Pulumi

Pulumi brings infrastructure as code into general-purpose languages, so cloud config gets the same structure, types, and reuse as application code. I use it where that expressiveness pays over templated DSLs.

Loops, conditionals, functions, and shared modules let me build infrastructure the way I build software — and existing code can shape the cloud resources it needs. State and drift are managed across projects and stacks.

Its automation API and policy layers extend IaC into CD: running infra changes from pipelines with validation gates instead of hand-run commands.

Real languages are the differentiator. Because the infrastructure is TypeScript, Python, or Go, I get typing, functions, and editor support on the cloud config — the same leverage that makes application code maintainable, applied to the estate.

Code drives what gets provisioned. Loops create a fleet from a list, conditionals branch on environment, functions factor complexity — so infrastructure scales in expressiveness without duplicating blocks.

Shared modules and typed contracts make infrastructure reusable and reviewable. A common pattern is written once and consumed everywhere with clear inputs and outputs, exactly like a well-designed library.

State is managed across projects and stacks with drift control, so the estate stays coherent as it grows — not a pile of disconnected `apply` runs.

The automation API turns infra changes into pipeline steps. A deploy runs `pulumi up` through CI with preview, validation gates, and approvals — which is what moves infrastructure into the same disciplined delivery path as application code.

Policy layers enforce governance. Guardrails on resource types, tags, and security postures run as code, keeping the estate safe by construction rather than by review after the fact.

The real-language surface is the differentiator. Infrastructure in TypeScript, Python, or Go gets typing, functions, and editor support, so cloud config has the same leverage as application code.

Loops, conditionals, and shared functions replace duplicated blocks. A fleet is created from a list and environments branch cleanly, so infra scales in expressiveness.

Shared modules and typed contracts make infrastructure reusable and reviewable. A common pattern is written once and consumed with clear inputs and outputs.

State is managed across projects and stacks with drift control, so the estate stays coherent as it grows rather than a pile of disconnected `apply` runs.

The automation API turns infra change into a pipeline step. `pulumi up` runs through CI with a preview, validation gates, and approvals — infrastructure on the same disciplined path as app code.

Policy layers enforce governance as code. Guardrails on resource types, tags, and security posture run before apply, keeping the estate safe by construction.

I keep secrets out of the config. Sensitive values come from the state backend or a secret provider, never plaintext in the repo.

Previews gate every change, so a human sees exactly what will be created, changed, or destroyed before anything moves.

Where Terraform's HCL fits a team better, I use it; where Pulumi's real languages pay, I choose that. The tool fits the team and the estate, not the habit.