Pulumi Infrastructure as Code for Real-Language Cloud Automation

Terraform (HCL) has a larger provider ecosystem and more community modules. Pulumi is the better fit when your team already writes TypeScript, Python or Go and wants to use real language features — loops, functions, classes, unit tests — without learning HCL. Pulumi also provides the Automation API for embedding IaC in application code, which Terraform cannot match. Both tools are mature; the choice is largely about your team's existing language skills and the need for programmable automation.

Pulumi supports multiple state backends: Pulumi Cloud (managed, with RBAC, history and policy enforcement), S3 with server-side encryption and DynamoDB locking, Azure Blob Storage, and GCS. We separate state per environment (dev / staging / prod) and per major subsystem to limit blast radius. State files are encrypted at rest; sensitive outputs are marked `Output.secret` so they are encrypted in state and never logged.

Pulumi offers two layers of secrets management. Stack-level secrets use the stack's encryption key (Pulumi Cloud or a customer-managed key) to encrypt individual output values in state. Pulumi ESC (Environments, Secrets, Config) is the newer, recommended approach: secrets are stored centrally, version-controlled, encrypted server-side, and injected into stacks and CI environments at run time — eliminating plaintext credentials from state files and CI logs entirely.

CrossGuard is Pulumi's policy-as-code framework. You write policies in TypeScript or Python that assert on resource properties — encryption enabled, public access blocked, required tags present. Policies are bundled into policy packs and run server-side on Pulumi Cloud (blocking the update) or locally in CI. CrossGuard supports advisory policies (warn only) and mandatory policies (block deploy). Regulated clients use mandatory packs to ensure no non-compliant resource reaches production.

Yes. Pulumi provides two testing layers. Unit tests mock the Pulumi SDK and assert on resource configurations without making cloud API calls — fast and runnable in CI without credentials. Property-based tests use the real Pulumi engine against a test stack and validate that deployed resources satisfy invariants. We write both layers for every non-trivial component, giving teams the same test confidence for infrastructure as for application code.

Pulumi ships `pulumi convert --from terraform`, which translates HCL modules to TypeScript, Python or Go. For large codebases we convert incrementally: wrap existing Terraform state with Pulumi's Terraform remote-state data source, then migrate subsystems one by one. State for already-provisioned resources is imported with `pulumi import` so Pulumi takes ownership without reprovisioning. We run both Terraform and Pulumi in parallel during the transition window to avoid downtime.

Each cloud is a separate Pulumi provider installed as a package dependency. We organise stacks by environment and cloud region, use stack references to share outputs across stacks (e.g. a shared networking stack consumed by application stacks), and maintain a library of reusable components for common patterns on each cloud. Provider versions are pinned in code and upgraded on a scheduled cadence with automated preview runs to catch breaking changes before they propagate.