Pulumi: Infrastructure as Code in Real Languages

Pulumi

Pulumi is an infrastructure-as-code tool that lets you define cloud resources in general-purpose programming languages — TypeScript, Python, Go, C#, Java — instead of a domain-specific config language. You get real functions, loops, conditionals, classes, and your language's package ecosystem for modeling infrastructure.

That's the headline trade-off versus Terraform's HCL: Pulumi gives you the full power (and the full footguns) of a programming language. It's a great fit for teams who want to share abstractions, write tests, and reuse their existing language tooling for infrastructure.

TL;DR

IaC in real languages (TypeScript, Python, Go, C#) with normal abstractions.
A program defines resources; a stack is an environment instance (dev/prod).
Manage state carefully — treat it like production data.
Preview changes before applying; keep secrets in encrypted config.

Quick Example

Defining a resource is just code — here, an S3 bucket in TypeScript:

Core Concepts

Program — code (in your language) that declares resources.
Stack — an isolated instance of a program (e.g. dev, staging, prod).
State — Pulumi's record of deployed resources (self-managed or Pulumi Cloud).
Config — per-stack parameters, including encrypted secrets.

Best Practices

Keep stacks small and composable; one per environment.
Standardize naming and tagging, ideally via shared helper code.
Use encrypted config secrets — never hard-code credentials in the program.
Preview every change before pulumi up, and review it like code.

Comparison: Pulumi vs Terraform

See Terraform.

Common Mistakes

Over-abstracting infrastructure

Concurrent applies corrupting state

FAQ

Pulumi or Terraform?

Pulumi if your team wants to define infrastructure in a real programming language — sharing libraries, writing unit tests, and using loops/conditionals naturally. Terraform if you prefer a focused declarative DSL with the largest provider ecosystem and simplest mental model. Both are mature, multi-cloud IaC tools.

Does Pulumi have state like Terraform?

Yes. Pulumi keeps a state record mapping your program to real resources. You can self-manage the state backend (S3, etc.) or use the Pulumi Cloud service, which adds locking and history. Either way, treat state as sensitive, production-critical data.

Which language should I use with Pulumi?

The one your team already knows — TypeScript and Python are the most popular. Using your primary language means you reuse existing tooling, testing, and skills, which is much of Pulumi's appeal.

How does Pulumi handle secrets?

Through encrypted configuration: secret values are encrypted in state and config, and decrypted only at deploy time. Mark values as secrets (pulumi config set --secret) rather than embedding plaintext credentials in your program.