How We Used Pulumi to Safely Migrate Oso's Global Infrastructure

Infrastructure as Code (IaC) tools like Pulumi can provide significant advantages when used correctly, ensuring both leverage and safety in infrastructure management. Oso, which offers Authorization as a Service, faced a complex infrastructure migration due to rapid growth necessitating a shift from Amazon ECS Fargate to self-managed EC2 instances. The key to a successful migration involved understanding how to safely modify infrastructure, writing reusable and predictable Pulumi code, and performing zero-diff refactors to ensure no unintended changes. Pulumi’s programming model involves a global state where resources are registered, making it vital to write code that is aware of these side effects. By utilizing snapshot testing and zero-diff refactors, Oso managed to transition without downtime, despite numerous challenges. The experience underscores the importance of leveraging IaC tools effectively to benefit from their potential while maintaining system stability.