Comprehensive IaC comparison: Terraform vs Pulumi vs CloudFormation

Comprehensive IaC comparison: Terraform vs Pulumi vs CloudFormation

·

7 min read

AWS CloudFormation, Pulumi, and Terraform are the most popular IaC options cloud developers use to provision AWS cloud resources. Like most stack choices, picking the right tool comes down to the resources and services you require, the support you’re looking for, and the price you’re willing to pay.

AWS CloudFormation and Terraform are mature and widely adopted systems, whereas Pulumi, a relatively new entrant, brings additional features and takes a comprehensive approach to cloud engineering. We compared the tools based on features and the user experience, so you can pick the one that suits you the best.

How does IaC help my startup?

As a startup, being agile is often the top priority. From having lean teams to using open-source and free dev tools, it’s all about moving fast. One thing that is often overlooked and yet takes a considerable chunk of your dev team’s time is infra overheads. Replicating infra and having clear visibility into what is running at any point in time is essential. Setting up an infrastructure that meets your customer's needs, is reliable, and can be scaled takes a lot of effort. This valuable time is taken away from developing your core application.

We compare AWS CloudFormation and Terraform based on their core offerings, developer experience, integrations and extensibility, testing and deployment, and pricing.

Core features

Provisioning infra as code is the common goal among these tools. Here’s how they do it differently. Understanding their state management, what configuration languages are supported, and what makes them unique are the first steps in getting to know these tools.

AWS CloudFormationTerraformPulumi
State managementNo state fileSelf-managed (local, remote)/ managedSelf-managed / Pulumi Service
LanguageJSON / YAMLJSON / HCLPython, Java, Node.js, Go, or .NET Core
ParadigmDeclarativeDeclarativeImperative code turned into a declarative graph
AWS Features supportSupports most new AWS services at launchOften supports new AWS services fasterSupports all AWS services
Multi cloud supportAWS OnlyAll public clouds, other resources. Often supports new AWS services fasterSupports all AWS services
Unique feature(s)CloudFormation designer, more languages using AWS CDKProvision of third-party and custom appsRemote deployments, automation API, Policy as code, secret encryption

Developer experience

The three IaC tools have ecosystems of varying maturity. This also can be seen in the type and number of resources covered. Things like time to learn, modularity, and secret management can be seen below.

AWS CloudFormationTerraformPulumi
Ease of use/learning curveVery easy. Similar to other AWS tools. The designer makes it visualVery easy. Human readable HCL, multi-cloud, and 3p supportExtremely easy. Use familiar languages, integrates with existing CI/CD
ModularityYes, nested stacks with automatic dependency managementYes, modules, automatic and manualYes, class, function, or package, in Pulumi files
Integrated loggingYesYesYes
Resource coverageAll AWS and 3rd party AWS vendorsAWS, GCP, Azure, k8s, & 100s moreAWS, GCP, Azure, k8s, ~60 more
CommunityActive community. 7,600 Qs on StackoverflowA mature tool with a massive community. 15,275 Qs Stackoverflow.Yes, active. 379 Qs on Stackoverflow.
Existing templatesCloudFormation registryTerraform registryPulumi registry
Secret managementYes. Use secret as a resource.No. Managed using another product, Vault.Yes. Secrets are encrypted in transit and in the state file.
SupportIncluded with AWS supportPaid 24x7 enterprise supportPaid for enterprise and critical
Target userDevOps EngineerDevOps EngineerPlatform Engineer
When to avoidStaying away from vendor lock-in. Need to deploy multiple cloud resources.If you have dynamically changing environments and items like IAM users. Need secure storage of sensitive info like secrets.If you plan to use the latest functionalities from cloud providers.

Integrations and extensibility

IaC templates are the blueprints of your infra; thus, having extensibility is vital to support third-party and dynamically add custom resource types. We also see how soon they support new AWS resources and services.

AWS CloudFormationTerraformPulumi
ExtensibilityLimited to AWS resources and services.Yes. Providers are extensible.Dynamic providers for a custom resource type
Resource coverageAll AWS, 3rd partyAWS, GCP, Azure, k8s, & 100s moreAWS, GCP, Azure, k8s, ~60 more
AWS Features supportSupports most new AWS services at launchOften supports new AWS services fasterSupports all AWS resources
Latest version10 Nov 2022v1.3.43.46.1
Application CodeWith AWS CodeDeploy2Limited. Use TF’s Go as a package in your applicationFully embed Pulumi with Automation API

Testing and deploying

IaC tools simplify testing and can be deployed quickly with your existing CI/CD pipelines. Tools like AWS CloudFormation also offer automatic and manual rollback capabilities.

AWS CloudFormationTerraformPulumi
TestingTaskCat custom testing pipelineIntegration testing support. 3rd party tools Terratest, Kitchen-TerraformExternal automated tests
Policy as codeYesYesYes
Rollback capabilityYes, automatic & manualYes, manualYes, manual
CI/CD integrationTaskCat, CodePipelineGitHub Actions and CircleCIAWS Code Services, Jenkins, CircleCI, and more

Pricing

Pricing is often the most important decision factor for most startups. Here’s how they compare. They all offer paid support and enterprise version with additional features which can come in handy as your startup scales. Terraform is often the better choice for enterprise teams.

AWS CloudFormationTerraformPulumi
CostFree tier*Free*, Open-sourceFree-tier, and Open-source
Free versionYes, up to 1,000 handler operations/mo/accYes. (OSS)Yes. Individual, free credits, & open-source.
SupportIncluded with AWS supportPaid 24x7 enterprise supportPaid for enterprise and critical
Enterprise versionYesTerraform Cloud, with additional collaboration and governanceYes, with SSO, RBAC, and improved support.

*Though the tools are free to use, the resources provisioned will cost you money. Spend less by leveraging the 100+ AWS services in their free tier.

Here’s the ultimate list of AWS free credit deals for your startup.

Deploying AWS resources using IaC

To give you an idea of what the code looks like, we have examples of deploying an S3 bucket using AWS CloudFormation, Terraform, and Pulumi.

S3 bucket using AWS CloudFormation

As the only platform-specific tool on the list, AWS CloudFormation is limited deploying AWS resources. Almost all AWS CloudFormation functionality can also be achieved using their UI.

AWSTemplateFormatVersion: "2010-09-09"
Description: Simple cloud formation for bucket creation and configuration

Resources:
  S3Bucket:
    Type: 'AWS::S3::Bucket'
    DeletionPolicy: Retain
    Properties:
      BucketName: my-bucke
            VersioningConfiguration:
        Status: Enabled

S3 bucket using Terraform

Terraform uses the Hashicorp Configuration Language, which is very intuitive to use. There is also excellent documentation available for all the AWS resources.

resource "aws_s3_bucket" "my-bucket" {
   bucket = "test-s3"
   acl = "private"
   versioning {
      enabled = true
   }
   tags = {
     Name = "My bucket"
     Environment = "Dev"
   }
}

S3 bucket using Pulumi

Pulumi’s packages make it easy to create and manage an s3 bucket easily and in the language of your preference. The below example shows the code in YAML format.

resources:
  bucket: test-s3
    type: aws:s3:Bucket
    properties:
      acl: private
      tags:
        Environment: Dev
        Name: My bucket

Further reading

Here are some informative articles that touch on this topic.

  1. https://www.cncf.io/blog/2021/04/06/cloudformation-vs-terraform-which-is-better/

  2. https://cloudonaut.io/cloudformation-vs-terraform/

  3. https://thenewstack.io/terraform-vs-cloudformation-which-is-better-for-you/

  4. https://www.pulumi.com/docs/intro/vs/cloud-templates/cloudformation/

  5. https://www.pulumi.com/docs/intro/vs/terraform/