Your security team requires all infrastructure deployments to pass policy checks before applying. How do you implement policy as code using Pulumi CrossGuard, and how does it compare to OPA/Sentinel?
Quick Answer
CrossGuard is Pulumi's policy-as-code framework that runs PolicyPacks (written in TypeScript or Python) during `pulumi preview` and `pulumi up`. Policies validate resource configurations before deployment, with enforcement levels of advisory, mandatory, or disabled. Unlike OPA, CrossGuard has native access to Pulumi resource types and outputs.
Detailed Answer
CrossGuard Architecture
CrossGuard PolicyPacks are collections of rules that run against the resource graph during Pulumi operations. Each policy can inspect individual resources (validateResource), the entire stack (validateStack), or resource configurations before creation. Policies run locally during pulumi up or can be enforced server-side via Pulumi Cloud, where the organization admin configures which PolicyPacks are mandatory for which stacks.
Enforcement Levels
Three levels control what happens when a policy violation is detected: advisory logs a warning but allows deployment to proceed, mandatory blocks deployment entirely, and disabled skips the policy. In practice, start new policies as advisory to measure impact, then promote to mandatory after teams have remediated violations. Pulumi Cloud allows setting enforcement levels per stack, so you might enforce strict policies in production but keep them advisory in development.
Comparison with OPA and Sentinel
OPA (Open Policy Agent) uses Rego, a purpose-built policy language. It's provider-agnostic and can evaluate Terraform plans, Kubernetes manifests, and API requests. Sentinel is HashiCorp's policy framework, tightly integrated with Terraform Cloud/Enterprise. CrossGuard's advantage is that policies are written in the same language as your infrastructure code (TypeScript/Python), leveraging IDE support and type checking. Its disadvantage is that it only works with Pulumi. For organizations standardized on Pulumi, CrossGuard is the natural choice. For multi-tool environments, OPA provides broader coverage.
Advanced Patterns
Stack-level policies can enforce architectural constraints like 'every stack must have at least one CloudWatch alarm' or 'total estimated monthly cost must not exceed $5000'. You can combine CrossGuard with Pulumi ESC to apply different policy sets based on environment (strict for prod, relaxed for dev). Custom remediation advisories can suggest the exact fix for violations.