pulumiservice.api.PolicyGroup

Pulumi Cloud v1.5.0, Oct 19 26

Viewing docs for Pulumi Cloud v1.5.0
published on Monday, Oct 19, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-pulumiservice

Viewing docs for Pulumi Cloud v1.5.0
published on Monday, Oct 19, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-pulumiservice

Creates a new Policy Group for an organization. Policy Groups define which Policy Packs are enforced on which stacks or cloud accounts, with configurable enforcement levels (advisory, mandatory, or disabled) per pack. This allows different policy strictness for different environments, such as advisory-only in development and mandatory in production.

Create PolicyGroup Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new PolicyGroup(name: string, args: PolicyGroupArgs, opts?: CustomResourceOptions);

@overload
def PolicyGroup(resource_name: str,
                args: PolicyGroupArgs,
                opts: Optional[ResourceOptions] = None)

@overload
def PolicyGroup(resource_name: str,
                opts: Optional[ResourceOptions] = None,
                name: Optional[str] = None,
                org_name: Optional[str] = None,
                account_match_rule: Optional[Any] = None,
                agent_pool_id: Optional[str] = None,
                entity_type: Optional[str] = None,
                mode: Optional[str] = None,
                stack_match_rule: Optional[Any] = None)

func NewPolicyGroup(ctx *Context, name string, args PolicyGroupArgs, opts ...ResourceOption) (*PolicyGroup, error)

public PolicyGroup(string name, PolicyGroupArgs args, CustomResourceOptions? opts = null)

public PolicyGroup(String name, PolicyGroupArgs args)
public PolicyGroup(String name, PolicyGroupArgs args, CustomResourceOptions options)

type: pulumiservice:api:PolicyGroup
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

resource "pulumiservice_api_policy_group" "name" {
    # resource properties
}

Parameters

name string: The unique name of the resource.
args PolicyGroupArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args PolicyGroupArgs: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args PolicyGroupArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args PolicyGroupArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args PolicyGroupArgs: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var policyGroupResource = new PulumiService.Api.PolicyGroup("policyGroupResource", new()
{
    Name = "string",
    OrgName = "string",
    AccountMatchRule = "any",
    AgentPoolId = "string",
    EntityType = "string",
    Mode = "string",
    StackMatchRule = "any",
});

example, err := api.NewPolicyGroup(ctx, "policyGroupResource", &api.PolicyGroupArgs{
	Name:             pulumi.String("string"),
	OrgName:          pulumi.String("string"),
	AccountMatchRule: pulumi.Any("any"),
	AgentPoolId:      pulumi.String("string"),
	EntityType:       pulumi.String("string"),
	Mode:             pulumi.String("string"),
	StackMatchRule:   pulumi.Any("any"),
})

resource "pulumiservice_api_policy_group" "policyGroupResource" {
  lifecycle {
    create_before_destroy = true
  }
  name               = "string"
  org_name           = "string"
  account_match_rule = "any"
  agent_pool_id      = "string"
  entity_type        = "string"
  mode               = "string"
  stack_match_rule   = "any"
}

var policyGroupResource = new com.pulumi.pulumiservice.api.PolicyGroup("policyGroupResource", com.pulumi.pulumiservice.api.PolicyGroupArgs.builder()
    .name("string")
    .orgName("string")
    .accountMatchRule("any")
    .agentPoolId("string")
    .entityType("string")
    .mode("string")
    .stackMatchRule("any")
    .build());

policy_group_resource = pulumiservice.api.PolicyGroup("policyGroupResource",
    name="string",
    org_name="string",
    account_match_rule="any",
    agent_pool_id="string",
    entity_type="string",
    mode="string",
    stack_match_rule="any")

const policyGroupResource = new pulumiservice.api.PolicyGroup("policyGroupResource", {
    name: "string",
    orgName: "string",
    accountMatchRule: "any",
    agentPoolId: "string",
    entityType: "string",
    mode: "string",
    stackMatchRule: "any",
});

type: pulumiservice:api:PolicyGroup
properties:
    accountMatchRule: any
    agentPoolId: string
    entityType: string
    mode: string
    name: string
    orgName: string
    stackMatchRule: any

PolicyGroup Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The PolicyGroup resource accepts the following input properties:

Name string: The name of the new policy group. Up to 100 characters, made up of letters, numbers, hyphens, underscores, periods, or spaces, and may not begin or end with a space.
OrgName string: The organization name
AccountMatchRule object: Preview: an account match rule to create the group with, a boolean expression over Insights account tags. Requires the tag-based policy groups feature; not allowed on preventative groups.
AgentPoolId string: Agent pool ID for policy evaluation. Defaults to Pulumi hosted pool if not specified.
EntityType string: Deprecated: a legacy label, stacks or accounts. When mode is omitted it picks the mode (accounts → audit, stacks → preventative). When this is omitted, it is derived from mode. It does not restrict which entities the group can hold.
Mode string: The enforcement mode for the policy group (audit or preventative). The mode decides what the group can hold: an audit group holds stacks and Insights accounts, a preventative group holds stacks only. Required unless the deprecated entityType is sent. Fixed at creation; it cannot be changed later.
StackMatchRule object: Preview: a stack match rule to create the group with, a boolean expression over stack tags. Requires the tag-based policy groups feature.

Name string: The name of the new policy group. Up to 100 characters, made up of letters, numbers, hyphens, underscores, periods, or spaces, and may not begin or end with a space.
OrgName string: The organization name
AccountMatchRule interface{}: Preview: an account match rule to create the group with, a boolean expression over Insights account tags. Requires the tag-based policy groups feature; not allowed on preventative groups.
AgentPoolId string: Agent pool ID for policy evaluation. Defaults to Pulumi hosted pool if not specified.
EntityType string: Deprecated: a legacy label, stacks or accounts. When mode is omitted it picks the mode (accounts → audit, stacks → preventative). When this is omitted, it is derived from mode. It does not restrict which entities the group can hold.
Mode string: The enforcement mode for the policy group (audit or preventative). The mode decides what the group can hold: an audit group holds stacks and Insights accounts, a preventative group holds stacks only. Required unless the deprecated entityType is sent. Fixed at creation; it cannot be changed later.
StackMatchRule interface{}: Preview: a stack match rule to create the group with, a boolean expression over stack tags. Requires the tag-based policy groups feature.

name string: The name of the new policy group. Up to 100 characters, made up of letters, numbers, hyphens, underscores, periods, or spaces, and may not begin or end with a space.
org_name string: The organization name
account_match_rule any: Preview: an account match rule to create the group with, a boolean expression over Insights account tags. Requires the tag-based policy groups feature; not allowed on preventative groups.
agent_pool_id string: Agent pool ID for policy evaluation. Defaults to Pulumi hosted pool if not specified.
entity_type string: Deprecated: a legacy label, stacks or accounts. When mode is omitted it picks the mode (accounts → audit, stacks → preventative). When this is omitted, it is derived from mode. It does not restrict which entities the group can hold.
mode string: The enforcement mode for the policy group (audit or preventative). The mode decides what the group can hold: an audit group holds stacks and Insights accounts, a preventative group holds stacks only. Required unless the deprecated entityType is sent. Fixed at creation; it cannot be changed later.
stack_match_rule any: Preview: a stack match rule to create the group with, a boolean expression over stack tags. Requires the tag-based policy groups feature.

name String: The name of the new policy group. Up to 100 characters, made up of letters, numbers, hyphens, underscores, periods, or spaces, and may not begin or end with a space.
orgName String: The organization name
accountMatchRule Object: Preview: an account match rule to create the group with, a boolean expression over Insights account tags. Requires the tag-based policy groups feature; not allowed on preventative groups.
agentPoolId String: Agent pool ID for policy evaluation. Defaults to Pulumi hosted pool if not specified.
entityType String: Deprecated: a legacy label, stacks or accounts. When mode is omitted it picks the mode (accounts → audit, stacks → preventative). When this is omitted, it is derived from mode. It does not restrict which entities the group can hold.
mode String: The enforcement mode for the policy group (audit or preventative). The mode decides what the group can hold: an audit group holds stacks and Insights accounts, a preventative group holds stacks only. Required unless the deprecated entityType is sent. Fixed at creation; it cannot be changed later.
stackMatchRule Object: Preview: a stack match rule to create the group with, a boolean expression over stack tags. Requires the tag-based policy groups feature.

name string: The name of the new policy group. Up to 100 characters, made up of letters, numbers, hyphens, underscores, periods, or spaces, and may not begin or end with a space.
orgName string: The organization name
accountMatchRule any: Preview: an account match rule to create the group with, a boolean expression over Insights account tags. Requires the tag-based policy groups feature; not allowed on preventative groups.
agentPoolId string: Agent pool ID for policy evaluation. Defaults to Pulumi hosted pool if not specified.
entityType string: Deprecated: a legacy label, stacks or accounts. When mode is omitted it picks the mode (accounts → audit, stacks → preventative). When this is omitted, it is derived from mode. It does not restrict which entities the group can hold.
mode string: The enforcement mode for the policy group (audit or preventative). The mode decides what the group can hold: an audit group holds stacks and Insights accounts, a preventative group holds stacks only. Required unless the deprecated entityType is sent. Fixed at creation; it cannot be changed later.
stackMatchRule any: Preview: a stack match rule to create the group with, a boolean expression over stack tags. Requires the tag-based policy groups feature.

name str: The name of the new policy group. Up to 100 characters, made up of letters, numbers, hyphens, underscores, periods, or spaces, and may not begin or end with a space.
org_name str: The organization name
account_match_rule Any: Preview: an account match rule to create the group with, a boolean expression over Insights account tags. Requires the tag-based policy groups feature; not allowed on preventative groups.
agent_pool_id str: Agent pool ID for policy evaluation. Defaults to Pulumi hosted pool if not specified.
entity_type str: Deprecated: a legacy label, stacks or accounts. When mode is omitted it picks the mode (accounts → audit, stacks → preventative). When this is omitted, it is derived from mode. It does not restrict which entities the group can hold.
mode str: The enforcement mode for the policy group (audit or preventative). The mode decides what the group can hold: an audit group holds stacks and Insights accounts, a preventative group holds stacks only. Required unless the deprecated entityType is sent. Fixed at creation; it cannot be changed later.
stack_match_rule Any: Preview: a stack match rule to create the group with, a boolean expression over stack tags. Requires the tag-based policy groups feature.

name String: The name of the new policy group. Up to 100 characters, made up of letters, numbers, hyphens, underscores, periods, or spaces, and may not begin or end with a space.
orgName String: The organization name
accountMatchRule Any: Preview: an account match rule to create the group with, a boolean expression over Insights account tags. Requires the tag-based policy groups feature; not allowed on preventative groups.
agentPoolId String: Agent pool ID for policy evaluation. Defaults to Pulumi hosted pool if not specified.
entityType String: Deprecated: a legacy label, stacks or accounts. When mode is omitted it picks the mode (accounts → audit, stacks → preventative). When this is omitted, it is derived from mode. It does not restrict which entities the group can hold.
mode String: The enforcement mode for the policy group (audit or preventative). The mode decides what the group can hold: an audit group holds stacks and Insights accounts, a preventative group holds stacks only. Required unless the deprecated entityType is sent. Fixed at creation; it cannot be changed later.
stackMatchRule Any: Preview: a stack match rule to create the group with, a boolean expression over stack tags. Requires the tag-based policy groups feature.

Outputs

All input properties are implicitly available as output properties. Additionally, the PolicyGroup resource produces the following output properties:

Accounts List<string>: The Insights accounts added to this policy group individually, with addInsightsAccount.
AppliedPolicyPacks List<object>: List of policy packs that are applied to this policy group.
Id string: The provider-assigned unique ID for this managed resource.
IsOrgDefault bool: True if this is either the default stacks or default accounts policy group for the organization.
Stacks List<object>: The stacks added to this policy group individually, with addStack.

Accounts []string: The Insights accounts added to this policy group individually, with addInsightsAccount.
AppliedPolicyPacks []interface{}: List of policy packs that are applied to this policy group.
Id string: The provider-assigned unique ID for this managed resource.
IsOrgDefault bool: True if this is either the default stacks or default accounts policy group for the organization.
Stacks []interface{}: The stacks added to this policy group individually, with addStack.

accounts list(string): The Insights accounts added to this policy group individually, with addInsightsAccount.
applied_policy_packs list(any): List of policy packs that are applied to this policy group.
id string: The provider-assigned unique ID for this managed resource.
is_org_default bool: True if this is either the default stacks or default accounts policy group for the organization.
stacks list(any): The stacks added to this policy group individually, with addStack.

accounts List<String>: The Insights accounts added to this policy group individually, with addInsightsAccount.
appliedPolicyPacks List<Object>: List of policy packs that are applied to this policy group.
id String: The provider-assigned unique ID for this managed resource.
isOrgDefault Boolean: True if this is either the default stacks or default accounts policy group for the organization.
stacks List<Object>: The stacks added to this policy group individually, with addStack.

accounts string[]: The Insights accounts added to this policy group individually, with addInsightsAccount.
appliedPolicyPacks any[]: List of policy packs that are applied to this policy group.
id string: The provider-assigned unique ID for this managed resource.
isOrgDefault boolean: True if this is either the default stacks or default accounts policy group for the organization.
stacks any[]: The stacks added to this policy group individually, with addStack.

accounts Sequence[str]: The Insights accounts added to this policy group individually, with addInsightsAccount.
applied_policy_packs Sequence[Any]: List of policy packs that are applied to this policy group.
id str: The provider-assigned unique ID for this managed resource.
is_org_default bool: True if this is either the default stacks or default accounts policy group for the organization.
stacks Sequence[Any]: The stacks added to this policy group individually, with addStack.

accounts List<String>: The Insights accounts added to this policy group individually, with addInsightsAccount.
appliedPolicyPacks List<Any>: List of policy packs that are applied to this policy group.
id String: The provider-assigned unique ID for this managed resource.
isOrgDefault Boolean: True if this is either the default stacks or default accounts policy group for the organization.
stacks List<Any>: The stacks added to this policy group individually, with addStack.

Package Details

Repository: pulumiservice pulumi/pulumi-pulumiservice
License: Apache-2.0

Viewing docs for Pulumi Cloud v1.5.0
published on Monday, Oct 19, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-pulumiservice

pulumiservice.api.PolicyGroup

On this page

On this page

Create PolicyGroup Resource

Constructor syntax

Parameters

Constructor example

PolicyGroup Resource Properties

Inputs

Outputs

Package Details

On this page

On this page

Try Pulumi Cloud free.
Your team will thank you.

pulumiservice.api.PolicyGroup

On this page

On this page

Create PolicyGroup Resource

Constructor syntax

Parameters

Constructor example

PolicyGroup Resource Properties

Inputs

Outputs

Package Details

On this page

On this page

Try Pulumi Cloud free.Your team will thank you.

Try Pulumi Cloud free.
Your team will thank you.