diff --git a/pkgs/development/python-modules/pulumi-aws/default.nix b/pkgs/development/python-modules/pulumi-aws/default.nix
new file mode 100644
index 00000000000..1b6eed0d31a
--- /dev/null
+++ b/pkgs/development/python-modules/pulumi-aws/default.nix
@@ -0,0 +1,44 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, fetchpatch
+, pulumi
+, parver
+, semver
+, isPy27
+}:
+
+buildPythonPackage rec {
+  pname = "pulumi-aws";
+  # version is independant of pulumi's.
+  version = "5.3.0";
+  disabled = isPy27;
+
+  src = fetchFromGitHub {
+    owner = "pulumi";
+    repo = "pulumi-aws";
+    rev = "v${version}";
+    sha256 = "sha256-LrWiNYJeQQvXJDOxklRO86VSiaadvkOepQVPhh2BBkk=";
+  };
+
+  propagatedBuildInputs = [
+    pulumi
+    parver
+    semver
+  ];
+
+  postPatch = ''
+    cd sdk/python
+  '';
+
+  # checks require cloud resources
+  doCheck = false;
+  pythonImportsCheck = ["pulumi_aws"];
+
+  meta = with lib; {
+    description = "Pulumi python amazon web services provider";
+    homepage = "https://github.com/pulumi/pulumi-aws";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ costrouc ];
+  };
+}
diff --git a/pkgs/development/python-modules/pulumi/default.nix b/pkgs/development/python-modules/pulumi/default.nix
new file mode 100644
index 00000000000..e38157c6907
--- /dev/null
+++ b/pkgs/development/python-modules/pulumi/default.nix
@@ -0,0 +1,89 @@
+{ lib
+, buildPythonPackage
+, fetchpatch
+, fetchFromGitHub
+, protobuf
+, dill
+, grpcio
+, pulumi-bin
+, isPy27
+, semver
+, pyyaml
+, six
+
+
+# for tests
+, tox
+, go
+, pulumictl
+, bash
+, pylint
+, pytest
+, pytest-timeout
+, coverage
+, black
+, wheel
+, pytest-asyncio
+
+, mypy
+}:
+let
+  data = import ./data.nix {};
+in
+buildPythonPackage rec {
+  pname = "pulumi";
+  version = pulumi-bin.version;
+  disabled = isPy27;
+
+  src = fetchFromGitHub {
+    owner = "pulumi";
+    repo = "pulumi";
+    rev = "v${pulumi-bin.version}";
+    sha256 = "sha256-vqEZEHTpJV65a3leWwYhyi3dzAsN67BXOvk5hnTPeuI=";
+  };
+
+  propagatedBuildInputs = [
+    semver
+    protobuf
+    dill
+    grpcio
+    pyyaml
+    six
+  ];
+
+  checkInputs = [
+    pulumi-bin
+    pulumictl
+    mypy
+    bash
+    go
+    tox
+    pytest
+    pytest-timeout
+    coverage
+    pytest-asyncio
+    wheel
+    black
+  ];
+
+  pythonImportsCheck = ["pulumi"];
+
+  postPatch = ''
+    cp README.md sdk/python/lib
+    patchShebangs .
+    cd sdk/python/lib
+
+    substituteInPlace setup.py \
+      --replace "{VERSION}" "${version}"
+  '';
+
+  # disabled because tests try to fetch go packages from the net
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Modern Infrastructure as Code. Any cloud, any language";
+    homepage = "https://github.com/pulumi/pulumi";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ teto ];
+  };
+}
diff --git a/pkgs/tools/admin/pulumi/update-pulumi-shell.nix b/pkgs/tools/admin/pulumi/update-pulumi-shell.nix
new file mode 100644
index 00000000000..cf69e640550
--- /dev/null
+++ b/pkgs/tools/admin/pulumi/update-pulumi-shell.nix
@@ -0,0 +1,8 @@
+{ nixpkgs ? import ../../../.. { } }:
+with nixpkgs;
+mkShell {
+  packages = [
+    pkgs.gh
+  ];
+}
+
diff --git a/pkgs/tools/admin/pulumi/update.sh b/pkgs/tools/admin/pulumi/update.sh
index fadc64cf1df..1097759c3bd 100755
--- a/pkgs/tools/admin/pulumi/update.sh
+++ b/pkgs/tools/admin/pulumi/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p gh
+#!nix-shell update-pulumi-shell.nix -i bash
 # shellcheck shell=bash
 # Bash 3 compatible for Darwin
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index dd21231dfec..7262b18c944 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1105,6 +1105,10 @@ in {
 
   babelgladeextractor = callPackage ../development/python-modules/babelgladeextractor { };
 
+  pulumi = callPackage ../development/python-modules/pulumi { };
+
+  pulumi-aws = callPackage ../development/python-modules/pulumi-aws { };
+
   backcall = callPackage ../development/python-modules/backcall { };
 
   backoff = callPackage ../development/python-modules/backoff { };