June 2025 Summaries

Pulumi, a declarative infrastructure tool, has introduced resource hooks, allowing users to execute custom code during any point in a resource's lifecycle from version 3.182.0 onward. These hooks provide a way for users to engage more deeply with Pulumi's operations by attaching callbacks to create, update, and delete actions, offering the flexibility to run arbitrary code before or after these operations. This feature enables scenarios such as setting up SSH tunnels before creating resources or sending metrics to a data warehouse when resources are updated. The hooks can be used within Pulumi's command provider, allowing for complex operations like opening a local TCP port and forwarding it to a remote host before executing a command, as illustrated by a contrived example of using the command provider to invoke curl. Another practical application is in the deployment of an EC2 web server, where resource hooks are used to perform health checks, ensuring the server is operational before Pulumi finalizes the deployment. Such hooks are a significant enhancement, expanding Pulumi's capabilities for handling custom scripts, collecting logs, and performing application health checks, although they require the use of the --run-program flag for refresh and destroy operations.

Pulumi ESC has integrated support for Doppler, a secrets management platform, enhancing its capabilities in centralized secrets and configuration management. This update introduces two dynamic providers: doppler-login and doppler-secrets. The doppler-login provider generates short-lived OIDC access tokens, addressing security concerns associated with static credentials, and is ideal for temporary authentication in local development or CI/CD pipelines. The doppler-secrets provider allows for the dynamic fetching of secrets stored in Doppler, making them accessible within the Pulumi ESC environment, thus centralizing secret consumption and ensuring consistent access across various platforms such as AWS, Azure, and more. These providers aim to boost security and streamline workflows by allowing secure interaction with Doppler, offering a robust and consistent API interface for managing secrets and configurations across diverse systems. Pulumi ESC supports this through various methods, including its SDK, CLI, and integration with platforms like GitHub Secrets and AWS Secrets Manager, emphasizing the importance of exploring these features for enhanced security and simplified management.

Infrastructure as Code (IaC) has significantly evolved, transforming infrastructure management by integrating software engineering principles such as testing, version control, and continuous integration. By 2025, leading organizations treat infrastructure provisioning akin to software development, utilizing tools that support both declarative and imperative programming languages. Key IaC tools like Pulumi, Terraform, and AWS Cloud Development Kit (CDK) facilitate this transformation by providing multi-cloud support, state management, and preview capabilities, which enable teams to define infrastructure through code rather than manual configurations. As infrastructure complexity increases, tools that offer comprehensive testing, abstraction, and collaboration become essential, particularly for teams with programming backgrounds. The guide emphasizes the importance of selecting IaC tools based on team expertise, infrastructure complexity, and organizational needs, while also highlighting the role of security and compliance tools in ensuring robust infrastructure management. Looking forward, the landscape is shifting towards software engineering convergence, real-time cloud integration, and AI-enhanced development, promising further advancements in infrastructure management.

AWS RDS supports blue/green deployments to facilitate database maintenance with minimal downtime, allowing changes to be made on a staging (green) instance before promoting it to production (blue). This method is particularly beneficial for critical databases, minimizing service interruptions during updates like engine version changes. During an update, Pulumi sets up a temporary blue/green deployment, performs requested changes on the green instance, and then switches over, deleting the old instance. Although this strategy extends the update duration, it ensures continuous availability. Important considerations include the lack of support for custom checks and clusters, potential manual cleanup if the update fails, and the possibility of resource ID changes, although connection details remain consistent. The method is ideal for updates requiring a maintenance window, such as engine version, parameter group, or storage changes.

Pulumi has announced a major update that allows developers to execute Terraform modules directly within Pulumi, facilitating a smoother transition from Terraform to Pulumi for managing infrastructure as code. This new feature addresses the challenge of migrating complex projects with extensive module dependencies by enabling incremental migration. Developers can now start new projects in Pulumi while maintaining existing Terraform modules without immediate rewrites, providing a strategic approach to modernization. The integration includes three components: direct module execution, enhanced conversion support, and configuration synchronization, which together offer improved developer experience, AI assistance, and cloud-native tooling. This capability is designed to be a stepping stone for teams, allowing them to leverage modern infrastructure practices while maintaining their current investments in Terraform modules. Pulumi's latest release promises comprehensive support for lifecycle management, resource visibility, and provider configuration, with plans for further enhancements to facilitate seamless Terraform-to-Pulumi transitions in the future.

Pulumi has introduced PostgreSQL as a new option for state storage, offering a reliable, scalable, and secure alternative for managing infrastructure as code. This addition caters to organizations requiring robust transactional guarantees and large object support, enhancing the traditional DIY backends that rely on object storage systems like AWS S3 or Google Cloud Storage. Developed through a community-driven process, the PostgreSQL backend integrates with Pulumi's existing architecture, providing features like ACID compliance, deep observability, and performance optimizations while maintaining Pulumi's simplicity. Although it requires additional operational overhead, it addresses a longstanding community request and aligns with Pulumi’s architectural patterns and coding standards. The PostgreSQL option enhances Pulumi's offerings, providing enterprises with enterprise-grade state storage while enabling future enhancements such as high availability, performance optimizations, and multi-tenant support.

Pulumi has introduced support for Customer-Managed Keys (CMKs) in Pulumi ESC, allowing organizations to control the encryption of their secrets and state, which is crucial for meeting compliance standards such as HIPAA, GDPR, and FedRAMP. This feature enables customers to use their own keys for encryption, giving them control over key lifecycle, revocation, audit trails, and rotation policies while maintaining transparency for secret consumers. The integration with Pulumi Cloud Organizations ensures that all existing data keys are re-encrypted with CMKs, and the setup process is straightforward, involving the creation and configuration of a KMS key in an AWS account. Currently available for Pulumi Enterprise or Business Critical plans, the feature supports AWS KMS, with plans to expand support to other cloud providers like Azure Key Vault and Google Cloud KMS. Pulumi encourages user feedback through various channels as they continue to develop this feature.

Platform engineering addresses the challenges of governance in scaling organizations by transforming it from a manual, bureaucratic process into an automated, built-in feature that ensures compliance, consistency, and cost control while maintaining team autonomy and agility. As platforms scale, organizations face difficulties in balancing team autonomy with governance, leading to compliance risks, unpredictable costs, and reduced innovation. By embedding governance directly into the platform, policies can be enforced automatically using policy-as-code, role-based access control (RBAC), audit logs, and drift detection, thereby reducing the need for manual compliance checks and enhancing real-time visibility and traceability. Resource lifecycle and deployment controls ensure efficient resource usage and responsible scaling. Pulumi's governance features, such as CrossGuard and RBAC, exemplify how platforms can maintain control and empower engineering teams to innovate safely. The approach allows for a scalable, least-privilege model that integrates compliance and control without hindering operational speed, thereby supporting organizations to innovate confidently at scale.

Observability is highlighted as a crucial component in platform engineering, transforming how engineering teams manage and optimize their systems by providing actionable insights and eliminating infrastructure chaos. The article emphasizes that effective observability allows teams to move from reactive firefighting to proactive innovation by embedding visibility, context, and guidance into platforms. It addresses common challenges like tool sprawl, alert fatigue, and reactive debugging, suggesting solutions such as centralized service dashboards, actionable alerts, and built-in instrumentation. These solutions aim to reduce time spent on troubleshooting and enhance team productivity and satisfaction. The integration of AI and natural-language querying further enriches observability, enabling rapid problem identification and resolution. Tools like Pulumi are mentioned for their capabilities in enhancing observability through features like Pulumi Insights and AI-powered troubleshooting. The goal is to create a coherent, efficient environment where engineers can easily navigate, interpret, and act upon system data, thus fostering innovation and reliability.

Pulumi has introduced Identity and Access Management (IAM) to enhance security in cloud development by integrating fine-grained authorization directly into the development lifecycle. This new capability aims to allow rapid and frequent deployments without compromising security or compliance. Pulumi IAM is being rolled out in phases, beginning with the release of Granular Access Tokens and Custom Roles, which enable organizations to define precise permissions and roles for secure automation. Future phases will include advanced features like Attribute-Based Access Control and user/team role assignments. The IAM system supports the Zero Trust security model, focusing on least privilege enforcement and minimizing risks associated with over-privileged accounts. Available now for Pulumi Enterprise and Business Critical tiers, the IAM features are designed to provide scalable governance while maintaining development velocity. Pulumi encourages users to explore these new security features to enhance compliance and secure their cloud environments effectively.

Daniel Ward, a Software Developer/Consultant at Lean TECHniques and Microsoft MVP, shares insights into transforming infrastructure management by moving from configuration chaos to using programming languages like C# for infrastructure as code, advocating for tools like Pulumi over YAML for complex systems. He emphasizes the importance of gradual change, recommending the 10% rule to avoid overwhelming teams and ensuring sustainable transformation. Ward highlights strategies like quantifying the cost of inaction to overcome resistance, building consensus through "nemawashi" conversations, and driving viral adoption by demonstrating early wins. He argues that infrastructure as code aligns development and operations teams, suggesting platform engineering as a solution for creating reusable components and enhancing efficiency. Ward criticizes the limitations of configuration languages like YAML, advocating for the flexibility of programming languages, and highlights Pulumi's ability to offer both code-first and declarative infrastructure management, making it a preferred choice for scalable and maintainable infrastructure solutions.