Pulumi

Overview

Pulumi takes a different line from Terraform: instead of a bespoke configuration language, you describe infrastructure in a general-purpose programming language. TypeScript, Python, Go, .NET, Java, plus YAML and HCL are all supported, so reuse comes from ordinary functions, classes and packages.

The trade-off is familiar. Loops, conditionals and abstractions are natural, and you get your language's tooling and tests; the cost is that infrastructure code can become as complex as application code.

State works much like Terraform's, but the default backend is the hosted Pulumi Cloud. You can self-manage it on S3, Azure Blob, Google Cloud Storage, PostgreSQL or locally, with the caveat the docs give: do-it-yourself backends cannot always recover cleanly from partial failures. Cloud credentials stay on the client.

Policy as code is CrossGuard, written in TypeScript, Python or Open Policy Agent's Rego, run either preventatively during preview and update, or as continuous audit. Secrets and configuration are handled by Pulumi ESC, which can issue short-lived OIDC credentials for AWS, Azure, GCP and GitHub instead of storing keys.

For data teams, Databricks and Snowflake providers are in its registry, and existing resources can be imported, including in bulk.

The CLI and SDKs are Apache 2.0. Pulumi Cloud is the commercial service, priced in credits with published rates, and self-hosting that service requires the Enterprise tier.

Key features and capabilities

The same headings are used for every infrastructure as code entry, so two tools can be read side by side.

How infrastructure is described

• General-purpose languages: TypeScript, Python, Go, .NET and Java, plus YAML and HCL
• Reuse through ordinary language constructs rather than a bespoke module system
• The docs note some functionality may land in one language before others

State and planning

• Hosted Pulumi Cloud is the default backend; self-managed options include S3, Azure Blob, GCS and PostgreSQL
• The docs warn that do-it-yourself backends cannot always recover from partial failures
• Import of existing resources one at a time or in bulk, generating code in your language
• Drift detection and remediation is a paid Pro-tier feature

What it can provision

• Providers for AWS, Azure, Google Cloud, Kubernetes, Docker and many SaaS services
• Databricks and Snowflake providers for data platform work
• Total provider count is not published

Policy, testing and secrets

• CrossGuard policy as code in TypeScript, Python or Open Policy Agent Rego
• Preventative enforcement blocks a deployment, or audit mode scans continuously
• Pulumi ESC centralises secrets and configuration, with short-lived OIDC credentials
• SAML and advanced roles on Pro; SCIM synchronisation on Enterprise

Team workflow

• Hosted service manages state and history, with unlimited projects and stacks even on the free tier
• Code reviews, Slack integration, resource and property search from the Essentials tier
• Organisation-wide policy enforcement and an internal developer platform on Pro

Integrations

• Pulumi Deployments for CI/CD, included from the free tier
• Kubernetes as a first-class provider
• Terraform and OpenTofu interoperability, including HCL, existing state and modules

How it runs

• CLI and SDKs under Apache 2.0
• Managed Pulumi Cloud, or self-hosted with the Enterprise tier
• Self-hosting options: Kubernetes on EKS, AKS or GKE, AWS ECS, or Docker with MySQL and object storage

Pricing

SubscriptionFree for one user; Essentials $40 a month

Free covers one user and up to 500 workflow minutes, with unlimited projects, stacks and history. Essentials is $40 a month including 40 credits and up to 500 managed resources, then $0.1825 per resource a month. Pro is $400 a month including 400 credits and up to 2,000 resources, and adds SAML, advanced roles, preventative policy, drift detection and audit-log export. Enterprise is quoted and adds self-hosting, compliance packs and SCIM. One credit is one US dollar.

Vendor pricing page →

Demos and videos

• Terraform and HCL in Pulumi: state, modules and OpenTofu-compatible code Tutorial · YouTube
• Infrastructure as code on AWS with TypeScript Tutorial · YouTube
• PulumiTV channel Channel or playlist · YouTube

About Pulumi

Pulumi Corporation was founded in November 2017 and is based in Seattle, with Joe Duffy as co-founder and chief executive. Its published funding totals $99m: a $5m seed in 2017, $15m Series A in 2018, $37.5m Series B in 2020 and a $41m Series C led by Madrona in October 2023. The CLI and SDKs are Apache 2.0 and company-led rather than foundation-governed, with Pulumi Cloud sold as the commercial service.

Founded 2017 · Seattle, Washington · pulumi.com