Encore vs
Pulumi has you define each cloud resource explicitly in code, separate from your app. Encore provisions infrastructure automatically in your AWS or GCP account from your application code. Ship quickly, without writing and maintaining a second codebase for infrastructure.
“What used to take days or weeks of back-and-forth between developers and infra teams is now automated and completed in minutes.”
Josef Sima, Engineering Director at Groupon
How they work
Pulumi gives you a real language for infrastructure, but it still lives in a separate program from your application. Encore infers infrastructure from the application code itself, then provisions the managed service, its networking, IAM, and secrets.
Encore
3 lines of TypeScriptimport { SQLDatabase } from "encore.dev/storage/sqldb";
const db = new SQLDatabase("users", {
migrations: "./migrations",
});Pulumi
40+ lines of TypeScriptimport * as aws from "@pulumi/aws";
const sg = new aws.ec2.SecurityGroup("rds-sg", { /* ... */ });
const db = new aws.rds.Instance("users", {
engine: "postgres",
instanceClass: "db.t3.micro",
allocatedStorage: 20,
dbName: "users",
username: config.require("dbUser"),
password: config.requireSecret("dbPass"),
vpcSecurityGroupIds: [sg.id],
});
export const dbUrl = db.endpoint;You don't need to become an infrastructure expert to run on AWS or GCP
Encore sets all of this up from your application code. It's real infrastructure in your own cloud account, so you can always open the console and look. You just never have to build it by hand.
- Terraform modules
- IAM policies
- VPC and subnets
- Security groups
- Kubernetes
- Helm charts
- CI/CD pipelines
- Load balancers
- Secrets per environment
- Staging environments
- Tracing setup
- Database networking
Your options for running a backend
Writing infrastructure code yourself keeps you in your own cloud, but costs time and expertise. Encore gives you the same ownership, without the config.
Do it yourself Pulumi, IAM, VPCs | Hire DevOps One senior engineer | Hosted platform Heroku, Render, Supabase | Encore Automated, in your cloud | |
|---|---|---|---|---|
| Time to first production deploy | Weeks | Months, after the hiring search | Minutes | Minutes |
| Ongoing cost | Your best engineer's evenings | $150k to $250k a year, fully loaded | Grows fast with usage | From $49 per member a month |
| Every new database or queue | Another day of config | A ticket in their queue | Limited to what they offer | One line of code |
| Runs in your AWS or GCP account | Yes | Yes | No | Yes |
| Your cloud credits apply | Yes | Yes | No | Yes |
| Answers "where is our data?" in security reviews | If set up right | Yes | Their answer, not yours | Your account, your VPC |
| When you grow | Rewrite what you hacked together | Hire a second one | Migrate off, usually at the worst time | Nothing changes |
| If the key person leaves | Nobody knows how it works | Same problem | Not your problem | Not your problem |
Infrastructure Ownership
Both Encore and Pulumi deploy to your own cloud account. The difference is how you get there. Pulumi requires you to explicitly define every resource, dependency, and policy. Encore derives infrastructure from your application code automatically.
Pulumi gives you the ability to configure any cloud resource, but this requires deep cloud expertise and ongoing maintenance of infrastructure code that lives separately from your application.
Encore gives you production-ready infrastructure without the expertise overhead. You still own everything in your AWS/GCP console, and you can always access resources directly when needed.
Learn more about infrastructure ownership →Local Development
Pulumi is focused on provisioning cloud resources and doesn't provide a local development solution. To develop locally, you'd use Docker, LocalStack, or connect to remote cloud resources, managing this setup yourself.
Encore runs encore run and automatically provisions local PostgreSQL, Pub/Sub emulation, and cron scheduling. A local dashboard shows distributed tracing and architecture diagrams.
This means you can develop and test your entire backend locally without connecting to cloud resources or managing Docker containers.
Learn more about local development →Least-privilege access, without writing IAM
With Pulumi, IAM roles and policy documents are still objects you author and maintain yourself, and over-broad permissions are easy to ship by accident.
Encore knows which services touch each database, queue, bucket, and secret, and generates per-service IAM policies with only those permissions. Secrets are referenced by name and stay encrypted and environment-scoped, so credentials never enter the repository.
- Per-service IAM generated from the code
- Policies updated as the application changes
- Encrypted, environment-scoped secrets
- Every infrastructure change tied to a commit
Every other combination stays denied — you never write the policy.
AI-Assisted Development
With Pulumi, infrastructure lives in a separate codebase from your application. AI agents like Cursor and Claude Code lack context about how Pulumi definitions relate to your application code, leading to drift, inconsistencies, and infrastructure configs that don't match application needs.
Encore defines infrastructure in your application code. AI agents see everything in one context: your APIs, databases, queues, and how they connect. This makes AI-generated code easy to review before you deploy it.
Because the infrastructure comes from Encore's defaults rather than hand-written Pulumi config, you can let an AI agent build features and trust the result is provisioned correctly. Built-in guardrails, auto-documentation, and observability keep what it produces maintainable as it grows.
Learn about AI-assisted development →
Migrating from Pulumi
You don't have to replace Pulumi all at once. It can keep managing infrastructure outside your application while Encore takes over the resources your backend uses, one at a time.
The migration guide covers how Pulumi concepts map to Encore, deciding what Pulumi keeps managing, and migrating existing resources.
Read the Pulumi migration guideLoved by teams
who refuse to slow down
"Encore is our foundation for all new development. Since adopting it, we've seen a 2-3x increase in development speed and 90% shorter project lead times."
Josef Sima · Engineering Director"Encore lets us go from idea to shipped product at least 3x faster and saves us hours of devops work every week."
Will · Co-founder"We've reduced time spent on DevOps by 95%, and we're now on track to save $60K annually in cloud costs."
Mason Stewart · CTO"Encore is an unfair advantage. At Pave we've moved 2x faster than we did at Monzo."
Simon Vans-Colina · CTO"We're saving $200k+ annually compared to additional hiring. The ROI is outstanding, easily 10x."
Daniel Stocks · CTO"You define infrastructure in your code and it's automatically spun up for you. You can go from zero to a deployed service on GCP in an hour. I don't know how else to do it."
Nilkanth Patel · CTO"Encore's inferred infrastructure has allowed us to move at unprecedented speed. Combined with database branching in Neon, we're able to spin ephemeral environments up and down with incredible ease. Stakeholders love preview app URLs."
Justin Foley · VP of Engineering
Frequently asked questions
Common questions about Encore vs Pulumi.
Encore uses infrastructure-from-code where infrastructure is derived automatically from your application code. Pulumi is Infrastructure as Code (IaC) where you explicitly define every cloud resource in a separate codebase. With Encore, you write your app and infrastructure is provisioned automatically. With Pulumi, you maintain two codebases: your application and your infrastructure definitions.
Encore is purpose-built for backend development with built-in databases, Pub/Sub, cron jobs, and distributed tracing that work locally and in production with zero configuration. Pulumi is a general-purpose IaC tool that requires you to define each resource explicitly and manage the connection between your application code and infrastructure definitions.
Encore is designed for developers without DevOps expertise. Infrastructure is provisioned automatically based on your code. Pulumi requires understanding cloud provider APIs, resource dependencies, IAM policies, and infrastructure best practices. While Pulumi uses familiar languages like TypeScript, you still need to know what infrastructure to create.
Encore provides automatic local development with databases, Pub/Sub, and distributed tracing included with a single command. Pulumi has no local development solution and only provisions cloud resources. For local development with Pulumi, you need to set up Docker, LocalStack, or similar tools separately.
Yes, both deploy to your own AWS or GCP account. The difference is how: Pulumi requires you to explicitly define every resource, IAM policy, and configuration. Encore analyzes your application code and provisions the right resources automatically, including proper IAM policies, security groups, and resource configurations.
Encore is designed specifically for microservices with automatic service discovery, type-safe API calls between services, distributed tracing, and auto-generated architecture diagrams. Pulumi can provision infrastructure for microservices, but you need to define service communication, IAM policies, and observability setup manually in your infrastructure code.
Start building with Encore
Deploy to your own AWS or GCP account, with infrastructure provisioned automatically.