A small library of Pulumi/GCP patterns for the parts of infrastructure-as-code where a subtle mistake is a security incident, not a broken build. Each pattern is written up as: the failure mode it prevents, a minimal generic code sample, and — where it applies — the test that stops the mistake from ever recurring.
Generic and illustrative. All identifiers are placeholders (
platform-prod,example.com,deploy-sa@…). These are patterns to adapt, not a deployable product.
| Pattern | Prevents |
|---|---|
| authoritative-iam | Authoritative IAM bindings silently clobbering each other's members — the "why did that role lose its members overnight?" outage. Includes an AST regression test that fails CI if a second authoritative binding for a role ever appears. |
| keyless-ci-wif | Long-lived service-account JSON keys in CI. Replaces them with Workload Identity Federation, with trust pinned to immutable repository claims so a repo rename or transfer can't hijack the deploy identity. |
| adopting-clickops-into-iac | Losing control of resources created by hand in the console. Adopts them into Pulumi with minimal blast radius — enforce one or two invariants, leave everything else owned by the operator lifecycle. |
| binary-authorization | Unverified container images reaching production. Stands up a Binary Authorization policy in dry-run first, with a documented path to enforcement and a risk-acceptance memo. |
They're the patterns where I've seen the gap between "the deploy succeeded" and "the estate is actually safe" bite hardest:
- IAM authority is the one most people get wrong, because the failure is silent and delayed — the members vanish on the next unrelated deploy, not the one that caused it.
- CI credentials are the highest-value secret you own; a leaked deploy key is game over, so the goal is to not have one at all.
- Click-ops drift is inevitable in any real org; the skill is adopting it safely rather than either ignoring it or rebuilding it and causing an outage.
- Supply chain (what image is even allowed to run) is the control most estates skip, and dry-run-first is how you add it without breaking every deploy on day one.
Every sample is trimmed to the pattern. Real stacks have more wiring (config plumbing, outputs, tests around the edges); that's deliberately elided so the pattern itself is legible. The companion architecture that ties these together lives in gcp-pulumi-reference-architecture.