I love Pulumi, but I can't in good conscience hand it to a group of developers when I know at least one of them will want to be extremely clever and abuse the fact that it runs real code to do cursed things that will make the code not just not idempotent (i.e. picking the most recent secret from somewhere, or a new AMI), but anti-idempotent (it doesn't run the second time around, it does things to the filesystem, it provisions things outside of the pulumi ecosystem).

Much easier to hand them Terraform and reject anything with local-exec provisioner, the official worst piece of terraform.