1. Docs
  2. Secrets & Configuration
  3. Environments
  4. Environment Definition Syntax
  5. Reserved Properties
  6. policyConfig

policyConfig

    The policyConfig reserved property contains values that should be exported as configuration for Pulumi policy packs. When an ESC environment is attached to a policy pack in a policy group, the values under policyConfig are made available to the policy pack at runtime.

    Properties

    PropertyTypeDescription
    policyNameobjectConfiguration values for the policy named policyName
    packName:policyNameobjectConfiguration values for the policy named policyName in the pack named packName

    Keys can use either format:

    • policyName — when the ESC environment is associated with a single policy pack
    • packName:policyName — to scope configuration to a specific pack, following the same namespacing pattern as pulumiConfig

    Example

    Without pack namespace

    values:
  compliance:
    apiToken:
      fn::secret: xxxxxxxxxxxxxxxx

  policyConfig:
    cost-compliance:
      maxMonthlyCost: 5000
      apiEndpoint: https://compliance.example.com
      apiToken: ${compliance.apiToken}

    Evaluated result

    {
  "policyConfig": {
    "cost-compliance": {
      "maxMonthlyCost": 5000,
      "apiEndpoint": "https://compliance.example.com",
      "apiToken": "[secret]"
    }
  }
}

    With pack namespace

    values:
  policyConfig:
    my-compliance-pack:cost-compliance:
      maxMonthlyCost: 5000

    Evaluated result

    {
  "policyConfig": {
    "my-compliance-pack:cost-compliance": {
      "maxMonthlyCost": 5000
    }
  }
}