Terraform or Pulumi: What Actually Matters for Pipeline Infra

Terraform uses its own declarative configuration language, HCL, purpose-built for infrastructure definitions, with a large existing module ecosystem and broad provider support. Pulumi lets you write infrastructure definitions in a general-purpose language like TypeScript or Python, which means your existing testing and code-review tooling for application code applies more directly, at the cost of a steeper learning curve for team members who aren't already comfortable in that language.

For a small engineering team, the tool your engineers can already read and review competently is usually the more important factor than a feature-by-feature comparison. A team of backend engineers fluent in TypeScript may move faster and catch more mistakes in code review with Pulumi. A team already comfortable with HCL and a large existing Terraform module library may find switching costs outweigh any marginal benefit. Neither tool is a wrong choice on its own merits.

Both tools maintain a state file representing what they believe is deployed, and both break down the same way when someone makes a manual change directly in the cloud console that the state file doesn't know about. The next apply either reverts that manual change unexpectedly or fails outright. Lock down console access for anything managed by IaC, or at minimum require that any manual emergency change gets reconciled back into code within a defined window, not left as permanent drift.

Reviewing the code change in a pull request isn't the same as reviewing what that change will actually do to running infrastructure. Require the plan or preview output, the tool's explicit list of what will be created, changed, or destroyed, to be visible in the pull request itself, not just run locally by whoever wrote the change. A plan that shows an unexpected resource destruction is exactly the kind of thing a reviewer needs to see before approval, not discover after apply.

Platforms like Vanta or Drata can pull evidence directly from your cloud state and pipeline logs once infrastructure is defined as code, which is useful for turning your IaC-managed setup into auditor-ready evidence without an engineer manually assembling a report. What they don't replace is policy-as-code checks inside the pipeline itself, catching a misconfigured resource before it's ever applied. Federal remediation guidance treats a critical, internet-accessible vulnerability as needing a fix within 15 days¹; a misconfigured resource caught by a policy check before apply never has to enter that remediation clock at all, which is a stronger outcome than catching it after the fact.

Both tools let you pull in shared modules or packages, community-maintained or your own, and an unpinned dependency on a module can change what a routine apply does without a corresponding code change anyone reviewed. Pin module and provider versions explicitly, and treat a version bump as its own reviewable change with its own plan output, the same way you'd review a change to your own configuration. An apply that behaves differently because an unpinned upstream module changed underneath you is a genuinely confusing incident to debug after the fact.

This applies just as much to your own internal shared modules as to community ones. A shared networking or IAM module used across several projects, updated without a version bump, can silently change behavior everywhere it's referenced at once, which is a wider blast radius than most teams expect from what looks like a small internal change.

Governance habits that apply to either tool:

• Console access is locked down for IaC-managed resources, and emergency manual changes are reconciled back into code within a defined window.
• The plan or preview output appears in the pull request itself, not only on the author's machine.
• Module and provider versions are pinned, and each version bump gets its own reviewable plan.
• Policy-as-code checks catch a misconfigured resource inside the pipeline before it is applied.
• A compliance platform pulls audit evidence from the IaC-managed state after the fact, without replacing those checks.