Does Terraform satisfy UK Cyber Essentials change management?

Yes — Cyber Essentials requires documented, tested, and approved changes to infrastructure. Terraform plan output is a change review document: it shows exactly what will be created, modified, or destroyed before apply. Pull request review of Terraform changes + terraform plan output satisfies Cyber Essentials change management evidence requirements.

Should I use Terraform Cloud or self-hosted state?

For most UK businesses: Terraform Cloud (free tier for small teams, £20/user/month Pro) is the simplest option for state management, run history, and team collaboration. Alternative: S3 bucket + DynamoDB for state locking (AWS eu-west-2 for UK data residency — Terraform state can contain sensitive data and should never be stored in US regions for UK GDPR compliance).

Terraform Vs Pulumi Vs Cdk Uk

Terraform vs Pulumi vs AWS CDK — Which Infrastructure as Code for UK Software? (2025)

Updated: June 20259 min read

🇬🇧 UK💷 GBP📊 Comparison🔒 UK GDPR⚖️ UK Law

Direct Answer

Terraform (with OpenTofu as the open-source fork) is the right default for most UK infrastructure projects: largest UK community, multi-cloud support (AWS + Azure in the same codebase), mature state management, and the widest support from UK managed service providers. Pulumi is better when your team strongly prefers writing infrastructure in TypeScript/Python rather than HCL. AWS CDK is better for AWS-only projects with strong TypeScript teams who want CDK L3 constructs. Infrastructure as Code choice affects how your team manages cloud infrastructure, collaboration, and UK Cyber Essentials change management evidence. Here is an honest UK market comparison.

Factor	Terraform (OpenTofu)	Pulumi	AWS CDK
Language	HCL (HashiCorp Config Language)	TypeScript, Python, Go, C#	TypeScript, Python, Java, C#
Multi-cloud support	✅ AWS + Azure + GCP in one codebase	✅ Multi-cloud	AWS only
UK Cyber Essentials change management	✅ Terraform plan = change review document	Pulumi preview = equivalent	CDK diff = equivalent
State management	Remote state (S3/Azure Blob)	Pulumi Cloud or self-hosted	AWS CloudFormation (managed)
UK developer community	✅ Largest	Medium	Medium (AWS-only)
Learning curve	HCL — 1–2 weeks to proficiency	Familiar language — faster for devs	TypeScript devs — fast
Drift detection	terraform plan detects drift	pulumi refresh detects drift	cdk diff detects drift
AWS-specific features	Good	Good	✅ Best — first-class CDK constructs
ClickMasters default	✅ All projects	TypeScript-heavy teams	AWS-only with CDK L3 constructs needed