# Pulumi

> Pulumi infrastructure as code with programming languages. Use for IaC. Use when this capability is needed.

- Skill: `tomevault-io/pulumi` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/pulumi`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/pulumi/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/pulumi

---


# Pulumi

Pulumi lets you define infrastructure using TypeScript, Python, Go, or C#. It offers the power of a real language (loops, functions, classes) for IaC. 2025 highlights include **Pulumi ESC** for secret management.

## When to Use

- **Developers**: You prefer TypeScript over HCL YAML.
- **Complexity**: You need genuine logic (if/else, loops, external API calls) during infrastructure definition.
- **Testing**: You want to unit test your infrastructure code using standard test runners (Jest, Pytest).

## Quick Start (TypeScript)

```typescript
import * as pulum from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const bucket = new aws.s3.Bucket("my-bucket", {
  acl: "private",
});

export const bucketName = bucket.id;
```

## Core Concepts

### Programming Model

Unlike Terraform's declarative HCL, Pulumi executes your program to build a resource graph.

### Pulumi ESC (Environments, Secrets, Config)

Centralized secret management. Retrieve dynamic secrets (AWS temp creds) at runtime.

### Automation API

Embed infrastructure creation inside your own software. "Click to Deploy" features in SaaS products often use this.

## Best Practices (2025)

**Do**:

- **Use ComponentResources**: Abstract complexity into reusable Classes (e.g., `class MyMicroservice extends ComponentResource`).
- **Use Secrets Provider**: Don't store secrets in plaintext config. Pulumi encrypts config values by default.
- **Unit Test**: Use mocks to test that your Security Groups don't allow 0.0.0.0/0.

**Don't**:

- **Don't mix logic and state**: Keep side-effects (API calls) predictable.

## References

- [Pulumi Documentation](https://www.pulumi.com/docs/)

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/g1joshi) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-15 -->