Policy updates - Blogs & Marketing

content/blog/policy-audit-scans-for-stacks/index.md

@@ -0,0 +1,72 @@
+---
+title: "Introducing Audit Policy Scans for Pulumi Stacks"
+date: 2025-11-05T00:04:00
+authors:
+  - levi-blackstone
+  - arun-loganathan
+meta_desc: "Continuous policy evaluation for IaC stacks based on their last successful deployment state, enabling frictionless adoption and faster CI/CD."
+allow_long_title: true
+meta_image: "meta.png"
+tags:
+  - pulumi-service
+  - policy-as-code
+  - crossguard
+  - features
+  - compliance
+  - governance
+---
+
+Today, as part of the next generation of Pulumi Policies, we're introducing **Audit Policy Scans for Pulumi Stacks**. This capability uses policies to run compliance checks against the last successful deployment state of your stacks, providing continuous compliance monitoring without impacting your existing CI/CD workflows.
+
+Until now, Pulumi’s preventative policies have served as a critical "shift-left" gate, blocking non-compliant changes during `pulumi up`. While essential, this created challenges for organizations wanting to roll out new governance across thousands of existing stacks. This new evaluation mode solves that problem, giving you a complete and continuous view of your IaC compliance posture without the friction.
+
+<!--more-->
+
+## A Complete Audit Story: Cloud Accounts and IaC Stacks
+
+Pulumi's audit philosophy is to provide complete visibility across your entire cloud footprint. We achieve this through two complementary audit modes:
+
+1. **Audit Scans for Cloud Accounts (Existing):** This capability scans your live cloud environments (like an AWS account or Azure subscription). Its primary purpose is to give you a holistic view of your security posture by discovering *all* resources, including those not managed by Pulumi, and detecting configuration drift. This is how you find unmanaged, legacy, or manually-created resources that violate your policies.
+
+2. **Audit Scans for Pulumi Stacks (New):** The feature we're launching today extends this audit power to the source of truth for your managed infrastructure: your Pulumi stacks. It evaluates the *last successfully deployed state* of your IaC. This allows you to get an instant compliance baseline of all your managed infrastructure without having to redeploy anything, making it perfect for frictionless policy rollouts at scale.
+
+Together, these two audit modes give you a comprehensive picture of your entire cloud estate, all feeding into one unified **Policy Findings hub**.
+
+## Key Scenarios for Audit Scans for Stacks
+
+This new evaluation mode for IaC stacks is designed to unlock policy adoption at scale and accelerate developer velocity. Key use cases include:
+
+* **Gain an instant compliance overview across all existing stacks:** Apply policies centrally and get immediate visibility into your compliance posture without requiring redeployment of every stack.
+* **Accelerate policy rollouts:** By decoupling policy evaluation from the critical deployment path, deployments become faster and developers are unblocked. Teams still get immediate feedback on the compliance of the deployed infrastructure.
+* **Ensure continuous compliance:** Evaluation is automatically triggered whenever policy configurations change. This ensures the *latest policies* are always evaluated against the *latest deployed infrastructure*.
+
+## How It Works
+
+This new mechanism runs against the last known successfully deployed state of your IaC Stacks as recorded by Pulumi Cloud.
+
+* **Evaluation is triggered automatically** after a successful `pulumi up` or when a policy pack attached to the stack is updated.
+* **Results are unified** into the same **Policy Findings hub** you use today, giving you a single pane of glass for all preventative and audit policy findings.
+
+## How to Get Started
+
+You can enable audit scans for your IaC stacks by adding them to an **Audit Policy Group**.
+
+1. Navigate to the **Policies** tab in the left navigation bar of the Pulumi Cloud console.
+2. Create a new **Audit Policy Group** or select an existing one.
+3. Select **Pulumi Stacks** and add the specific stacks you want to monitor.
+4. **Add Policy Packs** to the group.
+5. **Save the policy group**. That's it!
+
+{{< video title="Setting up Stack Audit Policy" src="stack-audit-policy.mp4" autoplay="true" loop="true" >}}
+
+The next time any of the selected stacks completes a `pulumi up`, a post-deployment evaluation will be automatically triggered, and the results will populate in the Policy Findings hub.
+
+{{< notes type="info" >}}
+Audit policy scans consume workflow minutes from your Pulumi Cloud plan. Each scan counts toward your monthly quota based on the complexity and number of resources evaluated. See pricing documentation for details.
+{{< /notes >}}
+
+## A Complete Governance Picture
+
+With the addition of post-deployment evaluation for IaC stacks, you now have a complete, 360-degree view of your cloud environment. You can use audit scans for cloud accounts to get a handle on your entire live footprint, and use audit scans for stacks to easily assess your IaC-managed footprint without adding friction to your development process.
+
+Try it out in the Pulumi Cloud today and check out the documentation to learn more!

content/blog/policy-issue-management/index.md

@@ -0,0 +1,64 @@
+---
+title: "Introducing the New Policy Findings Hub"
+date: 2025-11-05T00:03:00
+authors:
+  - alejandro-cotroneo
+  - arun-loganathan
+meta_desc: "Move from alert fatigue to action. Announcing Pulumi's new Policy Findings hub, a collaborative workspace for triaging, managing, and fixing compliance issues."
+allow_long_title: true
+meta_image: "meta.png"
+tags:
+  - pulumi-service
+  - policy-as-code
+  - features
+  - compliance
+  - governance
+  - pulumi-neo
+  - ai
+---
+
+For platform and security teams, enabling robust cloud scanning often creates a new problem: an unmanageable firehose of policy alerts. Identifying a violation is only the first step. Without a system to manage the lifecycle of these findings, teams are quickly overwhelmed, leading to prioritization paralysis and a perpetually growing backlog.
+
+Today, we're introducing the solution to this alert fatigue. The new **Policy Findings** hub is a purpose-built, collaborative workspace that transforms a noisy list of violations into an organized and actionable set of tasks. It guides your team from initial discovery all the way to a verified fix.
+
+<!--more-->
+
+## From Raw Data to Actionable Insights
+
+The Policy Findings hub is designed with distinct views for every stakeholder involved in the governance lifecycle.
+
+### 1. The Overview Tab: A Dashboard for Leaders
+
+For a platform lead or security manager, the goal is to understand the big picture. The Overview tab provides a high-level dashboard of your organization's compliance health, answering key questions at a glance:
+
+* What is our overall resource compliance score?
+* Are we trending in the right direction?
+* Which parts of our cloud infrastructure (stacks, accounts, etc.) carry the most risk?
+
+This view helps leadership track progress and make data-driven decisions about where to focus engineering efforts.
+
+### 2. The Compliance Tab: The Auditor and Infosec Workspace
+
+For the infosec members and auditors, context is everything. Simply listing thousands of violations is not helpful. The Compliance tab provides a policy-centric view, grouping all findings by the specific control they violated (e.g., a specific rule within CIS or NIST).
+
+This is crucial when preparing for an audit or assessing adherence to a specific security framework, as it allows you to see exactly where you are compliant and where you have gaps, control by control.
+
+### 3. The Issues Tab: The Team's Daily Workspace
+
+This is space where insight is turned into action. The Issues tab is a collaborative triage board designed for the day-to-day workflow of platform and development teams. It provides the full toolset needed to manage the lifecycle of an issue from start to finish:
+
+* **Triage and Prioritize:** Filter issues by severity, resource type, or policy to focus on what matters most. Set a priority level from P0 (critical) to P4 (low).
+* **Assign Ownership:** Assign issues to specific team members to ensure clear ownership and accountability.
+* **Manage Lifecycle:** Mark an issue as "Ignored" with a justification. This is a critical workflow for acknowledging intentional exceptions, which cleans up your dashboard and allows the team to focus on legitimate issues.
+
+And for the most critical part of the workflow—the fix itself—we've integrated our AI agent, **Pulumi Neo**, directly into this view.
+
+After selecting one or more issues, your team can assign the task to Neo. It will analyze the violations and automatically generate a pull request with the necessary code changes. For unmanaged resources, Neo will even generate the code to import them into Pulumi and apply the fix. This turns a complex manual task into a simple review-and-merge process, allowing your team to finally burn down the backlog.
+
+{{< video title="Managing policy findings in Pulumi Cloud" src="findingsclipblog.mp4" autoplay="false" controls="true" loop="true" >}}
+
+## Conclusion
+
+Effective governance requires more than just detection; it requires a robust system for managing, prioritizing, and resolving issues at scale. The new Policy Findings hub provides that end-to-end experience. It's a collaborative environment that brings clarity to your compliance posture and provides the tools—including AI-powered assistance—to take decisive action.
+
+This powerful new experience is available today. Navigate to the **Policies > Findings** tab in the Pulumi Cloud to explore your new compliance dashboard and transform alert fatigue into action.

content/blog/policy-next-gen/index.md

@@ -0,0 +1,92 @@
+---
+title: "Announcing the Next Generation of Pulumi Policies: AI-Accelerated Governance for the Cloud"
+authors: 
+- craig-symonds  
+- tyler-dunkel  
+- arun-loganathan
+date: 2025-11-05T00:05:00
+meta_desc: "Launching the governance lifecycle: AI-powered remediation, pre-built compliance packs, continuous auditing, and a new Policy Findings hub."
+allow_long_title: true
+meta_image: "meta.png"
+tags:
+- policy-as-code
+- features
+- compliance
+- governance
+- pulumi-neo
+- ai
+- platform-engineering
+---
+
+The era of AI-accelerated development has created a paradox: the faster developers move, the bigger the governance challenge becomes. For years, security and platform teams have worked to "shift left," but the tools available have been incomplete. Most focus on detection, which is necessary but not sufficient. They identify thousands of policy violations across an organization's infrastructure but leave teams with an overwhelming backlog and no scalable way to remediate it. This creates a persistent gap between finding a problem and fixing it. The result is an impossible choice between development velocity and organizational control, forcing leadership to slow down innovation to manage risk.
+
+Today, we end that compromise.
+
+<!--more-->
+
+We are thrilled to announce the next generation of Pulumi Policies, a comprehensive governance solution that moves beyond detection to deliver AI-powered remediation at scale. We’re introducing a new lifecycle to secure your cloud: first, **Get Clean** by using AI to fix your existing policy violations. Second, **Stay Clean** by using policy as a universal guardrail that makes AI-driven development not just fast, but fundamentally safe. These are not strictly sequential steps; you can begin enforcing "Stay Clean" policies for all new infrastructure while you simultaneously work on the "Get Clean" process for your existing footprint.
+
+Watch our Launch Video:
+
+{{< youtube "mwcrOTEf1EQ?rel=0" >}}
+
+## Part 1: Get Clean - From Thousands of Issues to a Compliant State
+
+The first step to a secure cloud is tackling the mountain of existing misconfigurations spread across your environments.
+
+### First, Gain Complete Visibility with the New Policy Findings Hub
+
+To fix your issues, you first need to see them clearly. We have introduced a powerful **Policy Findings Hub** designed to give every stakeholder the exact view they need.
+
+* **The Overview Tab:** A high-level dashboard with compliance scores for leadership to track trends and measure your organization's posture.
+* **The Compliance Tab:** A control-centric view for auditors and infosec teams, grouping findings by policy (e.g., CIS, NIST) to simplify evidence gathering and prove compliance.
+* **The Issues Tab:** A collaborative workspace for platform and development teams to triage, assign, prioritize, and track the remediation of every policy issue.
+
+This hub is powered by our flexible audit capabilities. With **Audit Scans for IaC Stacks**, you can get an instant compliance baseline on all your existing Pulumi-managed infrastructure without blocking developers or re-deploying thousands of stacks. This is combined with discovery scans of your cloud accounts to give you a single, unified view of every resource, whether managed by Pulumi or not.
+
+### The Solution to Remediation at Scale: AI-Powered Fixes with Pulumi Neo
+
+Visibility creates a new problem: an overwhelming backlog. Manually fixing thousands of issues is an impossible task.
+
+This is where Pulumi Neo provides a powerful solution.
+
+Pulumi Neo, our AI platform engineer, is now integrated directly into the Policy Findings hub to automate the most difficult part of the process: the fix itself. From the Issues tab, your teams can now select a group of policy issues, assign them to Neo, and trigger a remediation flow.
+
+Neo is smart. It will:
+
+1. Analyze the non-compliant resources and the policies they are violating.
+2. Understand the required configuration to make them compliant.
+3. **Generate a pull request with the exact code changes needed to fix the issues.**
+
+Most powerfully, for an unmanaged resource discovered via a cloud scan, Neo will generate the code to **import the resource into a Pulumi stack and apply the fix.** This "Import and Fix" workflow transforms unmanaged infrastructure into governed, compliant code, turning a task that could take a developer hours into a simple review-and-merge process. Your teams can finally burn down their issue backlog and achieve a state of continuous compliance.
+
+## Part 2: Stay Clean - The Universal Guardrail for Humans and AI
+
+Once you begin cleaning your environment, the next challenge is to *stay* clean. As AI accelerates infrastructure creation, you need robust guardrails to ensure it doesn't also accelerate the creation of security risks.
+
+The answer is **Policy as *Real* Code.** Pulumi Policies uses general-purpose languages like TypeScript and Python to create sophisticated guardrails that govern every change. To help you establish these controls immediately, we are launching a new suite of pre-built compliance packs authored and maintained by Pulumi experts.
+
+| Framework                 | AWS | Azure | Google Cloud |
+| ------------------------- |:---:|:-----:|:------------:|
+| **CIS Controls v8.1**      | ✅  |   ✅  |      ✅      |
+| **NIST SP 800-53 Rev. 5**  | ✅  |       |              |
+| **PCI DSS v4.0**           | ✅  |       |              |
+| **HITRUST CSF v11.5**      | ✅  |   ✅  |      ✅      |
+| **Pulumi Best Practices**  | ✅  |   ✅  |      ✅      |
+
+These policies act as a universal guardrail for your entire organization by blocking non-compliant changes during `pulumi up`, before they are ever created.
+
+And now, you can even use **Neo to author new policies**. You can ask Neo in plain English to "create a policy that prevents overly permissive IAM roles," and it will generate the code for you. This creates a powerful, dynamic governance system where AI can help you build the very rules that then govern its own actions. If you then ask Neo to create an admin role, the deployment will be blocked by the policy it just helped write. This is how we make AI safe to go fast.
+
+## A New Era of Collaboration
+
+This "Get Clean, Stay Clean" lifecycle transforms how teams work together:
+
+* **Platform Teams** lead prevention by building real-code guardrails, proving their value with measurable compliance scores.
+* **Security Teams** drive the "Get Clean" process with continuous, non-blocking audit scans and use the Findings hub to manage compliance without slowing development.
+
+## Governance That Accelerates You
+
+The age of AI-driven development demands AI-powered governance. With this new generation of Pulumi Policies, we are providing the essential infrastructure for platform engineering teams to not just survive, but thrive. You can finally build preventative guardrails that developers love, secure your cloud at scale, and transform governance from a blocker into a business accelerator.
+
+This powerful new experience is available today. Navigate to the **Policies** and **Policy Findings** tab in Pulumi Cloud to explore your new governance capabilities and meet the future of platform engineering.