# Share a Pulumi Preview — The Diff, Reviewable, at a URL

Canonical: https://commareports.com/share-pulumi-preview
Published: 2026-09-14

> A pulumi preview is the most important thing in the pipeline and it lives in a log. Render it to HTML, publish to Comma, and get line-anchored approval on the resources that change.

# Share a Pulumi preview

`pulumi preview` is the single highest-stakes document in an infrastructure
pipeline. It is the difference between a deploy and an outage, it is read once,
and it is read in a CI log — scrolled past in a fold, in a monospace column, by
whoever happened to trigger the pipeline.

The `~ update` line that replaces a database is three lines down from four
hundred lines of unchanged resources, and the person who would recognise it as
dangerous is not the person looking.

## Render it to HTML

The preview's colour is information — green create, yellow update, red replace
— so keep it:

```bash
pulumi preview --diff --color=always --stack prod \
  | ansi2html --scheme=xterm > preview.html
```

`ansi2html` (from `colorized-logs`, or `pip install ansi2html`) converts the
escape sequences into styled HTML rather than throwing them away.

For something more structured, `pulumi preview --json` emits the plan as data —
every step with its `op`, `urn` and the diff of changed properties — which you
can render into a table that puts replaces at the top, where they belong.

## Publish it

Drop `preview.html` into [Comma](https://commareports.com/), or from the
pipeline:

```bash
pulumi preview --diff --color=always | ansi2html > preview.html

curl -fsS -X POST "https://commareports.com/api/v1/reports" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html preview.html \
        --arg t "Preview — prod — PR #$PR_NUMBER" '{title: $t, html: $html}')"
```

POST rather than PATCH here: a preview belongs to a proposed change, so a new
report per PR is the right shape, and the URL goes into the PR as the thing
being approved. See the [API reference](/docs/api) and
[publishing from CI](/docs/ci).

## Approval that points at a resource

The reason infrastructure review is weak is that approval is granted on a pull
request diff of _code_, while the risk lives in the _plan_ — and the plan is
not in the PR. `+ 12 resources` in a YAML diff does not tell you one of them
replaces a stateful volume.

Publishing the preview and commenting on it moves the approval onto the plan:

- "This `replace` on `aws:rds/instance:Instance` will drop the data. Use
  `deleteBeforeReplace: false` and rename." — anchored on the resource.
- "Approved, but run it after 20:00 UTC." — on the report, with a timestamp.

See [commenting on HTML](/comment-on-html) and
[sign-off on a report](/docs/sharing).

## Keep it restricted

A preview names account ids, region, resource URNs and sometimes ARNs and
endpoint hostnames. Access is per report — private, team, or anyone signed in
at your domain. Use one of those, never link-anyone.

## Limits

- **Entry HTML: 5 MB.** A very large stack's full `--diff` output can exceed
  that — preview per project or per stack, which is also how it is reviewed.
- Assets: 25 MB per file, **250 MB and 500 files total**.
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision
history.

**[Publish a preview →](https://commareports.com/)**

### Related

- [Share a Terraform plan](/share-terraform-plan) · [Share a CDK diff](/share-cdk-diff)
- [Share an Infracost report](/share-infracost-report) · [Share a Checkov report](/share-checkov-report)
- [Share an Ansible report](/share-ansible-report) · [Publishing from CI](/docs/ci)