Accessible Ops

Accessible Ops is a spec. These are its properties where the tools differ.

Synthesis

chantchoudoufuAWS CDK

I. Honor the lower layerBuild in the platform's own terms, readable before anything runs.folds to the native spec without running it; a file outside the subset runsintentius.iodeclarative HCL, as upstream; the plan reads the cloud, not a state filesynthesizes a CloudFormation template; lookups are cached and committeddocs.aws.amazon.com✗ runs the program; no native spec, only a previewpulumi.comdeclarative HCL; the real plan needs the cloud and state

II. The same check, left of the commitA change proves itself at the keystroke, the same check for a human and an agent.types and lint as you type, over LSP and MCPintentius.iolive-check flags what it would refuse, offline, with no credential✗ types as you type; infrastructure checks wait for synthdocs.aws.amazon.com✗ types as you type; infrastructure checks wait for a preview✗ validate is shallow; the real check is plan

Ops and lifecycle

chantchoudoufuAWS CDK

VII. Reversible before riskyUndoable actions run on their own; the rest wait for a human.deletes gated per resource; rollback is CloudFormation's on AWSintentius.io✗ no rollback; a destroy is not held apartCloudFormation rolls back a failed deploy; cdk rollback✗ no rollback; re-apply a prior state✗ no rollback; re-apply a prior state by hand

VIII. Escalate the judgmentThe newcomer executes; a human owns the call that matters.a durable gate holds the change for an approverintentius.ioapply refuses a plan that no longer matches livedeploy stops for approval on IAM or security-group broadeningdocs.aws.amazon.com✗ no deploy gate of its ownpulumi.comapply asks for confirmation

IX. AttributableEvery change traces to who made it and who approved it.the approval and the change set it approved land in gitintentius.io✗ the approval record needs chant's pipeline✗ CloudTrail or pipeline logs, outside the toolupdate history on every tierpulumi.com✗ state history or CI logs, outside the tool

Truth and trust

chantchoudoufuAWS CDK

XI. The live system is the truthTruth lives in the running system, never a separate store you host.no store of its own; on AWS the stack record is CloudFormation'sintentius.io✗ ownership is a tag; generated values sit in a record store you hostintentius.iono store of its own; the stack record is CloudFormation's✗ keeps its own authoritative state✗ the state file is the authority

XIV. Verify the artifactA deployable proves itself before it ships.components: SBOM, provenance and a signature, checked before applyintentius.io✗ the plan file must still match live; no provenance or signature✗ not in the tool✗ not in the tool✗ not in the tool

Sources read 2026-10-25. AWS CDK is a trademark of Amazon.com, Inc. Pulumi is a trademark of Pulumi Corporation. Terraform is a trademark of HashiCorp, an IBM Company. OpenTofu is a trademark of The Linux Foundation.