Pulumi Infrastructure as Code Guide

import * as aws from "@pulumi/aws";

// Create a VPC
const vpc = new aws.ec2.Vpc("main", {
  cidrBlock: "10.0.0.0/16",
  tags: { Name: "production" },
});

// Create a subnet
const subnet = new aws.ec2.Subnet("public", {
  vpcId: vpc.id,
  cidrBlock: "10.0.1.0/24",
  availabilityZone: "eu-west-1a",
});

// Create an EC2 instance
const server = new aws.ec2.Instance("web", {
  ami: "ami-0c55b159cbfafe1f0",
  instanceType: "t3.medium",
  subnetId: subnet.id,
});

// Export the public IP
export const publicIp = server.publicIp;

pulumi up
# Previews changes, then applies on confirmation

// Create instances across availability zones
const azs = ["eu-west-1a", "eu-west-1b", "eu-west-1c"];

const subnets = azs.map((az, i) =>
  new aws.ec2.Subnet(`subnet-${i}`, {
    vpcId: vpc.id,
    cidrBlock: `10.0.${i}.0/24`,
    availabilityZone: az,
  })
);

// components/vpc.ts
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

interface VpcArgs {
  cidrBlock: string;
  azCount: number;
}

export class StandardVpc extends pulumi.ComponentResource {
  public readonly vpc: aws.ec2.Vpc;
  public readonly subnets: aws.ec2.Subnet[];

  constructor(name: string, args: VpcArgs, opts?: pulumi.ComponentResourceOptions) {
    super("custom:network:StandardVpc", name, {}, opts);

    this.vpc = new aws.ec2.Vpc(`${name}-vpc`, {
      cidrBlock: args.cidrBlock,
    }, { parent: this });

    this.subnets = Array.from({ length: args.azCount }, (_, i) =>
      new aws.ec2.Subnet(`${name}-subnet-${i}`, {
        vpcId: this.vpc.id,
        cidrBlock: `10.0.${i}.0/24`,
      }, { parent: this })
    );
  }
}

// __tests__/infra.test.ts
import * as pulumi from "@pulumi/pulumi";
import { StandardVpc } from "../components/vpc";

describe("StandardVpc", () => {
  it("creates the correct number of subnets", async () => {
    const vpc = new StandardVpc("test", {
      cidrBlock: "10.0.0.0/16",
      azCount: 3,
    });

    const subnets = await pulumi.output(vpc.subnets).promise();
    expect(subnets).toHaveLength(3);
  });
});

const config = new pulumi.Config();
const dbPassword = config.requireSecret("dbPassword");

new aws.rds.Instance("db", {
  password: dbPassword, // encrypted in state
});

# Set a secret
pulumi config set --secret dbPassword "my-secure-password"