Accessible Ops

Build in the platform's own terms, and keep its spec readable and predictable before anything runs. Read the full property →

chant Fold to native spec, no run

choudoufu Declarative HCL, as upstream; the real plan reads the cloud, and needs no state file to do it

KCL / CUE / Pkl Folds via its own DSL

CDK Synthesizes a reviewable native template (CloudFormation, or K8s via cdk8s), and a context lookup can shift the output when the program runs

Pulumi Runs the program through its own engine; no static declarative spec, only an engine preview or plan

Terraform / OpenTofu Declarative, but the real plan needs cloud and state

A change proves itself at the keystroke, the same check for a human and an agent. Read the full property →

chant Type and fold diagnostics at the keystroke, human and agent alike

choudoufu live-check lints and resolves every identity with no cloud call, credential or state, on any OpenTofu configuration; the real check is still plan

KCL / CUE / Pkl Schema check plus an LSP

CDK TS types check, but infra correctness needs a synth and a plan

Pulumi TS types check, but infra correctness needs a preview

Terraform / OpenTofu validate is shallow; the real check is plan

The parts a machine can't infer belong in writing. Read the full property →

chant Typed lexicons, semantic lint, and policy checks

choudoufu Thin types, as upstream; every limit is a named lint rule with its reasoning and a fixture, and ownership policy is declared in the estate file; broader policy is still OPA or Sentinel

KCL / CUE / Pkl Schemas and constraints encode validity

CDK L2 constructs and cdk-nag encode a lot of validity, and deeper policy is an add-on

Pulumi Types encode structure, and policy comes from CrossGuard

Terraform / OpenTofu Thin types; policy via OPA or Sentinel

Every change arrives as a diff, in one place. Read the full property →

chant Every change is one typed change set against live

choudoufu plan and apply; an approved plan file is re-planned against live and refused by name if it no longer matches

KCL / CUE / Pkl Language only; bring your own pipeline

CDK Deploy through cdk deploy

Pulumi Deploy through pulumi up

Terraform / OpenTofu plan and apply

Access stays scoped and revocable, and secrets are referenced by name rather than held. Read the full property →

chant By reference, never held, with keyless signing

choudoufu Credentials are your own IAM, scoped per estate or per address on tags every create carries, and revoked by detaching a policy; strict secrets = refuse holds no generated secret at all and can be pinned from outside the configuration. The default keeps what a state file keeps

KCL / CUE / Pkl Out of scope

CDK Refs and IAM, but the program can read secrets at runtime

Pulumi ESC gives references with short-lived OIDC, but core stores secrets encrypted in state

Terraform / OpenTofu Refs, but the state file can capture secrets; OpenTofu encrypts state at rest

One mistake can't take down everything. Read the full property →

chant Owned-only by marker, a per-environment removal cap, and a blast-radius graph view

choudoufu Every resource carries its estate as a tag, so an IAM Deny on anything outside the estate holds below the tool, wherever AWS honours the condition

KCL / CUE / Pkl Out of scope

CDK Stack and IAM boundaries, but refs can widen reach

Pulumi Stack and IAM boundaries, but refs can widen reach

Terraform / OpenTofu Module boundaries, but shared state couples them

Actions that can be undone run on their own, and the ones that cannot wait for a human. Read the full property →

chant Reversible runs ungated; a destructive one is gated with saga rollback

choudoufu No rollback; a change that would abandon or duplicate an object refuses by default and proceeds only by name, but a plain destroy is not held apart from a reversible change, as upstream

KCL / CUE / Pkl Out of scope

CDK CloudFormation auto-rollback and cdk rollback recover a failed deploy, though an irreversible change is not gated

Pulumi No auto-rollback; you re-apply a prior state

Terraform / OpenTofu No rollback; you re-apply a prior state by hand

The newcomer executes, and a human owns the call that matters. Read the full property →

chant A durable approval gate that survives a crash

choudoufu The approved plan file is the approval: the apply re-plans against live and refuses, with its own exit status, if anything moved since review. The pipelines generated for GitHub, GitLab and Forgejo stop both writing Ops at a gate that is a fact in git

KCL / CUE / Pkl Out of scope

CDK Approval in the CI pipeline, not the tool

Pulumi Approval via Pulumi Deployments, a Cloud add-on

Terraform / OpenTofu Apply confirmation is built-in; role-separated approval needs HCP, a paid add-on

Every change traces to who made it and who approved it. Read the full property →

chant An append-only release ledger, with approval in the workflow history

choudoufu Every change is an API call under a scoped role, ownership moves included, so the cloud's own audit log names who did what with no ledger edit beside it; the plan file and the approval it landed under are in git

KCL / CUE / Pkl Out of scope

CDK CloudTrail or pipeline logs, outside the tool

Pulumi Pulumi Cloud records who applied by default; the approver needs Deployments, an add-on

Terraform / OpenTofu State history or CI logs, outside the tool

Any credential can be rotated as a routine change, from what's written down. Read the full property →

chant By-reference makes rotation an out-of-band routine change

choudoufu Under strict secrets = refuse no secret is ever held, so rotating a credential is an out-of-band change the source never sees; a generated secret kept under the default is one record, deleted to regenerate, never state surgery

KCL / CUE / Pkl Out of scope

CDK Runtime reads or state can pin the value

Pulumi ESC helps, but core state can pin the value

Terraform / OpenTofu A state-captured secret needs state surgery

Truth lives in the running system, never a separate store you host. Read the full property →

chant Truth left in the live system, with no state store

choudoufu Ownership is two tags on the resource itself, and the state file is a cache you are allowed to lose; values with no cloud twin go in a small record store

KCL / CUE / Pkl Language only, no state model⁴

CDK No tool-side state copy: cdk8s emits stateless manifests you can GitOps, and AWS CDK's stack state is CloudFormation's own record of what AWS runs, not a copy the tool keeps

Pulumi Keeps its own authoritative state, whatever the backend

Terraform / OpenTofu The state file is the authority⁵

Existing infrastructure comes under management in place, without conversion to a private format. Read the full property →

chant Imports a template or live estate; the spec stays native

choudoufu A stock OpenTofu estate migrates by stamping markers from the state it already has, and a live resource matching a block is adopted by writing two tags; the HCL stays as it was

KCL / CUE / Pkl Importers bootstrap from OpenAPI, CRDs, or Terraform, but authoring moves to the DSL

CDK cdk import, then rewrite as code

Pulumi pulumi import, then rewrite as code

Terraform / OpenTofu Config-driven import blocks preview the import; you still author the HCL

The tool touches only what you declare and deletes only what it owns. Read the full property →

chant Selective by omission; deletes gated on an ownership marker

choudoufu A resource carrying no marker is kept, and a delete is gated on the estate's own marker; the ownership policy sets what happens in each case

KCL / CUE / Pkl No apply, so nothing to over-reach

CDK Stack-scoped, but absence in the template deletes

Pulumi Stack-scoped, but absence in the program deletes

Terraform / OpenTofu Omission deletes by default; removed and prevent_destroy are opt-in guards, not the design

A deployable proves itself before it ships, verified where it is built. Read the full property →

chant SBOM, provenance, and a signature built at synthesis, verified at the deploy gate

choudoufu The plan file is admitted before apply only if it still matches the live system, failing closed with its own exit status; it carries no provenance or signature, as upstream

KCL / CUE / Pkl No build artifact or gate

CDK Provenance via CI add-ons like cosign or SLSA

Pulumi Provenance via CI add-ons like cosign or SLSA

Terraform / OpenTofu Provenance via CI add-ons