Pulumi Security

Pulumi provides encrypted configuration, policy as code with CrossGuard, secrets management via Pulumi ESC, and integration with cloud-native security tools. Security is built into the programming model using familiar language constructs.

pulumi config set --secret encrypts values per-stack with per-stack encryption keys. Stack references securely pass outputs between stacks without exposing values. Encryption keys managed by Pulumi Cloud or customer-managed KMS.

Pulumi Environments, Secrets, and Configuration (ESC) provides centralized secrets management with dynamic secret providers (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, GCP Secret Manager, 1Password). Fine-grained access control with OIDC authentication. Secret rotation without application changes.

CrossGuard enforces policies written in TypeScript, Python, Go, or Rego. Policies validate resources before deployment: encryption, public exposure, tagging, region restrictions, naming conventions. Policy packs versioned and tested. Integration with CI/CD for gate enforcement.

Native provider SDKs use cloud provider authentication (AWS IRSA, Azure Workload Identity, GCP Workload Identity). No long-lived credentials in code. Least-privilege IAM via Pulumi-generated policies. Drift detection via pulumi refresh and preview.

Pulumi Cloud Enterprise: SOC 2, audit logs, SAML/SSO, SCIM, encryption at rest, customer-managed keys. Self-hosted Pulumi Cloud for air-gapped environments. Compliance reporting for policy violations.