Make the Switch to OpenTofu

It’s been almost exactly a year since OpenTofu went GA. We’d like to step back and take a look at why we got here, how it’s going and what Gruntwork recommends going forward for people still using Terraform.

When Terraform was king

Since shortly after HashiCorp launched Terraform in July 2014, Terraform became the undisputed king of Infrastructure as Code (IaC).

It’s not hard to imagine why:

1. It was an open source alternative to many proprietary offerings from other vendors.
2. It was platform agnostic, supporting many different cloud providers.
3. Cloud providers could maintain their own provider plugins to integrate with Terraform, and most of them open sourced their provider plugins to promote rapid iteration and collaboration with the community.
4. It offered a human-readable, declarative syntax for defining infrastructure, with tooling to see what would change before doing anything potentially destructive (plans).

Then in August 2023 Hashicorp changed the license from the open source MPL v2 to a closed source BSL v1.1 — changing their minds after 9 years, making Terraform no longer open source. Suddenly, they’d gone from using a standard license that was clear, objective, and static to one that was vague, subjective, and dynamic, depending on whether HashiCorp interpreted what you were doing as competing with them.

The Rise of OpenTofu

In January of 2024, OpenTofu took up the mantle of preserving that promise of open collaboration with the IaC community, with the launch of OpenTofu 1.6 as generally available, and over the last year, they’ve been excelling in their stewardship of the project. They’ve maintained backwards compatibility with Terraform and collaborated with the community to introduce long awaited features to take IaC to the next level.

As founding members of the OpenTofu project, and active members of the steering committee, our perspective is biased. Nevertheless, we’d like to make the case that you should seriously consider making the switch to OpenTofu as soon as possible.

Adoption by industry leaders

We, at Gruntwork, regularly talk directly to customers that have migrated to OpenTofu from Terraform, but you don’t have to take our word for it that there’s wide industry adoption.

Basically any organization that provided services integrated with Terraform (other than HashiCorp) will recommend using OpenTofu over Terraform. That includes organizations directly supporting OpenTofu like Gruntwork, Spacelift, Env0, Harness and Scalr, but you can also find organizations like Oracle, JFrog and GitLab publicly discussing moving away from Terraform to OpenTofu.

OpenTofu was launched by The Linux Foundation, which is one of, if not the largest incubator and host of open source projects (including Linux and CNCF, which hosts Kubernetes).

Assurances for the future

If being part of The Linux Foundation doesn’t give you enough confidence that OpenTofu will remain open source forever, consider that in addition to being MPL v2 licensed, it also does not require a Contribution License Agreement (CLA) for contributions, unlike Terraform. This means that members of the community do not surrender their copyright when submitting contributions, and any re-license would legally require their consent, or a complete rewrite of their contributions.

There is no reason to believe that HashiCorp wouldn’t re-license Terraform again, and OpenTofu has intentionally made it exceedingly difficult to be anything other than open source forever.

Terraform already has features that you cannot use without being a paid HashiCorp customer. A prime example of this is Terraform Stacks, which are explicitly an HCP Terraform product. HashiCorp as an entity has sole legal authority over how Terraform can be used, what features require paying HashiCorp to adopt, and what services are permitted to integrate with it. Those conditions can change at any time.

Meanwhile, OpenTofu has zero incentive to make it any more expensive to use the product now, and into the future. You can also integrate it with a vibrant ecosystem of open source products like Terragrunt to get many of those same features for free (See Terragrunt Stacks for more information).

OpenTofu is a better product

OpenTofu has a very different relationship with the community than Terraform does. Popular requests are prioritized, and long-standing requests for Terraform features were addressed promptly by the OpenTofu core team soon after general availability.

In the past year, while maintaining backwards compatibility, OpenTofu has added the following community-requested features that are not currently available in Terraform (and may never be):

• State Encryption
• Provider iteration (for_each on providers)
• Resource exclusion (-exclude flag)
• Early variable evaluation

Top issues are publicly tracked and reported on, and an open community call takes place weekly to keep the community informed and provide a space to any feedback.

Governed by the community

OpenTofu is governed by a steering committee with members comprised of members from the founding organizations dedicated to the success of OpenTofu for all members of the community. No one vendor controls the fate of OpenTofu, and no company can unilaterally decide to change how it works because it’s in the financial interest of their organization.

In-fact, the steering committee is made up of organizations that directly compete with each other. OpenTofu was founded by organizations that joined forces to steward OpenTofu as a collective because IaC has become fundamental to how countless organizations manage their business-critical infrastructure. Over the past decade, it has become a bedrock utility for managing infrastructure, and you should have confidence in the governance of that utility now and into the future.

Parity with Terraform

To be clear, Terraform is a great product. With the exception of no longer being open source, all of those reasons mentioned above for why Terraform was an industry leader still hold true.

OpenTofu isn’t a ground-up rewrite of Terraform, however. When HashiCorp re-licensed Terraform to a closed source license, the consortium of companies that back OpenTofu did what you’re supposed to do in the open source world after a rug pull: They forked open source Terraform.

With the initial release of OpenTofu v1.6, OpenTofu released a drop-in replacement for Terraform, derived from the exact same open source origin in Terraform v1.5. Over the last year, they’ve also had a great track record for re-implementing every new widely adopted Terraform feature to keep the migration from Terraform trivial.

Every customer we have worked with that has engaged in a migration from Terraform to OpenTofu has done so successfully, and without incident.

Compatibility with Terraform providers

OpenTofu compatibility with Terraform providers isn’t just as good compared to the compatibility of the OpenTofu/Terraform binaries — it’s* better.* Every major Terraform provider (including AWS, GCP, Azure, Cloudflare, etc.) is built from the exact same codebase that OpenTofu providers are built from.

Shortly after the license change, HashiCorp decided to update the Terms of Service of the Terraform registry to disallow usage outside of Terraform. The provider registry is really just an index of binaries compiled from open source code hosted on GitHub, so OpenTofu only needed to build their own index (completed before GA, with generous support from Cloudflare for hosting) to provide their own registry.

You can search through that registry at search.opentofu.org, and if you want to search across OpenTofu and Terraform registries, Scalr hosts their own search portal at library.tf.

Every major provider is still open source, and every provider OpenTofu hosts is compiled from identical source code. As a result, there is zero change in behavior for how providers behave between OpenTofu and Terraform. You are either using the exact same binary hosted in GitHub, or a binary compiled from the same source in the case of providers hosted by HashiCorp.

Make the switch

It costs you nothing to try it out, and you may be surprised by how simple the process is to adopt OpenTofu. For a small migration now, you can save yourself a lifetime of uncertainty about the stability of one of the most important pieces of tooling in your infrastructure tool belt and take advantage of a slew of new time-saving and security-improving capabilities.

The migration process is well documented, and depending on the scale of your infrastructure, you can probably get it done in less than a day.

If you’re feeling nervous about the switch, Gruntwork is one of several companies providing OpenTofu Enterprise and Migration Support, so you don’t need to make the switch on your own.

Thanks to Eben Eliason, Josh Padnick, Tin Nguyen and Zach Goldberg for their support on this blog post.