devopsy.kinsta.cloud

Tag: Pulumi

IBM HashiCorp Ends External Language Support for Terraform

IBM and HashiCorp recently announced they’re ending external language support for Terraform. If you’ve been using Python, Ruby, or other third-party languages in your Terraform configurations, this changes things.

The decision marks a clear strategic shift. HashiCorp wants to focus on Terraform’s core capabilities instead of maintaining support for multiple programming languages. For teams managing infrastructure at scale, this means rethinking how you write and maintain your Infrastructure as Code.

What’s Actually Changing

Terraform will no longer support external languages in new releases. The HashiCorp Configuration Language (HCL) will become the only supported option in the future. If you’ve built workflows around Python or Ruby integrations, you’ll need to migrate to HCL.

HCL isn’t new. It has been Terraform’s primary language since the beginning. HashiCorp designed it specifically for infrastructure management, and it handles most IaC tasks well. But the removal of language flexibility does limit options for teams that prefer other tools.

Why This Matters for DevOps Teams

Infrastructure as Code has become standard practice in DevOps. Terraform sits at the center of many organizations’ multi-cloud strategies. When a major vendor narrows the scope of a critical tool, it affects how teams plan and execute their work.

Some teams chose Terraform specifically because it uses familiar languages. Python developers could write infrastructure code in Python. Ruby teams could stick with Ruby. That flexibility made Terraform easier to adopt in diverse technical environments.

Now, those teams need to either commit to HCL or evaluate alternative options. That’s not a small decision. Migration takes time. Training takes resources. And any transition introduces risk.

The Business Logic Behind It

From HashiCorp’s perspective, this makes sense. Supporting multiple languages means maintaining multiple codebases, handling edge cases across different ecosystems, and managing compatibility issues. That’s expensive and complicated.

Focusing on HCL lets HashiCorp improve one language really well, rather than supporting several languages adequately. The company can move faster, ship features more consistently, and reduce technical debt.

For IBM, which acquired HashiCorp earlier this year, consolidation fits its enterprise software playbook. Streamlined products are easier to support, document, and sell.

What HCL Does Well

HCL isn’t a bad language. It’s declarative, which fits infrastructure management naturally. You describe what you want, and Terraform figures out how to create it. The syntax is readable even if you’re not a developer.

HCL handles variables, modules, and dependencies in ways that make sense for infrastructure work. HashiCorp has spent years refining it based on real-world use cases. The language works.

But it’s still a domain-specific language. That means learning a new syntax, understanding new patterns, and adjusting your mental model if you’re coming from general-purpose languages.

The Migration Challenge

Moving existing Terraform configurations from external languages to HCL isn’t trivial. You can’t just run a converter and call it done. Infrastructure code often includes business logic, error handling, and integration points that need thoughtful translation.

Teams will need to audit their current implementations, prioritize what to migrate first, and test thoroughly. In production environments, that process can take months.

The timing creates additional pressure. Organizations are already managing initiatives in cloud cost optimization, security compliance, and platform engineering. Adding a forced migration to the list strains already busy teams.

“This change does not alter Terraform itself, but it directly impacts the Cloud Development Kit for Terraform, which enabled teams to define infrastructure using Java, Python, TypeScript, and other general-purpose languages. HashiCorp is ending its support for CDKTF, even though the project remains available on GitHub under the Mozilla Public License 2.0,” according to Mitch Ashley, VP and practice lead, software lifecycle engineering, The Futurum Group.

Ashley continues, “I expect the open source community will rally around CDKTF and sustain it, which would significantly lessen the disruption for existing users. By any practical measure, HashiCorp is turning CDKTF support over to the community, and acknowledging that reality directly would have been a more palatable message to the community.”

Alternatives Worth Considering

This change might push some teams to evaluate other IaC tools. Pulumi supports multiple programming languages, including Python, TypeScript, and Go. AWS CDK lets you write infrastructure in JavaScript, Python, or Java. OpenTofu, the Terraform fork, continues to support a broader range of language options.

Switching tools has costs, too. But if language flexibility matters more than staying in the HashiCorp ecosystem, alternatives exist.

Moving Forward

DevOps teams need to make some decisions. Evaluate how much you rely on external language support in Terraform. Map out what migration would require. Consider whether this fits your long-term infrastructure strategy.

For organizations deeply invested in Terraform, committing to HCL probably makes sense. The tool still works well for IaC. HashiCorp will likely improve it faster without the burden of maintaining external language support.

For teams on the fence, this might be the moment to explore other options. The IaC landscape has matured. You have choices.

Either way, plan. These transitions go more smoothly when you control the timeline rather than reacting under pressure.

The infrastructure tooling market keeps evolving. This won’t be the last time vendors make strategic decisions that affect how you work. Building adaptable teams and processes matters more than betting everything on a single tool.

December 15, 2025
Pulumi Previews AI Agents Trained to Automate Infrastructure Management

Pulumi today revealed it is now making available in preview a set of artificial intelligence (AI) agents to its namesake infrastructure-as-code (IaC) platform that are capable of diagnosing issues and autonomously completing tasks when permitted.

Company CEO Joe Duffy said Pulumi Neo adds a set of AI agents specifically trained to automate the management of IT infrastructure using data collected by Pulumi. In effect, Pulumi Neo adds a member to the DevOps team that understands dependencies, executes changes, monitors outcomes, and maintains compliance throughout the entire infrastructure lifecycle, he added.

Neo is designed to enable DevOps teams to launch short- or long-running tasks with approvals and interactive guidance provided in a way that adheres to the policies enforced by the Pulumi platform, said Duffy. It also provides a complete history of which tasks were automated to enable organizations to meet compliance requirements, he noted. In effect, Neo becomes a digital member of the platform engineering team, added Duffy.

Each DevOps team will need to decide for themselves to what degree to rely on AI agents to automate tasks. In the case of Neo, for example, DevOps teams can use it to simply generate optimization suggestions or alternatively autonomously perform tasks based on permissions that have been assigned.

Additionally, Neo will also analyze the underlying IT platforms being used to run certain classes of workloads, which may lead to it recommending, for example, that certain cloud-native application be migrated from Kubernetes to a simpler environment such as the Elastic Container Service (ECS) from Amazon Web Services (AWS).

Finally, Neo has also been included in the Model Context Protocol (MCP) server developed by Pulumi, which means AI coding tools can invoke it as well to create agentic AI workflows that conform to a set of best DevOps teams.

It’s not clear how rapidly DevOps teams are embracing AI agents to automate tasks, but as they do the overall level of toil encountered should continue to be reduced. Early adopters of Neo such as Werner Enterprises are, for example, reporting they reduced infrastructure provisioning time from three days to four hours while both maintaining SOC 2 compliance and enabling development teams to ship features 75 percent faster.

Hopefully, as AI agents become more pervasively employed the number of misconfigurations leading to cloud security incidents will decline. While application developers routinely use IaC tools to provision cloud platforms, they don’t always have the greatest appreciation for best DevSecOps practices, which can lead to ports through which data can be exfiltrated being left wide open.

Of course, it might be a while yet before DevOps engineers are completely comfortable with AI agents but given the volume of workloads that will need to be deployed in the AI era the need for those agents is already apparent. The issue, as always, is making sure that whatever winds up being automated can also be undone should, for whatever reason, the AI output being provided winds up being worse than the proverbial disease it was meant to cure.

September 16, 2025
Pulumi Previews IDP to Manage Reusable Software Building Blocks

Pulumi today previewed an internal developer platform (IDP) through which DevOps and platform engineering teams will be able to access reusable building blocks that can be used to create templates and blueprints to build applications.

Scheduled to be generally available later this year for self-hosted environments or via a software-as-service (SaaS) application, Pulumi IDP will be made available at no extra cost to the company’s existing base of more than 3,500 customers.

The overall goal is to make it simpler for DevOps teams of any skill level to set up golden paths for building applications using an IDP that provides drift and policy detection and remediation tools, auditing of outdated components and templates, and change management when rolling out updated versions.

Additionally, there are approval workflows to enable teams to delegate and maintain guardrails, a visual import tool that helps teams bring existing unmanaged cloud infrastructure under the management of Pulumi with just a few clicks, and an integrated identity access management (IAM) tool to ensure least privilege controls are maintained.

Pulumi CEO Joe Duffy said DevOps teams will also be able to employ a mix of graphical, lowcode, REST application programming interfaces (APIs), programming tools and DevOps pipelines as they best see fit to deploy and update the Pulumi IDP.

Eventually, Pulumi will also extend its existing generative artificial intelligence (AI) tooling to create AI agents that will automate many existing IDP management tasks, noted Duffy.

While IDPs have been gaining traction as a means to apply guardrails to self-service workflows that developers employ to access software components and infrastructure-as-code, they typically require a lot of software engineering expertise. Pulumi is pursuing an alternative approach that provides built-in search, semantic versioning, documentation and usage tracking tools to make it easy to discover and share patterns.

Compatible with TypeScript, Python, Go, C#, Java or YAML software components, the registry that is at the code of the Pulumi IDP will make it simpler to enforce security, compliance, cost controls and other operational rules, said Duffy.

Many DevOps and platform engineering teams have, of course, already built and deployed an IDP. However, managing, updating and securing those platforms requires a lot of undifferentiated effort that doesn’t necessarily contribute to the bottom line of an organization, noted Duffy.

Pulumi is making a case for an extensible alternative IDP that is easier to integrate with multiple existing DevOps tools and platforms, including the open source Backstage IDP originally developed by Spotify, he added. Pulumi is also willing to meet customers wherever they are on the road to adopting best platform engineering practices, said Duffy.

IDPs, of course, are not a new concept, but as more organizations realize how much productivity there is to be gained by ensuring developers have access to a set of secure reusable components that they can directly download, there is now a greater appreciation for their need. The challenge is that many DevOps teams have found IDPs to be more complex to deploy and maintain than anticipated.

Hopefully, there will come a day when IDPs can be taken more for granted. In the meantime, however, DevOps teams may need to revisit their decision to build versus buy an IDP when there are so many other pressing concerns to address.

May 6, 2025
Pulumi Adds Internal Developer Portal to Portfolio

Pulumi today added a portal to its portfolio, dubbed Pulumi for Platform Teams, to centrally manage environments through which developers can self-service their own requirements within the context of a set of pre-defined guardrails that ensure compliance and improve security.

In addition, the company also announced general availability of the previously launched Pulumi Deployments orchestration tool for deploying workloads.

Pulumi CEO Joe Duffy said both offerings are part of an ongoing effort to extend the company’s portfolio of offerings beyond infrastructure-as-code (IaC) tools.

Pulumi for Platform Teams is designed to be deployed via the Pulumi Cloud platform for configuring infrastructure, and provides DevOps teams with a service catalog that can be integrated with DevOps workflows via a REST application programming interface (API). That approach makes it possible to leverage hundreds of existing Pulumi CrossGuard policies for automating compliance. In addition, there is a policy-as-code engine to author policies that automatically correct configuration violations.

Pulumi for Platform Teams also includes a plug-in for Backstage, an open source project for building internal developer platforms (IDPs) originally developed by Spotify that is now being advanced under the auspices of the Cloud Native Computing Foundation (CNCF).

With the launch of Pulumi for Platform Teams, the company is providing the building blocks that will enable DevOps teams to build and maintain an IDP that complies with multiple regulatory requirements, noted Duffy.

IDPs are at the core of many efforts to embrace a platform engineering methodology that promises to enable organizations to manage DevOps workflows at scale. The overall goal is to reduce the amount of time developers spend on maintaining environments to enable them to spend more time writing code while at the same time reducing the total cost of DevOps by eliminating redundant tools and processes.

Regardless of approach, given the current overall state of the economy, there is more pressure than ever to improve developer productivity. The goal is to enable developers to self-service their own requirements as much as possible within the context of a standard set of “golden path” workflows. When a developer requests a new environment, the IDP uses calls to application programming interfaces (APIs) to set up a namespace, updates configurations, pulls any images that might be needed and connects to eternal resources such as databases. The IDP should provide developers with enough flexibility to employ new tools when required without unnecessarily adding tools and processes that are redundant to capabilities that already exist.

As every IT leader knows, that’s a fine line to walk, so they would be well-advised to embrace platform engineering in phases. The most critical asset any DevOps team has is culture. Major changes to existing workflows that developers have not bought into are likely to do more to increase friction and strife than to reduce them. When it comes to change management, slow and steady usually wins the race. After all, the worst thing that can happen after embracing platform engineering is for developer productivity to decline rather than improve.

October 11, 2023
Pulumi Previews Tool to Integrate Secrets and Infrastructure Management

Pulumi today previewed a tool that enables DevOps teams to unify the management of environments, secrets and configuration (ESC).

ESC is designed to enable developers to define reusable environments that combine secrets from multiple sources, including Pulumi IaC, AWS KMS, Azure Key Vault, Google Cloud KMS, OpenID Connect (OIDC) Relying Parties, 1Password and HashiCorp Vault. ESC works with any cloud execution context or tool, including Pulumi, Terraform, Cloudflare Workers, GitHub Actions or Docker.

Pulumi CEO Joe Duffy said multiple environments can be defined and composed together to make it simpler to provision cloud environments at scale and eliminate copy-and-paste errors. That approach streamlines a complex process that is fraught with opportunities for mistakes to be made, including inadvertently leaving secrets exposed in an application after it has been deployed in a production environment, he added.

ESC can manage both static and dynamic short-lived secrets, now considered a best practice for secrets management, in a way that can easily be audited, noted Duffy.

ESC can be run independently of Pulumi’s existing infrastructure-as-code (IaC) tool, or it can be integrated with the company’s identity and role-based access control (RBAC) tools. ESC includes deep integration with any SAML IdP, including Azure AD, Microsoft Entra ID, Okta and Google Workspace.

One of the primary reasons cybercriminals target cloud computing environments is because the developers that provision these services have little to no cybersecurity expertise. As a result, the probability a cloud service will be misconfigured is fairly high. As organizations add additional cloud services, it becomes more probable that mistakes will be made as developers programmatically invoke services in an unfamiliar IT environment.

Pulumi ESC is available for free as a public preview today with the intent to eventually offer multiple tiered versions, including a free offering and others with advanced Enterprise and Business Critical capabilities. The ESC client SDKs, CLI and plugins are all open source.

In general, Pulumi has been committed to an open source strategy that clearly defines what capabilities are going to be freely available versus those that can only be found in the other available tiers of service, said Duffy. One of the issues that too many open source software companies encounter is that they can’t generate enough revenue from subscriptions and services to sustain themselves, he noted. Pulumi, in contrast, has been squarely focused on providing additional capabilities that can only be found in its commercial offerings and provide enough value to warrant licensing, said Duffy.

It’s not clear whether organizations are moving to change the way they provision cloud infrastructure and manage secrets. As the amount of scrutiny of software supply chain management increases, it’s now only a matter of time before those processes are, at the very least, reviewed. The challenge, of course, is that when it comes to how those tasks are managed today, there is a lot of cultural inertia to overcome before development teams adapt to a new approach to provisioning infrastructure and managing application secrets.

October 10, 2023
Pulumi Embeds Terraform Conversion Tool in Platform

At its virtual PulumiUP event, Pulumi this week announced it embedded an ability to convert instances of Terraform into its infrastructure-as-code (IaC) platform via a simple command line interface (CLI) command. In addition, Pulumi added a Review Stacks capability that automatically creates a dedicated cloud environment to review code every time a pull request is opened.

Pulumi is also making available a beta release of Pulumi Azure Native Provider 2.0, which decreases the size of the software development kit (SDK) by 60%. This is part of an effort to improve deployment times and reduce resource consumption by, for example, removing support for deprecated application programming interfaces (APIs).

Finally, Pulumi has added support for property names and values to Resource Search for Pulumi Cloud, a search and analytics tool for cloud computing environments. DevOps teams can now additionally search for instances of, for example, versions of databases or specific availability zone as a result.

Aaron Kao, vice president of marketing for Pulumi, said previously the company made available a separate tool for converting snippets of Terraform code. For the first time, Pulumi is also making available a converter plugin in the Pulumi engine which allows conversion tools from other IaC tools to be used.

Review Stacks, meanwhile, makes it simpler for DevOps teams to pick up an unfamiliar codebase, make changes to both application and infrastructure code and share a live environment to review that code.

Pulumi has been making a case for an alternative to Terraform that centralizes the management and provisioning of infrastructure using a set of embedded guardrails. One of the major issues enterprise IT organizations are encountering these days is the number of misconfigurations created when developers use tools like Terraform to provision infrastructure on their own. Those misconfigurations often lead to, for example, ports being left open and cybercriminals exfiltrating data.

That approach is gaining traction among enterprise customers that are looking to centralize the management of DevOps processes, said Kao.

In the wake of a series of high-profile breaches, more organizations are now reviewing the security of their software supply chains, including how infrastructure is provisioned. Many of those organizations will need to revisit those processes as pending legislation that requires more stringent requirements for building software eventually become law, noted Kao.

At the same time, many organizations are also looking to improve the productivity of DevOps teams during an economic downturn that limits the number of full-time employees they might be able to hire. The pace at which software is being developed has not slowed, so there is a greater urgency to do more with less.

It’s not clear how quickly organizations are centralizing the management of DevOps workflows, but with the rise of platform engineering, there is clearly more interest in defining consistent backend processes that multiple DevOps teams are currently managing individually. The challenge is finding a way to achieve that goal without impeding the pace of innovation enabled by embracing DevOps in the first place.

June 15, 2023
Pulumi Brings Advanced Analytics and AI to IaC Platform

Pulumi today launched a platform that leverages analytics and artificial intelligence (AI) to generate infrastructure-as-code (IaC) from natural language prompts in addition to automating infrastructure management.

Pulumi CEO Joe Duffy said Pulumi Insights will substantially improve the productivity of DevOps teams in addition to ultimately reducing the total cost of cloud computing.

At the core of Pulumi Insights is an analytics engine automation application programming interface (API) that enables DevOps teams to launch queries using a search interface or natural language prompts across more than 100 cloud computing platforms. Results can then be organized to highlight the most-used clouds and resources broken down by project and environment using built-in dashboards. There’s also a REST API that makes it possible to export that data to a data warehouse such as Snowflake, Amazon Redshift, Google BigQuery and Azure Synapse.

In addition, Pulumi has created a companion website and command line tool to make it possible to create code for provisioning infrastructure. That uses large language models like those at the core of generative AI platforms such as GitHub CoPilot or ChatGPT that promise to eliminate much of the toil associated with writing code.

Pulumi has been making a case for an alternative approach to IaC tools, such as Terraform, that gives enterprise IT organizations more control over how IT environments are provisioned. Too many developers with limited cybersecurity expertise are provisioning infrastructure themselves, resulting in misconfigurations that cybercriminals can then easily exploit.

The Pulumi approach also makes it simpler for IT teams to create platform engineering teams that can centrally apply guardrails that prevent those issues from arising without slowing down the rate at which applications are being built and deployed, noted Duffy.

There’s also a much greater focus on improving the productivity of DevOps teams during uncertain economic times as organizations look to either limit or reduce the number of full-time employees they hire or retain.

For one reason or another, DevOps teams are going to be required to find ways to become more productive as the number of applications being built and deployed continues to increase. AI clearly has a major role to play in enabling organizations to achieve that goal. However, before organizations can reliably benefit from those advancements, they will need to ensure the accuracy of the data those AI models use to surface recommendations and generate code. Otherwise, no matter how advanced these platforms are, the results will be suboptimal.

In the meantime, IT organizations will need to revisit how IaC tools are being employed in an era where the focus on securing software supply chains has dramatically increased after some high-profile breaches. The challenge is that, in addition to all the applications currently being developed, there are thousands more that were deployed by developers without the same emphasis on cybersecurity.

April 13, 2023
Pulumi Adds Deployment Capability to IaC Platform

At the Pulumi Cloud Engineering Days event, Pulumi announced today it has added a code deployment capability to its Pulumi Cloud platform for managing infrastructure-as-code (IaC).

Pulumi CEO Joe Duffy said Pulumi Deployments will make it possible for DevOps teams to provision infrastructure and deploy applications via a single Git commit that can be invoked via an application programming interface (API) or graphical tool.

A Git Push to Deploy capability allows DevOps teams to connect to any Git repository to drive deployments for a given project path, push to any given branch and set up GitOps workflows such as pull request reviews. Deployment actions include both updates and destroys in addition to providing drift detection and remediation capabilities.

The Deployments and Automation API Pulumi developed also enables ephemeral code review environments, automatic cleanup and deployment orchestrations across multiple cloud platforms using a library of templates Pulumi provides. In effect, Pulumi is now providing a GitOps workflow out of the box, said Duffy.

Pulumi has already integrated these capabilities with GitHub and plans to add support for GitLab, Atlassian Bitbucket and other DevOps platforms. The goal is to make it possible for DevOps teams to effectively manage ten times the amount of cloud infrastructure resources per engineer using GitOps workflows than is currently possible relying on IaC tools such as Terraform, said Duffy.

As an alternative to Terraform, the Pulumi platform has been gaining traction because it makes it possible to more easily centralize the management and provisioning of infrastructure using a set of embedded guardrails. One of the major issues enterprise IT organizations are encountering these days is the number of misconfigurations created when developers use tools like Terraform to provision infrastructure on their own. Those misconfigurations often lead to, for example, ports being left open and cybercriminals exfiltrating data. In the wake of a series of high-profile breaches, more organizations are now reviewing the security of their software supply chains including how infrastructure is provisioned by embedding policy-as-code into DevOps workflows.

At the same, organizations are also keenly interested in increasing the productivity of DevOps teams during an economic downturn that limits the number of IT professionals an organization can afford to hire, added Duffy.

Pulumi claims there are now more than 5 million users of its platform spanning more than 1,000 organizations. Less clear is the degree to which organizations are embracing GitOps workflows to unify deployments on IaC and application code. As platforms make it easier to make that transition, the number of organizations using a more opinionated approach to DevOps should steadily increase.

In the meantime, DevOps teams are going to be required to find ways to build and deploy safer applications faster. Much of the focus in recent years has been on accelerating application deployments with little regard for cybersecurity. Those days are clearly now coming to an end.

November 2, 2022
Pulumi Extends Infrastructure-as-Code Reach

At its online PulumiUP conference, Pulumi announced it will make its Pulumi CrossCode translation technology available to third parties and DevOps teams. The technology was developed to integrate a wide range of programming languages with its infrastructure-as-code (IaC) platform.

The company also announced it has added support for YAML—widely used to configure Kubernetes environments—as well as any variant of Java. It already supports .NET, Node.js, Go and Python programming languages.

Finally, Pulumi also added packages for Oracle Cloud, Databricks and EventStore that simplify deployments on those platforms. The company already provides similar integrations for Amazon Web Services (AWS), Microsoft Azure, Google Cloud, Kubernetes, Auth0, CloudFlare, Confluent Cloud, Datadog, DigitalOcean, Docker, GitHub, Kong, MinIO, MongoDB Atlas, PagerDuty, Snowflake, Spot by NetApp and SumoLogic. There are also now components that provide support for container applications, Kubernetes clusters and serverless applications along with an AWS Cloud Development Kit (CDK).

Pulumi has been making a case for an IaC approach that enables developers to use programming languages they already know to provision infrastructure as an alternative to having to deploy and master tools such as Terraform.

The Pulumi CrossCode translation technology the company developed is now being made available to any organization that wants to add support for another programming language. It converts any infrastructure-as-code format, including Terraform, CloudFormation, Azure Resource Manager and Kubernetes configuration, to any programming languages supported by Pulumi.

Pulumi CEO Joe Duffy said the goal is to extend the overall reach of the translation technology the company created to simplify provisioning any type of infrastructure.

While many developers use tools such as Terraform, the need to limit misconfigurations is driving many larger enterprises to revisit their approach to IaC to improve software supply chain security, noted Duffy. Today, Pulumi claims more than 2,400 organizations have adopted platforms that enable developers to provision infrastructure and apply guardrail policies to reduce errors. That approach prevents developers from making configuration mistakes that can lead to exfiltration of data via, for example, a port that has been accidentally left open, he added.

Too many developers assume that their cloud service provider is securing both the underlying platform and how it is configured only to discover later that it was their responsibility to validate those configurations. Security teams, meanwhile, can’t keep pace with the rate at which cloud infrastructure resources are being provisioned without some ability to apply policies that enforce rules for provisioning that infrastructure within the context of a larger DevSecOps workflow.

Ultimately, the goal is to employ automation to resolve these issues once and for all as more organizations adopt DevSecOps best practices. In the meantime, the challenge is doing so in a way the average developer will accept and embrace. Otherwise, they will continue to find ways to work around security teams in the name of productivity, regardless of how insecure the underlying IT environment might become.

May 5, 2022
Pulumi Adds Business Critical Edition to Infrastructure Management Platform

Pulumi today added a Business Critical edition of its Cloud Engineering Platform that provides large enterprises with additional security and compliance features, premium 24×7 support, training, professional services and a self-hosting option.

In addition, the company announced that Pulumi Enterprise and Business Critical editions are now available via the online marketplace run by Amazon Web Services (AWS), with future availability on other marketplaces planned.

The Cloud Engineering Platform from Pulumi enables DevOps teams to use Pulumi Packages to create reusable components for automating IT infrastructure provisioning. Those can be embedded within workflows and applications using an application programming interface (API) that Pulumi has exposed. IT teams can define a Pulumi Package in the programing language of their choice.

Aaron Kao, vice president of marketing for Pulumi, said the Cloud Engineering Platform from Pulumi provides an alternative to managing infrastructure-as-code (IaC) that can be centrally managed more easily than open source tools like Terraform.

Pulumi reported that adoption has accelerated across enterprises around the world with more than one million downloads per month. The company claimed it has seen 350% year-over-year growth of its enterprise customers, such as Mercedes-Benz, in the last 12 months.

IT organizations in general are looking to bring some order to chaotic provisioning processes to avoid misconfigurations that often result in, for example, a developer leaving a port open; that open port leaves a vulnerability through which data can be exfiltrated.

As organizations focus more on software supply chains in the wake of recent high-profile breaches, it’s only a matter of time before more questions arise about how cloud infrastructure is being provisioned. Much of the concerns organizations already have about cloud security don’t stem from the platforms themselves. Rather, it’s the processes employed to provision infrastructure under a shared cloud security responsibility model that results in so many vulnerabilities. Developers often assume the cloud service provider is securing configurations, only to discover later that it was their own responsibility to validate those configurations. Security teams, meanwhile, can’t keep pace with the rate at which cloud infrastructure resources are being provisioned.

Centralizing infrastructure management is especially important as the number of cloud platforms IT organizations manage continues to expand and the rate at which applications are built and deployed shows no sign of slowing, noted Kao.

It’s not clear whether development or IT operations teams will ultimately wind up managing the provisioning of infrastructure. Pulumi is making a case for a platform that enables those teams to more closely collaborate within the context of a set of policies and DevSecOps best practices that the IT organization defines.

It may be a while before the bulk of enterprise IT organizations are able to exercise the political will to regain control over IaC provisioning. However, in the absence of guardrails that allow IT organizations to make sure infrastructure is properly configured, it’s only a matter of time before tougher questions are asked about how software supply chains are managed.

March 3, 2022