Why OpenTofu 1.9 matters for teams choosing between Terraform and Pulumi

The OpenTofu 1.9 release introduced provider for_each, a feature that allows a single provider block to generate configurations for multiple regions or accounts without requiring copied blocks. This specific capability, alongside the -exclude flag, marks a clear functional divergence from Terraform that impacts how teams structure multi-cloud deployments. For organizations evaluating infrastructure as code tools in 2026, this version represents more than a minor update; it solidifies OpenTofu’s position as a distinct engine rather than a simple fork. The choice between OpenTofu, Terraform, and Pulumi now hinges on license governance, native security features, and the specific programming paradigms your team prefers. You already know the basics of HCL and state files, so the real question is which tool best fits your operational constraints and legal requirements.

License governance and security shifts

HashiCorp changed Terraform’s license from MPL 2.0 to BSL 1.1 in August 2023, restricting commercial use for competitors of IBM’s paid versions. OpenTofu remains under the OSI-approved MPL 2.0 license, governed by the Linux Foundation and accepted into the CNCF Sandbox in April 2025. This governance model ensures no single vendor can alter the terms unilaterally, providing stability for enterprises concerned about supply chain risks. While Terraform 1.17.1 released in October 2026, OpenTofu 1.13.2 shipped shortly after, maintaining a steady release cadence backed by a multi-vendor Technical Steering Committee. The security implications are equally significant, as OpenTofu 1.7 added native client-side encryption for state and plan files using AES-GCM. This feature protects sensitive data like database credentials before they reach remote backends, whereas Terraform relies on backend-side encryption such as S3 server-side encryption. Teams adopting OpenTofu gain a stronger security posture without integrating third-party key management systems, though they must manage their own state storage and locking mechanisms.

Pulumi offers a different approach by allowing infrastructure definitions in general-purpose languages like Python and TypeScript, which appeals to software engineering teams who prefer loops and complex logic over declarative HCL. However, Pulumi introduces dependencies on its own SDK and optional cloud services, creating a different type of lock-in compared to the binary-level compatibility of OpenTofu. For teams already invested in the Terraform ecosystem, migrating to OpenTofu is often a mechanical process involving a binary swap and CI/CD configuration updates. The shared HCL syntax and provider protocol mean existing modules work unchanged, provided you avoid Terraform-specific features like Stacks or Actions. Yet, once you adopt OpenTofu-only features such as state encryption or provider for_each, the migration path becomes one-way, making reversal difficult if you later decide to return to Terraform.

Migration realities and feature trade-offs

Migration from Terraform to OpenTofu requires backing up state files and running an empty plan to verify compatibility before applying changes. If the plan shows unexpected modifications, you must investigate potential conflicts with Terraform-only features or provider checksums in the .terraform.lock.hcl file. Most teams find this process straightforward, but those relying on HCP Terraform features like Stacks or Sentinel policies face significant hurdles because these proprietary components do not translate to OpenTofu. The decision to switch should be made per project, especially when some workflows depend on commercial HashiCorp services while others prioritize open-source governance. OpenTofu 1.9’s provider for_each simplifies multi-account setups, reducing code duplication and improving maintainability for large-scale environments. In contrast, Pulumi excels at reusing programming language libraries, which can streamline testing and complex infrastructure logic for polyglot teams.

The negative reality is that OpenTofu lacks a unified managed platform comparable to HCP Terraform, forcing teams to rely on third-party orchestration tools or self-managed CI pipelines. This adds operational overhead for organizations that prefer a single vendor for both the engine and the control plane. Additionally, GPG key signing support for non-mainstream providers remains a work in progress, causing minor warnings in logs that some teams find distracting. These friction points are manageable but require awareness during adoption. Whether your team prioritizes the safety of an open-source license or the convenience of a hosted commercial platform, the answer depends on your specific risk tolerance and architectural needs. There is no universal winner, only the tool that aligns with your current stack and future goals.