Current Output Limitations

Oct 13, 2025 by pynkocean.com 53 views

Introduction

When running a preview or an update with --json, including information about policy packs, policies, and any violation/remediation is crucial for users to understand the compliance status of their infrastructure. Currently, the output generated by pulumi preview or pulumi update with --json does not contain any information about policy packs, its policies, and about any infringed policies. This article proposes enhancements to the Pulumi CLI output to include this critical information.

Current Output Limitations

When running pulumi preview or pulumi update with --json, the output generated is in JSON format, which is great for parsing and formatting. However, if one or more policy packs are evaluated, the returned JSON doesn't contain any information about the policy pack(s), its policies, and about any infringed policies. This limitation makes it challenging for users to understand the compliance status of their infrastructure.

Example Current Output

{
  "diagnostics": [
    {
      "message": "Total registered policies: 454\n\n",
      "severity": "info#err"
    },
    {
      "message": "Selected policies: 84\n\n",
      "severity": "info#err"
    },
    {
      "message": "Remaining (unselected) policies: 370\n\n",
      "severity": "info#err"
    },
    {
      "message": "---\n\n",
      "severity": "info#err"
    },
    {
      "message": "Included policy packages:\n\n",
      "severity": "info#err"
    },
    {
      "message": "  @pulumi/aws-compliance-policies: 0.0.23\n\n",
      "severity": "info#err"
    },
    {
      "message": "  @pulumi/kubernetes-compliance-policies: 0.1.5\n\n",
      "severity": "info#err"
    }
  ],
  "result": {
    "changes": []
  }
}

Proposed Enhancements

To address the current output limitations, we propose the following enhancements:

Include Policy Pack Information: The output should include information about the policy pack(s) evaluated, such as the name, version, and description.
Include Policy Information: The output should include information about the policies evaluated, such as the name, description, and compliance status.
Include Violation/Remediation Information: The output should include information about any infringed policies, such as the policy name, description, and remediation steps.

Example Proposed Output

{
  "policyPacks": [
    {
      "name": "AWS Compliance Policies",
      "version": "0.0.23",
      "description": "AWS compliance policies for Pulumi"
    },
    {
      "name": "Kubernetes Compliance Policies",
      "version": "0.1.5",
      "description": "Kubernetes compliance policies for Pulumi"
    }
  ],
  "policies": [
    {
      "name": "Policy 1",
      "description": "Policy 1 description",
      "complianceStatus": "Compliant"
    },
    {
      "name": "Policy 2",
      "description": "Policy 2 description",
      "complianceStatus": "Non-Compliant"
    }
  ],
  "violations": [
    {
      "policyName": "Policy 2",
      "description": "Policy 2 description",
      "remediationSteps": [
        {
          "step": "Step 1",
          "description": "Step 1 description"
        },
        {
          "step": "Step 2",
          "description": "Step 2 description"
        }
      ]
    }
  ],
  "result": {
    "changes": []
  }
}

Benefits of Proposed Enhancements

The proposed enhancements will provide users with a better understanding of the compliance status of their infrastructure. By including information about policy packs, policies, and any violation/remediation, users can:

Easily identify non-compliant policies and take corrective action
Understand the compliance status of their infrastructure
Improve the overall security and compliance of their infrastructure

Conclusion

In conclusion, the proposed enhancements to the Pulumi CLI output will provide users with a better understanding of the compliance status of their infrastructure. By including information about policy packs, policies, and any violation/remediation, users can easily identify non-compliant policies and take corrective action. We believe that these enhancements will improve the overall security and compliance of users' infrastructure.

Recommendations

We recommend that the Pulumi team implement the proposed enhancements to the Pulumi CLI output. This will provide users with a more comprehensive understanding of the compliance status of their infrastructure and improve the overall security and compliance of their infrastructure.

Future Work

In the future, we recommend that the Pulumi team consider the following:

Enhance Policy Pack Information: Consider including additional information about policy packs, such as the author, creation date, and last updated date.
Enhance Policy Information: Consider including additional information about policies, such as the policy type, scope, and impact.
Enhance Violation/Remediation Information: Consider including additional information about violations, such as the severity level and remediation steps.

Q: What is the current limitation of the Pulumi CLI output when running `pulumi preview` or `pulumi update` with `--json`?

A: The current limitation is that the output generated does not contain any information about policy packs, its policies, and about any infringed policies.

Q: Why is it important to include information about policy packs, policies, and any violation/remediation in the Pulumi CLI output?

A: Including this information is crucial for users to understand the compliance status of their infrastructure. It allows users to easily identify non-compliant policies and take corrective action, which improves the overall security and compliance of their infrastructure.

Q: What are the proposed enhancements to the Pulumi CLI output?

A: The proposed enhancements include:

Include Policy Pack Information: The output should include information about the policy pack(s) evaluated, such as the name, version, and description.
Include Policy Information: The output should include information about the policies evaluated, such as the name, description, and compliance status.
Include Violation/Remediation Information: The output should include information about any infringed policies, such as the policy name, description, and remediation steps.

Q: What are the benefits of the proposed enhancements?

A: The benefits include:

Easily identifying non-compliant policies and taking corrective action
Understanding the compliance status of their infrastructure
Improving the overall security and compliance of their infrastructure

Q: How will the proposed enhancements improve the overall security and compliance of users' infrastructure?

A: The proposed enhancements will provide users with a better understanding of the compliance status of their infrastructure. By including information about policy packs, policies, and any violation/remediation, users can easily identify non-compliant policies and take corrective action, which improves the overall security and compliance of their infrastructure.

Q: What is the recommended course of action for the Pulumi team?

A: We recommend that the Pulumi team implement the proposed enhancements to the Pulumi CLI output. This will provide users with a more comprehensive understanding of the compliance status of their infrastructure and improve the overall security and compliance of their infrastructure.

Q: What are some potential future enhancements to the Pulumi CLI output?

A: Some potential future enhancements include:

Enhance Policy Pack Information: Consider including additional information about policy packs, such as the author, creation date, and last updated date.
Enhance Policy Information: Consider including additional information about policies, such as the policy type, scope, and impact.
Enhance Violation/Remediation Information: Consider including additional information about violations, such as the severity level and remediation steps.

Q: How can users provide feedback on the proposed enhancements?

A: Users can provide feedback by commenting on this issue or by reaching out to the Pulumi team directly. We encourage users to share their thoughts and suggestions on how to improve the Pulumi CLI output.