Bring your Terraform estate into the agentic era. At Pulumi, Pulumi is building the platform for agentic infrastructure. Pulumi Cloud provides the guardrails and enterprise readiness needed to safely move fast in this new era. While Pulumi is seeing extraordinary adoption - over 40% of its users now manage infrastructure using AI agents - Pulumi know many organizations are at different phases in their AI journey and have to balance building for the future with maintaining their existing infrastructure as code (IaC) solutions like Terraform. Today, Pulumi is launching three ways that Pulumi lets you avoid trading off building for the future against building for today. You don't have to rip out Terraform to enter the agentic era. Pulumi Cloud brings agentic infrastructure to the IaC estate you already have. What Pulumi is shipping today. Last December, its CEO Joe Duffy laid out his vision to make Pulumi the platform for all of your infrastructure as code. The capabilities Pulumi is launching today make that promise a reality. Pulumi is now fully interoperable with Terraform and OpenTofu and enables organizations to build upon their existing IaC estate rather than starting from scratch as they work toward the agentic infrastructure future. Pulumi Cloud as a Terraform backend. Pulumi is excited to announce the general availability of Pulumi Cloud as the backend to your Terraform state, enabling organizations to seamlessly lift and shift their existing Terraform estates. Pulumi recognize there is lots of infrastructure that works as is, and switching over to a new management paradigm may not always be possible. Pulumi Cloud support for the Terraform state backend lets organizations maintain their existing Terraform deployment patterns while also unlocking the power of Pulumi Cloud. The following common patterns for running Terraform are now supported: * Plans and applies run remotely by default for new Terraform stacks, following the behavior of HCP Terraform and Terraform Enterprise. When you run a Terraform operation, it executes on a Pulumi-hosted runner rather than your local machine. You get full visibility into these operations both on your local CLI and in the Pulumi Cloud console. * Production deployments may be gated with manual approvals before applying a Terraform plan. With this release, stacks with Terraform state are first-class entities in Pulumi Cloud. They get access to all of the capabilities that organizations need to scale in this new AI-first era. * Manage access to your Terraform stacks at scale using tag-based access control, team role assignments, and user role assignments. * Take advantage of Neo code reviews. On every pull request, leverage what Pulumi Cloud knows about your running infrastructure and get clear feedback on whether it's safe to merge changes to your Terraform and OpenTofu projects. * Run preventive policies after a Terraform plan to block non-compliant resources before deployment. * Configure your Terraform deployments with Pulumi ESC, which is natively available to Pulumi Cloud-backed Terraform projects, to securely inject OIDC credentials at apply time and expose outputs to downstream stacks and services. Reuse your Terraform modules. Pulumi programs, regardless of language, now support importing Terraform modules natively. Organizations can leverage their existing reusable artifacts as is, without having to make a single change. This enables organizations to focus on new infrastructure projects and lets them build those projects in the language of their choice, regardless of what their existing IaC estate is. In addition, Pulumi Cloud's private registry can now host Terraform modules alongside Pulumi packages. This enables you to consolidate all of your IaC building blocks in a single source of truth rather than managing disparate solutions and making sure your teams know where to look. Terraform modules hosted in Pulumi Cloud provide maximum interoperability and can be used in both Pulumi and Terraform programs. Build in HCL natively. HashiCorp Configuration Language (HCL) is now generally available as a first-class language in Pulumi IaC. Like any other Pulumi language, it has full access to the entirety of the Pulumi ecosystem, including thousands of providers. Thanks to its Terraform bridge, if there's a Terraform provider out there, it just works. Best of all, HCL in Pulumi is 100% OpenTofu compatible with no syntactical differences. Pulumi recognize there are many teams out there that prefer to work in HCL over general-purpose languages but want to leverage the modern Pulumi IaC engine, or want to be able to use the reusable components their partner teams rely on - regardless of whether those teams work in Terraform or Pulumi. You are still covered until your HashiCorp renewal. Pulumi stand by the promise Pulumi made last December, and the last thing Pulumi want is for you to pay for two IaC solutions. To set your team up for long-term success and ensure your transition to Pulumi is as smooth as possible, Pulumi is continuing to offer three things: * An escape hatch for your current contract. Pulumi know paying for two IaC solutions at once is a non-starter, so Pulumi is letting you apply credits purchased from HashiCorp toward your Pulumi usage until your next renewal, avoiding double pay. * A free IaC modernization workshop. Its professional services cloud architects host a free IaC modernization workshop to review where you're at with your IaC already and share best practices for adopting the Pulumi platform at scale, learned from working with world-class organizations like BMW and Supabase. You will leave this session trained up and equipped to succeed with the next phase of your IaC journey. * A return on investment (ROI) calculation. Pulumi will show you how the move to Pulumi will not only be spend-neutral thanks to the escape hatch, but how much value and savings you should expect to see, given its experience helping innovators like Snowflake accelerate their time to market - going from code to cloud in weeks to hours. These ensure there's no financial penalty for switching, a clear ROI, and no learning curve. Pulumi has always been proud to work with customers of all sizes in all industries, so these offers are available to you whether you're a Global 2000, a startup, or somewhere in between. Get started today. The agentic infrastructure era is already here, and Pulumi want you to bring your IaC to it. Get started with Pulumi free and provision your first stack in minutes. If you'd like to get started with the new Terraform/OpenTofu and HCL capabilities, or take advantage of the financial flexibility options, please get in touch.

Enforce ISO 27001 across your AWS infrastructure. ISO/IEC 27001 is the international standard for information security management. Proving you meet it usually means months of mapping abstract security controls to concrete cloud configuration, then authoring custom checks one resource at a time. Pulumi is changing that. Today Pulumi is shipping a pre-built ISO/IEC 27001:2022 policy pack for AWS, live now in Pulumi Cloud as iso-27001-aws. It encodes the standard's security expectations as 238 ready-to-run policies, so you can align your AWS estate to ISO 27001 in minutes, not months. Why ISO 27001 matters. For many companies, ISO 27001 is what stands between them and a customer or a market. The sooner you can reach a certifiable state and prove you stay there, the less compliance slows the business down. The pack collapses months of policy work into something you run continuously, so security keeps pace with growth instead of blocking it. How the pack maps to ISO 27001. The hard part of ISO 27001 has always been translation: its controls are written in the language of governance and risk management, not in the language of AWS resources. Every team has had to interpret each control and decide what it means for an S3 bucket or an RDS instance. The pack does that interpretation for you. Its 238 policies are aligned to the relevant ISO 27001 controls, so each result connects back to the standard instead of leaving you to map it yourself. You can browse the full pack in the pack reference. Audit and prevent. The same pack works two ways, so you can both reach compliance and stay there: * Audit. Scan your existing AWS estate against the pack, including resources that Pulumi doesn't manage. You get an honest baseline of where you stand against ISO 27001 today, with every finding tied back to the control it affects. * Prevent. Run the same pack as a preventative policy during pulumi up to block non-compliant resources before they're ever created. New infrastructure is born aligned to the standard. Audit gets you clean. Preventative policies keep you clean. A growing library of pre-built packs. ISO 27001 joins a growing library of pre-built packs for AWS, each authored and maintained by Pulumi and kept current with its source standard: * ISO/IEC 27001:2022 * CIS Controls v8.1 * NIST SP 800-53 Rev. 5 * PCI DSS v4.0 * HITRUST CSF v11.5 * Pulumi Best Practices Adopting any pack means you skip the authoring work entirely, inherit framework mappings maintained by Pulumi, and apply a consistent baseline across every stack and account. Get started today. The ISO 27001 pack is available now to every Pulumi Cloud user: * Browse the pack reference to see all 238 policies and how they map to the standard's controls. * Explore the full pre-built packs index. * Follow the get-started guide to run your first audit. Try pulumi policies. Ready to align your AWS infrastructure to ISO 27001? Sign up for Pulumi Cloud and run the pack against your estate, or read the policy get-started guide to dig in. Need a compliance pack for a framework that isn't listed here? Open a request in pulumi/pulumi-cloud-requests or come tell Pulumi in the community Slack. Pulumi is listening.