Pulumi Blog: Anton Tayanovskyy

New: Use Terraform Modules in Pulumi Without Conversion

Anton Tayanovskyy — Mon, 23 Jun 2025 00:00:00 +0000

Today, we’re excited to announce a major advancement in Pulumi’s mission to make modern infrastructure as code accessible to every developer: direct support for executing Terraform modules. This new capability addresses one of the most significant challenges our users face when migrating from Terraform to Pulumi—complex projects with extensive module dependencies.

The Path to Modern Infrastructure as Code

At Pulumi, we believe the ideal infrastructure as code experience leverages the full power of modern programming languages, AI-assisted development, and cloud-native tooling. Our vision is that every team should be able to write infrastructure code in their preferred language—TypeScript, Python, Go, C#, or Java—with full IntelliSense, testing capabilities, and AI-powered assistance.

However, we also understand the reality that many organizations have invested years building extensive Terraform module estates. These modules often contain critical business logic, compliance configurations, and battle-tested patterns that teams can’t always rewrite overnight.

This new capability bridges that gap, giving you the best of both worlds: the ability to start new projects in Pulumi immediately while preserving your existing Terraform modules until you’re ready to migrate them.

Strategic Migration Approach

Here’s how we recommend teams approach this transition:

Phase 1: New Projects in Pulumi Start all new infrastructure projects in Pulumi to immediately gain the benefits of modern IaC—better developer experience, AI assistance, and cloud-native tooling.

Phase 2: Incremental Module Migration Use the new Terraform module support to bring existing modules into Pulumi projects without rewriting them. This gives you immediate access to Pulumi Cloud’s state management, deployment workflows, and team collaboration features across all your IaC.

Phase 3: Full Migration (When Ready) Gradually migrate your Terraform modules to native Pulumi components as time and resources permit. With AI-assisted development tools making this easier than ever, you can modernize at your own pace.

This approach eliminates the “big bang” migration risk while ensuring you’re not stuck with legacy tooling for new projects.

What This Means for Your Team

This isn’t just a technical feature—it’s a strategic enabler for teams looking to modernize their infrastructure practices. Here’s what this announcement means:

For Terraform Users: You can now migrate to Pulumi incrementally, keeping your existing modules intact while gaining access to Pulumi’s powerful programming language features, better state management, and enhanced developer experience.

For Platform Teams: You can standardize on Pulumi for new infrastructure while seamlessly incorporating existing Terraform modules, reducing migration risk and accelerating adoption.

For DevOps Engineers: You get the best of both worlds—the reliability of proven Terraform modules with Pulumi’s superior tooling, testing capabilities, and deployment workflows.

How It Works

The new feature consists of three key components:

1. Direct Module Execution

The pulumi package add terraform-module command now supports modules from Terraform and OpenTofu registries, as well as locally managed modules. This is powered by our new terraform-module provider, which orchestrates Terraform execution while maintaining the full Pulumi lifecycle.

2. Enhanced Conversion Support

Our pulumi convert --from terraform tool now supports a special annotation // @pulumi-terraform-module <pulumi-package-name> that tells the converter to execute modules directly rather than attempting to translate them. This preserves your existing module logic while enabling Pulumi’s benefits.

3. Configuration Synchronization

Pulumi providers now expose helper methods like awsProvider.terraformConfig() to keep configuration consistent between Pulumi and Terraform providers, eliminating the need to maintain duplicate configuration.

Real-World Impact

Let me walk you through a practical example that demonstrates the power of this integration.

First, install the latest version of the Pulumi CLI (v3.178.0 or later is required) and create a new Pulumi project using pulumi new $language such as pulumi new typescript.

Setting Up a VPC Module

Next, add a Terraform module to your Pulumi project:

$ pulumi package add terraform-module terraform-aws-modules/vpc/aws 6.0.0 vpcmod
Successfully generated a Nodejs SDK for the vpcmod package at /Users/anton/tmp/2025-06-23/blog/sdks/vpcmod

$ pulumi package add terraform-module terraform-aws-modules/vpc/aws 6.0.0 vpcmod

Successfully generated a Python SDK for the vpcmod package at /workdir/vpcmod

Resolved 13 packages in 111ms
 Built pulumi-vpcmod @ file:///workdir/sdks/vpcmod
Prepared 4 packages in 297ms
Installed 4 packages in 1ms
 + arpeggio==2.0.2
 + attrs==25.3.0
 + parver==0.5
 + pulumi-vpcmod==6.0.0 (from file:///workdir/sdks/vpcmod)

You can then import the SDK in your Python code with:

 import pulumi_vpcmod as vpcmod

$ pulumi package add terraform-module terraform-aws-modules/vpc/aws 6.0.0 vpcmod

Using Terraform CLI for schema inference
Successfully generated a Go SDK for the vpcmod package at /workdir/sdks/vpcmod
Go mod file updated to use local sdk for vpcmod
To use this package, import github.com/pulumi/pulumi-terraform-module/sdks/go/vpcmod/v6/vpcmod
Added package "vpcmod" to Pulumi.yaml

$ pulumi package add terraform-module terraform-aws-modules/vpc/aws 6.0.0 vpcmod

Using Terraform CLI for schema inference
Successfully generated a .NET SDK for the vpcmod package at /workdir/sdks/vpcmod

Reference `sdks\vpcmod\Pulumi.Vpcmod.csproj` added to the project.
You also need to add the following to your .csproj file of the program:

 <DefaultItemExcludes>$(DefaultItemExcludes);sdks/**/*.cs</DefaultItemExcludes>

You can then use the SDK in your .NET code with:

 using Pulumi.Vpcmod;

Added package "vpcmod" to Pulumi.yaml

$ pulumi package add terraform-module terraform-aws-modules/vpc/aws 6.0.0 vpcmod

Using Terraform CLI for schema inference
Successfully generated a Java SDK for the vpcmod package at /workdir/sdks/vpcmod

To use this SDK in your Java project, complete the following steps:

1. Copy the contents of the generated SDK to your Java project:
 cp -r /workdir/sdks/vpcmod/src/* /workdir/src

2. Add the SDK's dependencies to your Java project's build configuration.
 If you are using Maven, add the following dependencies to your pom.xml:

 <dependencies>
 <dependency>
 <groupId>com.google.code.findbugs</groupId>
 <artifactId>jsr305</artifactId>
 <version>3.0.2</version>
 </dependency>
 <dependency>
 <groupId>com.google.code.gson</groupId>
 <artifactId>gson</artifactId>
 <version>2.8.9</version>
 </dependency>
 </dependencies>

Added package "vpcmod" to Pulumi.yaml

$ pulumi package add terraform-module terraform-aws-modules/vpc/aws 6.0.0 vpcmod

Added package "vpcmod" to Pulumi.yaml

Pulumi automatically generates a local SDK with full support for your language:

$ ls sdks/vpcmod
README.md index.ts node_modules provider.ts tsconfig.json utilities.ts
bin module.ts package.json scripts types

$ ls sdks/vpcmod
build pulumi_vpcmod pulumi_vpcmod.egg-info setup.py

$ ls sdks/vpcmod
go.mod vpcmod

$ ls sdks/vpcmod
Inputs Provider.cs README.md
logo.png pulumi-plugin.json Utilities.cs
Module.cs Pulumi.Vpcmod.csproj version.txt

$ ls sdks/vpcmod
README.md src

$ ls sdks/vpcmod
vpcmod-6.0.0.yaml

Pulumi automatically links the generated SDK into your project.

Using the Module in Your Code

Now you can use the module with full IntelliSense support:

import * as pulumi from "@pulumi/pulumi";
import * as vpcmod from '@pulumi/vpcmod';

const vpc = new vpcmod.Module("test-vpc", {
 azs: ["us-west-2a", "us-west-2b"],
 name: `test-vpc-${pulumi.getStack()}`,
 cidr: "10.0.0.0/16",
 public_subnets: [
 "10.0.1.0/24",
 "10.0.2.0/24",
 ],
 private_subnets: [
 "10.0.3.0/24",
 "10.0.4.0/24",
 ],
 enable_nat_gateway: true,
 single_nat_gateway: true,
});

export const publicSubnets = vpc.public_subnets;
export const privateSubnets = vpc.private_subnets;

import pulumi
import pulumi_aws as aws
import pulumi_vpcmod as vpcmod

aws_provider = aws.Provider("awsprovider", region="us-east-1")

vpcmod_provider = vpcmod.Provider("vpcprovider", aws=aws_provider.terraform_config().result)

vpc = vpcmod.Module(
 "test-vpc",
 azs=["us-west-2a", "us-west-2b"],
 name=f"test-vpc{pulumi.get_stack()}",
 cidr="10.0.0.0/16",
 public_subnets=[
 "10.0.1.0/24",
 "10.0.2.0/24",
 ],
 private_subnets=[
 "10.0.3.0/24",
 "10.0.4.0/24",
 ],
 enable_nat_gateway=True,
 single_nat_gateway=True,
)

pulumi.export("publicSubnets", vpc.public_subnets)
pulumi.export("privateSubnets", vpc.private_subnets)

package main

import (
 "fmt"

 "github.com/pulumi/pulumi-terraform-module/sdks/go/vpcmod/v6/vpcmod"
 "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func run(ctx *pulumi.Context) error {
 stack := ctx.Stack()

 vpc, err := vpcmod.NewModule(ctx, "test-vpc", &vpcmod.ModuleArgs{
 Azs: pulumi.StringArray{
 pulumi.String("us-west-2a"),
 pulumi.String("us-west-2b"),
 },
 Name: pulumi.String(fmt.Sprintf("test-vpc-%s", stack)),
 Cidr: pulumi.String("10.0.0.0/16"),
 Public_subnets: pulumi.StringArray{
 pulumi.String("10.0.1.0/24"),
 pulumi.String("10.0.2.0/24"),
 },
 Private_subnets: pulumi.StringArray{
 pulumi.String("10.0.3.0/24"),
 pulumi.String("10.0.4.0/24"),
 },
 Enable_nat_gateway: pulumi.Bool(true),
 Single_nat_gateway: pulumi.Bool(true),
 })
 if err != nil {
 return err
 }

 ctx.Export("publicSubnets", vpc.Public_subnets)
 ctx.Export("privateSubnets", vpc.Private_subnets)

 return nil
}

func main() {
 pulumi.Run(run)
}

using System.Collections.Generic;
using Pulumi;
using Vpc = Pulumi.Vpcmod;

return await Deployment.RunAsync(() =>
{
 var vpc = new Vpc.Module("test-vpc", new Vpc.ModuleArgs
 {
 Azs = new string [] {
 "us-west-2a",
 "us-west-2b",
 },
 Cidr = "10.0.0.0/16",
 Public_subnets = new string[] {
 "10.0.1.0/24",
 "10.0.2.0/24"
 },
 Private_subnets = new string[] {
 "10.0.1.0/24",
 "10.0.2.0/24"
 },
 Enable_nat_gateway=true,
 Single_nat_gateway=true
 });

 return new Dictionary<string, object?>
 {
 ["publicSubnets"] = vpc.Public_subnets,
 ["privateSubnets"] = vpc.Private_subnets
 };
});

package myproject;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.deployment.Deployment;
import com.pulumi.vpcmod.Module;
import com.pulumi.vpcmod.ModuleArgs;

public class App {

 public static void main(String[] args) {
 Pulumi.run(ctx -> {
 final var stackName = Deployment.getInstance().getStackName();

 final var vpc = new Module("test-vpc", ModuleArgs.builder()
 .name("test-vpc-"+stackName)
 .azs("us-west-2a", "us-west-2b")
 .cidr("10.0.0.0/16")
 .public_subnets("10.0.1.0/24", "10.0.2.0/24")
 .private_subnets("10.0.3.0/24", "10.0.4.0/24")
 .enable_nat_gateway(true)
 .single_nat_gateway(true)
 .build());

 ctx.export("publicSubnets", vpc.public_subnets());
 ctx.export("privateSubnets", vpc.private_subnets());
 });
 }
}

name: my-program

runtime: yaml

resources:
 vpc:
 type: vpcmod:index:Module
 properties:
 azs:
 - us-west-2a
 - us-west-2b
 name: test-vpc-${pulumi.stack}
 cidr: 10.0.0.0/16
 public_subnets:
 - 10.0.1.0/24
 - 10.0.2.0/24
 private_subnets:
 - 10.0.3.0/24
 - 10.0.4.0/24
 enable_nat_gateway: true
 single_nat_gateway: true

outputs:
 publicSubnets: ${vpc.public_subnets}
 privateSubnets: ${vpc.private_subnets}

packages:
 vpcmod:
 source: terraform-module
 version: 0.1.7
 parameters:
 - terraform-aws-modules/vpc/aws
 - 6.0.0
 - vpcmod

Seamless Deployment

When you run pulumi up, Pulumi orchestrates the Terraform module execution while providing its signature preview and deployment experience:

Previewing update (dev)

View in Browser (Ctrl+O): https://app.pulumi.com/anton-pulumi-corp/anton-blog/dev/previews/5851682a-a3e3-4f47-a50e-3d7b4f4e6c34

 Type Name Plan
 + pulumi:pulumi:Stack anton-blog-dev create
 + └─ vpcmod:index:Module test-vpc create
 + ├─ vpcmod:tf:aws_route_table_association module.test-vpc.aws_route_table_association.private[0] create
 + ├─ vpcmod:tf:aws_subnet module.test-vpc.aws_subnet.private[1] create
 + ├─ vpcmod:tf:aws_route_table_association module.test-vpc.aws_route_table_association.public[1] create
 + ├─ vpcmod:tf:aws_subnet module.test-vpc.aws_subnet.private[0] create
 + ├─ vpcmod:tf:aws_route_table module.test-vpc.aws_route_table.private[0] create
 + ├─ vpcmod:tf:aws_subnet module.test-vpc.aws_subnet.public[1] create
 + ├─ vpcmod:tf:aws_nat_gateway module.test-vpc.aws_nat_gateway.this[0] create
 + ├─ vpcmod:tf:aws_route module.test-vpc.aws_route.public_internet_gateway[0] create
 + ├─ vpcmod:tf:aws_route module.test-vpc.aws_route.private_nat_gateway[0] create
 + ├─ vpcmod:tf:aws_default_network_acl module.test-vpc.aws_default_network_acl.this[0] create
 + ├─ vpcmod:tf:aws_default_route_table module.test-vpc.aws_default_route_table.default[0] create
 + ├─ vpcmod:tf:aws_subnet module.test-vpc.aws_subnet.public[0] create
 + ├─ vpcmod:tf:aws_internet_gateway module.test-vpc.aws_internet_gateway.this[0] create
 + ├─ vpcmod:tf:aws_vpc module.test-vpc.aws_vpc.this[0] create
 + ├─ vpcmod:tf:aws_default_security_group module.test-vpc.aws_default_security_group.this[0] create
 + ├─ vpcmod:tf:aws_route_table module.test-vpc.aws_route_table.public[0] create
 + ├─ vpcmod:tf:aws_eip module.test-vpc.aws_eip.nat[0] create
 + ├─ vpcmod:tf:aws_route_table_association module.test-vpc.aws_route_table_association.public[0] create
 + └─ vpcmod:tf:aws_route_table_association module.test-vpc.aws_route_table_association.private[1] create

Resources:
 + 21 to create

The infrastructure deploys successfully, and the Terraform state is automatically stored securely in Pulumi Cloud with full secret encryption support.

Migration Made Simple

For teams starting with existing Terraform code, the migration process is straightforward. Simply annotate your modules with a special comment:

// @pulumi-terraform-module vpcmod
module "my-vpc" {
 source = "terraform-aws-modules/vpc/aws"
 version = "6.0.0"
 azs = ["us-west-2a", "us-west-2b"]
 name = "test-vpc-123"
 public_subnets = ["10.0.1.0/24", "10.0.2.0/24"]
 private_subnets = ["10.0.3.0/24", "10.0.4.0/24"]
 enable_nat_gateway = true
 single_nat_gateway = true
}

Then run the conversion (replace typescript with your language of choice):

pulumi convert --from terraform --language typescript --out my-pulumi-project

The resulting project is ready to deploy with full Pulumi functionality.

Configuration Management

One of the key benefits is seamless configuration management. Instead of maintaining separate configurations for Pulumi and Terraform providers, you can reuse your existing Pulumi provider configuration:

const awsProvider = new aws.Provider("awsprovider", {
 region: "us-west-2",
 // more configuration
});

// Pass the AWS configuration to your VPC module provider
const vpcmodProvider = new vpcmod.Provider("vpcprovider", {
 "aws": awsProvider.terraformConfig().result
});

// Use the VPC module provider in your Module
const vpc = new vpcmod.Module("test-vpc", {...},
 {provider: vpcmodProvider}
);

import pulumi
import pulumi_aws as aws
import pulumi_vpcmod as vpcmod

aws_provider = aws.Provider("awsprovider", region="us-west-2")

# Pass the AWS configuration to your VPC module provider
vpcmod_provider = vpcmod.Provider("vpcprovider", aws=aws_provider.terraform_config().result)

# Use the VPC module provider in your Module
vpc = vpcmod.Module("test-vpc", ..., opts=pulumi.ResourceOptions(provider=vpcmod_provider))

func run(ctx *pulumi.Context) error {
 stack := ctx.Stack()

 awsProvider, err := aws.NewProvider(ctx, "awsprovider", &aws.ProviderArgs{
 Region: pulumi.String("us-west-2"),
 })
 if err != nil {
 return err
 }

 awsProviderTfConfig, err := awsProvider.TerraformConfig(ctx)
 if err != nil {
 return err
 }

 // Pass the AWS configuration to your VPC module provider
 vpcProvider, err := vpcmod.NewProvider(ctx, "vpcprovider", &vpcmod.ProviderArgs{
 Aws: awsProviderTfConfig.Result(),
 })
 if err != nil {
 return err
 }

 // Use the VPC module provider in your Module
 vpc, err := vpcmod.NewModule(ctx, "test-vpc", &vpcmod.ModuleArgs{...}, pulumi.Provider(vpcProvider))
 if err != nil {
 return err
 }

 ctx.Export("publicSubnets", vpc.Public_subnets)
 ctx.Export("privateSubnets", vpc.Private_subnets)

 return nil
}

This demonstrates how Terraform modules integrate seamlessly with existing Pulumi programs, allowing you to compose infrastructure components naturally.

What’s Supported

The integration provides comprehensive support for Pulumi’s core features:

Full Lifecycle Management: Preview, update, refresh, and destroy operations work exactly as expected
Resource Visibility: The entire resource tree is visible in Pulumi’s UI and CLI
Type Safety: Generated TypeScript interfaces provide IntelliSense and compile-time checking
Secret Management: First-class support for Pulumi’s secret encryption
Provider Configuration: Full control over Terraform provider settings

Current Limitations

As with any new technology integration, there are some current limitations to be aware of:

Transforms resource options are not supported
Targeted operations like pulumi up --target are not available
The protect resource option is not supported
Dependent resources may have limited support in some scenarios

Looking Ahead

This release represents a significant milestone in our journey to make infrastructure as code accessible to every developer. We’re already working on the next phase, which includes:

Enhanced state import capabilities for seamless Terraform-to-Pulumi migrations
Improved type inference for complex module schemas
Expanded support for additional Terraform features

The Path Forward

While this capability enables you to preserve your existing Terraform modules, we encourage teams to view this as a stepping stone rather than a final destination. The full benefits of modern infrastructure as code—including AI-assisted development, advanced testing capabilities, and seamless integration with modern development workflows—are best realized with native Pulumi components.

With AI developer tools making code conversion easier than ever, we’re committed to helping teams migrate their Terraform modules to native Pulumi when they’re ready. This capability ensures you can start your modernization journey today without being blocked by existing technical debt.

Get Started Today

The Terraform module support is available immediately. Install the latest Pulumi CLI and try it out with your existing Terraform modules. We’ve prepared comprehensive examples showcasing real-world scenarios, from simple VPC deployments to complex multi-module architectures.

For detailed documentation on using Terraform modules in Pulumi, including advanced configuration options, troubleshooting guides, and best practices, see our comprehensive guide.

If you encounter any issues or have suggestions for improvement, please open an issue or reach out in our Community Slack. Your feedback is invaluable as we continue to evolve this capability.

This release embodies our commitment to meeting developers where they are while providing a clear path forward to modern infrastructure practices. We’re excited to see how teams use this capability to accelerate their infrastructure modernization journey.

Announcing the 1.0 release of AWS CDK on Pulumi

Matt Jeffryes — Mon, 02 Dec 2024 08:00:00 -0700

At Pulumi, we’re committed to delivering the widest range of cloud infrastructure building blocks for use in your cloud engineering projects. In 2022, we introduced preview support for integrating AWS CDK constructs into Pulumi programs and today we’re happy to announce the 1.0 release of our pulumi-cdk library for typescript. This first stable version completes support for common CDK features enabling you to deploy almost any CDK construct with Pulumi.

The pulumi-cdk library provides access to the many high-level libraries (‘constructs’) built by service teams at AWS and by the AWS CDK community. However, there were some limitations in the preview version of the library that prevented using some constructs and complicating migration of existing CDK stacks. Uncertainty about which constructs were supported has limited adoption of this rich ecosystem by Pulumi users.

With the new 1.0 release, pulumi-cdk has greatly expanded compatibility with all CDK features. Users can now confidently use Pulumi to deploy constructs they have written themselves or any of the 1600+ constructs in AWS’s construct hub. We’re excited to bring Pulumi users access to all the high level interfaces curated by AWS and the CDK community.

Additionally, existing AWS CDK users now have an easier path to transition from CloudFormation to Pulumi, unlocking faster deployments, integration with Pulumi’s vast provider ecosystem and all of the features of Pulumi’s Cloud Engineering Platform (like Policy as Code, Audit Logs, Drift detection, Secrets, and much more).

Deploying CDK Constructs with Pulumi

To deploy existing AWS CDK Constructs using Pulumi:

Create a class that derives from pulumicdk.Stack (which itself is derived from awscdk.Stack).
In the constructor, use any AWS CDK constructs from existing libraries such as aws-cdk-lib
Create a pulumicdk.App instance that constructs an instance of your stack.

For example, the following program deploys an AWS Apprunner CDK Construct using Pulumi:

import * as pulumi from '@pulumi/pulumi';
import * as pulumicdk from '@pulumi/cdk';
import { Service, Source } from '@aws-cdk/aws-apprunner-alpha';

class AppRunnerStack extends pulumicdk.Stack {
 url: pulumi.Output<string>;

 constructor(id: string, options?: pulumicdk.StackOptions) {
 super(id, options);

 const service = new Service(this, 'service', {
 source: Source.fromEcrPublic({
 imageConfiguration: { port: 8000 },
 imageIdentifier: 'public.ecr.aws/aws-containers/hello-app-runner:latest',
 }),
 });

 this.url = this.asOutput(service.serviceUrl);
 }
}

const app = new pulumicdk.App('app', (scope: pulumicdk.App): pulumicdk.AppOutputs => {
 const stack = new AppRunnerStack('teststack');
 return {
 url: stack.url,
 };
});
export const url = app.outputs['url'];

Deploy with a pulumi up:

> pulumi up

Updating (dev)

View Live: https://app.pulumi.com/lukehoban/pulumi-cdk-apprunner/dev/updates/1

 Type Name Status
 + pulumi:pulumi:Stack pulumi-cdk-apprunner-dev created
 + └─ cdk:index:StackComponent teststack created
 + └─ cdk:construct:Service teststack/adapter/service created
 + └─ aws-native:apprunner:Service service6D174F83 created

Outputs:
 url: "2ez3iazupm.us-west-2.awsapprunner.com"

Resources:
 + 4 created

And curl the endpoint:

> curl https://$(pulumi stack output url)

 ______ __ __ __ _ __
 / ____/___ ____ ____ __________ _/ /___ __/ /___ _/ /_(_)___ ____ _____/ /
 / / / __ \/ __ \/ __ `/ ___/ __ `/ __/ / / / / __ `/ __/ / __ \/ __ \/ ___/ /
/ /___/ /_/ / / / / /_/ / / / /_/ / /_/ /_/ / / /_/ / /_/ / /_/ / / / (__ )_/
\____/\____/_/ /_/\__, /_/ \__,_/\__/\__,_/_/\__,_/\__/_/\____/_/ /_/____(_)
 /____/

 Congratulations, your service has successfully deployed on AWS App Runner.

Open it in your browser at https://2ez3iazupm.us-west-2.awsapprunner.com/

Try the workshop at https://apprunnerworkshop.com
Read the docs at https://docs.aws.amazon.com/apprunner

Pulumi takes CDK apps to the next level

Combine CDK constructs with any of the features of Pulumi programs to deploy faster, easier and to any cloud. Use Pulumi functions and stack references to connect to pre-existing infrastructure and mix in resources from any provider to bring all of your infrastructure under management.

For example, we can use CDK’s ecs_patterns to quickly create a loadbalanced Fargate service, but route traffic to it with a record in an existing CloudFlare DNS zone.

import * as path from 'path';
import * as acm from 'aws-cdk-lib/aws-certificatemanager';
import * as aws from '@pulumi/aws';
import * as pulumi from '@pulumi/pulumi';
import * as pulumicdk from '@pulumi/cdk';
import * as cloudflare from '@pulumi/cloudflare';
import * as ecs from 'aws-cdk-lib/aws-ecs';
import * as ecsPatterns from 'aws-cdk-lib/aws-ecs-patterns';

let config = new pulumi.Config();
let accountId = config.requireSecret("cloudflare_account_id");
let zoneName = config.require("cloudflare_zone_name");
let certificateId = config.require("certificate_id");
let certificateKey = config.requireSecret("certificate_key");

class CloudFlareStack extends pulumicdk.Stack {
 constructor(app: pulumicdk.App, id: string) {
 super(app, id);

 // First Load the zone and certificate from CloudFlare
 ///////////////////////////////////////////////////////

 // Read the CloudFlare zone for the domain
 const zone = cloudflare.getZoneOutput({
 accountId,
 name: zoneName,
 });

 // read the certificate from CloudFlare
 const caCertificate = cloudflare.getOriginCaCertificateOutput({
 id: certificateId,
 });

 // Import the certificate in ACM
 const cert = new aws.acm.Certificate('import', {
 privateKey: certificateKey,
 certificateBody: caCertificate.certificate,
 });

 // Create a L2 reference from the cert arn
 const acmCert = acm.Certificate.fromCertificateArn(this, 'cert', pulumicdk.asString(cert.arn));

 // Next, use ECS Patterns to create a loadbalanced fargate service with the correct certificate
 ///////////////////////////////////////////////////////////////////////////////////////////////

 const loadBalancedFargateService = new ecsPatterns.ApplicationLoadBalancedFargateService(this, 'Service', {
 certificate: acmCert,
 redirectHTTP: true,
 taskImageOptions: {
 image: ecs.ContainerImage.fromRegistry("amazon/amazon-ecs-sample"),
 },
 });

 const alb = loadBalancedFargateService.loadBalancer;

 // Finally, Create a record in CloudFlare that directs to the service's loadbalancer
 ////////////////////////////////////////////////////////////////////////////////////

 new cloudflare.Record('alb', {
 name: 'cdk-alb',
 type: 'CNAME',
 zoneId: zone.zoneId,
 content: this.asOutput(alb.loadBalancerDnsName),
 proxied: true,
 });
 }
}

class MyApp extends pulumicdk.App {
 constructor() {
 super('app', (scope: pulumicdk.App) => {
 new CloudFlareStack(scope, 'cloudflare');
 });
 }
}

new MyApp();

Pulumi let’s you read and create any resource type across thousands of different cloud service providers and integrate them with your CDK stacks. Building CDK apps on Pulumi brings a host of other benefits too, including:

Customize resource options (eg. to protect a database against accidental deletion or deploy to multiple regions in the same program)
Detect and manage drift with Pulumi deployments
Track and store user actions and change history with Audit Logs
And a host of other benefits from Pulumi Cloud

Expanded Features in pulumi-cdk 1.0

The 1.0 version of pulumi-cdk adds support for key CDK features such as: assets, custom resources, nested stacks, and aspects, so most existing CDK constructs will work with Pulumi without any modification. We’ve also eliminated the need to call cdk bootstrap before running pulumi up by integrating a custom Pulumi Synthesizer.

Using CDK Aspects

Pulumi CDK now supports CDK aspects. For example, you can add the cdk-nag aspect to your stack to enforce best practices:

import * as pulumicdk from '@pulumi/cdk';
import * as s3 from 'aws-cdk-lib/aws-s3';
import { AwsSolutionsChecks } from 'cdk-nag';

const app = new pulumicdk.App('app', (scope: pulumicdk.App): pulumicdk.AppOutputs => {
 const stack = new pulumicdk.Stack('example-stack');
 Aspects.of(stack).add(new AwsSolutionsChecks({ verbose: true }));

 new s3.Bucket(this, 'bucket');
});

Example Output

[Error at /test-stack/bucket/Resource] AwsSolutions-S1: The S3 Bucket has server access logs disabled. The bucket should have server access logging enabled to provide detailed records for the requests that are made to the bucket.
[Error at /test-stack/bucket/Resource] AwsSolutions-S10: The S3 Bucket or bucket policy does not require requests to use SSL. You can use HTTPS (TLS) to help prevent potential attackers from eavesdropping on or manipulating network traffic using person-in-the-middle or similar attacks. You should allow only encrypted connections over HTTPS (TLS) using the aws:SecureTransport condition on Amazon S3 bucket policies.

CDK assets

CDK’s assets make it easy to bundle code and other files your application needs into an S3 bucket or a Docker container, eliminating extra steps from your build pipeline. For example you can use Docker container asset to deploy a Fargate service from local directory. CDK will build the container image and push to ECR on pulumi up.

import * as pulumicdk from '@pulumi/cdk';
import * as aws from '@pulumi/aws';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as ecs from 'aws-cdk-lib/aws-ecs';
import * as ecs_patterns from 'aws-cdk-lib/aws-ecs-patterns';

const app = new pulumicdk.App('app', (scope: pulumicdk.App) => {
 const stack = new pulumicdk.Stack('example-stack');

 const vpc = new ec2.Vpc(stack, 'MyVpc');
 const cluster = new ecs.Cluster(stack, 'fargate-service-autoscaling', { vpc });

 // Create Fargate Service
 const fargateService = new ecs_patterns.NetworkLoadBalancedFargateService(this, 'sample-app', {
 cluster,
 taskImageOptions: {
 image: ecs.ContainerImage.fromAsset(path.join(__dirname, './'), {
 // assetName is required and is used in the name of the ecr repository that is created
 assetName: 'cdk-fargate-example',
 }),
 },
 });
});

Future direction

Currently AWS CDK on Pulumi is supported only for TypeScript users, but we’re eager to bring the benefits of the CDK ecosystem to all Pulumi languages in the future. You can comment and upvote on this tracking issue, to let us know this is important to you.

We’re also exploring options for importing state from CDK applications that are already deployed with CloudFormation to enable seamless migration for existing CDK users. Please let us know on this tracking issue if you would be interested in testing this with us.

Summary

The 1.0 release of AWS CDK support for Pulumi marks a significant expansion of opportunities to interoperate between the AWS CDK and Pulumi ecosystems. Existing AWS CDK users can now more easily adopt the full power, speed and flexibility of the Pulumi Cloud Platform and its diverse ecosystem. And existing Pulumi users can benefit from the many expert curated constructs and libraries in the CDK community. We’re excited to see what you’ll build with these two great cloud technologies together.

The AWS CDK on Pulumi project is open source at https://github.com/pulumi/pulumi-cdk and on NPM at https://www.npmjs.com/package/@pulumi/cdk. Get started today!

Functions Now Accept Outputs

Anton Tayanovskyy — Fri, 12 Nov 2021 13:14:58 -0500

Pulumi 3.17.1 makes it easier to compose function calls and resources. In practice you often need to call a function with a resource output. Previous versions of Pulumi required an apply to do this, which was unfortunate:

new Pulumi users would get stuck and ask for help as the solution was not obvious
experienced users found the code unpleasant, upvoting the relevant GitHub Issue

With Pulumi 3.17.1 you can now call functions directly with resource outputs without an extra apply. Every function now has an additional Output form that accepts Input-typed arguments and returns an Output-wrapped result.

For a quick example, here is how you can call aws.ecr.getCredentials with a registryId of type Output<string>:

const registryId: Output<string> = ...
getCredentialsOutput({registryId: registryId}): Output<GetCredentialsResult>

registry_id: Output[str] = ...
get_credentials_output(registry_id=registryId): Output[GetCredentialsResult]

var registryId StringOutput
var result GetCredentialsResultOutput
result = GetCredentialsOutput(ctx, GetCredentialsOutputArgs{
 RegistryId: result
})

Output<string> registryId;
GetCredentials.Invoke(new GetCredentialsInvokeArgs
{
 RegistryId = registryId
});

Complete Example: Publish Docker Image to ECR

Why would you call aws.ecr.getCredentials with an Output? Suppose you want to provision an AWS Elastic Container Registry (ECR) repository, build a Docker image locally and publish this image to the registry.

To configure the Docker Image resource, you need ECR credentials.
To acquire the credentials, you need to call the aws.ecr.getCredentials function with the ECR registry ID.
Because the ECR registry ID is only known once the actual repository is provisioned in the cloud, the registryId property of the ecr.Repository resource has the type Output<string> rather than string (see Inputs and Outputs).

In the code below, note how getCredentialsOutput now accepts appRepo.registryId directly:

import * as aws from "@pulumi/aws";
import * as docker from "@pulumi/docker";

function parseAuthToken(authToken: string): {username: string, password: string} {
 const parts = Buffer.from(authToken, "base64").toString("ascii").split(":");
 console.log(parts);
 return {
 username: parts[0],
 password: parts[1]
 }
}

const appRepo = new aws.ecr.Repository("app-repo");

const creds = aws.ecr.getCredentialsOutput({registryId: appRepo.registryId})
 .apply(creds => parseAuthToken(creds.authorizationToken))

const image = new docker.Image("app-img", {
 // ./my-app is a folder with a Dockerfile
 build: "./my-app",
 imageName: appRepo.repositoryUrl,
 registry: {
 server: appRepo.repositoryUrl,
 username: creds.username,
 password: creds.password
 }
});

export const imageUrn = image.urn;

from collections import namedtuple
import base64
from pulumi_aws import s3, ecr
import pulumi_docker as docker

Creds = namedtuple('Creds', 'username password')

def parse_auth_token(token):
 (u, p) = base64.b64decode(token).decode().split(':')
 return Creds(username=u, password=p)

repo = ecr.Repository('app-repo')

creds = ecr.get_credentials_output(registry_id=repo.registry_id).apply(
 lambda creds: parse_auth_token(creds.authorization_token))

image = docker.Image(
 'app-img',
 image_name=repo.repository_url,
 # ./my-app is a folder with a Dockerfile
 build=docker.DockerBuild(context='./my-app'),
 registry=docker.ImageRegistry(
 repo.repository_url,
 creds.username,
 creds.password))

package main

import (
 "encoding/base64"
 "fmt"
 "strings"

 "github.com/pulumi/pulumi-aws/sdk/v4/go/aws/ecr"
 "github.com/pulumi/pulumi-docker/sdk/v3/go/docker"
 "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

type creds struct {
 Username string
 Password string
}

func parseAuthToken(token string) (creds, error) {
 decoded, err := base64.StdEncoding.DecodeString(token)
 if err != nil {
 return creds{}, err
 }
 parts := strings.Split(string(decoded), ":")
 if len(parts) != 2 {
 return creds{}, fmt.Errorf("Failed to parse token")
 }
 return creds{parts[0], parts[1]}, nil
}

func main() {
 pulumi.Run(func(ctx *pulumi.Context) error {

 repo, err := ecr.NewRepository(ctx, "app-repo", &ecr.RepositoryArgs{})
 if err != nil {
 return err
 }

 creds := ecr.GetCredentialsOutput(ctx, ecr.GetCredentialsOutputArgs{
 RegistryId: repo.RegistryId,
 })

 username := creds.AuthorizationToken().
 ApplyT(func(token string) (string, error) {
 creds, err := parseAuthToken(token)
 return creds.Username, err
 }).(pulumi.StringOutput)

 password := creds.AuthorizationToken().
 ApplyT(func(token string) (string, error) {
 creds, err := parseAuthToken(token)
 return creds.Password, err
 }).(pulumi.StringOutput)

 image, err := docker.NewImage(ctx, "app-img", &docker.ImageArgs{
 Build: &docker.DockerBuildArgs{
 Context: pulumi.String("./my-app"),
 },
 ImageName: repo.RepositoryUrl,
 Registry: &docker.ImageRegistryArgs{
 Server: repo.RepositoryUrl,
 Username: username,
 Password: password,
 },
 })
 if err != nil {
 return err
 }

 ctx.Export("imageName", image.ImageName)
 return nil
 })
}

class MyStack : Pulumi.Stack
{
 public MyStack()
 {
 var repo = new Repository("app-repo");

 var creds = GetCredentials.Invoke(new GetCredentialsInvokeArgs
 {
 RegistryId = repo.RegistryId
 });

 var username = creds
 .Apply(c => ParseAuthToken(c.AuthorizationToken).Username);

 var password = creds
 .Apply(c => ParseAuthToken(c.AuthorizationToken).Password);

 var image = new Image("app-img", new ImageArgs
 {
 ImageName = repo.RepositoryUrl,
 Build = new DockerBuild
 {
 // ./my-app is a folder with a Dockerfile
 Context = "./my-app"
 },
 Registry = new ImageRegistry
 {
 Server = repo.RepositoryUrl,
 Username = username,
 Password = password,
 }
 });
 }

 public (string Username, string Password) ParseAuthToken(string token)
 {
 var parts = Encoding.UTF8.GetString(
 Convert.FromBase64String(token)).Split(":");
 return (Username: parts[0], Password: parts[1]);
 }
}

Prior to the ability to call aws.ecr.getCredentials directly with an Output this program required an apply form and was a lot more verbose and harder to read:

const creds = appRepo.id
 .apply(id => aws.ecr.getCredentials({registryId: id})

creds = app_repo.id.apply(lambda repo_id: ecr.get_credentials(registry_id=repo_id))

creds := repo.ID().ToStringOutput().
 ApplyT(func(id string) *ecr.GetCredentialsResult {
 creds, err := ecr.GetCredentials(ctx,
 &ecr.GetCredentialsArgs{RegistryId: id})
 if err != nil {
 panic(err)
 }
 return creds
 }).(ecr.GetCredentialsResultOutput)

var creds = repo.Id.Apply(repoId =>
 GetCredentials.InvokeAsync(new GetCredentialsArgs
 {
 RegistryId = repoId
 }));

More examples

The above example is one of many practical situations where mixing function calls and resources benefits from the new form. To find out more, check out the following updated Pulumi examples:

Compatibility

To keep existing Pulumi programs working without changes, the function forms are added as separate functions or methods in each Pulumi-supported language following a simple naming convention. To illustrate with the getCredentials function:

Language	Existing non-Output form	New Output form
TypeScript	aws.ecr.getCredentials	aws.ecr.getCredentialsOutput
Python	aws.ecr.get_credentials	aws.ecr.get_credentials_output
Go	ecr.getCredentials	ecr.getCredentialsOutput
C#	GetCredentials.InvokeAsync	GetCredentials.Invoke

Note that there are cases where the existing non-Output form may still be the right choice. For example, retrieving the default VPC in Python utilizing the existing form is simpler as it returns a result that can be immediately inspected:

default_vpc = aws.ec2.get_vpc(default=True)
print(default_vpc.id)

Prefer the new Output form when passing resource outputs to a function or else using the outputs of the function as inputs to resources. You may still want to use the existing non-Output form if you are using the outputs of the function to inform control flow (if conditionals or for loops).

Get started

To use Output-versioned functions, please upgrade your install of Pulumi to at least 3.17.1 and upgrade your providers to the latest available version. Example compatible versions for major Pulumi providers:

Provider	Version
pulumi-aws	4.27.0
pulumi-azure-native	1.45.0
pulumi-google-native	0.8.0
pulumi-azure	4.26.0
pulumi-gcp	5.26.0