Local Pulumi policy packs resolve ESC environments
Introduced 2026-04-16 · score 0.96
HOW TO USE IT
When configuring a local policy pack with ESC environment secrets or configuration, add an `environments` array of environment references to the JSON config and run `pulumi preview` with both policy-pack flags. ESC configuration is merged into the initial policy configuration; file configuration can override it.
pulumi preview --policy-pack <path-to-policy-pack> --policy-pack-config <path-to-config.json>{
"environments": ["<org>/<environment>", "<org>/<environment>"],
"<policy-name>": {
"<setting>": "<value>"
}
}WHY THIS HELPS
Configure a local policy pack to use ESC environment secrets and configuration.
REQUIREMENTS AND LIMITATIONS
- Version: v3.231.0
- --policy-pack <path-to-policy-pack> (required): Path to the local policy pack directory; the pack must be present on disk.
- --policy-pack-config <path-to-config.json> (required): Path to the JSON file containing local policy configuration.
- environments: JSON array of ESC environment references to resolve for the local policy pack.
- <policy-name>: Object containing configuration for that policy; file configuration can override ESC configuration.
- Prerequisite: Pulumi CLI installed; local policy pack available on disk; the runtime chosen by the pack installed.
- Prerequisite: Pulumi CLI v3.231.0 or later for the documented release change.
- The environment references are resolved client-side via the ESC backend.
- File policy configuration can override ESC configuration.
FIRST-PARTY EVIDENCE
- https://github.com/pulumi/pulumi/releases/tag/v3.231.0
- https://github.com/pulumi/pulumi/pull/22495
- https://www.pulumi.com/docs/discovery-governance/guides/write-a-policy-pack/
- https://www.pulumi.com/docs/discovery-governance/concepts/policy-as-code/
Check the installed version and the source before using it. Entry JSON