Pulumi

When to Use

• Developers: You prefer TypeScript over HCL YAML.
• Complexity: You need genuine logic (if/else, loops, external API calls) during infrastructure definition.
• Testing: You want to unit test your infrastructure code using standard test runners (Jest, Pytest).

Quick Start (TypeScript)

import * as pulum from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const bucket = new aws.s3.Bucket("my-bucket", {
  acl: "private",
});

export const bucketName = bucket.id;

Core Concepts

Programming Model

Pulumi ESC (Environments, Secrets, Config)

Automation API

Best Practices (2025)

• Use ComponentResources: Abstract complexity into reusable Classes (e.g.,

  class MyMicroservice extends ComponentResource

  ).
• Use Secrets Provider: Don't store secrets in plaintext config. Pulumi encrypts config values by default.
• Unit Test: Use mocks to test that your Security Groups don't allow 0.0.0.0/0.

• Don't mix logic and state: Keep side-effects (API calls) predictable.

References

• Pulumi Documentation