Migrate to OpenTofu — The Open Source Terraform Fork

In August 2023, HashiCorp changed Terraform's license from MPL 2.0 (permissive open source) to the Business Source License (BSL). The BSL restricts using Terraform in products or services that compete with HashiCorp. For most end-users, this does not matter. But for managed service providers, consultancies that offer Terraform as a service, and companies that embed Terraform in their products, the license change creates legal risk.

OpenTofu forked Terraform at version 1.5.7 (the last MPL-licensed version) and is maintained by the Linux Foundation. It is 100% compatible with existing Terraform code, state files, and providers. The migration is mechanical — update the binary name, update CI/CD references, and verify. No code changes required in most cases.

Beyond licensing, OpenTofu has begun adding features that Terraform lacks, including client-side state encryption (encrypting state before it reaches the backend, not just at rest), early variable evaluation, and a more open contribution process. The feature divergence is still small, but it is growing.

The migration is straightforward but requires careful execution to avoid disrupting your infrastructure management workflow.

Compatibility check: We scan your codebase for features that might differ between Terraform and OpenTofu. As of OpenTofu 1.7, compatibility with Terraform 1.5.x is near-complete. We verify every provider you use has a corresponding OpenTofu registry entry and test tofu init against your codebase to catch any issues early.

Binary swap: We replace the terraform binary with tofu in your CI/CD pipeline, developer machines (via version managers like tenv or mise), and any automation scripts. State files are compatible — no migration needed. The remote backend (S3, GCS, Azure) works identically.

CI/CD update: We update your pipeline to use the OpenTofu GitHub Action or the tofu CLI directly. Plan comments, apply workflows, and security scanning all work the same way. We verify the full pipeline end-to-end in a staging environment before cutting over production.

Validation: We run tofu plan against every root module and verify zero changes — confirming that OpenTofu reads your existing state and code identically to Terraform. This is the acceptance criterion for the migration.

A complete migration from Terraform to OpenTofu:

• License compliance — your IaC toolchain under a permissive open-source license
• Zero-disruption migration — no code changes, no state migration, no infrastructure modifications
• Updated CI/CD — pipeline configured for OpenTofu with all existing functionality preserved
• Developer tooling — version manager setup for tofu binary on all team machines
• Compatibility report — documentation of any feature differences relevant to your codebase
• Client-side state encryption — optional setup of OpenTofu's unique state encryption feature
• Validation report — tofu plan output for every root module confirming zero-change compatibility