pulumi-aws

@pulumi/aws is the Node.js/TypeScript SDK for Pulumi’s AWS resource provider, a Terraform-bridged package that exposes strongly-typed classes for the entirety of AWS’s resource surface — EC2, S3, IAM, Lambda, RDS, ECS, VPC, CloudFront, and hundreds more — generated from the upstream terraform-provider-aws schema and kept current as AWS adds services.

Beyond raw resource coverage, the package layers convenience abstractions on top, such as aws.lambda.CallbackFunction for defining serverless functions directly from an in-language callback, plus data-source functions like getCallerIdentity and getAvailabilityZones for reading live account state during a deploy. The same generated schema produces matching SDKs for Python, Go, .NET, and Java, so teams standardize on one resource model across every language.

What You Get

• Full strongly-typed resource coverage across the entirety of AWS services (EC2, S3, IAM, Lambda, RDS, ECS, VPC, CloudFront, and hundreds more)
• Data source functions (aws.getCallerIdentity, aws.getAvailabilityZones, aws.getRegion, aws.getPartition) for querying live AWS account/region state at preview and update time
• Convenience abstractions layered on top of raw resources, like aws.lambda.CallbackFunction for defining a Lambda directly from an in-language callback
• A consistent provider configuration surface (access keys, named profiles, shared credentials files, STS assume-role, custom endpoints) matching Terraform’s AWS provider model
• Automatic secret-handling for sensitive outputs (access keys, passwords, tokens) surfaced as Pulumi secret outputs

Common Use Cases

• Provisioning AWS infrastructure (VPCs, EC2, ECS/EKS, RDS, S3) entirely in TypeScript, Python, Go, C#, or Java instead of HCL
• Wiring event-driven serverless architectures (S3-to-Lambda, CloudWatch-to-Lambda) using the callback-function helpers
• Building reusable, versioned component resources that wrap common AWS patterns for internal platform teams
• Migrating existing Terraform AWS configurations into a general-purpose programming language via Pulumi
• Managing multi-account/multi-region AWS deployments with per-stack provider configuration

Under The Hood

Architecture The provider is built on the Terraform-bridge pattern: provider/resources.go assembles a tfbridge.ProviderInfo that wraps the upstream terraform-provider-aws schema (via pkg/tfshim/sdk-v2 for classic SDKv2 resources and pkg/pf/tfbridge for newer plugin-framework resources), with resource_overrides.go, data_source_overrides.go, aliases.go, compatibility.go, and computed_ids.go translating Terraform resource and attribute names into Pulumi tokens and preserving identity across provider versions. provider/cmd/pulumi-tfgen-aws generates the cross-language schema from this metadata, while provider/cmd/pulumi-resource-aws is the runtime gRPC provider binary the Pulumi engine talks to; the sdk/{nodejs,python,go,dotnet,java} directories are entirely generated output that AGENTS.md explicitly forbids hand-editing, with only a small set of hand-authored overlay files (CallbackFunction, ARN build/parse helpers, tag utilities) layered in for ergonomics beyond raw generation.

Tech Stack Go modules pull in pulumi-terraform-bridge/v3 as the core bridging dependency, which wraps a Pulumi-forked terraform-plugin-sdk/v2 plus terraform-plugin-framework/-go/-log for framework-based upstream resources; the build is orchestrated by a large generated Makefile (sourced from .ci-mgmt.yaml) driving make schema and make build_sdks. Generated SDKs use plain tsc for the Node.js package, standard packaging for Python, Go modules for the Go SDK, and equivalent .NET/Java toolchains; mise.toml and devbox.json/.devcontainer pin reproducible tool versions, and CI runs as GitHub Actions across build, lint, unit-test, and both scheduled and nightly acceptance-test workflows, with Renovate managing dependency upgrades.

Code Quality The provider/ package carries roughly a dozen Go test files (configure_test.go, doc_edits_test.go, replay_regressions_test.go, provider_endpoint_test.go, enum_test.go, resources_test.go, and more) exercising bridge configuration, documentation post-processing, and provider replay regressions, while examples/ adds per-language end-to-end tests (examples_nodejs_test.go, examples_go_test.go, examples_dotnet_test.go) that actually deploy sample programs; .golangci.yml enforces Go linting via make lint, and error handling favors typed tfbridge/tfdiag diagnostics over swallowed errors. No hand-written tests exist for the generated SDK code itself, which is consistent with the project’s stated policy that SDKs are generated artifacts never edited directly, so coverage properly concentrates on the provider/bridge layer and cross-language example programs instead.

What Makes It Unique The package’s distinguishing quality is scale and fidelity rather than a novel API shape: it mirrors Terraform’s AWS resource surface closely enough that existing Terraform AWS knowledge transfers almost directly, while the schema-driven generation pipeline keeps five language SDKs — Node/TypeScript, Python, Go, .NET, and Java — in lockstep from one upstream source that is refreshed against the real Terraform AWS provider on a regular cadence. Deliberate ergonomic additions on top of the generated baseline, like the callback-based Lambda helper and ARN/tag utilities, show real polish, but the underlying bridge-a-Terraform-provider approach is now a well-established pattern across the wider Pulumi ecosystem rather than something unique to this package.