Pulumi CDK Adapter

The pulumi-cdk library provides access to the many high-level libraries ('constructs') built by service teams at AWS and by the AWS CDK community.

The adapter allows writing AWS CDK code inside a Pulumi program, and having the resulting AWS resources be deployed and managed via Pulumi. Pulumi and CDK resources can seamlessly interact with each other. Outputs of resources defined in a Pulumi program can be passed into AWS CDK Constructs, and outputs from AWS CDK stacks can be used as inputs to other Pulumi resources.

Getting Started

To get started with CDK on Pulumi first download and install Pulumi, and configure it to work with your AWS account. Next, create a Pulumi TypeScript project, install the required packages, and ensure you have configured the AWS providers.

$ pulumi new aws-typescript
$ npm install @pulumi/aws @pulumi/aws-native @pulumi/cdk @pulumi/docker-build @pulumi/pulumi aws-cdk-lib
$ pulumi config set aws-native:region us-east-2
$ pulumi config set aws:region us-east-2

cdk.json File

Settings for CDK applications are typically stored in a cdk.json file at the root of the project. It is recommended that you create one and populate it with a couple of settings.

app: This setting controls what command to run in order to synthesize the CDK application.
output: The directory location where the CDK output will be placed. If this is not specified it will be placed in a system temporary directory and could cause issues such as permanent diffs in docker image assets.
context: Any context values, specifically CDK features flags. You should populate all existing feature flags when you create a new application. A full list can be found here

{
  "app": "npx ts-node -P tsconfig.json --prefer-ts-exts src/main.ts",
  "output": "cdk.out",
  "context": {
    "@aws-cdk/aws-iam:minimizePolicies": true,
    ...other feature flags
  }
}

Example

After following the getting started steps, the next step is to setup your application. For this example we are using the AWS AppRunner serivce. We will create an AppRunner Service from within our Pulumi program, and export the resulting service's URL as a Pulumi Stack Output.

First install the additional aws-apprunner-alpha CDK package:

$ npm install @aws-cdk/aws-apprunner-alpha

Then update the index.ts file with the following code:

import * as pulumi from '@pulumi/pulumi';
import * as pulumicdk from '@pulumi/cdk';
import { Service, Source } from '@aws-cdk/aws-apprunner-alpha';

class AppRunnerStack extends pulumicdk.Stack {
    url: pulumi.Output<string>;

    constructor(id: string, options?: pulumicdk.StackOptions) {
        super(id, options);

        const service = new Service(this, 'service', {
            source: Source.fromEcrPublic({
                imageConfiguration: { port: 8000 },
                imageIdentifier: 'public.ecr.aws/aws-containers/hello-app-runner:latest',
            }),
        });

        this.url = this.asOutput(service.serviceUrl);
    }
}

const app = new pulumicdk.App('app', (scope: pulumicdk.App): pulumicdk.AppOutputs => {
    const stack = new AppRunnerStack('teststack');
    return {
        url: stack.url,
    };
});
export const url = app.outputs['url'];

And then deploy with pulumi update:

> pulumi up

Updating (dev)

View Live: https://app.pulumi.com/lukehoban/pulumi-cdk-apprunner/dev/updates/1

     Type                                   Name                       Status
 +   pulumi:pulumi:Stack                    pulumi-cdk-apprunner-dev   created
 +   └─ cdk:index:StackComponent            teststack                  created
 +      └─ cdk:construct:Service            teststack/adapter/service  created
 +         └─ aws-native:apprunner:Service  service6D174F83            created

Outputs:
    url: "2ez3iazupm.us-west-2.awsapprunner.com"

Resources:
    + 4 created

And curl the endpoint:

> curl https://$(pulumi stack output url)

   ______                             __        __      __  _                  __
  / ____/___  ____  ____ __________ _/ /___  __/ /___ _/ /_(_)___  ____  _____/ /
 / /   / __ \/ __ \/ __ `/ ___/ __ `/ __/ / / / / __ `/ __/ / __ \/ __ \/ ___/ /
/ /___/ /_/ / / / / /_/ / /  / /_/ / /_/ /_/ / / /_/ / /_/ / /_/ / / / (__  )_/
\____/\____/_/ /_/\__, /_/   \__,_/\__/\__,_/_/\__,_/\__/_/\____/_/ /_/____(_)
                 /____/


        Congratulations, your service has successfully deployed on AWS App Runner.



Open it in your browser at https://2ez3iazupm.us-west-2.awsapprunner.com/

Try the workshop at https://apprunnerworkshop.com
Read the docs at https://docs.aws.amazon.com/apprunner

Use Pulumi resources with CDK Constructs

It is possible to use Pulumi and CDK resources side-by-side. In order to pass a Pulumi Output value into a CDK resource you can use the asString, asList, & asNumber functions. Conversely, in order to pass a CDK attribute to a Pulumi resource, you can use the Stack.asOutput function to convert the CDK resource to a Pulumi Output value.

CDK to Pulumi Example

import * as pulumicdk from '@pulumi/cdk';
import * as aws from '@pulumi/aws';
import * as s3ObjectLambda from 'aws-cdk-lib/aws-s3objectlambda';
import * as s3 from 'aws-cdk-lib/aws-s3';

const app = new pulumicdk.App('app', (scope: pulumicdk.App) => {
    const stack = new pulumicdk.Stack('accesspoint-stack');
    const bucket = new s3.Bucket(stack, 'example-bucket');

    const policyDoc = new iam.PolicyDocument();
    policyDoc.addStatements(...);

    const ap = new aws.s3.AccessPoint('exampleBucketAP', {
      // Use `asOutput` to convert the bucketName attribute to a Pulumi Output
      bucket: stack.asOutput(bucket.bucketName),
      name: S3_ACCESS_POINT_NAME,
      policy: policyDoc.toJSON(),
    }, { parent: scope });

    const objectLambdaAP = new s3ObjectLambda.CfnAccessPoint(stack, 's3ObjectLambdaAP', {
      name: OBJECT_LAMBDA_ACCESS_POINT_NAME,
        objectLambdaConfiguration: {
          // Use `asString` to convert a Pulumi Output to a string value
          supportingAccessPoint: pulumicdk.asString(ap.arn),
          transformationConfigurations: [...],
        },
    });
});

Pulumi to CDK Example

CDK L2 Constructs do not normally take simple values. Instead, they take references to other L2 Constructs. If you want to take a Pulumi resource and pass that in to a CDK Construct, you first have turn the Pulumi resource into a reference to a CDK L2 Construct. You can do this by using asString in combination with CDK fromXXX methods.

Example

import * as pulumicdk from '@pulumi/cdk';
import * as aws from '@pulumi/aws';
import * as aws_route53 from 'aws-cdk-lib/aws-route53';

const app = new pulumicdk.App('app', (scope: pulumicdk.App) => {
    const stack = new pulumicdk.Stack('example-stack');

    // create a Pulumi Resource
    const zone = new aws.route53.Zone('example-zone', {
      name: 'cooldomain.io',
    });

    // Turn it into a reference to a CDK L2 Construct (IHostedZone)
    const hostedZone = aws_route53.HostedZone.fromHostedZoneAttributes(
      this,
      'hosted-zone',
      {
        zoneName: asString(zone.name),
        hostedZoneId: asString(zone.zoneId),
      },
    );

    new aws_route53.CnameRecord(this, 'record', {
      zone: hostedZone, // pass it into another L2 Construct
      domainName: 'example.com',
      recordName: 'test',
    });
});

Create Pulumi outputs

In order to create Pulumi Stack outputs you also need to propagate the App outputs all the way to the Pulumi Stack outputs. You can do this in one of two ways.

CfnOutput

Any CfnOutput that you create automatically gets added to the App outputs.

import * as pulumicdk from '@pulumi/cdk';
import * as s3 from 'aws-cdk-lib/aws-s3';

const app = new pulumicdk.App('app', (scope: pulumicdk.App) => {
    const stack = new pulumicdk.Stack('example-stack');
    const bucket = new s3.Bucket(stack, 'Bucket');
    new cdk.CfnOutput(stack, 'BucketName', { value: bucket.bucketName });
});

export const bucketName = app.outputs['BucketName'];

AppOutputs

import * as pulumicdk from '@pulumi/cdk';
import * as s3 from 'aws-cdk-lib/aws-s3';

const app = new pulumicdk.App('app', (scope: pulumicdk.App): pulumicdk.AppOutputs => {
    const stack = new pulumicdk.Stack('example-stack');
    const bucket = new s3.Bucket(stack, 'Bucket');
    return {
        bucketName: stack.asOutput(bucket.bucketName),
    }
});

export const bucketName = app.outputs['bucketName'];

Customizing providers

Currently Pulumi CDK utilizes three Pulumi providers.

If you want to customize any of these providers you can create your own and pass them to the AppResourceOptions

import * as pulumicdk from '@pulumi/cdk';
import * as aws from '@pulumi/aws';
import * as ccapi from '@pulumi/aws-native';
import * as build from '@pulumi/docker-build';

const awsProvider = new aws.Provider('aws-provider');
const awsCCAPIProvider = new ccapi.Provider('ccapi-provider', {
    region: 'us-east-2',
    // enable autoNaming
    autoNaming: {
        autoTrim: true,
        randomSuffixMinLength: 7,
    }
});
const dockerBuildProvider = new build.Provider('docker-build');

const app = new pulumicdk.App('app', (scope: pulumicdk.App) => {
    const stack = new pulumicdk.Stack('example-stack');
    const bucket = new s3.Bucket(stack, 'Bucket');
}, {
    providers: [
      dockerBuildProvider,
      awsProvider,
      awsCCAPIProvider,
    ]
});

Stack Level Providers

It is also possible to customize the Providers at the Stack level. This can be useful in cases where you need to deploy resources to different AWS regions.

import * as aws from '@pulumi/aws';
import * as ccapi from '@pulumi/aws-native';
import * as pulumicdk from '@pulumi/cdk';

const awsProvider = new aws.Provider('aws-provider');
const awsCCAPIProvider = new ccapi.Provider('ccapi-provider', {
    // enable autoNaming
    autoNaming: {
        autoTrim: true,
        randomSuffixMinLength: 7,
    }
});

const app = new pulumicdk.App('app', (scope: pulumicdk.App) => {
    // inherits the provider from the app
    const defaultProviderStack = new pulumicdk.Stack('default-provider-stack');
    const bucket = new s3.Bucket(defaultProviderStack, 'Bucket');

    // use a different provider for this stack
    const east2Stack = new pulumicdk.Stack('east2-stack', {
        providers: [
            new aws.Provider('east2-provider', { region: 'us-east-2' }),
            new ccapi.Provider('east2-ccapi-provider', {
                region: 'us-east-2',
                autoNaming: {
                    autoTrim: true,
                    randomSuffixMinLength: 7,
                },
            }),
        ],
    });
    const bucket2 = new s3.Bucket(east2Stack, 'Bucket');
}, {
    providers: [
      dockerBuildProvider,
      awsProvider,
      awsCCAPIProvider,
    ]
});

One thing to note is that when you pass different custom providers to a Stack, by default the Stack becomes an environment agnostic stack. If you want to have the environment specified at the CDK Stack level, then you also need to provide the environment to the Stack Props, as follows:

import * as aws from '@pulumi/aws';
import * as ccapi from '@pulumi/aws-native';
import * as pulumicdk from '@pulumi/cdk';

const app = new pulumicdk.App('app', (scope: pulumicdk.App) => {
    // inherits the provider from the app and has the CDK env auto populated
    // based on the default provider
    const defaultProviderStack = new pulumicdk.Stack('default-provider-stack');
    const bucket = new s3.Bucket(defaultProviderStack, 'Bucket');

    // use a different provider for this stack
    const east2Stack = new pulumicdk.Stack('east2-stack', {
        props: {
            env: {
                region: 'us-east-2',
                account: '12345678912',
            },
        },
        providers: [
            new aws.Provider('east2-provider', { region: 'us-east-2' }),
            new ccapi.Provider('east2-ccapi-provider', {
                region: 'us-east-2',
                autoNaming: {
                    autoTrim: true,
                    randomSuffixMinLength: 7,
                },
            }),
        ],
    });
    const bucket2 = new s3.Bucket(east2Stack, 'Bucket');
});

CDK Lookups

CDK lookups are currently disabled by default. If you would like to use lookups there are currently two options.

Use Pulumi functions

Instead of using CDK Lookups you can use Pulumi functions along with CDK fromXXX methods.

Example

import * as pulumicdk from '@pulumi/cdk';
import * as aws from '@pulumi/aws';

const app = new pulumicdk.App('app', (scope: pulumicdk.App): pulumicdk.AppOutputs => {
    const stack = new pulumicdk.Stack('example-stack');
    // use getAmiOutput to lookup the AMI instead of ec2.LookupMachineImage
    const ami = aws.ec2.getAmiOutput({
        owners: ['amazon'],
        mostRecent: true,
        filters: [
            {
                name: 'name',
                values: ['al2023-ami-2023.*.*.*.*-arm64'],
            },
        ],
    });

    const region = aws.config.requireRegion();
    const machineImage = ec2.MachineImage.genericLinux({
        [region]: pulumicdk.asString(ami.imageId),
    });

    const instance = new ec2.Instance(this, 'Instance', {
        vpc,
        instanceType: ec2.InstanceType.of(ec2.InstanceClass.T4G, ec2.InstanceSize.MICRO),
        machineImage,
    });
});

Experimental Lookup Support

Set the environment variable PULUMI_CDK_EXPERIMENTAL_LOOKUPS=true. This will allow lookups to run during preview operations, but will require you to execute Pulumi twice (the first execution will fail).

Example

import * as pulumicdk from '@pulumi/cdk';
import * as aws_route53 from 'aws-cdk-lib/aws-route53';

const app = new pulumicdk.App('app', (scope: pulumicdk.App): pulumicdk.AppOutputs => {
    const stack = new pulumicdk.Stack('example-stack');
    const hostedZone = aws_route53.HostedZone.fromLookup(this, 'hosted-zone', {
        domainName: zoneName,
    });

    new aws_route53.AaaaRecord(this, 'record', {
        zone: hostedZone,
        target: aws_route53.RecordTarget.fromAlias(new aws_route53_targets.LoadBalancerTarget(lb)),
    });
});

PULUMI_CDK_EXPERIMENTAL_LOOKUPS=true pulumi preview

You will see an error message that looks something like the error message below.

cdk:construct:StagingStack (staging-stack):
    error: Duplicate resource URN 'urn:pulumi:project::pulumi-lookups-enabled::cdk:index:App$cdk:construct:StagingStack::staging-stack-'; try giving it a unique name

At this point the lookups have been performed and you should be able to run Pulumi commands without errors.

Using Pulumi Policy Packs

You can use Policy Packs with your Pulumi CDK Application. It is also possible to use CDK specific policy validation tools (a couple are discussed below), but it is recommended to use Pulumi specific tools, especially if you are creating Pulumi resources outside of CDK.

Below is an example output using Pulumi's Compliance Ready Policies

import * as pulumicdk from '@pulumi/cdk';
import * as s3 from 'aws-cdk-lib/aws-s3';

const app = new pulumicdk.App('app', (scope: pulumicdk.App): pulumicdk.AppOutputs => {
    const stack = new pulumicdk.Stack('example-stack');

    new s3.Bucket(this, 'bucket');
});

Example output

Policies:
    ❌ [email protected] (local: ../policypack)
        - [mandatory]  awsnative-s3-bucket-enable-server-side-encryption  (aws-native:s3:Bucket: bucket)
          Check that S3 Bucket Server-Side Encryption (SSE) is enabled.
          S3 Buckets Server-Side Encryption (SSE) should be enabled.

CDK Aspects

Pulumi CDK supports CDK Aspects, including aspects like cdk-nag

import * as pulumicdk from '@pulumi/cdk';
import * as s3 from 'aws-cdk-lib/aws-s3';
import { AwsSolutionsChecks } from 'cdk-nag';

const app = new pulumicdk.App('app', (scope: pulumicdk.App): pulumicdk.AppOutputs => {
    const stack = new pulumicdk.Stack('example-stack');
    Aspects.of(stack).add(new AwsSolutionsChecks({ verbose: true }));

    new s3.Bucket(this, 'bucket');
});

Example Output

[Error at /test-stack/bucket/Resource] AwsSolutions-S1: The S3 Bucket has server access logs disabled. The bucket should have server access logging enabled to provide detailed records for the requests that are made to the bucket.
[Error at /test-stack/bucket/Resource] AwsSolutions-S10: The S3 Bucket or bucket policy does not require requests to use SSL. You can use HTTPS (TLS) to help prevent potential attackers from eavesdropping on or manipulating network traffic using person-in-the-middle or similar attacks. You should allow only encrypted connections over HTTPS (TLS) using the aws:SecureTransport condition on Amazon S3 bucket policies.

CDK Policy Validation Plugins

Pulumi CDK also supports CDK Policy Validation Plugins.

import * as pulumicdk from '@pulumi/cdk';
import { CfnGuardValidator } from '@cdklabs/cdk-validator-cfnguard';
import * as s3 from 'aws-cdk-lib/aws-s3';

const app = new pulumicdk.App('app', (scope: pulumicdk.App): pulumicdk.AppOutputs => {
    const stack = new pulumicdk.Stack('example-stack');
    new s3.Bucket(this, 'bucket');
}, {
    appOptions: {
      props: {
        policyValidationBeta1: [new CfnGuardValidator()],
      },
    },
});

Example Output

Diagnostics:
  pulumi:pulumi:Stack (pulumi-typescript-app-dev):
    Performing Policy Validations
    Validation failed. See the validation report above for details

    Validation Report
    -----------------
    ╔════════════════════════════════════╗
    ║           Plugin Report            ║
    ║   Plugin: cdk-validator-cfnguard   ║
    ║   Version: N/A                     ║
    ║   Status: failure                  ║
    ╚════════════════════════════════════╝
    (Violations)
    s3_bucket_level_public_access_prohibited_check (1 occurrences)
      Occurrences:
        - Construct Path: test-stack/bucket/Resource
        - Template Path: /private/var/folders/3b/6mr1jkqx7r797ff75k27jfjc0000gn/T/cdk.outC3dFwa/test-stack.template.json
        - Creation Stack:
        └──  test-stack (test-stack)
             │ Construct: aws-cdk-lib.Stack
             │ Library Version: 2.166.0
             │ Location: Run with '--debug' to include location info
             └──  bucket (test-stack/bucket)
                  │ Construct: aws-cdk-lib.aws_s3.Bucket
                  │ Library Version: 2.166.0
                  │ Location: Run with '--debug' to include location info
                  └──  Resource (test-stack/bucket/Resource)
                       │ Construct: aws-cdk-lib.aws_s3.CfnBucket
                       │ Library Version: 2.166.0
                       │ Location: Run with '--debug' to include location info
        - Resource ID: bucket
        - Template Locations:
          > /Resources/bucket
      Description: [CT.S3.PR.1]: Require an Amazon S3 bucket to have block public access settings configured
      How to fix: [FIX]: The parameters 'BlockPublicAcls', 'BlockPublicPolicy', 'IgnorePublicAcls', 'RestrictPublicBuckets' must be set to true under the bucket-level 'PublicAccessBlockConfiguration'.
      Rule Metadata:
        DocumentationUrl: https://github.com/cdklabs/cdk-validator-cfnguard#bundled-control-tower-rules

Mapping AWS resources

Pulumi CDK automatically maps CDK resources to AWS CCAPI resources, but there are some resources that are not yet available in CCAPI. In these cases it is possible to manually map the CloudFormation resource to an AWS Provider resource. A couple of common resources have been mapped in aws-resource-mappings.ts which can be used as a reference.

Simple mapping

import * as pulumicdk from '@pulumi/cdk';
import * as aws from '@pulumi/aws';

const app = new pulumicdk.App('app', (scope: pulumicdk.App): pulumicdk.AppOutputs => {
    const stack = new pulumicdk.Stack('example-stack');
}, {
    appOptions: {
        remapCloudControlResource: (logicalId, typeName, props, options): ResourceMapping | undefined => {
            if (typeName === 'AWS::ApiGatewayV2::Stage') {
                return new aws.apigatewayv2.Stage(
                    logicalId,
                    {
                        accessLogSettings: props.AccessLogSettings,
                        apiId: props.ApiId,
                        ...
                    },
                    options,
                )
            }
            return undefined;
        },
    }
});

Mapping to multiple resources

Sometimes a single CloudFormation resource maps to multiple AWS Provider resources. In these cases you should return the logicalId of the resource along with the resource itself.

import * as pulumicdk from '@pulumi/cdk';
import * as aws from '@pulumi/aws';

const app = new pulumicdk.App('app', (scope: pulumicdk.App): pulumicdk.AppOutputs => {
    const stack = new pulumicdk.Stack('example-stack');
}, {
    appOptions: {
        remapCloudControlResource: (logicalId, typeName, props, options): ResourceMapping | undefined => {
            if (typeName === 'AWS::SQS::QueuePolicy') {
                const queues: string[] = props.queues ?? [];
                return queues.flatMap((q: string, i: number) => {
                    const id = i === 0 ? logicalId : `${logicalId}-policy-${i}`;
                    return {
                        logicalId: id,
                        resource: new aws.sqs.QueuePolicy(
                            id,
                            {
                                policy: rawProps.PolicyDocument,
                                queueUrl: q,
                            },
                            options,
                        ),
                    };
                });
            }
            return undefined;
        },
    }
});

Using Assets

Docker Assets

In order to use Docker assets with Pulumi CDK you have to provide the assetName when you create the asset. This is because Pulumi CDK will automatically create a ECR Repository per image asset.

import * as pulumicdk from '@pulumi/cdk';
import * as aws from '@pulumi/aws';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as ecs from 'aws-cdk-lib/aws-ecs';
import * as ecs_patterns from 'aws-cdk-lib/aws-ecs-patterns';

const app = new pulumicdk.App('app', (scope: pulumicdk.App) => {
    const stack = new pulumicdk.Stack('example-stack');

    const vpc = new ec2.Vpc(stack, 'MyVpc');
    const cluster = new ecs.Cluster(stack, 'fargate-service-autoscaling', { vpc });

    // Create Fargate Service
    const fargateService = new ecs_patterns.NetworkLoadBalancedFargateService(this, 'sample-app', {
        cluster,
        taskImageOptions: {
            image: ecs.ContainerImage.fromAsset(path.join(__dirname, './'), {
                // assetName is now required and is used in the name of the ecr repository that is created
                assetName: 'cdk-fargate-example',
            }),
        },
    });
});

Note If you have issues with permanent asset diffs, make sure you have created a cdk.json with the outdir set to a project relative directory.

Feature Flags

Feature flags in Pulumi CDK work the exact same way as in AWS CDK and can be set the same way as well (e.g. cdk.json). You can view the currently recommended set of feature flags here.

Setting Pulumi options for CDK resources

You can set Pulumi resource options for CDK resources by using Transforms. For example, if you wanted to set protect on database resources you could use a transform like this.

import * as pulumicdk from '@pulumi/cdk';

const app = new pulumicdk.App('app', (scope: pulumicdk.App): pulumicdk.AppOutputs => {
    const stack = new pulumicdk.Stack('example-stack');
}, {
    transforms: [
        (args: pulumi.ResourceTransformArgs): pulumi.ResourceTransformResult => {
            if (args.type === 'aws-native:rds:DbCluster') {
                return {
                    props: args.props,
                    opts: pulumi.mergeOptions(args.opts, { protect: true }),
                };
            }
            return undefined;
        },
    ]
});

Pulumi Synthesizer

By default Pulumi CDK uses a custom PulumiSynthesizer. One of the things a CDK Synthesizer is used for is registering assets. The PulumiSynthesizer handles automatically provisioning the required resources (see Bootstrapping) and uploading File and Image assets.

In order to customize the settings, you can pass in a PulumiSynthesizer that you create.

import * as pulumicdk from '@pulumi/cdk';
import * as s3 from 'aws-cdk-lib/aws-s3';

const app = new pulumicdk.App('app', (scope: pulumicdk.App) => {
    const stack = new pulumicdk.Stack('example-stack');
    const bucket = new s3.Bucket(stack, 'Bucket');
}, {
  appOptions: {
    props: {
      defaultStackSynthesizer: new pulumicdk.PulumiSynthesizer({
        appId: `cdk-${pulumi.getStack()}`,
        autoDeleteStagingAssets: false,
      })
    }
  }
});

Unsupported Features

Unsupported CloudFormation Features

Fn::Transform
Transforms
CloudFormation helper scripts
- cfn-init
- cfn-signal
- cfn-get-metadata
- cfn-hup
ResourceAttributes

Unsupported CDK Features

Cross stack references

AWS Cloud Control AutoNaming Config

Sometimes CDK constructs can create resource names that are too long for the AWS Cloud Control provider. When this happens you can configure the autoTrim feature to have the generated names be automatically trimmed to fit within the name requirements. If you are not configuring your own aws-native provider then this feature is enabled by default. If you are configuring your own aws-native provider then you will have to enable this.

import * as pulumicdk from '@pulumi/cdk';
import * as ccapi from '@pulumi/aws-native';

const nativeProvider = new ccapi.Provider('cdk-native-provider', {
  region: 'us-east-2',
  autoNaming: {
    autoTrim: true,
    randomSuffixMinLength: 7,
  },
});
const app = new pulumicdk.App('app', (scope: pulumicdk.App): pulumicdk.AppOutputs => {
    const stack = new AppRunnerStack('teststack');
    return {
        url: stack.url,
    };
}, {
  providers: [ nativeProvider ],
});

Bootstrapping

CDK has the concept of bootstrapping which requires you to first bootstrap your account with certain AWS resources that CDK needs to exist. With Pulumi CDK this is not required! Pulumi CDK will automatically and dynamically create the bootstrap resources as needed.

S3 Resources

When any file assets are added to your application, CDK will automatically create the following staging resources.

aws.s3.BucketV2

forceDestroy: true

aws.s3.BucketServerSideEncryptionConfigurationV2

AES256

aws.s3.BucketVersioningV2

Enabled

aws.s3.BucketLifecycleConfigurationV2

Expire old versions > 365 days
Expire deploy-time assets > 30 days

aws.s3.BucketPolicy

Require SSL

ECR Resources

When any image assets are added to your application, CDK will automatically create the following staging resources.

aws.ecr.Repository

imageTagMutability: IMMUTABLE

aws.ecr.LifecyclePolicy

Expire old images when the number of images > 3

Multiple Stacks

It is possible to use multiple CDK Stacks in your Pulumi CDK application, but you probably don't need/want to. According to AWS CDK best practices you should separate your application into multiple stacks based on your deployment patterns, keeping as many resources in the same stack as possible. Typically the only three scenarios that justify splitting resources into separate stacks are:

CloudFormation stack resource limits
Keeping stateful resources (like databases) in a separate stack so that you can enable termination protection on that stack.
Creating resources in multiple regions require you to create a stack per region.

When using Pulumi CDK you only need to create multiple Stacks for #3. Currently CDK Stacks in a Pulumi application are only needed when you want to configure a different set of Pulumi resource options (e.g. providers). Otherwise all resources are created as part of the same Pulumi Stack and there is no benefit in splitting resources into multiple CDK Stacks.

Multi Region

If you need to create resources in multiple regions you can use multiple CDK Stacks. The below example shows an application that creates a Stack in us-east-1 in order to create a Lambda@Edge function and then a second stack in us-east-2 which creates the CloudFront resource.

import * as ccapi from '@pulumi/aws-native';
import * as aws from '@pulumi/aws';
import * as pulumi from '@pulumi/pulumi';
import * as pulumicdk from '@pulumi/cdk';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
import * as cloudfront_origins from 'aws-cdk-lib/aws-cloudfront-origins';
import * as s3 from 'aws-cdk-lib/aws-s3';

interface CloudFrontAppStackProps {
    edgeFunctionArn: pulumi.Output<string>;
}

class EdgeFunctionStack extends pulumicdk.Stack {
    public versionArn: pulumi.Output<string>;
    constructor(scope: pulumicdk.App, id: string) {
        super(scope, id, {
            props: {
                env: {
                    region: 'us-east-1',
                },
            },
            providers: [
                new ccapi.Provider('ccapi', {
                    region: 'us-east-1',
                }),
                new aws.Provider('aws', {
                    region: 'us-east-1',
                }),
            ],
        });

        const handler = new cloudfront.experimental.EdgeFunction(this, 'edge-handler', {
            runtime: lambda.Runtime.NODEJS_LATEST,
            handler: 'index.handler',
            code: lambda.Code.fromInline('export const handler = async () => { return "hello" }'),
        });

        this.versionArn = this.asOutput(handler.currentVersion.edgeArn);
    }
}

class CloudFrontAppStack extends pulumicdk.Stack {
    constructor(scope: pulumicdk.App, id: string, props: CloudFrontAppStackProps) {
        super(scope, id);


        const bucket = new s3.Bucket(this, 'Bucket');

        new cloudfront.Distribution(this, 'distro', {
            defaultBehavior: {
                origin: new cloudfront_origins.S3Origin(bucket),
                edgeLambdas: [
                    {
                        eventType: cloudfront.LambdaEdgeEventType.ORIGIN_REQUEST,
                        functionVersion: lambda.Version.fromVersionArn(
                            this,
                            'edge',
                            pulumicdk.asString(props.edgeFunctionArn),
                        ),
                    },
                ],
            },
        });
    }
}

class MyApp extends pulumicdk.App {
    constructor() {
        super('app', (scope: pulumicdk.App) => {
            const edgeStack = new EdgeFunctionStack(scope, 'edge-function');
            new CloudFrontAppStack(scope, 'cloudfront-app', {
                edgeFunctionArn: edgeStack.versionArn,
            });
        });
    }
}
const app = new MyApp();
const output = app.outputs['url'];
export const url = pulumi.interpolate`https://${output}`;

Pulumi CDK does not support native cross stack references. Instead, you can convert a value to a Pulumi Output in order to reference the value in a separate stack.

API

See API Docs for more details.

Contributing

Building locally

Install dependencies, build library, and link for local usage.

$ yarn install
$ yarn build
$ yarn link

Run unit test:

$ yarn test

  Basic tests
    ✔ Checking single resource registration (124ms)
    ✔ Supports Output<T> (58ms)

  Graph tests
    ✔ Test sort for single resource
    ✔ Test sort for ASG example (56ms)
    ✔ Test sort for appsvc example
    ✔ Test sort for apprunner example


  6 passing (278ms)

Run Pulumi examples:

$ yarn test-examples

Name		Name	Last commit message	Last commit date
Latest commit History 232 Commits
.github		.github
adr		adr
api-docs		api-docs
examples		examples
integration		integration
schemas		schemas
scripts		scripts
src		src
tests		tests
.eslintignore		.eslintignore
.eslintrc.js		.eslintrc.js
.gitignore		.gitignore
.npmignore		.npmignore
.prettierrc		.prettierrc
CODE-OF-CONDUCT.md		CODE-OF-CONDUCT.md
LICENSE		LICENSE
Makefile		Makefile
README.md		README.md
go.mod		go.mod
go.sum		go.sum
package.json		package.json
renovate.json5		renovate.json5
tsconfig.json		tsconfig.json
typedoc.json		typedoc.json
yarn.lock		yarn.lock

License

pulumi/pulumi-cdk

Folders and files

Latest commit

History

Repository files navigation

Pulumi CDK Adapter

Table of Contents

Getting Started

cdk.json File

Example

Use Pulumi resources with CDK Constructs

CDK to Pulumi Example

Pulumi to CDK Example

Create Pulumi outputs

Customizing providers

Stack Level Providers

CDK Lookups

Use Pulumi functions

Experimental Lookup Support

Using Pulumi Policy Packs

CDK Aspects

CDK Policy Validation Plugins

Mapping AWS resources

Simple mapping

Mapping to multiple resources

Using Assets

Docker Assets

Feature Flags

Setting Pulumi options for CDK resources

Pulumi Synthesizer

Unsupported Features

Unsupported CloudFormation Features

Unsupported CDK Features

AWS Cloud Control AutoNaming Config

Bootstrapping

S3 Resources

ECR Resources

Multiple Stacks

Multi Region

API

Contributing

Building locally

About

Resources

License

Code of conduct

Security policy

Stars

Watchers

Forks

Releases 15

Packages 0

Contributors 21

Languages

Packages