Introduction

Pulumi brings infrastructure as code to Java developers, allowing you to define cloud resources using familiar Java constructs instead of YAML or domain-specific languages. With Pulumi's Java SDK, you can leverage your existing Java skills to provision and manage infrastructure across AWS, Azure, Google Cloud, and Kubernetes with type safety, IDE support, and full testing capabilities.

Article: Mastering Cloud Infrastructure with Pulumi Java SDK

Pulumi's Java SDK enables Java developers to define cloud infrastructure using real Java code, bringing compile-time safety, code reuse, and modern software engineering practices to infrastructure management. Let's explore how to build, test, and deploy infrastructure using Pulumi with Java.

1. Setting Up Pulumi with Java

Prerequisites:

• Java 8 or higher
• Apache Maven or Gradle
• Pulumi CLI
• Cloud provider CLI (AWS, Azure, or GCP)

Installation:

# Install Pulumi CLI
curl -fsSL https://get.pulumi.com | sh
# Verify installation
pulumi version

Maven Configuration:

<!-- pom.xml -->
<project>
<modelVersion>4.0.0</modelVersion>
<groupId>com.mycompany</groupId>
<artifactId>pulumi-infrastructure</artifactId>
<version>1.0.0</version>
<properties>
<maven.compiler.source>11</maven.compiler.source>
<maven.compiler.target>11</maven.compiler.target>
<pulumi.version>3.96.2</pulumi.version>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
</properties>
<dependencies>
<dependency>
<groupId>com.pulumi</groupId>
<artifactId>pulumi</artifactId>
<version>${pulumi.version}</version>
</dependency>
<dependency>
<groupId>com.pulumi</groupId>
<artifactId>aws</artifactId>
<version>${pulumi.version}</version>
</dependency>
<dependency>
<groupId>com.pulumi</groupId>
<artifactId>awsx</artifactId>
<version>${pulumi.version}</version>
</dependency>
<dependency>
<groupId>com.pulumi</groupId>
<artifactId>kubernetes</artifactId>
<version>${pulumi.version}</version>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>com.pulumi</groupId>
<artifactId>pulumi-maven-plugin</artifactId>
<version>${pulumi.version}</version>
<configuration>
<mainClass>com.mycompany.infra.Infrastructure</mainClass>
</configuration>
</plugin>
</plugins>
</build>
</project>

2. Basic Pulumi Java Structure

Main Infrastructure Class:

package com.mycompany.infra;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.s3.Bucket;
import com.pulumi.aws.s3.BucketArgs;
public class Infrastructure {
public static void main(String[] args) {
Pulumi.run(Infrastructure::stack);
}
private static void stack(Context ctx) {
// Infrastructure definition goes here
var bucket = new Bucket("my-bucket", BucketArgs.builder()
.bucket("my-unique-bucket-name-12345")
.build());
// Export values for easy access
ctx.export("bucketName", bucket.bucket());
ctx.export("bucketArn", bucket.arn());
}
}

3. AWS Infrastructure Examples

S3 Bucket with CloudFront Distribution:

package com.mycompany.infra.aws;
import com.pulumi.Context;
import com.pulumi.aws.s3.Bucket;
import com.pulumi.aws.s3.BucketArgs;
import com.pulumi.aws.s3.BucketWebsiteArgs;
import com.pulumi.aws.cloudfront.Distribution;
import com.pulumi.aws.cloudfront.DistributionArgs;
import com.pulumi.aws.cloudfront.inputs.DistributionOriginArgs;
import com.pulumi.aws.cloudfront.inputs.DistributionDefaultCacheBehaviorArgs;
import com.pulumi.aws.cloudfront.inputs.DistributionViewerCertificateArgs;
import com.pulumi.aws.acm.Certificate;
import com.pulumi.aws.acm.CertificateArgs;
import com.pulumi.aws.route53.Record;
import com.pulumi.aws.route53.RecordArgs;
import com.pulumi.aws.route53.inputs.RecordAliasArgs;
public class StaticWebsite {
public static void createStaticWebsite(Context ctx) {
// S3 Bucket for static website
var bucket = new Bucket("website-bucket", BucketArgs.builder()
.bucket("my-static-website-12345")
.website(BucketWebsiteArgs.builder()
.indexDocument("index.html")
.errorDocument("error.html")
.build())
.forceDestroy(true)
.build());
// SSL Certificate
var certificate = new Certificate("website-cert", CertificateArgs.builder()
.domainName("example.com")
.validationMethod("DNS")
.build());
// CloudFront Distribution
var distribution = new Distribution("website-distribution", DistributionArgs.builder()
.enabled(true)
.aliases("example.com", "www.example.com")
.origins(DistributionOriginArgs.builder()
.domainName(bucket.websiteEndpoint())
.originId(bucket.arn())
.customOriginConfig(DistributionOriginArgs.CustomOriginConfigArgs.builder()
.httpPort(80)
.httpsPort(443)
.originProtocolPolicy("http-only")
.build())
.build())
.defaultCacheBehavior(DistributionDefaultCacheBehaviorArgs.builder()
.targetOriginId(bucket.arn())
.viewerProtocolPolicy("redirect-to-https")
.allowedMethods("GET", "HEAD", "OPTIONS")
.cachedMethods("GET", "HEAD", "OPTIONS")
.forwardedValues(DistributionDefaultCacheBehaviorArgs.ForwardedValuesArgs.builder()
.queryString(false)
.cookies(DistributionDefaultCacheBehaviorArgs.ForwardedValuesArgs.CookiesArgs.builder()
.forward("none")
.build())
.build())
.minTtl(0)
.defaultTtl(3600)
.maxTtl(86400)
.build())
.viewerCertificate(DistributionViewerCertificateArgs.builder()
.acmCertificateArn(certificate.arn())
.sslSupportMethod("sni-only")
.build())
.build());
ctx.export("websiteUrl", Output.format("https://%s", distribution.domainName()));
ctx.export("bucketName", bucket.bucket());
}
}

VPC and ECS Fargate Service:

package com.mycompany.infra.aws;
import com.pulumi.Context;
import com.pulumi.awsx.ec2.Vpc;
import com.pulumi.awsx.ec2.VpcArgs;
import com.pulumi.awsx.ecs.FargateService;
import com.pulumi.awsx.ecs.FargateServiceArgs;
import com.pulumi.awsx.ecs.inputs.FargateServiceTaskDefinitionArgs;
import com.pulumi.awsx.lb.ApplicationLoadBalancer;
import com.pulumi.awsx.lb.ApplicationLoadBalancerArgs;
import com.pulumi.aws.lb.Listener;
import com.pulumi.aws.lb.ListenerArgs;
import com.pulumi.aws.ecs.Cluster;
import com.pulumi.aws.ecs.ClusterArgs;
public class EcsFargateStack {
public static void createFargateService(Context ctx) {
// Create VPC
var vpc = new Vpc("app-vpc", VpcArgs.builder()
.enableDnsHostnames(true)
.enableDnsSupport(true)
.build());
// Create ECS Cluster
var cluster = new Cluster("app-cluster", ClusterArgs.builder()
.build());
// Create Load Balancer
var alb = new ApplicationLoadBalancer("app-alb", ApplicationLoadBalancerArgs.builder()
.vpcId(vpc.vpcId())
.subnetIds(vpc.publicSubnetIds())
.build());
// Fargate Service
var service = new FargateService("app-service", FargateServiceArgs.builder()
.cluster(cluster.arn())
.assignPublicIp(true)
.taskDefinitionArgs(FargateServiceTaskDefinitionArgs.builder()
.container(FargateServiceTaskDefinitionArgs.ContainerArgs.builder()
.name("app-container")
.image("my-registry/my-java-app:latest")
.cpu(512)
.memory(1024)
.portMappings(FargateServiceTaskDefinitionArgs.PortMappingArgs.builder()
.containerPort(8080)
.targetGroup(alb.defaultTargetGroup())
.build())
.environment(List.of(
FargateServiceTaskDefinitionArgs.KeyValuePairArgs.builder()
.name("SPRING_PROFILES_ACTIVE")
.value("production")
.build(),
FargateServiceTaskDefinitionArgs.KeyValuePairArgs.builder()
.name("JAVA_OPTS")
.value("-Xmx768m -Xms256m")
.build()))
.build())
.build())
.build());
// Export important values
ctx.export("vpcId", vpc.vpcId());
ctx.export("loadBalancerUrl", alb.loadBalancer().apply(lb -> lb.dnsName()));
ctx.export("clusterName", cluster.name());
}
}

4. Kubernetes Infrastructure

Java Application Deployment:

package com.mycompany.infra.k8s;
import com.pulumi.Context;
import com.pulumi.kubernetes.apps.v1.Deployment;
import com.pulumi.kubernetes.apps.v1.DeploymentArgs;
import com.pulumi.kubernetes.core.v1.Service;
import com.pulumi.kubernetes.core.v1.ServiceArgs;
import com.pulumi.kubernetes.core.v1.inputs.ServicePortArgs;
import com.pulumi.kubernetes.core.v1.inputs.ContainerArgs;
import com.pulumi.kubernetes.core.v1.inputs.PodSpecArgs;
import com.pulumi.kubernetes.core.v1.inputs.PodTemplateSpecArgs;
import com.pulumi.kubernetes.meta.v1.inputs.ObjectMetaArgs;
import com.pulumi.kubernetes.meta.v1.inputs.LabelSelectorArgs;
import com.pulumi.kubernetes.apps.v1.inputs.DeploymentSpecArgs;
public class KubernetesStack {
public static void createJavaAppDeployment(Context ctx) {
var appName = "order-service";
var appLabels = Map.of("app", appName);
// Deployment
var deployment = new Deployment(appName, DeploymentArgs.builder()
.metadata(ObjectMetaArgs.builder()
.name(appName)
.labels(appLabels)
.build())
.spec(DeploymentSpecArgs.builder()
.replicas(3)
.selector(LabelSelectorArgs.builder()
.matchLabels(appLabels)
.build())
.template(PodTemplateSpecArgs.builder()
.metadata(ObjectMetaArgs.builder()
.labels(appLabels)
.build())
.spec(PodSpecArgs.builder()
.containers(ContainerArgs.builder()
.name(appName)
.image("my-registry/order-service:1.0.0")
.ports(ContainerArgs.PortArgs.builder()
.containerPort(8080)
.name("http")
.build())
.env(
ContainerArgs.EnvVarArgs.builder()
.name("JAVA_OPTS")
.value("-XX:+UseContainerSupport -Xmx512m -Xms256m")
.build(),
ContainerArgs.EnvVarArgs.builder()
.name("SPRING_PROFILES_ACTIVE")
.value("kubernetes")
.build()
)
.resources(ContainerArgs.ResourceRequirementsArgs.builder()
.requests(Map.of(
"cpu", "250m",
"memory", "512Mi"
))
.limits(Map.of(
"cpu", "500m",
"memory", "768Mi"
))
.build())
.livenessProbe(ContainerArgs.LivenessProbeArgs.builder()
.httpGet(ContainerArgs.HttpGetArgs.builder()
.path("/actuator/health")
.port("http")
.build())
.initialDelaySeconds(45)
.periodSeconds(10)
.build())
.readinessProbe(ContainerArgs.ReadinessProbeArgs.builder()
.httpGet(ContainerArgs.HttpGetArgs.builder()
.path("/actuator/health/readiness")
.port("http")
.build())
.initialDelaySeconds(30)
.periodSeconds(5)
.build())
.build())
.build())
.build())
.build())
.build());
// Service
var service = new Service(appName, ServiceArgs.builder()
.metadata(ObjectMetaArgs.builder()
.name(appName)
.build())
.spec(com.pulumi.kubernetes.core.v1.inputs.ServiceSpecArgs.builder()
.selector(appLabels)
.ports(ServicePortArgs.builder()
.port(80)
.targetPort("http")
.protocol("TCP")
.build())
.type("ClusterIP")
.build())
.build());
ctx.export("deploymentName", deployment.metadata().apply(m -> m.name()));
ctx.export("serviceName", service.metadata().apply(m -> m.name()));
}
}

5. Advanced Patterns and Best Practices

Configuration Management:

package com.mycompany.infra.config;
import com.pulumi.Config;
import com.pulumi.Context;
public class AppConfig {
private final String environment;
private final String appVersion;
private final int replicaCount;
private final DatabaseConfig databaseConfig;
public AppConfig(Context ctx) {
Config config = ctx.config();
this.environment = config.get("environment").orElse("dev");
this.appVersion = config.get("appVersion").orElse("latest");
this.replicaCount = config.getInteger("replicaCount").orElse(2);
this.databaseConfig = new DatabaseConfig(config);
}
public static class DatabaseConfig {
private final String username;
private final String password;
private final String instanceClass;
public DatabaseConfig(Config config) {
this.username = config.get("dbUsername").orElse("appuser");
this.password = config.requireSecret("dbPassword");
this.instanceClass = config.get("dbInstanceClass").orElse("db.t3.small");
}
}
// Getters
public String getEnvironment() { return environment; }
public String getAppVersion() { return appVersion; }
public int getReplicaCount() { return replicaCount; }
public DatabaseConfig getDatabaseConfig() { return databaseConfig; }
}

Modular Infrastructure Components:

package com.mycompany.infra.components;
import com.pulumi.aws.rds.Instance;
import com.pulumi.aws.rds.InstanceArgs;
import com.pulumi.aws.rds.inputs.InstanceS3ImportArgs;
import com.pulumi.core.Output;
public class DatabaseComponent {
private final Instance databaseInstance;
public DatabaseComponent(String name, DatabaseArgs args) {
this.databaseInstance = new Instance(name, InstanceArgs.builder()
.engine("mysql")
.engineVersion("8.0")
.instanceClass(args.getInstanceClass())
.allocatedStorage(20)
.dbName(args.getDbName())
.username(args.getUsername())
.password(args.getPassword())
.skipFinalSnapshot(true)
.backupRetentionPeriod(7)
.backupWindow("03:00-04:00")
.maintenanceWindow("sun:04:00-sun:05:00")
.build());
}
public Output<String> getEndpoint() {
return databaseInstance.endpoint();
}
public Output<String> getConnectionString() {
return Output.format("jdbc:mysql://%s/%s", 
databaseInstance.endpoint(), 
databaseInstance.dbName());
}
public static class DatabaseArgs {
private final String instanceClass;
private final String dbName;
private final String username;
private final String password;
public DatabaseArgs(String instanceClass, String dbName, String username, String password) {
this.instanceClass = instanceClass;
this.dbName = dbName;
this.username = username;
this.password = password;
}
// Getters
public String getInstanceClass() { return instanceClass; }
public String getDbName() { return dbName; }
public String getUsername() { return username; }
public String getPassword() { return password; }
}
}

Using Components:

package com.mycompany.infra;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.mycompany.infra.components.DatabaseComponent;
import com.mycompany.infra.config.AppConfig;
public class MainStack {
public static void main(String[] args) {
Pulumi.run(MainStack::stack);
}
private static void stack(Context ctx) {
var config = new AppConfig(ctx);
// Create database using component
var database = new DatabaseComponent("app-db", 
new DatabaseComponent.DatabaseArgs(
config.getDatabaseConfig().getInstanceClass(),
"myapp",
config.getDatabaseConfig().getUsername(),
config.getDatabaseConfig().getPassword()
));
ctx.export("databaseEndpoint", database.getEndpoint());
ctx.export("databaseConnectionString", database.getConnectionString());
}
}

6. Testing Infrastructure Code

Unit Testing with Pulumi Mocks:

package com.mycompany.infra.test;
import com.pulumi.test.Mocks;
import com.pulumi.test.TestOptions;
import com.pulumi.test.internal.PulumiTestInternal;
import org.junit.jupiter.api.Test;
import static org.assertj.core.api.Assertions.assertThat;
class InfrastructureTest {
@Test
void testS3BucketCreation() {
var result = PulumiTestInternal.builder()
.withOptions(TestOptions.builder()
.preview(true)
.build())
.withMocks(new MyMocks())
.testAsync(Infrastructure::stack)
.join();
var bucketName = result.outputs().get("bucketName").getValue();
assertThat(bucketName).isEqualTo("my-unique-bucket-name-12345");
}
static class MyMocks implements Mocks {
@Override
public Result newResource(ResourceArgs args) {
switch (args.type) {
case "aws:s3/bucket:Bucket":
return Result.of(args.name + "-id", Map.of(
"bucket", args.name,
"arn", "arn:aws:s3:::" + args.name
));
default:
return Result.empty();
}
}
@Override
public Result call(CallArgs args) {
return Result.of(Map.of());
}
}
}

7. Deployment and CI/CD

Pulumi.yaml:

name: my-infrastructure
runtime: java
description: Infrastructure as Code with Java
template:
config:
aws:region:
description: AWS region to deploy to
default: us-west-2
environment:
description: Deployment environment
default: dev

GitHub Actions Workflow:

name: Deploy Infrastructure
on:
push:
branches: [ main ]
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Set up Java
uses: actions/setup-java@v3
with:
java-version: '11'
distribution: 'temurin'
cache: 'maven'
- name: Set up Pulumi
uses: pulumi/setup-pulumi@v3
- name: Build project
run: mvn compile
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v2
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: us-west-2
- name: Deploy infrastructure
run: pulumi up --stack dev --yes
env:
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}

8. Best Practices for Pulumi Java

1. Use Strong Typing:

// Good - type safe
new Bucket("my-bucket", BucketArgs.builder()
.bucket("my-bucket")
.versioning(BucketVersioningArgs.builder()
.enabled(true)
.build())
.build());
// Avoid - untyped
new Bucket("my-bucket");

2. Organize with Packages:

src/main/java/com/mycompany/infra/
├── components/          # Reusable infrastructure components
├── stacks/             # Main stack definitions
├── config/             # Configuration classes
└── utils/              # Utility classes

3. Use Outputs Properly:

// Chain outputs correctly
var bucket = new Bucket("my-bucket", BucketArgs.builder()
.bucket("my-bucket")
.build());
var object = new BucketObject("index.html", BucketObjectArgs.builder()
.bucket(bucket.bucket())  // Use output directly
.key("index.html")
.build());
// Export computed values
ctx.export("websiteUrl", 
Output.format("https://%s.s3.amazonaws.com/index.html", bucket.bucket()));

4. Handle Secrets Securely:

var dbPassword = new RandomPassword("db-password", RandomPasswordArgs.builder()
.length(16)
.special(true)
.build());
var db = new Instance("database", InstanceArgs.builder()
.password(dbPassword.result())  // Automatically treated as secret
.build());

Benefits of Pulumi Java SDK

1. Type Safety - Compile-time checking of infrastructure definitions
2. IDE Support - Full code completion, refactoring, and debugging
3. Code Reuse - Leverage Java packages, classes, and inheritance
4. Testing - Comprehensive unit and integration testing capabilities
5. Familiar Tooling - Use Maven/Gradle, JUnit, and existing CI/CD pipelines
6. Multi-Cloud - Consistent experience across AWS, Azure, GCP, and Kubernetes

Conclusion

The Pulumi Java SDK brings infrastructure as code into the Java ecosystem with full type safety, IDE support, and modern software engineering practices. By using Java for infrastructure definition, teams can leverage their existing skills, tools, and patterns to manage cloud resources effectively.

Whether you're deploying simple S3 buckets or complex microservices architectures, Pulumi Java provides a robust, maintainable approach to infrastructure management that integrates seamlessly with your Java development workflow.

Call to Action: Start by converting a simple cloud resource (like an S3 bucket) to Pulumi Java. Experience the benefits of type safety and IDE support firsthand, then gradually expand to more complex infrastructure components. Your infrastructure code will become more maintainable, testable, and reliable.