| title | Hulumi documentation |
|---|---|
| description | Index of every doc shipped in this repo, organised by reader. |
Welcome. This index is the single jumping-off point for every doc in the repo. Pick your starting point by what you're trying to do.
| You want to… | Read this |
|---|---|
| Understand what Hulumi is and whether it's for you | Why Hulumi |
| Stand up a hardened S3 bucket in 10 minutes | Getting started |
| See a worked threat model before writing any IaC | Threat-model examples |
| Browse practical recipes ("how do I do X?") | Cookbooks |
| Look up a component's args, outputs, and tier matrix | Component reference |
Check what each tier (sandbox vs. startup-hardened) actually emits |
Tier matrix |
| Understand Hulumi's stance on framework licensing (CCM, CIS, NIST) | Licensing & IDs-only policy |
| You want to… | Read this |
|---|---|
| Bootstrap a sandbox AWS account for Hulumi integration tests | Sandbox account guide |
Apply the v1.0 SCP that protects the hulumi:iac-role tag |
SCP guide · scp.json |
| Wire the drift classifier into your CI | Drift classifier deployment |
| Run the weekly real-AWS integration job | Integration testing |
Verify SLSA provenance on a published @hulumi/* tarball |
Cookbook: verifying provenance |
| You want to… | Read this |
|---|---|
| Get the local dev loop running (build, test, lint) | Development guide |
| Understand the PR conventions (DCO, conventional commits, CODEOWNERS) | CONTRIBUTING.md |
| Read the engineering runbooks driving each release train | docs/slo/completed/ and docs/slo/README.md |
| See what lessons came out of each milestone | docs/slo/lessons/ |
| Find candidate issues / improvements for the project | Issue candidates |
- Components —
SecureBucket,AccountFoundation,AwsOrganizationSecurityFoundation,PulumiStateBackendFoundation,EksClusterFoundation,SecurityDetectionFoundation,RunnerGovernanceFoundation,DriftClassifier,hulumi validate live, plus the K8s/EKS surface (HardenedHelmRelease,EksSubnetTagger,IstioFoundation,AlbMeshedHttpEntrypoint,KubernetesSecretFromAwsSecretsManager,RdsCredentialSecret,GitHubAppCredential). - Framework mappings — CCM v4.1, CIS AWS v5.0.0, NIST 800-53 r5, NIST 800-218A, MITRE ATLAS v5.1.
- Tier matrix — what differs between Sandbox and Startup-Hardened, by component.
- Threat-model examples — sample outputs from
/hulumi-threat-model. - Release notes — package-release notes and security-advisory preparation docs.
- Lessons learned — per-milestone notes capturing design decisions and surprises.
- Launch artifacts — outreach drafts, blog pitches, CFP submissions.
- Runbooks — AWS, GitHub, K8s baseline, combined Operations + K8s security. Layout convention: docs/slo/README.md.
Two formats of the same material on the drift classifier. Pick whichever fits how you want to read it.
- Drift detection that actually tells you what happened — narrative tour. Reads start-to-finish; uses analogies; explains the verdict matrix, the TLA+ verification, the probe, and the guardrails by building intuition first. Good as a blog draft, a handout, or a reading list entry.
- TLA+-Verified Drift Detection for Pulumi — reference paper. Same content in dense citation form with code-line links, file paths, and a §-by-§ index. Good when you want to point at a specific test or trace a property to its source.
- IDs only. Every reference to CCM, AICM, CIS, CAIQ, NIST, or ATLAS controls is by ID with a link to the upstream. We never embed verbatim control text in
skills/orpackages/source. See licensing.md for the rationale. - Code samples are the contract. TypeScript snippets in component docs and cookbooks are kept in sync with
packages/*/tests/BDD suites. If a snippet here drifts from the test, the test wins — please open an issue. - Release notes are the contract. The root README release history and CHANGELOG.md tell you which package release shipped each public API. If a doc references something marked
planned, treat it as a forward reference, not a present-tense API.