Pulumi Cloud

Reliability is generally good, but the failure modes are often code-level rather than purely declarative: dependency issues, runtime exceptions, or surprising language-side behavior during preview/apply. Agents need to think of Pulumi changes as both code execution and infra mutation. That makes preview discipline and change review especially important.

The API and platform model revolve around stacks, updates, state, secrets, environments, deployment history, and policies. Compared with Terraform Cloud, the core difference is where the desired state lives: in code, not HCL. That gives agents more expressive power but also raises the risk of over-engineering or embedding too much imperative logic into infra definitions. When used well, the stack model is clean and highly automatable.

Pulumi Cloud is especially attractive for agents when the infrastructure program is written in a general-purpose language. That lowers context-switching for teams already working in TypeScript, Python, Go, or C#. Agents can reuse language tooling, abstractions, and packaging patterns instead of translating everything into a separate DSL. Pulumi Cloud then provides managed state, history, stack coordination, and governance around that programmatic IaC model.

Authentication uses access tokens, org/project controls, and stack-oriented permissions. Secrets management is built into the platform, and stack configs can be protected. For agents, this is good enough for serious usage, but privilege scope still needs care. A token that can update the wrong stack is a real risk, especially in multi-environment organizations.

Pulumi's docs are strong and the language-specific examples are a major advantage. Agents can often find a working pattern faster than in DSL-only IaC systems because the examples look like normal application code. The tradeoff is that the conceptual line between application logic and infrastructure logic can blur if teams are not disciplined.