Pulumi: product and architecture
This Pulumi review covers the infrastructure-as-code platform that made a deliberate bet against configuration languages. Instead of HCL or YAML, Pulumi lets you declare cloud resources in TypeScript, Python, Go or .
NET, so loops, conditionals, functions, package managers, type checking and unit tests come from the language rather than from the tool. The CLI and SDKs are Apache-2.0; Pulumi Cloud is the managed state, secrets and policy service the company sells. We evaluated it on its documentation, its own product pages, and its GitHub repository, which carried 25,703 stars when we checked on 19 September 2026.
Overview
Every infrastructure-as-code tool has to solve the same problem: describe resources, build a dependency graph, reconcile against recorded state, apply the difference. Pulumi's engine does exactly that. What differs is the authoring layer.
The argument for a general-purpose language is that infrastructure code becomes ordinary code. A repeated block is a function. A conditional resource is an if. A shared pattern is a package published to npm or PyPI and versioned like any other dependency. Tests are written with the test framework the team already uses, and an IDE gives real type checking and completion rather than string interpolation.
The argument against is discipline. A configuration language constrains what can be expressed, and that constraint is why a reviewer can read a diff and know what will happen. Give a team a full programming language and some will build abstractions nobody else can follow. Which argument wins depends on the team more than on the tool.
Pulumi supports configuration languages too — YAML and HCL are both options — but choosing Pulumi for those is choosing it for the platform rather than the authoring model.
Key Features and Architecture
Language support is the headline: TypeScript, Python, Go and .
NET, with the same resource model behind each. Providers cover the major clouds and a long list of other services, and Pulumi can consume Terraform providers, which is how its coverage reached parity rather than starting from nothing.
Composition is where the language choice pays. Reusable components are published with standard package managers — npm, PyPI and the rest — so an organisation can ship a vetted "production service" component as a versioned dependency rather than a copied directory. That is a materially different distribution story from copying modules between repositories.
Secrets and configuration are centralised. Pulumi presents one interface across secret stores, pulling from HashiCorp Vault, AWS Secrets Manager and Azure Key Vault, and supports short-lived dynamic credentials rather than long-lived keys checked into configuration.
Governance features target the compliance buyer: encrypted secrets, policy as code, full audit trails, and SOC 2 attestation on the hosted service. Policy as code means guardrails are expressed and enforced programmatically rather than written in a wiki and hoped for.
The newest layer is agent-facing. Pulumi publishes open-source skills for coding agents and sells Pulumi Neo, an agent that works against your infrastructure code with your organisational context and policies applied. Whether that belongs in an infrastructure tool is a judgement each team will make, but it is a real part of the product rather than a roadmap item.
Ideal Use Cases
Pulumi fits a team of software engineers who own their own infrastructure and resent context-switching into a configuration language. If the same people write the service and the infrastructure, one language for both is a genuine simplification.
It fits organisations building internal platforms. The component-and-package-manager model is the cleanest way to distribute opinionated, vetted infrastructure patterns to other teams and to version them properly.
It fits teams that want real tests around infrastructure. Unit-testing a resource graph with an ordinary test framework is straightforward here and awkward elsewhere.
It fits estates that need centralised secrets across several stores, since that is built in rather than assembled.
Do not use Pulumi if your infrastructure is maintained largely by people who are not programmers, or if your review culture depends on diffs being trivially readable. A configuration language's limits are a feature in those settings, and a team that cannot agree on abstraction discipline will produce infrastructure code only its author understands. That failure mode is real, and it is not something the tool prevents.
Pricing and Licensing
The Pulumi CLI and SDKs are Apache-2.0 and free. You can run Pulumi entirely self-managed, keeping state in your own object storage, and pay nothing for the software.
Pulumi Cloud is the commercial product: managed state, secrets, policy enforcement, audit trails and the collaboration surface. It carries a free individual tier, paid team and enterprise tiers, and a self-hosted option for organisations that cannot use the hosted service. Its published rates are quoted on the vendor's pricing page and are structured around credits rather than seats alone, which makes a spreadsheet model worth building before committing.
That split matters when comparing against alternatives. The tool is free; the service around it is where spend appears — the same shape as the rest of this category, where a free binary sits beside a paid control plane.
We recommend pricing the self-managed path honestly before assuming you need Pulumi Cloud. State in object storage with a locking mechanism is viable for a small team, and the managed service earns its cost through collaboration, policy and audit rather than through making the tool work.
Strengths & Trade-offs
Pros
- Real languages with real tooling. Type checking, IDE completion, tests and package managers apply to infrastructure code.
- Components distribute through npm and PyPI. Vetted patterns ship as versioned dependencies rather than copied directories.
- Consumes Terraform providers. Coverage did not have to be rebuilt from scratch.
- Centralised secrets across stores. Vault, AWS Secrets Manager and Azure Key Vault behind one interface, with dynamic credentials.
- Self-managed path is genuinely free. Apache-2.0 CLI and SDKs with state in your own storage.
Cons
- Abstraction is unconstrained. A full language permits infrastructure code that only its author can review, and nothing in the tool prevents it.
- Credit-based pricing needs modelling. Pulumi Cloud's structure is harder to forecast than a flat per-seat rate.
- Smaller body of copyable examples. HCL-based tooling has more tutorials and answers in circulation, which costs newcomers time.