September 2025 Summaries

The third post in the IDP Best Practices series explores the implementation of policy as code using Pulumi CrossGuard to establish deployment guardrails, ensuring developer speed while maintaining security and compliance. Highlighting the challenge of balancing speed and safety, the post recounts Statsig's experience, where dependency on one infrastructure engineer led to operational bottlenecks. By integrating automated guardrails, Statsig transformed its infrastructure management, enabling self-service without compromising security. The text details the architecture of a modern platform, comprising three layers with varying security needs, and emphasizes the importance of deployment guardrails as automated policies that prevent misconfigurations. Pulumi CrossGuard, a policy as code framework, allows writing policies in familiar programming languages to enforce compliance across cloud resources. The post provides practical examples of guardrails, outlines different policy enforcement models, and discusses best practices for policy implementation, emphasizing starting small, clear communication, and continuous improvement. It also anticipates future trends, such as AI-enhanced policies and multi-cloud governance, highlighting the role of policy as code in enabling safe, scalable infrastructure management.

The v9 release of the Pulumi Google Cloud Provider introduces significant updates to Google Cloud resources and functions, aligning with the latest features from Pulumi and the upstream provider. This open-source provider, available on GitHub, enables the provisioning of any Google Cloud resources, and the community is encouraged to contribute through issues and pull requests. Notable additions include new modules supporting AI and Google Gemini, among others, while improvements focus on enhanced import and field validation to ensure compliance with Google Cloud's requirements. The release also features substantial documentation upgrades, including 100 new resource and function descriptions. Pulumi Neo, a new automation agent, assists users with upgrades by analyzing the migration guide and stack to propose necessary changes, even offering to open a pull request for code updates.

Architecture diagram automation is revolutionizing infrastructure management by eliminating the manual labor of creating and updating diagrams, which often become outdated with infrastructure changes. By utilizing infrastructure as code (IaC) tools like Pulumi, teams can generate real-time, accurate diagrams directly from IaC definitions, ensuring that documentation remains synchronized with infrastructure states. Pulumi provides several automated diagramming approaches: native Pulumi diagramming, AI-powered diagramming with Claude and Mermaid, and Pulumi Neo for enterprise-scale diagramming. Native Pulumi diagramming offers the highest accuracy, creating diagrams directly from deployed states, while AI-powered approaches like Claude enhance aesthetics and provide multiple perspectives but may risk inaccuracies due to AI interpretation. Pulumi Neo elevates diagramming to an enterprise level, providing organization-wide views and intelligent customization tailored to different stakeholders. Each method integrates seamlessly with CI/CD pipelines, offering zero-maintenance updates, albeit with varying levels of complexity and setup requirements. These innovative approaches ensure that infrastructure documentation is always current, aesthetically pleasing, and tailored to the needs of technical and non-technical stakeholders alike, transforming architecture visualization into an effortless, intelligent process.

Pulumi has enhanced its Infrastructure as Code platform by expanding access to its policy engine, now available to all Team and Enterprise customers, to improve governance for modern cloud platforms. The updates include a redesigned policy management experience and new policy packs, facilitating easier security and compliance for both human developers and AI agents like Pulumi Neo. Pulumi's Policy as Code (PaC) framework allows organizations to utilize general-purpose programming languages such as TypeScript and Python to implement nuanced policies through conditional logic, reusable functions, and unit tests. The new streamlined experience simplifies policy discovery and application through an intuitive in-console workflow, while pre-built policy packs like Pulumi Best Practices and HITRUST CSF v11.5 provide immediate governance solutions. The policy management system supports both preventative and audit approaches to governance, ensuring compliance and security across entire infrastructures without impeding developer velocity.

AI coding assistants have significantly accelerated software development, but this rapid increase in developer velocity has created challenges for infrastructure and platform teams, which often lack the necessary tools to manage the evolving demands. The introduction of Pulumi Neo, an infrastructure automation agent, aims to address these challenges by providing a specialized AI tool designed specifically for platform and infrastructure engineering teams. Unlike generic AI tools, Neo understands the full context of infrastructure, including the complexities of multiple repositories, compliance, and security policies. Built on Pulumi's platform, Neo leverages existing features and governance frameworks to ensure secure and compliant automation, transforming platform engineering from a reactive to a proactive discipline. This shift allows platform teams to become strategic enablers, facilitating rapid development without compromising safety or control. Neo's approach represents a new era in platform engineering, where infrastructure can evolve at the same pace as the code it supports, effectively ending the "platform team bottleneck" narrative and empowering these teams to drive organizational strategy and innovation.

Pulumi Cloud has introduced a redesigned left-hand navigation to improve user access and streamline workflows for managing cloud infrastructure. The update prioritizes commonly used sections like Stacks, Environments, and Resources, placing them in the top-level navigation for quick access. Features are now organized into four categories—Platform, Management, Settings, and Organization—reflecting the typical workflow of infrastructure teams and reducing interface clutter. Key changes include the consolidation of Deployment Runners into Deployments, integration of new project creation and resource importing into the main Stacks page, and relocation of Customer Managed Keys under Organization settings. This update aims to enhance user experience by aligning the interface with user needs, supporting efficient navigation for teams managing various resources across multiple cloud environments, and advancing Pulumi's mission to facilitate infrastructure management with speed and ease. The new navigation is now available for all Pulumi Cloud users, who are encouraged to provide feedback to help further improve the platform.

Pulumi Cloud has introduced a new feature called unified resources, which consolidates resources from various sources into a single, comprehensive view, eliminating duplicate entries that previously cluttered search results. This enhancement addresses the challenge of fragmented views of cloud resources that exist across multiple contexts within organizations, such as AWS S3 buckets or Azure VMs appearing in both Infrastructure as Code (IaC) stacks and Pulumi Insights. By automatically detecting and consolidating duplicates, users gain accurate resource counts, improved visibility into management states, and quicker access to information essential for troubleshooting. The update includes a redesigned resource details page, which now provides a unified view of all available information about a resource, including its sources and metadata. This allows teams to easily compare resource properties, detect configuration changes, and track property changes over time. The feature is designed to provide an accurate infrastructure inventory, enhance compliance visibility by differentiating between managed and unmanaged resources, and facilitate faster incident response by centralizing resource information. Unified resources are now available for all Pulumi Cloud users, and feedback is encouraged through the Pulumi Community Slack or customer success teams.

Azure Native Provider v3.8 introduces enhancements that streamline authentication and expand support for private Azure environments, allowing for more efficient management of Azure infrastructure. This update features a new authentication mode using DefaultAzureCredential, a tool that unifies authentication settings across various environments by automatically selecting the best available method, thereby eliminating the need for environment-specific configurations. This facilitates seamless operations in local development environments, CI/CD pipelines, Azure Kubernetes Service, Azure VMs, and App Services without requiring configuration changes. Additionally, the release improves support for Azure private clouds by enabling automatic configuration discovery through the ARM_METADATA_HOSTNAME environment variable. Other notable features include a new setting to disable instance discovery for disconnected or private clouds and enhanced authentication capabilities for programs running in Azure Kubernetes Service using workload identity. Overall, Azure Native Provider v3.8 aims to simplify and enhance the management of Azure infrastructure across diverse deployment scenarios.