This message was deleted.

I’m checking for you, but this may be a bug.

Hi @bored-vase-40478! Thanks for calling this to our attention. The reason this does not work at present is that organization tokens are granted no org admin level privileges at this time, and publishing policy packs requires that you are an org administrator (links here for anyone else that comes across this Slack thread and is curious). This calls into question a clear use case for automation to have sufficient privileges to make changes to PaC, so we will evaluate if permissions changes need to be made to organization tokens to enable this. As this is a relatively new feature, we welcome the opportunity to make tweaks to it as the needs of our users become more clear, so once again thanks for your input on this!

thanks Pulumi team @acoustic-lock-52416 @billowy-army-68599! i will stay tune to any update about this topic. Also, as a feedback related to the crossguard feature, it would be nice if you can provide an easy way (thinking in automation processes cicd) to associate policy packs to policy groups and pulumi stacks to policy groups. I’m handling these scenarios with some config files that the cicd pipeline use to create the associations. as a proposal: - a

Pulumi.yaml

file could have a property option to associate a pulumi project with multiple policy groups. - a

PulumiPolicy.yaml

could have a parameter to associate that policy pack to multiple policy groups.