OpenTofu Terraform Alternative

OpenTofu is an open-source fork of Terraform created after HashiCorp changed Terraform licensing to BSL. It maintains full compatibility with Terraform configurations while remaining under the Linux Foundation with a truly open-source license. This guide covers migrating to OpenTofu and using its unique features.

Installation

# Install OpenTofu
curl --proto "=https" --tlsv1.2 -fsSL https://get.opentofu.org/install-opentofu.sh -o install-opentofu.sh
chmod +x install-opentofu.sh
./install-opentofu.sh --install-method deb

# Or with Homebrew
brew install opentofu

# Verify
tofu version

Migration from Terraform

# OpenTofu is a drop-in replacement for Terraform 1.6
# Step 1: Replace terraform binary with tofu
alias terraform=tofu

# Step 2: Initialize (uses same .terraform directory)
tofu init

# Step 3: Plan (should show no changes if state is compatible)
tofu plan

# State format is compatible — no migration needed
# Provider registry is compatible — same providers work
# HCL syntax is identical — no code changes needed

OpenTofu-Specific Features

# State encryption (OpenTofu exclusive)
# Encrypt state file at rest
terraform {
  encryption {
    key_provider "pbkdf2" "main" {
      passphrase = var.state_passphrase
    }
    method "aes_gcm" "main" {
      keys = key_provider.pbkdf2.main
    }
    state {
      method   = method.aes_gcm.main
      enforced = true
    }
  }
}

# Early variable/locals evaluation
# OpenTofu allows variables in backend and provider blocks
terraform {
  backend "s3" {
    bucket = var.state_bucket  # Not possible in Terraform
    key    = var.state_key
    region = var.aws_region
  }
}

Provider Registry

# OpenTofu uses its own registry at registry.opentofu.org
# Falls back to Terraform registry for compatibility
# Most providers work without changes

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

CI/CD Integration

# GitHub Actions with OpenTofu
name: Infrastructure
on: [push]
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: opentofu/setup-opentofu@v1
      - run: tofu init
      - run: tofu plan -out=plan.tfplan
      - run: tofu apply plan.tfplan
        if: github.ref == 'refs/heads/main'

Summary

OpenTofu provides a fully open-source alternative to Terraform with compatible syntax, state format, and provider ecosystem. Migration is straightforward — replace the binary and run init. OpenTofu adds features like state encryption and early variable evaluation that Terraform lacks. For organizations concerned about vendor lock-in or licensing restrictions, OpenTofu is the safest path forward for infrastructure as code.