Pulumi vs SST vs CDKTF (2026)

import * as pulumi from "@pulumi/pulumi"
import * as aws from "@pulumi/aws"

// S3 bucket:
const bucket = new aws.s3.Bucket("pkgpulse-assets", {
  website: {
    indexDocument: "index.html",
    errorDocument: "404.html",
  },
})

// Lambda function:
const fn = new aws.lambda.Function("api-handler", {
  runtime: "nodejs20.x",
  handler: "index.handler",
  code: new pulumi.asset.AssetArchive({
    ".": new pulumi.asset.FileArchive("./dist"),
  }),
  environment: {
    variables: {
      BUCKET_NAME: bucket.id,
    },
  },
})

// API Gateway:
const api = new aws.apigatewayv2.Api("http-api", {
  protocolType: "HTTP",
})

const integration = new aws.apigatewayv2.Integration("lambda-integration", {
  apiId: api.id,
  integrationType: "AWS_PROXY",
  integrationUri: fn.arn,
})

// Outputs:
export const bucketUrl = bucket.websiteEndpoint
export const apiUrl = api.apiEndpoint

import * as pulumi from "@pulumi/pulumi"
import * as aws from "@pulumi/aws"
import * as gcp from "@pulumi/gcp"
import * as cloudflare from "@pulumi/cloudflare"

// AWS — database:
const db = new aws.rds.Instance("pkgpulse-db", {
  engine: "postgres",
  instanceClass: "db.t4g.micro",
  allocatedStorage: 20,
  dbName: "pkgpulse",
})

// GCP — storage:
const bucket = new gcp.storage.Bucket("pkgpulse-backups", {
  location: "US",
  uniformBucketLevelAccess: true,
})

// Cloudflare — DNS:
const record = new cloudflare.Record("api-record", {
  zoneId: process.env.CLOUDFLARE_ZONE_ID!,
  name: "api",
  type: "CNAME",
  value: "api.pkgpulse.com",
  proxied: true,
})

import * as pulumi from "@pulumi/pulumi"
import * as aws from "@pulumi/aws"

// Reusable component:
class StaticSite extends pulumi.ComponentResource {
  public readonly url: pulumi.Output<string>

  constructor(name: string, args: { domain: string }, opts?: pulumi.ComponentResourceOptions) {
    super("pkgpulse:StaticSite", name, {}, opts)

    const bucket = new aws.s3.Bucket(`${name}-bucket`, {
      website: { indexDocument: "index.html" },
    }, { parent: this })

    const cdn = new aws.cloudfront.Distribution(`${name}-cdn`, {
      origins: [{
        domainName: bucket.bucketRegionalDomainName,
        originId: "s3",
      }],
      enabled: true,
      defaultRootObject: "index.html",
      defaultCacheBehavior: {
        viewerProtocolPolicy: "redirect-to-https",
        allowedMethods: ["GET", "HEAD"],
        cachedMethods: ["GET", "HEAD"],
        targetOriginId: "s3",
        forwardedValues: { queryString: false, cookies: { forward: "none" } },
      },
      restrictions: { geoRestriction: { restrictionType: "none" } },
      viewerCertificate: { cloudfrontDefaultCertificate: true },
    }, { parent: this })

    this.url = cdn.domainName
    this.registerOutputs({ url: this.url })
  }
}

// Usage:
const site = new StaticSite("pkgpulse", { domain: "pkgpulse.com" })
export const siteUrl = site.url

// sst.config.ts
export default $config({
  app(input) {
    return {
      name: "pkgpulse",
      removal: input.stage === "production" ? "retain" : "remove",
      home: "aws",
    }
  },
  async run() {
    // Deploy Next.js to AWS:
    const site = new sst.aws.Nextjs("PkgPulse", {
      domain: "pkgpulse.com",
      environment: {
        DATABASE_URL: db.properties.connectionString,
      },
    })

    return { url: site.url }
  },
})

// sst.config.ts
export default $config({
  app(input) {
    return { name: "pkgpulse", home: "aws" }
  },
  async run() {
    // Database:
    const db = new sst.aws.Postgres("Database", {
      scaling: { min: "0.5 ACU", max: "4 ACU" },
    })

    // Storage:
    const bucket = new sst.aws.Bucket("Assets")

    // API:
    const api = new sst.aws.Function("Api", {
      handler: "packages/api/src/index.handler",
      url: true,
      link: [db, bucket],
      environment: {
        STAGE: $app.stage,
      },
    })

    // Cron job:
    new sst.aws.Cron("DailySync", {
      schedule: "rate(1 day)",
      job: {
        handler: "packages/jobs/src/sync.handler",
        link: [db],
      },
    })

    // Frontend:
    const site = new sst.aws.Nextjs("Web", {
      path: "packages/web",
      link: [api],
      domain: "pkgpulse.com",
    })

    return {
      api: api.url,
      site: site.url,
    }
  },
})

// In your Lambda function code:
import { Resource } from "sst"

// Type-safe resource access:
const dbUrl = Resource.Database.connectionString
const bucketName = Resource.Assets.name

// No manual env var wiring needed — SST links resources automatically

# Start live development:
npx sst dev

# → Deploys to AWS
# → Proxies Lambda invocations to your local machine
# → Set breakpoints in VS Code
# → See logs in real-time
# → Hot reload on file changes

import { Construct } from "constructs"
import { App, TerraformStack, TerraformOutput } from "cdktf"
import { AwsProvider } from "@cdktf/provider-aws/lib/provider"
import { S3Bucket } from "@cdktf/provider-aws/lib/s3-bucket"
import { LambdaFunction } from "@cdktf/provider-aws/lib/lambda-function"
import { IamRole } from "@cdktf/provider-aws/lib/iam-role"

class PkgPulseStack extends TerraformStack {
  constructor(scope: Construct, id: string) {
    super(scope, id)

    new AwsProvider(this, "aws", { region: "us-east-1" })

    // S3 bucket:
    const bucket = new S3Bucket(this, "assets", {
      bucket: "pkgpulse-assets",
    })

    // IAM role:
    const role = new IamRole(this, "lambda-role", {
      name: "pkgpulse-lambda-role",
      assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
          Action: "sts:AssumeRole",
          Effect: "Allow",
          Principal: { Service: "lambda.amazonaws.com" },
        }],
      }),
    })

    // Lambda:
    const fn = new LambdaFunction(this, "api", {
      functionName: "pkgpulse-api",
      runtime: "nodejs20.x",
      handler: "index.handler",
      role: role.arn,
      filename: "dist/lambda.zip",
      environment: {
        variables: { BUCKET_NAME: bucket.id },
      },
    })

    new TerraformOutput(this, "bucket-name", { value: bucket.id })
    new TerraformOutput(this, "function-arn", { value: fn.arn })
  }
}

const app = new App()
new PkgPulseStack(app, "pkgpulse")
app.synth()

import { CloudflareProvider } from "@cdktf/provider-cloudflare/lib/provider"
import { Record } from "@cdktf/provider-cloudflare/lib/record"
import { DataCloudflareZone } from "@cdktf/provider-cloudflare/lib/data-cloudflare-zone"

// Use any Terraform provider:
new CloudflareProvider(this, "cloudflare", {
  apiToken: process.env.CLOUDFLARE_API_TOKEN,
})

const zone = new DataCloudflareZone(this, "zone", {
  name: "pkgpulse.com",
})

new Record(this, "api-record", {
  zoneId: zone.id,
  name: "api",
  type: "CNAME",
  value: "api.pkgpulse.com",
  proxied: true,
})

import { Construct } from "constructs"
import { S3Bucket } from "@cdktf/provider-aws/lib/s3-bucket"
import { CloudfrontDistribution } from "@cdktf/provider-aws/lib/cloudfront-distribution"

class StaticSite extends Construct {
  public readonly url: string

  constructor(scope: Construct, id: string, props: { domain: string }) {
    super(scope, id)

    const bucket = new S3Bucket(this, "bucket", {
      bucket: `${props.domain}-static`,
    })

    const cdn = new CloudfrontDistribution(this, "cdn", {
      origin: [{
        domainName: bucket.bucketRegionalDomainName,
        originId: "s3",
      }],
      enabled: true,
      defaultRootObject: "index.html",
      defaultCacheBehavior: {
        allowedMethods: ["GET", "HEAD"],
        cachedMethods: ["GET", "HEAD"],
        targetOriginId: "s3",
        viewerProtocolPolicy: "redirect-to-https",
        forwardedValues: { queryString: false, cookies: { forward: "none" } },
      },
      restrictions: { geoRestriction: { restrictionType: "none" } },
      viewerCertificate: { cloudfrontDefaultCertificate: true },
    })

    this.url = cdn.domainName
  }
}

// Usage:
const site = new StaticSite(this, "site", { domain: "pkgpulse.com" })

# Initialize:
cdktf init --template=typescript

# Synthesize (TypeScript → Terraform JSON):
cdktf synth

# Plan:
cdktf diff

# Deploy:
cdktf deploy

# Destroy:
cdktf destroy