Pulumi vs Terraform: Which IaC Tool Should You Choose in 2026?

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
 
// Real programming: loops, conditions, functions
const azs = ["us-east-1a", "us-east-1b", "us-east-1c"];
 
const vpc = new aws.ec2.Vpc("main", {
  cidrBlock: "10.0.0.0/16",
  enableDnsHostnames: true,
});
 
// Use a real for loop
const privateSubnets = azs.map((az, i) =>
  new aws.ec2.Subnet(`private-${az}`, {
    vpcId: vpc.id,
    cidrBlock: `10.0.${i}.0/24`,
    availabilityZone: az,
  })
);
 
// Conditional logic with real if/else
const db = new aws.rds.Instance("main", {
  engine: "postgres",
  instanceClass: pulumi.getStack() === "prod"
    ? "db.r6g.xlarge"
    : "db.t3.micro",
  vpcSecurityGroupIds: [dbSg.id],
  dbSubnetGroupName: subnetGroup.name,
});
 
// Reusable function
function tagAll(name: string): Record<string, string> {
  return {
    Name: name,
    Environment: pulumi.getStack(),
    ManagedBy: "pulumi",
  };
}

variable "azs" {
  default = ["us-east-1a", "us-east-1b", "us-east-1c"]
}
 
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
}
 
resource "aws_subnet" "private" {
  for_each = { for i, az in var.azs : az => i }
 
  vpc_id            = aws_vpc.main.id
  cidr_block        = cidrsubnet("10.0.0.0/16", 8, each.value)
  availability_zone = each.key
}
 
resource "aws_db_instance" "main" {
  engine         = "postgres"
  instance_class = terraform.workspace == "prod" ? "db.r6g.xlarge" : "db.t3.micro"
 
  vpc_security_group_ids = [aws_security_group.db.id]
  db_subnet_group_name   = aws_db_subnet_group.main.name
}

// Pulumi: Deploy different configs per region
const regions = ["us-east-1", "eu-west-1", "ap-southeast-1"];
 
for (const region of regions) {
  const provider = new aws.Provider(`provider-${region}`, { region });
 
  const cluster = new aws.ecs.Cluster(`app-${region}`, {}, { provider });
 
  // Only deploy GPU instances in us-east-1
  if (region === "us-east-1") {
    new aws.ec2.Instance(`gpu-${region}`, {
      instanceType: "p4d.24xlarge",
      ami: gpuAmi,
    }, { provider });
  }
}

// Generate resources from a JSON config file
import * as fs from "fs";
 
interface ServiceConfig {
  name: string;
  port: number;
  replicas: number;
  cpu: number;
  memory: number;
}
 
const services: ServiceConfig[] = JSON.parse(
  fs.readFileSync("services.json", "utf-8")
);
 
for (const svc of services) {
  new aws.ecs.Service(`svc-${svc.name}`, {
    name: svc.name,
    desiredCount: svc.replicas,
    // ... use svc.port, svc.cpu, svc.memory
  });
}

# HCL: anyone can read this
resource "aws_s3_bucket" "data" {
  bucket = "company-data"
}
 
resource "aws_s3_bucket_versioning" "data" {
  bucket = aws_s3_bucket.data.id
  versioning_configuration {
    status = "Enabled"
  }
}

# terraform plan
+ aws_s3_bucket.data
    bucket = "company-data"
 
~ aws_instance.web
    instance_type: "t3.micro" → "t3.small"
 
- aws_security_group.old

pulumi login   # Uses Pulumi Cloud by default
pulumi up      # State stored in Pulumi Cloud

pulumi login s3://my-pulumi-state
pulumi login file://~/.pulumi-state

terraform {
  backend "s3" {
    bucket         = "my-tf-state"
    key            = "prod/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "terraform-locks"
  }
}

const config = new pulumi.Config();
const dbPassword = config.requireSecret("dbPassword");
// Encrypted in state, shown as [secret] in previews
 
new aws.rds.Instance("db", {
  password: dbPassword,  // Decrypted only during deployment
});

pulumi config set --secret dbPassword "MyS3cur3P@ss"
# Stored encrypted in Pulumi.prod.yaml

// __tests__/infra.test.ts
import * as pulumi from "@pulumi/pulumi";
import { AppStack } from "../index";
 
pulumi.runtime.setMocks({
  newResource: (args) => ({ id: `${args.name}-id`, state: args.inputs }),
  call: (args) => args.inputs,
});
 
test("S3 bucket has versioning", async () => {
  const stack = new AppStack("test");
  const versioning = await new Promise((resolve) =>
    stack.bucket.versioning.apply(resolve)
  );
  expect(versioning).toBeTruthy();
});

run "bucket_versioning" {
  command = plan
  assert {
    condition     = aws_s3_bucket_versioning.data.versioning_configuration[0].status == "Enabled"
    error_message = "Versioning must be enabled"
  }
}