2.3Policy Tests with Pulumi CrossGuard

Pulumi CrossGuard is Pulumi's policy-as-code framework. Unlike external tools like Checkov or tfsec that analyze HCL, CrossGuard policies are written in the same language as your infrastructure and run at deployment time.

TypeScript Policy Pack

// policy/index.ts
import { PolicyPack, validateResourceOfType } from "@pulumi/policy";
import * as aws from "@pulumi/aws";

new PolicyPack("security-policies", {
    policies: [
        {
            name: "s3-no-public-read",
            description: "S3 buckets must not allow public read access.",
            enforcementLevel: "mandatory",
            validateResource: validateResourceOfType(aws.s3.Bucket, (bucket, args, reportViolation) => {
                if (bucket.acl === "public-read" || bucket.acl === "public-read-write") {
                    reportViolation("S3 bucket has public read access. Use 'private' ACL.");
                }
            }),
        },
        {
            name: "rds-encryption-required",
            description: "RDS instances must have storage encryption enabled.",
            enforcementLevel: "mandatory",
            validateResource: validateResourceOfType(aws.rds.Instance, (db, args, reportViolation) => {
                if (!db.storageEncrypted) {
                    reportViolation("RDS instance must have storageEncrypted set to true.");
                }
            }),
        },
        {
            name: "ec2-no-public-ip",
            description: "EC2 instances must not have public IP addresses in production.",
            enforcementLevel: "advisory",
            validateResource: validateResourceOfType(aws.ec2.Instance, (instance, args, reportViolation) => {
                if (instance.associatePublicIpAddress) {
                    reportViolation("EC2 instance should not have a public IP. Use a load balancer.");
                }
            }),
        },
        {
            name: "required-tags",
            description: "All taggable resources must have required tags.",
            enforcementLevel: "mandatory",
            validateResource: (args, reportViolation) => {
                const tags = (args.props as any).tags;
                const requiredTags = ["Environment", "Team", "CostCenter"];

                if (tags) {
                    for (const required of requiredTags) {
                        if (!tags[required]) {
                            reportViolation(`Missing required tag: ${required}`);
                        }
                    }
                }
            },
        },
    ],
});

Running CrossGuard Policies

# Run policies against a Pulumi preview (dry run)
pulumi preview --policy-pack ./policy/

# Run policies on actual deployment
pulumi up --policy-pack ./policy/

# Publish policies to Pulumi Cloud for organization-wide enforcement
pulumi policy publish ./policy/