Search the docs, videos, blog, apps, teams, skills and release notes.
At a glance
What it is
Expert guide for infrastructure as code using Pulumi with TypeScript, Python, and Go. Covers stack management, state backends, component resources, secrets, testing, CI/CD integration, and migration from Terraform.
A skill is a written procedure a bot loads when a job calls for it. This one is a single file, SKILL.md, and the whole file is on this page.
The whole file, exactly as it downloads. Read it before you rely on it.
SKILL.md
404 lines · 1,413 words
You are an expert in Pulumi infrastructure as code. You guide teams through project architecture, stack management, component resource design, state backends, secrets management, testing, and CI/CD integration using real programming languages instead of domain-specific configuration languages.
Real languages, real power - Use loops, conditionals, functions, classes, and type systems from your language of choice.
Expert guide for infrastructure as code using Pulumi with TypeScript, Python, and Go. Covers stack management, state backends, component resources, secrets, testing, CI/CD integration, and migration from Terraform.
Nothing. It ships with Murage, which is open source. Your bots run on the AI plan you already have.
Yes. Open it in Settings → Skills to read, edit or duplicate it. Skill Guard scans it again after every edit.
Download the app, connect the AI you already pay for, and tell your Chief of Staff what needs doing. Plan on about ten minutes from install to a working team.
No account needed · Runs on the AI plan you already pay for
Paste it into your agent's instructions (CLAUDE.md, AGENTS.md or a custom GPT), or add it to a bot in Murage.
Ask Ember for the bot, then switch the skill on in its settings.
Step 1
Send your Chief of Staff this message. It proposes the bot and its role first, and creates it when you say go.
Send this to Ember
“Create a bot that uses the Pulumi Engineer skill, and show me the plan first.”
You're done when your Chief proposes the bot and its role, and the bot appears in your sidebar once you say go.
Step 2
You're done when you see the bot’s skills and the library.
Step 3
You're done when the skill shows as on for that bot.
Step 4
You're done when the bot takes the job and opens the skill when it needs it.
Prefer to do it yourself? Choose + in the sidebar, then New Bot.Read the full guide to skills and Skill Guard
What it teaches a bot, what it covers, and the whole file to read.
The principle
You are an expert in Pulumi infrastructure as code. You guide teams through project architecture, stack management, component resource design, state backends, secrets management, testing, and CI/CD integration using real programming languages instead of domain-specific configuration languages.
What it covers
Core Principles
Project Structure (TypeScript)
Component Resources
State Management
Secrets
Dynamic Providers
Testing
CI/CD (GitHub Actions)
Migration from Terraform
Common Commands
Production Checklist
When to Use
Output Format
Example
Edge Cases
Components for abstraction - Build reusable component resources that encapsulate cloud patterns.
infrastructure/
Pulumi.yaml # Project definition
Pulumi.dev.yaml # Dev stack config
Pulumi.staging.yaml
Pulumi.prod.yaml
index.ts # Entry point
package.json
tsconfig.json
src/
components/ # Reusable component resources
vpc.ts
database.ts
config/
settings.ts
__tests__/
vpc.test.ts# Pulumi.prod.yaml
config:
aws:region: us-east-1
my-infra:environment: production
my-infra:vpcCidr: "10.0.0.0/16"
my-infra:instanceType: m5.large
my-infra:dbPassword:
secure: AAABAMt1P8K... # Encrypted secretimport * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
export interface VpcArgs {
cidrBlock: string;
azs: string[];
enableNat?: boolean;
tags?: Record<string, string>;
}
export class Vpc extends pulumi.ComponentResource {
public readonly vpcId: pulumi.Output<string>;
public readonly publicSubnetIds: pulumi.Output<string>[];
public readonly privateSubnetIds: pulumi.Output<string>[];
constructor(name: string, args: VpcArgs, opts?: pulumi.ComponentResourceOptions) {
super("custom:networking:Vpc", name, {}, opts);
const parent = { parent: this };
const tags = { ...args.tags, ManagedBy: "pulumi" };
const vpc = new aws.ec2.Vpc(`${name}-vpc`, {
cidrBlock: args.cidrBlock,
enableDnsHostnames: true,
tags: { ...tags, Name: `${name}-vpc` },
}, parent);
this.vpcId = vpc.id;
this.publicSubnetIds = [];
this.privateSubnetIds = [];
const igw = new aws.ec2.InternetGateway(`${name}-igw`, {
vpcId: vpc.id, tags: { ...tags, Name: `${name}-igw` },
}, parent);
const publicRt = new aws.ec2.RouteTable(`${name}-public-rt`, {
vpcId: vpc.id,
routes: [{ cidrBlock: "0.0.0.0/0", gatewayId: igw.id }],
}, parent);
args.azs.forEach((az, i) => {
const pub = new aws.ec2.Subnet(`${name}-pub-${i}`, {
vpcId: vpc.id, cidrBlock: `10.0.${i}.0/24`,
availabilityZone: az, mapPublicIpOnLaunch: true,
}, parent);
this.publicSubnetIds.push(pub.id);
new aws.ec2.RouteTableAssociation(`${name}-pub-rta-${i}`, {
subnetId: pub.id, routeTableId: publicRt.id,
}, parent);
const priv = new aws.ec2.Subnet(`${name}-priv-${i}`, {
vpcId: vpc.id, cidrBlock: `10.0.${128 + i}.0/24`,
availabilityZone: az,
}, parent);
this.privateSubnetIds.push(priv.id);
});
this.registerOutputs({ vpcId: this.vpcId });
}
}
// Usage
const vpc = new Vpc("main", {
cidrBlock: config.require("vpcCidr"),
azs: ["us-east-1a", "us-east-1b", "us-east-1c"],
tags: { Environment: pulumi.getStack() },
});
export const vpcId = vpc.vpcId;BACKEND WHEN TO USE COMMAND
---------------------------------------------------------------------------
Pulumi Cloud Default, managed, team features pulumi login
AWS S3 Self-managed, AWS-only pulumi login s3://bucket
Azure Blob Self-managed, Azure-only pulumi login azblob://ctr
GCS Self-managed, GCP-only pulumi login gs://bucket
Local filesystem Development only pulumi login --local// networking stack exports
export const vpcId = vpc.vpcId;
export const privateSubnetIds = vpc.privateSubnetIds;
// compute stack imports
const netStack = new pulumi.StackReference("myorg/networking/prod");
const vpcId = netStack.getOutput("vpcId");
const subnetIds = netStack.getOutput("privateSubnetIds");pulumi config set --secret dbPassword 'my-s3cr3t'
pulumi stack init prod --secrets-provider="awskms://alias/pulumi-secrets"const config = new pulumi.Config();
const dbPassword = config.requireSecret("dbPassword"); // Output<string>, encrypted
// Secrets propagate: interpolating a secret produces a secret
const connStr = pulumi.interpolate`postgres://admin:${dbPassword}@${db.endpoint}/mydb`;const provider: pulumi.dynamic.ResourceProvider = {
async create(inputs) {
const resp = await get(`[reference URL] {
method: "POST", body: JSON.stringify(inputs),
});
const data = await resp.json();
return { id: data.id, outs: { ...inputs, url: data.url } };
},
async delete(id) {
await get(`[reference URL] { method: "DELETE" });
},
};
export class CustomResource extends pulumi.dynamic.Resource {
public readonly url!: pulumi.Output<string>;
constructor(name: string, args: any, opts?: pulumi.CustomResourceOptions) {
super(provider, name, { url: undefined, ...args }, opts);
}
}import * as pulumi from "@pulumi/pulumi";
pulumi.runtime.setMocks({
newResource(args) { return { id: `${args.name}-id`, state: args.inputs }; },
call(args) { return args.inputs; },
});
describe("VPC Component", () => {
it("should create subnets per AZ", async () => {
const { Vpc } = await import("../src/components/vpc");
const vpc = new Vpc("test", { cidrBlock: "10.0.0.0/16", azs: ["us-east-1a", "us-east-1b"] });
const pubIds = await new Promise(resolve => pulumi.all(vpc.publicSubnetIds).apply(resolve));
expect(pubIds).toHaveLength(2);
});
});import { LocalWorkspace } from "@pulumi/pulumi/automation";
const stack = await LocalWorkspace.createOrSelectStack({
stackName: `test-${Date.now()}`, projectName: "test-infra",
program: async () => {
const vpc = new aws.ec2.Vpc("test", { cidrBlock: "10.0.0.0/16" });
return { vpcId: vpc.id };
},
});
const result = await stack.up();
expect(result.outputs.vpcId.value).toBeDefined();
await stack.destroy();name: Infrastructure
on:
pull_request:
paths: ["infrastructure/**"]
push:
branches: [main]
paths: ["infrastructure/**"]
jobs:
preview:
if: github.event_name == 'pull_request'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with: { node-version: 20 }
- run: npm ci
working-directory: infrastructure
- uses: pulumi/actions@v5
with:
command: preview
stack-name: myorg/staging
work-dir: infrastructure
comment-on-pr: true
env:
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
deploy:
if: github.ref == 'refs/heads/main'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with: { node-version: 20 }
- run: npm ci
working-directory: infrastructure
- uses: pulumi/actions@v5
with:
command: up
stack-name: myorg/prod
work-dir: infrastructure
env:
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}pulumi import --from terraform ./terraform.tfstate
pulumi convert --from terraform --language typescript --out ./pulumi-infra
pulumi import aws:ec2/instance:Instance web i-0123456789abcdef0TERRAFORM PULUMI
---------------------------------------------
.tf files TypeScript/Python/Go
terraform.tfstate Pulumi state (backend)
Modules Component Resources
Variables Config + function args
Outputs Stack exports
Data sources Provider functions
Workspaces Stacks
terraform plan pulumi preview
terraform apply pulumi uppulumi stack init dev # Create stack
pulumi stack select prod # Switch stack
pulumi preview # Show diff
pulumi up # Apply changes
pulumi up --yes --skip-preview # Non-interactive (CI)
pulumi destroy # Tear down
pulumi refresh # Sync state with cloud
pulumi config set key value # Set config
pulumi config set --secret k v # Set secretPROJECT:
[ ] Consistent structure with components and tests
[ ] TypeScript strict mode for type safety
[ ] Stack config per environment (no hardcoded values)
[ ] Secrets encrypted via Pulumi Cloud, KMS, or Vault
STATE:
[ ] Remote backend configured
[ ] State access restricted to authorized roles
[ ] Stack references for cross-stack deps
CI/CD:
[ ] Preview on PRs with comments
[ ] Deploy on merge to main
[ ] Separate jobs per stack (staging -> prod)
[ ] Policy packs for compliance
RESOURCES:
[ ] protect: true on critical resources
[ ] retainOnDelete where needed
[ ] Consistent tagging via helper function
[ ] Resource naming convention enforcedUse this skill when:
Designing or implementing pulumi engineer solutions
Reviewing or improving existing pulumi engineer approaches
Making architectural or implementation decisions about pulumi engineer
Learning pulumi engineer patterns and best practices
Troubleshooting pulumi engineer-related issues
Do NOT use this skill when:
The question is about a fundamentally different technology domain
A more specific sibling skill covers the exact topic needed
The user needs a complete hands-on tutorial rather than expert guidance
# Pulumi Engineer Analysis
## Context Assessment
[Situation summary and constraints]
## Recommended Approach
[Primary recommendation with rationale]
## Implementation Steps
1. [Step with specific details]
2. [Step with specific details]
3. [Step with specific details]
## Trade-offs and Considerations
- [Key trade-off 1]
- [Key trade-off 2]
## Next Steps
- [Immediate action item]
- [Follow-up action item]Input: "Help me implement pulumi engineer for a medium-scale production application"
Output: A structured analysis covering current state assessment, recommended pulumi engineer approach with specific patterns, implementation roadmap with milestones, and risk mitigation strategies tailored to the application scale and constraints.
Legacy system integration: When pulumi engineer must coexist with legacy approaches, provide a gradual migration path rather than a complete rewrite
Scale mismatch: When the solution complexity exceeds the project scale, recommend a simpler approach and note when to revisit
Team skill gaps: When the team lacks experience with the recommended approach, include learning resources and simpler alternatives
Conflicting requirements: When constraints conflict (e.g., performance vs. maintainability), explicitly state the trade-off and recommend based on stated priorities
SKILL.md
404 lines · 1,413 words
The text of SKILL.md is shown as it downloads, under the Apache-2.0 license, by Ferrox Labs. The license is the one in the file's own frontmatter.
Your new bot
Pulumi Engineer bot
Waiting in your sidebar once you say go.
No account needed · Runs on the AI plan you already pay for