Introduction to OpenTofu

If you've used Terraform, you already know how to use OpenTofu. It reads the same configuration files, uses the same providers and works with the same state. The command is tofu instead of terraform. The difference isn't technical. It's who owns it.

How a fork happened

Terraform was open source under the Mozilla Public License from its launch in 2014. Over nine years it became the default way to describe cloud infrastructure as code, with thousands of providers and modules written by the community, and a lot of commercial products built around it.

On August 10, 2023, HashiCorp moved Terraform and its other products to the Business Source License. The BSL lets you read and use the code but forbids using it in a product that competes with HashiCorp. What counts as "competing" was HashiCorp's to decide. Companies whose businesses were built on Terraform suddenly had a legal question hanging over them, and so did their customers.

The response was fast. Within days, a group of companies published the OpenTF manifesto, asking HashiCorp to reverse course. When it didn't, they forked the last MPL-licensed version. The fork was renamed OpenTofu and joined the Linux Foundation in September 2023. Its first stable release, 1.6, shipped in January 2024. It's backed by companies including Gruntwork, Spacelift, env0, Harness and Scalr, with several of them paying engineers to work on it full time.

What it is, if you're new to this

Infrastructure as code means describing your servers, networks, DNS records, databases and permissions in text files instead of clicking through web consoles. OpenTofu then makes reality match the files.

resource "aws_instance" "web" {
  ami           = "ami-0abcdef1234567890"
  instance_type = "t3.small"
  tags          = { Name = "web-1" }
}

The workflow is three commands:

  • tofu init downloads the providers your configuration needs. Providers are plugins for each platform: AWS, Azure, Google Cloud, Cloudflare, Kubernetes, Proxmox and thousands more.
  • tofu plan compares your files with what actually exists and shows exactly what it would create, change or destroy.
  • tofu apply does it.

OpenTofu keeps a state file recording what it manages, so it knows what to change next time. Your infrastructure is now reviewable in pull requests, reproducible in a new region and documented by the code itself. That's the real benefit. Nobody has to remember which checkbox someone clicked three years ago.

What it does that Terraform doesn't

For its first release, OpenTofu was a drop-in replacement and nothing more. With 1.7, released in April, it started to diverge in useful ways:

  • State encryption. The state file often contains secrets: database passwords, private keys, access tokens. OpenTofu can now encrypt it on the client side before it's stored, with keys from a passphrase, AWS KMS, Google Cloud KMS or OpenBao. Terraform has no equivalent. It relies on the storage backend's encryption.
  • Provider-defined functions and loopable import blocks, for less repetitive code.

The project also runs its own provider and module registry, so you don't depend on HashiCorp's.

There was a brief legal scuffle along the way. In April HashiCorp sent OpenTofu a cease-and-desist letter claiming one feature had been copied from BSL code. OpenTofu showed the code in question came from MPL-licensed Terraform, and most observers who looked at the evidence agreed. Nothing came of it.

Should you switch?

If you're starting fresh, start with OpenTofu. It's open source, governed by a neutral foundation, and compatible with everything you'll find in tutorials.

If you're on Terraform 1.5 or older, switching is mostly mechanical:

  1. Install tofu from your package manager or the project's releases.
  2. Back up your state.
  3. Run tofu init in your project, then tofu plan. You should see no changes.
  4. Update your CI pipelines to call tofu.

If you're on Terraform 1.6 or newer, check the migration guide for your version first. A few features differ.

If you pay HashiCorp for Terraform Cloud or Enterprise and you're happy, there's no emergency. But you should know that your infrastructure code now runs on a tool with a license one company controls, and that company just agreed to be bought.

IBM enters

That's the other reason this matters now. In April IBM announced it would buy HashiCorp for about $6.4 billion. IBM also owns Red Hat, which spent last year restricting access to RHEL source code. Whatever IBM does with Terraform, the decision will be IBM's.

OpenTofu is insurance against that. A project hosted by the Linux Foundation, under an open source license, with several companies contributing, can't be relicensed by anyone. If you build your infrastructure on it, nobody can change the terms underneath you.

Since then

Added October 2026. IBM completed the HashiCorp acquisition in February 2025. OpenTofu kept shipping, adding features like early variable evaluation and for_each on provider blocks, and in April 2025 it was accepted into the Cloud Native Computing Foundation as a sandbox project.