-
Pulumi Crossguard
+Pulumi CrossGuard
Continuously enforce your organization's cloud governance — security, compliance, cost controls, and more.
Try CrossGuard
@@ -95,51 +95,53 @@
Security
Maintain security across all cloud infrastructure assets.
- {{ $code := `new PolicyPack("acmecorp-security", {
- policies: [{
- name: "prohibited-public-internet",
- description: "Reject public internet access.",
- enforcementLevel: "mandatory",
- validateResource: validateResourceOfType(
- aws.ec2.SecurityGroup, (sg, args, reportViolation) => {
- const hasInternetAccess = sg.ingress.find(
- rule => rule.cidrBlocks.includes("0.0.0.0/0"));
- if (hasInternetAccess) {
- reportViolation("Illegal internet access");
- }
- }
- ),
- }],
- );`
- }}
+{{ $code := `new PolicyPack("acmecorp-security", {
+ policies: [{
+ name: "prohibited-public-internet",
+ description: "Reject public internet access.",
+ enforcementLevel: "mandatory",
+ validateResource: validateResourceOfType(
+ aws.ec2.SecurityGroup,
+ (sg, args, reportViolation) => {
+ const hasInternetAccess = sg.ingress.find(
+ rule => rule.cidrBlocks.includes("0.0.0.0/0")
+ );
+ if (hasInternetAccess) {
+ reportViolation("Illegal internet access");
+ }
+ },
+ ),
+ }],
+);`
+}}
- {{ partial "code" (dict "code" $code "lang" "js" "mode" "dark") }}
+ {{ partial "code" (dict "code" $code "lang" "js") }}
- Prohibiting network access from the Internet.
+Prohibiting network access from the Internet.
Compliance
Meet, and stay meeting, compliance standards.
- {{ $code := `new PolicyPack("acmecorp-compliance", {
- policies: [{
- name: "required-storage-region",
- description: "Data must be stored in the US.",
- enforcementLevel: "mandatory",
- validateResource: validateResourceOfType(
- aws.s3.Bucket, (bucket, args, reportViolation) => {
- if (!bucket.region.startsWith("us-")) {
- reportViolation("Non-US bucket detected");
- }
- }
- ),
- }],
- );`
- }}
+{{ $code := `new PolicyPack("acmecorp-compliance", {
+ policies: [{
+ name: "required-storage-region",
+ description: "Data must be stored in the US.",
+ enforcementLevel: "mandatory",
+ validateResource: validateResourceOfType(
+ aws.s3.Bucket, (bucket, args, reportViolation) => {
+ if (!bucket.region.startsWith("us-")) {
+ reportViolation("Non-US bucket detected");
+ }
+ },
+ ),
+ }],
+);`
+}}
- {{ partial "code" (dict "code" $code "lang" "js" "mode" "dark") }}
+ {{ partial "code" (dict "code" $code "lang" "js") }}
- Disallowing storage outside of specific regions.
+Disallowing storage outside of specific regions.
@@ -147,30 +149,30 @@
Cost Controls
Ensure cost conscious deployments.
- {{ $code := `new PolicyPack("acmecorp-cost", {
- policies: [{
- name: "required-cost-tags",
- description: "Cost tags are required.",
- enforcementLevel: "mandatory",
- validateResource: (args, reportViolation) => {
- if (isTaggable(args.type) &&
- !args.resource["tags"]["Cost Center"]) {
- reportViolation("Resource missing tags");
- }
- ),
- }],
- );`
- }}
+{{ $code := `new PolicyPack("acmecorp-cost", {
+ policies: [{
+ name: "required-cost-tags",
+ description: "Cost tags are required.",
+ enforcementLevel: "mandatory",
+ validateResource: (args, reportViolation) => {
+ if (isTaggable(args.type) &&
+ !args.resource["tags"]["Cost Center"]) {
+ reportViolation("Resource missing tags");
+ }
+ ),
+ }],
+);`
+}}
- {{ partial "code" (dict "code" $code "lang" "js" "mode" "dark") }}
+ {{ partial "code" (dict "code" $code "lang" "js") }}
- Requiring a specific cost allocation tags.
+Requiring specific cost allocation tags.
Continuous Delivery
Catch policy violations before they escape using CI/CD.
-
- A live dashboard of organizational violations in Pulumi Enterprise.
+
+ A live dashboard of organizational violations in Pulumi Cloud.