Terraform vs Pulumi — Which IaC Tool Should You Choose? (2026)

# variables.tf
variable "domain_name" {
  type    = string
  default = "myapp.com"
}
 
variable "aws_region" {
  type    = string
  default = "us-east-1"
}

# main.tf
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
  backend "s3" {
    bucket = "my-terraform-state"
    key    = "prod/terraform.tfstate"
    region = "us-east-1"
  }
}
 
provider "aws" {
  region = var.aws_region
}
 
# S3 bucket for static website
resource "aws_s3_bucket" "website" {
  bucket = var.domain_name
}
 
resource "aws_s3_bucket_public_access_block" "website" {
  bucket = aws_s3_bucket.website.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}
 
# CloudFront distribution
resource "aws_cloudfront_distribution" "cdn" {
  origin {
    domain_name              = aws_s3_bucket.website.bucket_regional_domain_name
    origin_id                = "S3-${var.domain_name}"
    origin_access_control_id = aws_cloudfront_origin_access_control.oac.id
  }
 
  enabled             = true
  default_root_object = "index.html"
 
  default_cache_behavior {
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    target_origin_id       = "S3-${var.domain_name}"
    viewer_protocol_policy = "redirect-to-https"
 
    forwarded_values {
      query_string = false
      cookies { forward = "none" }
    }
 
    min_ttl     = 0
    default_ttl = 86400
    max_ttl     = 31536000
  }
 
  viewer_certificate {
    acm_certificate_arn = aws_acm_certificate.cert.arn
    ssl_support_method  = "sni-only"
  }
 
  restrictions {
    geo_restriction { restriction_type = "none" }
  }
}

# Initialize — download providers and configure backend
terraform init
 
# Preview changes (like a dry run)
terraform plan -out=tfplan
 
# Apply the plan
terraform apply tfplan
 
# Destroy all resources
terraform destroy
 
# Show current state
terraform show
terraform state list
 
# Import existing resource into state
terraform import aws_s3_bucket.website my-existing-bucket

# modules/eks-cluster/main.tf
resource "aws_eks_cluster" "this" {
  name     = var.cluster_name
  role_arn = aws_iam_role.cluster.arn
  version  = var.kubernetes_version
 
  vpc_config {
    subnet_ids              = var.subnet_ids
    endpoint_private_access = true
    endpoint_public_access  = var.public_access
  }
}
 
# Using the module
module "production_cluster" {
  source = "./modules/eks-cluster"
 
  cluster_name        = "prod-cluster"
  kubernetes_version  = "1.31"
  subnet_ids          = module.vpc.private_subnet_ids
  public_access       = false
}

import * as aws from "@pulumi/aws";
import * as pulumi from "@pulumi/pulumi";
 
const config = new pulumi.Config();
const domainName = config.require("domainName");
 
// S3 bucket
const bucket = new aws.s3.Bucket("website", {
  bucket: domainName,
});
 
const oac = new aws.cloudfront.OriginAccessControl("oac", {
  originAccessControlOriginType: "s3",
  signingBehavior: "always",
  signingProtocol: "sigv4",
});
 
// CloudFront distribution
const distribution = new aws.cloudfront.Distribution("cdn", {
  origins: [{
    domainName: bucket.bucketRegionalDomainName,
    originId: `S3-${domainName}`,
    originAccessControlId: oac.id,
  }],
  enabled: true,
  defaultRootObject: "index.html",
  defaultCacheBehavior: {
    allowedMethods: ["GET", "HEAD"],
    cachedMethods: ["GET", "HEAD"],
    targetOriginId: `S3-${domainName}`,
    viewerProtocolPolicy: "redirect-to-https",
    forwardedValues: {
      queryString: false,
      cookies: { forward: "none" },
    },
  },
  viewerCertificate: {
    cloudfrontDefaultCertificate: true,
  },
  restrictions: {
    geoRestriction: { restrictionType: "none" },
  },
});
 
export const distributionUrl = distribution.domainName;
export const bucketName = bucket.bucket;

# Create new project
pulumi new aws-typescript
 
# Preview changes
pulumi preview
 
# Apply changes
pulumi up
 
# Destroy
pulumi destroy
 
# View stack outputs
pulumi stack output
 
# Manage secrets
pulumi config set --secret dbPassword "mypassword"

# In Terraform, this requires count or for_each with flat maps
resource "aws_s3_bucket" "buckets" {
  for_each = toset(["logs", "assets", "backups", "exports", "archives"])
  bucket   = "myapp-${each.key}-${var.environment}"
}
# Complex conditional logic gets very messy in HCL

const bucketConfigs = [
  { name: "logs",     versioning: false, lifecycle: 30  },
  { name: "assets",   versioning: true,  lifecycle: 365 },
  { name: "backups",  versioning: true,  lifecycle: 90  },
  { name: "exports",  versioning: false, lifecycle: 7   },
  { name: "archives", versioning: true,  lifecycle: 730 },
];
 
const buckets = bucketConfigs.map(cfg => {
  const bucket = new aws.s3.Bucket(`bucket-${cfg.name}`, {
    bucket: `myapp-${cfg.name}-${stack}`,
  });
 
  if (cfg.versioning) {
    new aws.s3.BucketVersioningV2(`versioning-${cfg.name}`, {
      bucket: bucket.id,
      versioningConfiguration: { status: "Enabled" },
    });
  }
 
  new aws.s3.BucketLifecycleConfigurationV2(`lifecycle-${cfg.name}`, {
    bucket: bucket.id,
    rules: [{
      id: "expire-objects",
      status: "Enabled",
      expiration: { days: cfg.lifecycle },
    }],
  });
 
  return bucket;
});

# This is painful in HCL — nested conditionals and dynamic blocks
resource "aws_security_group_rule" "ingress" {
  for_each = {
    for rule in var.ingress_rules :
    "${rule.port}-${rule.protocol}" => rule
    if rule.enabled == true
  }
 
  type              = "ingress"
  from_port         = each.value.port
  to_port           = each.value.port
  protocol          = each.value.protocol
  cidr_blocks       = each.value.cidr_blocks
  security_group_id = aws_security_group.main.id
}
# This is already at the edge of readable HCL

# Common state file problems:
# - State lock conflicts in teams
# - Drift between state and real infrastructure
# - State corruption during interrupted applies
# - "Backend not initialized" errors
 
# Have to manually fix state often:
terraform state rm aws_instance.old
terraform state mv aws_s3_bucket.old aws_s3_bucket.new

# OpenTofu is a drop-in replacement for terraform CLI
tofu init
tofu plan
tofu apply
 
# 100% compatible with existing .tf files

module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 20.0"
 
  cluster_name    = "production"
  cluster_version = "1.31"
 
  vpc_id     = module.vpc.vpc_id
  subnet_ids = module.vpc.private_subnets
 
  eks_managed_node_groups = {
    workers = {
      instance_types = ["m5.xlarge"]
      min_size       = 2
      max_size       = 10
      desired_size   = 3
    }
  }
}

import * as eks from "@pulumi/eks";
 
const cluster = new eks.Cluster("production", {
  vpcId: vpc.id,
  subnetIds: vpc.privateSubnetIds,
  instanceType: "m5.xlarge",
  minSize: 2,
  maxSize: 10,
  desiredCapacity: 3,
  version: "1.31",
});
 
export const kubeconfig = cluster.kubeconfig;

# Install
brew install terraform  # macOS
# or: https://developer.hashicorp.com/terraform/downloads
 
# Create your first config
mkdir my-infra && cd my-infra
cat > main.tf << 'EOF'
provider "aws" { region = "us-east-1" }
resource "aws_s3_bucket" "test" { bucket = "my-test-bucket-12345" }
EOF
 
terraform init && terraform plan

# Install
brew install pulumi  # macOS
 
# Create TypeScript project
mkdir my-pulumi && cd my-pulumi
pulumi new aws-typescript
 
# Preview
pulumi preview