How to migrate from Terraform to OpenTofu open-source tooling

HashiCorp changed the Terraform license to BSL 1.1 in August 2023. This change restricts commercial use for products that compete with HashiCorp. OpenTofu provides a fully open-source alternative under the MPL 2.0 license. The Linux Foundation governs OpenTofu, whereas IBM manages Terraform after the 2025 acquisition of HashiCorp. The OpenTofu initiative started when a coalition of companies, including Spacelift, Gruntwork, and Scalr, forked Terraform 1.5.6. This group released a manifesto on August 15, 2023, which gathered 35,000 GitHub stars. The project joined the CNCF at Sandbox maturity in April 2025. Teams migrating from Terraform 1.5.x to OpenTofu should install OpenTofu 1.6.2 first to ensure compatibility before moving to the latest 1.12.0 release.

Technical workflows and features

The replacement of the Terraform binary with the OpenTofu binary constitutes the primary technical step for most teams. Both tools use the same HCL syntax and state file format, so most existing configurations work without modification. Users run tofu init to download modules and providers directly from the OpenTofu Registry. The OpenTofu 1.12.0 release, which arrived in May 2026, provides dynamic prevent_destroy arguments and improved provider checksum handling using both zh: and h1: hashes for all platforms and configurations. OpenTofu also ships client-side state encryption, which version 1.7 introduced to fix a long-standing security issue. Version 1.9 added provider for_each to allow easier multi-region deployments, while version 1.10 added OCI registry support and native S3 state locking. Version 1.11 added ephemeral values and ephemeral resources. However, OpenTofu removed WinRM support in the 1.13 series, so users must migrate to OpenSSH for Windows.

Follow these steps to manage the transition:

1. Back up the existing state file.
2. Install the OpenTofu CLI.
3. Run tofu init in the configuration directory.
4. Run tofu plan to verify the execution plan.
5. Run tofu apply to update the state file.
6. Replace terraform with tofu in CI/CD pipelines.

Choosing your path

Decision makers evaluate whether they need the managed services in HCP Terraform or the community-driven roadmap of OpenTofu. OpenTofu provides native state encryption, whereas Terraform relies on backend-level encryption like S3 server-side encryption. Teams requiring an OSI-approved license often select OpenTofu to avoid the ambiguity of the BSL. The project maintains a faster release cadence for features like early variable evaluation and OCI registry support. You should evaluate your organization’s compliance needs before committing to a specific tool.

Organizations with strict regulatory requirements like HIPAA or SOC 2 find OpenTofu’s native state encryption helpful for simplifying security. Companies that rely on HashiCorp-specific features like Stacks or Sentinel must choose between remaining on Terraform or adopting OPA or Terragrunt. The decision often hinges on whether the team requires commercial support from IBM or vendor neutrality from the Linux Foundation. Will the community continue to outpace HashiCorp’s commercial roadmap? The verdict remains that OpenTofu is the lower-risk default for teams prioritizing license flexibility and community control.