Terraform vs Pulumi vs CDK Enterprise

TL;DR

• OpenTofu (fork Terraform OSS): default multi-cloud, license MPL 2.0, ekosistem provider terbesar.
• Terraform Cloud / Enterprise: kalau butuh Sentinel policy, run task, agent self-host enterprise.
• Pulumi: TypeScript / Python first-class, DX bagus untuk software engineer.
• AWS CDK: AWS-only, abstraction L3 powerful, vendor lock-in tinggi.
• Verdict: Conditional — OpenTofu default, Pulumi niche TS-first, CDK AWS-only.

Konteks

Saya jalankan IaC paralel 24 bulan (Juni 2024 - Mei 2026) di:

• BUMN energy Jakarta: OpenTofu (migrate dari Terraform 1.5.7 di Q3 2024 setelah license shift)
  • 4 cloud: GCP Jakarta (asia-southeast2), AWS Singapore, on-prem VMware vSphere, Azure (limited)
  • 18 state file, 240+ resource per environment, 3 env (dev, staging, prod)
• Fintech series-B Jakarta: Terraform Cloud (sebelum contract berakhir Q2 2026, plan migrate ke OpenTofu)
  • 2 cloud: GCP Jakarta, Cloudflare
  • 24 state file, 380 resource production
• Eval Pulumi: 6 bulan di fintech untuk 1 service greenfield TypeScript
• Eval CDK: 4 bulan di project sampingan AWS-only

Pengalaman IaC: Terraform 7 tahun (sejak 0.11 era), CloudFormation 4 tahun (legacy AWS), Pulumi 1,5 tahun, CDK 1 tahun.

Pricing (Juni 2026)

OpenTofu

• Software gratis (MPL 2.0)
• Backend state: GCS bucket Jakarta versioned + IAM = Rp 350 ribu/bulan untuk 24 state file
• CI runner self-host (Atlantis): 2 pod e2-small = Rp 920 ribu/bulan
• Total: Rp 1,27 juta/bulan

Terraform Cloud / Enterprise

• Free: 500 RUM (Resources Under Management), 1 user
• Standard: USD 0,00014/hour/RUM = ~USD 100-300/bulan untuk team kecil
• Plus: USD 0,00014/hour/RUM + USD 12/user — saya pakai 25 user × USD 12 + ~2.000 RUM ~ USD 350/bulan
• Enterprise: quoted, USD 3.000-10.000+/bulan untuk Sentinel policy + self-host agent
• Fintech saya: Plus tier ~USD 320/bulan = Rp 5,1 juta/bulan

Pulumi

• Individual: gratis (250k resource update/bulan)
• Team: USD 9/user/bulan
• Business: USD 25/user/bulan + advanced feature
• Enterprise: USD 50/user/bulan + SSO
• Self-host (Pulumi Cloud Self-Hosted): USD 30k+/tahun
• Eval saya: gratis tier (1 user)

AWS CDK

• Software gratis (Apache 2.0)
• CloudFormation backend gratis (charged only resource yang ter-create)
• Eval saya: gratis

Total IaC cost

Komponen	Cost/bulan
OpenTofu BUMN	Rp 1,27 juta
Terraform Cloud fintech	Rp 5,1 juta
Total	Rp 6,37 juta/bulan

Setelah migrate fintech ke OpenTofu (target Q3 2026): total turun ke ~Rp 2,7 juta/bulan. Saves Rp 3,7 juta/bulan = Rp 44 juta/tahun.

SLO + performance (24 bulan)

OpenTofu + Atlantis

Metrik	Target	Realisasi
tofu plan execution time p99	< 90 detik	75 detik
tofu apply execution time p99	< 8 menit	5-7 menit
Apply success rate	> 98%	98,7%
State lock waiting p99	< 60 detik	32 detik
Drift detection (daily cron)	100% coverage	100%
Rollback time (apply revert)	< 15 menit	8-12 menit
Pipeline availability	> 99,5%	99,76%

Insiden 24 bulan: 3 P2 (state lock deadlock 1x, GCS bucket permission issue 1x, provider version drift 1x). 0 P0.

Terraform Cloud

Similar dengan OpenTofu performance. Trade-off: vendor SLA 99,9% untuk TFC, lebih predictable.

Architecture pipeline

OpenTofu + Atlantis pattern

git push main ─→ GitHub Actions
                    │
                    └─→ Atlantis bot detect PR
                            │
                            ├─→ tofu plan + comment hasil di PR
                            │
                            ├─→ Reviewer 2 orang approve
                            │
                            └─→ tofu apply (auto setelah approve)
                                    │
                                    ├─→ State write ke GCS Jakarta
                                    ├─→ Notify Slack
                                    └─→ Audit log ke Splunk

Atlantis self-host di GKE: gratis, mature, GitOps pattern native. Alternative: Spacelift (commercial), Scalr.

Drift detection daily

# Cron daily 02:00 WIB
for state in $(list-state-files); do
  tofu plan -detailed-exitcode -state=$state
  if [ $? -eq 2 ]; then  # diff detected
    notify-slack "Drift detected in $state"
    create-jira-ticket "Drift remediation: $state"
  fi
done

Drift terdeteksi quarterly trend: rata-rata 8-15 resource/bulan ter-modify outside IaC (manual operator click di GCP console). Remediation: import ke state atau revert manual change.

Capability comparison

Capability	OpenTofu / Terraform	Pulumi	AWS CDK
Multi-cloud	ya (2.000+ provider)	ya (resource provider Pulumi)	tidak (AWS-only)
Bahasa	HCL declarative	TypeScript / Python / Go / C#	TypeScript / Python / Java
State file backend	banyak (S3, GCS, Azure, Postgres)	Pulumi Cloud / self-host	CloudFormation native
State locking	ya	ya	ya (CFN stack)
Module / abstraction	module HCL	function / class native bahasa	construct L1/L2/L3
Imperative escape hatch	terbatas (lokal block)	full (bahasa programmer)	full
Testing	terratest, kitchen-terraform	unit test native bahasa	jest, pytest native
Drift detection	ya (plan -detailed-exitcode)	ya	ya (CFN drift)
Policy as code	Sentinel (TFE), OPA (3rd)	CrossGuard	cdk-nag
Secret management	Vault, AWS SM via provider	sama	sama
Ekosistem provider	terbesar	medium-besar	AWS native
Learning curve	sedang	rendah (kalau familiar TS)	sedang
Lock-in	sedang	sedang	tinggi (AWS)

Use case fit

Scenario	Best fit
Multi-cloud enterprise (GCP + AWS + Azure)	OpenTofu
AWS-only enterprise dengan team Java/TS	CDK
SaaS startup TypeScript-first	Pulumi
Network + infra team (ops-led)	OpenTofu / Terraform
Software engineering team (no ops)	Pulumi atau CDK
Migration dari CloudFormation	CDK (smooth)
Migration dari shell script + console click	OpenTofu (low barrier)
Policy enforcement compliance OJK	Terraform Cloud + Sentinel, atau OpenTofu + OPA

Trade-off arsitektural

Pilih OpenTofu kalau:

• Multi-cloud (2+ provider major)
• License legal team konservatif (avoid BSL)
• Ops-led tim (HCL declarative natural)
• Investment Terraform existing
• Self-host preference (zero vendor dependency)

Pilih Terraform Cloud / Enterprise kalau:

• Sentinel policy compliance wajib
• Run task integrasi (cost estimation, drift detection automation)
• Agent self-host enterprise (akses VPC private)
• Budget USD 5k-50k/tahun OK
• Vendor support enterprise penting

Pilih Pulumi kalau:

• Tim TypeScript / Python first-class
• DX dev-led tim (testing native, IDE autocomplete)
• Abstraction kompleks (loops, conditional, polymorphism)
• Vendor agnostic preference (Pulumi support multi-cloud)

Pilih AWS CDK kalau:

• AWS-only stack confirmed
• CloudFormation native lock-in OK
• Abstraction L3 (custom construct) untuk reuse pattern
• Team Java/Python existing AWS

Migration paths

Terraform → OpenTofu

Smoothest path saya pernah encounter. 1.5.x state file compatible.

Steps:

1. Pin Terraform version 1.5.7 (last MPL version)
2. Install OpenTofu 1.6+ paralel
3. Test tofu plan vs terraform plan — should match
4. Switch CI/CD ke tofu command
5. Update documentation + team training

Effort: 1-2 minggu untuk BUMN saya (18 state file). 0 incident. Compatibility 99%+ — beberapa provider deprecate masih support.

CloudFormation → CDK

Native — CDK synth output adalah CloudFormation template. Smooth.

Effort: 4-8 minggu untuk 50 stack medium complexity. Pattern: bikin construct L3 untuk abstraction recurring, lalu replace stack lama satu per satu.

Pulumi → Terraform (atau sebaliknya)

Tidak ada direct migration. Re-write resource declaration. Effort 1-2x lipat dari greenfield (karena harus map state).

Lebih masuk akal: stay di satu tool sekali pick.

State file strategy

Pattern saya untuk 18 service fintech + 22 BUMN:

infrastructure/
├── modules/                    # shared module library
│   ├── gke-cluster/
│   ├── postgres-ha/
│   └── network-base/
├── envs/
│   ├── dev/
│   │   ├── network/            # 1 state
│   │   ├── data/               # 1 state
│   │   ├── payment-svc/        # 1 state
│   │   └── ...
│   ├── staging/
│   └── prod/
└── policies/                   # OPA / Sentinel policy

Backend per state: GCS bucket scoped per-environment + IAM granular:

• tofu-state-prod bucket: write akses hanya CI/CD service account + 2 SRE senior
• tofu-state-staging bucket: write akses tim engineering broader
• tofu-state-dev bucket: write akses dev open

Cross-reference via terraform_remote_state:

data "terraform_remote_state" "network" {
  backend = "gcs"
  config = {
    bucket = "tofu-state-prod"
    prefix = "network"
  }
}

resource "google_container_cluster" "primary" {
  network = data.terraform_remote_state.network.outputs.vpc_id
  # ...
}

State separation per domain = blast radius kecil saat apply error.

Policy as code

Terraform Cloud + Sentinel

# policy.sentinel
main = rule {
  all tfplan.resource_changes as _, rc {
    rc.type is "google_storage_bucket" implies
      rc.change.after.location is "ASIA-SOUTHEAST2"
  }
}

Enforce: semua GCS bucket harus di region Jakarta. Compliance OJK data residency.

OpenTofu + OPA (Open Policy Agent)

Equivalent dengan OPA Rego language. Lebih portable, tidak vendor lock-in.

deny[msg] {
  input.resource.type == "google_storage_bucket"
  input.resource.location != "ASIA-SOUTHEAST2"
  msg = "GCS bucket harus di asia-southeast2"
}

Policy run di CI sebelum apply. 25-30 policy aktif di BUMN saya covering: region binding, encryption mandatory, public IP forbid, IAM principle of least privilege, tagging mandatory.

Common pitfall

1. Monolith state file. 1 state untuk semua resource = lock contention + blast radius besar. Split per domain dari awal.
2. State file di Git. NEVER commit .tfstate ke Git. Berisi secret + state mutable. Pakai remote backend (GCS, S3) dengan versioning + locking.
3. No backend encryption. Backend bucket harus encrypted with customer-managed key (CMK) untuk compliance. Default Google-managed key tidak cukup untuk audit OJK strict.
4. Provider version unpinned. provider "google" { version = "~> 5.0" } semi-OK. Better: pin exact version version = "5.12.0". Avoid drift accidental saat provider update.
5. Manual change di console. Drift = state file inconsistent. Audit drift weekly, remediate via import atau revert.

Cost of ownership 36 bulan

Skenario: enterprise multi-cloud (GCP + AWS + Cloudflare), 50 state file production, tim 6 engineer + 2 SRE.

Item	OpenTofu + Atlantis	Terraform Enterprise	Pulumi Business
License/SaaS 3 tahun	Rp 0	Rp 1,2 miliar	Rp 540 juta (25 user)
Backend infra	Rp 60 juta	Rp 0 (managed)	Rp 0
Ops engineer	Rp 270 juta	Rp 95 juta (less ops, managed)	Rp 130 juta
Policy + tooling custom	Rp 95 juta	Rp 0 (Sentinel built-in)	Rp 60 juta
Training tim	Rp 30 juta	Rp 40 juta	Rp 85 juta
Total 3 tahun	Rp 455 juta	Rp 1,335 miliar	Rp 815 juta

OpenTofu self-host paling murah cash, tapi butuh ops + tooling capacity. Terraform Enterprise paling mahal, tapi paling siap untuk compliance + run task. Pulumi middle ground untuk team TS-first.

Indonesia specific

Data residency provider Indonesia

OpenTofu / Terraform provider untuk:

• GCP asia-southeast2 (Jakarta): mature
• AWS ap-southeast-3 (Jakarta): mature, lokasi data center 2023+
• Cloudflare Jakarta PoP: provider via API matang
• BiznetGio (lokal): provider terbatas, sebagian via REST API custom
• Alibaba Cloud Indonesia: provider matang
• On-prem VMware vSphere (BUMN): provider mature

Compliance OJK

Audit log Terraform / OpenTofu apply: export ke Splunk via webhook. Format CEF compliant. KAP audit Q1 2026 passed dengan 0 finding terkait IaC.

Hiring

Terraform engineer di Jakarta: pool moderate, kompensasi Rp 25-40 juta/bulan senior. OpenTofu skill 99% transferable dari Terraform — tidak butuh hiring spesialis. Pulumi engineer scarce, train dari TypeScript engineer existing (ramp-up 2-3 minggu).

Yang surprising

Setelah 24 bulan: license shift Terraform → OpenTofu ternyata smooth lebih dari ekspektasi. Saya khawatir compatibility issue muncul dalam 6 bulan, realita: 24 bulan dengan 0 P0 incident attributed to OpenTofu compat. Community contribution OpenTofu aktif, provider update bahkan kadang lebih cepat dari Terraform (karena tidak filter PR berdasar HashiCorp roadmap).

Surprise lain: Pulumi DX untuk software engineer ternyata jauh lebih friendly dari Terraform HCL. Eval saya di fintech, engineer JS yang biasa tidak pernah pakai IaC, dalam 1 minggu sudah produktif di Pulumi. Sebelumnya di Terraform butuh 3-4 minggu. Untuk team dev-led tanpa SRE: Pulumi adoption barrier lebih rendah.

Verdict

Conditional dengan rule konkret:

• Default enterprise multi-cloud Indonesia: OpenTofu. Free, multi-cloud, ekosistem terbesar.
• Enterprise butuh policy compliance + run task: Terraform Cloud Plus / Enterprise.
• SaaS startup TypeScript-first: Pulumi worth evaluasi.
• AWS-only stack: CDK acceptable, tapi accept vendor lock-in.
• Skip Pulumi / CDK kalau tim sudah Terraform expert + multi-cloud. Migration cost > benefit.

Threshold konkret untuk adopt IaC formal: 5+ environment (dev/staging/prod × multi-domain) atau 20+ resource cloud aktif. Di bawah ini, console click + Bash script masih acceptable untuk lab/MVP.