Setting up cloud infrastructure by clicking through the AWS or GCP console does not scale. Every server, every network rule, every database has to be created by hand. If a team needs to build the same setup again for a new environment, they have to click through everything again. This is slow and it leads to mistakes.
Infrastructure as Code solves this problem. Instead of clicking through a console, engineers write the infrastructure setup as a file. That file can be run to create the servers, networks, and databases automatically. It can also be run again to update them, or to build the exact same setup in a new region.
Terraform, OpenTofu, and Pulumi are the three most used tools for this today. Each one solves the same core problem, automating cloud infrastructure, but they work differently and are built for slightly different needs. This article explains what each tool does, how they are different, and how to pick the right one.
What Is Terraform?
Terraform is a tool that lets engineers describe cloud infrastructure using a simple configuration file, instead of clicking through a cloud console. Engineers write down what they want (a server, a database, a network) and Terraform creates it in the cloud.
Terraform uses its own language called HCL, short for HashiCorp Configuration Language. HCL is built only for describing infrastructure. It is easy to read, even for someone who has never written code before.
A basic Terraform file to create an AWS server looks like this:
| # This creates one virtual server on AWS resource "aws_instance" "web_server" { ami = "ami-0c55b15*****fe1f0" instance_type = "t2.micro" } |
When this file is run, Terraform talks to AWS and creates exactly that server. If the file is changed later, for example the server size is increased, Terraform figures out what needs to change and updates only that part.
Terraform keeps track of everything it has created in a file called the state file. This file is how Terraform knows what already exists in the cloud, so it does not try to create the same thing twice.
Terraform supports almost every cloud provider and SaaS tool that exists today. AWS, GCP, Azure, Kubernetes, Datadog, GitHub, and thousands of others all have a Terraform provider. This is one of the biggest reasons Terraform became the most used Infrastructure as Code tool over the last several years.
What Is OpenTofu?
OpenTofu is a tool that works almost exactly like Terraform. It uses the same HCL language, works with the same cloud providers, and reads the same kind of state file. For most day-to-day work, using OpenTofu feels identical to using Terraform.
OpenTofu exists because of a licensing change. In August 2023, HashiCorp changed Terraform's license from an open-source license (MPL) to a more restrictive license called BSL (Business Source License). Under BSL, companies are not allowed to use Terraform to build products that directly compete with HashiCorp's own commercial products.
A group of companies and open-source contributors did not want Terraform to move away from open source. They took the last fully open-source version of Terraform and built OpenTofu from it. OpenTofu is managed by the Linux Foundation, which means no single company controls it.
For most engineers, moving from Terraform to OpenTofu is simple. The command line tool name changes, but the configuration files usually work without any changes at all.
OpenTofu has also added a few features that Terraform did not have at the time, such as built-in encryption for state files. Development on OpenTofu is active and community driven.
What Is Pulumi?
Pulumi is also an Infrastructure as Code tool, but it works in a completely different way from Terraform and OpenTofu. Instead of writing infrastructure in a special configuration language like HCL, Pulumi lets engineers write infrastructure using a normal programming language: Python, TypeScript, Go, C#, or Java.
The same AWS server, written in Pulumi using Python, looks like this:
| # This creates one virtual server on AWS, written in Python import pulumi_aws as aws web_server = aws.ec2.Instance("web_server", ami="ami-0c55b******afe1f0", instance_type="t2.micro") |
Because Pulumi uses a real programming language, engineers can use normal programming features: loops, if conditions, functions, and classes. This makes it possible to build infrastructure that changes automatically based on real logic, something that is very hard to do in HCL.
Pulumi infrastructure code can also be tested using the same testing tools already used for application code, such as Jest for JavaScript or pytest for Python. This is one of the biggest reasons software engineering teams like Pulumi. Infrastructure gets tested the same way the rest of the application does.
Pulumi manages its own state, similar to Terraform. It can be stored in Pulumi's own managed service or in a private cloud storage bucket.
How Terraform and OpenTofu Are Different
Since OpenTofu was built from Terraform, the technical differences between them are small.
| Point | Terraform | OpenTofu |
|---|---|---|
| Who controls it | HashiCorp (now part of IBM) | Linux Foundation, community managed |
| License | BSL (Business Source License) | MPL (fully open source) |
| Language used | HCL | HCL (same language) |
| Provider support | Very large, over 3,000 providers | Same providers, uses the same registry format |
| State file encryption | Available through paid products | Built in, free |
| Migration effort from the other tool | N/A | Very low, mostly a command name change |
For a team that only cares about getting the job done, either tool works the same way. The real difference is who controls the tool and what license it uses. If a company has strict rules about using only fully open-source software, OpenTofu fits that requirement and Terraform does not.
How Terraform (or OpenTofu) and Pulumi Are Different
This comparison matters more than the Terraform vs OpenTofu one, because Pulumi works in a fundamentally different way.
| Point | Terraform / OpenTofu | Pulumi |
|---|---|---|
| Language used | HCL, a configuration language built only for infrastructure | A real programming language: Python, TypeScript, Go, C#, Java |
| Loops and conditions | Limited, built specifically for this purpose | Full support, same as normal programming |
| Testing | Basic built-in testing, still developing | Can use standard testing tools like pytest or Jest |
| Learning curve | Easier for someone with no coding background | Easier for someone who already codes |
| Provider ecosystem | Very large, native support | Slightly smaller, but can use Terraform providers through a bridge |
| Best fit | Teams that want simple, readable infrastructure files | Teams that want to write infrastructure like software |
HCL is built to describe infrastructure and nothing else. This keeps every file simple and predictable, and anyone on the team can read it, even without a programming background.
Pulumi removes that limit completely. Since it uses a real programming language, a team can build reusable infrastructure modules with real logic, write unit tests for their infrastructure, and use the same IDE features (autocomplete, error checking) they already use for application code. The tradeoff is that infrastructure code quality now depends on the team's software engineering skills, the same way application code quality does.
What Problem Each Tool Solves Best
Terraform
Terraform is the safest default choice for most teams. It has the largest community, the most tutorials, the most Stack Overflow answers, and support for almost every cloud service that exists. If a team is new to Infrastructure as Code, Terraform is the easiest tool to find help for.
OpenTofu
OpenTofu solves the problem of vendor control. If a company's policy does not allow using tools under a restrictive license, or if a company wants full control over the roadmap of the tools it depends on, OpenTofu removes that concern completely while keeping everything else about Terraform the same.
Pulumi
Pulumi solves the problem of infrastructure that needs real logic, or infrastructure that a software engineering team wants to test and build the same way they build applications. If a platform team is writing reusable infrastructure components that other teams will use, Pulumi's support for real functions and classes makes that much easier than HCL modules.
How to Choose the Right Tool
These three questions cover most decisions.
Question 1: Does the license matter to your company?
If there is a company policy about using only open-source tools, or concern about one company controlling a critical tool, OpenTofu is the answer. If there is no such policy, this question does not matter and either Terraform or OpenTofu works fine.
Question 2: Does the team want a configuration file or real code?
If the team wants infrastructure files that are simple to read, easy to review, and do not require a programming background, HCL (Terraform or OpenTofu) is the better fit. If the team already writes application code and wants infrastructure to work the same way, with tests, functions, and real logic, Pulumi is the better fit.
Question 3: If HCL is the answer, Terraform or OpenTofu?
If the answer to Question 1 was yes, use OpenTofu. If the team depends on HashiCorp-specific paid features like Terraform Stacks or Sentinel policies, stay on Terraform.
| Simple rule: New team, no strong preference, wants the easiest tool to get help with: Terraform. Care about license and open governance: OpenTofu. Software engineering team that wants infrastructure to behave like code: Pulumi. |
Frequently Asked Questions
Is OpenTofu a replacement for Terraform?
Yes. OpenTofu was built from the last open-source version of Terraform and works almost the same way. Most Terraform configuration files work in OpenTofu without changes.
Can Pulumi use Terraform providers?
Yes. Pulumi has a bridge that lets it use most Terraform providers, which covers a large part of the gap in native provider support.
Is Terraform still free to use?
Yes. Terraform itself is free to download and use. The BSL license only restricts companies from building a competing commercial product using Terraform's code. Normal usage to manage a company's own infrastructure is not affected.
Which tool is easiest for beginners?
Terraform and OpenTofu are usually easier for beginners because HCL is simpler than a full programming language. Pulumi is easier for someone who already knows Python, TypeScript, or another supported language.
Can a team switch from Terraform to Pulumi later?
Yes, but it takes real effort. Pulumi has a conversion tool that helps translate Terraform files into Pulumi code, but because the two tools work in fundamentally different ways, most teams end up rewriting a significant part of their infrastructure code rather than doing a simple find-and-replace.
