Terraform Is an IBM Product With a Meter Now. Here Is What the IaC Landscape Looks Like

#devops #cloud #terraform #opensource

Try opening a state file written by OpenTofu with encryption turned on using Terraform 1.5.7. You get Unsupported state file format. That single error is a better description of where infrastructure as code sits in 2026 than any licensing debate, because the fork is no longer about which license you prefer. It is about a file one of your tools cannot read.

Two things happened that most teams only noticed on an invoice. HashiCorp archived the Cloud Development Kit for Terraform on 10 December 2025, read-only, with the recommendation to go back to HCL. Then on 31 March 2026 the legacy HCP Terraform free plan reached end of life and every organization still on it landed on resource metering, in a migration you cannot reverse.

The longer version of this comparison lives on DevToolLab, with every price sourced from the vendor's own page and the full ten-tool table. This is the short version.

Stop Treating It as One Choice

Three decisions hide inside "which IaC tool", and they are independent. The engine parses your config and calls cloud APIs. The runner executes it with credentials and leaves an audit trail. The state layer holds the mapping from config to real resource IDs, and decides whether that mapping is encrypted.

Most cost surprises come from conflating the first and third. You can run OpenTofu as the engine, GitHub Actions as the runner and an encrypted bucket as state, and pay nobody anything.

Terraform: Still the Default, Still Shipping

IBM closed its $6.4 billion HashiCorp acquisition on 27 February 2025, and Terraform has been under the Business Source License 1.1 since August 2023, with 1.5.7 the last MPL release. Feature work has not stalled. Version 1.14 introduced list resources in .tfquery.hcl files with a terraform query command that discovers unmanaged resources and writes import blocks for them. Version 1.15 arrived on 29 April 2026 with dynamic module sources and a deprecated marker for variables and outputs, and Stacks went generally available as a terraform stacks subcommand. Current stable is 1.15.8.

The part worth your attention if you use coding agents is the official Terraform MCP server, generally available since 13 June 2026 and open source. It exposes the registry and your workspaces over Model Context Protocol, which means an agent can read the real inputs of your private modules instead of guessing at resource arguments.

OpenTofu Went Somewhere Different

OpenTofu forked from Terraform 1.5, kept MPL 2.0, lives under the Linux Foundation and became a CNCF sandbox project on 23 April 2025. Harness, Gruntwork, Spacelift, env0 and Scalr committed nineteen full-time engineers for five years, which is why the pace held up rather than trailing off after the initial news cycle.

Early variable and locals evaluation shipped in 1.8, roughly twenty months ahead of Terraform's dynamic module sources. Version 1.11 brought ephemeral values that never touch state or plan files and an enabled meta-argument that retires the count = var.x ? 1 : 0 trick. Version 1.12.0, on 14 May 2026, added dynamic prevent_destroy, import by resource identity and destroy = false for removing a resource from state while leaving the real object alone.

State encryption is the feature with no counterpart. Configure it through an environment variable, so the passphrase stays out of your repository:

export TF_ENCRYPTION='key_provider "pbkdf2" "demo" {
  passphrase = "correct-horse-battery-staple-42"
}
method "aes_gcm" "secure" {
  keys = key_provider.pbkdf2.demo
}
state { method = method.aes_gcm.secure }'
tofu init && tofu apply -auto-approve

Applied against a config containing a random_password resource on OpenTofu 1.12.5, the resulting state file gives up nothing:

$ grep -c 'random_password' terraform.tfstate
0

The readable part of the file is a PBKDF2 header at 600,000 iterations. Everything else is ciphertext. Change the passphrase and the next command reports decryption failed for all provided methods.

Pulumi Bet on Agents

Pulumi is the choice for teams who want TypeScript, Python, Go or C# instead of HCL, and its 2026 pitch is agentic. Co-founder Joe Duffy said in May that language models now carry out more than 20 percent of deployments on the platform, up from effectively zero twelve months earlier, and expects that past 50 percent within the year. The same release added a Neo CLI, GitHub and Slack apps, scheduled agent tasks that arrive as pull requests, and a pulumi do command.

Billing is per resource per month: free for one user, $40 a month on Team covering up to 500 resources and then $0.1825 each, $400 a month on Enterprise. Neo tokens are $3 per million. The engine and CLI are Apache 2.0, so self-hosted state without Pulumi Cloud is a legitimate path.

Crossplane for Platform Teams

Crossplane reframes the problem: cloud resources become Kubernetes objects a controller reconciles continuously, so correcting drift is the default rather than a cron job. It graduated in CNCF on 28 October 2025, and v2 made composite and managed resources namespaced, dropped the claim indirection, and added Operations that run function pipelines for jobs like certificate rotation.

It earns its keep when other teams consume your platform through Kubernetes APIs. For one VPC and a handful of services, you have just adopted a control plane to operate.

Who Actually Holds Your State

This is the decision teams make by accident rather than on purpose. There are really only three options: a bucket you own with encryption turned on, a vendor's hosted state bundled into a platform plan, or a self-hosted backend like OpenTaco's that speaks the same protocol as the commercial ones so nothing downstream has to change if you move.

Two things are worth knowing before you pick. State holds credentials in plain text unless something encrypts it, which is the entire reason OpenTofu's TF_ENCRYPTION above is worth setting up on day one rather than after an incident. And encryption only goes one way between engines: once OpenTofu encrypts a state file, Terraform cannot read it, so decrypt before any trip back. If you want the fuller picture on where those credentials belong in the first place, DevToolLab's secrets management comparison covers Vault, OpenBao and the SaaS options this post does not.

The Free Runner Layer Is Good Now

Terragrunt reached 1.0 on 30 March 2026 with a backwards compatibility guarantee across CLI flags, HCL config and serialized output, which matters a lot for something wired into everyone's CI. MIT licensed, around 9,800 stars.

Atlantis is still the reference self-hosted pattern, posting plans to the pull request and applying on a comment so credentials never leave your infrastructure. Digger became OpenTaco in November 2025 and now ships a self-hosted state backend with access control, history and rollback behind an HCP Terraform compatible interface. An open source state backend speaking the commercial protocol is the sharpest answer yet to per-resource billing.

The Meters Are Not Comparable

HCP Terraform charges per managed resource per month: $0.10 on Essentials, $0.47 on Standard, $0.99 on Premium, free up to 500 resources with unlimited users and a surprisingly complete feature set including SSO and policy as code. Spacelift covers the most engines and keeps a two-user free tier, but its entry paid plan is now $20,000 a year on annual commitment. Scalr charges per run instead: 50 free monthly, then $0.99 each, with no per-user or per-resource fee. env0, trading as env zero, gives 250 runs and 30 environments free.

At 1,000 managed resources that works out to $100 a month on Essentials, $470 on Standard, roughly $131 on Pulumi Team, and $99 on Scalr at 100 runs regardless of resource count. Model your own estate before signing anything, because per-resource billing penalizes stable, well-factored infrastructure specifically. The full pricing table on DevToolLab lays all ten options side by side.

Migrating Takes About Fifteen Minutes

Back up state, install OpenTofu, then run tofu init in the unchanged directory. No edits are needed, because hashicorp/* provider addresses resolve through OpenTofu's registry. Run tofu plan and insist on an empty diff. On a project whose state was written by Terraform 1.5.7, OpenTofu reported found no differences, so no changes are needed. Enable state encryption before the next apply, swap the binary in CI, and audit any wrapper script that greps output, since the word "Terraform" becomes "OpenTofu". Plan the return trip too: encrypted state has to be decrypted first.

If you are picking today with nothing to migrate, OpenTofu plus GitHub Actions plus encrypted remote state is the sensible default. It is a superset of the Terraform you would otherwise learn, and there is no license review at the end of it. Two small things that help before you commit anything: the Subnet Calculator for working out CIDR ranges before they get hard-coded into a VPC module, and the Cron Expression Parser for sanity-checking a drift detection schedule that will run unattended.