Infrastructure as Code Explained: Terraform and OpenTofu

Infrastructure as Code (IaC) lets you define servers, databases, networks, and cloud services using configuration files instead of manual clicks. Terraform has been the dominant IaC tool for years. In 2023, OpenTofu emerged as an open-source fork. This article explains both tools, compares their features, and helps you choose the right one.

What Is Infrastructure as Code?

Traditional infrastructure management means logging into cloud consoles and clicking buttons to create servers, databases, and networks. IaC replaces this with configuration files:

resource "aws_s3_bucket" "data" {
  bucket = "my-app-data"

  tags = {
    Environment = "production"
    ManagedBy   = "opentofu"
  }
}

One file creates the bucket, sets tags, and tracks it in state. Version control, code review, and automated deployment — all built in.

Key IaC benefits:

• Reproducibility — Create identical environments every time
• Version control — Track infrastructure changes in Git
• Code review — Review infrastructure changes like code
• Automation — Deploy with CI/CD pipelines
• Documentation — Config files are living documentation

Terraform: The Original

Created by HashiCorp in 2014, Terraform uses HCL (HashiCorp Configuration Language) to define infrastructure across 3,000+ providers. It introduced the concept of declarative infrastructure — you describe what you want, and Terraform figures out how to create it.

Current status (August 2026):

• Version: 1.15.8 (stable), 1.17.0-alpha (preview)
• License: BSL 1.1 (Business Source License) — changed from MPL 2.0 in August 2023
• Maintained by: HashiCorp (IBM)
• Managed offering: Terraform Cloud, Terraform Enterprise

OpenTofu: The Open-Source Fork

In September 2023, the Linux Foundation forked Terraform 1.5.5 (the last MPL-licensed version) into OpenTofu. It maintains full compatibility with Terraform's HCL syntax and providers while adding new features.

Current status (August 2026):

• Version: 1.12.6 (stable)
• License: MPL 2.0 (OSI-approved open source)
• Maintained by: Linux Foundation
• Registry: registry.opentofu.org (mirrors Terraform providers)

OpenTofu has added features not yet available in Terraform:

• Native state encryption — Encrypt state files with pbkdf2 or PKCS#11 keys
• Dynamic prevent_destroy — Use variables in lifecycle blocks
• Provider-defined functions — Extend HCL with provider-specific functions
• Simultaneous output formats — Human-readable + machine-readable at once

Head-to-Head Comparison

The Licensing Question

The license difference is the primary reason OpenTofu exists:

Most organizations are unaffected by the BSL change — the restriction primarily targets competitors building commercial IaC products. However, the shift away from OSI-approved open source drove many teams to evaluate OpenTofu.

Same HCL, Different Binary

The most important thing to understand: the configuration files are the same. Both tools read identical .tf files.

# This file works with BOTH terraform AND tofu

terraform {
  required_version = ">= 1.5.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t3.micro"

  tags = {
    Name = "web-server"
  }
}

The CLI commands are identical except for the binary name:

# Terraform
terraform init
terraform plan
terraform apply

# OpenTofu — same commands, different binary
tofu init
tofu plan
tofu apply

State Management

State files track which resources exist and their current configuration. Both tools use JSON state files, but OpenTofu adds native encryption:

# OpenTofu native state encryption (not in Terraform)
terraform {
  encryption {
    key_provider "pbkdf2" "my_key" {
      passphrase = var.encryption_passphrase
    }
    state {
      method = method.aes_gcm.my_key
    }
  }
}

With Terraform, state encryption requires configuring it at the backend level (e.g., S3 bucket encryption). OpenTofu encrypts the state file itself — an additional layer of protection.

When to Choose Terraform

• Existing Terraform Cloud/Enterprise setup — Switching has real migration costs
• No licensing concerns — Internal use is allowed under BSL
• IBM/HashiCorp vendor support required — Enterprise contracts
• Team already trained on Terraform — No learning curve
• Need managed Terraform Cloud features — State locking, run triggers, policy as code

When to Choose OpenTofu

• OSI-approved open source required — MPL 2.0 meets the definition
• Building a commercial product — BSL restricts competitors
• Need native state encryption — Not available in Terraform
• Community governance preferred — Linux Foundation oversight
• Migrating from Terraform 1.5.x — Drop-in replacement
• Want faster feature releases — OpenTofu ships features Terraform hasn't yet

Migration: Terraform to OpenTofu

Migrating is straightforward because the HCL files are identical:

1. Back up state: cp terraform.tfstate opentofu.tfstate
2. Install OpenTofu: brew install opentofu or snap install opentofu
3. Update scripts: Replace terraform with tofu in all commands
4. Update CI/CD: Change workflow YAML to use tofu
5. Run init: tofu init (reads existing .tf files)
6. Verify plan: tofu plan (should match terraform plan)
7. Apply: tofu apply (migrates state format if needed)

Other IaC Tools

Terraform and OpenTofu are not the only options:

Try It Yourself — BestWordz Tools

Practice infrastructure configuration with these BestWordz tools:

• JSON Formatter — Validate Terraform/OpenTofu state files
• CIDR Subnet Calculator — Calculate VPC subnets for IaC configs
• URL Encoder/Decoder — Handle encoded values in configurations

Related BestWordz Articles

• Docker vs Virtual Machines — Containers as IaC components
• Docker Security for Developers — Secure container infrastructure
• Secrets Management for Developers — Managing secrets in IaC
• Production Python CI Pipeline — CI/CD for IaC workflows
• GitHub Actions CI/CD Pipeline — Automate IaC deployments
• API Authentication Methods Compared — Secure cloud API access
• Local Python Docker Workspace — Development infrastructure

Decision Checklist

Summary

Terraform and OpenTofu are functionally equivalent for most use cases. They share the same HCL syntax, the same providers, and the same state format. The differences are:

• License: Terraform uses BSL 1.1; OpenTofu uses MPL 2.0
• State encryption: OpenTofu has native support; Terraform relies on backend encryption
• Governance: Terraform is controlled by HashiCorp/IBM; OpenTofu by the Linux Foundation
• Features: OpenTofu has shipped features (state encryption, dynamic lifecycle) not yet in Terraform

For most teams, the choice comes down to licensing philosophy. If open-source matters, OpenTofu is the answer. If you're already invested in Terraform Cloud, staying with Terraform is reasonable.

Further Reading

• OpenTofu Documentation
• Terraform Documentation
• OpenTofu 1.12 Release Notes
• HashiCorp License FAQ
• What's New in OpenTofu

Information current as of August 29, 2026. Terraform 1.15.8 and OpenTofu 1.12.6 verified from official sources.