IaC Benchmark: Pulumi 3.130 vs AWS CDK 3.0 for Deploying 100 Lambda Functions

// Pulumi 3.130 100 Lambda Deploy Stack
// Deploys 100 identical Node.js 20.x Lambdas with IAM roles and API Gateway endpoints
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
import * as awsx from "@pulumi/awsx";

// Configure stack settings
const config = new pulumi.Config();
const lambdaMemory = config.getNumber("lambdaMemory") || 128;
const lambdaRuntime = config.get("lambdaRuntime") || "nodejs20.x";
const stackName = pulumi.getStack();

// Create shared IAM role for all Lambdas
const lambdaRole = new aws.iam.Role("lambda-exec-role", {
    assumeRolePolicy: aws.iam.assumeRolePolicyForPrincipal({ service: "lambda.amazonaws.com" }),
});

// Attach basic execution policy to Lambda role
const lambdaPolicyAttachment = new aws.iam.RolePolicyAttachment("lambda-basic-exec", {
    role: lambdaRole.name,
    policyArn: "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
});

// Create API Gateway HTTP API for Lambda endpoints
const api = new awsx.apigatewayv2.HttpApi("lambda-api", {
    name: `${stackName}-100-lambda-api`,
    description: "API Gateway for 100 benchmark Lambdas",
});

// Array to hold all Lambda functions for batch operations
const lambdas: aws.lambda.Function[] = [];
const lambdaIntegrations: awsx.apigatewayv2.HttpApiIntegration[] = [];

// Deploy 100 identical Lambda functions
for (let i = 0; i < 100; i++) {
    try {
        // Lambda function code (inline for benchmark consistency)
        const lambdaFunc = new aws.lambda.Function(`benchmark-lambda-${i}`, {
            name: `${stackName}-benchmark-lambda-${i}`,
            runtime: lambdaRuntime,
            handler: "index.handler",
            memorySize: lambdaMemory,
            role: lambdaRole.arn,
            code: new pulumi.asset.AssetArchive({
                "index.js": new pulumi.asset.StringAsset(`
                    exports.handler = async (event) => {
                        return {
                            statusCode: 200,
                            body: JSON.stringify({ message: "Benchmark Lambda ${i} executed successfully" }),
                        };
                    };
                `),
            }),
            environment: {
                variables: {
                    LAMBDA_INDEX: i.toString(),
                    STACK_NAME: stackName,
                },
            },
            tags: {
                stack: stackName,
                benchmark: "100-lambda-pulumi",
                lambdaIndex: i.toString(),
            },
        });

        // Create API Gateway integration for each Lambda
        const integration = new awsx.apigatewayv2.HttpApiIntegration(`lambda-integration-${i}`, {
            api: api,
            integrationType: "AWS_PROXY",
            integrationUri: lambdaFunc.arn,
            payloadFormatVersion: "2.0",
        });

        // Add route for each Lambda: /lambda/{index}
        new awsx.apigatewayv2.HttpApiRoute(`lambda-route-${i}`, {
            api: api,
            routeKey: `GET /lambda/${i}`,
            integration: integration,
        });

        lambdas.push(lambdaFunc);
        lambdaIntegrations.push(integration);
    } catch (error) {
        pulumi.log.error(`Failed to deploy Lambda ${i}: ${error.message}`);
        throw error; // Fail stack deploy if any Lambda fails
    }
}

// Export stack outputs for verification
export const apiEndpoint = api.url;
export const lambdaCount = lambdas.length;
export const lambdaRoleArn = lambdaRole.arn;

// AWS CDK 3.0 100 Lambda Deploy Stack
// Deploys 100 identical Node.js 20.x Lambdas with IAM roles and API Gateway v2 endpoints
import * as cdk from "aws-cdk-lib";
import * as lambda from "aws-cdk-lib/aws-lambda";
import * as iam from "aws-cdk-lib/aws-iam";
import * as apigwv2 from "aws-cdk-lib/aws-apigatewayv2";
import * as integrations from "aws-cdk-lib/aws-apigatewayv2-integrations";
import { Construct } from "constructs";

export class HundredLambdaStack extends cdk.Stack {
    constructor(scope: Construct, id: string, props?: cdk.StackProps) {
        super(scope, id, props);

        // Stack configuration
        const lambdaMemory = 128;
        const lambdaRuntime = lambda.Runtime.NODEJS_20_X;
        const stackName = cdk.Stack.of(this).stackName;

        // Create shared IAM role for all Lambdas
        const lambdaRole = new iam.Role(this, "LambdaExecRole", {
            assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
            description: "Execution role for benchmark Lambdas",
        });

        // Attach basic execution policy to Lambda role
        lambdaRole.addManagedPolicy(
            iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
        );

        // Create API Gateway HTTP API
        const api = new apigwv2.HttpApi(this, "BenchmarkApi", {
            apiName: `${stackName}-100-lambda-api`,
            description: "API Gateway for 100 benchmark Lambdas",
            createDefaultStage: true,
        });

        // Array to hold Lambda functions for batch operations
        const lambdas: lambda.Function[] = [];

        // Deploy 100 identical Lambda functions
        for (let i = 0; i < 100; i++) {
            try {
                // Inline Lambda code for benchmark consistency
                const lambdaCode = `
                    exports.handler = async (event) => {
                        return {
                            statusCode: 200,
                            body: JSON.stringify({ message: "Benchmark Lambda ${i} executed successfully" }),
                        };
                    };
                `;

                // Create Lambda function
                const lambdaFunc = new lambda.Function(this, `BenchmarkLambda${i}`, {
                    functionName: `${stackName}-benchmark-lambda-${i}`,
                    runtime: lambdaRuntime,
                    handler: "index.handler",
                    memorySize: lambdaMemory,
                    role: lambdaRole,
                    code: lambda.Code.fromInline(lambdaCode),
                    environment: {
                        LAMBDA_INDEX: i.toString(),
                        STACK_NAME: stackName,
                    },
                    tags: {
                        stack: stackName,
                        benchmark: "100-lambda-cdk",
                        lambdaIndex: i.toString(),
                    },
                });

                // Create Lambda integration for API Gateway
                const lambdaIntegration = new integrations.HttpLambdaIntegration(
                    `LambdaIntegration${i}`,
                    lambdaFunc
                );

                // Add route for each Lambda: /lambda/{index}
                api.addRoutes({
                    path: `/lambda/${i}`,
                    methods: [apigwv2.HttpMethod.GET],
                    integration: lambdaIntegration,
                });

                lambdas.push(lambdaFunc);
            } catch (error) {
                cdk.Annotations.of(this).addError(`Failed to deploy Lambda ${i}: ${error.message}`);
                throw error; // Fail stack deploy if any Lambda fails
            }
        }

        // Stack outputs for verification
        new cdk.CfnOutput(this, "ApiEndpoint", {
            value: api.url!,
            description: "API Gateway endpoint URL",
        });
        new cdk.CfnOutput(this, "LambdaCount", {
            value: lambdas.length.toString(),
            description: "Number of deployed Lambda functions",
        });
        new cdk.CfnOutput(this, "LambdaRoleArn", {
            value: lambdaRole.roleArn,
            description: "ARN of the shared Lambda execution role",
        });
    }
}

// App initialization (required for CDK deploy)
const app = new cdk.App();
new HundredLambdaStack(app, "HundredLambdaStack");
app.synth();

# GitHub Actions CI/CD Pipeline: Pulumi vs CDK 100 Lambda Deploy Benchmark
# Runs parallel deploys for Pulumi 3.130 and AWS CDK 3.0, captures timing metrics
name: IaC Benchmark 100 Lambdas

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  schedule:
    - cron: "0 0 * * 0" # Weekly benchmark run

jobs:
  benchmark-pulumi:
    runs-on: ubuntu-latest
    name: Pulumi 3.130 Deploy Benchmark
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Setup Node.js 20.x
        uses: actions/setup-node@v4
        with:
          node-version: 20.x
          cache: "npm"

      - name: Install Pulumi CLI
        uses: pulumi/setup-pulumi@v2
        with:
          pulumi-version: 3.130.0

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Install Pulumi Dependencies
        working-directory: ./pulumi-100-lambda
        run: |
          set -e
          npm ci

      - name: Run Pulumi Deploy (10 iterations)
        working-directory: ./pulumi-100-lambda
        id: pulumi-deploy
        run: |
          set -e
          deploy_times=()
          for i in {1..10}; do
            echo "Starting Pulumi deploy iteration $i"
            start_time=$(date +%s%N)
            pulumi up --yes --stack dev --non-interactive 2>&1 | tee deploy-$i.log
            end_time=$(date +%s%N)
            duration=$(( ($end_time - $start_time) / 1000000 )) # Convert to ms
            deploy_times+=($duration)
            echo "Iteration $i duration: $duration ms"
            # Clean up between iterations to avoid state caching skew
            pulumi destroy --yes --stack dev --non-interactive
          done
          # Calculate median deploy time
          IFS=$'\n' sorted=($(sort -n <<<"${deploy_times[*]}"))
          unset IFS
          median=${sorted[4]} # 10 iterations, median is 5th element (0-indexed 4)
          echo "median_duration_ms=$median" >> $GITHUB_OUTPUT
          echo "Pulumi median deploy time: $median ms"

      - name: Upload Pulumi Deploy Logs
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: pulumi-deploy-logs
          path: ./pulumi-100-lambda/deploy-*.log

  benchmark-cdk:
    runs-on: ubuntu-latest
    name: AWS CDK 3.0 Deploy Benchmark
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Setup Node.js 20.x
        uses: actions/setup-node@v4
        with:
          node-version: 20.x
          cache: "npm"

      - name: Install AWS CDK CLI
        run: npm install -g aws-cdk@3.0.0

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Install CDK Dependencies
        working-directory: ./cdk-100-lambda
        run: |
          set -e
          npm ci

      - name: Run CDK Deploy (10 iterations)
        working-directory: ./cdk-100-lambda
        id: cdk-deploy
        run: |
          set -e
          deploy_times=()
          for i in {1..10}; do
            echo "Starting CDK deploy iteration $i"
            start_time=$(date +%s%N)
            cdk deploy --all --require-approval never 2>&1 | tee deploy-$i.log
            end_time=$(date +%s%N)
            duration=$(( ($end_time - $start_time) / 1000000 )) # Convert to ms
            deploy_times+=($duration)
            echo "Iteration $i duration: $duration ms"
            # Clean up between iterations
            cdk destroy --all --require-approval never
          done
          # Calculate median deploy time
          IFS=$'\n' sorted=($(sort -n <<<"${deploy_times[*]}"))
          unset IFS
          median=${sorted[4]}
          echo "median_duration_ms=$median" >> $GITHUB_OUTPUT
          echo "CDK median deploy time: $median ms"

      - name: Upload CDK Deploy Logs
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: cdk-deploy-logs
          path: ./cdk-100-lambda/deploy-*.log

  generate-report:
    runs-on: ubuntu-latest
    needs: [benchmark-pulumi, benchmark-cdk]
    name: Generate Benchmark Report
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Download Pulumi Logs
        uses: actions/download-artifact@v4
        with:
          name: pulumi-deploy-logs
          path: ./logs/pulumi

      - name: Download CDK Logs
        uses: actions/download-artifact@v4
        with:
          name: cdk-deploy-logs
          path: ./logs/cdk

      - name: Generate Markdown Report
        run: |
          set -e
          pulumi_median=${{ needs.benchmark-pulumi.outputs.median_duration_ms }}
          cdk_median=${{ needs.benchmark-cdk.outputs.median_duration_ms }}
          # Convert ms to minutes:seconds
          pulumi_min=$(( $pulumi_median / 60000 ))
          pulumi_sec=$(( ($pulumi_median % 60000) / 1000 ))
          cdk_min=$(( $cdk_median / 60000 ))
          cdk_sec=$(( ($cdk_median % 60000) / 1000 ))
          echo "## 100 Lambda Deploy Benchmark Results" > report.md
          echo "- Pulumi 3.130 median deploy time: ${pulumi_min}m ${pulumi_sec}s" >> report.md
          echo "- AWS CDK 3.0 median deploy time: ${cdk_min}m ${cdk_sec}s" >> report.md
          echo "- Speed difference: $(( $cdk_median / $pulumi_median ))x faster (Pulumi)" >> report.md

      - name: Upload Benchmark Report
        uses: actions/upload-artifact@v4
        with:
          name: benchmark-report
          path: report.md

// Pulumi Crossguard Policy: Enforce Lambda memory <= 256MB and required tags
import { PolicyPack, validateResourceOfType } from "@pulumi/policy";
import * as aws from "@pulumi/aws";

new PolicyPack("lambda-best-practices", {
    policies: [
        {
            name: "lambda-memory-limit",
            description: "Lambda functions must have memory size <= 256MB",
            validateResource: validateResourceOfType(aws.lambda.Function, (func, args, reportViolation) => {
                if (func.memorySize > 256) {
                    reportViolation(`Lambda ${args.name} has memory size ${func.memorySize}MB, max allowed is 256MB`);
                }
            }),
        },
        {
            name: "lambda-required-tags",
            description: "Lambda functions must have stack and benchmark tags",
            validateResource: validateResourceOfType(aws.lambda.Function, (func, args, reportViolation) => {
                const requiredTags = ["stack", "benchmark"];
                requiredTags.forEach(tag => {
                    if (!func.tags?.[tag]) {
                        reportViolation(`Lambda ${args.name} missing required tag: ${tag}`);
                    }
                });
            }),
        },
    ],
});

// CDK Stack Policy: Block manual updates to Lambda functions and IAM roles
const stackPolicy = {
    Statement: [
        {
            Effect: "Allow",
            Action: "Update:*",
            Principal: "*",
            Resource: "*",
            Condition: {
                StringEquals: {
                    "aws:CalledVia": "cloudformation.amazonaws.com",
                },
            },
        },
        {
            Effect: "Deny",
            Action: ["Update:*", "Delete:*"],
            Principal: "*",
            Resource: [
                "arn:aws:lambda:*:*:function:*-benchmark-lambda-*",
                "arn:aws:iam:*:*:role/*-lambda-exec-role",
            ],
            Condition: {
                Null: {
                    "aws:CalledVia": "false",
                },
            },
        },
    ],
};

// Apply stack policy to CDK stack
const app = new cdk.App();
new HundredLambdaStack(app, "HundredLambdaStack", {
    stackPolicy: stackPolicy,
});
app.synth();

// Pulumi incremental Lambda code update (no full stack deploy)
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const config = new pulumi.Config();
const lambdaIndex = config.requireNumber("lambdaIndex");
const stackName = pulumi.getStack();

// Retrieve existing Lambda function (no full stack deploy)
const existingLambda = aws.lambda.Function.get(
    `benchmark-lambda-${lambdaIndex}`,
    `${stackName}-benchmark-lambda-${lambdaIndex}`
);

// Update only the Lambda code
const updatedLambda = new aws.lambda.Function(`benchmark-lambda-${lambdaIndex}`, {
    ...existingLambda,
    code: new pulumi.asset.AssetArchive({
        "index.js": new pulumi.asset.StringAsset(`
            exports.handler = async (event) => {
                return {
                    statusCode: 200,
                    body: JSON.stringify({ message: "Updated Benchmark Lambda ${lambdaIndex}" }),
                };
            };
        `),
    }),
});

export const updatedLambdaArn = updatedLambda.arn;