Pulumi

Key features

• Seven provisioning languages Write infrastructure in TypeScript, Python, Go, .NET, Java, YAML, or HCL, reusing existing editors, packages, loops, and test frameworks rather than learning a separate configuration language.[1]

• Thousands of cloud providers Address AWS, Azure, Google Cloud, and Kubernetes plus a registry of thousands of cloud and SaaS providers, combining resources across accounts and vendors in one program.[1]

• Previewed updates Review the planned change set before applying it, which makes pull-request review of infrastructure changes concrete and auditable.[1]

• Self-managed state backends Run pulumi login against a local directory, S3, Google Cloud Storage, Azure Blob Storage, or PostgreSQL to keep state inside infrastructure the team already operates; backup and shared access then remain the team's responsibility.[1]

• Automation and REST APIs Embed stack lifecycle operations into applications, internal platforms, and CI/CD pipelines through language-specific SDKs and the REST API, available on every Pulumi Cloud edition.[1]

• Policy as code Author reusable policy packs evaluated against proposed changes, advisory on Essentials and enforced on Pro and above, with Enterprise conformance packs for frameworks such as ISO 27001 and PCI DSS.[1]

• Drift detection and remediation Detect configuration drift on Pro and above and remediate it there, with time-to-live stacks for ephemeral environments.[1]

• Secrets and configuration (ESC) Centralize secrets and configuration with version history, dynamic credentials, database rotation, and customer-managed keys on Pro and above; the Free tier includes basic ESC with 25 secrets.[1]

Who will love it

• Application-fluent platform teams Teams already writing TypeScript, Python, or Go can review, test, and refactor infrastructure with familiar idioms instead of maintaining a separate HCL skill base.[1]

• Multi-cloud organizations One workflow covering AWS, Azure, Google Cloud, and Kubernetes suits estates where resources span providers and a single declarative dialect would need provider-by-provider workarounds.[1]

• Governed enterprises Organizations needing enforced policy, audit logs, customer-managed keys, and SCIM user sync can buy those controls on Pro and Enterprise rather than building them around a CLI.[1]

Who should avoid it

• HCL-invested Terraform estates Teams with large reviewed Terraform configurations and Terraform-compatible tooling gain little by rewriting; a Terraform-compatible path such as OpenTofu preserves that investment.[1]

• SSO starts at $400 per month SAML-based single sign-on and advanced RBAC are Pro features, so teams that require SSO on a small budget face a pricing wall, not a technical one.[1]

• Offline-only operators Local-only state works without Pulumi Cloud, but provisioning public clouds inherently needs network access, so fully disconnected operation is not a supported posture.[1]

Compatibility considerations