Pulumi vs Terraform vs AWS CDK: Which One to Use and When

Most CEOs never think about which tool their engineers use to build cloud infrastructure. That’s usually fine, until it isn’t.

This decision shows up on your balance sheet in three places:

• How fast does your team ship? The wrong tool adds weeks to every infrastructure change.
• How much do you pay for cloud waste? Manual infrastructure work causes drift, and drift causes overspend. As we’ve covered before, sustainable cloud cost optimization relies entirely on your underlying architecture.
• How exposed you are when key people leave. If only one engineer understands your infrastructure setup, that’s a business risk, not just a technical one.

This isn’t a story about which tool is “better.” It’s about which one matches your team, your budget, and how much risk you’re willing to carry.

What Actually Changed Since 2024

A few things have moved that change the calculus for 2026 budgets and hiring plans.

• IBM now owns HashiCorp. The acquisition closed in early 2025. Terraform itself hasn’t broken, but it raised real questions inside procurement and legal teams about long-term direction and pricing.
• HashiCorp’s paid platform got more expensive. The free tier for HashiCorp’s managed Terraform service ended in March 2026. Teams using the free tier now face a real budget line they didn’t have before.
• OpenTofu stopped being a “just in case” backup plan. It’s a Linux Foundation project, fully open source, and now has features Terraform’s free version doesn’t — including built-in encryption for sensitive infrastructure data. Adoption is still smaller than Terraform’s, but it’s growing fastest among companies that don’t want to depend on one vendor.
• Pulumi closed the performance gap that used to justify avoiding it. On large environments, it now provisions infrastructure noticeably faster than Terraform or AWS CDK.
• AWS CDK became the default for AWS-only teams. Companies running mostly on Lambda and container services (ECS) are adopting it heavily, mainly because their developers already know the programming languages it uses.

What Each Tool Actually Costs You (In Business Terms, Not Tech Terms)

Forget features for a second. Here’s what each option means for your company:

Terraform

• What you’re buying: Stability and the largest talent pool. Easiest tool to hire for.
• What you’re risking: Ongoing dependency on one vendor now owned by IBM, and a paid platform that got pricier in 2026.
• Who this fits: Companies that want the safest, most “nobody gets fired for choosing this” option, and don’t mind paying for the managed platform.

OpenTofu

• What you’re buying: The same day-to-day experience as Terraform, but fully open source with no single company controlling the roadmap or the license.
• What you’re risking: A smaller (but fast-growing) hiring pool and a slightly newer project with less history under real production load.
• Who this fits: Companies in regulated industries, companies burned by vendor lock-in before, or anyone who wants Terraform’s stability without Terraform’s ownership structure.

Pulumi

• What you’re buying: Speed on large, complex environments, and infrastructure written in the same language your product engineers already use: Python, TypeScript, or Go.
• What you’re risking: A smaller hiring pool for people with direct Pulumi experience and fewer ready-made templates than Terraform’s ecosystem.
• Who this fits: Companies with strong software engineering teams that don’t want to train developers on a brand-new syntax just for infrastructure. This open-source-first approach is a core part of the Platform Engineering Services we build to keep our clients out of vendor traps.

AWS CDK

• What you’re buying: Fast setup if you’re deep into Lambda and container services, and developers can write infrastructure in languages they already know.
• What you’re risking: Full lock-in to AWS. If you ever plan to run workloads on Azure, Google Cloud, or a second provider for redundancy, you’ll need a second infrastructure tool from scratch. See how we handled seamless AWS, GCP, and Azure integration in our Multi-Cloud Hosted Data Lake Case Study.
• Who this fits: Companies that are and plan to stay 100% on AWS.

Provisioning Speed: What the Numbers Actually Mean for You

Speed differences matter more as your infrastructure grows. On a small setup (around 50 resources), the difference between tools is a matter of seconds, not something your business will feel. On larger, more complex environments (200+ resources), the gap widens: Pulumi tends to run fastest, Terraform and OpenTofu are close behind and nearly identical to each other, and AWS CDK tends to be the slowest because it has to go through an extra layer (CloudFormation) before anything actually gets built.

If your company deploys infrastructure changes daily and your environment is large, that gap adds up to real engineering hours over a year. If you deploy infrequently or your environment is small, this difference won’t move your budget at all.

The Decision, Without the Sales Pitch

Your Situation	Pick This
Starting fresh, want the safest, most talked-about option	Terraform
Want Terraform’s stability without depending on one vendor	OpenTofu
Your engineers already write Python, TypeScript, or Go, and your environment is large	Pulumi
100% AWS, heavy on Lambda and container services, no plans to leave AWS	AWS CDK
Multi-cloud today or planned within 2 years	Terraform, OpenTofu, or Pulumi — never CDK alone

The Real Bottom Line

The tool matters less than most vendors want you to believe. A well-run team using Terraform will consistently outperform a poorly run team using Pulumi, and the reverse is just as true.

What actually determines whether this decision costs you money or saves you money:

• Whether your team documents and reviews infrastructure changes the same way they review code
• Whether one person is the only one who understands your setup
• Whether you picked the tool because it fit your team, or because it was trending

Before you approve a budget for a new tool, or a migration off an old one, get a clear picture of what your current setup is actually costing you in engineering time, cloud waste, and risk. You can benchmark your team’s current setup in 5 minutes using our free Platform Engineering Maturity Assessment.

Want a clear picture of what your current infrastructure setup is actually costing you? We review IaC setups for engineering leadership teams, no sales pitch, just a straight assessment of risk, cost, and what to fix first.

Contact us today to book an Infrastructure and Architecture Review →