Terraform License Change Explained: Navigating BSL and Open Source Options for Platform Teams | Harness Blog

Have you ever asked yourself, what is the fastest way to turn a harmless Infrastructure as Code change into a production incident and an awkward postmortem? We did, and found that usually, it's from letting it through without any guardrails.

Infrastructure guardrails in Infrastructure as Code (IaC) were once a nice-to-have. Today, they’re essential. Without clear boundaries and safety mechanisms, even well-designed IaC workflows can turn small mistakes into fast-moving, high-impact problems.

What Are Infrastructure Guardrails?

Infrastructure guardrails are preventive controls that help teams standardize and secure infrastructure deployments. They act as a safety net, ensuring changes consistently align with organizational policies, security best practices, and compliance requirements.

Think of infrastructure guardrails as the difference between letting developers drive on an open road with no lanes versus providing clear lane markings, speed limits, and crash barriers. Guardrails do not restrict innovation. They make it safe to move fast without losing control.

Why Infrastructure Guardrails Are Critical for Modern Cloud Operations

As organizations adopt cloud-native practices and infrastructure as code becomes the standard for deployment, the complexity and scale of infrastructure management increases exponentially. Here's why infrastructure guardrails have become non-negotiable:

Prevent Costly Mistakes

Without proper infrastructure guardrails, simple human errors can result in significant outages or security incidents. Consider these common scenarios:

• A developer accidentally provisions oversized instances across multiple regions
• Security groups are incorrectly configured, exposing sensitive services to the public internet
• Production environments are modified during testing due to misconfigured workspace variables

Each of these scenarios can lead to substantial financial impact, from unexpected cloud bills to costly security breaches and downtime. Infrastructure guardrails help prevent these issues before they manifest in your environment.

Enforce Infrastructure as Code Best Practices

Infrastructure guardrails ensure teams follow infrastructure as code best practices consistently. These include:

• Standardizing resource naming conventions
• Ensuring all resources have required tags for cost allocation
• Enforcing module versioning to prevent unexpected changes
• Requiring documentation for infrastructure components

When these practices are enforced through guardrails rather than through documentation alone, teams naturally develop better habits while reducing technical debt.

‍

Key Types of Infrastructure Guardrails Your Stack Needs

Policy-Based Infrastructure Guardrails

Policy-based guardrails enforce rules across your entire infrastructure. Tools like Open Policy Agent (OPA) integrate with OpenTofu and Terraform to validate infrastructure changes against organizational policies before deployment.

These policies can be as simple or complex as needed:

‍

Policy-based infrastructure guardrails provide the flexibility to codify any organizational requirement while ensuring consistent enforcement.

Compliance Controls

Both OpenTofu and Terraform benefit from specific guardrails that enhance their native capabilities:

1. Module Registry Controls: Ensuring teams use only approved, tested modules from internal registries
2. Variable Validation: Preventing deployments with invalid or potentially dangerous input values
3. Custom Policy Frameworks (OpenTofu): Enforcing business and security rules

OpenTofu compliance controls can be particularly effective when integrated into CI/CD pipelines, creating automated checkpoints that validate changes before they reach production environments.

‍

Infrastructure Drift Prevention

One of the most insidious challenges in infrastructure management is configuration drift. Without proper infrastructure guardrails, manual changes can occur outside the IaC workflow, creating inconsistencies between your code and the actual deployed resources.

Effective drift prevention guardrails include:

• Regular automated drift detection scans
• Remediation workflows that reconcile detected drift
• Prevention of manual changes through access controls
• Alerting systems that notify teams when drift occurs

Implement IaC Security Controls Within Your Guardrails

Infrastructure guardrails should incorporate robust IaC security controls to protect against both accidental and malicious security issues:

1. Static Code Analysis: Scan IaC templates for security misconfigurations before deployment
2. Secrets Management: Prevent hardcoded credentials in infrastructure code
3. Least Privilege Enforcement: Ensure IAM roles and permissions follow principle of least p
4. Network Security Validation: Verify that network configurations don't create unintended exposure

These security-focused infrastructure guardrails help organizations maintain a strong security posture even as infrastructure scales and evolves.

Cloud Infrastructure Governance Through Effective Guardrails

For organizations operating at scale, infrastructure guardrails form the foundation of cloud infrastructure governance. This governance framework provides:

• Visibility into all infrastructure resources across environments
• Accountability through detailed audit trails of changes
• Cost management through enforcement of resource constraints
• Compliance with industry regulations and internal policies

How Harness IaCM Enhances Your Infrastructure Guardrails

Harness Infrastructure as Code Management (IaCM) provides a comprehensive platform for implementing and maintaining effective infrastructure guardrails. Supporting both OpenTofu and Terraform, Harness IaCM addresses the challenges we've discussed through several key capabilities:

Built-in Policy Enforcement

Harness IaCM integrates policy-as-code directly into your infrastructure workflows. Teams can define, test, and enforce policies that validate infrastructure changes against security, compliance, and operational requirements. These policies run automatically during the plan phase, preventing non-compliant changes from being applied.

Standardization Through Module and Provider Registry

Harness IaCM includes a built-in registry for OpenTofu and Terraform modules and providers. This enables teams to:

• Publish approved, pre-validated infrastructure components
• Version modules to ensure controlled changes
• Share reusable components across teams with appropriate guardrails already built in

This standardization dramatically reduces the risk of configuration errors while improving developer productivity.

Controlled Deployment Workflows

With Harness IaCM, infrastructure deployments follow consistent, auditable workflows:

1. Changes are proposed through version control
2. Infrastructure guardrails validate the changes through policy enforcement
3. Approvals are routed to appropriate stakeholders based on impact
4. Deployments proceed only after all guardrails have been satisfied

These workflows provide the perfect balance between developer autonomy and operational control.

Drift Detection and Remediation

Harness IaCM continuously monitors your infrastructure for drift, automatically detecting when resources deviate from their expected state. When drift occurs, teams can:

• Receive immediate notifications
• Visualize exactly what changed
• Automatically remediate drift by reapplying the correct configuration

This ensures your infrastructure guardrails remain effective even after deployment.

Get Started with Infrastructure Guardrails

Implementing effective infrastructure guardrails doesn't have to be an all-or-nothing proposition. Start with these steps:

1. Identify your highest-risk areas: Begin with guardrails that protect against your most common or costly errors
2. Start with simple policies: Focus on basic security and cost management policies before adding complexity
3. Integrate guardrails into your existing workflow: Use tools like Harness IaCM that work with your current processes
4. Measure the impact: Track reduced incidents, faster deployments, and improved compliance

Conclusion: Infrastructure Guardrails as Enablers, Not Barriers

Effective infrastructure guardrails don't limit innovation, they enable it by providing a safe environment for experimentation and rapid deployment. By preventing costly errors, enforcing best practices, and ensuring compliance, guardrails give teams the confidence to move quickly without sacrificing reliability or security.

Harness Infrastructure as Code Management provides the ideal platform for implementing these guardrails, with native support for both OpenTofu and Terraform, built-in policy enforcement, and comprehensive drift management capabilities.

Ready to implement effective infrastructure guardrails in your environment? Explore how Harness IaCM can help your team deploy more confidently and securely while maintaining the flexibility developers need to innovate.

Infrastructure as Code (IaC) has revolutionized IT infrastructure management, with HashiCorp’s Terraform leading the way for many years. However, when HashiCorp introduced licensing restrictions on Terraform, it left many organizations questioning the future of their open-source infrastructure tooling. 

Enter OpenTofu: a community-driven fork of Terraform that's rapidly gaining traction among developers and operations teams alike.

Born out of a desire to preserve the open-source ethos, OpenTofu is more than just a Terraform clone. It represents a philosophical shift in how we approach infrastructure management tools. In this post, we'll dive deep into OpenTofu, unpack its origins, explore its key features, and see how it stacks up against its well-established predecessor.

Whether you're a seasoned Terraform user or new to the world of IaC, understanding OpenTofu is crucial as we navigate the ever-evolving terrain of cloud infrastructure management. So, let's roll up our sleeves and get to know this promising new player in the DevOps toolkit.

What is OpenTofu?

OpenTofu is an open-source infrastructure as code tool that allows users to define and provision data center infrastructure using a declarative configuration language. As a fork of HashiCorp's Terraform, it was created to ensure the continued availability of a fully open-source option for infrastructure management.

At its core, OpenTofu enables developers and operations teams to manage complex infrastructure setups through code, bringing software development practices to infrastructure management. This approach, known as Infrastructure as Code (IaC), facilitates version control, code review, and automated testing for infrastructure changes.

OpenTofu supports a wide array of service providers and can manage both cloud and on-premises resources. From spinning up virtual machines to configuring networking rules, it provides a unified workflow for provisioning and managing infrastructure across different platforms.

Why OpenTofu Now and How It Differs from Terraform

OpenTofu was born out of the open-source community’s response to HashiCorp’s decision to change Terraform’s license from the Mozilla Public License v2.0 (MPL v2.0) to the more restrictive Business Source License (BSL). This shift raised concerns about the long-term accessibility and open-source future of Terraform, prompting the need for an alternative that would uphold open-source principles and empower the community to drive the tool’s direction.

Here’s how OpenTofu differs from Terraform and why it represents a significant shift in the Infrastructure as Code (IaC) landscape:

Licensing:

OpenTofu remains fully open-source under the MPL v2.0 license, ensuring unrestricted access to its code and the freedom for users to modify and distribute it. In contrast, Terraform now operates under the BSL, which imposes limitations on its use and restricts open development as a source-available licence.

Governance:

OpenTofu is governed by the community through the Linux Foundation, emphasizing a decentralized and collaborative approach. This means development decisions, feature requests, and bug fixes are driven by the broader community. Terraform, on the other hand, remains under the control of HashiCorp, with development decisions made centrally by the company.

Feature Parity and Divergence:

While OpenTofu began as a fork of Terraform and maintains feature parity for now, the two tools are expected to diverge over time. OpenTofu will evolve based on community priorities and needs, while Terraform’s feature set will likely be influenced by HashiCorp’s commercial goals. This divergence may lead to OpenTofu gaining new features or adopting changes faster in areas prioritized by its users.

Provider Ecosystem:

Both OpenTofu and Terraform can utilize the existing ecosystem of providers to manage infrastructure across multiple platforms. However, differences may arise in how quickly new providers are supported. OpenTofu, driven by community contributions, may focus on rapid provider development for cloud and on-premises systems based on user demand, while Terraform’s provider updates will follow HashiCorp’s priorities.

Development Pace:

As a community-driven project, OpenTofu is likely to see a faster pace of development in areas that matter most to its users. This could include bug fixes, new features, and provider support, with the community able to directly influence the tool’s roadmap. Terraform’s development, meanwhile, will be steered by HashiCorp’s internal timelines and enterprise focus.

Enterprise Features:

OpenTofu aims to keep all features fully open-source, making it a cost-effective solution for teams of any size. In contrast, Terraform separates certain advanced features—such as governance, policy enforcement, and collaboration—into its enterprise offering, which is only available under commercial licensing.

OpenTofu stands out as more than just a fork of Terraform; it represents a philosophical shift toward community empowerment, open governance, and unrestricted access. By combining these differences with its commitment to open-source values, OpenTofu provides a stable, innovative, and flexible alternative for organizations looking to maintain control over their infrastructure as code tools without compromising on features or flexibility.

History of OpenTofu

The history of OpenTofu is closely intertwined with that of Terraform:

Since its inception, OpenTofu has gained support from major tech companies and cloud providers, indicating strong interest in maintaining an open-source IaC solution.

Why Use OpenTofu and What Does It Offer?

OpenTofu is more than just an open-source alternative to Terraform—it combines the power of a community-driven project with a robust feature set that makes it a compelling choice for managing infrastructure as code. Here’s why OpenTofu stands out and the key features it offers:

Open-Source Commitment & Community Governance:

As a fully open-source tool under the MPL v2.0 license, OpenTofu ensures unrestricted access to its codebase. Managed by the Linux Foundation, it benefits from diverse contributions, making it a tool shaped by its community’s needs. This open governance model also drives faster innovation and development, responding directly to user demands.

Compatibility & Flexibility:

OpenTofu maintains full compatibility with existing Terraform configurations and providers, making it an easy transition for users already familiar with Terraform. Its flexibility allows for extensive customization and integration with other tools, offering broad support for cloud and on-premises infrastructure.

Declarative Infrastructure as Code:

Like Terraform, OpenTofu uses the HashiCorp Configuration Language (HCL) for declarative infrastructure management. This allows users to define their infrastructure in a way that’s easy to read and understand, while also being compatible with version control systems for change tracking.

Comprehensive State Management:

OpenTofu keeps track of infrastructure changes with a state file, ensuring you always have an accurate representation of your deployed resources. Features like state locking prevent concurrent modifications, maintaining consistency and preventing accidental overwrites.

Plan and Apply Workflow:

OpenTofu allows users to generate a detailed execution plan (opentofu plan) before applying any changes. This helps prevent unexpected infrastructure modifications by giving teams full visibility into what changes will be made before they are applied.

Resource Graph:

OpenTofu builds a dependency graph of your resources, allowing it to determine the correct order for creating, updating, or deleting them. This automatic ordering ensures efficient infrastructure provisioning.

Modular Infrastructure & Reusability:

OpenTofu supports reusable modules, enabling developers to encapsulate and share standardized infrastructure components. This encourages the DRY (D

‍

Basic OpenTofu Commands

Using OpenTofu is straightforward, with a set of core commands that follow a clear workflow for managing infrastructure. Whether you’re running OpenTofu directly or through a CI/CD pipeline like Harness IaCM, these commands form the backbone of your IaC operations:

tofu init: The init command initializes your working directory. This sets up your configuration files and prepares your environment for running other OpenTofu commands.

tofu plan: Before applying changes, plan generates a detailed execution plan, showing what changes will be made to your infrastructure. This step ensures that you review changes before implementing them.

tofu apply: The apply command carries out the changes defined in your configuration. Once you’ve reviewed the plan, apply makes the modifications to your infrastructure, whether it’s creating resources, updating them, or deleting them.

tofu destroy: The destroy command is used to clean up resources. When you no longer need infrastructure, destroy will tear it down, ensuring you avoid unnecessary costs or complexity.

tofu validate: Before running a plan or apply, it’s good practice to use validate to check your configuration for syntax errors or inconsistencies. This helps catch issues early in the workflow.

tofu state: The state command manages the state file, which tracks the current state of your infrastructure. You can use state to query, modify, or import resources into OpenTofu’s state file.

Here’s how these commands work in sequence:

1. Start by initializing your configuration with tofu init.
2. Next, use tofu plan to preview the infrastructure changes.
3. After reviewing the plan, apply the changes using tofu apply.
4. Periodically, use tofu state to manage or query the current state of your resources.

For those using Harness IaCM, OpenTofu commands like init, plan, and apply are automatically executed within your pipelines. Harness ensures these commands run with the correct context and credentials, streamlining your IaC processes.

Checkout how this commands can be executed in sequence with Harness IaCM.

Conclusion

By leveraging Harness IaCM alongside OpenTofu, teams can move beyond manual IaC management to a fully automated, governed, and scalable solution. This combination provides the tools needed for consistent, secure, and efficient infrastructure provisioning, all while maintaining the open-source flexibility that OpenTofu offers.

For more information on getting started with OpenTofu in Harness, check out Harness IaCM or join our on-demand webinar to learn how GitOps and OpenTofu are shaping the future of IaC.

OpenTofu, combined with tools like Harness IaCM, is the future of Infrastructure as Code. Whether you’re building infrastructure at scale or just getting started with IaC, the flexibility and community-driven innovation offered by OpenTofu make it a must-have tool. Start exploring how OpenTofu and Harness IaCM can transform your infrastructure management today.

Introduction

Over the last 9-10 years, Terraform has become synonymous with “Infrastructure as Code,” being the go-to tool within the domain. Over this time, a vast ecosystem has built up around the open source tool, both in terms of community and tooling, with a wide range of providers, modules, tooling, and services, extending its applicability, reach, and adoption.

OpenTofu Catalyst

However, like the rest of the technology space, the IaC landscape is constantly evolving. Part of this evolution happened when Terraform’s licensing model was changed from the open-source Mozilla Public License (MPL) to a more restrictive Business Source License (BSL). This change limited Terraform’s commercial use and made it costly or illegal for previous ecosystem solutions that competed with the parent company to carry on.

This move was followed by introducing a new pricing model for their management tool. This new pricing approach significantly increased costs making Terraform management cost-prohibitive for many of its users, especially for those managing large-scale infrastructures. As a result, many users faced unexpected financial burdens.

These moves caused Terraform users to reevaluate their reliance on the IaC tool and its parent company. They revealed risks associated with being tied to the success and whims of a single company for what had become a foundational tool for operating cloud application infrastructures at scale.

What is OpenTofu?

Terraform users began to seek alternatives, which led to the creation of the OpenTofu Manifesto. OpenTofu was forked from Terraform to ensure the IaC tool remains open source. Managed by the Linux Foundation and with a CNCF application underway, OpenTofu operates under a well-known, widely accepted open-source license, providing long-term assurance against sudden, unilateral license changes.

Key Benefits of OpenTofu

Truly open source

OpenTofu is committed to staying under a well-known and widely accepted open-source license, ensuring transparency and allowing companies to adopt OpenTofu without fear of future legal entanglements.

Community-driven development‍

OpenTofu's governance is rooted in community involvement. Pull requests are evaluated and accepted based on their merit and value to the community, fostering a collaborative and innovative environment where developers can confidently contribute and use the tool.

Impartial management‍

Managed by the Linux Foundation, OpenTofu operates under a neutral entity, ensuring no single company can dictate its direction. This impartiality means that valuable features and fixes are included based on their benefits to the broader community, not the interests of any one vendor.

Layered & modular architecture

‍OpenTofu’s architecture is designed to be programmer-friendly, encouraging the development of additional tools and integrations. This modular approach enables a vibrant ecosystem to grow around the core project, similar to the ecosystems seen around other successful open-source projects, such as Kubernetes.

Backwards-compatible‍

OpenTofu maintains compatibility with the forked version of Terraform, ensuring that current investments in infrastructure as code continue to provide value. Users can transition to OpenTofu without losing the functionality or stability of their existing setups.

Features and Compatibility

OpenTofu maintains compatibility with existing Terraform configurations, making it easy to switch. Already, major eco-system tool providers such as Oracle, Vmware, and Grafana Labs have switched to OpenTofu, telling their customers that they will no longer support Terraform. However, OpenTofu never planned to be just a shadow project of Terraform, so after the initial 1.6 stable release, thoughts turned to how the project could innovate to become the leading IaC tool.

This has led to OpenTofu 1.7 and 1.8 (the latest as of this writing) introducing new functionalities such as client-side state encryption, loop-able import blocks, and dynamic provider-defined functions in 1.7, and in 1.8, mechanisms to allow OpenTofu-specific overrides, balancing the commitment to compatibility while enabling future innovations.

Migration

As a fork of Terraform, OpenTofu has backward compatibility and migrating to OpenTofu is straightforward. Provided you aren’t using new functionality from Terraform 1.7 onward:

1. Backup your terraform code and state file
2. Ensure there are no more changes to be made (terraform plan and terraform apply)
3. Set up the OpenTofu environment (tofu init)
4. Check there are are no changes to be made (tofu plan)
5. If no changes it is safe to update the state file to Open Tofu (tofu apply) 

Full migration guides for each version can be found at https://opentofu.org/docs/intro/migration.

Conclusion

OpenTofu offers a truly open-source, community-driven, and impartial IaC tool, making it a reliable choice for managing your infrastructure. Its commitment to open-source values, modular architecture, and backward compatibility ensures it is a robust and future-proof solution.

Its open-source license ensures that users will continue to have an ecosystem of competitive products and enhancements to this foundational tool for operating cloud application infrastructures at scale. For example, IaC Management tools, such as IaCM from Harness (an OpenTofu founding member and sponsor), can provide secure state file hosting, versioning, and diffs, automatic rollbacks, drift detection, policy enforcement, change approvals, and powerful infrastructure pipeline automation and testing with full audit trails. All are necessary as you scale up your use of infrastructure as Code.

Thankfully, OpenTofu exists to keep IaC evolving in a positive direction.

‍