# Pulumi ships a 238-policy ISO/IEC 27001:2022 pack for AWS

DevFeed: [Pulumi ships a 238-policy ISO/IEC 27001:2022 pack for AWS](<https://devfeed.tech/articles/enforce-iso-27001-across-your-aws-infrastructure-19009.md>)

Original publisher: [Read original article](<https://www.pulumi.com/blog/iso-27001-policy-pack-for-aws/>)

Author: Dan Biwer

Published: 2026-06-30T00:00:00Z

Content type: release

Language: en

Sources: [Pulumi](<https://devfeed.tech/sources/pulumi.md>)

Topics: [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [Security](<https://devfeed.tech/topics/security.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>), [configuration](<https://devfeed.tech/topics/configuration.md>)

Tags: [audit](<https://devfeed.tech/tags/audit.md>), [aws](<https://devfeed.tech/tags/aws.md>), [compliance](<https://devfeed.tech/tags/compliance.md>), [crossguard](<https://devfeed.tech/tags/crossguard.md>), [features](<https://devfeed.tech/tags/features.md>), [governance](<https://devfeed.tech/tags/governance.md>), [infrastructure](<https://devfeed.tech/tags/infrastructure.md>), [iso](<https://devfeed.tech/tags/iso.md>), [iso-27001](<https://devfeed.tech/tags/iso-27001.md>), [policy](<https://devfeed.tech/tags/policy.md>), [policy-as-code](<https://devfeed.tech/tags/policy-as-code.md>), [product](<https://devfeed.tech/tags/product.md>), [pulumi](<https://devfeed.tech/tags/pulumi.md>), [pulumi-cloud](<https://devfeed.tech/tags/pulumi-cloud.md>), [security](<https://devfeed.tech/tags/security.md>), [standard](<https://devfeed.tech/tags/standard.md>)

## AI overview

Pulumi announces a pre-built ISO/IEC 27001:2022 policy pack for AWS, available in Pulumi Cloud as iso-27001-aws. The pack contains 238 policies mapped to relevant ISO 27001 controls and supports auditing existing AWS resources and preventing non-compliant resources during pulumi up.

## Source excerpt

ISO/IEC 27001 is the international standard for information security management. Proving you meet it usually means months of mapping abstract security controls to concrete cloud configuration, then authoring custom checks one resource at a time. We're changing that. Today we're shipping a pre-built ISO/IEC 27001:2022 policy pack for AWS, live now in Pulumi Cloud as iso-27001-aws. It encodes the standard's security expectations as 238 ready-to-run policies, so you can align your AWS estate to ISO 27001 in minutes, not months. Why ISO 27001 matters For many companies, ISO 27001 is what stands between them and a customer or a market. The sooner you can reach a certifiable state and prove you stay there, the less compliance slows the business down. The pack collapses months of policy work into something you run continuously, so security keeps pace with growth instead of blocking it. How the pack maps to ISO 27001 The hard part of ISO 27001 has always been translation: its controls are written in the language of governance and risk management, not in the language of AWS resources. Every team has had to interpret each control and decide what it means for an S3 bucket or an RDS instance. The pack does that interpretation for you. Its 238 policies are aligned to the relevant ISO 27001 controls, so each result connects back to the standard instead of leaving you to map it yourself. You can browse the full pack in the pack reference. Audit and prevent The same pack works two ways, so you can both reach compliance and stay there: Audit. Scan your existing AWS estate against the pack, including resources that Pulumi doesn't manage. You get an honest baseline of where you stand against ISO 27001 today, with every finding tied back to the control it affects. Prevent. Run the same pack as a preventative policy during pulumi up to block non-compliant resources before they're ever created. New infrastructure is born aligned to the standard. Audit gets you clean. Preventative policie