# pulumi Pulumi is an open-source infrastructure-as-code platform and toolset for defining, deploying, and managing cloud infrastructure with programming languages. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Cloud Sovereignty, Provider Risk, and Migration Options for EU Companies DevFeed: [Cloud Sovereignty, Provider Risk, and Migration Options for EU Companies]() Original publisher: [Read original article]() Author: Adam Gordon Bell Published: 2026-09-16T13:00:00Z Content type: opinion Language: en Sources: [Pulumi]() Topics: [Cloud](), [migration](), [pulumi](), [Security](), [scaleway](), [Tooling]() Tags: [aws](), [azure](), [cloud](), [customers](), [kubernetes](), [migration](), [platform-engineering](), [pulumi](), [scaleway](), [security]() ### AI overview This recorded discussion examines cloud sovereignty, legal and cost concerns for EU companies using major US cloud providers, and the practical tradeoffs of moving to European providers. Three guests discuss provider exposure, encryption and account shutdown risks, migration costs, and whether Pulumi and agentic infrastructure can make future moves easier. ### Source excerpt Recorded September 3, 2026. Quotes are lightly edited for clarity. Maybe this sounds familiar. You run infrastructure at a company that isn't American. Your workloads are on AWS, Azure, or Google Cloud, probably more than one, because that is what everyone picked. Until recently nobody asked you where the data lives or who can reach it. Now you're getting questions. Legal wants to know what NIS2 means for where your systems run. Someone on the leadership team read that the US government locked the cloud accounts of judges at the International Criminal Court and wants to know if that could happen to you. Finance wants to know why the bill went up again. A customer's security review asked, in writing, which country your data sits in. So now you have questions of your own: If a US court or agency wants my data, can they get it from my provider without involving me? Does putting everything in an EU region change that? The big providers now sell "sovereign cloud" in Europe. Is that different, or a rename? If I encrypt everything and hold the keys myself, am I covered? Could my account be switched off one day? What would I do? Are Hetzner, OVH, and Scaleway usable for real workloads? How much cheaper are they once you count the migration? What should I be building on now so I can leave later if I need to? A migration like this used to be a multi-year project. Does Pulumi and agentic infrastructure change that? Is any of this worth the disruption, or should I leave what works alone? I put those questions to three people who have each dealt with this for real. One of them helps EU companies work out their exposure and builds the tooling to leave. Another has spent fifteen years sizing what cloud actually costs, and thinks most people should stay put. The third moved his company off AWS and onto a European provider. They don't agree on how big the risk is. The full hour is below. Don't just default to the hyperscalers Waldemar Kindler co-founded Think Ahead Technologies, whe ## ITIL vs SRE: why the big clouds went their own way DevFeed: [ITIL vs SRE: why the big clouds went their own way]() Original publisher: [Read original article]() Author: Sridhar Rajarao Published: 2026-07-26T00:00:00Z Content type: opinion Language: en Sources: [Sridhar Rajarao]() Topics: [SRE](), [site-reliability-engineering](), [Development](), [Terraform](), [pulumi](), [Availability](), [feature flags](), [incident]() Tags: [automated](), [aws](), [azure](), [cloud](), [feature-flags](), [gcp](), [human-review](), [hyperscaler](), [incident](), [incident-management](), [infrastructure-as-code](), [itil](), [on-call](), [postmortems](), [pulumi](), [release](), [reliability](), [service-catalog](), [sre](), [terraform]() ### AI overview This opinion article compares ITIL practices with SRE operations at hyperscaler scale. It argues that human change boards, single production instances, developer-to-operations handoffs, documentation-first configuration management, and weekly release windows do not fit environments serving millions of external customers. It describes automated approvals, gradual deployments, service-team ownership, infrastructure as code, continuous release, error budgets, SLOs, and blameless postmortems as alternatives. ### Source excerpt The big clouds don't run ITIL. Five assumptions ITIL makes that break at hyperscaler scale, and what AWS, Azure, GCP, and OCI use instead. ## Incident Response as Code: Managing PagerDuty with Pulumi DevFeed: [Incident Response as Code: Managing PagerDuty with Pulumi]() Original publisher: [Read original article]() Author: Engin Diri Published: 2026-07-20T00:00:00Z Content type: tutorial Language: en Sources: [Pulumi]() Topics: [pulumi](), [Incident response](), [Amazon Web Services](), [TypeScript](), [Amazon Simple Queue Service (SQS)]() Tags: [aws](), [devops](), [incident](), [incident-response](), [infrastructure-as-code](), [pagerduty](), [pulumi](), [sqs](), [tutorials](), [typescript]() ### AI overview A tutorial for managing PagerDuty incident-response resources and AWS alarm wiring together in a Pulumi program. The demo uses TypeScript to define an on-call team, escalation policy, PagerDuty service, SQS dead-letter queue, CloudWatch alarm, and SNS forwarding. ### Source excerpt You usually find out in the postmortem: the alarm fired, but it paged a schedule nobody was on anymore. Or the service had been running in production for three months before anyone created the matching PagerDuty service, so the first person to notice the outage was a customer. The infrastructure was code, reviewed and versioned. The incident response setup was forty clicks in a web UI, done once, by someone who has since changed teams. PagerDuty's own engineering team has been making the case for managing PagerDuty as code for years, and the OneUptime folks recently published a hands-on guide to the PagerDuty Terraform provider that walks the whole resource catalog. I liked both posts, and you probably know where this is going: I want the same thing in TypeScript, with the on-call setup and the infrastructure it protects living in the same Pulumi program. Teams, schedules, escalation policies, services, and the CloudWatch alarm that pages you: one pulumi up. What you are building The demo models a small platform team that owns a checkout service on AWS. On the PagerDuty side: a team with three members, a weekly on-call rotation, an escalation policy with two levels, and a service with a CloudWatch integration. On the AWS side: a dead-letter queue, an alarm that fires when a message lands in it, and an SNS topic that forwards the alarm to PagerDuty. The interesting part is where the two meet: the integration key PagerDuty mints flows straight into the SNS subscription without ever touching a clipboard. flowchart LR DLQ["SQS dead-letter queue"] --> Alarm["CloudWatch alarm"] Alarm --> SNS["SNS topic"] SNS -->|"HTTPS subscription with integration key"| Int["CloudWatch integration"] Int --> Svc["PagerDuty service Checkout API"] Svc --> EP["Escalation policy"] EP -->|"level 1"| Sched["Weekly rotation Lena, Jonas, Mia"] EP -->|"level 2, after 15 min"| Lead["Team lead"] Everything on both sides of that diagram is one TypeScript program. If you would rather write ## Neo Automations: Scheduled Tasks Shipped as Pull Requests DevFeed: [Neo Automations: Scheduled Tasks Shipped as Pull Requests]() Original publisher: [Read original article]() Author: Pulumi Neo Team Published: 2026-05-21T14:00:00Z Content type: release Language: en Sources: [Pulumi]() Topics: [pulumi-neo](), [Automation](), [pull-requests](), [pulumi](), [Amazon Web Services](), [Kubernetes]() Tags: [ai](), [ai-agents](), [automation](), [aws](), [features](), [kubernetes](), [product](), [pull-requests](), [pulumi](), [pulumi-neo]() ### AI overview Pulumi Neo now supports scheduled automations that run tasks on hourly, daily, weekday, or weekly cadences and open pull requests for proposed changes. The launch includes templates for provider freshness, encryption, backup, and activity audits, along with configurable prompts, permissions, and integrations. ### Source excerpt Recurring platform work slips: provider versions fall behind, drift accumulates between checks, and the quarterly audit keeps getting pushed back another month. Pulumi Neo can now run any task on a cadence you set, opening a pull request for each run. Automations in action Your platform team runs stacks across staging and production, and the AWS, GCP, and Kubernetes providers keep shipping new versions. Nobody has time to bump them stack by stack. You write one automation: Every Monday at 8 AM, check the infra/ project for stacks where the AWS, GCP, or Kubernetes provider is more than two minor versions behind. For each one, bump the out-of-date provider, run pulumi preview, and open a PR if the preview is clean. Monday morning, Neo runs the prompt. It finds three stacks behind on the AWS provider, edits each program, runs preview, and opens a PR for each clean run. You review the PRs like you would any other dependency bump, merge them, and Neo runs again next Monday. What automations are for The launch includes four built-in templates: a provider freshness check, an encryption audit, a backup audit, and an activity digest. You can also skip the templates and write your own prompt. Pick from hourly, daily, weekdays, or weekly cadences. Each automation gets its own page in the Automations tab, where you can edit the prompt, change the schedule, run it once on demand, or pause it. Safe by default Automations default to two settings that fit recurring work. Approval mode is auto, so a run doesn't wait for human confirmation between steps. Permission mode is read-only, so a run can read state and propose changes through pull requests but can't apply changes directly. You can override either default per automation. How automations fit with the rest of Neo A scheduled task uses the same context as an interactive Neo task. Custom Instructions at the organization and project level apply, so a scheduled run respects the same naming conventions, tagging policies, and archite ## Chainguard Image now available for Pulumi DevFeed: [Chainguard Image now available for Pulumi]() Original publisher: [Read original article]() Published: 2023-06-29T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [pulumi](), [Infrastructure as code](), [container images](), [Security]() Tags: [apko](), [container-images](), [iac](), [multi-arch](), [pulumi](), [security](), [trivy](), [wolfi](), [x86-64]() ### AI overview Chainguard announces a Pulumi container image packaged with the Pulumi toolchain in Wolfi OS and built using apko. The image supports multiple programming-language runtimes, is multi-architecture, and is reported to be smaller and to have fewer Trivy-reported CVEs than the official Pulumi image. ### Source excerpt See a 57% reduction in your Pulumi image sizes with more security built in by default and a 97% reduction in CVEs with the new Chainguard Pulumi Image.