Pulumi lets you write Azure infrastructure in real Python — with full language features (loops, functions, classes, unit tests). The Pulumi engine diffs your desired state against current state, then calls Azure SDK APIs. No DSL to learn.
Each stage in order — click any step to read what it does.
Pulumi Python architecture: how Python programs, the engine, and Azure interact.
The trade-offs worth knowing before you build this.
Pulumi resource properties return Output[T] — a future/promise wrapping the real value. Use .apply(lambda v: ...) to transform outputs. Never use .get() in resource declarations — only in tests.
ComponentResource is Pulumi's abstraction for reusable components. Group related resources (e.g., VNet + Subnets + NSG) into a single Python class. Consumers use it like a single resource.
Use pulumi.runtime.set_mocks() to unit test resource configurations. Mock the Azure provider — resources return fake IDs. Test that your Python program creates resources with the right properties.
pulumi config set --secret dbPassword encrypts the value in the Pulumi stack config (uses Pulumi's KMS or your Azure Key Vault). Access in Python: pulumi.Config().require_secret('dbPassword').
StackReference('org/network-stack/prod').get_output('vnetId') reads outputs from another Pulumi stack. Cross-stack references without copy-pasting resource IDs.
pulumi_azure_native is the preferred package — generated from Azure ARM specs, always up-to-date. pulumi_azure is a Terraform-bridged provider with slightly different APIs. Use azure-native for new projects.
Sign in to share your feedback and join the discussion.
