Per-component documentation. Each component page includes tier matrix references, cited framework IDs, and a working Pulumi TypeScript snippet for both Sandbox and Startup-Hardened tiers.
| Component | Milestone | Doc |
|---|---|---|
hulumi.baseline.aws.SecureBucket |
v0.2 (M2) | secure-bucket.md |
hulumi.policies.aws.HulumiHardeningPack |
v0.2 (M2) | see ../tiers.md § HulumiHardeningPack rule matrix |
hulumi.baseline.aws.AccountFoundation |
v0.3 (M3) | account-foundation.md |
hulumi.baseline.aws.AwsOrganizationSecurityFoundation |
v1.5 (M1) | aws-organization-security-foundation.md |
| AWS secure primitives | v1.5 (M5) | aws-secure-primitives.md |
hulumi.baseline.aws.SecurityDetectionFoundation |
v1.5 (M6) | security-detection-foundation.md |
hulumi.drift.DriftClassifier |
v0.4 (M4) | drift-classifier.md |
hulumi validate live |
v1.5 (M4) | live-validator.md |
Three CrossGuard PolicyPacks added in runbook hulumi-operations-k8s-security Milestone 3. Each pack has its own entry point because @pulumi/policy allows only one PolicyPack per process. Point your PulumiPolicy.yaml at one of:
| Pack | Module entry point | Rules |
|---|---|---|
HulumiK8sHardeningPack |
@hulumi/policies/k8s/packs/hulumi-k8s-hardening |
WL-1 privileged containers · WL-2 host namespaces · WL-3 mutable image tags · WL-4 resources missing (advisory) · SVC-1 public LoadBalancer |
HulumiK8sRbacPack |
@hulumi/policies/k8s/packs/hulumi-k8s-rbac |
RBAC-1 wildcard verbs · RBAC-2 list / watch on Secrets · RBAC-3 cluster-admin RoleBinding / ClusterRoleBinding |
HulumiEksClusterPack |
@hulumi/policies/k8s/packs/hulumi-eks-cluster |
EKS-CL-1 public endpoint with broad CIDR · EKS-CL-2 audit logging required |
HulumiOperationsHardeningPack |
@hulumi/policies/aws/packs/hulumi-operations-hardening |
O-PATCH-1 Patch:Group enum · O-AUDIT-1 CloudTrail multi-region + log-file validation · O-AUDIT-2 CT log group KMS-encrypted · O-INSPECTOR-1 Inspector v2 full coverage |
HulumiAwsOrgHardeningPack |
@hulumi/policies/aws-org/packs/hulumi-aws-org-hardening |
ORG-1 delegated admins · ORG-2 role separation · ORG-3 SCP set · ORG-4 S3 account block switches · ORG-5 S3 account block present · ORG-6 sandbox SCP advisory |
All rules support the existing Suppression API: a { ruleId, urnScope, reason } entry on the suppressions config silences the rule for the matching URN. Suppressions without a non-empty reason are ignored.
Stable in the v1.2+ release trains. Compatibility with tested Helm chart versions is documented in packages/k8s-baseline/COMPATIBILITY.md and asserted in the release-readiness.test.ts BDD suite.
| Component | Doc |
|---|---|
hulumi.k8s.HardenedHelmRelease |
hardened-helm-release.md |
hulumi.k8s.MetricsServer |
metrics-server.md |
hulumi.k8s.EksSubnetTagger |
eks-subnet-tagger.md |
hulumi.k8s.EksAdminAccessPath |
eks-admin-access-path.md |
hulumi.k8s.IstioFoundation |
istio-foundation.md |
hulumi.k8s.AlbMeshedHttpEntrypoint |
alb-meshed-http-entrypoint.md |
hulumi.k8s.KubernetesSecretFromAwsSecretsManager |
kubernetes-secret-from-asm.md |
hulumi.k8s.RdsCredentialSecret |
rds-credential-secret.md |
hulumi.k8s.GitHubAppCredential |
github-app-credential.md |
hulumi.k8s.NamespaceFoundation |
namespace-foundation.md |
hulumi.k8s.EksRuntimeDetectionFoundation |
eks-runtime-detection-foundation.md |
hulumi.k8s.EksBackupFoundation |
eks-backup-foundation.md |
hulumi.k8s.EksAddonFoundation |
eks-addon-foundation.md |
hulumi.k8s.EksClusterFoundation |
eks-cluster-foundation.md |
hulumi.k8s.planUpgrade (library) |
eks-upgrade-planner.md |
The tier matrix for every baseline component lives in ../tiers.md.
| Component | Doc |
|---|---|
hulumi.cloudflare.ZoneFoundation |
zone-foundation.md |
hulumi.cloudflare.PublicHostname |
public-hostname.md |
hulumi.cloudflare.EdgeWafBaseline |
edge-waf-baseline.md |
hulumi.cloudflare.BotProtectionBaseline |
bot-protection-baseline.md |
hulumi.cloudflare.ProtectedAdminHostname |
protected-admin-hostname.md |
| Component | Doc |
|---|---|
hulumi.platform.CloudflareOriginIngress |
cloudflare-origin-ingress.md |
hulumi.platform.GitHubAwsOidcDeploymentRole |
github-aws-oidc-deployment-role.md |
hulumi.platform.DeploymentRepositoryFoundation |
deployment-repository-foundation.md |
hulumi.platform.BuildProvenanceFoundation |
build-provenance-foundation.md |
hulumi.platform.PulumiStateBackendFoundation |
pulumi-state-backend-foundation.md |
hulumi.platform.RunnerGovernanceFoundation |
runner-governance-foundation.md |
| Pack | Doc |
|---|---|
| GitHub OIDC trust guard | g-oidc-1.md |
| Cloudflare hardening | cloudflare-policy-packs.md |
| Origin bypass | origin-bypass-policy-pack.md |
| Deployment governance | deployment-governance-policy-pack.md |
| Workflow governance linter | workflow-governance-linter.md |