Pulumi vs. HCP Terraform (Terraform Cloud)
Pulumi Cloud and HCP Terraform (formerly Terraform Cloud) are both managed platforms for running infrastructure as code as a team. Each stores state, runs deployments remotely, enforces policy, and controls who can change what. They differ mainly in which infrastructure as code tools they run: HCP Terraform runs Terraform configurations written in HCL, while Pulumi Cloud runs Pulumi programs written in general-purpose languages (Python, TypeScript, JavaScript, Go, .NET, and Java), YAML, or HCL, and can also act as a state backend and remote runner for the Terraform and OpenTofu CLIs.
This page covers what each product is, a feature-by-feature comparison, the most important differences in detail, and the available paths for adopting Pulumi Cloud alongside or instead of HCP Terraform. For a comparison of the Pulumi and Terraform engines themselves, see Pulumi vs. Terraform.
What is Pulumi?
Pulumi is an infrastructure as code platform for provisioning and managing resources across any cloud or SaaS platform. Pulumi programs are written in general-purpose programming languages — Python, TypeScript, JavaScript, Go, .NET, and Java — as well as YAML and HCL. The Pulumi Registry covers all major clouds, including first-party native providers that are generated from upstream API schemas for same-day coverage of new platform features. The Pulumi CLI and SDKs are open source under the Apache 2.0 license. Pulumi Cloud is the commercial product that adds managed state, secrets, RBAC, audit logs, policy management, and other features for running Pulumi at organizational scale.
Pulumi Cloud’s capabilities for teams include Pulumi Deployments for remote and Git-driven runs, Pulumi Policies for policy as code, Pulumi ESC for secrets and configuration, and Pulumi Discovery for a searchable inventory of cloud resources. Pulumi Cloud is available as a managed service or self-hosted.
What is HCP Terraform?
HCP Terraform is HashiCorp’s managed service for running Terraform. It stores Terraform state, runs terraform plan and terraform apply remotely through CLI-driven, VCS-driven, or API-driven workflows, and organizes infrastructure into workspaces grouped by project. It includes a private registry for modules and providers, policy enforcement with Sentinel or Open Policy Agent, dynamic provider credentials for AWS, Azure, Google Cloud, and other platforms, and self-hosted agents for running operations inside private networks. Terraform Enterprise is the self-hosted distribution of the same product.
HCP Terraform is priced by Resources Under Management (RUM), the number of resources tracked in the state files it manages. Its Free tier covers up to 500 managed resources per organization; HashiCorp retired the older user-based Free plan on March 31, 2026.
Detailed comparison
| Feature | Pulumi Cloud | HCP Terraform |
|---|---|---|
| Languages | Python, TypeScript, JavaScript, Go, .NET, and Java, YAML, and HCL (runtime: hcl), which runs valid Terraform and OpenTofu configurations with a short list of documented exceptions | HCL |
| Terraform and OpenTofu CLI support | Implements the Terraform remote backend API, so the terraform and tofu CLIs can store state in Pulumi Cloud and run plans and applies remotely on it | Native backend and runner for the terraform CLI |
| State management | Managed state for Pulumi stacks and for Terraform and OpenTofu stacks, with update history, locking, and encryption | Managed state per workspace, with state versions and locking |
| Remote execution | Pulumi Deployments: Git-push, API, schedule, and click-to-deploy triggers; review stacks per pull request; Pulumi-managed or customer-managed runners | CLI-driven, VCS-driven, and API-driven runs; speculative plans on pull requests; HashiCorp-managed workers or self-hosted agents |
| Drift detection | Scheduled drift detection through Pulumi Deployments, with optional remediation | Health assessments detect drift and evaluate continuous validation checks on eligible plans |
| Policy as code | Pulumi Policies, written in Python, TypeScript, or OPA Rego; enforced on Pulumi previews and updates and, for remotely executed Terraform stacks, against Terraform plans; audit policies can scan existing resources | Sentinel or OPA policy sets, evaluated as a step in each run with advisory, soft-mandatory, or hard-mandatory enforcement |
| Secrets and configuration | Pulumi ESC manages secrets and configuration for infrastructure and applications, and can pull from external stores such as AWS Secrets Manager and HashiCorp Vault; stack secrets are encrypted in state | Sensitive workspace variables and variable sets; HashiCorp Vault is a separate product for centralized secrets |
| Dynamic cloud credentials | OIDC-based credentials through Pulumi ESC and Pulumi Deployments | Dynamic provider credentials for AWS, Azure, Google Cloud, Kubernetes, and Vault |
| Module and package registry | Private registry for Pulumi packages and components and for Terraform modules, with a publish API compatible with HCP Terraform’s | Private registry for Terraform modules and providers, including no-code-ready modules |
| Resource inventory | Pulumi Discovery inventories cloud resources across accounts and providers, including resources not managed by any infrastructure as code tool | Explorer reports on workspaces, modules, providers, and Terraform versions across the organization |
| Access control and audit | Role-based access control, SAML SSO, SCIM, and audit logs | Team-based permissions, SSO, and audit trails |
| Programmatic API | REST API, plus the Automation API, an SDK for driving Pulumi operations from application code | REST API, with the go-tfe client and the tfe Terraform provider |
| AI assistance | Pulumi Neo, Agent Skills, and the Pulumi MCP server | HashiCorp publishes a Terraform MCP server for AI assistants |
| Self-hosted option | Self-hosted Pulumi Cloud | Terraform Enterprise |
| Pricing model | Editions with a monthly base price and Pulumi Credits consumed across IaC resources, Deployments, ESC, and Neo; see pricing | Resources Under Management (RUM), with a Free tier up to 500 managed resources |
Key differences
Language support
HCP Terraform runs Terraform, so configurations are written in HCL. HCL is a declarative configuration language with built-in functions and meta-arguments such as for_each, count, and dynamic; reuse happens through modules, and terraform test provides a native test framework.
Pulumi Cloud runs Pulumi programs, which can be written in general-purpose languages, YAML, or HCL. A general-purpose language brings its own package manager, test frameworks, and IDE tooling, and lets you build reusable components as classes or functions. Pulumi HCL runs existing .tf files on the Pulumi engine, so language is a per-project choice: HCL projects and general-purpose-language projects in the same organization can share components, policies, and state. HashiCorp deprecated the Cloud Development Kit for Terraform (CDKTF) in December 2025, so HCL is the supported authoring language for HCP Terraform.
Running Terraform on Pulumi Cloud
Pulumi Cloud can manage Terraform and OpenTofu configurations without converting them. It implements the Terraform remote backend API, so an existing project moves to it by adding a backend "remote" block and running terraform init -migrate-state. From there:
- Stacks created through the CLI run plans and applies on Pulumi Cloud by default. VCS-triggered applies pause after the plan and wait for Confirm or Discard in the console. Stacks that predate remote execution stay on local execution until you set the
terraform:execution-modestack tag toremote. - Access is governed by the same RBAC as other Pulumi Cloud stacks.
- Backend configuration and OIDC credentials can come from Pulumi ESC, and root module outputs are exposed as stack outputs for other stacks to consume.
- Preventative policies run against the Terraform plan on remotely executed stacks and can block a non-compliant apply.
- Terraform-managed resources appear in Pulumi Discovery alongside Pulumi-managed ones, and Neo can review Terraform and OpenTofu pull requests.
Pulumi programs in any language can also consume Terraform modules with pulumi package add hcl module <source> [version], resolving from the Terraform Registry, a private registry, or a local path.
Remote execution and workspaces
HCP Terraform organizes infrastructure into workspaces, each with its own state, variables, and run history, grouped into projects. Runs are triggered from the CLI, from VCS events, or through the API, and can execute on HashiCorp-managed workers or on self-hosted agents.
Pulumi organizes infrastructure into projects and stacks. Pulumi Deployments runs pulumi preview and pulumi up remotely on Git pushes, API calls, schedules, or from the console, and can create review stacks for each pull request. Stacks can read each other’s outputs through stack references. Runs can execute on Pulumi-managed runners or on customer-managed runners inside your network.
Policy as code
HCP Terraform evaluates Sentinel or OPA policy sets as a step in each run, after the plan and before the apply. Policies can be advisory, soft-mandatory (can be overridden), or hard-mandatory.
Pulumi Policies are written in Python, TypeScript, or OPA Rego. Preventative policies run during pulumi preview and pulumi up and block non-compliant changes; audit policies scan resources that already exist, including resources found by Pulumi Discovery. For Terraform stacks executed remotely on Pulumi Cloud, preventative policies evaluate the Terraform plan. The policy SDK is open source; centralized management and enforcement across an organization are Pulumi Cloud features.
Secrets and configuration
HCP Terraform stores variables per workspace or in variable sets shared across workspaces. Variables marked sensitive are write-only in the UI and API. Dynamic provider credentials exchange a workload identity token for short-lived cloud credentials at run time. Centralized secrets management across infrastructure and applications is typically handled by HashiCorp Vault, a separate product.
Pulumi ESC manages secrets and configuration as composable environments that Pulumi stacks, Terraform stacks on Pulumi Cloud, applications, and CI systems can all consume. Environments can generate OIDC credentials for AWS, Azure, and Google Cloud and can reference secrets held in external stores, including Vault. Within Pulumi programs, values marked as secret are encrypted in state with per-stack keys.
Pricing models
HCP Terraform charges by Resources Under Management: cost scales with the number of resources tracked in state across the organization. Its Free tier covers up to 500 managed resources.
Pulumi Cloud sells editions with a monthly base price and Pulumi Credits, a shared unit consumed by managed IaC resources beyond an edition’s included amount, Deployments minutes, ESC, and Neo. Both models charge for the resources you manage; the difference is whether other platform features draw from the same allowance. Current rates are on the Pulumi pricing page and HashiCorp’s pricing page.
Ecosystem
Terraform has the largest public ecosystem of providers and modules of any infrastructure as code tool. Pulumi can use that ecosystem directly: any Terraform provider can be generated into a Pulumi SDK, and Pulumi programs can consume Terraform modules without modification. Pulumi also maintains native providers for Kubernetes, Azure Native, and AWS Cloud Control that are generated from each platform’s API schema.
When to choose Pulumi Cloud vs. HCP Terraform
Choose Pulumi Cloud when you:
- Want teams to be able to write infrastructure in a general-purpose language, in HCL, or in both, on one platform.
- Want to keep running Terraform or OpenTofu while using a managed backend that also runs Pulumi programs.
- Want secrets and configuration management, resource inventory, and policy as code in the same product as state and remote runs.
- Need an embeddable SDK (Automation API) to drive deployments from your own application or internal developer platform.
Choose HCP Terraform when you:
- Have standardized on Terraform and HCL and don’t expect to author infrastructure in other languages.
- Rely on HCP Terraform features without a Pulumi Cloud equivalent, such as Sentinel policies.
- Already use other HashiCorp products, such as Vault, and want to consolidate on one vendor.
- Prefer resource-count pricing for your workload.
Adoption: coexistence, conversion, and import
These paths can be taken independently or combined, and none require the ones after them:
- Move Terraform state to Pulumi Cloud. Point Terraform or OpenTofu at Pulumi Cloud as its state backend. Configurations and the CLI workflow stay the same. The guide covers migrating from HCP Terraform as well as from Amazon S3, Azure Blob Storage, Google Cloud Storage, and local files.
- Move your private module registry. Pulumi Cloud’s registry hosts Terraform modules with a publish API compatible with HCP Terraform’s private registry. Existing
go-tfeorhashicorp/tfepublishing pipelines work after changing the host totf.pulumi.comand supplying a Pulumi access token. Each published version is also available as a Pulumi package, and.tfconsumers keep resolving it over the Terraform protocol. - Reuse Terraform modules from Pulumi programs. Add existing modules to Pulumi projects with
pulumi package add hcl module. - Write projects in HCL on the Pulumi engine. Use Pulumi HCL with
runtime: hcland your existing.tffiles. Requires Pulumi CLI 3.256.0 or later. - Convert to a general-purpose language.
pulumi convert --from terraformtranslates HCL into a Pulumi program as a starting point for review, andpulumi importbrings existing resources under Pulumi management without recreating them. - Run both side by side. Pulumi programs can read outputs from Terraform state, so Terraform and Pulumi can manage different parts of the same environment during a gradual migration.
Frequently asked questions
Can I use Pulumi Cloud as my Terraform state backend without changing my code?
Yes. Pulumi Cloud implements the Terraform remote backend API, so you add a standard backend "remote" block and your resource code stays as it is. Stacks created through the CLI run plans and applies on Pulumi Cloud by default, VCS-triggered applies wait for manual approval, and the stack gets the same RBAC, policy enforcement, and update history as other Pulumi Cloud stacks. See Using Pulumi Cloud as a Terraform state backend.
Can I keep writing HCL with Pulumi?
Yes. HCL is a Pulumi language: set runtime: hcl in Pulumi.yaml and write ordinary .tf files. Pulumi HCL runs valid Terraform and OpenTofu configurations, with a short list of documented exceptions, and has the same access to Pulumi providers as any other Pulumi language.
Can I use my existing Terraform modules in Pulumi?
Yes, without modifying them. pulumi package add hcl module <source> [version] makes a module available to a Pulumi program in any language, resolving from the Terraform Registry, a private registry, or a local path. See Using Terraform modules in Pulumi. You can also host your modules in the Pulumi Cloud registry, where they stay usable from both Pulumi and Terraform.
Is HCP Terraform (Terraform Cloud) free?
HCP Terraform has a Free tier that covers up to 500 managed resources per organization. The legacy user-based Free plan reached end of life on March 31, 2026, and organizations still on it were moved to the current Free tier. Pulumi Cloud also has a Free edition; see pricing for what each edition includes.
How does Pulumi’s pricing compare to HCP Terraform’s?
HCP Terraform charges by Resources Under Management, the number of resources tracked in state. Pulumi Cloud charges a monthly base price per edition plus Pulumi Credits, which cover managed resources beyond the included amount as well as Deployments, ESC, and Neo usage. Which is less expensive depends on the number of resources you manage and which other features you use. See the Pulumi pricing page for current rates.
How do I migrate my existing Terraform state and code to Pulumi?
You can move state without changing code by using Pulumi Cloud as a Terraform backend. To move to the Pulumi engine, run existing .tf files with Pulumi HCL, convert HCL to another language with pulumi convert --from terraform, or adopt existing resources with pulumi import. See the migration guide for a full walkthrough.
Does Pulumi work with AI coding agents?
Yes. Coding agents such as Claude Code, Codex, Cursor, and GitHub Copilot can write Pulumi programs, and Agent Skills and the Pulumi MCP server give them Pulumi-specific context. Pulumi Neo is Pulumi’s infrastructure agent; it runs inside Pulumi Cloud and can run previews, investigate failed updates, and review Terraform and OpenTofu pull requests. Most teams get the most out of using Neo alongside the coding agent they already use.