Add policies

Now that Discovery has scanned your cloud account, you can check the resources it found against policies. In this step, you’ll apply the Pulumi Best Practices policy pack, a set of recommended security and governance controls that Pulumi publishes and maintains, in two ways:

• Audit: evaluate the resources Discovery found in your cloud account and report any violations.
• Preventative: evaluate a Pulumi stack’s resources during pulumi preview and pulumi up, before anything is deployed.

You don’t need to write any policy code. To write policies of your own later, see Write a policy pack.

Prerequisites

• The Discovery account you connected in the previous steps.
• For the preventative section: a Pulumi stack that deploys AWS resources, and Node.js installed on the machine where you run pulumi preview. Pulumi’s pre-built policy packs run on Node.js, whatever language your program uses.

Find the Pulumi Best Practices pack

In the Pulumi Cloud console, navigate to Governance > Policy configuration. The Policy Packs tab lists every policy pack available to your organization: the ones you’ve published, and the pre-built packs that Pulumi publishes for your edition. You don’t need to add Pulumi’s packs to your organization first.

Select Pulumi Best Practices for AWS to see the policies it contains, or see its reference page.

Audit your discovered resources

An audit policy group evaluates the resources in your cloud accounts and reports violations without blocking anything.

1. On the Policy configuration page, select the Policy Groups tab, then select Create audit policy group.
2. Enter a name, such as best-practices-audit.
3. Under Entities, select Choose accounts and select the Discovery account you connected, for example production.
4. Under Policy Packs, select Select policy packs and choose Pulumi Best Practices.
5. Keep the enforcement level at Advisory, then select Save Policy Group.

Policies evaluate each time Discovery scans the account. To see results now instead of waiting for the next scheduled scan, run a scan manually:

1. Navigate to Resources > Discovery.
2. Select the account, then select Actions, choose Scan, and select Run.

Review policy findings

When the scan finishes, navigate to Governance > Policy findings to see the results. The page has three tabs:

• Overview: compliance metrics across your accounts and policy packs.
• Compliance: the failing resources for each policy, organized by policy group.
• Issues: each violation as a work item that you can filter by policy, severity, resource type, or account, assign to a teammate, or hand to Pulumi Neo to fix.

Each issue shows the resource that failed, the policy it violated, and how to fix it. For more, see Review policy findings.

Prevent violations before deployment

Audit policies find problems after resources exist. A preventative policy group catches the same problems in Pulumi stacks before they’re deployed.

1. Navigate to Governance > Policy configuration, and on the Policy Groups tab, select Create preventative policy group.
2. Enter a name, such as best-practices-preventative.
3. Under Entities, select Choose stacks and select the stack you want to govern.
4. Under Policy Packs, select Select policy packs and choose Pulumi Best Practices.
5. Keep the enforcement level at Advisory, then select Save Policy Group.

Now run a preview of that stack:

pulumi preview

Pulumi downloads the policy pack and evaluates it against the resources your program declares. Any violations appear in the preview output as advisory warnings, and the preview still completes. With the mandatory enforcement level, available in the Pro and Enterprise editions, a violation would stop pulumi up before any resource changes. To choose between the two, see Choosing an enforcement level.

Next steps

• Policy groups: how audit and preventative groups work, and how to roll policies out across an organization.
• Use pre-built policy packs: the compliance-framework packs, such as CIS, PCI DSS, and HITRUST.
• Write a policy pack: write custom policies for your organization’s own rules.