The full review
What is Pulumi?
At heart, Pulumi is an open-source infrastructure as code platform that provisions cloud resources from programs written in general-purpose languages. The homepage frames it as infrastructure as code for the AI era, built so humans and agents alike can describe cloud infrastructure with real programming languages rather than a bespoke configuration dialect. You write TypeScript, Python, Go, C#, Java, or YAML, and the Apache 2.0 licensed engine reconciles that program against live cloud accounts.
The vendor product overview splits the platform into Pulumi IaC for provisioning, Pulumi ESC for secrets and configuration, Pulumi Cloud for state and collaboration, and Neo, described as the first AI agent purpose-built for infrastructure. The IaC page lists more than 300 providers, headlined by AWS, Azure, Google Cloud, and Kubernetes.
Infrastructure as code in languages your team already writes
The central claim of Pulumi IaC is that infrastructure deserves the same tooling as application code. A stack is an ordinary program, so loops, conditionals, functions, and classes come free, along with type checking and editor support. Pulumi highlights unit tests that run in milliseconds and integration tests against ephemeral environments, pushing misconfiguration into CI rather than production. Reusable components published through the Pulumi Registry let a platform team turn an approved network pattern into a single call, while the Automation API embeds the engine as a library so you can drive provisioning from your own service.
Pulumi ESC and the end of secrets sprawl
Pulumi ESC stands for Environments, Secrets, and Configuration, and its stated goal is centralized configuration with zero sprawl. It does not replace your vault; it reads the ones you already run, naming AWS Secrets Manager, HashiCorp Vault, Azure Key Vault, and 1Password behind one interface available from the CLI, API, and SDKs. Composable environments let staging inherit a shared base, dynamic credentials issued over OIDC swap long-lived keys for short-lived ones, and automatic secrets rotation arrives with the Team plan.
Neo, the infrastructure agent
Neo is the most distinctive part of the lineup. It takes natural language commands, generates Pulumi programs, debugs failed deployments, scans for policy violations, and flags underutilized expensive resources. The vendor stresses guardrails as much as autonomy: customizable approval workflows keep a person in the loop, and every action carries a preview, a log entry, and a way back. Pulumi ships an MCP server so Neo works inside VS Code, Cursor, Claude Code, and Windsurf, right where you already code. Neo code reviews and Slack integration come with Team, scheduled tasks with Enterprise.
Pulumi Cloud carries the operational surface: encrypted versioned state, an audit trail of who changed what and when, policy as code, and resource search spanning AWS, Azure, and Google Cloud accounts. Enterprise adds drift detection with remediation, time-to-live stacks that reap ephemeral environments on a timer, and customer-managed keys. The internal developer platform layer wraps this into self-service templates with guardrails, the realistic route to product engineers provisioning infrastructure without filing a ticket. Pulumi reports SOC 2 Type II certification.
How the Pulumi plans are structured
Tiers run Individual, Team, Enterprise, and Business Critical. Individual is free forever for one user with unlimited projects, stacks, environments, and update history, plus capped monthly workflow minutes and a Neo token allowance. Team and Enterprise each bundle credits into the base subscription, Team capped at ten users and Enterprise unlimited with SAML/SSO, RBAC, and audit logs. Business Critical is quoted custom, adding self-hosting, NIST and PCI compliance, SCIM sync, and 24x7 support.
Who should choose Pulumi
Engineering organizations that already treat infrastructure as a software problem are the natural fit: polyglot teams, platform groups building golden paths, and anyone running multi-cloud estates where one language across AWS, Azure, and Kubernetes cuts real context switching. The free Individual tier is generous enough to learn on properly, and Team is a sensible landing spot for a small squad. It is a poorer fit for teams that want infrastructure expressed as static declarative config with no programming language in the loop, or for a small operations group maintaining a handful of stable resources, where general-purpose code adds governance burden without much payoff.
Strengths
- Open-source engine, CLI and SDKs under Apache 2.0 — free forever, no BUSL restrictions
- Write infrastructure in real languages: TypeScript, Python, Go, .NET, Java, plus YAML
- Generous free tier: $0 Individual plan and free self-hosted state on S3/Azure/GCS
- Native Terraform/HCL support added Jan 2026 — run existing Terraform code inside Pulumi
Watch out for
- Resource-hour billing with partial hours rounded up can get unpredictable at scale
- Smaller provider and module ecosystem than Terraform
- Team's $40/mo base plus per-resource overages adds up for large fleets
- Real programming languages mean a steeper learning curve than declarative HCL
Key features
| Feature | What it does |
|---|
| IaC in any language | Define cloud resources in TypeScript, Python, Go, .NET, Java or YAML — with loops, functions and real testing |
| Pulumi Cloud managed state | Hosted state backend with history, RBAC, audit logs and drift detection (or self-host for free) |
| Pulumi ESC | Environments, Secrets and Configuration — centralized secrets and config management across stacks |
| Policy as Code (CrossGuard) | Enforce security, compliance and cost guardrails written in code before deployments run |
| Pulumi Deployments | Managed CI/CD workflows and GitOps to run pulumi up remotely, billed by deployment/workflow minutes |
| Pulumi Neo | AI copilot for infrastructure; Individual tier includes 5M free tokens per month |
How Pulumi compares
| Alternative | How it differs |
|---|
| Terraform (HashiCorp) | Largest IaC ecosystem and HCL, but moved to restrictive BUSL license in 2023 |
| OpenTofu | Open-source (MPL 2.0) community-governed Terraform fork, free and drop-in compatible |
| Spacelift | Managed IaC orchestration/CI-CD platform supporting Terraform, Pulumi and more |
Frequently asked questions
Is Pulumi free?
Yes. The Pulumi CLI, SDKs and IaC engine are open source under Apache 2.0 and free forever, supporting TypeScript, Python, Go, .NET, Java and YAML. Pulumi Cloud's Individual tier is also $0 forever for one user, with unlimited projects, stacks and environments, 500 deployment minutes and 5M free Pulumi Neo AI tokens each month.
How much does Pulumi cost?
The open-source tooling is free. Pulumi Cloud's Individual tier is $0 forever. The Team plan is $40/month including 500 managed resources; extra resources cost $0.1825/mo, billed at $0.00025 per resource-hour. Enterprise is $400/month with 2,000 resources and unlimited users. Business Critical is custom-priced with volume discounts, self-hosting and 24x7 support.
Pulumi vs Terraform — which is better?
Both are IaC tools. Pulumi lets you write infrastructure in real languages (TypeScript, Python, Go, .NET, Java) plus YAML, and as of January 2026 runs existing Terraform/HCL natively. Pulumi's engine stays Apache 2.0 open source, while Terraform moved to a restrictive BUSL license. Terraform has the larger ecosystem; Pulumi suits developer-heavy teams wanting familiar languages and testing.
Is Pulumi open source?
Yes. The Pulumi engine, CLI and language SDKs are open source under the permissive Apache 2.0 license and, per Pulumi, will always be free. Only Pulumi Cloud — the managed backend adding state management, secrets, RBAC, policy-as-code, audit logs and deployments — is commercial. You can also self-host state on AWS S3, Azure Blob or Google Cloud Storage for free.
How does Pulumi resource pricing work?
Pulumi Cloud bills by resource-hour. The Team tier includes 500 managed resources; beyond that, each resource-hour costs $0.00025 (about $0.1825 per resource per month), with partial hours rounded up to full hours. Enterprise includes 2,000 resources with overage starting at $0.0005/hour. Additional charges cover secrets ($0.50-$0.75/mo each) and deployment or workflow minutes.
Pulumi ratings on other platforms
Independent user ratings from third-party review sites, linked here for transparency.
These are not our editorial score, are captured on the date shown, and may have changed since.