--- title: pulumi policy exception new | CLI commands url: /docs/iac/cli/commands/pulumi_policy_exception_new/ --- [EXPERIMENTAL] Create a policy exception from a run's violations ## Synopsis [EXPERIMENTAL] Create a policy exception from a run's violations. Reads the policy violations of the stack's latest run, update or preview, so you don't have to re-run it or copy URNs. In a terminal, you pick the violations to exempt and enter a reason. --policy, --target and --level narrow the violations to pick from, and --file reads a whole exception instead. Only mandatory violations are read unless --level says otherwise. The exception belongs to the Policy Pack named as or /; the organization defaults to the stack's. It gets one entry per resource, listing the resource's selected policies. Requesting the same exception again returns the existing one. When the organization requires approval for policy exceptions, or --draft is passed, the command creates a change request for the exception instead and submits it, with the reason as its description. The exception is created once the change request is approved and applied. With --expires-in, the exception is removed once it expires. The command prints a link to the exception, or to its change request. --output json prints the result, with the exception's ID, to stdout. --dry-run --output json prints the run's violations, with their URNs, and the exception the command would create, without creating it. For scripts and agents, pass --yes (or run without a terminal) to skip the picker: every violation the run didn't already exempt is included. --reason is then required unless --file has one, and so is the Policy Pack when the violations are from several. Check first with --dry-run --output json, edit the JSON if needed, and create it with --file -. ``` pulumi policy exception new [policy-pack] [flags] ``` ## Examples ``` # Pick from the violations of the current stack's latest run pulumi policy exception new aws-security # Exempt one policy on every resource that violated it, without prompting pulumi policy exception new aws-security --policy required-tags --reason "Shared buckets (LOG-31)" --yes # Include advisory violations, from update 12 instead of the latest run pulumi policy exception new aws-security --update=12 --level mandatory --level advisory --dry-run # Preview the exception as JSON, then create it from the edited output pulumi policy exception new aws-security -s web/prod --dry-run --output json > exc.json pulumi policy exception new aws-security --file exc.json --yes # Expire it after 30 days; with an approval gate this opens a change request instead pulumi policy exception new aws-security -s web/prod --policy s3-no-public-read \ --reason "LOG-31" --expires-in 30d --yes --output json # Request the exception in a change request, even if no approval is required pulumi policy exception new aws-security --policy required-tags --reason "LOG-31" --draft # See where violations are recorded, or the findings of a stack pulumi stack history events latest --event-type 9 --output json pulumi policy issue list ``` ## Options ``` --draft Request the exception in a change request, even if the organization doesn't require approval --dry-run Show the violations and the exception, without creating it --expires-in string Expire the exception this long after it's created, in days (7d) or hours (12h); by default it never expires --file string Read the exception from this JSON or YAML file, or from stdin with -; its policyPack is the default -h, --help help for new --level stringArray Only exempt violations of this enforcement level (mandatory, advisory, remediate or all); may be repeated (default [mandatory]) --output string Output format. Supported values are: default and json (default "default") --policy stringArray Only exempt violations of this policy; may be repeated --preview string[="latest"] Read the violations of a preview, as --preview= (default: the latest) --reason string Why it's safe to exempt the violations -s, --stack stringArray The stack whose violations to read; may be repeated. Defaults to the current stack --target stringArray Only exempt violations on this resource URN; may be repeated --update string[="latest"] Read the violations of an update, as --update= (default: the latest) -y, --yes Skip prompts and confirmation ``` ## Options inherited from parent commands ``` --color string Colorize output. Choices are: always, never, raw, auto (default "auto") -C, --cwd string Run pulumi as if it had been started in another directory --disable-integrity-checking Disable integrity checking of checkpoint files -e, --emoji Enable emojis in the output -Q, --fully-qualify-stack-names Show fully-qualified stack names --logflow Flow log settings to child processes (like plugins) --logtostderr Log to stderr instead of to files --memprofilerate int Enable more precise (and expensive) memory allocation profiles by setting runtime.MemProfileRate --non-interactive Disable interactive mode for all commands --otel-traces string Export OpenTelemetry traces to the specified endpoint. Use file:// for local JSON files, grpc:// or https:// for remote collectors --profiling string Emit CPU and memory profiles and an execution trace to '[filename].[pid].{cpu,mem,trace}', respectively --tracing file: Emit tracing to the specified endpoint. Use the file: scheme to write tracing data to a local file -v, --verbose int Enable verbose logging (e.g., v=3); anything >3 is very verbose ``` ## SEE ALSO * [pulumi policy exception](/docs/iac/cli/commands/pulumi_policy_exception/) - [EXPERIMENTAL] Manage policy exceptions