Infrastructure as Code (IaC) means describing cloud infrastructure in text files that live in a repository, go through review and are deployed by a tool rather than by hand. Choosing the tool is no longer purely technical: licensing, state storage, provider lock-in and whether the product is still being developed all matter.
Quick Overview
What you will learn:
- How Terraform works: state, state locking, plan and apply
- What the Terraform licence change means and where OpenTofu comes in
- How the cloud providers’ own tools differ
- How to match the approach to your team and the number of clouds you use
Who this article is for:
- DevOps engineers and platform teams
- Cloud architects and infrastructure team leads
- IT managers choosing an IaC standard for the organization
Reading time: 8 minutes
How Terraform Works: State, Plan and Apply
Terraform describes resources declaratively and deploys them in two steps. terraform plan shows what will be created, changed or destroyed, and terraform apply makes the changes. According to the documentation on developer.hashicorp.com, running a plan without the -out=FILE option produces a speculative plan: it is there for review, and you should check the final plan before applying because the infrastructure may have changed in the meantime. In a CI/CD pipeline you therefore save the plan to a file and apply exactly that file.
Everything hinges on the state file. Its main job is to record the bindings between objects in the cloud and the resources declared in your configuration. State can also hold sensitive values such as access keys, a point the OpenTofu documentation on state encryption makes explicitly. That is why teams keep it in a remote backend with access control.
The other key concept is state locking. If the backend supports it, Terraform takes a lock on every operation that could write state and stops if it cannot get one. The -lock=false flag turns locking off, but the documentation advises against it. terraform force-unlock is only meant for releasing your own lock when automatic unlocking failed; releasing someone else’s can leave several processes writing state at the same time. Not every backend supports locking, so check before you pick one.
The Terraform Licence and the OpenTofu Fork
According to the manifesto on opentofu.org, Terraform was released under the Mozilla Public License 2.0 from 2014 until HashiCorp switched it to the Business Source License (BUSL), which is not an open-source licence. Companies across the ecosystem responded by forking it as OpenTofu, maintained under the Linux Foundation. The project’s FAQ argues that the BUSL terms and the additional use grant are ambiguous for commercial use, while its initial reading is that non-commercial use is unrestricted.
You can check the fork’s standing on www.cncf.io: OpenTofu was accepted into the CNCF at the Sandbox level on 23 April 2025. Three practical points matter to teams:
- OpenTofu uses the same providers as Terraform and runs its own registry of modules and providers.
- According to the FAQ on
opentofu.org, it works with state files created by Terraform up to and including version 1.5.x, which matters when you migrate. - Commands map across, for example
tofu plan, and OpenTofu can encrypt state and plan files at rest, locally and in a remote backend.
In the author’s view, picking Terraform or OpenTofu is therefore mostly a legal and strategic decision rather than a matter of syntax. Your legal team should weigh the licence terms against how the company actually uses the tool.
Cloud Providers’ Own Tools
The other route is tooling a cloud provider builds for its own platform:
- AWS CloudFormation: templates and stacks deployed on AWS, which can be automated in a CI/CD pipeline (
aws.amazon.com). - Azure Bicep: a domain-specific language with declarative syntax that is more concise than the equivalent JSON ARM templates. According to
learn.microsoft.com, there are no state files to manage, because Azure stores the state. - Google Cloud: Deployment Manager reached end of support on 31 March 2026, and since 30 June 2026 new users can no longer enable it. It keeps running for existing customers until 30 June 2027, and new users are redirected to Infrastructure Manager, which deploys Terraform configurations (
cloud.google.com).
The Google case shows the catch with native tooling: the provider decides when a tool is retired, and the customer’s team does the migration.
Choosing an Approach
- A single cloud and a small team: a native tool makes it easy to start, and on Azure there is no state to look after.
- Several clouds, or services outside the cloud: Terraform or OpenTofu lets you describe resources from many providers in one language and one review process. The OpenTofu documentation describes exactly this: configurations that span multiple cloud providers and services.
- Licensing constraints and tight control over state: OpenTofu with state encryption, or Terraform once legal has reviewed the BUSL.
Whatever the tool, the split of roles looks much the same. The platform team owns the modules, the state backend and the plan, review, apply pipeline. Application teams consume the modules, and security reviews planned changes to critical resources.
Read Also
- Multi-Cloud Strategy: An Implementation Checklist: getting started with more than one cloud
- Cloud FinOps and Cost Control: what infrastructure defined in code ends up costing
- Cloud Identity and Access Management (IAM): permissions for IaC pipelines
Build Your Skills
Two trainings cover this topic: Terraform / OpenTofu: Infrastructure as Code and Advanced IaC: Terraform vs Pulumi vs AWS CDK. The first is a hands-on workshop from the basics to CI/CD, covering state management, modules and migrating to OpenTofu; the second is an advanced comparison of IaC tools. Get in touch to tailor the scope to your team.
Frequently Asked Questions (FAQ)
What Is Infrastructure as Code?
Infrastructure as Code (IaC) means describing servers, networks, databases and other resources in configuration files that you keep in a repository and deploy with a tool. Changes are reviewed like application code, and the same environment can be rebuilt as often as you need.
How Is OpenTofu Different From Terraform?
OpenTofu is a fork of Terraform created after Terraform moved from MPL 2.0 to the BUSL. It is maintained under the Linux Foundation and, since 2025, has been a CNCF Sandbox project (www.cncf.io). Both use the same providers and similar commands. They differ in licence, in features such as OpenTofu’s state encryption, and in who sets the project’s direction.
How Do You Manage Infrastructure Across Several Clouds?
Tools such as Terraform and OpenTofu let you describe resources from many providers in one configuration, with one review and deployment process. Split state by environment and by area, keep shared modules with the platform team, and keep a close eye on the identities and permissions your pipeline uses.
Where Should You Start Learning Terraform?
Start with the terraform plan and terraform apply cycle on a small test environment, then move on to remote state with locking, modules and running plans in a CI/CD pipeline. It is worth learning OpenTofu alongside, because the commands and concepts are shared and your company’s choice of tool may come down to licensing.