Reference
About this page
Look-up facts for Pulumi: versions, runtime support, backends, CLI commands, environment variables, Pulumi Cloud
editions and prices, RBAC, policy levels, hardening checklist and known pitfalls. All values verified 2026-09-25
unless marked otherwise. Why things work this way is in Explanation. Tasks are in
How-to Guides.
Release and Version Facts
| Item |
Value (as of 2026-09-25) |
Source |
| Latest CLI / core SDK |
3.264.0 (2026-09-23) |
pulumi/pulumi CHANGELOG, npm @pulumi/pulumi, PyPI pulumi |
| Major version line |
v3 since 3.0.0 (2021-04-19) |
CHANGELOG |
| Release cadence |
Minor release roughly weekly (49 minor releases between 2026-01-01 and 2026-09-23), occasional patch releases |
CHANGELOG |
| Support policy |
Only the latest release is patched. Upgrade by moving forward, with no LTS branches (inferred from the release pattern, not a published policy) |
CHANGELOG |
| License |
Apache 2.0 (CLI, engine, SDKs, ESC evaluator). Pulumi Cloud is proprietary SaaS or self-hosted |
LICENSE files |
| Company |
Pulumi Corporation (Seattle), founded 2017 |
pulumi.com |
@pulumi/aws |
7.48.0 (2026-09-22) |
npm |
@pulumi/kubernetes |
4.34.2 (2026-09-21) |
npm |
@pulumi/awsx |
3.10.0 (2026-09-24) |
npm |
@pulumi/policy |
1.21.0 (2026-05-20) |
npm |
@pulumi/esc-sdk |
0.14.0 (2026-06-15) |
npm |
| Pulumi Kubernetes Operator |
2.9.1 (2026-09-03) |
pulumi-kubernetes-operator CHANGELOG |
Standalone esc CLI |
0.26.0, retired: use pulumi env |
pulumi/esc CHANGELOG |
Notable Changes 2025-2026
| Version (date) |
Change |
| 3.143.0 (2024-12-12) |
Python 3.8 support dropped |
| 3.202.0 (2025-10-10) |
Python 3.14 support |
| 3.211.0 (2025-12-11) |
Stack tags on DIY backends |
| 3.224.0 (2026-02-26) |
zstd compression option for DIY state files |
| 3.225.0 (2026-03-04) |
Journaling enabled by default (PULUMI_DISABLE_JOURNALING to opt out) |
| 3.226.0 (2026-03-11) |
Bun supported as a plugin runtime (docs cite 3.227.0 for runtime: bun programs) |
| 3.228.0 (2026-03-25) |
DIY non-project mode deprecation starts |
| 3.235.0 (2026-05-05) |
CLI bundles the hcl language host (Pulumi HCL) |
| 3.241.0 (2026-05-18) |
pulumi neo visible by default. pulumi insights account ... commands added |
| 3.243.0 (2026-05-22) |
plugin ls/rm renamed to list/remove (old names kept as aliases) |
| 3.246.0 (2026-06-11) |
Experimental pulumi ai web removed |
| 3.249.0 (2026-07-01) |
Node.js SDK requires Node.js 22+. pulumi policy analyze --file for exported state |
| 3.251.0 (2026-07-08) |
ESC engine/CLI folded into the monorepo. Pulumi.<stack>.deploy.yaml removed. pulumi neo --debug-update |
| 3.254.0 (2026-07-23) |
pulumi stack migrate between backends. pulumi neo acp (Agent Client Protocol) |
| 3.256.0 (2026-08-04) |
Pulumi AI mode of pulumi new (--ai) retired. Use pulumi neo. Minimum CLI for Pulumi HCL per docs |
| 3.257.0 (2026-08-13) |
DIY non-project mode is now an error (PULUMI_DIY_BACKEND_IGNORE_DEPRECATION_ERROR to bypass). pulumi do improvements |
| 3.261.0 (2026-09-02) |
pulumi env setup aws\|azure\|gcp configures OIDC trust plus ESC environments |
| 3.264.0 (2026-09-23) |
Latest. Python component state migration callbacks |
Language Runtime Matrix
| Language |
runtime: |
SDK package |
Supported runtime versions |
Package / build tools |
| TypeScript / JavaScript |
nodejs or bun |
@pulumi/pulumi (npm) |
Node.js Current, Active and Maintenance LTS. SDK requires Node.js 22+ (since 3.249.0). Bun (no function serialization or dynamic providers) |
npm (default), Yarn Classic, pnpm, Bun |
| Python |
python |
pulumi (PyPI) |
Currently supported CPython versions. PyPI metadata: >=3.10. 3.14 supported |
pip (default), Poetry 1.8+, uv |
| Go |
go |
github.com/pulumi/pulumi/sdk/v3/go/pulumi |
Currently supported Go releases (Go 1.27 support added in 3.260.0) |
Go modules |
| .NET |
dotnet |
Pulumi (NuGet) |
Supported .NET versions. Tested on .NET 8, 9, 10. C#, F#, VB |
dotnet CLI |
| Java |
java |
com.pulumi:pulumi (Maven Central) |
Supported Java versions, 11 or later |
Maven 3.6.1+ (default), Gradle |
| Pulumi YAML |
yaml |
none (bundled) |
n/a |
n/a |
| Pulumi HCL |
hcl |
none (bundled) |
CLI 3.256.0+ |
pulumi install fetches provider SDKs |
Corrections vs. the earlier version of this topic
Node.js 18+ -> 22+, Python 3.8+ -> 3.10+, Go 1.21+ -> supported Go releases, .NET 6+ -> .NET 8/9/10
tested. HCL and Bun are new since the last review.
State Backends
| Backend |
Login URL |
Locking |
Default secrets |
Notes |
| Pulumi Cloud (SaaS) |
pulumi login (https://api.pulumi.com) |
Service-side (409 on concurrent update) |
Pulumi Cloud per-stack key |
History, RBAC, audit, ESC, Neo, Deployments |
| Pulumi Cloud self-hosted |
pulumi login https://<your-api-host> |
Service-side |
Service key or customer-managed |
Enterprise edition |
| AWS S3 / S3-compatible |
pulumi login s3://<bucket>[/prefix] (MinIO/Ceph via ?endpoint=...) |
Lock file in .pulumi/locks/ |
Passphrase or KMS |
Needs s3:ListBucket, GetObject, PutObject, DeleteObject |
| Azure Blob Storage |
pulumi login azblob://<container> |
Lock file |
Passphrase or KMS |
Uses AZURE_STORAGE_ACCOUNT + key/SAS or Azure identity |
| Google Cloud Storage |
pulumi login gs://<bucket> |
Lock file |
Passphrase or KMS |
Uses Google ADC |
| PostgreSQL |
pulumi login postgres://<user>:<pass>@<host>:<port>/<db> |
Lock records |
Passphrase or KMS |
Credentials masked in lock errors |
| Local filesystem |
pulumi login --local or file://<path> |
Lock file |
Passphrase |
Default ~/.pulumi |
Secrets Providers
| Provider |
--secrets-provider value |
Notes |
| Pulumi Cloud |
default (on Pulumi Cloud) |
Key never leaves the service |
| Passphrase |
passphrase |
PULUMI_CONFIG_PASSPHRASE or PULUMI_CONFIG_PASSPHRASE_FILE |
| AWS KMS |
awskms://alias/<name>?region=<r> or key ARN |
|
| Azure Key Vault |
azurekeyvault://<vault>.vault.azure.net/keys/<key> |
|
| Google Cloud KMS |
gcpkms://projects/<p>/locations/<l>/keyRings/<r>/cryptoKeys/<k> |
|
| HashiCorp Vault Transit |
hashivault://<key> |
Uses VAULT_ADDR / VAULT_TOKEN |
CLI Command Quick Reference
| Command |
Purpose |
pulumi new <template> |
Create a project from a template (for example aws-typescript, python, java-gradle) |
pulumi install |
Install language dependencies, plugins and packages from Pulumi.yaml |
pulumi preview [--diff] |
Show planned changes |
pulumi up [--yes] [--target <urn>] |
Deploy |
pulumi refresh |
Reconcile state with real infrastructure |
pulumi destroy |
Delete all stack resources |
pulumi stack init / select / ls / rm / output |
Manage stacks |
pulumi stack migrate <source-backend-url> <stack> |
Move a stack into the currently logged-in backend (3.254.0+) |
pulumi stack export / import |
Dump or restore the state checkpoint |
pulumi state remove / move / rename / upgrade |
Edit state (delete is an alias of remove). upgrade migrates DIY non-project layout |
pulumi import <type> <name> <id> |
Adopt an existing cloud resource and generate code |
pulumi convert --from terraform --language <lang> |
Convert HCL to a Pulumi program |
pulumi package add terraform-provider <ns>/<name> [ver] |
Use any Terraform/OpenTofu provider |
pulumi plugin list / install / remove |
Manage plugins (ls/rm are aliases) |
pulumi config set [--secret] <k> <v> |
Stack config |
pulumi env init / edit / open / run / setup |
ESC environments |
pulumi policy new / analyze / publish |
Policy packs |
pulumi neo [-p "<prompt>"] |
Neo agent (interactive or one-shot) |
pulumi do <pkg:module:type> <op> |
Direct resource operations without a program (research preview) |
pulumi cancel |
Cancel an in-progress update (Pulumi Cloud) |
pulumi insights account ... |
Discovery accounts and scans |
Environment Variables
| Variable |
Effect |
PULUMI_ACCESS_TOKEN |
Pulumi Cloud token for non-interactive login |
PULUMI_BACKEND_URL |
Backend URL, instead of running pulumi login |
PULUMI_CONFIG_PASSPHRASE / PULUMI_CONFIG_PASSPHRASE_FILE |
Passphrase secrets provider |
PULUMI_HOME |
CLI home (plugins, credentials). Default ~/.pulumi |
PULUMI_DIY_BACKEND_IGNORE_DEPRECATION_ERROR |
Temporarily allow DIY non-project layout (3.257.0+) |
PULUMI_DISABLE_JOURNALING |
Turn off journaling (3.225.0+ default on) |
PULUMI_DIY_BACKEND_PARALLEL |
Parallelism for listing stacks on DIY backends |
PULUMI_EXPERIMENTAL |
Enable experimental commands (no longer needed for pulumi neo) |
Pulumi Cloud Editions and Pricing
Pulumi moved to a new edition lineup, which its docs call pricing V6. The figures below come from the pulumi/docs
pricing data file on 2026-09-25. The exact V6 launch date is TBD. Third-party coverage places it around 2026-09.
|
Free |
Essentials |
Pro |
Enterprise |
| Base price |
$0 |
$40/month (40 credits) |
$400/month (400 credits) |
$2,000/month (2,000 credits). Annual contracts available |
| Included managed resources |
Not limited (1 user) |
Up to 500 |
Up to 2,000 |
Up to 4,750 |
| IaC resource rate |
Free |
$0.00025/resource-hour ($0.1825/month) |
From $0.0005/hour ($0.365/month), volume discounts |
From $0.00075/hour ($0.5475/month) |
| ESC secret |
Basic ESC |
$0.50/secret/month |
$0.75/secret/month |
$1.00/secret/month |
| Discovered (Insights) resource |
n/a |
$0.0185/month |
From $0.0365/month |
$0.05475/month |
| Workflow minutes (Deployments + Discovery) |
Up to 500 |
$0.01/minute |
$0.01/minute |
$0.01/minute |
| Neo |
Not included |
$3 per 1M tokens |
$3 per 1M tokens |
$3 per 1M tokens + BYOK |
| Users |
1 |
Unlimited |
Unlimited |
Unlimited |
| Headline features |
State, Deployments, basic ESC, unlimited projects/stacks/history |
Teams, CI/CD, Neo code reviews + Slack, Resource/Property Search, OIDC and org tokens, webhooks, secret rotation, advisory policies, SLOs + support tickets |
SAML SSO, advanced RBAC, org-managed + preventative + custom policies, Neo scheduled tasks, IDP, audit-log export, drift detection/remediation, TTL stacks, customer-managed keys |
Self-hosting, compliance packs (CIS, CMMC, HITRUST, ISO 27001, NIST, PCI DSS), SCIM, unlimited custom packs, policy remediation, contract invoicing |
- 1 Pulumi Credit = $1. Unused monthly credits expire, and overage is billed in arrears.
- ESC API: the first 10,000
ReadOpen calls/month are free, then $0.10 per 10,000.
- Every IaC resource counts, including component resources and stacks. Partial hours round up.
- Support: every edition includes the support agent and tickets. Standard or Bronze support can be purchased, and
Platinum is required for self-hosted.
- The CLI with a DIY backend is free and unrestricted, since it is open source.
Legacy edition names
Older material (including earlier versions of this topic and third-party pricing posts) uses the V5 names
Individual (free), Team (usage-based, 150,000 free credits/month at $0.0005/credit), Enterprise and Business
Critical, plus grandfathered Starter and Pro SKUs from before 2023. V5 customers may still be on those.
"Pro" and "Enterprise" mean different things in V5 and V6.
Pulumi Cloud RBAC
| Built-in role |
Scope |
| Admin |
Full access to organization resources and settings, members, roles |
| Member |
Baseline access. Default stack/environment/account permissions set in org-wide role settings |
| Billing Manager |
View and manage billing only |
| Custom roles |
Built from permission sets (for example Stack Read / Write / Admin, Environment Read / Open / Write) applied to entities. Pro and above |
| Member default |
Stack |
Environment (ESC) |
Cloud account (Discovery) |
| Levels |
None / Read / Write (Write excludes stack rm) |
None / Read / Open / Write |
None / Read / Write |
Policy Enforcement Levels
| Level |
Effect |
advisory |
Report violation, deployment continues |
mandatory |
Block the preview/update |
remediate |
Policy transforms resource inputs to comply, then deployment continues |
disabled |
Policy not evaluated |
Policy groups apply packs in preventative mode (at deployment time) or audit mode (against discovered and
existing resources).
Benchmarks
Unsourced performance data
These tables come from an earlier version of this topic. They are rough estimates, not controlled benchmarks. No
hardware, versions or methodology were recorded, and nothing here was re-verified in 2026-09. Do not plan capacity
from them. Measure your own stacks. Journaling (3.225.0+) and provider versions change these numbers materially.
| Stack size |
Preview time |
Update time |
Notes |
| 50 resources |
5-10s |
1-3m |
Quick iteration |
| 200 resources |
15-30s |
3-10m |
Typical app stack |
| 1,000 resources |
1-3m |
10-30m |
Large infrastructure |
Language Runtime Overhead
| Language |
Cold start |
Warm start |
Memory |
| Go |
1-2s |
< 1s |
50-100MB |
| TypeScript |
3-5s |
1-2s |
100-200MB |
| Python |
2-4s |
1-2s |
80-150MB |
| C# |
3-6s |
1-3s |
100-200MB |
Scaling Limits
| Dimension |
Limit |
Notes |
| Resources per stack |
TBD: no documented hard limit found. Earlier estimate "10,000+, degrades beyond 5,000" is unverified |
Split large stacks and use stack references |
| Stacks per project |
Unlimited (all editions) |
Pricing page: unlimited projects and stacks |
| Concurrent updates |
1 per stack |
Stack-level locking |
Hardening Checklist
Known Pitfalls
| Pitfall |
Risk |
Mitigation |
| Plaintext secrets in config |
Credential exposure in version control |
Always use --secret or ESC |
| Static AWS keys in CI |
Long-lived credential compromise |
ESC aws-login or CI OIDC |
| Broad org Admin membership |
Overprivileged users |
Least-privilege custom roles |
| Unprotected stack references |
Cross-stack data leakage |
Restrict stack read access via RBAC |
| Passphrase state encryption |
Weak passphrase means weak encryption |
KMS secrets provider for production |
| DIY non-project layout |
CLI errors since 3.257.0, removal planned by end of 2026 |
pulumi state upgrade |
| Node.js < 22 |
Node.js SDK 3.249.0+ does not support it |
Upgrade Node.js to an LTS version, 22 or later |
| Renaming resources or changing parents |
Delete and recreate of real infrastructure |
aliases resource option |
Bridged provider major upgrades (for example @pulumi/aws v6 -> v7) |
Renamed resources and inputs, replacements |
Read the provider migration guide and run pulumi preview --diff first |
Sources