OpenTofu vs Terraform in 2024: Migration Guide and Key Differences

In August 2023, HashiCorp changed Terraform's license from the open-source Mozilla Public License to the Business Source License (BSL). This restricts commercial use of Terraform in competing products and has significant implications for organizations that have built internal tooling or platforms on top of Terraform. The change triggered the creation of OpenTofu — a community-maintained, truly open-source fork under the Linux Foundation.

For most individual engineers and small teams using Terraform to manage their own AWS infrastructure, the license change has no direct impact. However, for platform engineering teams building internal developer platforms, SaaS companies offering infrastructure automation, or organizations with strict open-source compliance requirements, OpenTofu presents a compelling alternative. OpenTofu maintains near-100% compatibility with Terraform syntax and providers, meaning migration requires minimal code changes.

The practical differences as of late 2024: OpenTofu ships features faster (end-to-end state encryption, early variable evaluation), has a growing provider registry, but lacks Terraform Cloud's managed backend features. Migration is straightforward — replace the terraform binary with tofu, update your backend configuration, and run tofu init. The snippet below shows the only file you typically need to change for migration: the required_providers block and the backend configuration.

# Before (Terraform)
# terraform {
#   required_providers {
#     aws = {
#       source  = "hashicorp/aws"
#       version = "~> 5.0"
#     }
#   }
#   backend "s3" {
#     bucket = "my-terraform-state"
#     key    = "prod/terraform.tfstate"
#     region = "us-east-1"
#   }
# }

# After (OpenTofu) — syntax is identical
# tofu {
#   required_providers {
#     aws = {
#       source  = "hashicorp/aws"  # Uses OpenTofu registry
#       version = "~> 5.0"
#     }
#   }
#   backend "s3" {
#     bucket = "my-terraform-state"
#     key    = "prod/tofu.tfstate"  # Rename key to avoid confusion
#     region = "us-east-1"
#   }
# }

# OpenTofu exclusive feature: encrypted state at rest
# tofu {
#   encryption {
#     key_provider "pbkdf2" "my_passphrase" {
#       passphrase = var.state_passphrase
#     }
#     method "aes_gcm" "default_method" {
#       keys = key_provider.pbkdf2.my_passphrase
#     }
#     state {
#       method = method.aes_gcm.default_method
#     }
#   }
# }

# Migration script — run these commands
# 1. brew install opentofu
# 2. tofu init -migrate-state
# 3. tofu plan  # Verify no diff
# 4. tofu apply