Multi-Cloud Pulumi Setup

AWS and Azure provisioned from a single Pulumi stack with shared secrets.

A single Pulumi TypeScript stack that provisions resources across AWS and Azure simultaneously. Useful for hybrid workloads where compute runs on AWS but identity or AD integration requires Azure. Secrets are managed via Pulumi ESC — no credentials in code.

Tech Stack

Features

• Single stack spans AWS and Azure with shared outputs
• AWS: VPC, ECS Fargate service, S3 bucket
• Azure: Resource Group, Storage Account, Key Vault
• Cross-cloud secret sharing via Pulumi ESC
• Stack references allow downstream stacks to consume outputs

Cross-Cloud Design

The AWS side provisions compute (ECS Fargate) and storage (S3). The Azure side provisions Key Vault for secrets used by the application. The ECS task definition reads secrets from Azure Key Vault at startup via a sidecar, enabling a hybrid secrets model.

Pulumi ESC

Pulumi ESC (Environments, Secrets, Config) stores AWS and Azure credentials as environment variables injected at runtime. Neither credential set appears in the Pulumi state file or source code.

Running the Stack

Ensure both AWS and Azure CLI are authenticated, or configure Pulumi ESC with the relevant cloud credentials. Run `pulumi up --stack prod` — Pulumi will parallelise resource creation across both providers where there are no dependencies.

File Structure