OpenTofu — Community-Driven Open-Source Terraform Alternative

What it is

OpenTofu is the Linux Foundation fork of Terraform, created after HashiCorp changed Terraform's license from MPL-2.0 to BSL. OpenTofu maintains the MPL-2.0 open-source license and is a drop-in replacement for Terraform. It adds features like state encryption and provider-defined functions that Terraform does not offer.

This tool targets infrastructure engineers and platform teams who rely on Terraform but want to stay on a truly open-source tool with community governance.

How it saves time or tokens

OpenTofu is compatible with existing Terraform configurations, providers, and modules. Migration requires minimal effort: replace the terraform binary with tofu. State files are compatible. The added state encryption feature saves teams from building custom encryption wrappers. For AI-assisted infrastructure management, the same HCL knowledge applies.

How to use

1. Install OpenTofu via your package manager or download the binary.
2. Replace terraform commands with tofu commands.
3. Initialize your existing Terraform project with tofu init.
4. Plan and apply as usual.

# Install on macOS
brew install opentofu

# Install on Linux
curl -fsSL https://get.opentofu.org/install-opentofu.sh | sh

# Initialize a project (works with existing Terraform configs)
tofu init

# Plan changes
tofu plan

# Apply changes
tofu apply

# Enable state encryption
tofu init -backend-config='encrypt=true'

Example

An OpenTofu configuration with state encryption:

terraform {
  encryption {
    key_provider "pbkdf2" "main" {
      passphrase = var.state_passphrase
    }
    method "aes_gcm" "main" {
      keys = key_provider.pbkdf2.main
    }
    state {
      method   = method.aes_gcm.main
      enforced = true
    }
  }

  backend "s3" {
    bucket = "my-state-bucket"
    key    = "prod/terraform.tfstate"
    region = "us-east-1"
  }
}

resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t3.micro"
}

Related on TokRepo

• DevOps tools — Infrastructure as code tools
• Automation tools — Infrastructure automation

Common pitfalls

• Some Terraform providers may lag in OpenTofu compatibility. Check the OpenTofu registry for provider availability before migrating.
• State encryption adds a key management responsibility. Losing the encryption passphrase means losing access to your state file.
• CI/CD pipelines need to be updated to use the tofu binary instead of terraform. Environment variables and paths may need adjustment.
• OpenTofu and Terraform may diverge in features over time. Keep an eye on compatibility if you use both in different projects.
• Third-party tools that integrate with Terraform (like Terragrunt, Atlantis) may need updates for OpenTofu compatibility.
• Review the official documentation before deploying to production to ensure compatibility with your specific environment and requirements.