Terraform vs Pulumi vs AWS CDK: IaC Tool Comparison

# Terraform VPC with subnets
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = {
    Name        = "main-vpc"
    Environment = var.environment
  }
}

resource "aws_subnet" "private" {
  count           = length(var.availability_zones)
  vpc_id          = aws_vpc.main.id
  cidr_block      = cidrsubnet(aws_vpc.main.cidr_block, 8, count.index)
  availability_zone = var.availability_zones[count.index]

  tags = {
    Name = "private-subnet-${count.index + 1}"
    Type = "Private"
  }
}

# Pulumi VPC with dynamic subnet creation
import pulumi
import pulumi_aws as aws

# Create VPC with automatic subnet calculation
vpc = aws.ec2.Vpc("main-vpc",
    cidr_block="10.0.0.0/16",
    enable_dns_hostnames=True,
    enable_dns_support=True,
    tags={"Name": "main-vpc", "Environment": pulumi.get_stack()})

# Dynamic subnet creation using Python loops
availability_zones = aws.get_availability_zones().names
private_subnets = []

for i, az in enumerate(availability_zones[:3]):
    subnet = aws.ec2.Subnet(f"private-subnet-{i}",
        vpc_id=vpc.id,
        cidr_block=f"10.0.{i+1}.0/24",
        availability_zone=az,
        tags={"Name": f"private-subnet-{i+1}", "Type": "Private"})
    private_subnets.append(subnet)

// AWS CDK with high-level constructs
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as cdk from 'aws-cdk-lib';

export class NetworkStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // VPC with automatic subnet distribution
    const vpc = new ec2.Vpc(this, 'MainVpc', {
      maxAzs: 3,
      cidr: '10.0.0.0/16',
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: 'Private',
          subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
        },
        {
          cidrMask: 24,
          name: 'Public',
          subnetType: ec2.SubnetType.PUBLIC,
        }
      ]
    });
  }
}

# Terraform development cycle
terraform init
terraform plan -var-file="production.tfvars"
terraform apply -auto-approve
terraform state list
terraform destroy

# Pulumi development cycle
pulumi new aws-python
pulumi config set aws:region us-west-2
pulumi preview
pulumi up --yes
pulumi stack output

# CDK development cycle
cdk init app --language typescript
npm install @aws-cdk/aws-ec2
cdk synth
cdk diff
cdk deploy --require-approval never

# Terraform provider variety
terraform init
  - hashicorp/aws v5.0
  - hashicorp/azurerm v3.5
  - hashicorp/google v4.8
  - kubernetes/kubernetes v2.2
  - datadog/datadog v3.3

# Pulumi multi-cloud deployment
import pulumi_aws as aws
import pulumi_azure as azure
import pulumi_gcp as gcp

# Deploy across multiple clouds
aws_instance = aws.ec2.Instance("web-aws", ...)
azure_vm = azure.compute.VirtualMachine("web-azure", ...)
gcp_instance = gcp.compute.Instance("web-gcp", ...)

// CDK with AWS focus but cross-account support
import * as aws from 'aws-cdk-lib';

const prodAccount = new aws.Environment({
  account: '123456789012',
  region: 'us-east-1'
});

terraform {
  backend "s3" {
    bucket         = "company-terraform-state"
    key            = "environments/production/terraform.tfstate"
    region         = "us-west-2"
    encrypt        = true
    dynamodb_table = "terraform-locks"
  }
}

# Pulumi.yaml configuration
name: infrastructure
runtime: python
description: Company infrastructure

backend:
  url: s3://company-pulumi-state
  # or use Pulumi Service: app.pulumi.com

// CDK automatically manages state via CloudFormation
export class ProductionStack extends Stack {
  constructor(scope: Construct, id: string) {
    super(scope, id, {
      env: { region: 'us-west-2' },
      terminationProtection: true  // Prevent accidental deletion
    });
  }
}

# Pulumi CrossGuard policy
from pulumi_policy import (
    EnforcementLevel,
    PolicyPack,
    ResourceValidationPolicy,
)

def s3_bucket_encryption_validator(args, report_violation):
    if args.resource_type == "aws:s3/bucket:Bucket":
        encryption = args.props.get("serverSideEncryptionConfiguration")
        if not encryption:
            report_violation("S3 buckets must have encryption enabled")

PolicyPack(
    name="security-policies",
    enforcement_level=EnforcementLevel.MANDATORY,
    policies=[
        ResourceValidationPolicy(
            name="s3-encryption-required",
            description="S3 buckets must have encryption",
            validate=s3_bucket_encryption_validator,
        ),
    ],
)

# Convert Terraform resources to Pulumi
# terraform import aws_instance.web i-1234567890abcdef0
web_server = aws.ec2.Instance("web",
    instance_type="t3.micro",
    ami="ami-0c02fb55956c7d316",
    opts=pulumi.ResourceOptions(import_="i-1234567890abcdef0"))

# Export CDK CloudFormation for analysis
cdk synth > infrastructure.json
# Use tools like former2 or terraformer for conversion

# GitHub Actions with Terraform
name: Infrastructure Deploy
on: [push]
jobs:
  terraform:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - uses: hashicorp/setup-terraform@v2
    - run: terraform init
    - run: terraform plan
    - run: terraform apply -auto-approve

# GitHub Actions with Pulumi
name: Pulumi Deploy
on: [push]
jobs:
  pulumi:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - uses: pulumi/actions@v4
      with:
        command: up
        stack-name: production
      env:
        PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}