Pulumi AWS IaC — fully cloud-native (all-managed) alternative

[ryanntannn]

A counterpart to the self-managed Pulumi stack on pulumi-eks-iac (PR #4). Where that variant keeps the data services self-managed (in-cluster Postgres, GHCR, nginx ingress, k8s Secrets; S3 the only managed app service), this stack flips every one of those to an AWS managed service. Lives entirely under infra/pulumi-cloud-native/, mirroring the self-managed project's structure.

Managed stack

Concern	Cloud-native choice
Kubernetes	EKS (KMS-encrypted etcd) + Karpenter node autoscaling (Fargate noted)
Database	Aurora PostgreSQL Serverless v2 — Multi-AZ, automated backups + PITR — replaces in-cluster Postgres; DATABASE_URL→writer endpoint
Object storage	S3 + SSE-KMS + versioning + lifecycle TTL
Registry	ECR (apiserver/operator/runner/portal/seed) — nodes pull via node role, no imagePullSecret
Ingress / LB / TLS / DNS	AWS Load Balancer Controller + ALB, ACM, Route53 + ExternalDNS
Secrets	Secrets Manager + External Secrets Operator (syncs synergyplus-env; DB creds + Better Auth secret in SM)
Observability	Amazon Managed Prometheus + Grafana + CloudWatch Container Insights + Fluent Bit
Email	SES (Better Auth)
Pod→AWS auth	IRSA for app pods + every platform controller (keyless)
Encryption	KMS keys for EKS etcd, S3, Aurora, Secrets Manager
Pod autoscaling	KEDA stays (no managed equivalent; HPA + CloudWatch-adapter noted)

app.ts wires the SynergyPlus manifests with: DATABASE_URL→Aurora (via External Secrets), images→ECR, ingress→ALB, secrets→Secrets Manager, no in-cluster Postgres.

Comparison vs self-managed (honest)

• Cost: self-managed cheaper (Aurora/AMP/AMG/ALB/Secrets Manager/NAT-per-AZ are a managed premium); cloud-native cost is usage-scaled opex.
• Ops burden: cloud-native far lighter — AWS owns DB HA/backups/PITR/patching, LB, cert renewal, metric/log storage, registry. The self-managed stack's single Postgres is its biggest liability.
• Vendor lock-in: higher here (Aurora/AMP/IRSA/Karpenter/ALB annotations are AWS-specific); self-managed is portable on-prem.
• Time-to-production: faster here — HA DB, TLS, DNS, secrets, metrics, logs are turn-key.
• Which when: prototype/on-prem/cost-sensitive/portability → self-managed; production HA now / small team / AWS-committed → cloud-native.

Notes

• Structure parity with the self-managed project: Pulumi.yaml, Pulumi.dev.yaml, package.json, tsconfig.json, index.ts, src/{config,network,cluster,database,storage,iam,registry,ingress,observability,secrets,app}.ts, plus the README.
• README contains the architecture diagram, the all-managed decision table, the side-by-side comparison, prerequisites, and a deploy runbook.
• npx tsc --noEmit is clean. pulumi up was not run (managed services cost money; no AWS creds/spend).
• No node_modules/ committed (.gitignore in place; verified git status).

🤖 Generated with Claude Code