-
- Policy as Code Scenarios
-Accelerate your organization's delivery while still staying compliant
-
-
-
-
- Security
-Maintain security across all cloud infrastructure assets.
-
-{{ $code := `new PolicyPack("acmecorp-security", {
- policies: [{
- name: "prohibited-public-internet",
- description: "Reject public internet access.",
- enforcementLevel: "mandatory",
- validateResource: validateResourceOfType(
- aws.ec2.SecurityGroup,
- (sg, args, reportViolation) => {
- const hasInternetAccess = sg.ingress.find(
- rule => rule.cidrBlocks.includes("0.0.0.0/0")
- );
- if (hasInternetAccess) {
- reportViolation("Illegal internet access");
- }
- },
- ),
- }],
-);`
-}}
-
- {{ partial "code" (dict "code" $code "lang" "js") }}
-
- Prohibiting network access from the Internet.
-
-
- Compliance
-Meet, and stay meeting, compliance standards.
-
-{{ $code := `new PolicyPack("acmecorp-compliance", {
- policies: [{
- name: "required-storage-region",
- description: "Data must be stored in the US.",
- enforcementLevel: "mandatory",
- validateResource: validateResourceOfType(
- aws.s3.Bucket, (bucket, args, reportViolation) => {
- if (!bucket.region.startsWith("us-")) {
- reportViolation("Non-US bucket detected");
- }
- },
- ),
- }],
-);`
-}}
-
- {{ partial "code" (dict "code" $code "lang" "js") }}
-
- Disallowing storage outside of specific regions.
-
-
-
-
- Cost Controls
-Ensure cost conscious deployments.
-
-{{ $code := `new PolicyPack("acmecorp-cost", {
- policies: [{
- name: "required-cost-tags",
- description: "Cost tags are required.",
- enforcementLevel: "mandatory",
- validateResource: (args, reportViolation) => {
- if (isTaggable(args.type) &&
- !args.resource["tags"]["Cost Center"]) {
- reportViolation("Resource missing tags");
- }
- ),
- }],
-);`
-}}
-
- {{ partial "code" (dict "code" $code "lang" "js") }}
-
- Requiring specific cost allocation tags.
-
- 
-
- Continuous Delivery
-Catch policy violations before they escape using CI/CD.
-
- A live dashboard of organizational violations in Pulumi Cloud.
-
+ 
+