Pulumi pioneered infrastructure as real code instead of config files, and I've had no unsolved pain with it. I deploy everything with it, from my own machine, with state in S3.
The part people miss: Pulumi can use any Terraform provider. So the rule "if I can't provision it, it loses points" covers almost the whole market: AWS, Cloudflare, GitHub, Tailscale, Neon, Resend, PostHog, OpenRouter, Stripe.
Use it when
- Always.
Pricing
Free and open source with a self-managed S3 backend (no Pulumi Cloud fees).
Gotchas, with fixes
Gotcha: A vendor has no Pulumi package.
Fix: Run pulumi package add terraform-provider <namespace>/<name>: Pulumi generates an SDK from any Terraform or OpenTofu provider.
Gotcha: Community providers are often maintained by one person (Neon, Resend, Clerk).
Fix: Pin provider versions and upgrade deliberately.
Gotcha: New AWS services can land in @pulumi/aws-native before @pulumi/aws (Lambda Web Functions today).
Fix: Use aws-native for those resources alongside the classic provider.
Gotcha: Pulumi doesn't bundle Cloudflare Worker code.
Fix: Build with Wrangler, deploy the output with Pulumi, and give each Worker one owner.
Provisioning
Official Pulumi package ·
Instead, consider
- Terraform / OpenTofu The client already runs it.
Worked examples
Where it fits
- Provisioning everything: Pick 01.
Real code, S3 backend, and any Terraform provider.
- An AWS foundation for a client: Pick 02.
Everything as code.
- Moving on-premises systems to AWS: Pick 04.
The target infrastructure, as code.
Sources
Last reviewed by Nicolas Dao