Pulumi Deployments

Pulumi Deployments represents a fundamental shift in how infrastructure as code is executed, transitioning from local, developer-centric execution to a managed, deployment-as-a-service model. At its core, Pulumi Deployments is a managed service designed to execute critical Pulumi operations—specifically pulumi up, pulumi preview, pulumi refresh, and pulumi destroy—on remote compute resources rather than on a developer's local workstation. By decoupling the execution of infrastructure changes from the local environment, the service enables a paradigm where the configuration of how a stack is deployed is established once, and the Pulumi Cloud subsequently handles the execution of those operations. This execution can be triggered through various mechanisms, including on-demand requests, responses to version control system events, pre-defined schedules, or through a dedicated REST API.

The architectural necessity for Pulumi Deployments arises from the inherent volatility and security risks associated with running infrastructure updates from local machines or through manually constructed CI pipelines. In traditional local-execution workflows, every individual engineer is required to maintain active cloud credentials on their personal hardware, which increases the attack surface for credential theft. Furthermore, the local toolchain must be meticulously installed and version-pinned across all participating team members to ensure that the same code produces the same result. Without a centralized execution environment, there is no shared, immutable record of which operations were executed, when they occurred, or which identity initiated the change.

To resolve these systemic issues, Pulumi Deployments migrates the execution workload into a managed, isolated environment. This environment is pre-provisioned with the Pulumi CLI and the necessary language runtimes, eliminating the "it works on my machine" inconsistency. Security is fundamentally enhanced through the integration of Pulumi ESC and OIDC, which ensures that cloud credentials and secrets are supplied dynamically to the deployment environment rather than persisting on laptops or within static pipeline configuration files. Consequently, every deployment run is systematically recorded within Pulumi Cloud, providing an audit trail that is essential for governance and compliance in enterprise environments.

Core Operational Capabilities

Pulumi Deployments is designed to automate and scale the running of Pulumi applications within a secure hosting environment. This automation allows for the provisioning of infrastructure at a scale that is significantly larger than what is possible with manual CLI-driven processes. Specifically, the service is built upon the same underlying technology as the Pulumi Automation API, which enables organizations to manage up to 10x more cloud infrastructure resources per engineer compared to other infrastructure-as-code tools.

The operational scope of Pulumi Deployments covers several critical Pulumi CLI commands:

• pulumi up: This operation is remotely executed to update the infrastructure to match the desired state defined in the code.
• pulumi preview: This allows users to see the planned changes before they are applied to the live environment.
• pulumi refresh: This operation synchronizes the Pulumi state with the actual state of the cloud provider.
• pulumi destroy: This removes all resources associated with a specific stack.

The ability to execute these commands via a managed service means that users are no longer tethered to a command-line interface for deployment. Instead, they can trigger infrastructure updates through a button click in the Pulumi console, a git push to a connected repository, or an API call.

Deployment Triggers and Execution Logic

A key strength of Pulumi Deployments is the variety of triggers available to initiate infrastructure operations. These triggers allow for the creation of highly responsive and automated deployment pipelines.

• Click to Deploy: This allows users to manually initiate a deployment from the Pulumi console, providing a simple interface for those who may not want to interact with the CLI or API.
• Git Push to Deploy: This feature integrates directly with version control systems. When a user adds and pushes a commit to a Git repository, Pulumi Deployments can automatically trigger a deployment, ensuring that the deployed infrastructure is always in sync with the latest version of the code.
• REST API: For advanced automation and integration with other business logic, Pulumi provides a REST API that can trigger deployments programmatically.
• Webhooks: Webhooks enable the notification of external systems or the triggering of subsequent stacks in response to specific events within a Pulumi organization.
• Scheduled Operations: This allows for any Pulumi operation to be run on a recurring schedule, which is useful for routine maintenance or periodic state synchronization.

Configuration and Environment Management

To ensure consistency, a stack's deployment settings capture all the necessary components required for a run. This ensures that the deployment behaves identically regardless of the trigger used.

The deployment settings include:

• Source Location: The specific location of the code, such as a GitHub repository and branch.
• Credentials: The cloud provider secrets required to authenticate with the cloud service.
• Environment Variables: Custom variables needed by the application at runtime.
• Path and Tag Filters: Specific configurations to refine how the deployment is targeted.
• Runner Pool: The selection of compute resources that will execute the code.

The management of these settings is integrated with Pulumi ESC (Environment Secrets Configuration) and OIDC (OpenID Connect), moving secret management away from local .env files or CI provider secrets and into a centralized, secure system.

Compute Infrastructure for Deployments

Pulumi Deployments provides flexibility in where the actual compute for the deployment occurs, catering to different security and performance requirements.

• Pulumi-managed runners: These are the default compute resources provided by Pulumi. They include a pre-configured hardware set and an image that contains the Pulumi CLI and various language runtimes.
• Customer-managed runners: For organizations with strict regulatory requirements or specific hardware needs, Pulumi allows the self-hosting of compute on the customer's own infrastructure.

Specialized Stack Types and Governance

Beyond standard deployments, Pulumi Deployments introduces specialized stack behaviors to handle the modern software development lifecycle, specifically for testing and ephemeral environments.

• Review Stacks: These are ephemeral environments that are automatically stood up for each pull request. Once the pull request is closed, the environment is automatically torn down, reducing cloud spend and preventing the accumulation of orphaned resources.
• TTL Stacks: This feature allows for the automatic destruction of a stack at a set time. This is ideal for temporary environments where a fixed lifespan is required.
• Drift Detection: This critical governance feature detects when the actual deployed infrastructure no longer matches the desired state defined in the Pulumi program. Pulumi Deployments can optionally remediate this drift on a scheduled basis, ensuring the environment remains compliant with the source code.

Integration and Setup Workflow

Implementing Pulumi Deployments involves a structured sequence of steps to connect the code repository to the Pulumi Cloud execution environment.

Prerequisites for Implementation

Before initiating a deployment, the following components must be available:

• A Pulumi account.
• Pulumi CLI installed locally.
• Pulumi Deployment preview access.
• Python version 3.9 or higher.
• A valid account with a cloud provider such as AWS, Azure, or Google Cloud.
• The corresponding cloud provider CLI (e.g., AWS CLI, Azure CLI, or Google Cloud CLI).
• A GitHub account.

Project Creation and Configuration

The initial setup begins in the Pulumi service console:

1. Navigate to app.pulumi.com and log in.
2. Select "Stacks" from the left navigation menu.
3. Select "Create Project".
4. Define the cloud provider to be used.
5. Choose the preferred programming language.
6. Select the appropriate template for the project.

Connecting Version Control

To enable the automated "Git Push to Deploy" functionality, the Pulumi GitHub integration must be installed. During the installation process, the user is prompted to provide several configuration details:

• The specific organization and GitHub repository to be linked.
• The branch that should trigger the deployment.
• The directory within the repository where the Pulumi code resides.
• Environment Variables: This is where cloud credentials must be provided. For instance, when using AWS, the user must provide AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN.

Executing and Verifying the Deployment

Once the connection is established, the deployment is triggered through the Pulumi console:

1. Select the "Actions" button.
2. Choose "Update and Deploy".
3. Navigate to the "Actions" tab to monitor the progress.
4. Review the deployment log for detailed information about the process.
5. Verify the results by copying the endpoint URL from the output section of the deployment log and testing the live infrastructure.

To clean up the environment and avoid unnecessary costs, users can execute the following command:

pulumi destroy -y

Comparative Analysis of Execution Models

The following table compares the traditional local/CI execution model against the Pulumi Deployments managed model.

Technical Analysis of Managed CI/CD Logic

Pulumi Deployments functions as Pulumi Cloud's managed CI/CD service, specifically designed to close the governance and auditability gap that exists when using the Pulumi CLI in isolation. By moving the pulumi up operation into the cloud, Pulumi eliminates the need for self-hosted runners, which often require significant maintenance and security patching.

The system incorporates resource-level output capture, which allows engineers to see exactly what was created or modified within the deployment history. This is a significant improvement over standard CI logs, which often bury critical output data in thousands of lines of text.

Furthermore, for teams migrating from other tools, Pulumi Cloud can serve as a remote state backend for existing Terraform and OpenTofu projects. This allows organizations to consolidate their state management within the Pulumi ecosystem without the immediate need to rewrite all their HCL (HashiCorp Configuration Language) code. While the conversion from HCL to Pulumi is supported, and the system handles providers, variables, outputs, and most resource dependencies, complex for_each expressions and dynamic blocks may still require manual cleanup after the conversion process.

Conclusion

Pulumi Deployments transforms the infrastructure-as-code lifecycle by abstracting the complexities of the execution environment and centering the process on a managed, scalable service. By integrating features such as OIDC for secure credential handling, drift detection for governance, and ephemeral "Review Stacks" for CI/CD efficiency, it addresses the primary pain points of traditional infrastructure deployment. The shift from a developer-centric execution model to a service-centric model allows for a massive increase in resource management capacity, enabling a single engineer to manage up to ten times the amount of infrastructure they could with standard tools. This managed approach not only enhances security by removing secrets from local machines but also ensures an immutable audit trail and consistent deployment behavior across all environments.

Sources

1. Pulumi Deployments Documentation
2. Pulumi Deployments Concepts
3. Overview of Pulumi Deployments and its Challenge
4. What is Pulumi and How to Use it with env0