Pulumi policy as code
CrossGuard is Pulumi’s Policy as Code offering. CrossGuard empowers you to set guardrails to enforce compliance for resources so developers within an organization can provision their own infrastructure while sticking to best practices and security compliance. Using Policy as Code, you can write flexible business or security policies.
Using CrossGuard, organization administrators can apply these rules to particular stacks within their organization. When policies are executed as part of your Pulumi deployments, any violation will gate or block that update from proceeding. Policy remediations also allow you to automatically fix violations.
Learn more about Policy as Code core concepts.
|Open Policy Agent (OPA)
Compliance Ready Policy Packs
With Pulumi Compliance Ready Policies, you get a comprehensive set of predefined policies for AWS, Azure, Google, and Kubernetes, and an enhanced level of control and governance over your cloud resources. Learn more about Pulumi Compliance Ready Policies.
Pulumi CrossGuard policies for AWS (AWSGuard)
In addition to being able to implement your own CrossGuard policies, or use the Compliance Ready policies, we’ve also created a set of policies that codifies best practices for AWS that you can adopt and use in a Policy Pack. AWSGuard is a configurable library that you can use to enforce best practices for your own Pulumi stacks or organization. Learn more and get started with AWSGuard.
Configuring Policy Packs
Using configurable Policy Packs, you can write flexible policies that can be re-used across your organization. By default, some fields like enforcement level, are configurable. You may also specify configurable variables alongside each policy. Learn more about configurable Policy Packs.
If you’re looking for some example Policy Packs, take a look at these:
Get the answers to some Frequently Asked Questions about CrossGuard.