What's the best policy checker for pulumi? We currently use checkov for our CFN templates, but checkov doesn't support pulumi (yet? https://github.com/bridgecrewio/checkov/issues/568 ) The AWS policy validators in the Pulumi repo are... pretty barebones. Looks like only one has been added in the last couple years. I really don't want to lose coverage and/or rewrite all of the checkov tests. when I poked around in the checkov code, it looks like a decent chunk of the IAM validation in Checkov actually delegates to Salesforce's cloudsplainer library. May or may not be relevant, but I thought it was an interesting bit of trivia

unsure of any checkov integration, however you can validate your resources using https://www.pulumi.com/docs/guides/crossguard/core-concepts/#:~:text=Policies%20validation%20functions%20are%20executed,up%20into%20a%20final%20report.

I linked that issue in my original message 😛

haha sorry, long day 😂 yeah of course, that would be a pain. I’d maybe suggest bumping that post or contributing maybe 🤷

I commented on the issue; we'll see where it goes from here

good luck

want to bump the issue too?

done 🙂

\o/

i was thinking of doing something similar, we have a ticket to enforce tagging policies in our next sprint which starts on monday, so could probably get a core policy set knocked out in a sprint and then publish, if I beat you to it I’ll share a link

Heck yeah!!!

no problem 🙂

@victorious-church-57397 did you end up taking a look at this?

hey, sorry no not just yet. priorities changed! we enforced the tagging policy but didnt do any other stuff just yet