HighFile-scopeGo Plug & play

Pulumi Go: protect critical resources from destroy

For stateful/critical infra (state buckets, databases), create resources with pulumi.Protect(true) to block accidental destroy.

Why this matters

Protection guards against destructive updates and human error.

Side-by-side examples engineers can pattern-match during review.

Avoid

bucket, err := s3.NewBucket(ctx, "prod-state", &s3.BucketArgs{})
if err != nil { return err }

Prefer

bucket, err := s3.NewBucket(ctx, "prod-state", &s3.BucketArgs{}, pulumi.Protect(true))
if err != nil { return err }

Good

pulumi.Protect(true)

Bad

// no Protect option

From the same buckets as this rule.

Critical
Disallow public ingress without explicit allowlist
For Ingress/Service of type LoadBalancer, require host/path allowlist and TLS; forbid 0.0.0.0/0 exposure without WAF or Auth.
infra-as-codesecurity-hardening+1
Critical
Pods must run as non-root with read-only root filesystem
Set securityContext.runAsNonRoot=true, runAsUser!=0, and readOnlyRootFilesystem=true on pods/containers.
infra-as-codesecurity-hardening+1
Critical
Pulumi TS: secrets must use Config.requireSecret
In Pulumi TypeScript programs, load sensitive values with new Config().requireSecret and pass as Secret<T>, never plain strings.
infra-as-codesecrets-credentials+1