Pulumi — Modern Infrastructure as Code

Provision any cloud infrastructure using TypeScript, Python, Go, C#, or Java. Pulumi brings real programming languages, package managers, and IDE tooling to infrastructure.

What is Pulumi?

Pulumi is an open-source infrastructure-as-code platform founded in 2017 that fundamentally rethinks how developers define cloud resources. Rather than inventing a new configuration language, Pulumi lets you write infrastructure code using TypeScript, Python, Go, C#, or Java — the same languages you already use for your applications. This means real loops, functions, classes, conditionals, package managers (npm, pip, go mod), unit tests, and all the IDE tooling you depend on daily.

Pulumi supports over 100 cloud providers through a rich provider ecosystem including AWS, Azure, Google Cloud, Kubernetes, Cloudflare, MongoDB Atlas, GitHub, and many SaaS platforms. A single Pulumi program can provision resources across multiple providers, making it uniquely suited for organizations running workloads across clouds or managing cloud infrastructure alongside SaaS configuration.

Key Features

• General-purpose languages — TypeScript, Python, Go, C#, Java with full IDE support
• Multi-cloud — one platform for AWS, Azure, GCP, Kubernetes, and 100+ providers
• State management — Pulumi Cloud (managed), S3, Azure Blob, GCS, or local backends
• Stack config & secrets — per-environment config with encrypted secret values
• Automation API — embed Pulumi engine in your applications for programmatic deployments
• CrossGuard Policy as Code — enforce organizational policies automatically during deployments
• StackReference — compose stacks together and share outputs across environments
• pulumi preview — dry-run that shows exactly what will change before deploying

Getting Started: TypeScript Program

Install the Pulumi CLI and create a new project:

curl -fsSL https://get.pulumi.com | sh
pulumi new aws-typescript
npm install

Define an S3 bucket, Lambda function, and API Gateway:

// index.ts
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const config = new pulumi.Config();
const environment = config.require("environment");

// S3 bucket for file storage
const bucket = new aws.s3.Bucket("data-bucket", {
  acl: "private",
  versioning: { enabled: true },
  serverSideEncryptionConfiguration: {
    rule: {
      applyServerSideEncryptionByDefault: {
        sseAlgorithm: "AES256",
      },
    },
  },
  tags: { Environment: environment, ManagedBy: "Pulumi" },
});

// IAM role for Lambda
const lambdaRole = new aws.iam.Role("lambda-role", {
  assumeRolePolicy: aws.iam.assumeRolePolicyForPrincipal({
    Service: "lambda.amazonaws.com",
  }),
});

new aws.iam.RolePolicyAttachment("lambda-basic", {
  role: lambdaRole.name,
  policyArn: aws.iam.ManagedPolicy.AWSLambdaBasicExecutionRole,
});

// Lambda function
const processor = new aws.lambda.Function("processor", {
  runtime: aws.lambda.Runtime.NodeJS20dX,
  handler: "index.handler",
  role: lambdaRole.arn,
  code: new pulumi.asset.AssetArchive({
    "index.js": new pulumi.asset.StringAsset(
      `exports.handler = async (e) => ({ statusCode: 200, body: 'OK' });`
    ),
  }),
  environment: {
    variables: { BUCKET_NAME: bucket.bucket },
  },
});

// Stack outputs — accessible from other stacks via StackReference
export const bucketName = bucket.bucket;
export const bucketArn = bucket.arn;
export const lambdaArn = processor.arn;

Manage stacks and deploy:

pulumi stack init dev                    # create dev stack
pulumi config set environment dev       # set config value
pulumi config set --secret dbPass s3cr3t  # encrypted secret
pulumi preview                          # dry-run, see what changes
pulumi up                               # deploy
pulumi stack output bucketName          # read stack output
pulumi destroy                          # tear down resources

Automation API Example

// deploy-programmatically.ts
import { LocalWorkspace } from "@pulumi/pulumi/automation";

async function provisionTenant(tenantId: string) {
  const stack = await LocalWorkspace.createOrSelectStack({
    stackName: `tenant-${tenantId}`,
    workDir: "./infrastructure",
  });

  await stack.setConfig("tenantId", { value: tenantId });
  await stack.setConfig("dbPassword", { value: "secret", secret: true });

  const result = await stack.up({ onOutput: console.log });
  console.log(`Tenant ${tenantId} provisioned:`, result.outputs);
  return result.outputs;
}

// Call from your SaaS app when a customer signs up
provisionTenant("customer-abc-123");

Pulumi vs Alternatives

Use Cases

• Multi-cloud infrastructure managed from a single codebase with shared language and tooling
• SaaS platforms that provision cloud resources per customer using the Automation API
• Teams who want to unit-test infrastructure code with Jest, pytest, or Go testing
• Organizations enforcing security and compliance policies automatically via CrossGuard
• Developers migrating from Terraform who prefer TypeScript or Python over HCL
• Kubernetes users who want to manage cloud resources alongside K8s manifests

Pros and Cons