Pulumi Blog: Release notes

Pulumi Release Notes: Pulumi MCP Server, Pulumi ESC Rotated Secrets, and Policy Enhancements

Arun Loganathan — Fri, 25 Apr 2025 00:00:00 +0000

Note: This post discusses Pulumi Copilot, which Pulumi Neo has replaced. Learn about Neo →

We’ve been busy over the past two months, shipping significant enhancements across the Pulumi ecosystem. From major improvements to our core IaC platform with Azure Native V3 and cross-language Components to powerful new capabilities in Pulumi ESC and Insights, these updates deliver on our commitment to making cloud management more powerful, accessible, and secure. We’re particularly excited about our AI integration through the MCP Server, enabling developers to work with infrastructure in a more intuitive, contextual way. Let’s dive into the details of what’s new.

Pulumi IaC
Pulumi ESC
- Rotated Secrets
- Pulumi ESC GitHub Action
Pulumi Insights
- Enforce Policy as Code on Discovered Resources
Wrap up

Pulumi IaC

Azure Native V3

We’re excited to announce the release of Pulumi Azure Native V3, delivering a remarkable 75% reduction in SDK size while maintaining complete coverage of the Azure ecosystem. The new SDK provides faster downloads, more manageable package sizes, and more reliable performance while maintaining access to all Azure resource properties. With a modern API surface, consistent input/output schemas, and simplified version management, it’s now easier than ever to build and deploy Azure resources with Pulumi. Read the blog post or check out the Azure Native Provider documentation.

Pulumi Model Context Protocol (MCP) Server

The new Pulumi Model Context Protocol (MCP) Server integration brings AI-assisted infrastructure development directly into your coding workflow. By connecting AI-powered code assistants with Pulumi’s CLI and registry, MCP enables real-time resource information and infrastructure management without leaving your editor. This integration drastically reduces context switching, accelerates resource discovery, and enables faster coding with intelligent assistance. Use it with tools like GitHub Copilot, Anthropic’s Claude Code, Cursor, and others to streamline your infrastructure development experience. Learn more about AI-assisted IaC.

Next-Generation Pulumi Components

Introducing the next generation of Pulumi Components with enhanced cross-language capabilities, enabling you to create reusable infrastructure abstractions once and deploy them using any supported Pulumi language. These improved components allow platform teams to codify organizational standards into shareable libraries while giving developers simpler, more approachable interfaces that enforce best practices automatically. With built-in input validation, detailed documentation, improved error messages, and cross-language support, your components can now reach a wider audience of developers regardless of their preferred programming language. Read the blog post or explore the Components documentation.

Registry Wave 2: 27 New Providers

We’ve expanded the Pulumi Registry with 27 new native providers, bringing the total to over 150 providers and 7,500 resource types. This wave adds support for popular services like Jira, Gitlab, Railway, Neon, PlanetScale, and many more, giving you more options for managing your entire cloud infrastructure with Pulumi. Each provider is published as a standalone package, making it easier to adopt new providers without updating your entire Pulumi installation. Start using these providers today to expand your infrastructure management capabilities. Read the blog post or browse the Pulumi Registry.

Enhanced Terraform Conversion

With Pulumi CLI version 3.153.0 and above, we’ve supercharged our Terraform conversion capabilities. Now you can automatically convert ANY Terraform project to Pulumi and import its resources - even if it uses providers that don’t have native Pulumi equivalents. This breakthrough eliminates a significant migration barrier, allowing teams to convert their entire Terraform codebase without provider limitations. The enhanced converter handles mixed provider scenarios effortlessly, maintaining access to specialized Terraform providers you already leverage while modernizing your infrastructure deployment. This builds on our existing capability to use any Terraform/OpenTofu provider in your Pulumi projects, making it easier than ever to migrate your infrastructure as code to Pulumi. Read the blog post to see examples and learn how to try it for yourself.

Improved Refresh and Destroy Experience

As of Pulumi CLI version 3.160.0, we’ve introduced a significant enhancement to the pulumi refresh and pulumi destroy commands. These commands now support the --run-program flag, which enables them to run your program code before refreshing or destroying your stack. This is especially valuable for teams working with short-lived credentials, dynamic resources, or any workflow where your code needs to run to establish the right context. Previously, while these commands took into account updated configuration from your Pulumi.<stack>.yaml files, they didn’t consider changes in your actual code, which could break workflows that depend on code to update credentials or determine resources to manage. This improvement ensures your infrastructure operations have the full context they need to succeed, particularly important when using OIDC-based authentication, dynamically fetching credentials from a secrets manager, or working with dynamic providers. We plan to make this the default behavior eventually, but are introducing it as an opt-in flag first to ensure a smooth transition. Read more in our RFC on making program execution the default behavior.

GitLab Integration Improvements

We’ve significantly enhanced our GitLab integration with support for multiple pipeline jobs and simplified authentication. The improved integration works with both GitLab CI/CD server and SaaS offerings, supporting parallel execution of multiple Pulumi steps within a single GitLab pipeline. Authentication has been streamlined with a new method that eliminates the need for personal access tokens, instead leveraging GitLab’s CI/CD variables for secure, seamless authentication. These enhancements make it easier than ever to implement GitOps workflows with Pulumi and GitLab. Read the blog post or check out the documentation.

Faster Secrets Management

We’ve optimized secrets performance in Pulumi, resulting in significantly faster operations when working with large numbers of secrets. Through focused engineering efforts, we’ve achieved up to 75% reduction in secrets processing time for large stacks, with the most dramatic improvements seen in stacks with many outputs. This enhancement particularly benefits workflows involving many secrets, resource outputs, or stack references. The improvements are available starting with Pulumi 3.123.0 and require no changes to your existing code. Read the blog post to learn more about these performance improvements.

Pulumi Kubernetes Operator 2.0

The Pulumi Kubernetes Operator 2.0 is now generally available, bringing advanced automation capabilities for managing Pulumi stacks within Kubernetes clusters. The new version includes a completely rewritten, faster codebase with enhanced reconciliation logic, better error handling, and improved CRD management. Version 2.0 also adds critical features like automatic retry for temporary failures, fine-grained refresh control, idempotent updates, and advanced stack management capabilities. These improvements make the operator more reliable and powerful for managing infrastructure directly from your Kubernetes clusters. Read the blog post or check out the operator documentation.

Java SDK 1.0

The Pulumi Java SDK is now generally available with its 1.0 release, providing first-class support for Java in Pulumi’s multi-language ecosystem. The GA release includes feature parity with other Pulumi languages, improved documentation, enhanced type safety, and support for the complete Pulumi programming model. We’ve also expanded the Java SDK to support all current LTS versions and ensure smooth interoperability with the broader Java ecosystem. This milestone makes Pulumi an excellent choice for Java teams looking to manage their infrastructure using their preferred language. Read the blog post or check out the Java getting started guide.

Pulumi Copilot in VSCode

Pulumi Copilot is now available in Visual Studio Code, bringing AI-powered assistance directly to your infrastructure development environment. The VSCode extension helps you write, understand, and debug Pulumi code with inline explanations, transformation suggestions, and code generation capabilities. Copilot can also assist with converting between Pulumi languages and translating from other IaC tools like Terraform and CloudFormation. This integration makes it easier to learn Pulumi, accelerate your infrastructure development, and solve complex configuration challenges. Read the blog post or install the extension today.

Autonaming Configuration

We’ve enhanced Pulumi’s autonaming feature with new configuration options that give you more control over resource naming. You can now globally disable autonaming or configure it on a per-component basis, allowing you to precisely control when Pulumi generates names for your resources. This is particularly valuable for organizations that want to ensure consistent, predictable resource naming across their infrastructure. The new configuration is available in Pulumi CLI version 3.91.1 and later, and requires no code changes to implement. Read the blog post or check out the documentation for implementation details.

Pulumi ESC

Rotated Secrets

Address the persistent challenge of static, long-lived credentials with the new Rotated Secrets capability in Pulumi ESC. Static secrets pose significant security risks due to potential exposure and infrequent, error-prone manual rotation. While dynamic secrets are ideal, Rotated Secrets provide a powerful alternative for applications requiring long-lived credentials, systems needing persistent connections, or where dynamic credentials aren’t feasible. Automatically rotate credentials like AWS IAM user access keys (with more integrations coming soon) on flexible schedules or on-demand, eliminating manual effort and reducing the window of vulnerability. Rotated Secrets seamlessly integrate into ESC environments, utilize a “two-secret” strategy for smooth transitions, offer robust auditing, and allow for separation of administrative and consumer roles. Configure rotations directly within your ESC definitions and set up webhooks to automate downstream updates. Read the blog post.

Pulumi ESC GitHub Action

Securely inject secrets and configuration directly into your GitHub Actions workflows with the new Pulumi ESC GitHub Action. This action lets you dynamically inject values from your Pulumi ESC environments as needed during CI/CD runs, eliminating the need to store static, long-lived credentials within GitHub and reducing secret sprawl. Leverage Pulumi ESC’s automatic secret rotation capabilities and run ESC commands directly within your workflows for streamlined environment management. Combine this action with pulumi/auth-actions for seamless, tokenless authentication to Pulumi Cloud using OIDC, further enhancing security. Read the blog post.

Pulumi Insights

Enforce Policy as Code on Discovered Resources

Extend the governance reach of Pulumi Policy as Code beyond IaC-managed resources to encompass your entire cloud environment with a powerful new capability in Pulumi Insights. You can now automatically apply your existing policies to resources discovered by Pulumi Insights, regardless of how they were created. Simply link your Insights Accounts (representing cloud provider integrations) to your Policy Groups alongside your stacks. Pulumi will then evaluate all resources within those accounts against your defined policies, surfacing violations centrally. This allows you to write policies once and apply them universally across both IaC and discovered resources, dramatically simplifying how you maintain consistent security and compliance standards at scale across AWS, Azure, OCI, and Kubernetes. Read the blog post.

Wrap up

These new features and enhancements represent our ongoing commitment to improving the cloud management experience for developers and platform teams. Whether you’re managing cloud resources with our streamlined Azure Native V3 provider, creating reusable abstractions with cross-language Components, leveraging AI assistance with the MCP Server, or strengthening your security posture with ESC Rotated Secrets and policy enforcement, we’re focused on making your infrastructure management more efficient, secure, and enjoyable. As we continue to innovate, your feedback helps shape our roadmap and prioritize improvements that matter most to you.

Explore all the new capabilities and share your feedback – we’re always listening! Open an issue in the Pulumi Cloud requests repository or the pulumi/pulumi repository for anything CLI-related. Stay tuned for more exciting updates!

Pulumi Release Notes: Pulumi Copilot, Pulumi ESC Versioning, Pulumi ESC SDK, Docker Provider, and more!

Arun Loganathan — Mon, 24 Jun 2024 11:06:04 -0800

Note: This post discusses Pulumi Copilot, which Pulumi Neo has replaced. Learn about Neo →

What an incredible two months at Pulumi! From the revolutionary AI-powered Pulumi Copilot to robust infrastructure lifecycle management, enhanced Pulumi ESC with versioning and SDKs, and a brand-new Docker Build provider, this release cycle is packed with high-impact features delivered at an unprecedented pace. Ready to see all the details? We’ve got a lot to cover, so let’s jump right into the highlights of this action-packed release.

AI
- Pulumi Copilot: The Future of Cloud Infrastructure
Pulumi Cloud
Core
- Continue On Error in the Pulumi CLI
- Run Pulumi with Any TypeScript Version
Providers and Packages
Wrap up

AI

Pulumi Copilot: The Future of Cloud Infrastructure

Pulumi Copilot is a game-changing conversational AI assistant for Pulumi Cloud, leveraging large language models (LLMs) to simplify and enhance your cloud management experience. Get instant answers about your cloud by querying the state of any resource managed by Pulumi, across all your clouds and accounts. Explore historical data on stacks, projects, deployments, and more, gaining deep insights into your infrastructure. Write and deploy IaC with ease as Pulumi Copilot brings the power of Pulumi AI directly to your fingertips. Gain insights from cloud provider metadata as Pulumi Copilot integrates with AWS, Azure, Kubernetes, and more; to provide real-time insights into usage, costs, and your infrastructure.

Pulumi Copilot enforces the same strict identity and RBAC rules as Pulumi Cloud, ensuring data security and privacy for your organization. Try Pulumi Copilot for free! It’s in public beta and available to all Pulumi Cloud organizations. Enable it in your organization settings: Settings > Access Management > Pulumi Copilot. Read the blog post | Explore the docs

Pulumi Cloud

New Infrastructure Lifecycle Management Features

We introduced a wave of new Infrastructure Lifecycle Management capabilities in Pulumi Cloud, building upon the power of Pulumi Deployments, and directly addressing the needs of our customers for robust Day 2 operations and beyond. These new features—Drift Detection and Remediation, Time-to-Live Stacks, and Scheduled Deployments—enhance security, optimize costs, and automate key infrastructure management tasks. We also announced a new Pulumi Deployments Free Tier for all users, providing 3,000 free deployment minutes every month to easily test and use these new features.

Drift Detection and Remediation

Uncontrolled configuration drift can wreak havoc on your cloud environments, leading to security vulnerabilities, compliance violations, costly outages, and wasted resources. Pulumi Cloud’s new Drift Detection and Remediation feature empowers platform teams to maintain complete control over their cloud infrastructure. This feature periodically compares the actual state of cloud resources with the desired state defined in Pulumi programs, identifying any discrepancies. Automatically detect any deviation from your desired state, whether caused by manual edits or external scripts, and receive timely alerts through integrations like Slack and Microsoft Teams. Pulumi Deployments users can enable automatic remediation to correct drift and ensure their infrastructure remains consistent with their code. You can manage Drift Detection and Remediation through the Pulumi Cloud console, the Pulumi CLI, the REST API, or the Pulumi Service Provider. Check out our detailed post.

Time-to-Live Stacks

Creating temporary environments is crucial for running experiments, testing new features, and ensuring that everything works smoothly before going live. However, these environments are often forgotten and left running, consuming resources and adding unnecessary costs. Manually managing these temporary stacks is time-consuming, operationally burdensome, and prone to errors. Pulumi’s Time-to-Live Stacks feature solves this by allowing teams to set a predefined lifespan on any stack. After the specified time, the stack is automatically destroyed, preventing cost overruns and reducing security risks from idle resources. This automated cleanup process ensures cost control, enhances developer enablement, and improves security. Time-to-Live Stacks can be easily managed through the Pulumi Cloud console, REST API, or the Pulumi Service Provider. See our launch blog post.

Scheduled Deployments

We also rolled out Scheduled Deployments, extending the automation capabilities of Drift Detection and Remediation and Time-to-Live Stacks. Scheduled Deployments enable precise automation of cloud operations, allowing users to schedule any Pulumi operation—such as pulumi up, pulumi refresh, pulumi destroy, or pulumi preview—for any stack with Pulumi Deployments. This provides greater flexibility for managing your cloud operations, whether it’s scheduling off-peak deployments, optimizing resource costs, or automating routine infrastructure updates. You can easily set up and manage Scheduled Deployments through the Pulumi Cloud console, REST API, or directly within your code using the Pulumi Service Provider.

Pulumi ESC: New Features to Supercharge Your Secrets and Config Management

We unleashed a wave of powerful new features for Pulumi Environments, Secrets, and Configuration (ESC), taking secrets and configuration management to the next level. Read the blog post to learn more about these enhancements that bring best-in-class software engineering practices to your fingertips, enabling you to manage secrets and configuration complexity at scale across all your cloud applications and infrastructure.

Pulumi ESC Versioning

Pulumi ESC Versioning gives you unprecedented control over your secrets and configuration. Every change is captured in an immutable revision history, allowing you to audit modifications, compare versions, and safely roll back. Assign meaningful tags to revisions (e.g., production, v1.2.1, stable) for easy management, just like Docker tags. When importing an environment, pin it to a specific version using tags or a revision number to prevent automatic propagation of changes from the source. This enables phased rollouts and thorough testing before deploying new configurations. You can also reference specific versions with the pulumi env run command, targeting different environments for different tasks. This granular control minimizes risks, enhances collaboration, and streamlines workflows. Access versioning features through the Pulumi Cloud Console, the Pulumi CLI, or the ESC REST API.

Pulumi ESC SDK

Pulumi ESC SDKs are now available for Python, TypeScript/JavaScript, and Go, making it easier than ever to harness the power of ESC directly within your applications using your favorite programming languages. The SDKs provide a simple and intuitive programmatic interface to manage your ESC environments, securely access secrets and configurations at runtime, and eliminate the need for hardcoded credentials. This streamlines your development process, enhances security, and promotes best practices for handling sensitive data. Check out our docs.

Pulumi Service Provider for ESC

You can now manage your Pulumi ESC Environments using the powerful Pulumi Service Provider. This means you can define environments, add version tags, and even control access using familiar Infrastructure as Code (IaC) practices, ensuring consistency and repeatability across your deployments. The Pulumi Service Provider empowers you to manage your entire infrastructure and application landscape through a unified approach.

Automation API Support for ESC

We’ve expanded the powerful Pulumi Automation API to include new methods for interacting with Pulumi ESC Environments programmatically. These new methods– addEnvironments(…), listEnvironments(), and removeEnvironment(environment) – enable you to seamlessly integrate environment management into your automated workflows and build sophisticated custom tooling. The Automation API provides the building blocks for advanced automation scenarios such as dynamically configuring applications based on environments, managing environment dependencies, and integrating ESC into CI/CD pipelines. Pulumi ESC Automation API capabilities are available for TypeScript/JavaScript, Go, and Python. Check out our blog post for examples.

Pulumi Cloud OIDC Trust Relationship

Pulumi Cloud now supports OpenID Connect (OIDC) Trust Relationships, allowing you to securely integrate Pulumi into any ecosystem that supports OIDC. This feature addresses the “secret zero” challenge by facilitating the exchange of secure platform tokens for short-lived Pulumi tokens, enhancing security and simplifying token management. You can configure trusted OIDC identity providers, such as GitHub, GitLab, or Google Cloud, and set granular policies to control token exchange based on issuer, subject, or additional claims. This integration extends to Kubernetes, enabling pods to authenticate to Pulumi Cloud using OIDC tokens issued by Google Kubernetes Engine GKE. To further streamline the integration with GitHub Actions, we introduced a new GitHub Action that automates the retrieval of Pulumi access tokens, making it even easier to leverage OIDC for secure authentication within your workflows. Check out our OIDC docs.

New Project Wizard Enhancements

We enhanced the New Project Wizard in Pulumi Cloud to streamline developer workflows and give platform teams more control over deployments. You can now configure the Developer Portal Gallery to exclusively display organization-specific templates, ensuring developers only use approved configurations. This simplifies template discovery and selection, reinforcing governance and compliance across development projects. We also streamlined project creation by introducing default repository locations and auto-generated project names, eliminating manual steps and potential naming conflicts. Read the New Project Wizard updates blog post for more details.

Core

Continue On Error in the Pulumi CLI

Pulumi now offers more control over error handling during deployments with the new --continue-on-error flag for pulumi up and pulumi destroy. When managing complex infrastructure with Pulumi, deployments can involve a large number of concurrent resource operations. Previously, if an error occurred during a deployment, Pulumi would stop all new operations to prevent potential cascading failures. While this approach is often desirable, there are cases where you might want to continue updating or destroying resources that are independent of the failed resource. The –continue-on-error flag enables this behavior, allowing deployments to proceed even in the presence of errors, while still respecting resource dependencies. This can be especially useful when destroying resources, as it allows you to clean up as much infrastructure as possible. Read the blog post for more details.

Run Pulumi with Any TypeScript Version

Previously, Pulumi’s seamless TypeScript experience was limited to version 3.8, requiring manual build steps for newer versions. But now, with the release of the Pulumi Node.js SDK 3.113.0, you can use any TypeScript version 3.8 or later, including the latest TypeScript 5.4, by simply adding it as a dependency in your project’s package.json file. Pulumi will automatically use the specified version for compilation, unlocking access to the newest TypeScript features and improved type checking. Read the blog post for a detailed example and instructions on upgrading your projects.

Providers and Packages

Next-Generation Docker Image Builds with Pulumi

Pulumi introduces the new Docker Build provider, a dedicated package designed to modernize and streamline Docker image builds directly from your Pulumi programs. The new provider exposes Docker’s next-generation buildx interface, unlocking advanced features such as multi-platform image support, advanced caching mechanisms, built-in support for build secrets, and seamless integration with Docker Build Cloud. This unlocks powerful scenarios, including building multi-architecture images and optimizing build performance with various cache backends. Read the blog post for detailed examples and migration guides.

Using Pulumi with Azure Deployment Environments

Pulumi now supports authoring Azure Deployment Environments (ADE) environment definitions, empowering developers to self-serve the application infrastructure they need while maintaining centralized management and governance. This integration allows you to leverage Pulumi’s familiar programming model and the full power of its Infrastructure as Code (IaC) platform to define and manage Azure resources within ADE environments. You can define ADE environments using a YAML configuration file that references a Pulumi program written in any of Pulumi’s supported languages, including .NET, TypeScript, Python, Go, and YAML. Leveraging a dedicated Pulumi Docker image, ADE seamlessly executes the selected Pulumi program, provisioning the defined Azure resources. This streamlines the creation of new environments, enhances developer productivity, and ensures consistency and compliance with organizational standards. Read the blog post for a detailed walkthrough and examples.

Helm Chart v4 Resource

Pulumi introduces a new and improved Helm Chart v4 resource (kubernetes.helm.sh/v4.Chart) in the Pulumi Kubernetes provider, offering enhanced functionality, and a more streamlined experience for deploying Helm charts. A key improvement in v4 is expanded language support. Previous versions of the Chart resource were implemented separately for each Pulumi SDK, leading to inconsistencies and limited language compatibility. The new Chart v4 resource ensures consistent behavior and functionality across all Pulumi SDKs, including Python, TypeScript/JavaScript, Go, .NET, Java, and YAML. Other notable enhancements include full OCI registry support, improved handling of chart values, better connectivity for cluster interactions, and improved resource ordering. Read the blog post for a detailed overview, examples, and migration guidance.

New Provider Resources

We have added 121 functions and 159 resources across our most popular providers, along with many more throughout our ecosystem. We also welcome our new community provider resource: Genesis cloud.

Wrap up

Phew, that’s a lot! We’ve packed this release with features to empower you to build and manage modern cloud infrastructure and applications with greater efficiency, control, and confidence. Explore all the new capabilities and share your feedback – we’re always listening! Open an issue in the Pulumi Cloud requests repository or the pulumi/pulumi repository for anything CLI-related. Stay tuned for more exciting updates!

Pulumi Release Notes: Pulumi Dev Releases, Pulumi ESC Table Editor, 1Password Support , and more!

Arun Loganathan — Mon, 15 Apr 2024 11:06:04 -0800

As always, we have been actively rolling out new features in response to the invaluable feedback from our ever-growing community. We’ve shipped several security and usability features to Pulumi ESC in response to feedback from our growing user base. Moreover, we’ve also added new enhancements to our core Platform CLI and Providers. In addition to the release notes, stay up-to-date with all things Pulumi by following the new features blogs and the pulumi/pulumi repo changelog. With so much to explore, let’s dive into the major updates across Pulumi from the past two months!

Pulumi Cloud
Core
Providers and Packages
AI
- Pulumi AI Evolution
Wrap up

Pulumi Cloud

Pulumi ESC 1Password Support

In collaboration with 1Password, we’ve launched the 1Password provider for Pulumi ESC in public preview. This feature, highly requested by our community, allows you to pull secrets and configurations stored in 1Password directly into ESC, and use them as environment variables or within Pulumi Config. This integration eliminates the need for manual secret copy and paste, enhancing both security and efficiency. For more details, refer to our blog post.

Pulumi ESC Table view

We’ve rolled out the Pulumi ESC Table view, offering a novel, user-friendly interface for managing secrets and configurations. This addition complements the existing YAML-based editor, providing intuitive and familiar experiences for your workflows with secrets and configurations. Table Editor supports capabilities including CRUD operations for secrets and plaintext values, secret decryption, environment imports, variable projections, and interpolations.

Pulumi ESC YAML Code Editor Enhancements

We’ve upgraded the Pulumi ESC YAML editor with features aimed at simplifying the environment authoring process and enhancing developer productivity. Key enhancements include auto-complete for faster coding, enhanced diagnostics offering deeper error insights, and hover documentation for easy access to information, reducing the need for context switching. Additionally, we have added support for accessing contextual information about the current user and current environments. This support can be used to fine-tune OIDC claims and enhance audit logs. For more details, check out our blog post.

Pulumi ESC OIDC customization

Pulumi ESC now offers subject customization for OIDC tokens, enhancing security across AWS, GCP and Azure by aligning federated credentials with specific identifiers. By configuring the subjectAttributes setting, users can include specific environment, user, and organization information in the OIDC token subject claim, offering more granular control and customization for cloud resource access. This capability is especially valuable for customers using Azure, where subject claims are required to precisely match the string specified in the policy.

Pulumi ESC Audit Logs

Pulumi ESC now features comprehensive Audit Logs for all Create, Read, Open, Update, and Delete (CRUD) operations, strengthening your cloud security framework. This critical addition to Pulumi ESC enables organizations to closely monitor and audit their cloud infrastructure changes, ensuring enhanced oversight and security compliance. Through detailed logging, teams gain valuable insights into their operational activities, facilitating improved governance and accountability across cloud resources.

Core

Dev Releases for the Pulumi CLI and SDKs

We introduced Dev Releases, allowing developers to access the latest features and improvements in Pulumi’s infrastructure as code tools ahead of their official release. With this initiative, we aim to engage our community and gather early feedback, enhancing the product development process. This is crucial for identifying and resolving potential issues early, contributing to a smoother transition to new releases. Dev Releases will also be at the cutting edge of Pulumi’s evolving capabilities, with the latest bug fixes and features available within minutes of Pulumi developers merging. For instructions on how to use the CLI Dev releases see the install docs, and for pre-release versions of Dev SDKs see the docs for Node.js, Python, .NET, and Go.

Automation API support to install Pulumi CLI

The Pulumi Automation API now offers the functionality to install the Pulumi CLI directly through the API. This feature enables deploying programs utilizing the Automation API without the need for prior CLI installation. Explore an example in Go and refer to the new APIs in Go, Node.js, Python, and .NET.

Node.js Monorepo Support

Pulumi now seamlessly integrates with Node.js monorepos using tools like Nx. We’ve enhanced Pulumi to support yarn/npm workspaces, widely used in Node.js monorepos. This enhancement facilitates better project management by automatically handling dependencies and building processes. The integration allows Pulumi infrastructure codes to coexist with application codes in the same repository, improving development workflow efficiency by using Nx’s capabilities to manage build and deploy dependencies effectively. Check out the blog post for more details.

Providers and Packages

New Provider Resources

We have added 121 functions and 159 resources across our most popular providers, along with many more throughout our ecosystem. Notably, Palo Alto Networks is now supported in the Azure Native Provider.

New Community Providers

We welcome new providers to our registry!

Pulumi Registry Documentation Update

The Pulumi Registry documentation has significantly improved example code generation across programming languages. Systemic improvements benefit over 900 examples—700+ in Python, 200+ in Go, and a selection in C#—with notable improvements in type instantiations.

AI

Pulumi AI Evolution

We continue to invest in Pulumi Neo and improve the quality of programs in TypeScript, Python, Go, and C#. Key enhancements include generating code that accurately imports providers, with a special focus on those authored by our community and partners, ensuring the use of correct syntax for Pulumi YAML, embracing modern C# syntax like top-level statements, and implementing comprehensive spellchecking for modules and parameters. These updates continue to push Pulumi AI as a robust, developer-friendly platform, enabling you to build with greater confidence and efficiency. Moreover, you can now cancel in-progress prompts within Pulumi AI should you need to make any changes to your prompt.

Wrap up

That marks the end of this update on Pulumi’s latest enhancements! We can’t wait to see what you build with these new tools. Your feedback drives our innovation. Feel free to open an issue in the Pulumi Cloud requests repository or in the pulumi/pulumi repository for anything CLI. Keep an eye on us for more exciting updates!

Pulumi Release Notes: Pulumi ESC, Deployments GA, Pulumi AI Improvements, AWS S3 Express One Zone Support, and more!

Arun Loganathan — Thu, 01 Feb 2024 11:06:04 -0800

We’ve had a busy last few months at Pulumi. From shipping a brand new product offering, Pulumi ESC, to adding several major features in Pulumi Cloud and updates to various Pulumi providers - there is lots to catch up on. In addition to reading these release notes, check out the pulumi/pulumi repo changelog to stay up to date with CLI enhancements after each CLI release. For Pulumi Cloud updates, follow the new features blogs to stay updated on the latest feature releases. Let’s walk through the major updates across Pulumi from the last few months!

AI
Pulumi Cloud
Core
- Import Improvements
Providers and Packages
Wrap up

AI

Deploy with Pulumi within Pulumi AI

Pulumi AI’s new feature enables deploying cloud infrastructure using AI prompts. Users can rapidly generate and deploy templates through natural language inputs in ‘pulumi new’ CLI command and new project wizard, significantly streamlining the cloud setup process. Additionally, you now have the option to deploy the Pulumi AI generated Pulumi programs from within Pulumi Neo and in the New Project Wizard in the Pulumi Cloud console.

Pulumi AI coverage and performance

Pulumi AI can now write Pulumi programs for all 150 cloud providers in the Pulumi registry - up from 20 cloud providers. Pulumi AI has also been updated to OpenAI’s GPT-4 Turbo for enhanced performance along with fine tuning our prompts to improve our AI’s ability to write code.

Pulumi AI Answers

Pulumi AI Answers, launched late last year, has become a go-to repository, hosting an extensive collection of over 50,000 anonymized, infrastructure-as-code commonly asked queries, all carefully selected and presented by Pulumi. As this repository continues to expand, we’re seeing an exponential increase in user traffic, underscoring the immense value it offers. It’s inspiring to see the Pulumi community actively leveraging it as they build and scale their cloud infrastructure

Pulumi Cloud

Pulumi ESC Preview

Pulumi Environment, Secrets and Configuration (ESC) is our answer to the growing needs of our customers to manage secret sprawl and streamline config management. Pulumi ESC allows teams to store and aggregate secrets and configuration from various sources into a composable collection called an environment. You can dynamically generate OIDC credentials from all three major cloud providers (AWS, Azure and GCP), and integrate with other secrets managers like AWS Secrets Manager, Hashicorp Vault, Azure Vault and GCP Secret manager to pull secrets during runtime. Its hierarchical structure simplifies the composition and reuse of configurations, ensuring secure, auditable management and robust access control. With Pulumi ESC, the trend is clear: organizations are choosing its comprehensive approach for managing secrets and configurations, and they are here to stay. Get started with Pulumi ESC

Developer Portal Gallery

We launched a new template gallery in the New Project Wizard, supercharging Platform teams to provision and distribute organization templates for their development teams to get up and running fast. Developers can generate Pulumi programs from these templates, commit and push code to GitHub and trigger deployment within the Pulumi Cloud console. The gallery supports three template types: Organization Templates for custom internal projects, Pulumi Templates authored by Pulumi to cover common architectural patterns and AI-Generated Templates created through Pulumi AI. For more information, check out the full blog post.

Deployments GA

Pulumi Deployments was made generally available with new improvements such as support for GitHub Enterprise. Since launch, Pulumi Deployments has made infrastructure management at scale seamless for our customers, offering out of the box features such as Review Stacks and multiple deployment triggers.

Customer Managed Agents

Customer Managed Agents for Pulumi Deployments enable customers with hard security and compliance requirements to take advantage of the powerful capabilities of Pulumi Deployments. By self-hosting the agents, you can host them anywhere within your infrastructure on any hardware and environment in order to meet compliance requirements to keep cloud provider credentials within your private network.

MFA in Pulumi Cloud

We now support multi-factor authentication to prevent unauthorized access, ensuring robust security within your organization. Enable MFA by navigating to your account settings.

Pricing Calculator

Pulumi cost calculator for Team Edition enables you to quickly estimate the cost of using Pulumi Cloud. Simply input the number of resources in all your cloud accounts and the percentage of time they will be running to quickly get the total cost per month with a break down of estimated credits, free credits and cost per credit. You can also use the calculator to estimate the cost of using Pulumi Deployments.

Historical Views

The Pulumi Cloud stack update page now contains the historical resources in the stack and the historical stack outputs. Simply click on details on each Pulumi update to see the resource state and stack output at the time of the update. This history extends all the way back to the first update of the stack. See the historical views blog post for more details.

Core

Import Improvements

We have made several improvements to the pulumi import command to make it easier to bulk import resources into complex programs and components. You can now:

Import one resource and then use that resource as the parent for another imported resource. Previously, parents could only refer to resources that already existed; i.e., you would have had to do two imports
Specify that a resource is a component to be used as the parent of other imported resources via a new component property in the import file
Specify parents by name without having to include the parent URN in the nameTable
Specify the logicalName of resources
Run pulumi preview --import-file <file> on a program to generate a placeholder import file for every resource that would be created as part of the program. The generated file will contain all the names, types, and URNs already filled in, with blank id fields that need to be filled in. This is useful when you already have the structure of the resources for your program and only need to fill in the IDs of existing resources

Additionally, the import system no longer renames resources to try and make unique names and no longer generates errors just because two resources of different types have the same name. The rules for uniqueness now match what’s valid when writing a Pulumi program. The import system will generate an error if you try to import two resources that would end up with the same URN.

Providers and Packages

AWSX now uses AWS 6.0

We have launched AWSx 2.0, bringing all the benefits AWS 6.0 to Pulumi Crosswalk for AWS (AWSx). The new versions offer several fixes and improvements, including support for the latest Terraform Plugin Framework, 56 new resources and 23 new functions for various AWS services.

Pulumi Google Cloud Classic 7.0

We have updated the Pulumi Google Cloud Classic Provider to reflect the latest developments from Google Cloud, including updates to existing resources and adding support for new resources, functions and input properties. One of the key update is the fix for renaming of the Service Account resource for consistency and ease of use. We also made changes to align with upstream changes to labels. Upgrading to this new version is straightforward. Check out our blog post and migration guide.

AWS S3 Express One Zone Support

We added support for Amazon S3 Express One Zone, a new storage class offering up to 10x faster performance and reduced request costs by 50%. S3 Express One Zone is ideal for data-intensive applications such as AI/ML, HPC, etc. This update is part of our commitment to provide timely and effective support for the latest AWS offerings.

New Provider Resources

We have added 641 functions and 662 resources across our most popular providers, along with many more throughout our ecosystem.

New Community Providers

We welcome new providers to our registry!

Wrap up

That’s a wrap on our latest Pulumi release notes! With each new feature and improvement, from AI advancements to enhanced cloud deployment tools, we’re excited to see how you leverage these updates. Your feedback is crucial in shaping our path forward, feel free to open issues in our Pulumi Cloud requests repository or in the pulumi/pulumi repository for CLI feedback. Stay connected for more updates, and here’s to building a more efficient cloud future together!