Infrastructure as Code : Terraform vs Pulumi, le match pragmatique

# 4000+ providers officiels
provider "aws" { }
provider "kubernetes" { }
provider "datadog" { }
# ... tout est supporté

terraform {
  backend "s3" {
    bucket = "terraform-state"
    key    = "prod/terraform.tfstate"
    dynamodb_table = "terraform-locks"
  }
}

# Import ressource cloud dans Terraform
terraform import aws_instance.web i-1234567890abcdef0

# Pas de boucles complexes
# Pas de conditions avancées
# Pas de fonctions customs

# Exemple douloureux : dupliquer de la config
resource "aws_instance" "app_1" {
  ami = "ami-123"
  instance_type = "t3.micro"
  # 50 lignes de config...
}

resource "aws_instance" "app_2" {
  ami = "ami-123"
  instance_type = "t3.micro"
  # 50 lignes identiques...
}

# Tests Terraform = lancer vraiment
terraform plan
terraform apply

# Pas de tests unitaires réels

// TypeScript avec IDE autocompletion !
import * as aws from "@pulumi/aws";

const instances = ["web", "api", "worker"].map(name =>
  new aws.ec2.Instance(`${name}-instance`, {
    ami: "ami-123",
    instanceType: "t3.micro",
    tags: { Name: name }
  })
);

// Boucles, conditions, fonctions : tout est possible

// tests/infra.test.ts
import { describe, it } from '@jest/globals';

describe("Infrastructure", () => {
  it("should create S3 bucket with encryption", async () => {
    const infra = await createInfra();

    expect(infra.bucket.serverSideEncryptionConfiguration).toBeDefined();
    expect(infra.bucket.versioning.enabled).toBe(true);
  });
});

// shared/config.ts
export const regions = ["eu-west-1", "us-east-1"];

// infra/index.ts
import { regions } from '../shared/config';

regions.forEach(region => {
  new aws.Provider(region, { region });
  // Déployer dans chaque région
});

// app/config.ts
import { regions } from '../shared/config';
// Même config dans l'app !

// Erreur dans le code TS
// + erreur dans l'API cloud
// + erreur dans Pulumi
// = 3 stack traces imbriquées

Error:
  at Promise.all.pulumi/pulumi/...
    at aws.s3.Bucket.pulumi/aws...
      at AWS SDK InvalidBucketName...

variable "instance_count" {
  type = number
}

resource "aws_instance" "app" {
  count = var.instance_count

  ami           = "ami-123"
  instance_type = "t3.micro"

  tags = {
    Name = "app-${count.index}"
  }
}

const instanceCount = config.requireNumber("instance_count");

const instances = Array.from({ length: instanceCount }, (_, i) =>
  new aws.ec2.Instance(`app-${i}`, {
    ami: "ami-123",
    instanceType: "t3.micro",
    tags: { Name: `app-${i}` }
  })
);

# Secrets en plain text dans .tfvars 😱
# Ou avec Vault provider (complexe)

variable "db_password" {
  type      = string
  sensitive = true
}

// Secrets encryptés natifs
import { Config } from "@pulumi/pulumi";

const config = new Config();
const dbPassword = config.requireSecret("dbPassword");

// Encrypted dans state

# Excellent support multi-cloud
provider "aws" { }
provider "gcp" { }
provider "azure" { }

# Même syntaxe, providers différents

import * as aws from "@pulumi/aws";
import * as gcp from "@pulumi/gcp";
import * as azure from "@pulumi/azure";

// APIs différentes par provider

// Créer une abstraction high-level
class WebApp {
  constructor(name: string, config: WebAppConfig) {
    // Load balancer
    this.lb = new aws.lb.LoadBalancer(`${name}-lb`, {
      internal: false,
      loadBalancerType: "application",
    });

    // Auto Scaling Group
    this.asg = new aws.autoscaling.Group(`${name}-asg`, {
      minSize: config.minInstances,
      maxSize: config.maxInstances,
      launchTemplate: {
        id: this.launchTemplate.id,
        version: "$Latest"
      }
    });

    // CloudWatch Alarms
    if (config.enableAlerts) {
      this.createAlerts();
    }

    // RDS Database
    if (config.database) {
      this.db = new aws.rds.Instance(`${name}-db`, {
        engine: config.database.engine,
        instanceClass: config.database.instanceClass,
      });
    }
  }

  private createAlerts() {
    // Logique complexe d'alerting
  }
}

// Utilisation simple
const app = new WebApp("production", {
  minInstances: 2,
  maxInstances: 10,
  enableAlerts: true,
  database: {
    engine: "postgres",
    instanceClass: "db.t3.micro"
  }
});

// Pulumi : Fetch de data externe facile
const zones = await fetchAvailabilityZones();

zones.forEach(zone => {
  new aws.ec2.Subnet(`subnet-${zone}`, {
    availabilityZone: zone,
    cidrBlock: calculateCIDR(zone)
  });
});

// Policy TypeScript
import { PolicyPack, validateResourceOfType } from "@pulumi/policy";

new PolicyPack("aws-security", {
  policies: [{
    name: "s3-no-public-read",
    description: "S3 buckets must not allow public read access",
    enforcementLevel: "mandatory",
    validateResource: validateResourceOfType(aws.s3.Bucket, (bucket, args, reportViolation) => {
      if (bucket.acl === "public-read") {
        reportViolation("S3 bucket must not allow public read");
      }
    })
  }]
});

# Sentinel (HashiCorp payant)
# Ou OPA (plus complexe)

# Import automatique depuis Terraform
pulumi import aws:ec2/instance:Instance web i-1234567890abcdef0

// 1. Importer state Terraform
import * as terraform from "@pulumi/terraform";

const tfState = new terraform.state.RemoteStateReference("existing", {
  backendType: "s3",
  bucket: "terraform-state",
  key: "prod/terraform.tfstate"
});

// 2. Référencer ressources Terraform
const existingVpc = tfState.getOutput("vpc_id");

// 3. Créer nouvelles ressources Pulumi
new aws.ec2.Subnet("new-subnet", {
  vpcId: existingVpc,
  cidrBlock: "10.0.3.0/24"
});

// Créer infra pour chaque client
clients.forEach(client => {
  new CustomerInfra(client.id, {
    tier: client.subscriptionTier,
    region: client.preferredRegion,
    features: client.enabledFeatures
  });
});