Pulumi CLI

Pulumi CLI executes infrastructure programs as native code across TypeScript, Python, Go, .NET, and Java, communicating with resource providers over gRPC rather than interpreting static template files. The engine resolves state directly against local disks or private object storage in Amazon S3, Google Cloud Storage, and Azure Blob Storage. This design keeps sensitive configuration and state data entirely within private cloud perimeters.

Why Pulumi CLI instead of Pulumi Cloud

Using Pulumi CLI with a self-managed backend eliminates network latency and SaaS dependencies. In continuous integration pipelines, the CLI communicates directly with local storage or cloud object stores over private VPC endpoints, bypassing public network hops, third-party rate limits, and remote queueing. Execution performance is bounded only by cloud provider API quotas and runner resources rather than hosted concurrency tiers, enabling rapid preview and update cycles during automated testing.

The trade-off centers on operational responsibility. Pulumi Cloud provides out-of-the-box transactional locking, team deployment history, role-based access control, and a visual dashboard for proposed changes. Storing state in S3 or Google Cloud Storage places concurrency locking, bucket encryption, and auditing on the engineering team. Transitioning between backends requires only updating the login URL and transferring state files. Teams adopt the standalone CLI when execution performance and data sovereignty outweigh managed collaboration features.

What it does well

• Native programming languages allow teams to model infrastructure using loops, functions, and package managers like npm and pip instead of template syntax.
• Parallel resource engine executes independent dependency branches concurrently over local gRPC channels, accelerating deployments across multi-tier environments.
• Automation API embeds the full provisioning lifecycle into custom applications, internal portals, and delivery pipelines without invoking external shell scripts.
• Flexible backend support permits storing stack state in Amazon S3, Google Cloud Storage, Azure Blob Storage, or local disk without external services.
• Client-side secrets encryption secures sensitive values at rest using cloud key management services or local passphrases before state writes occur.
• Interactive terminal interface outputs structured color diffs during preview phases and streams operational logs directly to developer consoles.