Terraform vs OpenTofu vs CloudFormation
Infrastructure as Code (IaC) is the backbone of modern cloud operations. While AWS CloudFormation is deeply integrated into the AWS ecosystem, HashiCorp Terraform emerged as the multi-cloud standard. Recently, licensing changes in Terraform spawned OpenTofu, an open-source fork, adding a new dimension to tool selection.
Terraform
The Multi-Cloud Standard
Strengths
- •Massive ecosystem of providers (AWS, GCP, Azure, SaaS tools)
- •Declarative HCL (HashiCorp Configuration Language)
- •Powerful state management and plan/apply workflow
- •Vast community knowledge base
Weaknesses
- •Recent shift to Business Source License (BSL) restricts some commercial usage
- •State file management can be complex and sensitive (secrets in plain text)
- •Requires learning HCL
Best For:
Multi-cloud environments and teams standardizing on a single IaC tool across various infrastructure providers.
OpenTofu
The Open Source Fork
Strengths
- •True open-source (MPL license) backed by the Linux Foundation
- •Drop-in replacement for Terraform (compatible with older modules)
- •Community-driven roadmap free from single-vendor control
Weaknesses
- •Newer project (forked from TF 1.5.5), ecosystem is still diverging
- •Potential future compatibility issues with upstream HashiCorp providers
- •Requires migration effort for enterprise support
Best For:
Organizations requiring strictly open-source tools or those providing competing services to HashiCorp.
CloudFormation
AWS Native IaC
Strengths
- •Deep, day-zero integration with new AWS features
- •No state files to manage (AWS manages state server-side)
- •Automatic rollback on stack failure
- •No additional licensing costs
Weaknesses
- •Locked completely into the AWS ecosystem
- •JSON/YAML syntax can become extremely verbose and hard to read
- •Custom resources require writing Lambda functions
- •Slower to execute compared to Terraform API calls
Best For:
Teams operating exclusively in AWS who want a managed state experience without external dependencies.
Feature Comparison
| Aspect | Terraform | OpenTofu | CloudFormation |
|---|---|---|---|
| Cloud Support | Multi-Cloud & SaaS | Multi-Cloud & SaaS | AWS Only |
| Language | HCL (HashiCorp Configuration Language) | HCL | JSON, YAML |
| State Management | Local or Remote State File | Local or Remote State File | Managed entirely by AWS |
| License | BSL (Commercial restrictions) | MPL (Open Source) | Proprietary (AWS Service) |
| Rollback on Failure | Manual / Custom scripting | Manual / Custom scripting | Automatic native rollback |
| Drift Detection | via `plan` command | via `plan` command | Native Drift Detection feature |
Architecture Rule of Thumb
Highlight the operational trade-offs in state management. Terraform and OpenTofu require teams to secure, back up, and lock remote state backends (such as S3 with DynamoDB state locking), whereas CloudFormation manages state natively within AWS. OpenTofu maintains identical mechanics under an open-source MPL-2.0 license.
Common Mistakes
- •Stating that CloudFormation supports multi-cloud.
- •Ignoring the complexity of Terraform state files and remote backend locking.
- •Failing to mention the recent licensing divergence between Terraform and OpenTofu.
Related Topics
That's where we come in.
Being able to explain when you would choose Terraform or OpenTofu or CloudFormation is different from reading a comparison table.
Kernelry helps you rehearse technical questions, evidence-led debugging, safe next steps, and the clear communication teams expect. The drills adapt to your answer, so you practice the reasoning rather than memorize a company-specific script. During early access, free accounts include ten daily scenarios across our mixed question pool, with no credit card required.