Infrastructure as Code: Terraform vs Pulumi vs Ansible

Infrastructure as Code (IaC) is essential for modern DevOps. This guide compares three popular tools: Terraform, Pulumi, and Ansible, helping you choose the right one for your needs.

Overview Comparison#

Terraform#

Terraform uses HashiCorp Configuration Language (HCL) and is the most popular IaC tool.

Example: AWS EC2 Instance#

# main.tf
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t3.micro"

  tags = {
    Name = "WebServer"
    Environment = "Production"
  }
}

output "instance_ip" {
  value = aws_instance.web.public_ip
}

Pros:

• Mature and stable
• Excellent documentation
• Large community
• Strong state management
• Multi-cloud support

Cons:

• Limited programming constructs
• HCL can be verbose
• State file management complexity

Pulumi#

Pulumi allows you to write IaC in familiar programming languages.

Example: AWS EC2 Instance (TypeScript)#

import * as aws from "@pulumi/aws";

const instance = new aws.ec2.Instance("web", {
    ami: "ami-0c55b159cbfafe1f0",
    instanceType: "t3.micro",
    tags: {
        Name: "WebServer",
        Environment: "Production",
    },
});

export const instanceIp = instance.publicIp;

Example: AWS EC2 Instance (Python)#

import pulumi
import pulumi_aws as aws

instance = aws.ec2.Instance("web",
    ami="ami-0c55b159cbfafe1f0",
    instance_type="t3.micro",
    tags={
        "Name": "WebServer",
        "Environment": "Production",
    }
)

pulumi.export("instance_ip", instance.public_ip)

Pros:

• Use familiar languages (TypeScript, Python, Go, etc.)
• Better for complex logic
• Strong typing and IDE support
• Good for application developers

Cons:

• Smaller community than Terraform
• Requires programming knowledge
• Can be overkill for simple infrastructure

Ansible#

Ansible is primarily a configuration management tool but can also provision infrastructure.

Example: EC2 Instance#

# playbook.yml
---
- name: Create EC2 instance
  hosts: localhost
  gather_facts: no
  tasks:
    - name: Launch instance
      ec2_instance:
        name: webserver
        image_id: ami-0c55b159cbfafe1f0
        instance_type: t3.micro
        tags:
          Name: WebServer
          Environment: Production
      register: ec2

    - name: Display instance IP
      debug:
        msg: "Instance IP: {{ ec2.instances[0].public_ip_address }}"

Pros:

• Agentless (SSH-based)
• Easy to learn (YAML)
• Excellent for configuration management
• Large module library
• Idempotent operations

Cons:

• Weaker state management
• Not ideal for complex cloud provisioning
• Can be slow for large infrastructures

When to Use Each#

Use Terraform When:#

• Provisioning cloud infrastructure
• Need strong state management
• Working with multiple cloud providers
• Team is comfortable with HCL

Use Pulumi When:#

• Team has strong programming skills
• Need complex logic in infrastructure
• Want type safety and IDE support
• Building reusable infrastructure libraries

Use Ansible When:#

• Managing server configuration
• Need to configure existing infrastructure
• Prefer declarative YAML
• Working with mixed environments

Combining Tools#

Many teams use multiple tools together:

┌─────────────┐     ┌──────────────┐     ┌─────────────┐
│  Terraform  │────▶│  Infrastructure│────▶│   Ansible   │
│ (Provision) │     │   (Created)   │     │ (Configure)│
└─────────────┘     └──────────────┘     └─────────────┘

Workflow Example#

1. Terraform provisions infrastructure
2. Ansible configures the provisioned servers
3. Pulumi (optional) handles complex application deployments

Best Practices#

Terraform#

• Use modules for reusability
• Implement remote state
• Use workspaces for environments
• Version control all code
• Review plans before applying

Pulumi#

• Organize projects by environment
• Use stacks for different environments
• Leverage programming features (loops, functions)
• Write tests for infrastructure code

Ansible#

• Use roles for organization
• Keep playbooks idempotent
• Use inventories for different environments
• Leverage Ansible Vault for secrets

Migration Strategies#

Terraform to Pulumi#

# Use terraform-bridge to convert
pulumi import --from terraform main.tf

Ansible to Terraform#

• Use Terraform for new infrastructure
• Keep Ansible for configuration
• Gradually migrate playbooks

Conclusion#

There's no one-size-fits-all solution. Choose based on:

• Your team's skills
• Infrastructure complexity
• Cloud provider requirements
• Existing tooling

Many successful teams use Terraform for provisioning and Ansible for configuration, while Pulumi is gaining traction for teams with strong programming backgrounds.