Pulumi 3.140 surge and the IaC decision logic

The shift in provisioning logic

Economic pressure drives 17% of infrastructure as code re-evaluations, and 78% of those decisions have high urgency. Compliance and governance concerns trigger 14% of shifts, with 87% of those cases demanding high urgency. Operational toil forces 20% of teams to change tools. Developer velocity crises drive 18% of decisions when platform teams become bottlenecks. Pulumi 3.140 expands the ecosystem with first-class support for HashiCorp Configuration Language alongside TypeScript, Python, Go, and C#. I find that Pulumi is the best choice for development-heavy teams that require multi-cloud flexibility and the ability to run unit tests within existing CI pipelines. This tool allows developers to use real programming constructs like loops and functions instead of the limited expression syntax of HCL. Infrastructure as code brings version control, automated testing, code reviews, and CI/CD pipelines to infrastructure management. This approach eliminates configuration drift, which ensures production, staging, and development environments remain identical.

Technical implementation differences

The technical differences between tools define the long-term success of a platform team. AWS CDK synthesizes code into CloudFormation templates, which means users inherit the 500-resource-per-stack limit and the slower deployment speeds of the CloudFormation service. Pulumi runs programs through its own deployment engine and supports any cloud or SaaS platform through its registry. This registry includes bridged, native, parameterized, and dynamic providers. While Terraform is a valid choice for platform teams that prefer the declarative constraints of HCL, Pulumi is better for developers who want to use the same IDE features, such as autocomplete and refactoring, that they use for application code.

Terraform holds the industry standard for multi-cloud provisioning with its vast provider ecosystem. The move to the Business Source License in 2023 caused many teams to search for OpenTofu. OpenTofu provides an OSI-approved license under Linux Foundation governance and maintains compatibility with Terraform modules. If a team prefers HCL, they might stick with Terraform or OpenTofu. Pulumi treats secrets as a first-class primitive with integrated encryption in transit and at rest. Users can swap the default provider for AWS KMS, Azure Key Vault, Google Cloud KMS, or HashiCorp Vault. In contrast, AWS CDK lacks a built-in secrets primitive and requires users to pass sensitive values through NoEcho parameters or AWS Secrets Manager to ensure security. Pulumi also provides faster iteration cycles through the pulumi watch feature, which reduces the feedback loop from minutes to seconds. Pulumi’s Automation API allows a host application to drive deployments without shelling out to the CLI, which helps build internal developer platforms that provision environments per team or per branch.

Migration costs and lifecycle management

Migration planning determines the risk of a tool swap. Pulumi Neo automates the conversion of CDK applications by converting code and importing existing CloudFormation resources without downtime. You can also use pulumi import to bring existing resources under management. If a team already manages CloudFormation stacks, they should look at how Pulumi handles the transformation of the object graph.

The financial impact of these tools varies by scale. Pulumi Business costs $85 per user per month. The Pulumi free tier for individuals includes 500 deployment minutes per month. For the Team tier, Pulumi provides 150,000 free credits per month, and users pay $0.0005 per credit after that. Terraform Cloud costs $70 per user per month for collaboration features. AWS CDK is free as a tool, though you pay for the underlying AWS resources and CloudFormation API calls.

Teams should plan a three-phase migration to minimize disruption. The first phase involves parallel operations for two weeks using non-production services. During the second phase, teams execute a gradual migration over six weeks based on the risk profile of the services. Finally, the team performs a cutover in week nine by decommissioning old tooling. If an organization already uses Terraform, the CDKTF bridge once provided a way to use TypeScript, but HashiCorp archived CDKTF on December 10, 2025. This means the project is now read-only and lacks further compatibility fixes. Does your team have the discipline to manage infrastructure as a Turing-complete programming task?