Instead of Terraform: OpenTofu

Why OpenTofu is better

• Terraform moved to the Business Source License in August 2023. OpenTofu stays under the MPL, so there is no question about what counts as a competing use.
• Since 1.7 OpenTofu can encrypt state files client-side with keys from AWS KMS, GCP KMS, OpenBao or a passphrase.
• OpenTofu added provider for_each, an -exclude flag and early variable evaluation for module sources, which Terraform does not have.
• OpenTofu is a Linux Foundation project with a public RFC process, while Terraform belongs to IBM since its acquisition of HashiCorp in 2025.

When to keep Terraform

Keep Terraform if you use HCP Terraform or Terraform Enterprise, or depend on Terraform-only features added after the fork. It also stays the safer choice if a vendor support contract names Terraform.

Switching

For most configurations it is a drop-in. Back up state, install OpenTofu, run tofu init, then tofu plan and confirm it shows no changes. OpenTofu works with state files created by Terraform up to 1.5.x without conversion. Newer Terraform state may need the version-specific steps in the migration guide. Providers come from the OpenTofu registry, which mirrors the same providers.

Watch out

The two tools are diverging, so modules that use Terraform-only syntax will not run on OpenTofu, and the reverse. Some third-party tools and documentation still assume the terraform binary. HashiCorp sent OpenTofu a cease-and-desist over copied code in 2024, which OpenTofu denied.