OpenTofu

A coalition of infrastructure companies created OpenTofu under the Linux Foundation in 2023 after HashiCorp shifted Terraform to a commercial license. The project preserved HashiCorp Configuration Language syntax while returning development to an open-source model. Today, OpenTofu acts as a drop-in replacement that adds independent capabilities like native state encryption and early variable evaluation.

Why OpenTofu instead of Terraform Cloud

Running OpenTofu on local machines or internal CI/CD runners eliminates the network hops and queueing delays of Terraform Cloud. Speculative plans and applies query cloud APIs directly across private VPC endpoints and local peering connections rather than packaging configuration tarballs for remote SaaS workers. Execution concurrency is bounded only by your runner compute and cloud provider API quotas rather than hosted concurrency tiers, speeding up feedback loops during automated testing.

The operational trade-off centers on runner orchestration. Terraform Cloud provides managed worker infrastructure, hosted run histories, and a web console. OpenTofu shifts state locking to cloud backends like Amazon S3 or Google Cloud Storage, while audit logs stay inside your Git repository and pipeline logs. Migrating requires pointing state to private object storage and executing OpenTofu steps in your delivery pipeline, keeping existing HCL declarations and provider configurations intact.

What it does well

• Client-side state encryption protects sensitive attributes in state and plan files using AES-GCM or AES-CBC with AWS KMS, GCP KMS, Azure Key Vault, or passphrases before storage writes.
• Early variable evaluation allows passing variables and locals into module source arguments, provider blocks, and backend configurations.
• Direct S3 state locking uses Amazon S3 conditional writes, eliminating the cost and operational overhead of a dedicated DynamoDB lock table.
• Concurrent provider downloading fetches multiple plugin binaries in parallel during initialization and records multi-platform hashes in lock files.
• Dual output streams let engineers write machine-readable JSON to a file with -json-into while preserving colored terminal logs in standard output.
• Native module testing executes unit and integration tests with provider mocking and variable overrides through the built-in test framework.