Pulumi Cloud Service or Self-Managed State Backend for Concurrent Team Updates

Answer

Use Pulumi Cloud for predictable locking and built‑in access control; self‑managed backends lack deterministic lock errors and configurable retries, so Cloud’s lock guarantee generally outweighs self‑managed storage for teams with overlapping stack updates.

Likely explanation

Self‑managed storage (e.g., S3, GCS) delegates lock handling to the cloud provider and requires you to provision a separate lock table; Pulumi does not define a stable error contract for lock contention, so errors may be generic or absent.

Confirmed facts

• Pulumi Cloud returns a Pulumi AutomationError with a clear “LockConflict” message when a stale lock is detected.
• Self‑managed backends do not expose a deterministic error contract; lock conflicts may result in generic failures or hangs.
• Retry or backoff behavior for contested locks is not configurable outside Pulumi Cloud; the automation tool only retries transient network errors.
• Organization‑level IAM and fine‑grained access control are available only in Pulumi Cloud, limiting security controls on self‑managed backends.

Steps to verify for your team

1. Run `pulumi up` on two machines editing the same stack simultaneously.
2. Observe the error output: Cloud will show a clear LockConflict error, while self‑managed may hang or return a generic message.
3. Check the backend logs (e.g., Cloud audit logs or your S3/DynamoDB access logs) to confirm lock acquisition and conflict events.

Missing diagnostic detail

Do you require organization‑level IAM or fine‑grained access control beyond what Pulumi Cloud already provides?