Stop 09 · Infrastructure as CodeTopics · 7/9

Pulumi / CloudFormation (Overview)

In short

Terraform isn't the only way to write infrastructure as code. You'll meet AWS CloudFormation in AWS-heavy teams and Pulumi in teams that want real programming languages. Knowing the trade-offs helps you read either.

Alternative IaC approaches — Pulumi lets you write infrastructure code in general-purpose languages (Python, TypeScript) instead of a dedicated DSL, while CloudFormation is AWS's native, AWS-only IaC tool.

The mascot stands between a table with a steel thali and a home kitchen counter full of pots.

Think of it like this

Restaurant thali vs home kitchen

A restaurant thali is fixed and reliable, but only that restaurant serves it. Cooking at home, you use your own pots and recipes, and can make anything. CloudFormation is the thali: AWS's own, AWS only. Pulumi is the home kitchen: everyday languages, any cloud.

Watch it happen

Two other ways to write IaC

CloudFormation

YAML or JSON templates
AWS only, run by AWS
State managed for you as stacks

Pulumi

TypeScript, Python, Go, C# and more
Many clouds, like Terraform
Loops, functions and tests in code

All three are declarative underneath. Pick what your team and cloud already use; the concepts of plan, state and drift carry over.

The big ideas

What you need to know

Stacks

Both group resources into stacks. A CloudFormation stack rolls back on its own if a change fails partway.

Preview first

CloudFormation change sets and pulumi preview play the same role as terraform plan.

Real languages cut both ways

Pulumi's loops and functions are powerful, but clever code can make infrastructure harder to read and review.

CDK sits in between

AWS CDK lets you write TypeScript or Python that generates CloudFormation templates for you.

See it in code

Walk through the code

1import * as aws from "@pulumi/aws";2 3const bucket = new aws.s3.Bucket("notes", {4  tags: { env: "dev" },5});6 7export const bucketName = bucket.id;

1/3The AWS provider is a normal npm package.

Run pulumi new aws-typescript to scaffold a project, then pulumi preview and pulumi up. pulumi destroy cleans it all up.

Save yourself the pain

Common mistakes

Oops

Picking a tool because it's newest, regardless of what the team knows.

Do this instead

Choose what fits your cloud and team skills. A tool nobody else can review becomes a single point of failure.

Oops

Using Pulumi's full language power for deeply nested, clever abstractions.

Do this instead

Keep infrastructure code boring and obvious. Reviewers should see what will be created without running it.

Your mission

Same bucket, three ways

~30 min

Quick check

Your company runs only on AWS and wants AWS to manage IaC state. Which tool fits most naturally?

Go deeper

1Compare Terraform's HCL syntax to a Pulumi example in a language you already know.
2Learn why some teams prefer Pulumi's 'real programming language' approach over a dedicated DSL.
3Understand CloudFormation's trade-off: deep AWS integration, but locked into a single cloud provider.