Hulumi is released under the Apache License 2.0 in its entirety.
Hulumi cites third-party control frameworks (CSA CCM, CSA AICM, CIS AWS Foundations Benchmark, NIST SP 800-53 Rev 5, NIST SSDF, MITRE ATLAS) by identifier only. The full mapping policy lives in docs/mappings/licensing.md.