https://pulumi.com logo
#dotnet
Title
# dotnet
a

astonishing-cpu-1506

02/29/2024, 1:00 PM
Hey all, We’re looking at Pulumi’s capacity to enforce some governance, Crossguard is obviously one of the options, however we’re a pure dotnet shop. We were wondering how does Pulumi detect that a new resource is being materialized? Can we intercept that? Is it possible to “mutate” whatever our devs are going to create to ensure that some internal standards will be met at code level?
b

billions-river-87988

03/01/2024, 5:24 PM
Yes, CrossGuard does exactly what you want here- it supports governance of Pulumi programs written in C#- it works by intercepting the pulumi state changes when running 'preview' or 'up' operations. Additionally, it supports "Remediate" actions, meaning you can write policies to apply mutations to adhere to policy.
a

astonishing-cpu-1506

03/02/2024, 4:17 PM
oh that's interesting, do you have an example?
@billions-river-87988 I took the feature for a spin, The CLI usage appears to be straightforward, however I'm running into an interesting issue. The policies do not seem to execute. I've created an "always fail" policy just to check:
Copy code
// Copyright 2016-2022, Pulumi Corporation.  All rights reserved.

import * as azure from "@pulumi/azure-native";
import * as policy from "@pulumi/policy";

const azureAlwaysFailPolicy: policy.ResourceValidationPolicy = {
  name: "azure-always-fail-policy",
  description: "Ensures that Azure resources have a 'cloud' tag with the value 'azure'.",
  enforcementLevel: "mandatory",
  validateResource: policy.validateResourceOfType(azure.resources.Resource, (resource, args, reportViolation) => {
    reportViolation(`This policy always fails: [${resource}]`, args.urn); // same effect if I throw here
  }),
};

export const policies = new policy.PolicyPack("azure-always-fail", {
  policies: [azureAlwaysFailPolicy],
});
All policies pass and show green checkmarks in the CLI output. I'm a bit puzzled
Copy code
Policies:
    ✅ azure-always-fail@v0.0.1 (local: ../../poc-azure-pulumi-policy/azure/always-fail)
    ✅ azure-tags@v0.0.1 (local: ../../poc-azure-pulumi-policy/azure/tags)
Am I missing something with the structure of my
index.ts
file?
And yes, remediation appears to be the way to go
b

billions-river-87988

03/05/2024, 1:25 AM
@astonishing-cpu-1506 sorry for the delay- I will look into this- thanks for the example.
a

astonishing-cpu-1506

03/07/2024, 6:05 PM
@billions-river-87988 any luck with the sample so far?