Pulumi Blog: Cory Hall

Pulumi AWS Provider 7.0: Multi-Region Support, IAM Role Chaining, and S3 Resource Simplification

Cory Hall — Tue, 05 Aug 2025 09:00:00 -0400

Pulumi AWS provider 7.0 is here with powerful new capabilities that simplify and scale infrastructure as code on AWS. As the most widely used provider in the Pulumi ecosystem, it offers access to the full surface area of the upstream Terraform AWS Provider in Pulumi projects in all supported languages, like TypeScript, Python, Go, C#, Java, and YAML.

The 7.0 release brings fixes and improvements to the provider, including several breaking changes as part of the major version release.

What’s New in Pulumi AWS Provider 7.0

Multi-Region AWS Deployments with a Single Provider

Previously the Pulumi AWS provider each provider configuration could target a single AWS region. This meant that users would need to create a separate provider configuration for each region they wanted to deploy resources to. As the number of providers configured in an application grew, it could sometimes lead to increased memory usage.

With the 7.0 release, the AWS provider now supports multiple regions with a single provider. Each resource now has a region input property that allows the user to specify the region at the resource level, while still utilizing the same provider.

Some key highlights of this feature include:

Single provider configuration: This reduces the need to load multiple instances of the AWS provider, lowering memory usage.
Region input property: The region input property is added to all resources (except global resources)
Resource import enhancements: A new @<regionID> suffix allows importing resources from different regions

This example shows how to use the new region input property to configure cross-region VPC peering.

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const provider = new aws.Provider("provider", {region: "us-east-1"});
const mainVpc = new aws.ec2.Vpc("mainVpc", {cidrBlock: "10.0.0.0/16"}, {
 provider: provider,
});
const peerVpc = new aws.ec2.Vpc("peerVpc", {cidrBlock: "10.1.0.0/16"}, {
 provider: provider,
});
const peerConnection = new aws.ec2.VpcPeeringConnection("peerConnection", {
 vpcId: mainVpc.id,
 peerVpcId: peerVpc.id,
 peerRegion: "us-west-2",
 autoAccept: false,
}, {
 provider: provider,
});
const peerAcceptor = new aws.ec2.VpcPeeringConnectionAccepter("peerAcceptor", {
 region: "us-west-2",
 vpcPeeringConnectionId: peerConnection.id,
 autoAccept: true,
}, {
 provider: provider,
});

import pulumi
import pulumi_aws as aws

provider = aws.Provider("provider", region="us-east-1")
main_vpc = aws.ec2.Vpc("mainVpc", cidr_block="10.0.0.0/16",
opts = pulumi.ResourceOptions(provider=provider))
peer_vpc = aws.ec2.Vpc("peerVpc", cidr_block="10.1.0.0/16",
opts = pulumi.ResourceOptions(provider=provider))
peer_connection = aws.ec2.VpcPeeringConnection("peerConnection",
 vpc_id=main_vpc.id,
 peer_vpc_id=peer_vpc.id,
 peer_region="us-west-2",
 auto_accept=False,
 opts = pulumi.ResourceOptions(provider=provider))
peer_acceptor = aws.ec2.VpcPeeringConnectionAccepter("peerAcceptor",
 region="us-west-2",
 vpc_peering_connection_id=peer_connection.id,
 auto_accept=True,
 opts = pulumi.ResourceOptions(provider=provider))

package main

import (
 "github.com/pulumi/pulumi-aws/sdk/v7/go/aws"
 "github.com/pulumi/pulumi-aws/sdk/v7/go/aws/ec2"
 "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
 pulumi.Run(func(ctx *pulumi.Context) error {
 provider, err := aws.NewProvider(ctx, "provider", &aws.ProviderArgs{
 Region: pulumi.String("us-east-1"),
 })
 if err != nil {
 return err
 }
 mainVpc, err := ec2.NewVpc(ctx, "mainVpc", &ec2.VpcArgs{
 CidrBlock: pulumi.String("10.0.0.0/16"),
 }, pulumi.Provider(provider))
 if err != nil {
 return err
 }
 peerVpc, err := ec2.NewVpc(ctx, "peerVpc", &ec2.VpcArgs{
 CidrBlock: pulumi.String("10.1.0.0/16"),
 }, pulumi.Provider(provider))
 if err != nil {
 return err
 }
 peerConnection, err := ec2.NewVpcPeeringConnection(ctx, "peerConnection", &ec2.VpcPeeringConnectionArgs{
 VpcId: mainVpc.ID(),
 PeerVpcId: peerVpc.ID(),
 PeerRegion: pulumi.String("us-west-2"),
 AutoAccept: pulumi.Bool(false),
 }, pulumi.Provider(provider))
 if err != nil {
 return err
 }
 _, err = ec2.NewVpcPeeringConnectionAccepter(ctx, "peerAcceptor", &ec2.VpcPeeringConnectionAccepterArgs{
 Region: pulumi.String("us-west-2"),
 VpcPeeringConnectionId: peerConnection.ID(),
 AutoAccept: pulumi.Bool(true),
 }, pulumi.Provider(provider))
 if err != nil {
 return err
 }
 return nil
 })
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() =>
{
 var provider = new Aws.Provider("provider", new()
 {
 Region = "us-east-1",
 });

 var mainVpc = new Aws.Ec2.Vpc("mainVpc", new()
 {
 CidrBlock = "10.0.0.0/16",
 }, new CustomResourceOptions
 {
 Provider = provider,
 });

 var peerVpc = new Aws.Ec2.Vpc("peerVpc", new()
 {
 CidrBlock = "10.1.0.0/16",
 }, new CustomResourceOptions
 {
 Provider = provider,
 });

 var peerConnection = new Aws.Ec2.VpcPeeringConnection("peerConnection", new()
 {
 VpcId = mainVpc.Id,
 PeerVpcId = peerVpc.Id,
 PeerRegion = "us-west-2",
 AutoAccept = false,
 }, new CustomResourceOptions
 {
 Provider = provider,
 });

 var peerAcceptor = new Aws.Ec2.VpcPeeringConnectionAccepter("peerAcceptor", new()
 {
 Region = "us-west-2",
 VpcPeeringConnectionId = peerConnection.Id,
 AutoAccept = true,
 }, new CustomResourceOptions
 {
 Provider = provider,
 });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.Provider;
import com.pulumi.aws.ProviderArgs;
import com.pulumi.aws.ec2.Vpc;
import com.pulumi.aws.ec2.VpcArgs;
import com.pulumi.aws.ec2.VpcPeeringConnection;
import com.pulumi.aws.ec2.VpcPeeringConnectionArgs;
import com.pulumi.aws.ec2.VpcPeeringConnectionAccepter;
import com.pulumi.aws.ec2.VpcPeeringConnectionAccepterArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
 public static void main(String[] args) {
 Pulumi.run(App::stack);
 }

 public static void stack(Context ctx) {
 var provider = new Provider("provider", ProviderArgs.builder()
 .region("us-east-1")
 .build());

 var mainVpc = new Vpc("mainVpc", VpcArgs.builder()
 .cidrBlock("10.0.0.0/16")
 .build(), CustomResourceOptions.builder()
 .provider(provider)
 .build());

 var peerVpc = new Vpc("peerVpc", VpcArgs.builder()
 .cidrBlock("10.1.0.0/16")
 .build(), CustomResourceOptions.builder()
 .provider(provider)
 .build());

 var peerConnection = new VpcPeeringConnection("peerConnection", VpcPeeringConnectionArgs.builder()
 .vpcId(mainVpc.id())
 .peerVpcId(peerVpc.id())
 .peerRegion("us-west-2")
 .autoAccept(false)
 .build(), CustomResourceOptions.builder()
 .provider(provider)
 .build());

 var peerAcceptor = new VpcPeeringConnectionAccepter("peerAcceptor", VpcPeeringConnectionAccepterArgs.builder()
 .region("us-west-2")
 .vpcPeeringConnectionId(peerConnection.id())
 .autoAccept(true)
 .build(), CustomResourceOptions.builder()
 .provider(provider)
 .build());

 }
}

name: cross-region-peering
runtime: yaml

resources:
 provider:
 type: pulumi:providers:aws
 properties:
 region: us-east-1
 mainVpc:
 type: aws:ec2:Vpc
 properties:
 cidrBlock: 10.0.0.0/16
 options:
 provider: ${provider}
 peerVpc:
 type: aws:ec2:Vpc
 properties:
 cidrBlock: 10.1.0.0/16
 options:
 provider: ${provider}
 peerConnection:
 type: aws:ec2:VpcPeeringConnection
 properties:
 vpcId: ${mainVpc.id}
 peerVpcId: ${peerVpc.id}
 peerRegion: us-west-2
 autoAccept: false
 options:
 provider: ${provider}
 peerAcceptor:
 type: aws:ec2:VpcPeeringConnectionAccepter
 properties:
 region: us-west-2
 vpcPeeringConnectionId: ${peerConnection.id}
 autoAccept: true
 options:
 provider: ${provider}

See the Enhanced Region Support guide for more details.

IAM Role Chaining for Secure AWS IaC Workflows

One of the most requested features, IAM role chaining, is now supported. This allows the Pulumi AWS Provider to assume multiple IAM roles in sequence to obtain credentials, streamlining secure AWS access across accounts and teams.

To assume a role with role chaining, you can now do the following:

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const provider = new aws.Provider("provider", {assumeRoles: [
 {
 roleArn: "arn:aws:iam::123456789012:role/INITIAL_ROLE_NAME",
 },
 {
 roleArn: "arn:aws:iam::123456789012:role/FINAL_ROLE_NAME",
 },
]});

import pulumi
import pulumi_aws as aws

provider = aws.Provider("provider", assume_roles=[
 {
 "role_arn": "arn:aws:iam::123456789012:role/INITIAL_ROLE_NAME",
 },
 {
 "role_arn": "arn:aws:iam::123456789012:role/FINAL_ROLE_NAME",
 },
])

package main

import (
 "github.com/pulumi/pulumi-aws/sdk/v7/go/aws"
 "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
 pulumi.Run(func(ctx *pulumi.Context) error {
 _, err := aws.NewProvider(ctx, "provider", &aws.ProviderArgs{
 AssumeRoles: aws.ProviderAssumeRoleArray{
 &aws.ProviderAssumeRoleArgs{
 RoleArn: pulumi.String("arn:aws:iam::123456789012:role/INITIAL_ROLE_NAME"),
 },
 &aws.ProviderAssumeRoleArgs{
 RoleArn: pulumi.String("arn:aws:iam::123456789012:role/FINAL_ROLE_NAME"),
 },
 },
 })
 if err != nil {
 return err
 }
 return nil
 })
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() =>
{
 var provider = new Aws.Provider("provider", new()
 {
 AssumeRoles = new[]
 {
 new Aws.Inputs.ProviderAssumeRoleArgs
 {
 RoleArn = "arn:aws:iam::123456789012:role/INITIAL_ROLE_NAME",
 },
 new Aws.Inputs.ProviderAssumeRoleArgs
 {
 RoleArn = "arn:aws:iam::123456789012:role/FINAL_ROLE_NAME",
 },
 },
 });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.Provider;
import com.pulumi.aws.ProviderArgs;
import com.pulumi.aws.inputs.ProviderAssumeRoleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
 public static void main(String[] args) {
 Pulumi.run(App::stack);
 }

 public static void stack(Context ctx) {
 var provider = new Provider("provider", ProviderArgs.builder()
 .assumeRoles(
 ProviderAssumeRoleArgs.builder()
 .roleArn("arn:aws:iam::123456789012:role/INITIAL_ROLE")
 .build(),
 ProviderAssumeRoleArgs.builder()
 .roleArn("arn:aws:iam::123456789012:role/FINAL_ROLE")
 .build())
 .build());

 }
}

name: example
runtime: yaml
resources:
 provider:
 type: pulumi:providers:aws
 properties:
 assumeRoles:
 - roleArn: arn:aws:iam::123456789012:role/INITIAL_ROLE_NAME
 - roleArn: arn:aws:iam::123456789012:role/FINAL_ROLE_NAME

With this configuration the provider will use the INITIAL_ROLE to assume the FINAL_ROLE which will then be used as the credentials for the provider.

Simplified S3 Bucket Resource Model

In v6 of the Pulumi AWS Provider the S3 Bucket and BucketV2 resources represented different resource implementations. BucketV2 represented the latest version of the upstream Terraform resource, while Bucket was a separate resource maintained by Pulumi to keep backwards compatibility with the v4 release of the upstream Terraform Provider.

In v7 we are taking the first step in unifying these two resources by moving the S3 Bucket resource to the latest upstream implementation. As a result, in v7 both Bucket and BucketV2 will represent the latest version of the upstream Terraform S3 Bucket resource. As part of this work BucketV2 has been deprecated and will be removed in v8 of the Pulumi AWS Provider.

We have also introduced new S3 Bucket configuration resources that are alternatives to their V2 counterparts. The V2 versions will be removed in v8 of the Pulumi AWS Provider.

BucketAccelerateConfigurationV2 => BucketAccelerateConfiguration
BucketRequestPaymentConfigurationV2 => BucketRequestPaymentConfiguration
BucketAclV2 => BucketAcl
BucketCorsConfigurationV2 => BucketCorsConfiguration
BucketLifecycleConfigurationV2 => BucketLifecycleConfiguration
BucketLoggingV2 => BucketLogging
BucketObjectLockConfigurationV2 => BucketObjectLockConfiguration
BucketServerSideEncryptionConfigurationV2 => BucketServerSideEncryptionConfiguration
BucketVersioningV2 => BucketVersioning
BucketWebsiteConfigurationV2 => BucketWebsiteConfiguration

See the Migration Guide for more details on this change.

Upstream Improvements and Breaking Changes

Pulumi AWS 7.0 includes all improvements and bug fixes from the upstream (terraform-provider-aws) versions from 6.0.0 to 6.3.0. It also contains a number of upstream breaking changes. Please refer to the changelog to navigate the entire list.

Migration Guide

You can see a full list of changes and learn more about migrating your existing programs in our Migration Guide.

Getting Started with Pulumi AWS 7.0

Pulumi makes it easy to define, deploy, and manage modern AWS infrastructure with code:

Use your favorite languages: TypeScript, Python, Go, C#, Java, YAML
Explore the Pulumi AWS Provider repro
Check out the API reference docs

Announcing the 1.0 release of AWS CDK on Pulumi

Matt Jeffryes — Mon, 02 Dec 2024 08:00:00 -0700

At Pulumi, we’re committed to delivering the widest range of cloud infrastructure building blocks for use in your cloud engineering projects. In 2022, we introduced preview support for integrating AWS CDK constructs into Pulumi programs and today we’re happy to announce the 1.0 release of our pulumi-cdk library for typescript. This first stable version completes support for common CDK features enabling you to deploy almost any CDK construct with Pulumi.

The pulumi-cdk library provides access to the many high-level libraries (‘constructs’) built by service teams at AWS and by the AWS CDK community. However, there were some limitations in the preview version of the library that prevented using some constructs and complicating migration of existing CDK stacks. Uncertainty about which constructs were supported has limited adoption of this rich ecosystem by Pulumi users.

With the new 1.0 release, pulumi-cdk has greatly expanded compatibility with all CDK features. Users can now confidently use Pulumi to deploy constructs they have written themselves or any of the 1600+ constructs in AWS’s construct hub. We’re excited to bring Pulumi users access to all the high level interfaces curated by AWS and the CDK community.

Additionally, existing AWS CDK users now have an easier path to transition from CloudFormation to Pulumi, unlocking faster deployments, integration with Pulumi’s vast provider ecosystem and all of the features of Pulumi’s Cloud Engineering Platform (like Policy as Code, Audit Logs, Drift detection, Secrets, and much more).

Deploying CDK Constructs with Pulumi

To deploy existing AWS CDK Constructs using Pulumi:

Create a class that derives from pulumicdk.Stack (which itself is derived from awscdk.Stack).
In the constructor, use any AWS CDK constructs from existing libraries such as aws-cdk-lib
Create a pulumicdk.App instance that constructs an instance of your stack.

For example, the following program deploys an AWS Apprunner CDK Construct using Pulumi:

import * as pulumi from '@pulumi/pulumi';
import * as pulumicdk from '@pulumi/cdk';
import { Service, Source } from '@aws-cdk/aws-apprunner-alpha';

class AppRunnerStack extends pulumicdk.Stack {
 url: pulumi.Output<string>;

 constructor(id: string, options?: pulumicdk.StackOptions) {
 super(id, options);

 const service = new Service(this, 'service', {
 source: Source.fromEcrPublic({
 imageConfiguration: { port: 8000 },
 imageIdentifier: 'public.ecr.aws/aws-containers/hello-app-runner:latest',
 }),
 });

 this.url = this.asOutput(service.serviceUrl);
 }
}

const app = new pulumicdk.App('app', (scope: pulumicdk.App): pulumicdk.AppOutputs => {
 const stack = new AppRunnerStack('teststack');
 return {
 url: stack.url,
 };
});
export const url = app.outputs['url'];

Deploy with a pulumi up:

> pulumi up

Updating (dev)

View Live: https://app.pulumi.com/lukehoban/pulumi-cdk-apprunner/dev/updates/1

 Type Name Status
 + pulumi:pulumi:Stack pulumi-cdk-apprunner-dev created
 + └─ cdk:index:StackComponent teststack created
 + └─ cdk:construct:Service teststack/adapter/service created
 + └─ aws-native:apprunner:Service service6D174F83 created

Outputs:
 url: "2ez3iazupm.us-west-2.awsapprunner.com"

Resources:
 + 4 created

And curl the endpoint:

> curl https://$(pulumi stack output url)

 ______ __ __ __ _ __
 / ____/___ ____ ____ __________ _/ /___ __/ /___ _/ /_(_)___ ____ _____/ /
 / / / __ \/ __ \/ __ `/ ___/ __ `/ __/ / / / / __ `/ __/ / __ \/ __ \/ ___/ /
/ /___/ /_/ / / / / /_/ / / / /_/ / /_/ /_/ / / /_/ / /_/ / /_/ / / / (__ )_/
\____/\____/_/ /_/\__, /_/ \__,_/\__/\__,_/_/\__,_/\__/_/\____/_/ /_/____(_)
 /____/

 Congratulations, your service has successfully deployed on AWS App Runner.

Open it in your browser at https://2ez3iazupm.us-west-2.awsapprunner.com/

Try the workshop at https://apprunnerworkshop.com
Read the docs at https://docs.aws.amazon.com/apprunner

Pulumi takes CDK apps to the next level

Combine CDK constructs with any of the features of Pulumi programs to deploy faster, easier and to any cloud. Use Pulumi functions and stack references to connect to pre-existing infrastructure and mix in resources from any provider to bring all of your infrastructure under management.

For example, we can use CDK’s ecs_patterns to quickly create a loadbalanced Fargate service, but route traffic to it with a record in an existing CloudFlare DNS zone.

import * as path from 'path';
import * as acm from 'aws-cdk-lib/aws-certificatemanager';
import * as aws from '@pulumi/aws';
import * as pulumi from '@pulumi/pulumi';
import * as pulumicdk from '@pulumi/cdk';
import * as cloudflare from '@pulumi/cloudflare';
import * as ecs from 'aws-cdk-lib/aws-ecs';
import * as ecsPatterns from 'aws-cdk-lib/aws-ecs-patterns';

let config = new pulumi.Config();
let accountId = config.requireSecret("cloudflare_account_id");
let zoneName = config.require("cloudflare_zone_name");
let certificateId = config.require("certificate_id");
let certificateKey = config.requireSecret("certificate_key");

class CloudFlareStack extends pulumicdk.Stack {
 constructor(app: pulumicdk.App, id: string) {
 super(app, id);

 // First Load the zone and certificate from CloudFlare
 ///////////////////////////////////////////////////////

 // Read the CloudFlare zone for the domain
 const zone = cloudflare.getZoneOutput({
 accountId,
 name: zoneName,
 });

 // read the certificate from CloudFlare
 const caCertificate = cloudflare.getOriginCaCertificateOutput({
 id: certificateId,
 });

 // Import the certificate in ACM
 const cert = new aws.acm.Certificate('import', {
 privateKey: certificateKey,
 certificateBody: caCertificate.certificate,
 });

 // Create a L2 reference from the cert arn
 const acmCert = acm.Certificate.fromCertificateArn(this, 'cert', pulumicdk.asString(cert.arn));

 // Next, use ECS Patterns to create a loadbalanced fargate service with the correct certificate
 ///////////////////////////////////////////////////////////////////////////////////////////////

 const loadBalancedFargateService = new ecsPatterns.ApplicationLoadBalancedFargateService(this, 'Service', {
 certificate: acmCert,
 redirectHTTP: true,
 taskImageOptions: {
 image: ecs.ContainerImage.fromRegistry("amazon/amazon-ecs-sample"),
 },
 });

 const alb = loadBalancedFargateService.loadBalancer;

 // Finally, Create a record in CloudFlare that directs to the service's loadbalancer
 ////////////////////////////////////////////////////////////////////////////////////

 new cloudflare.Record('alb', {
 name: 'cdk-alb',
 type: 'CNAME',
 zoneId: zone.zoneId,
 content: this.asOutput(alb.loadBalancerDnsName),
 proxied: true,
 });
 }
}

class MyApp extends pulumicdk.App {
 constructor() {
 super('app', (scope: pulumicdk.App) => {
 new CloudFlareStack(scope, 'cloudflare');
 });
 }
}

new MyApp();

Pulumi let’s you read and create any resource type across thousands of different cloud service providers and integrate them with your CDK stacks. Building CDK apps on Pulumi brings a host of other benefits too, including:

Customize resource options (eg. to protect a database against accidental deletion or deploy to multiple regions in the same program)
Detect and manage drift with Pulumi deployments
Track and store user actions and change history with Audit Logs
And a host of other benefits from Pulumi Cloud

Expanded Features in pulumi-cdk 1.0

The 1.0 version of pulumi-cdk adds support for key CDK features such as: assets, custom resources, nested stacks, and aspects, so most existing CDK constructs will work with Pulumi without any modification. We’ve also eliminated the need to call cdk bootstrap before running pulumi up by integrating a custom Pulumi Synthesizer.

Using CDK Aspects

Pulumi CDK now supports CDK aspects. For example, you can add the cdk-nag aspect to your stack to enforce best practices:

import * as pulumicdk from '@pulumi/cdk';
import * as s3 from 'aws-cdk-lib/aws-s3';
import { AwsSolutionsChecks } from 'cdk-nag';

const app = new pulumicdk.App('app', (scope: pulumicdk.App): pulumicdk.AppOutputs => {
 const stack = new pulumicdk.Stack('example-stack');
 Aspects.of(stack).add(new AwsSolutionsChecks({ verbose: true }));

 new s3.Bucket(this, 'bucket');
});

Example Output

[Error at /test-stack/bucket/Resource] AwsSolutions-S1: The S3 Bucket has server access logs disabled. The bucket should have server access logging enabled to provide detailed records for the requests that are made to the bucket.
[Error at /test-stack/bucket/Resource] AwsSolutions-S10: The S3 Bucket or bucket policy does not require requests to use SSL. You can use HTTPS (TLS) to help prevent potential attackers from eavesdropping on or manipulating network traffic using person-in-the-middle or similar attacks. You should allow only encrypted connections over HTTPS (TLS) using the aws:SecureTransport condition on Amazon S3 bucket policies.

CDK assets

CDK’s assets make it easy to bundle code and other files your application needs into an S3 bucket or a Docker container, eliminating extra steps from your build pipeline. For example you can use Docker container asset to deploy a Fargate service from local directory. CDK will build the container image and push to ECR on pulumi up.

import * as pulumicdk from '@pulumi/cdk';
import * as aws from '@pulumi/aws';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as ecs from 'aws-cdk-lib/aws-ecs';
import * as ecs_patterns from 'aws-cdk-lib/aws-ecs-patterns';

const app = new pulumicdk.App('app', (scope: pulumicdk.App) => {
 const stack = new pulumicdk.Stack('example-stack');

 const vpc = new ec2.Vpc(stack, 'MyVpc');
 const cluster = new ecs.Cluster(stack, 'fargate-service-autoscaling', { vpc });

 // Create Fargate Service
 const fargateService = new ecs_patterns.NetworkLoadBalancedFargateService(this, 'sample-app', {
 cluster,
 taskImageOptions: {
 image: ecs.ContainerImage.fromAsset(path.join(__dirname, './'), {
 // assetName is required and is used in the name of the ecr repository that is created
 assetName: 'cdk-fargate-example',
 }),
 },
 });
});

Future direction

Currently AWS CDK on Pulumi is supported only for TypeScript users, but we’re eager to bring the benefits of the CDK ecosystem to all Pulumi languages in the future. You can comment and upvote on this tracking issue, to let us know this is important to you.

We’re also exploring options for importing state from CDK applications that are already deployed with CloudFormation to enable seamless migration for existing CDK users. Please let us know on this tracking issue if you would be interested in testing this with us.

Summary

The 1.0 release of AWS CDK support for Pulumi marks a significant expansion of opportunities to interoperate between the AWS CDK and Pulumi ecosystems. Existing AWS CDK users can now more easily adopt the full power, speed and flexibility of the Pulumi Cloud Platform and its diverse ecosystem. And existing Pulumi users can benefit from the many expert curated constructs and libraries in the CDK community. We’re excited to see what you’ll build with these two great cloud technologies together.

The AWS CDK on Pulumi project is open source at https://github.com/pulumi/pulumi-cdk and on NPM at https://www.npmjs.com/package/@pulumi/cdk. Get started today!