thoth.governance.PolicyBundle

Thoth v0.1.15, Jul 23 26

Viewing docs for Thoth v0.1.15
published on Thursday, Jul 23, 2026 by Aten Security

Schema (JSON)

atensecurity/pulumi-thoth

Viewing docs for Thoth v0.1.15
published on Thursday, Jul 23, 2026 by Aten Security

Schema (JSON)

atensecurity/pulumi-thoth

Create PolicyBundle Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new PolicyBundle(name: string, args: PolicyBundleArgs, opts?: CustomResourceOptions);

@overload
def PolicyBundle(resource_name: str,
                 args: PolicyBundleArgs,
                 opts: Optional[ResourceOptions] = None)

@overload
def PolicyBundle(resource_name: str,
                 opts: Optional[ResourceOptions] = None,
                 framework: Optional[str] = None,
                 name: Optional[str] = None,
                 assignments: Optional[Sequence[str]] = None,
                 description: Optional[str] = None,
                 enforcement_mode: Optional[str] = None,
                 expected_hash: Optional[str] = None,
                 raw_policy: Optional[str] = None,
                 s3_uri: Optional[str] = None,
                 s3_version_id: Optional[str] = None,
                 source_uri: Optional[str] = None,
                 status: Optional[str] = None)

func NewPolicyBundle(ctx *Context, name string, args PolicyBundleArgs, opts ...ResourceOption) (*PolicyBundle, error)

public PolicyBundle(string name, PolicyBundleArgs args, CustomResourceOptions? opts = null)

public PolicyBundle(String name, PolicyBundleArgs args)
public PolicyBundle(String name, PolicyBundleArgs args, CustomResourceOptions options)

type: thoth:governance:PolicyBundle
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

resource "thoth_governance_policy_bundle" "name" {
    # resource properties
}

Parameters

name string: The unique name of the resource.
args PolicyBundleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args PolicyBundleArgs: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args PolicyBundleArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args PolicyBundleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args PolicyBundleArgs: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var policyBundleResource = new Thoth.Governance.PolicyBundle("policyBundleResource", new()
{
    Framework = "string",
    Name = "string",
    Assignments = new[]
    {
        "string",
    },
    Description = "string",
    EnforcementMode = "string",
    ExpectedHash = "string",
    RawPolicy = "string",
    S3Uri = "string",
    S3VersionId = "string",
    SourceUri = "string",
    Status = "string",
});

example, err := governance.NewPolicyBundle(ctx, "policyBundleResource", &governance.PolicyBundleArgs{
	Framework: pulumi.String("string"),
	Name:      pulumi.String("string"),
	Assignments: pulumi.StringArray{
		pulumi.String("string"),
	},
	Description:     pulumi.String("string"),
	EnforcementMode: pulumi.String("string"),
	ExpectedHash:    pulumi.String("string"),
	RawPolicy:       pulumi.String("string"),
	S3Uri:           pulumi.String("string"),
	S3VersionId:     pulumi.String("string"),
	SourceUri:       pulumi.String("string"),
	Status:          pulumi.String("string"),
})

resource "thoth_governance_policy_bundle" "policyBundleResource" {
  lifecycle {
    create_before_destroy = true
  }
  framework        = "string"
  name             = "string"
  assignments      = ["string"]
  description      = "string"
  enforcement_mode = "string"
  expected_hash    = "string"
  raw_policy       = "string"
  s3_uri           = "string"
  s3_version_id    = "string"
  source_uri       = "string"
  status           = "string"
}

var policyBundleResource = new PolicyBundle("policyBundleResource", PolicyBundleArgs.builder()
    .framework("string")
    .name("string")
    .assignments("string")
    .description("string")
    .enforcementMode("string")
    .expectedHash("string")
    .rawPolicy("string")
    .s3Uri("string")
    .s3VersionId("string")
    .sourceUri("string")
    .status("string")
    .build());

policy_bundle_resource = thoth.governance.PolicyBundle("policyBundleResource",
    framework="string",
    name="string",
    assignments=["string"],
    description="string",
    enforcement_mode="string",
    expected_hash="string",
    raw_policy="string",
    s3_uri="string",
    s3_version_id="string",
    source_uri="string",
    status="string")

const policyBundleResource = new thoth.governance.PolicyBundle("policyBundleResource", {
    framework: "string",
    name: "string",
    assignments: ["string"],
    description: "string",
    enforcementMode: "string",
    expectedHash: "string",
    rawPolicy: "string",
    s3Uri: "string",
    s3VersionId: "string",
    sourceUri: "string",
    status: "string",
});

type: thoth:governance:PolicyBundle
properties:
    assignments:
        - string
    description: string
    enforcementMode: string
    expectedHash: string
    framework: string
    name: string
    rawPolicy: string
    s3Uri: string
    s3VersionId: string
    sourceUri: string
    status: string

PolicyBundle Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The PolicyBundle resource accepts the following input properties:

Framework string: Policy framework: OPA or CEDAR.
Name string: Stable bundle name. Updates create a new version for the same name.
Assignments List<string>: Assignment targets (for example: all, agent:security-analyst-agent, coding-agent). Defaults to all.
Description string: Optional policy bundle description.
EnforcementMode string: Customer-facing policy mode: enforce or observe. Defaults to enforce.
ExpectedHash string: Optional expected SHA-256 hash (hex or sha256:) to enforce policy integrity.
RawPolicy string: Raw Rego/Cedar policy payload. Set this or source_uri/s3_uri.
S3Uri string: Legacy S3 source URI (for example: s3://bucket/path/policy.rego). Set this or raw_policy. Prefer source_uri.
S3VersionId string: Optional S3 object version ID to pin deterministic policy enforcement.
SourceUri string: Unified policy source URI (file:// or s3://). Set this or raw_policy.
Status string: Bundle lifecycle status: active, staged, paused, or disabled (alias of paused).

Framework string: Policy framework: OPA or CEDAR.
Name string: Stable bundle name. Updates create a new version for the same name.
Assignments []string: Assignment targets (for example: all, agent:security-analyst-agent, coding-agent). Defaults to all.
Description string: Optional policy bundle description.
EnforcementMode string: Customer-facing policy mode: enforce or observe. Defaults to enforce.
ExpectedHash string: Optional expected SHA-256 hash (hex or sha256:) to enforce policy integrity.
RawPolicy string: Raw Rego/Cedar policy payload. Set this or source_uri/s3_uri.
S3Uri string: Legacy S3 source URI (for example: s3://bucket/path/policy.rego). Set this or raw_policy. Prefer source_uri.
S3VersionId string: Optional S3 object version ID to pin deterministic policy enforcement.
SourceUri string: Unified policy source URI (file:// or s3://). Set this or raw_policy.
Status string: Bundle lifecycle status: active, staged, paused, or disabled (alias of paused).

framework string: Policy framework: OPA or CEDAR.
name string: Stable bundle name. Updates create a new version for the same name.
assignments list(string): Assignment targets (for example: all, agent:security-analyst-agent, coding-agent). Defaults to all.
description string: Optional policy bundle description.
enforcement_mode string: Customer-facing policy mode: enforce or observe. Defaults to enforce.
expected_hash string: Optional expected SHA-256 hash (hex or sha256:) to enforce policy integrity.
raw_policy string: Raw Rego/Cedar policy payload. Set this or source_uri/s3_uri.
s3_uri string: Legacy S3 source URI (for example: s3://bucket/path/policy.rego). Set this or raw_policy. Prefer source_uri.
s3_version_id string: Optional S3 object version ID to pin deterministic policy enforcement.
source_uri string: Unified policy source URI (file:// or s3://). Set this or raw_policy.
status string: Bundle lifecycle status: active, staged, paused, or disabled (alias of paused).

framework String: Policy framework: OPA or CEDAR.
name String: Stable bundle name. Updates create a new version for the same name.
assignments List<String>: Assignment targets (for example: all, agent:security-analyst-agent, coding-agent). Defaults to all.
description String: Optional policy bundle description.
enforcementMode String: Customer-facing policy mode: enforce or observe. Defaults to enforce.
expectedHash String: Optional expected SHA-256 hash (hex or sha256:) to enforce policy integrity.
rawPolicy String: Raw Rego/Cedar policy payload. Set this or source_uri/s3_uri.
s3Uri String: Legacy S3 source URI (for example: s3://bucket/path/policy.rego). Set this or raw_policy. Prefer source_uri.
s3VersionId String: Optional S3 object version ID to pin deterministic policy enforcement.
sourceUri String: Unified policy source URI (file:// or s3://). Set this or raw_policy.
status String: Bundle lifecycle status: active, staged, paused, or disabled (alias of paused).

framework string: Policy framework: OPA or CEDAR.
name string: Stable bundle name. Updates create a new version for the same name.
assignments string[]: Assignment targets (for example: all, agent:security-analyst-agent, coding-agent). Defaults to all.
description string: Optional policy bundle description.
enforcementMode string: Customer-facing policy mode: enforce or observe. Defaults to enforce.
expectedHash string: Optional expected SHA-256 hash (hex or sha256:) to enforce policy integrity.
rawPolicy string: Raw Rego/Cedar policy payload. Set this or source_uri/s3_uri.
s3Uri string: Legacy S3 source URI (for example: s3://bucket/path/policy.rego). Set this or raw_policy. Prefer source_uri.
s3VersionId string: Optional S3 object version ID to pin deterministic policy enforcement.
sourceUri string: Unified policy source URI (file:// or s3://). Set this or raw_policy.
status string: Bundle lifecycle status: active, staged, paused, or disabled (alias of paused).

framework str: Policy framework: OPA or CEDAR.
name str: Stable bundle name. Updates create a new version for the same name.
assignments Sequence[str]: Assignment targets (for example: all, agent:security-analyst-agent, coding-agent). Defaults to all.
description str: Optional policy bundle description.
enforcement_mode str: Customer-facing policy mode: enforce or observe. Defaults to enforce.
expected_hash str: Optional expected SHA-256 hash (hex or sha256:) to enforce policy integrity.
raw_policy str: Raw Rego/Cedar policy payload. Set this or source_uri/s3_uri.
s3_uri str: Legacy S3 source URI (for example: s3://bucket/path/policy.rego). Set this or raw_policy. Prefer source_uri.
s3_version_id str: Optional S3 object version ID to pin deterministic policy enforcement.
source_uri str: Unified policy source URI (file:// or s3://). Set this or raw_policy.
status str: Bundle lifecycle status: active, staged, paused, or disabled (alias of paused).

framework String: Policy framework: OPA or CEDAR.
name String: Stable bundle name. Updates create a new version for the same name.
assignments List<String>: Assignment targets (for example: all, agent:security-analyst-agent, coding-agent). Defaults to all.
description String: Optional policy bundle description.
enforcementMode String: Customer-facing policy mode: enforce or observe. Defaults to enforce.
expectedHash String: Optional expected SHA-256 hash (hex or sha256:) to enforce policy integrity.
rawPolicy String: Raw Rego/Cedar policy payload. Set this or source_uri/s3_uri.
s3Uri String: Legacy S3 source URI (for example: s3://bucket/path/policy.rego). Set this or raw_policy. Prefer source_uri.
s3VersionId String: Optional S3 object version ID to pin deterministic policy enforcement.
sourceUri String: Unified policy source URI (file:// or s3://). Set this or raw_policy.
status String: Bundle lifecycle status: active, staged, paused, or disabled (alias of paused).

Outputs

All input properties are implicitly available as output properties. Additionally, the PolicyBundle resource produces the following output properties:

CreatedAt string: Creation timestamp.
CreatedBy string: Creator identity.
Id string: The provider-assigned unique ID for this managed resource.
PolicyHash string: SHA-256 hash of policy content.
ResolvedVersion string: Resolved immutable source version (S3 version ID or file revision hint).
TenantId string: Tenant ID from provider configuration.
UpdatedAt string: Last update timestamp.
Version int: Monotonic policy bundle version.

CreatedAt string: Creation timestamp.
CreatedBy string: Creator identity.
Id string: The provider-assigned unique ID for this managed resource.
PolicyHash string: SHA-256 hash of policy content.
ResolvedVersion string: Resolved immutable source version (S3 version ID or file revision hint).
TenantId string: Tenant ID from provider configuration.
UpdatedAt string: Last update timestamp.
Version int: Monotonic policy bundle version.

created_at string: Creation timestamp.
created_by string: Creator identity.
id string: The provider-assigned unique ID for this managed resource.
policy_hash string: SHA-256 hash of policy content.
resolved_version string: Resolved immutable source version (S3 version ID or file revision hint).
tenant_id string: Tenant ID from provider configuration.
updated_at string: Last update timestamp.
version number: Monotonic policy bundle version.

createdAt String: Creation timestamp.
createdBy String: Creator identity.
id String: The provider-assigned unique ID for this managed resource.
policyHash String: SHA-256 hash of policy content.
resolvedVersion String: Resolved immutable source version (S3 version ID or file revision hint).
tenantId String: Tenant ID from provider configuration.
updatedAt String: Last update timestamp.
version Integer: Monotonic policy bundle version.

createdAt string: Creation timestamp.
createdBy string: Creator identity.
id string: The provider-assigned unique ID for this managed resource.
policyHash string: SHA-256 hash of policy content.
resolvedVersion string: Resolved immutable source version (S3 version ID or file revision hint).
tenantId string: Tenant ID from provider configuration.
updatedAt string: Last update timestamp.
version number: Monotonic policy bundle version.

created_at str: Creation timestamp.
created_by str: Creator identity.
id str: The provider-assigned unique ID for this managed resource.
policy_hash str: SHA-256 hash of policy content.
resolved_version str: Resolved immutable source version (S3 version ID or file revision hint).
tenant_id str: Tenant ID from provider configuration.
updated_at str: Last update timestamp.
version int: Monotonic policy bundle version.

createdAt String: Creation timestamp.
createdBy String: Creator identity.
id String: The provider-assigned unique ID for this managed resource.
policyHash String: SHA-256 hash of policy content.
resolvedVersion String: Resolved immutable source version (S3 version ID or file revision hint).
tenantId String: Tenant ID from provider configuration.
updatedAt String: Last update timestamp.
version Number: Monotonic policy bundle version.

Look up Existing PolicyBundle Resource

Get an existing PolicyBundle resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: PolicyBundleState, opts?: CustomResourceOptions): PolicyBundle

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        assignments: Optional[Sequence[str]] = None,
        created_at: Optional[str] = None,
        created_by: Optional[str] = None,
        description: Optional[str] = None,
        enforcement_mode: Optional[str] = None,
        expected_hash: Optional[str] = None,
        framework: Optional[str] = None,
        name: Optional[str] = None,
        policy_hash: Optional[str] = None,
        raw_policy: Optional[str] = None,
        resolved_version: Optional[str] = None,
        s3_uri: Optional[str] = None,
        s3_version_id: Optional[str] = None,
        source_uri: Optional[str] = None,
        status: Optional[str] = None,
        tenant_id: Optional[str] = None,
        updated_at: Optional[str] = None,
        version: Optional[int] = None) -> PolicyBundle

func GetPolicyBundle(ctx *Context, name string, id IDInput, state *PolicyBundleState, opts ...ResourceOption) (*PolicyBundle, error)

public static PolicyBundle Get(string name, Input<string> id, PolicyBundleState? state, CustomResourceOptions? opts = null)

public static PolicyBundle get(String name, Output<String> id, PolicyBundleState state, CustomResourceOptions options)

resources:  _:    type: thoth:governance:PolicyBundle    get:      id: ${id}

import {
  to = thoth_governance_policy_bundle.example
  id = "${id}"
}

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

Assignments List<string>: Assignment targets (for example: all, agent:security-analyst-agent, coding-agent). Defaults to all.
CreatedAt string: Creation timestamp.
CreatedBy string: Creator identity.
Description string: Optional policy bundle description.
EnforcementMode string: Customer-facing policy mode: enforce or observe. Defaults to enforce.
ExpectedHash string: Optional expected SHA-256 hash (hex or sha256:) to enforce policy integrity.
Framework string: Policy framework: OPA or CEDAR.
Name string: Stable bundle name. Updates create a new version for the same name.
PolicyHash string: SHA-256 hash of policy content.
RawPolicy string: Raw Rego/Cedar policy payload. Set this or source_uri/s3_uri.
ResolvedVersion string: Resolved immutable source version (S3 version ID or file revision hint).
S3Uri string: Legacy S3 source URI (for example: s3://bucket/path/policy.rego). Set this or raw_policy. Prefer source_uri.
S3VersionId string: Optional S3 object version ID to pin deterministic policy enforcement.
SourceUri string: Unified policy source URI (file:// or s3://). Set this or raw_policy.
Status string: Bundle lifecycle status: active, staged, paused, or disabled (alias of paused).
TenantId string: Tenant ID from provider configuration.
UpdatedAt string: Last update timestamp.
Version int: Monotonic policy bundle version.

Assignments []string: Assignment targets (for example: all, agent:security-analyst-agent, coding-agent). Defaults to all.
CreatedAt string: Creation timestamp.
CreatedBy string: Creator identity.
Description string: Optional policy bundle description.
EnforcementMode string: Customer-facing policy mode: enforce or observe. Defaults to enforce.
ExpectedHash string: Optional expected SHA-256 hash (hex or sha256:) to enforce policy integrity.
Framework string: Policy framework: OPA or CEDAR.
Name string: Stable bundle name. Updates create a new version for the same name.
PolicyHash string: SHA-256 hash of policy content.
RawPolicy string: Raw Rego/Cedar policy payload. Set this or source_uri/s3_uri.
ResolvedVersion string: Resolved immutable source version (S3 version ID or file revision hint).
S3Uri string: Legacy S3 source URI (for example: s3://bucket/path/policy.rego). Set this or raw_policy. Prefer source_uri.
S3VersionId string: Optional S3 object version ID to pin deterministic policy enforcement.
SourceUri string: Unified policy source URI (file:// or s3://). Set this or raw_policy.
Status string: Bundle lifecycle status: active, staged, paused, or disabled (alias of paused).
TenantId string: Tenant ID from provider configuration.
UpdatedAt string: Last update timestamp.
Version int: Monotonic policy bundle version.

assignments list(string): Assignment targets (for example: all, agent:security-analyst-agent, coding-agent). Defaults to all.
created_at string: Creation timestamp.
created_by string: Creator identity.
description string: Optional policy bundle description.
enforcement_mode string: Customer-facing policy mode: enforce or observe. Defaults to enforce.
expected_hash string: Optional expected SHA-256 hash (hex or sha256:) to enforce policy integrity.
framework string: Policy framework: OPA or CEDAR.
name string: Stable bundle name. Updates create a new version for the same name.
policy_hash string: SHA-256 hash of policy content.
raw_policy string: Raw Rego/Cedar policy payload. Set this or source_uri/s3_uri.
resolved_version string: Resolved immutable source version (S3 version ID or file revision hint).
s3_uri string: Legacy S3 source URI (for example: s3://bucket/path/policy.rego). Set this or raw_policy. Prefer source_uri.
s3_version_id string: Optional S3 object version ID to pin deterministic policy enforcement.
source_uri string: Unified policy source URI (file:// or s3://). Set this or raw_policy.
status string: Bundle lifecycle status: active, staged, paused, or disabled (alias of paused).
tenant_id string: Tenant ID from provider configuration.
updated_at string: Last update timestamp.
version number: Monotonic policy bundle version.

assignments List<String>: Assignment targets (for example: all, agent:security-analyst-agent, coding-agent). Defaults to all.
createdAt String: Creation timestamp.
createdBy String: Creator identity.
description String: Optional policy bundle description.
enforcementMode String: Customer-facing policy mode: enforce or observe. Defaults to enforce.
expectedHash String: Optional expected SHA-256 hash (hex or sha256:) to enforce policy integrity.
framework String: Policy framework: OPA or CEDAR.
name String: Stable bundle name. Updates create a new version for the same name.
policyHash String: SHA-256 hash of policy content.
rawPolicy String: Raw Rego/Cedar policy payload. Set this or source_uri/s3_uri.
resolvedVersion String: Resolved immutable source version (S3 version ID or file revision hint).
s3Uri String: Legacy S3 source URI (for example: s3://bucket/path/policy.rego). Set this or raw_policy. Prefer source_uri.
s3VersionId String: Optional S3 object version ID to pin deterministic policy enforcement.
sourceUri String: Unified policy source URI (file:// or s3://). Set this or raw_policy.
status String: Bundle lifecycle status: active, staged, paused, or disabled (alias of paused).
tenantId String: Tenant ID from provider configuration.
updatedAt String: Last update timestamp.
version Integer: Monotonic policy bundle version.

assignments string[]: Assignment targets (for example: all, agent:security-analyst-agent, coding-agent). Defaults to all.
createdAt string: Creation timestamp.
createdBy string: Creator identity.
description string: Optional policy bundle description.
enforcementMode string: Customer-facing policy mode: enforce or observe. Defaults to enforce.
expectedHash string: Optional expected SHA-256 hash (hex or sha256:) to enforce policy integrity.
framework string: Policy framework: OPA or CEDAR.
name string: Stable bundle name. Updates create a new version for the same name.
policyHash string: SHA-256 hash of policy content.
rawPolicy string: Raw Rego/Cedar policy payload. Set this or source_uri/s3_uri.
resolvedVersion string: Resolved immutable source version (S3 version ID or file revision hint).
s3Uri string: Legacy S3 source URI (for example: s3://bucket/path/policy.rego). Set this or raw_policy. Prefer source_uri.
s3VersionId string: Optional S3 object version ID to pin deterministic policy enforcement.
sourceUri string: Unified policy source URI (file:// or s3://). Set this or raw_policy.
status string: Bundle lifecycle status: active, staged, paused, or disabled (alias of paused).
tenantId string: Tenant ID from provider configuration.
updatedAt string: Last update timestamp.
version number: Monotonic policy bundle version.

assignments Sequence[str]: Assignment targets (for example: all, agent:security-analyst-agent, coding-agent). Defaults to all.
created_at str: Creation timestamp.
created_by str: Creator identity.
description str: Optional policy bundle description.
enforcement_mode str: Customer-facing policy mode: enforce or observe. Defaults to enforce.
expected_hash str: Optional expected SHA-256 hash (hex or sha256:) to enforce policy integrity.
framework str: Policy framework: OPA or CEDAR.
name str: Stable bundle name. Updates create a new version for the same name.
policy_hash str: SHA-256 hash of policy content.
raw_policy str: Raw Rego/Cedar policy payload. Set this or source_uri/s3_uri.
resolved_version str: Resolved immutable source version (S3 version ID or file revision hint).
s3_uri str: Legacy S3 source URI (for example: s3://bucket/path/policy.rego). Set this or raw_policy. Prefer source_uri.
s3_version_id str: Optional S3 object version ID to pin deterministic policy enforcement.
source_uri str: Unified policy source URI (file:// or s3://). Set this or raw_policy.
status str: Bundle lifecycle status: active, staged, paused, or disabled (alias of paused).
tenant_id str: Tenant ID from provider configuration.
updated_at str: Last update timestamp.
version int: Monotonic policy bundle version.

assignments List<String>: Assignment targets (for example: all, agent:security-analyst-agent, coding-agent). Defaults to all.
createdAt String: Creation timestamp.
createdBy String: Creator identity.
description String: Optional policy bundle description.
enforcementMode String: Customer-facing policy mode: enforce or observe. Defaults to enforce.
expectedHash String: Optional expected SHA-256 hash (hex or sha256:) to enforce policy integrity.
framework String: Policy framework: OPA or CEDAR.
name String: Stable bundle name. Updates create a new version for the same name.
policyHash String: SHA-256 hash of policy content.
rawPolicy String: Raw Rego/Cedar policy payload. Set this or source_uri/s3_uri.
resolvedVersion String: Resolved immutable source version (S3 version ID or file revision hint).
s3Uri String: Legacy S3 source URI (for example: s3://bucket/path/policy.rego). Set this or raw_policy. Prefer source_uri.
s3VersionId String: Optional S3 object version ID to pin deterministic policy enforcement.
sourceUri String: Unified policy source URI (file:// or s3://). Set this or raw_policy.
status String: Bundle lifecycle status: active, staged, paused, or disabled (alias of paused).
tenantId String: Tenant ID from provider configuration.
updatedAt String: Last update timestamp.
version Number: Monotonic policy bundle version.

Package Details

Repository: thoth atensecurity/pulumi-thoth
License: Apache-2.0
Notes: This Pulumi package is based on the thoth Terraform Provider.

Viewing docs for Thoth v0.1.15
published on Thursday, Jul 23, 2026 by Aten Security

Schema (JSON)

atensecurity/pulumi-thoth

thoth.governance.PolicyBundle

On this page

On this page

Create PolicyBundle Resource

Constructor syntax

Parameters

Constructor example

PolicyBundle Resource Properties

Inputs

Outputs

Look up Existing PolicyBundle Resource

Package Details

On this page

On this page

Try Pulumi Cloud free.
Your team will thank you.

thoth.governance.PolicyBundle

On this page

On this page

Create PolicyBundle Resource

Constructor syntax

Parameters

Constructor example

PolicyBundle Resource Properties

Inputs

Outputs

Look up Existing PolicyBundle Resource

Package Details

On this page

On this page

Try Pulumi Cloud free.Your team will thank you.

Try Pulumi Cloud free.
Your team will thank you.