---
title: Cloud Engineering Concepts Explained
description: Plain-English explainers of infrastructure as code, DevOps, CI/CD, Kubernetes, platform engineering, secrets management, and other cloud engineering topics.
url: /what-is/
---

- [What is Platform Engineering?](/what-is/what-is-platform-engineering/) — Understand what platform engineering is, along with the main benefits and importance for modern application development.
- [Amazon DynamoDB vs Google Cloud Bigtable](/what-is/amazon-dynamodb-vs-google-cloud-bigtable/) — Compare Amazon DynamoDB vs Google Cloud Bigtable, plus other DynamoDB alternatives like Cassandra, MongoDB, and Cosmos DB, to pick the right NoSQL database.
- [An error occurred (ExpiredToken) when calling the ListBuckets operation](/what-is/resolve-list-buckets-expired-token/) — Use Pulumi ESC and dynamic credentials to run commands like aws ListBuckets in a more secure and seamless way.
- [An error occurred (InvalidAccessKeyId) when calling the ListBuckets operation](/what-is/resolve-list-buckets-invalid-access-key-id/) — Use Pulumi ESC and dynamic credentials to run commands like aws ListBuckets in a more secure and seamless way.
- [An error occurred (InvalidClientTokenId) when calling the ListBuckets operation](/what-is/resolve-list-buckets-invalid-client-token-id/) — Use Pulumi ESC and dynamic credentials to run commands like aws ListBuckets in a more secure and seamless way.
- [An error occurred (SignatureDoesNotMatch) when calling the ListBuckets operation](/what-is/resolve-list-buckets-signature-does-not-match/) — Use Pulumi ESC and dynamic credentials to run commands like aws ListBuckets in a more secure and seamless way.
- [Automating AWS S3 File Expiration with Pulumi](/what-is/guide-to-automating-file-expiration-in-aws-s3/) — A comprehensive guide to automate file expiration in AWS S3 using Pulumi.
- [Cosmos DB vs MongoDB, Know The Differences?](/what-is/cosmos-db-vs-mongodb-know-the-differences/) — Compare Cosmos DB and MongoDB strengths and limitations to determine the best database option.
- [Database Comparison: Cosmos DB vs DynamoDB](/what-is/database-comparison-cosmos-db-vs-dynamodb/) — Compare NoSQL databases Cosmos DB vs DynamoDB. See the similarities and differences between these databases to determine which is best for you.
- [Infrastructure as Code for DevOps](/what-is/infrastructure-as-code-for-devops/) — Infrastructure as code is what makes DevOps work past the app boundary: CI/CD, shift-left testing, policy as code, and AI agents for the platform itself.
- [Is Kubernetes Infrastructure as Code?](/what-is/is-kubernetes-infrastructure-as-code/) — Partly. Kubernetes reconciles YAML like IaC, but the loop stops at the cluster boundary. Pulumi extends that model to the infrastructure underneath.
- [JavaScript and TypeScript Infrastructure as Code](/what-is/javascript-and-infrastructure-as-code/) — Define cloud infrastructure as code in TypeScript or JavaScript: real types, npm packages, IDE tooling, and Jest tests for VPCs and clusters.
- [Kubernetes Infrastructure as Code: Tools and Best Practices](/what-is/infrastructure-as-code-for-kubernetes/) — Kubernetes infrastructure as code defines the cluster, its workloads, and the cloud resources around them in version-controlled code. Tools and best practices.
- [MCP for Infrastructure as Code: What It Means for Pulumi Users](/what-is/mcp-for-infrastructure-as-code/) — MCP connects AI agents to your cloud infrastructure. Learn what MCP for IaC means, how vendors are building it, and how Pulumi's MCP server works.
- [Python for DevOps](/what-is/python-for-devops/) — Python is the lingua franca of DevOps and MLOps automation. Learn where Python fits in IaC, CI/CD, observability, and machine-learning operations.
- [Run 'aws cloudwatch get-metric-data' w/ Dynamic Credentials](/what-is/run-aws-cloudwatch-get-metric-data-with-dynamic-credentials/) — Learn how to use dynamic credentials in Pulumi ESC for executing commands like 'aws cloudwatch get-metric-data' more securely and efficiently.
- [Run 'aws dynamodb list-tables' with Dynamic Credentials](/what-is/run-aws-dynamodb-list-tables-with-dynamic-credentials/) — Learn how to use dynamic credentials in Pulumi ESC for executing commands like 'aws dynamodb list-tables' more securely and efficiently.
- [Run 'aws ec2 describe-instances' using Dynamic Credentials](/what-is/run-aws-ec2-describe-instances-with-dynamic-credentials/) — Learn how to use dynamic credentials in Pulumi ESC for executing commands like 'aws ec2 describe-instances' in a more secure and efficient manner.
- [Run 'aws ec2 start-instances' using Dynamic Credentials](/what-is/run-aws-ec2-start-instances-with-dynamic-credentials/) — Learn how to use dynamic credentials in Pulumi ESC for executing commands like 'aws ec2 start-instances' in a more secure and efficient manner.
- [Run 'aws ec2 stop-instances' using Dynamic Credentials](/what-is/run-aws-ec2-stop-instances-with-dynamic-credentials/) — Learn how to use dynamic credentials in Pulumi ESC for executing commands like 'aws ec2 stop-instances' in a more secure and efficient manner.
- [Run 'aws iam list-users' using Dynamic Credentials](/what-is/run-aws-iam-list-users-with-dynamic-credentials/) — Learn how to use dynamic credentials in Pulumi ESC for executing commands like 'aws iam list-users' in a more secure and efficient manner.
- [Run 'aws lambda list-functions' with Dynamic Credentials](/what-is/run-aws-lambda-list-functions-with-dynamic-credentials/) — Learn how to use dynamic credentials in Pulumi ESC for executing commands like 'aws lambda list-functions' more securely and efficiently.
- [Run 'aws s3 cp' using Dynamic Credentials](/what-is/run-aws-s3-cp-with-dynamic-credentials/) — Learn more about using dynamic credentials in Pulumi ESC to run commands like aws s3 cp in a more secure and seamless way.
- [Run 'aws s3 ls' using Dynamic Credentials](/what-is/run-aws-s3-ls-with-dynamic-credentials/) — Learn more about using dynamic credentials in Pulumi ESC to run commands like aws s3 ls in a more secure and seamless way.
- [Run 'aws s3 sync' with Dynamic Credentials](/what-is/run-aws-s3-sync-with-dynamic-credentials/) — Learn how to use dynamic credentials in Pulumi ESC for executing commands like 'aws s3 sync' more securely and efficiently.
- [Run 'aws sts get-caller-identity' using Dynamic Credentials](/what-is/run-aws-sts-get-caller-identity-with-dynamic-credentials/) — Learn how to use dynamic credentials in Pulumi ESC for executing commands like 'aws sts get-caller-identity' in a more secure and efficient manner.
- [Unable to locate credentials](/what-is/resolve-unable-to-locate-credentials/) — Use Pulumi ESC and dynamic credentials to run commands like aws ListBuckets in a more secure and seamless way.
- [What are Docker Configs? Setup & Best Practices](/what-is/what-are-docker-configs/) — Docker Configs store non-sensitive data, like config files, and mount it into Swarm containers at runtime. Learn to create and mount Configs via the CLI.
- [What are Docker Secrets? Setup & Best Practices](/what-is/what-are-docker-secrets/) — Docker Secrets pass sensitive data, like passwords and keys, to Swarm containers without hard-coding it. Learn to create secrets via the CLI or Compose.
- [What are Kubernetes Secrets? Guide & Best Practices](/what-is/what-are-kubernetes-secrets/) — Kubernetes Secrets store sensitive data apart from pod specs so it isn't hard-coded into manifests. Learn to create, read, update, and delete Secrets safely.
- [What is a CircleCI Secret? Setup & Best Practices](/what-is/what-is-a-circleci-secret/) — A CircleCI secret is an encrypted variable that keeps credentials out of config files. Learn to define, reference, and rotate secrets, and use OIDC with ESC.
- [What is a Cloudflare Secret? Setup & Best Practices](/what-is/what-is-a-cloudflare-secret/) — A Cloudflare secret is an encrypted variable Workers read at runtime, never exposed in code. Learn to create secrets with Wrangler and access them.
- [What is a GitHub Actions Secret? How It Works](/what-is/what-is-a-github-action-secret/) — A GitHub Actions secret is an encrypted variable at the repo, environment, or org level so workflows use credentials safely. Learn to create one.
- [What Is a Terraform Module?](/what-is/what-is-a-terraform-module/) — A Terraform module is a reusable container for a group of related resources, defined once and called with different inputs. Learn how modules work.
- [What Is Agentic Infrastructure?](/what-is/what-is-agentic-infrastructure/) — Agentic infrastructure is cloud infrastructure that AI agents provision, govern, and operate through code. Learn what it is, how it works, and how to build it.
- [What is an Internal Developer Platform (IDP)?](/what-is/what-is-an-internal-developer-platform/) — How internal developer platforms (IDPs) work: golden paths, self-service infrastructure, architecture, key components, and how to build or adopt one.
- [What is AWS Secrets Manager? Setup & Best Practices](/what-is/what-is-aws-secrets-manager/) — AWS Secrets Manager stores, rotates, and retrieves credentials without hard-coding them. Learn to create secrets via the CLI and use Pulumi ESC.
- [What is Azure Key Vault? Setup & Best Practices](/what-is/what-is-azure-key-vault/) — Azure Key Vault securely stores secrets, keys, and certificates and controls access to them. Learn to create Key Vault secrets and centralize with Pulumi ESC.
- [What Is Cloud Infrastructure Autoscaling?](/what-is/what-is-cloud-infrastructure-autoscaling/) — Autoscaling adds and removes cloud capacity automatically. Learn horizontal vs vertical, reactive vs predictive, the major cloud services, and common pitfalls.
- [What Is Cloud Misconfiguration?](/what-is/what-is-cloud-misconfiguration/) — A cloud misconfiguration is an insecure setting on a cloud resource that exposes data or systems. Learn the common types and how to prevent them.
- [What is Cloud Security?](/what-is/what-is-cloud-security/) — Cloud security is the practice of protecting cloud workloads, data, and identities. Learn the shared responsibility model, key risks, and proven controls.
- [What is Configuration Management?](/what-is/what-is-configuration-management/) — Learn about what configuration management is and why configuration management is instrumental in maintaining the health and consistency of software systems.
- [What is Continuous Integration/Continuous Delivery (CI/CD)?](/what-is/what-is-ci-cd/) — Learn about CI/CD practices that improve dev process with automation for effective, rapid software delivery.
- [What Is DevOps Automation?](/what-is/what-is-devops-automation/) — DevOps automation can be key to consistent and scalable workflows. Learn how engineering teams can ship faster and more reliably with DevOps automation.
- [What is DevOps?](/what-is/what-is-devops/) — DevOps combines software development and IT operations to ship faster and more reliably. Learn lifecycle, CI/CD, automation, testing, and security.
- [What Is GitOps?](/what-is/what-is-gitops/) — GitOps manages infrastructure and apps with Git as the single source of truth and agents that reconcile live state to match. Learn how it works.
- [What is Google Cloud Secret Manager? Setup Guide](/what-is/what-is-google-cloud-secret-manager/) — Google Cloud Secret Manager stores API keys and passwords as encrypted, versioned secrets. Learn to create secrets via the CLI and apply best practices.
- [What is HashiCorp Vault? Features, Use Cases & Setup](/what-is/what-is-hashicorp-vault/) — HashiCorp Vault securely stores and controls access to secrets like tokens, passwords, and encryption keys. Learn its features and Pulumi ESC integration.
- [What is HIPAA?](/what-is/what-is-hipaa/) — HIPAA is the US law that sets national standards for protecting health information. Learn its rules, who it covers, penalties, and how to comply.
- [What is HITRUST?](/what-is/what-is-hitrust/) — HITRUST CSF is a certifiable security framework that harmonizes HIPAA, NIST, ISO 27001, and more into one assessment. Learn the levels, scope, and process.
- [What Is Immutable Infrastructure?](/what-is/what-is-immutable-infrastructure/) — Immutable infrastructure means never modifying a running server—you replace it with a new versioned image. Learn how it works and why it stops drift.
- [What is Infrastructure as Code (IaC)?](/what-is/what-is-infrastructure-as-code/) — Infrastructure as code (IaC) provisions cloud infrastructure with code instead of consoles. Learn how IaC works, declarative vs. imperative, and top tools.
- [What Is Infrastructure as Software?](/what-is/what-is-infrastructure-as-software/) — Infrastructure as Software is IaC written in general-purpose programming languages. Learn how it differs from DSL-based IaC and where it fits in practice.
- [What Is Infrastructure Drift?](/what-is/what-is-infrastructure-drift/) — Infrastructure drift is when live cloud resources diverge from your IaC code. Learn what causes it, how to detect it, and how to reconcile it safely.
- [What Is Policy as Code?](/what-is/what-is-policy-as-code/) — Policy as code applies software engineering practices to infrastructure governance. Learn what it is, how it works, the top tools, and how to enforce it.
- [What is Pulumi?](/what-is/what-is-pulumi/) — Discover what Pulumi is, how it works, and why it's revolutionizing infrastructure as code with familiar programming languages.
- [What is Secrets Management?](/what-is/what-is-secrets-management/) — Understand secrets management, the importance of secrets management, and how secrets management relates to infrastructure as code and configuration management
- [What is Serverless?](/what-is/what-is-serverless/) — Understand serverless architectures, along with some of the benefits of using serverless architectures for modern application development
- [What is SOC 2?](/what-is/what-is-soc-2/) — SOC 2 is an AICPA attestation that proves a service provider's controls meet the Trust Services Criteria. Learn Type I vs Type II, scope, and the audit process.
- [What Is Terraform State?](/what-is/what-is-terraform-state/) — Terraform state maps your configuration to real cloud resources so Terraform knows what it manages. Learn how the state file, backends, and locking work.
- [What Is Terragrunt?](/what-is/what-is-terragrunt/) — Terragrunt wraps Terraform and OpenTofu to add DRY configuration, remote state management, and multi-module orchestration. Learn how it works.
- [What is YAML?](/what-is/what-is-yaml/) — YAML is a data serialization language that has steadily increased in popularity. Discover how to use YAML with Pulumi today.