March 2026 Summaries

Supply chain attacks on CI/CD pipelines, particularly through GitHub Actions, are on the rise, with attackers exploiting vulnerabilities by tag poisoning to access sensitive information like environment variables and cloud credentials. To counter this, Pulumi has shifted from using static GitHub Secrets to a dynamic approach using Pulumi ESC and OpenID Connect (OIDC), which involves generating short-lived, cryptographically signed tokens for each workflow run. This method ensures that no static credentials are stored, and any fetched credentials are ephemeral and scoped to specific roles, reducing the risk and impact of potential compromises. By implementing this across over 70 repositories, Pulumi has enhanced their security posture, making it verifiable and auditable, while also providing centralized control and visibility not possible with traditional GitHub Secrets. This strategy minimizes the potential damage from compromised actions by ensuring no long-lived secrets are available for exploitation, thereby limiting the attack's blast radius.

Pulumi has introduced advanced features for managing permissions at scale, including tag-based access control, team role assignments, and user role assignments, aimed at enhancing security and efficiency in CI/CD pipelines. Tag-based access control allows organizations to dynamically grant permissions based on entity tags across infrastructure as code (IaC) stacks, environments, and accounts, simplifying the management of large numbers of resources without requiring manual configuration. Custom roles can now be directly assigned to teams, allowing members to inherit permissions as they join, and roles can be tailored to individual users for responsibilities spanning multiple teams. Permissions in Pulumi are additive, ensuring that users receive the collective permissions from all roles assigned to them or their teams. These new capabilities are accessible through the Pulumi Cloud console and REST API for organizations using the Pulumi Enterprise and Business Critical plans, offering a comprehensive solution for implementing least-privilege access control at scale.

Pulumi has announced the stabilization of its Open Policy Agent (OPA) support with the release of pulumi-policy-opa v1.1.0, which elevates OPA/Rego to a first-class policy language alongside Pulumi's native TypeScript and Python SDKs. This update allows users to write Rego policies to validate resources managed by Pulumi across various providers such as AWS, Azure, GCP, and Kubernetes, offering full feature parity with the existing SDKs. The release introduces Kubernetes Gatekeeper compatibility, enabling users to directly integrate existing .rego policies from Gatekeeper constraint templates into Pulumi policy packs without modification. These policies can now enforce security and operational standards during the pulumi preview process, catching violations before deployment. Additionally, OPA/Rego policies support various enforcement levels, custom configurations, and metadata annotations, allowing for flexible policy management and continuous compliance monitoring. The integration of OPA policies into Pulumi Insights provides organizations with enhanced visibility and governance across cloud environments, making it possible to run audit policy scans and maintain compliance without requiring redeployments.

Pulumi ESC (Environments, Secrets, and Configuration) provides a method for composing environments by importing configuration and secrets from other environments, which can inadvertently allow a child environment to override important settings such as security policies. To address this, Pulumi has introduced the fn::final function, allowing users to mark certain values as final to prevent unintended overrides. If a child environment attempts to change a final value, ESC issues a warning and retains the original setting, ensuring consistency and security. This feature is particularly useful for maintaining security-sensitive values, compliance settings, and consistent configurations across shared base environments. The fn::final functionality is currently available in all Pulumi ESC environments, with further details accessible in its documentation.

Pulumi has enhanced its Registry by allowing users to browse documentation for previous versions of first-party Pulumi providers, eliminating the need to search through Git history or guess changes. This feature supports Pulumi Neo and other agents in providing more accurate assistance with Pulumi code and operations. Users can now select from a version dropdown on a provider's page to view the full API documentation for the current version and the latest release of the two previous major versions. For instance, if a provider is on version 7.x, documentation for versions 6.x and 5.x is also accessible. Users are encouraged to explore this feature and provide feedback through Pulumi Community Slack or GitHub.

The document lists a diverse range of software packages across various platforms, with a particular focus on cloud and infrastructure services from providers like AWS, Azure, Google Cloud, and Kubernetes. It includes details such as version numbers, publication dates, and publishers, showcasing the continuous updates and expansions in software offerings. The text highlights the availability of packages for different use cases like infrastructure monitoring, network utilities, version control, and databases. The information appears to serve as a comprehensive resource for developers or teams looking to integrate specific tools into their workflows, reflecting the dynamic nature of software development and deployment in today's technology landscape.

Pulumi Cloud has introduced Google as a first-class identity provider, allowing users to sign in using their existing Google accounts, which many developers and platform engineers already use for various services like email and cloud console access. This integration simplifies the sign-in process by enabling users to log in with a single click if they are part of Google Workspace, eliminating the need for new credentials and allowing the inheritance of existing security policies, such as two-factor authentication. The process involves selecting the "Sign in with Google" option on the Pulumi Cloud sign-in page for new users or linking a Google account to an existing Pulumi Cloud account through account settings. While Google sign-in facilitates individual authentication, it does not function as a single sign-on (SSO) identity provider for entire organizations in Pulumi Cloud; for such centralized governance, SAML SSO with Google Workspace is recommended and is available on Pulumi Enterprise and Business Critical editions. This feature is now accessible to both new and existing Pulumi Cloud users, and feedback is encouraged via the Pulumi Community Slack or GitHub.

A Senior Technical Content Engineer at Pulumi, who works as a one-person documentation team, has creatively utilized AI to manage the documentation process and reduce cognitive overload, especially given their undiagnosed ADHD. By using AI as a conversational partner, they have scaffolded their workflow to overcome the daunting task of starting new projects. This approach involved treating AI prompts like code, creating modular and reusable skills that streamline tasks such as document reviews, issue fixing, and generating GitHub issues from Slack conversations, thus improving productivity and collaboration across teams. These AI skills are integrated into Pulumi's CI/CD pipeline to ensure consistency and quality in documentation, and they function as shared libraries that can be updated centrally, reflecting changes across all dependent workflows. The engineer emphasizes the importance of a modular approach to AI prompts, version control, and maintaining a low token burn rate, all while highlighting the potential for these tools to be adapted for broader team use, particularly for less technical members like marketers. The strategy underscores the value of using AI as a cognitive aid to assist in task initiation and execution, fostering a collaborative environment where AI acts as a reliable partner in the documentation process.

Pulumi Cloud has expanded its compatibility to include GitHub, GitHub Enterprise Server, Azure DevOps, and GitLab, allowing teams to leverage consistent deployment pipelines, pull request previews, and AI-generated change summaries irrespective of their version control system. The platform enables automatic infrastructure deployment upon code pushes by connecting repositories to stacks, with configurable path filters and direct management of environment variables and secrets. Pull requests are enhanced with infrastructure previews and AI-generated summaries, which help reviewers understand changes without needing to analyze resource diffs. The AI assistant, Neo, can also automate infrastructure changes by opening pull requests based on natural language descriptions. Pulumi Cloud offers drift detection to identify and address unauthorized infrastructure changes, ensuring stability. It employs secure authentication methods like OIDC or OAuth to maintain pipeline security without the need for long-lived credentials. Additionally, a new project wizard facilitates the quick setup and deployment of new projects directly from the version control system. Configuration and setup details are available for various version control systems under the settings menu.

Pulumi Cloud has introduced a major performance enhancement by changing how it manages state, resulting in operations being up to 20 times faster, now enabled by default for all users with Pulumi CLI v3.225.0+. The improvement affects operations like pulumi up, pulumi destroy, and pulumi refresh by replacing the full snapshot method with journaling, which sends only the state of each operation to the cloud, allowing parallel updates if resources are unrelated. Early adopters helped resolve a server-side bug, and journaling has been stable since its January rollout, showing significant improvements in update times, particularly for larger stacks with more than 100 resources. Users need only upgrade their Pulumi CLI, as the enhancement is automatic, although they can opt out if desired.

Platform engineering teams can now unify state management across Terraform and Pulumi without altering their existing HCL code by using Pulumi Cloud as a Terraform state backend. This integration allows teams to manage Terraform state alongside Pulumi stacks while continuing to use the Terraform or OpenTofu CLI for daily operations, benefiting from features such as encrypted state storage, update history, state locking, role-based access control, audit policies, and unified resource visibility through Insights. This development is significant for organizations with extensive Terraform deployments, as it facilitates seamless migration to Pulumi Cloud, providing centralized visibility and governance without requiring a complete code conversion. Pulumi Cloud enhances functionality by securing state with encryption, tracking changes with versioned checkpoints, preventing concurrent operation conflicts, applying consistent access policies, and enabling resource visibility and audit capabilities across Terraform and Pulumi-managed resources. The implementation uses the Terraform remote backend API, allowing straightforward migration from existing backends to Pulumi Cloud, thereby enabling teams to integrate legacy infrastructures while adopting new stacks in Pulumi.

In a comparison of infrastructure code generation by AI agents using Claude Opus 4.6 and GPT-5.2-Codex, the study explores the trade-offs between using HCL and Pulumi TypeScript. HCL, being more compact, offers token efficiency, reducing output tokens by 21-33% in simple resource generation, thus lowering costs. However, its advantage diminishes in scenarios requiring code refactoring and deployability, where Pulumi TypeScript shows better performance. Pulumi consistently produced deployable code with fewer refactoring repairs, particularly when used with Claude Opus, which resulted in a 41% lower total pipeline cost compared to HCL. This success is attributed to Pulumi's use of familiar TypeScript refactoring patterns and tooling that AI models are well-versed in, contrasting with the domain-specific constructs required by HCL. As the industry shifts towards more iterative and maintainable infrastructure processes, the deployability and refactoring capabilities of Pulumi make it a more effective choice for AI-driven infrastructure tasks.

Pulumi Insights offers visibility and governance over cloud infrastructure by cataloging resources across platforms like AWS, Azure, and GCP, regardless of their provisioning method, and enforcing compliance through policy evaluations. Initially available only on Pulumi-hosted infrastructure, it now supports customer-managed workflow runners, allowing enterprises to run Insights within their own environments to meet data residency, network constraints, and compliance requirements. These runners can execute discovery scans, policy evaluations, and deployments locally, communicating with Pulumi Cloud via HTTPS for secure integration in restricted environments. This feature is part of Pulumi Cloud's Business Critical edition, and it utilizes a distributed work scheduling system for efficient task management. Self-hosted Insights is designed to meet specific organizational needs by providing flexibility in hosting, such as running on Linux, macOS, Docker, or Kubernetes, and allows seamless integration with existing Pulumi Deployments infrastructure.