{TRY.map(([text, href]) => {text} →)}
}- the best answer in the row + {hasBest && the best answer in the row} ✗ doesn't do it {READ_ON && Sources read {READ_ON}.}
@@ -75,13 +68,13 @@ const host = (u) => (u.startsWith('/') ? 'intentius.io' : new URL(u).hostname.re {a.rows.map((r) => (Tick what you need.
Tick what you need. These are terragucci's features; what it lacks is under The basics.
Infrastructure consulting
-Source becomes the platform's own spec, settled before anything runs.
A change reaches production as one reviewable diff and stays accountable.
Truth stays live, adoption stays in place, and the artifact is verified.
Synthesis
- -chant Fold to native spec, no run
-choudoufu Declarative HCL, as upstream; the real plan reads the cloud, and needs no state file to do it
- - - -CDK Synthesizes a reviewable native template (CloudFormation, or K8s via cdk8s), and a context lookup can shift the output when the program runs
-Pulumi Runs the program through its own engine; no static declarative spec, only an engine preview or plan
-Terraform / OpenTofu Declarative, but the real plan needs cloud and state
-chant Type and fold diagnostics at the keystroke, human and agent alike
-choudoufu live-check lints and resolves every identity with no cloud call, credential or state, on any OpenTofu configuration; the real check is still plan
- - - -CDK TS types check, but infra correctness needs a synth and a plan
-Pulumi TS types check, but infra correctness needs a preview
-Terraform / OpenTofu validate is shallow; the real check is plan
-The parts a machine can't infer belong in writing. Read the full property →
-chant Typed lexicons, semantic lint, and policy checks
-choudoufu Thin types, as upstream; every limit is a named lint rule with its reasoning and a fixture, and ownership policy is declared in the estate file; broader policy is still OPA or Sentinel
- - - -CDK L2 constructs and cdk-nag encode a lot of validity, and deeper policy is an add-on
-Pulumi Types encode structure, and policy comes from CrossGuard
-Terraform / OpenTofu Thin types; policy via OPA or Sentinel
-Ops & Lifecycle
- -Every change arrives as a diff, in one place. Read the full property →
-chant Every change is one typed change set against live
-choudoufu plan and apply; an approved plan file is re-planned against live and refused by name if it no longer matches
- - - -CDK Deploy through cdk deploy
-Pulumi Deploy through pulumi up
-Terraform / OpenTofu plan and apply
-chant By reference, never held, with keyless signing
-choudoufu Credentials are your own IAM, scoped per estate or per address on tags every create carries, and revoked by detaching a policy; strict secrets = refuse holds no generated secret at all and can be pinned from outside the configuration. The default keeps what a state file keeps
- - - -CDK Refs and IAM, but the program can read secrets at runtime
-Pulumi ESC gives references with short-lived OIDC, but core stores secrets encrypted in state
-Terraform / OpenTofu Refs, but the state file can capture secrets; OpenTofu encrypts state at rest
-One mistake can't take down everything. Read the full property →
-chant Owned-only by marker, a per-environment removal cap, and a blast-radius graph view
-choudoufu Every resource carries its estate as a tag, so an IAM Deny on anything outside the estate holds below the tool, wherever AWS honours the condition
- - - -CDK Stack and IAM boundaries, but refs can widen reach
-Pulumi Stack and IAM boundaries, but refs can widen reach
-Terraform / OpenTofu Module boundaries, but shared state couples them
-chant Reversible runs ungated; a destructive one is gated with saga rollback
-choudoufu No rollback; a change that would abandon or duplicate an object refuses by default and proceeds only by name, but a plain destroy is not held apart from a reversible change, as upstream
- - - -CDK CloudFormation auto-rollback and cdk rollback recover a failed deploy, though an irreversible change is not gated
-Pulumi No auto-rollback; you re-apply a prior state
-Terraform / OpenTofu No rollback; you re-apply a prior state by hand
-The newcomer executes, and a human owns the call that matters. Read the full property →
-chant A durable approval gate that survives a crash
-choudoufu The approved plan file is the approval: the apply re-plans against live and refuses, with its own exit status, if anything moved since review. The pipelines generated for GitHub, GitLab and Forgejo stop both writing Ops at a gate that is a fact in git
- - - -CDK Approval in the CI pipeline, not the tool
-Pulumi Approval via Pulumi Deployments, a Cloud add-on
-Terraform / OpenTofu Apply confirmation is built-in; role-separated approval needs HCP, a paid add-on
-Every change traces to who made it and who approved it. Read the full property →
-chant An append-only release ledger, with approval in the workflow history
-choudoufu Every change is an API call under a scoped role, ownership moves included, so the cloud's own audit log names who did what with no ledger edit beside it; the plan file and the approval it landed under are in git
- - - -CDK CloudTrail or pipeline logs, outside the tool
-Pulumi Pulumi Cloud records who applied by default; the approver needs Deployments, an add-on
-Terraform / OpenTofu State history or CI logs, outside the tool
-chant By-reference makes rotation an out-of-band routine change
-choudoufu Under strict secrets = refuse no secret is ever held, so rotating a credential is an out-of-band change the source never sees; a generated secret kept under the default is one record, deleted to regenerate, never state surgery
- - - -CDK Runtime reads or state can pin the value
-Pulumi ESC helps, but core state can pin the value
-Terraform / OpenTofu A state-captured secret needs state surgery
-Truth & trust
- -Truth lives in the running system, never a separate store you host. Read the full property →
-chant Truth left in the live system, with no state store
-choudoufu Ownership is two tags on the resource itself, and the state file is a cache you are allowed to lose; values with no cloud twin go in a small record store
- - - -CDK No tool-side state copy: cdk8s emits stateless manifests you can GitOps, and AWS CDK's stack state is CloudFormation's own record of what AWS runs, not a copy the tool keeps
-Pulumi Keeps its own authoritative state, whatever the backend
-Terraform / OpenTofu The state file is the authority5
-chant Imports a template or live estate; the spec stays native
-choudoufu A stock OpenTofu estate migrates by stamping markers from the state it already has, and a live resource matching a block is adopted by writing two tags; the HCL stays as it was
- - - -CDK cdk import, then rewrite as code
-Pulumi pulumi import, then rewrite as code
-Terraform / OpenTofu Config-driven import blocks preview the import; you still author the HCL
-The tool touches only what you declare and deletes only what it owns. Read the full property →
-chant Selective by omission; deletes gated on an ownership marker
-choudoufu A resource carrying no marker is kept, and a delete is gated on the estate's own marker; the ownership policy sets what happens in each case
- - - -CDK Stack-scoped, but absence in the template deletes
-Pulumi Stack-scoped, but absence in the program deletes
-Terraform / OpenTofu Omission deletes by default; removed and prevent_destroy are opt-in guards, not the design
-A deployable proves itself before it ships, verified where it is built. Read the full property →
-chant SBOM, provenance, and a signature built at synthesis, verified at the deploy gate
-choudoufu The plan file is admitted before apply only if it still matches the live system, failing closed with its own exit status; it carries no provenance or signature, as upstream
- - - -CDK Provenance via CI add-ons like cosign or SLSA
-Pulumi Provenance via CI add-ons like cosign or SLSA
-Terraform / OpenTofu Provenance via CI add-ons
-Read down a column and what emerges is a division of labor rather than a ranking. CDK synthesizes a native template, reviewable but produced by running; Pulumi applies through its own engine with no native artifact to keep. Terraform and OpenTofu operate through a state file, and their real check is a cloud plan that lands after the commit. choudoufu is OpenTofu with the state file's one authoritative job, ownership, moved onto the resources as tags. The truth band clears, your own IAM scopes and bounds every run, the plan file is an approval the apply enforces against live, and the cloud's audit log is complete because there is no ledger to edit beside it. Synthesis stays where upstream is.
-chant reaches every row because it folds source to the native spec by construction, then carries that same change set through approval, rollback, and a record, with no authoritative state store to keep. It got there first, and nothing here is chant's to keep.
-