Pulumi
Connect Pulumi to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Pulumi to collect infrastructure evidence with automated compliance tests, switched on per workspace.
| Category | Infrastructure |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Pulumi's guide | pulumi.com |
Connect with an API token
-
In Pulumi:
- Sign in to Pulumi Cloud as a user who is an organization admin (Safeguard needs an admin's credential to read the full member list).
- Open the user menu and choose Personal access tokens.
- Click Create token, optionally add a description, choose an expiration period (up to two years), and click Create token in the dialog.
- Copy the token value and paste it into Safeguard's Access token field.
- Alternative: an organization admin can create an organization token under Settings › Access Management › Access Tokens. An organization token can do anything its assigned RBAC role permits; if no role is assigned at creation time it gets the organization's default member role, so assign an admin role if you use one.
Where to find the other values:
- Organization: Your Pulumi Cloud organization name. The fetched docs do not name the screen that displays it.
Pulumi's public documentation does not cover every step.
Source: pulumi.com, checked 2026-10-07.
The permissions Safeguard needs:
organization admin. Pulumi shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. Needs Pulumi's Business Critical (policy groups) plan. -
On Compliance › Connectors, open Pulumi, click Connect, choose API token and fill in:
Field What to enter Organization Required. Access token Required. Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read Pulumi and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.2, CC6.3, CC8.1 | 4 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.6.5, A.8.2, A.8.9 | 4 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4) | 3 |
| PCI DSS | Automated tests | 2.2.1, 7.2.2, 7.2.4, 8.2.5 | 4 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-05, PR.PS-01 | 4 |
These tests are switched on per workspace by the Safeguard team.
Pulumi Cloud connect to the same provider as Pulumi, and these tests run for a connection made through any of them.
Related
- Infrastructure connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks