Support Pulumi

[thewizarodofoz]

Great job on this tool guys. Do you have plans to support Pulumi?

[schosterbarak]

@thewizarodofoz This is definitely doable :) And would accept a contribution. I'd love to discuss more and give guidance on it if you'd like at https://slack.bridgecrew.io/

[stale[bot]]

Thanks for contributing to Checkov! We've automatically marked this issue as stale to keep our issues list tidy, because it has not had any activity for 6 months. It will be closed in 14 days if no further activity occurs. Commenting on this issue will remove the stale tag. If you want to talk through the issue or help us understand the priority and context, feel free to add a comment or join us in the Checkov slack channel at https://slack.bridgecrew.io Thanks!

[GaboFDC]

Hey, this would still be really nice to have? I could check about the guidance on how to implement, just a bit concerned on how big the scope will, I can contribute, but don't really have that much time.

[metahertz]

Hey @GaboFDC! Thanks for jumping in here to 'unstale' this issue :) Any time at all is much appreciated. I've added the help wanted tag too, lets see if we can create a little Pulumi team!

[spaceoddite]

Hey @metahertz Is this project active? I would like to contribute.

[metahertz]

Hey @spaceoddite it certainly is active! We've had a crazy month of contributions with Hacktoberfest!

Theres been some conversation internally about how we'd go about supporting Pulumi (which we'd very much like too and any contributions would be awesome!).

Possibly the easiest implementation would be if Pulumi allowed rendering of the "resultant infrastructure" out into more schema'd languge (Terraform, CloudFormation etc) then we could run against those existing Checkov frameworks with some logic to annotate the original Pulumi code with the original location of the failed policies. This is very similar to how we support HELM, rendering out the chart to resultant Kubernetes manifests then passing them through the kubernetes policies.

Are you a Pulumi user? Would love any insights or thoughts on this :)

[spaceoddite]

@metahertz Glad to hear about the support :) we can get the infra using "pulumi stack export" cmd - but this is available only after deployment An other way could be using the "pulumi preview -j " cmd - this gives out json format some logic would be needed to convert this to into existing checkov frameworks.

[metahertz]

Ooh that sounds interesting with preview -j, especially if theres a documented schema for that output!

[spaceoddite]

Hi I have a sample output of preview -j for this example azure-py-webserver as a github gist here. The code creates a virtual machine and other related resources like vnet, publicip and starts a simple webserver. This code is written in python, but the output should be same when written in go or ts I will look if this output has any documentation.

[spaceoddite]

@metahertz @schosterbarak I did more digging and found that pulumi has a policy as code module crossguard an example implementation of checking public access for an s3 bucket is here - example Can we automate this to have all checkov policies someway?

[paige-wdc]

Any updates on this? My org is migrating to Pulumi and it would be incredibly helpful for us.

[joshrichards37]

Would be really good to get this support added as my org are currently using Pulumi but haven't implemented any policy validation yet.

[JustJordanT]

This would be very nice to have! I would love to contribute to this!

[spaceoddite]

hi, I would love to contribute as well. A starting point of exploration would be policy as code module of pulumi - https://www.pulumi.com/docs/guides/crossguard/

[stale[bot]]

Thanks for contributing to Checkov! We've automatically marked this issue as stale to keep our issues list tidy, because it has not had any activity for 6 months. It will be closed in 14 days if no further activity occurs. Commenting on this issue will remove the stale tag. If you want to talk through the issue or help us understand the priority and context, feel free to add a comment or join us in the Checkov slack channel at https://slack.bridgecrew.io Thanks!

[stale[bot]]

Closing issue due to inactivity. If you feel this is in error, please re-open, or reach out to the community via slack: https://slack.bridgecrew.io Thanks!

[WP-LKL]

I think we could reopen this, a highly requested feature X)

[jmcvetta]

It's a shame these obnoxious bots go around closing Issues that aren't actually closed.

[DaniWS]

Would be nice to have!

[dulakm]

Could this be reopened?

[juancho088]

Hi all, also we are starting to use Pulumi and I think the tool is getting a really decent traction, this should be reopened