First stack deploy
Create a new Pulumi project in TypeScript, provision one S3 bucket, run pulumi preview, then pulumi up. Capture the output value and destroy the stack.
DevOps & Tooling / Knowledge library
Pulumi
infrastructure as code with real programming languages
Why learn Pulumi?
Pulumi lets teams define, deploy, and manage cloud infrastructure using familiar programming languages (TypeScript, Python, Go, C#, Java), reducing context switching and enabling reusable, testable infrastructure code.
Where it came from
2017: Pulumi was founded to modernize infrastructure as code with general-purpose languages. 2018: Early public releases introduced multi-cloud IaC with a developer-first workflow. 2019: Pulumi 1.0 launched. 2020+: Automation API enabled embedding Pulumi operations inside custom apps and platforms. 2023+: Pulumi ESC (Environments, Secrets, and Configuration) expanded secret/config management across projects.
- 2017: Pulumi was founded to modernize infrastructure as code with general-purpose languages.
- 2018: Early public releases introduced multi-cloud IaC with a developer-first workflow.
- 2019: Pulumi 1.0 launched.
- 2020+: Automation API enabled embedding Pulumi operations inside custom apps and platforms.
- 2023+: Pulumi ESC (Environments, Secrets, and Configuration) expanded secret/config management across projects.
Build your understanding
Work through these exercises in order. Try the task before opening a reference.
- Create a new Pulumi project in TypeScript, provision one S3 bucket, run pulumi preview, then pulumi up. Capture the output value and destroy the stack.
- Use pulumi config to store a plain region and one secret API key. Read both in code, deploy a resource, and confirm the secret is encrypted in state.
- Build a reusable ComponentResource that creates a bucket + IAM policy attachment. Instantiate it twice with different names and tags, then export both outputs.
- Which command previews changes without applying them?
- Pulumi can store state in Pulumi Cloud or self-managed backends like S3/Azure Blob/GCS.
More ways to practice
Config and secrets flow
Use pulumi config to store a plain region and one secret API key. Read both in code, deploy a resource, and confirm the secret is encrypted in state.
Reusable component
Build a reusable ComponentResource that creates a bucket + IAM policy attachment. Instantiate it twice with different names and tags, then export both outputs.
Pulumi CLI essentials
Which command previews changes without applying them?
Pulumi state backends
Pulumi can store state in Pulumi Cloud or self-managed backends like S3/Azure Blob/GCS.
Deploy a single AWS S3 bucket
Complete the blanks to create a private bucket and export its ID.
Documentation and sources
- Pulumi Docs (www.pulumi.com)
- Pulumi IaC Concepts (www.pulumi.com)
- Pulumi CLI Reference (www.pulumi.com)
- Pulumi ESC (www.pulumi.com)
- Automation API (www.pulumi.com)
Catalog research notes
- Pulumi ESC expanded environment composition for shared config and secrets.
- Pulumi Deployments added stronger CI/CD controls like OIDC-based auth patterns.
- Provider ecosystems keep growing, with frequent updates across AWS, Azure, GCP, and Kubernetes.
- Policy as Code workflows (CrossGuard) became easier to enforce in team pipelines.
Connect the ideas
Alternatives
Explore next
Real World Example
Unified Infrastructure Orchestration for Global Retail
A global retail chain managing diverse cloud environments across multiple regions to support their e-commerce platform.
The business problem
The engineering team struggles with fragmented infrastructure management, where different cloud providers require disparate tools and domain-specific languages, leading to configuration drift and inconsistent security postures.
How this topic solves it
Pulumi allows the team to define infrastructure using general-purpose programming languages like TypeScript, enabling the use of standard software engineering practices such as unit testing, modularity, and code reviews to manage cloud resources across providers in a unified workflow.
- Initialize a new Pulumi project using the TypeScript SDK to define the desired cloud architecture.
- Define cloud resources as classes or functions, allowing for reusable infrastructure components across different regional deployments.
- Integrate Pulumi with the existing CI/CD pipeline to automate infrastructure deployments and enforce version control.
- Utilize Pulumi's state management to track resource dependencies and detect drift between the defined code and the actual cloud environment.
This diagram illustrates how code flows from the developer to the cloud provider through Pulumi.
Writes TypeScript code
Processes code and state
Target infrastructure
Target infrastructure
- Developer → Deploys code → Pulumi Engine
- Pulumi Engine → Provisions resources → Cloud Provider A
- Pulumi Engine → Provisions resources → Cloud Provider B
Implementation example
This code demonstrates defining cloud infrastructure using TypeScript, which allows the retail team to use standard programming constructs to manage AWS resources.
import * as aws from "@pulumi/aws";
// Define an S3 bucket using standard TypeScript classes
const bucket = new aws.s3.Bucket("retail-data", {
acl: "private", // Enforce security policy
});
export const bucketName = bucket.id; // Export for cross-stack referenceExpected business outcome
The team achieves a consistent infrastructure lifecycle, reducing manual configuration errors and enabling developers to provision resources using familiar programming patterns without learning proprietary configuration languages.
Limitations and checks
Because infrastructure is defined in general-purpose languages, the state file can become complex to manage if the code is not structured with strict modularity; developers should check the Pulumi state output regularly to ensure the logical graph remains performant.