Infrastructure as Code in 2025: Why We Lean Pulumi (and Why Google Cloud is Our Foundation)
At 7Sigma, we have built infrastructure every way imaginable: raw bash scripts with gcloud, Terraform modules, Kubernetes-native operators, and modern IaC frameworks. Over time, one thing became clear: Infrastructure-as-Code (IaC) is table stakes in 2025, and Pulumi is the tool we usually reach for.
From Bash to Infrastructure as Code
Bash and CLI calls work fine, until they don't.
- Imperative vs. desired state: Bash says “do this now”, IaC says “make the world look like this”.
- Drift detection: With bash, you only find out something changed when it breaks, IaC refresh shows drift immediately.
- Idempotency: Run bash twice and you might create two instances, run Pulumi twice and it converges without duplicates.
Bash is great for initial setups, spikes, and experiments. For long-lived systems, IaC is the only way to achieve consistency and safety.
Why Pulumi Stands Out
Pulumi gives us everything bash does not:
- Change previews:
pulumi preview shows exactly what will change before it happens.
- Drift awareness:
pulumi refresh syncs reality to code.
- Reusable components: We can package infra as NPM or PyPI libraries, version them, and share them across projects.
- Real programming languages: TypeScript, Python, Go, and C#. Loops, functions, and types are native, not bolted on.
- Multi environment config: Stacks keep dev, staging, and prod configurations separate and consistent.
- Policy and testing: We can unit test infra modules and enforce guardrails like “no public buckets”.
For us, Pulumi means infrastructure as software: typed, testable, composable, and reusable.
Pulumi and Terraform both manage desired state, but they differ in style and ergonomics.
| Area | Pulumi | Terraform |
| Language | TypeScript, Python, Go, C#, full power of real languages | HCL, domain specific DSL |
| Reusability | Share as packages, testable code | Modules, less expressive |
| Ecosystem | Built on Terraform providers, broad but newer | Huge, mature ecosystem |
| Typing | Strong typing, IDE autocomplete | Weakly typed, errors at apply time |
| Community | Growing | Industry standard, very large |
Terraform is the safe, boring choice for infra specialists who live in HCL.
Pulumi shines for developer heavy teams who want infra to feel like code.
Other contenders:
- AWS CDK: Good if you are AWS only. Multi cloud exists via Terraform, but more clunky.
- Crossplane: Manage infra as Kubernetes CRDs, powerful but heavy for non K8s shops.
- Ansible: Still great for configuring inside VMs, not ideal for managing cloud infra.
Decision Flow
Why Our Infra Runs on Google Cloud
Pulumi is our IaC engine of choice. The underlying cloud is usually Google Cloud, because it balances cost, reliability, and ecosystem depth better than the alternatives.
- Rock solid infra: Cloud Run handles containerized apps with scale to zero and zero downtime deploys. Cloud SQL provides resilient databases with automatic backups.
- Lifecycle costs: A minimal Cloud Run plus Cloud SQL setup starts around 25 to 30 USD per month, competitive with Fly or Render but with more stability and fewer hidden costs.
- Granularity: IAM, autoscaling, network, and storage tiers allow precise tuning for security and efficiency.
- Ecosystem depth: APIs for Maps, Drive, and Workspace, plus Vertex AI for ML and AI, all within the same console.
- Security tooling: Least-privilege IAM by default, built-in vulnerability scanning for Docker images, continuous policy audits, and compliance certifications (SOC, HIPAA, ISO) available out of the box. Pulumi lets us codify these guardrails so no team member can accidentally drift into insecure configs.
The Loosely Coupled Google Umbrella
Perhaps the most underrated advantage of choosing Google Cloud is that it sits under the same umbrella as Google Workspace.
- Over 3 billion users rely on Workspace tools, according to Exploding Topics.
- More than 40 percent of Fortune 500 companies run their collaboration and identity through Gmail, Drive, Docs, and Calendar, according to Patronum.
- This means authentication, identity, and data sharing are already standardized across the tools most teams use every day.
With Google Cloud and Workspace together, you get a loosely coupled Google umbrella:
- Unified identity and SSO between Workspace and Cloud IAM.
- Collaboration tools, Docs, Sheets, and Drive, integrate directly into GCP workflows.
- No code automation with AppSheet and Apps Script across productivity apps and cloud services, as explained by Promevo.
- AI assistance across Workspace and Cloud, with over two billion AI assists per month flowing through Gmail, Docs, and Calendar, according to Google Workspace.
For clients like Konecta, which migrated 100,000 employees to Workspace while certifying 500 engineers in Google Cloud, this umbrella creates alignment across the entire organization.
Google Cloud can take more setup at the start, but it is the smartest way to keep building.
- Pulumi is our Infra as Code choice, because it treats infra like software: reusable, testable, and typed.
- Google Cloud is our cloud of choice, because it provides rock solid infra, cost efficiency, and ecosystem depth.
- Workspace ties it all together, giving teams a loosely coupled umbrella where productivity, collaboration, and infra share the same foundation.
At 7Sigma, we help teams cross the setup gap so they can reap the stability dividend. If you are ready to build on a foundation that lasts, let us talk.
About 7Sigma
7Sigma was founded to close the gap between strategy and execution. We partner with companies to shape product, innovation, technology, and teams. Not as outsiders, but as embedded builders.
From fractional CTO roles to co-founding ventures, we bring cross-domain depth: architecture, compliance, AI integration, and system design. We don’t add intermediaries. We remove them.
We help organizations move from idea → execution → scale with clarity intact.
Don't scale your team, scale your thinking.
Learn more at 7sigma.io
Authored by: Robert Christian, Founder at 7Sigma
© 2025 7Sigma Partners LLC
