published on Monday, Aug 24, 2026 by Pulumi
published on Monday, Aug 24, 2026 by Pulumi
Provides a Certificate Management Service (Original SSL Certificate) Certificate Validation resource.
Waits until the certificate application submitted on a certificate instance has been issued, and exposes the resulting certificate for downstream services to reference.
Certificate validation is the step between applying and issuance: the certificate authority verifies that the applicant controls the domain — for a DV certificate typically by checking a DNS record published under it, carrying the values that alicloud.sslcertificatesservicecertificate.Apply reports in domainValidationList. Once that verification passes, the authority issues the certificate a few minutes later. This resource represents the wait for that outcome.
For information about Certificate Management Service (Original SSL Certificate) and domain validation, see SSL Certificates Service.
NOTE: Available since v1.287.0.
NOTE: This resource creates nothing in the cloud. It only waits: after the application has been submitted and the domain validation records have been published, it polls the instance until the certificate is issued. Destroying it calls no API and leaves the certificate untouched. It exists so that downstream resources can depend on a certificate that has actually been issued, rather than on one that has merely been requested.
Example Usage
Basic Usage
import * as pulumi from "@pulumi/pulumi";
import * as alicloud from "@pulumi/alicloud";
const config = new pulumi.Config();
const name = config.get("name") || "terraform-example";
const _default = new alicloud.sslcertificatesserviceinstance.SslCertificatesServiceInstance("default", {
productType: "cas",
period: 12,
pricingCycle: 2,
instanceName: name,
domain: "example.com",
validationMethod: "DNS",
parameters: [
{
code: "fullSpec",
value: "ws.dv.f",
},
{
code: "fullDomainCount",
value: "1",
},
],
});
const defaultApply = new alicloud.sslcertificatesservicecertificate.Apply("default", {
instanceId: _default.id,
domain: _default.domain,
validationMethod: _default.validationMethod,
});
const defaultAlidnsRecord: {[key: string]: alicloud.dns.AlidnsRecord} = {};
defaultApply.domainValidationLists.apply(domainValidationLists => {
const defaultAlidnsRecord: {[key: string]: alicloud.dns.AlidnsRecord} = {};
pulumi.all(domainValidationLists.reduce((__obj, v) => ({ ...__obj, [v.domain]: v }), {})).apply(rangeBody => {
for (const range of Object.entries(rangeBody).sort().map(([k, v]) => ({key: k, value: v}))) {
defaultAlidnsRecord[range.key] = new alicloud.dns.AlidnsRecord(`default-${range.key}`, {
domainName: range.value.rootDomain,
rr: range.value.validationKey,
type: range.value.validationType,
value: range.value.validationValue,
ttl: 600,
});
}
});
});
const defaultValidation = new alicloud.sslcertificatesservicecertificate.Validation("default", {
instanceId: _default.id,
validationRecordIds: defaultAlidnsRecord.apply(defaultAlidnsRecord => Object.values(defaultAlidnsRecord).map(r => (r.id))),
});
import pulumi
from typing import Any
import pulumi_alicloud as alicloud
config = pulumi.Config()
name = config.get("name")
if name is None:
name = "terraform-example"
default = alicloud.sslcertificatesserviceinstance.SslCertificatesServiceInstance("default",
product_type="cas",
period=12,
pricing_cycle=2,
instance_name=name,
domain="example.com",
validation_method="DNS",
parameters=[
{
"code": "fullSpec",
"value": "ws.dv.f",
},
{
"code": "fullDomainCount",
"value": "1",
},
])
default_apply = alicloud.sslcertificatesservicecertificate.Apply("default",
instance_id=default.id,
domain=default.domain,
validation_method=default.validation_method)
default_alidns_record: dict[str, alicloud.dns.AlidnsRecord] = {}
def create_default(range_body):
for default_alidns_record_range in [{"key": k, "value": v} for [k, v] in sorted((range_body).items())]:
default_alidns_record[default_alidns_record_range['key']] = alicloud.dns.AlidnsRecord(f"default-{default_alidns_record_range['key']}",
domain_name=default_alidns_record_range["value"].root_domain,
rr=default_alidns_record_range["value"].validation_key,
type=default_alidns_record_range["value"].validation_type,
value=default_alidns_record_range["value"].validation_value,
ttl=600)
default_apply.domain_validation_lists.apply(lambda resolved_outputs: create_default({v.domain: v for v in resolved_outputs['domain_validation_lists']}))
default_validation = alicloud.sslcertificatesservicecertificate.Validation("default",
instance_id=default.id,
validation_record_ids=default_alidns_record.apply(lambda default_alidns_record: [r.id for r in default_alidns_record.values()]))
Example coming soon!
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AliCloud = Pulumi.AliCloud;
return await Deployment.RunAsync(() =>
{
var config = new Config();
var name = config.Get("name") ?? "terraform-example";
var @default = new AliCloud.SslCertificatesServiceInstance.SslCertificatesServiceInstance("default", new()
{
ProductType = "cas",
Period = 12,
PricingCycle = 2,
InstanceName = name,
Domain = "example.com",
ValidationMethod = "DNS",
Parameters = new[]
{
new AliCloud.sslCertificatesServiceInstance.Inputs.SslCertificatesServiceInstanceParameterArgs
{
Code = "fullSpec",
Value = "ws.dv.f",
},
new AliCloud.sslCertificatesServiceInstance.Inputs.SslCertificatesServiceInstanceParameterArgs
{
Code = "fullDomainCount",
Value = "1",
},
},
});
var defaultApply = new AliCloud.SslCertificatesServiceCertificate.Apply("default", new()
{
InstanceId = @default.Id,
Domain = @default.Domain,
ValidationMethod = @default.ValidationMethod,
});
var defaultAlidnsRecord = new List<AliCloud.Dns.AlidnsRecord>();
domainValidationLists.Apply(rangeBody =>
{
foreach (var range in rangeBody.Select(pair => new { pair.Key, pair.Value }))
{
defaultAlidnsRecord.Add(new AliCloud.Dns.AlidnsRecord($"default-{range.Key}", new()
{
DomainName = range.Value.RootDomain,
Rr = range.Value.ValidationKey,
Type = range.Value.ValidationType,
Value = range.Value.ValidationValue,
Ttl = 600,
}));
}
return 0;
});
var defaultValidation = new AliCloud.SslCertificatesServiceCertificate.Validation("default", new()
{
InstanceId = @default.Id,
ValidationRecordIds = defaultAlidnsRecord.Apply(defaultAlidnsRecord => (defaultAlidnsRecord).Values.Select(r =>
{
return r.Id;
}).ToList()),
});
});
Example coming soon!
Example coming soon!
pulumi {
required_providers {
alicloud = {
source = "pulumi/alicloud"
}
}
}
resource "alicloud_sslcertificatesserviceinstance_sslcertificatesserviceinstance" "default" {
product_type = "cas"
period = 12
pricing_cycle = 2
instance_name = var.name
domain = "example.com"
validation_method = "DNS"
parameters {
code = "fullSpec"
value = "ws.dv.f"
}
parameters {
code = "fullDomainCount"
value = "1"
}
}
resource "alicloud_sslcertificatesservicecertificate_apply" "default" {
instance_id = alicloud_sslcertificatesserviceinstance_sslcertificatesserviceinstance.default.id
domain = alicloud_sslcertificatesserviceinstance_sslcertificatesserviceinstance.default.domain
validation_method = alicloud_sslcertificatesserviceinstance_sslcertificatesserviceinstance.default.validation_method
}
resource "alicloud_dns_alidnsrecord" "default" {
for_each = {for v in alicloud_sslcertificatesservicecertificate_apply.default.domain_validation_lists : v.domain => v}
domain_name = each.value.rootDomain
rr = each.value.validationKey
type = each.value.validationType
value = each.value.validationValue
ttl = 600
}
resource "alicloud_sslcertificatesservicecertificate_validation" "default" {
instance_id = alicloud_sslcertificatesserviceinstance_sslcertificatesserviceinstance.default.id
validation_record_ids = [for r in alicloud_dns_alidnsrecord.default : r.id]
}
variable "name" {
type = string
default = "terraform-example"
}
Downstream services should reference the certificate exposed by this resource, so that the reference is only resolved once the certificate actually exists:
import * as pulumi from "@pulumi/pulumi";
import * as alicloud from "@pulumi/alicloud";
const _default = new alicloud.alb.Listener("default", {certificates: {
certificateId: defaultAlicloudSslCertificatesServiceCertificateValidation.certIdentifier,
}});
import pulumi
import pulumi_alicloud as alicloud
default = alicloud.alb.Listener("default", certificates={
"certificate_id": default_alicloud_ssl_certificates_service_certificate_validation["certIdentifier"],
})
package main
import (
"github.com/pulumi/pulumi-alicloud/sdk/v3/go/alicloud/alb"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := alb.NewListener(ctx, "default", &alb.ListenerArgs{
Certificates: &alb.ListenerCertificatesArgs{
CertificateId: pulumi.Any(defaultAlicloudSslCertificatesServiceCertificateValidation.CertIdentifier),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AliCloud = Pulumi.AliCloud;
return await Deployment.RunAsync(() =>
{
var @default = new AliCloud.Alb.Listener("default", new()
{
Certificates = new AliCloud.Alb.Inputs.ListenerCertificatesArgs
{
CertificateId = defaultAlicloudSslCertificatesServiceCertificateValidation.CertIdentifier,
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.alicloud.alb.Listener;
import com.pulumi.alicloud.alb.ListenerArgs;
import com.pulumi.alicloud.alb.inputs.ListenerCertificatesArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var default_ = new Listener("default", ListenerArgs.builder()
.certificates(ListenerCertificatesArgs.builder()
.certificateId(defaultAlicloudSslCertificatesServiceCertificateValidation.certIdentifier())
.build())
.build());
}
}
resources:
default:
type: alicloud:alb:Listener
properties:
certificates:
certificateId: ${defaultAlicloudSslCertificatesServiceCertificateValidation.certIdentifier}
pulumi {
required_providers {
alicloud = {
source = "pulumi/alicloud"
}
}
}
resource "alicloud_alb_listener" "default" {
certificates = {
certificate_id = defaultAlicloudSslCertificatesServiceCertificateValidation.certIdentifier
}
}
Deleting alicloud.sslcertificatesservicecertificate.Validation or removing it from your configuration
Terraform cannot destroy resource alicloud.sslcertificatesservicecertificate.Validation. Terraform will remove this resource from the state file, however resources may remain.
📚 Need more examples? VIEW MORE EXAMPLES
Create Validation Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new Validation(name: string, args: ValidationArgs, opts?: CustomResourceOptions);@overload
def Validation(resource_name: str,
args: ValidationArgs,
opts: Optional[ResourceOptions] = None)
@overload
def Validation(resource_name: str,
opts: Optional[ResourceOptions] = None,
instance_id: Optional[str] = None,
validation_record_ids: Optional[Sequence[str]] = None)func NewValidation(ctx *Context, name string, args ValidationArgs, opts ...ResourceOption) (*Validation, error)public Validation(string name, ValidationArgs args, CustomResourceOptions? opts = null)
public Validation(String name, ValidationArgs args)
public Validation(String name, ValidationArgs args, CustomResourceOptions options)
type: alicloud:sslcertificatesservicecertificate:Validation
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
resource "alicloud_sslcertificatesservicecertificate_validation" "name" {
# resource properties
}Parameters
- name string
- The unique name of the resource.
- args ValidationArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args ValidationArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args ValidationArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args ValidationArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args ValidationArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var validationResource = new AliCloud.SslCertificatesServiceCertificate.Validation("validationResource", new()
{
InstanceId = "string",
ValidationRecordIds = new[]
{
"string",
},
});
example, err := sslcertificatesservicecertificate.NewValidation(ctx, "validationResource", &sslcertificatesservicecertificate.ValidationArgs{
InstanceId: pulumi.String("string"),
ValidationRecordIds: pulumi.StringArray{
pulumi.String("string"),
},
})
resource "alicloud_sslcertificatesservicecertificate_validation" "validationResource" {
lifecycle {
create_before_destroy = true
}
instance_id = "string"
validation_record_ids = ["string"]
}
var validationResource = new Validation("validationResource", ValidationArgs.builder()
.instanceId("string")
.validationRecordIds("string")
.build());
validation_resource = alicloud.sslcertificatesservicecertificate.Validation("validationResource",
instance_id="string",
validation_record_ids=["string"])
const validationResource = new alicloud.sslcertificatesservicecertificate.Validation("validationResource", {
instanceId: "string",
validationRecordIds: ["string"],
});
type: alicloud:sslcertificatesservicecertificate:Validation
properties:
instanceId: string
validationRecordIds:
- string
Validation Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The Validation resource accepts the following input properties:
- Instance
Id string - The ID of the certificate instance whose application is being waited on.
- Validation
Record List<string>Ids - The IDs of the DNS records carrying the domain ownership validation information. The values themselves are never read; they exist so that Terraform creates the validation records before it starts waiting for issuance.
- Instance
Id string - The ID of the certificate instance whose application is being waited on.
- Validation
Record []stringIds - The IDs of the DNS records carrying the domain ownership validation information. The values themselves are never read; they exist so that Terraform creates the validation records before it starts waiting for issuance.
- instance_
id string - The ID of the certificate instance whose application is being waited on.
- validation_
record_ list(string)ids - The IDs of the DNS records carrying the domain ownership validation information. The values themselves are never read; they exist so that Terraform creates the validation records before it starts waiting for issuance.
- instance
Id String - The ID of the certificate instance whose application is being waited on.
- validation
Record List<String>Ids - The IDs of the DNS records carrying the domain ownership validation information. The values themselves are never read; they exist so that Terraform creates the validation records before it starts waiting for issuance.
- instance
Id string - The ID of the certificate instance whose application is being waited on.
- validation
Record string[]Ids - The IDs of the DNS records carrying the domain ownership validation information. The values themselves are never read; they exist so that Terraform creates the validation records before it starts waiting for issuance.
- instance_
id str - The ID of the certificate instance whose application is being waited on.
- validation_
record_ Sequence[str]ids - The IDs of the DNS records carrying the domain ownership validation information. The values themselves are never read; they exist so that Terraform creates the validation records before it starts waiting for issuance.
- instance
Id String - The ID of the certificate instance whose application is being waited on.
- validation
Record List<String>Ids - The IDs of the DNS records carrying the domain ownership validation information. The values themselves are never read; they exist so that Terraform creates the validation records before it starts waiting for issuance.
Outputs
All input properties are implicitly available as output properties. Additionally, the Validation resource produces the following output properties:
- Cert
Identifier string - The global certificate identifier, formatted as the certificate ID plus
-plus the site region ID. Alibaba Cloud services such as ALB, CDN and WAF reference a certificate by this value. - Certificate
Id int - The ID of the issued certificate.
- Certificate
Status string - The status of the issued certificate.
- Id string
- The provider-assigned unique ID for this managed resource.
- Cert
Identifier string - The global certificate identifier, formatted as the certificate ID plus
-plus the site region ID. Alibaba Cloud services such as ALB, CDN and WAF reference a certificate by this value. - Certificate
Id int - The ID of the issued certificate.
- Certificate
Status string - The status of the issued certificate.
- Id string
- The provider-assigned unique ID for this managed resource.
- cert_
identifier string - The global certificate identifier, formatted as the certificate ID plus
-plus the site region ID. Alibaba Cloud services such as ALB, CDN and WAF reference a certificate by this value. - certificate_
id number - The ID of the issued certificate.
- certificate_
status string - The status of the issued certificate.
- id string
- The provider-assigned unique ID for this managed resource.
- cert
Identifier String - The global certificate identifier, formatted as the certificate ID plus
-plus the site region ID. Alibaba Cloud services such as ALB, CDN and WAF reference a certificate by this value. - certificate
Id Integer - The ID of the issued certificate.
- certificate
Status String - The status of the issued certificate.
- id String
- The provider-assigned unique ID for this managed resource.
- cert
Identifier string - The global certificate identifier, formatted as the certificate ID plus
-plus the site region ID. Alibaba Cloud services such as ALB, CDN and WAF reference a certificate by this value. - certificate
Id number - The ID of the issued certificate.
- certificate
Status string - The status of the issued certificate.
- id string
- The provider-assigned unique ID for this managed resource.
- cert_
identifier str - The global certificate identifier, formatted as the certificate ID plus
-plus the site region ID. Alibaba Cloud services such as ALB, CDN and WAF reference a certificate by this value. - certificate_
id int - The ID of the issued certificate.
- certificate_
status str - The status of the issued certificate.
- id str
- The provider-assigned unique ID for this managed resource.
- cert
Identifier String - The global certificate identifier, formatted as the certificate ID plus
-plus the site region ID. Alibaba Cloud services such as ALB, CDN and WAF reference a certificate by this value. - certificate
Id Number - The ID of the issued certificate.
- certificate
Status String - The status of the issued certificate.
- id String
- The provider-assigned unique ID for this managed resource.
Look up Existing Validation Resource
Get an existing Validation resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: ValidationState, opts?: CustomResourceOptions): Validation@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
cert_identifier: Optional[str] = None,
certificate_id: Optional[int] = None,
certificate_status: Optional[str] = None,
instance_id: Optional[str] = None,
validation_record_ids: Optional[Sequence[str]] = None) -> Validationfunc GetValidation(ctx *Context, name string, id IDInput, state *ValidationState, opts ...ResourceOption) (*Validation, error)public static Validation Get(string name, Input<string> id, ValidationState? state, CustomResourceOptions? opts = null)public static Validation get(String name, Output<String> id, ValidationState state, CustomResourceOptions options)resources: _: type: alicloud:sslcertificatesservicecertificate:Validation get: id: ${id}import {
to = alicloud_sslcertificatesservicecertificate_validation.example
id = "${id}"
}
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Cert
Identifier string - The global certificate identifier, formatted as the certificate ID plus
-plus the site region ID. Alibaba Cloud services such as ALB, CDN and WAF reference a certificate by this value. - Certificate
Id int - The ID of the issued certificate.
- Certificate
Status string - The status of the issued certificate.
- Instance
Id string - The ID of the certificate instance whose application is being waited on.
- Validation
Record List<string>Ids - The IDs of the DNS records carrying the domain ownership validation information. The values themselves are never read; they exist so that Terraform creates the validation records before it starts waiting for issuance.
- Cert
Identifier string - The global certificate identifier, formatted as the certificate ID plus
-plus the site region ID. Alibaba Cloud services such as ALB, CDN and WAF reference a certificate by this value. - Certificate
Id int - The ID of the issued certificate.
- Certificate
Status string - The status of the issued certificate.
- Instance
Id string - The ID of the certificate instance whose application is being waited on.
- Validation
Record []stringIds - The IDs of the DNS records carrying the domain ownership validation information. The values themselves are never read; they exist so that Terraform creates the validation records before it starts waiting for issuance.
- cert_
identifier string - The global certificate identifier, formatted as the certificate ID plus
-plus the site region ID. Alibaba Cloud services such as ALB, CDN and WAF reference a certificate by this value. - certificate_
id number - The ID of the issued certificate.
- certificate_
status string - The status of the issued certificate.
- instance_
id string - The ID of the certificate instance whose application is being waited on.
- validation_
record_ list(string)ids - The IDs of the DNS records carrying the domain ownership validation information. The values themselves are never read; they exist so that Terraform creates the validation records before it starts waiting for issuance.
- cert
Identifier String - The global certificate identifier, formatted as the certificate ID plus
-plus the site region ID. Alibaba Cloud services such as ALB, CDN and WAF reference a certificate by this value. - certificate
Id Integer - The ID of the issued certificate.
- certificate
Status String - The status of the issued certificate.
- instance
Id String - The ID of the certificate instance whose application is being waited on.
- validation
Record List<String>Ids - The IDs of the DNS records carrying the domain ownership validation information. The values themselves are never read; they exist so that Terraform creates the validation records before it starts waiting for issuance.
- cert
Identifier string - The global certificate identifier, formatted as the certificate ID plus
-plus the site region ID. Alibaba Cloud services such as ALB, CDN and WAF reference a certificate by this value. - certificate
Id number - The ID of the issued certificate.
- certificate
Status string - The status of the issued certificate.
- instance
Id string - The ID of the certificate instance whose application is being waited on.
- validation
Record string[]Ids - The IDs of the DNS records carrying the domain ownership validation information. The values themselves are never read; they exist so that Terraform creates the validation records before it starts waiting for issuance.
- cert_
identifier str - The global certificate identifier, formatted as the certificate ID plus
-plus the site region ID. Alibaba Cloud services such as ALB, CDN and WAF reference a certificate by this value. - certificate_
id int - The ID of the issued certificate.
- certificate_
status str - The status of the issued certificate.
- instance_
id str - The ID of the certificate instance whose application is being waited on.
- validation_
record_ Sequence[str]ids - The IDs of the DNS records carrying the domain ownership validation information. The values themselves are never read; they exist so that Terraform creates the validation records before it starts waiting for issuance.
- cert
Identifier String - The global certificate identifier, formatted as the certificate ID plus
-plus the site region ID. Alibaba Cloud services such as ALB, CDN and WAF reference a certificate by this value. - certificate
Id Number - The ID of the issued certificate.
- certificate
Status String - The status of the issued certificate.
- instance
Id String - The ID of the certificate instance whose application is being waited on.
- validation
Record List<String>Ids - The IDs of the DNS records carrying the domain ownership validation information. The values themselves are never read; they exist so that Terraform creates the validation records before it starts waiting for issuance.
Import
Certificate Management Service (Original SSL Certificate) Certificate Validation can be imported using the id, e.g.
$ pulumi import alicloud:sslcertificatesservicecertificate/validation:Validation example <instance_id>
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- Alibaba Cloud pulumi/pulumi-alicloud
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
alicloudTerraform Provider.
published on Monday, Aug 24, 2026 by Pulumi