# Pulumi vs Terraform 2026: Infrastructure as Code voi TypeScript va Cau hoi Phong van

> So sanh chi tiet Pulumi vs Terraform cho Infrastructure as Code nam 2026. Tim hieu su khac biet ve ho tro TypeScript, quan ly state va cac cau hoi phong van DevOps thuong gap.

- Published: 2026-09-21
- Updated: 2026-09-21
- Author: Anthony Fillion-Maillet
- Reading time: 5 min

---

Pulumi vs Terraform la quyet dinh trong yeu ve Infrastructure as Code doi voi cac doi DevOps trong nam 2026. Ca hai cong cu deu cung cap kha nang provisioning cloud resources mot cach declarative, nhung khac biet ve ho tro ngon ngu lap trinh, quan ly state va muc do truong thanh cua he sinh thai. Bai viet nay trinh bay cac danh doi ky thuat, vi du code bang TypeScript va HCL, cung nhu cac cau hoi phong van thuong gap khi ung vien thao luan ve lua chon IaC.

> **Boi canh phien ban: Thang 9/2026**
>
> Bai so sanh nay su dung Pulumi v3.263.0 (phat hanh ngay 15 thang 9 nam 2026) va Terraform 1.16.3 (phat hanh ngay 26 thang 8 nam 2026). CDKTF, lop TypeScript cua HashiCorp cho Terraform, da ngung ho tro tu thang 12 nam 2025 va repository da duoc luu tru.

## Kien truc cot loi: Engine Pulumi va Chu ky Plan-Apply cua Terraform

Terraform su dung ngon ngu dac thu mien (HCL) va quy trinh hai giai doan: `terraform plan` tao execution plan, `terraform apply` thuc thi no. State file theo doi resource metadata va duoc luu tru cuc bo hoac tren remote backend nhu S3 hoac Terraform Cloud.

Pulumi nhung engine cua no vao cac runtime ngon ngu lap trinh thong dung. Cac chuong trinh viet bang TypeScript, Python, Go hoac C# thuc thi truc tiep voi cloud API thong qua cac provider cua Pulumi. State duoc luu tru tren Pulumi Cloud theo mac dinh, voi tuy chon cho self-managed backend bao gom S3, Azure Blob Storage va file cuc bo.

Su khac biet kien truc nay the hien ngay lap tuc trong cach moi cong cu xu ly vong lap, dieu kien va truu tuong hoa. `for_each` va `count` cua Terraform hoat dong trong cac rang buoc cua HCL. Cac chuong trinh Pulumi su dung cac cau truc ngon ngu tu nhien: `for...of` trong TypeScript, list comprehension trong Python, `range` trong Go.

```typescript
// infra/index.ts - Vi du Pulumi TypeScript
import * as aws from "@pulumi/aws";
import * as pulumi from "@pulumi/pulumi";

// Phuong thuc mang TypeScript tu nhien hoat dong truc tiep
const environments = ["dev", "staging", "prod"];

const buckets = environments.map(env => 
  new aws.s3.BucketV2(`data-${env}`, {
    bucket: `myapp-data-${env}-${pulumi.getStack()}`,
    tags: {
      Environment: env,
      ManagedBy: "pulumi",
    },
  })
);

// Xuat bucket ARN nhu stack output
export const bucketArns = buckets.map(b => b.arn);
```

Cau hinh Terraform tuong duong yeu cau cu phap HCL de lap:

```hcl
# main.tf - Vi du Terraform HCL
variable "environments" {
  type    = list(string)
  default = ["dev", "staging", "prod"]
}

resource "aws_s3_bucket" "data" {
  for_each = toset(var.environments)

  bucket = "myapp-data-${each.key}-${terraform.workspace}"

  tags = {
    Environment = each.key
    ManagedBy   = "terraform"
  }
}

output "bucket_arns" {
  value = [for b in aws_s3_bucket.data : b.arn]
}
```

Ca hai doan code deu tao ba S3 bucket. Phien ban Terraform ngan gon va de doc doi voi bat ky ai quen thuoc voi HCL. Phien ban Pulumi su dung TypeScript tieu chuan, co nghia la IDE autocompletion, kiem tra kieu va tich hop voi codebase hien co ma khong can hoc ngon ngu moi.

## Ho tro TypeScript: Ngon ngu tu nhien va CDKTF (Ngung ho tro)

Pulumi ho tro TypeScript tu ban phat hanh cong khai dau tien. SDK expose typed resource class, va `pulumi.Output<T>` bao boc cac gia tri bat dong bo duoc resolve trong qua trinh deployment. Cac cong cu refactoring, linter va test framework tu he sinh thai TypeScript co the ap dung truc tiep.

Cau tra loi cua Terraform cho ho tro ngon ngu lap trinh thong dung la [CDKTF (Cloud Development Kit for Terraform)](https://developer.hashicorp.com/terraform/cdktf). CDKTF cho phep cac doi viet TypeScript hoac Python duoc bien dich thanh Terraform JSON. HashiCorp ngung ho tro CDKTF vao thang 12 nam 2025 va luu tru repository. Cac du an CDKTF hien co van chay duoc, nhung khong co cap nhat cho cac phien ban Terraform moi hoac thay doi provider.

Doi voi cac doi muon TypeScript IaC trong nam 2026, Pulumi la tuy chon duoc duy tri tich cuc. Cac doi da dau tu vao CDKTF co the tiep tuc chay cac stack cua ho, nhung chuyen sang HCL hoac Pulumi la huong di cho phat trien moi.

```typescript
// infra/vpc.ts - Pulumi component cho truu tuong VPC co the tai su dung
import * as aws from "@pulumi/aws";
import * as pulumi from "@pulumi/pulumi";

// Custom component dong goi VPC, subnet va routing
export class StandardVpc extends pulumi.ComponentResource {
  public readonly vpcId: pulumi.Output<string>;
  public readonly publicSubnetIds: pulumi.Output<string>[];

  constructor(name: string, args: { cidr: string; azCount: number }, opts?: pulumi.ComponentResourceOptions) {
    super("mycompany:network:StandardVpc", name, {}, opts);

    const vpc = new aws.ec2.Vpc(`${name}-vpc`, {
      cidrBlock: args.cidr,
      enableDnsHostnames: true,
      tags: { Name: name },
    }, { parent: this });

    this.vpcId = vpc.id;

    // Tao public subnet tren cac availability zone
    const azs = aws.getAvailabilityZones({ state: "available" });
    this.publicSubnetIds = [];

    for (let i = 0; i < args.azCount; i++) {
      const subnet = new aws.ec2.Subnet(`${name}-public-${i}`, {
        vpcId: vpc.id,
        cidrBlock: `10.0.${i}.0/24`,
        availabilityZone: azs.then(az => az.names[i]),
        mapPublicIpOnLaunch: true,
        tags: { Name: `${name}-public-${i}` },
      }, { parent: this });
      this.publicSubnetIds.push(subnet.id);
    }

    this.registerOutputs({ vpcId: this.vpcId });
  }
}
```

Pulumi component nay tao mot truu tuong VPC co the tai su dung. Nguoi dung khoi tao voi `new StandardVpc("prod", { cidr: "10.0.0.0/16", azCount: 3 })`. Tuong duong trong Terraform la thu muc module voi variables, outputs va cac file HCL. Ca hai cach tiep can deu cho phep tai su dung; phien ban Pulumi thua huong tooling TypeScript cho tai lieu, testing va versioning.

## Quan ly State va Tuy chon Backend

Quan ly state la noi su khac biet van hanh xuat hien. State Terraform chua resource ID, provider metadata va sensitive values. Cac doi phai cau hinh remote backend de cong tac va thuc hien locking de ngan chan sua doi dong thoi.

[Cau hinh backend Terraform](https://developer.hashicorp.com/terraform/language/settings/backends/configuration) ho tro S3, Azure Blob, Google Cloud Storage, Terraform Cloud va nhieu hon. Moi backend yeu cau thiet lap xac thuc rieng. State locking su dung DynamoDB cho S3 backend, blob lease cho Azure hoac native locking trong Terraform Cloud.

Pulumi Cloud xu ly state storage, locking va lich su theo mac dinh. Cac doi tao tai khoan mien phi, chay `pulumi login`, va quan ly state da duoc cau hinh. Doi voi cac doi yeu cau self-managed state, Pulumi ho tro S3, Azure Blob, GCS va file backend cuc bo voi lenh `pulumi login`.

```bash
# Pulumi: dang nhap vao self-managed S3 backend
pulumi login s3://my-pulumi-state-bucket

# Terraform: cau hinh S3 backend trong HCL
# backend.tf
terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "prod/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "terraform-locks"
    encrypt        = true
  }
}
```

Pulumi Cloud cung cap giao dien web cho lich su stack, truc quan hoa resource va quyen nhom. Terraform Cloud cung cap cac tinh nang tuong tu voi thuc thi chinh sach thong qua Sentinel. Tuy chon self-hosted co san cho ca hai: self-hosted backend cua Pulumi va Terraform Enterprise.

## He sinh thai Provider va Ho tro Multi-Cloud

He sinh thai provider Terraform la lon nhat trong IaC. [Terraform Registry](https://registry.terraform.io/) liet ke hon 4.000 provider bao gom AWS, Azure, GCP, Kubernetes va hang tram nen tang SaaS. Chat luong provider khac nhau: provider chinh thuc cua HashiCorp va cloud vendor nhan cap nhat thuong xuyen, trong khi community provider co the cham hon so voi thay doi API.

Provider Pulumi bao boc provider Terraform su dung bridge tao typed SDK. [Pulumi Registry](https://www.pulumi.com/registry/) expose provider cho cac cloud chinh, Kubernetes, database va dich vu monitoring. Vi Pulumi bridge provider Terraform, pham vi he sinh thai tuong duong, mac du cac phien ban provider Terraform moi yeu cau cap nhat bridge truoc khi SDK Pulumi phan anh thay doi.

Pulumi cung cung cap native provider duoc viet truc tiep voi cloud API. Native provider cho AWS, Azure va Kubernetes cung cap ho tro cung ngay cho cac tinh nang API moi. Danh doi la native provider chi ton tai cho cac cloud chinh; cac dich vu it pho bien hon su dung bridged provider.

```typescript
// Su dung native AWS provider cua Pulumi cho Lambda
import * as aws from "@pulumi/aws";
import * as pulumi from "@pulumi/pulumi";

const role = new aws.iam.Role("lambda-role", {
  assumeRolePolicy: aws.iam.assumeRolePolicyForPrincipal({
    Service: "lambda.amazonaws.com",
  }),
});

const lambdaFunction = new aws.lambda.Function("api-handler", {
  runtime: aws.lambda.Runtime.NodeJS20dX,
  handler: "index.handler",
  role: role.arn,
  code: new pulumi.asset.AssetArchive({
    "index.js": new pulumi.asset.StringAsset(
      `exports.handler = async () => ({ statusCode: 200, body: "OK" });`
    ),
  }),
});

export const functionArn = lambdaFunction.arn;
```

## Testing Infrastructure Code

Testing la noi lua chon ngon ngu tao ra su phan ky. Cac chuong trinh Pulumi la code tieu chuan, nen unit test su dung cac framework quen thuoc. Module `@pulumi/pulumi/runtime` cung cap mocking cho resource creation, cho phep test xac minh cau hinh ma khong can deploy resource.

```typescript
// __tests__/infra.test.ts - Unit testing resource Pulumi voi Vitest
import { describe, it, expect, beforeAll } from "vitest";
import * as pulumi from "@pulumi/pulumi";

// Mock Pulumi runtime
pulumi.runtime.setMocks({
  newResource: (args: pulumi.runtime.MockResourceArgs) => {
    return { id: `${args.name}-id`, state: args.inputs };
  },
  call: (args: pulumi.runtime.MockCallArgs) => {
    return args.inputs;
  },
});

describe("S3 Bucket Configuration", () => {
  let bucketTags: Record<string, string>;

  beforeAll(async () => {
    // Import chuong trinh Pulumi sau khi mock duoc thiet lap
    const infra = await import("../infra/index");
    // Trich xuat output de testing
    bucketTags = await new Promise(resolve => {
      infra.buckets[0].tags.apply(tags => resolve(tags as Record<string, string>));
    });
  });

  it("should tag buckets with Environment", () => {
    expect(bucketTags).toHaveProperty("Environment");
  });

  it("should tag buckets with ManagedBy", () => {
    expect(bucketTags.ManagedBy).toBe("pulumi");
  });
});
```

Testing Terraform su dung `terraform test` (gioi thieu trong Terraform 1.6) hoac cac cong cu ben ngoai nhu Terratest. `terraform test` chay cac file test HCL tao resource thuc trong cau hinh co lap. Terratest la thu vien Go bao boc cac lenh Terraform va cung cap assertion.

```hcl
# tests/bucket.tftest.hcl - Test native Terraform
run "bucket_tags" {
  command = plan

  assert {
    condition     = aws_s3_bucket.data["dev"].tags["Environment"] == "dev"
    error_message = "Bucket phai duoc tag voi Environment"
  }

  assert {
    condition     = aws_s3_bucket.data["dev"].tags["ManagedBy"] == "terraform"
    error_message = "Bucket phai duoc tag voi ManagedBy"
  }
}
```

Ca hai cach tiep can deu xac minh cau hinh infrastructure. Loi the cua Pulumi la tich hop voi test runner va coverage tool TypeScript. Test native Terraform chay ma khong can dependency ben ngoai nhung yeu cau cu phap HCL.

## Cau hoi Phong van: Pulumi vs Terraform

Phong van DevOps trong nam 2026 thuong bao gom so sanh cong cu IaC. Sau day la cac cau hoi phan biet ung vien da su dung ca hai cong cu trong production.

**"Dieu gi xay ra khi state Terraform drift khoi infrastructure thuc te?"**

Cau tra loi mong doi: `terraform plan` phat hien drift bang cach so sanh state voi infrastructure thuc. Plan hien thi cac resource can cap nhat, tao hoac huy. Drift xay ra khi thay doi duoc thuc hien ben ngoai Terraform (console, CLI, cong cu khac). Cac tuy chon bao gom `terraform refresh` de cap nhat state, `terraform import` de dua resource vao quan ly, hoac chap nhan plan de khoi phuc desired state.

**"Pulumi xu ly secret khac voi Terraform nhu the nao?"**

Cau tra loi mong doi: Pulumi ma hoa secret trong state theo mac dinh su dung passphrase hoac cloud KMS. Ham `pulumi.secret()` danh dau gia tri la nhay cam, va chung van duoc ma hoa khi luu tru. Terraform luu secret dang plaintext trong state file; cac doi dua vao ma hoa backend (ma hoa server-side S3) va access control. Terraform 1.4 them danh dau bien `sensitive`, nhung gia tri van xuat hien khong ma hoa trong state.

**"Tai sao HashiCorp ngung ho tro CDKTF, va cac tuy chon chuyen doi la gi?"**

Cau tra loi mong doi: CDKTF them chi phi bao tri ma khong theo kip nhip do cap nhat Terraform. Cac phien ban provider moi va tinh nang Terraform yeu cau cap nhat thu cong vao CDK binding. HashiCorp chon tap trung vao HCL va Terraform Cloud. Cac tuy chon chuyen doi la: chuyen sang HCL su dung `cdktf convert`, viet lai trong Pulumi neu can TypeScript, hoac tiep tuc chay cac stack CDKTF hien co ma khong cap nhat.

**"Khi nao nen chon Pulumi thay vi Terraform cho du an moi?"**

Cau tra loi mong doi: Chon Pulumi khi doi da su dung TypeScript/Python/Go va muon IaC trong cung ngon ngu voi code ung dung, khi truu tuong phuc tap yeu cau cac cau truc lap trinh thuc (generic, interface, testing framework), hoac khi ma hoa secret tich hop la bat buoc. Chon Terraform khi doi thanh thao HCL, khi he sinh thai provider phai bao gom cac provider niche hoac community, hoac khi tooling to chuc (Atlantis, Spacelift) tich hop voi Terraform.

De chuan bi phong van infrastructure as code them, xem [Cau hoi Phong van Terraform: Huong dan day du Infrastructure as Code](/blog/devops/terraform-interview-questions-infrastructure-as-code) va [module Terraform Advanced](/technologies/devops/interview-questions/terraform-advanced).

## Chien luoc Chuyen doi: Terraform sang Pulumi

Pulumi cung cap `pulumi import` de dua cac cloud resource hien co vao quan ly ma khong can tao lai chung. Doi voi cac doi co state Terraform, `pulumi convert` dich HCL sang chuong trinh Pulumi. Chuyen doi khong hoan hao: module phuc tap va dynamic block yeu cau dieu chinh thu cong.

```bash
# Chuyen doi Terraform HCL sang Pulumi TypeScript
pulumi convert --from terraform --language typescript

# Import resource AWS hien co vao state Pulumi
pulumi import aws:s3/bucketV2:BucketV2 my-bucket my-existing-bucket-name
```

Chuyen doi theo giai doan cho phep cac doi chay ca hai cong cu trong qua trinh chuyen tiep. Terraform quan ly cac stack hien co trong khi Pulumi provision infrastructure moi. Sau khi cac doi co kinh nghiem Pulumi, ho chuyen doi cac stack Terraform dan dan. State khong duoc chia se giua cac cong cu, nen quan ly resource phai duoc phan chia ro rang de tranh xung dot.

## Framework Quyet dinh cho 2026

| Yeu to | Terraform | Pulumi |
|--------|-----------|--------|
| Ngon ngu | HCL (DSL) | TypeScript, Python, Go, C#, Java, YAML |
| Quan ly state | Self-managed hoac Terraform Cloud | Pulumi Cloud (mac dinh) hoac self-managed |
| Xu ly secret | Plaintext trong state, ma hoa backend | Ma hoa theo mac dinh |
| Testing | `terraform test`, Terratest | Framework test ngon ngu tu nhien |
| Pham vi provider | 4.000+ trong registry | Bridge provider Terraform + SDK native |
| Ho tro TypeScript | CDKTF (ngung ho tro thang 12/2025) | First-class, duy tri tich cuc |
| Do kho hoc | HCL duoc xay dung co muc dich, nhanh cho IaC | Yeu cau kien thuc ngon ngu hien co |
| Tinh nang enterprise | Terraform Cloud/Enterprise | Pulumi Cloud/self-hosted |

> **Meo Phong van**
>
> Khi duoc hoi ve Pulumi vs Terraform, tranh tuyen bo mot cai "tot hon." Trinh bay cac danh doi: Terraform co he sinh thai lon hon va cac rang buoc cua HCL ngan chan runtime error; Pulumi cung cap cac tinh nang ngon ngu thuc va typed SDK. Cho thay lua chon phu thuoc vao ky nang doi, tooling hien co va yeu cau du an.

## Diem chinh cho Infrastructure as Code nam 2026

- Terraform 1.16 la lua chon on dinh cho IaC dua tren HCL voi he sinh thai provider lon nhat va tooling truong thanh (Atlantis, Spacelift, env0).
- Pulumi v3.263 cung cap TypeScript, Python, Go va C# voi testing ngon ngu tu nhien, tich hop IDE va ma hoa secret tich hop.
- CDKTF ngung ho tro tu thang 12/2025. Cac doi muon TypeScript IaC nen danh gia Pulumi thay vi bat dau du an CDKTF moi.
- Ca hai cong cu ho tro deployment multi-cloud, remote state backend va cong tac nhom. Lua chon phu thuoc vao so thich ngon ngu va chuyen mon cua doi hien co.
- Thao luan phong van nen the hien su hieu biet ve quan ly state, phat hien drift, he sinh thai provider va danh doi giua su don gian cua DSL va suc manh cua ngon ngu lap trinh thong dung.
- Chuyen doi tu Terraform sang Pulumi co the thuc hien su dung `pulumi convert` va `pulumi import`, nhung yeu cau lap ke hoach can than va trien khai theo giai doan.

---

Source: SharpSkill (https://sharpskill.dev), tech interview preparation for your real stack.
HTML version of this page: https://sharpskill.dev/vi/blog/devops/pulumi-vs-terraform-2026-infrastructure-as-code-typescript-interview-questions