diff --git a/content/docs/esc/vs/_index.md b/content/docs/esc/vs/_index.md new file mode 100644 index 000000000000..9fbe25697d41 --- /dev/null +++ b/content/docs/esc/vs/_index.md @@ -0,0 +1,22 @@ +--- +title_tag: "Pulumi ESC Compared to Alternatives" +meta_desc: Learn how Pulumi ESC compares with alternative Environments, Secrets, and Configurations solutions. +title: Compare to... +h1: Compare Pulumi ESC to other solutions +meta_image: /images/docs/meta-images/docs-meta.png +menu: + pulumiesc: + weight: 7 + identifier: esc-vs +aliases: +--- + +Pulumi ESC is centralized environments, secrets, and configuration manager for cloud applications and infrastructure. It provides the ability to create environments which are collections of secrets and configuration that can be versioned, branched, and composed inside other collections. ESC supports pulling and centralizing the management of secrets from 1Password, AWS OIDC, AWS Secrets Manager, Azure OIDC, Azure Key Vault, Google Cloud OIDC, Google Cloud Secrets Manager, Pulumi stacks, Vault OIDC, and Vault. + +There are many tools that overlap with Pulumi ESC's capabilities. Many +of these are complementary and can be used together, whereas some are "either or" decisions. + +Here are several useful comparisons that will help you understand Pulumi's place in the cloud tooling ecosystem: + +* [HashiCorp Vault](/docs/esc/vs/vault/) +* [Infisical](/docs/esc/vs/infisical/) diff --git a/content/docs/esc/vs/infisical.md b/content/docs/esc/vs/infisical.md new file mode 100644 index 000000000000..ec193747515b --- /dev/null +++ b/content/docs/esc/vs/infisical.md @@ -0,0 +1,173 @@ +--- +title_tag: "Pulumi ESC vs Infisical" +meta_desc: Learn about the major differences between Pulumi ESC and Infisical. +title: Pulumi ESC vs Infisical +h1: Pulumi ESC vs Infisical +meta_image: /images/docs/meta-images/docs-meta.png +menu: + pulumiesc: + identifier: infisical + parent: esc-vs + weight: 2 +aliases: +--- + + + +Choosing the right [secrets management](/what-is/what-is-secrets-management/) tool is important, and we want you to have as much information as possible to make the choice that best suits your needs. We’ve created this document to help you understand how Pulumi ESC compares with Infisical. + +## What is Infisical? + +Infisical is a secrets management tool that provides a centralized platform for managing and controlling access to secrets. It supports dynamic secret generation, encryption as a service, and comprehensive access policies. + +## Pulumi ESC vs. Infisical: Similarities {#similarities} + +Like Infisical, Pulumi ESC is a secrets manager for cloud applications and infrastructure. In both ESC and Infisical, secrets can be stored and accessed through a CLI, SDK, or Web editor interface. Granular access controls can be implemented across all secrets. + +## Pulumi ESC vs. Infisical: Key Differences {#differences} + +There are a couple of fundamental differences between Infisical and Pulumi ESC. First, ESC and Infisical differ in that Infisical can only add and manage secrets stored in Infisical. ESC adopts an open ecosystem approach, allowing you to pull secrets stored in most secrets and password managers during runtime and use them anywhere. This allows teams to use the best secrets management solution according their purposes and needs. Second, Infisical lacks the composability and hierarchical nature of ESC, which increases getting started speed and duplication of secrets. Third, ESC takes a software engineering approach to versioning with ability to add tags and import specific collections of secrets and configuration via those tags, similar to Docker. Fourth, ESC takes a more secure limited privilege path to provisioning dynamic short-term credentials as compared to Infisical. + +Here's a detailed comparison of the two: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
FeaturePulumi ESCInfisical
Architecture
OSS LicenseYes, Apache License 2.0Yes, MIT expat license
Document StoreYesNo
Key-value StoreYesYes
Open EcosystemYes, supports pulling and using secrets from multiple sources including HashiCorp Vault, 1Password, AWS Secrets Manager, etc.No, can only store and manage secrets stored in Infisical
Developer Experience
Editing and AuthoringYes, supports both GUI and powerful Document Editor with autocomplete, docs hover, and error checkingLimited, has GUI editor without YAML support
CLIYes, available as esc CLI or pulumi CLIYes
Client SDKsYesYes
Declarative ProviderYes, support via the Pulumi Service Provider, which allows management (create, update, delete) of collections of secrets and configuration as a resource through infrastructure as code.No
ComposabilityYes, simple set up of hierarchical environments that inherit values from imported environmentsNo, can only reference singular secrets from other environments and references have to be duplicated in multiple environments
VersioningYes, entire environments can be versioned and tagged and imported based on the specific version tags or revision numbersLimited
Immutable History & Point in Time RecoveryYesYes
Values Can Be of Type Secret and PlaintextYesNo, values can only be secrets
Interpolate Values from Other ValuesYes, new dynamic values can be constructed through string interpolationNo
Branching / Personal ConfigsYes, environments can be forked for testing without rewriting entire environments and overriding specific valuesLimited, requires careful copying since secrets need to be downloaded in plaintext locally and then uploaded
Compare Secrets across EnvironmentsNoYes
In-built FunctionsYes, support for functions like toJSON, fromJSON, fromBase64, toString allows data manipulation for any scenarioNo
Security and Compliance
Audit LogsYesYes
Encrypted Secrets StorageYes, TLS is used for encryption in transit and unique encryption keys per environment are employed for encryption at restYes
Access ControlsYesYes
Secure Dynamic Cloud Provider CredentialsYes, uses OIDC flows to generate dynamic credentials. Available for AWS, Azure, and Google Cloud.No, less secure as it requires access keys for highly privileged root accounts
OIDC TrustYes, trust relationships are established with third-party OIDC providersNo
Secure Environment VariablesYes, the esc run CLI command can be used to specify which secrets are available as environment variablesNo, all values are available as environment variables
Plaintext Read Only ModeYes, ESC offers a read mode that allows reading only plaintext values while not being able to decrypt secrets or access dynamic credentialsNo
+ +{{< get-started-esc >}} diff --git a/content/docs/esc/vs/vault.md b/content/docs/esc/vs/vault.md new file mode 100644 index 000000000000..a75bb52316e5 --- /dev/null +++ b/content/docs/esc/vs/vault.md @@ -0,0 +1,174 @@ +--- +title_tag: "Pulumi ESC vs HashiCorp Vault" +meta_desc: Learn about the major differences between Pulumi ESC and HashiCorp Vault. +title: Pulumi ESC vs HashiCorp Vault +h1: Pulumi ESC vs HashiCorp Vault +meta_image: /images/docs/meta-images/docs-meta.png +menu: + pulumiesc: + identifier: vault + parent: esc-vs + weight: 1 +aliases: +--- + + + +Choosing the right [secrets management](/what-is/what-is-secrets-management/) tool is important, and we want you to have as much information as possible to make the choice that best suits your needs. We’ve created this document to help you understand how Pulumi ESC compares with HashiCorp Vault, and how ESC and Vault can be used together. + +## What is HashiCorp Vault? + +HashiCorp Vault is a secrets management tool that provides a centralized platform for managing and controlling access to secrets. It supports dynamic secret generation, encryption as a service, and comprehensive access policies. + +## Pulumi ESC vs. Vault: Similarities {#similarities} + +Like Vault, Pulumi ESC is a secrets manager for cloud applications and infrastructure. In both ESC and Vault, secrets can be stored and accessed through a CLI, SDK, or editor interface. Granular access controls can be implemented across all secrets. + +## Pulumi ESC vs. Vault: Key Differences {#differences} + +There are a couple of fundamental differences between Vault and Pulumi ESC. First, ESC and Vault differ in that Vault is not open source, using the Business Source License model. In contrast, ESC is fully open source and Apache 2.0 licensed. Second, Vault only stores secrets, whereas ESC stores environments, secrets, and configurations. Third, ESC provides composability of collections of secrets and configuration. Environments can be composed together from multiple other environments, enabling easy inheritance of shared configuration. + +## Pulumi ESC and Vault: Better Together + +While there are differences and similarities between Pulumi ESC and Vault, they can actually be used together for a more powerful experience to store and manage infrastructure and application secrets. ESC environments can reference secrets stored in Vault. Through ESC, secrets in Vault can be organized as collections of secrets that can be versioned, branched, and composed inside other collections. With ESC, non-secret configuration can be stored alongside secrets in Vault. ESC enhances Vault, and they work better together. + +Here is a summary of the key differences between Pulumi ESC and HashiCorp Vault: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
FeaturePulumi ESCVault
Architecture
OSS LicenseYes, Apache License 2.0No, Business Source License 1.1
Hosting/managementFully-managed SaaS service provided by Pulumi CloudOffers hosted cloud service and self-hosting, which requires significant management overhead
Key-value StoreYesYes
Open EcosystemYes, supports pulling and using secrets from multiple sources including HashiCorp Vault, 1Password, AWS Secrets Manager, etc.No, can only store and manage secrets store in Vault
Developer Experience
Editing and AuthoringYes, supports both GUI and powerful Document Editor with autocomplete, docs hover, and error checkingLimited, has a JSON editor
CLIYes, available as esc CLI or pulumi CLI. Supports injecting application secrets as environment variables and modifying secrets.Limited, has a CLI but lacks the capabilities of injecting secrets as environment variables. The CLI is for modifying secrets only.
Client SDKsYesYes
Declarative ProviderYes, support via the Pulumi Service Provider, which allows management (create, update, delete) of collections of secrets and configuration as a resource through infrastructure as code.No
ComposabilityYes, simple set up of hierarchical environments that inherit values from imported environmentsNo, users have to create the structure themselves
VersioningYes, entire environments can be versioned and tagged and imported based on the specific version tags or revision numbersLimited, secrets are individually versioned
Values Can Be of Type Secret and PlaintextYesNo, values can only be secrets
Ability to See Existing SecretsYesNo
Secret ReferencingYes, environments can import secrets from another environment. Secrets updated from the referenced environment will automatically propagate to downstream environmentsNo
Interpolate Values from Other ValuesYes, new dynamic values can be constructed through string interpolationNo
Branching / Personal ConfigsYes, environments can be forked for testing without rewriting entire environments and overriding specific valuesNo
Compare Secrets across EnvironmentNoNo
In-built FunctionsYes, support for functions like toJSON, fromJSON, fromBase64, toString allows data manipulation for any scenarioNo
Security and Compliance
Audit LogsYesYes
Encrypted Secrets StorageYes, TLS is used for encryption in transit and unique encryption keys per environment are employed for encryption at rest.Yes, Vault uses a security barrier for all requests made to the backend. The security barrier automatically encrypts all data leaving Vault using a 256-bit Advanced Encryption Standard (AES) cipher in the Galois Counter Mode (GCM) with 96-bit nonces.
Access ControlsYesYes
Secure Dynamic Cloud Provider CredentialsYes, uses OIDC flows to generate dynamic credentials. Available for AWS, Azure, and Google Cloud.Limited, requires the usage of root account keys. Only available for AWS.
OIDC ProviderYes, Pulumi Cloud can be used as an OIDC provider from the Pulumi SDK, CLI, UI, and pulumi-service provider.Limited, configuring Vault as an OIDC provider is only available from the CLI
+ +{{< get-started-esc >}} diff --git a/layouts/shortcodes/get-started-esc.html b/layouts/shortcodes/get-started-esc.html new file mode 100644 index 000000000000..f2a9ef1a4f48 --- /dev/null +++ b/layouts/shortcodes/get-started-esc.html @@ -0,0 +1,33 @@ +
+
+
+

Get Started with Pulumi

+

{{ "Use Pulumi ESC to easily centralize and manage environments, secrets, and configurations. Follow our [Get Started guide](/docs/esc/get-started/) for ESC to begin. If you want to use Vault or any other secrets manager with ESC, follow the below guides to import secrets from existing secrets managers into ESC environments." | markdownify }}

+
+
+ +
+
+
+ + AWS + +
+
+ + Azure + +
+
+ + Google Cloud + +
+
+ + Vault + +
+
+
+
diff --git a/static/logos/tech/vault-2.png b/static/logos/tech/vault-2.png new file mode 100644 index 000000000000..e8eaa97686a4 Binary files /dev/null and b/static/logos/tech/vault-2.png differ