Terraform vs OpenTofu vs Pulumi in 2026: Which IaC Tool to Use

In 2023, HashiCorp changed Terraform's license from MPL 2.0 to BSL 1.1 — no longer truly open source. This created OpenTofu (the community fork) and accelerated interest in alternatives like Pulumi. Here is where things stand in 2026.

Quick Decision Table

Terraform

The BSL License Reality

The BSL 1.1 license restricts "competitive" uses of Terraform. If you are running Terraform internally for your own infrastructure, you are not affected. The restriction is on building products that compete with HashiCorp's commercial offerings.

For most engineering teams, the BSL license has zero practical impact. The concern is if you are a platform team building IaC tooling for other companies, or if you are embedding Terraform in a product you sell.

Why Teams Still Choose Terraform

The ecosystem is unmatched. 4,000+ providers, every cloud service covered. AWS, GCP, Azure, Datadog, PagerDuty, Cloudflare — all have mature, actively maintained Terraform providers.

HCL is battle-tested. The HCL syntax is opinionated but readable. Most DevOps engineers already know it. Your hiring pool is large.

HCP Terraform (previously Terraform Cloud) handles state management, drift detection, remote execution, and policy enforcement. For teams that want managed infrastructure, it is good.

# Terraform — familiar, readable
resource "aws_eks_cluster" "main" {
  name     = var.cluster_name
  role_arn = aws_iam_role.eks.arn
  version  = "1.30"
 
  vpc_config {
    subnet_ids = var.subnet_ids
  }
 
  depends_on = [aws_iam_role_policy_attachment.eks-cluster-policy]
}

Where Terraform Falls Short

HCL is not a real programming language. No for loops over arbitrary data structures, no type system, limited string manipulation, no native testing. You end up reaching for workarounds.

State file management is manual. S3 + DynamoDB state backend setup, state locking, state import — all operational overhead.

OpenTofu

OpenTofu is a drop-in replacement for Terraform, maintained by the Linux Foundation. It forked at Terraform 1.5 and has since added features Terraform has not.

Migration from Terraform

# Drop-in replacement — just change the binary name
# Existing .tf files work without changes
 
# Install OpenTofu
brew install opentofu  # macOS
# or
curl --proto '=https' --tlsv1.2 -fsSL https://get.opentofu.org/install-opentofu.sh | sh
 
# Run like Terraform
tofu init
tofu plan
tofu apply
 
# State files are compatible — no migration needed

What OpenTofu Added Beyond Terraform

Built-in testing framework:

# tests/vpc.tftest.hcl
run "creates_vpc_with_correct_cidr" {
  command = plan
 
  assert {
    condition     = aws_vpc.main.cidr_block == "10.0.0.0/16"
    error_message = "VPC CIDR should be 10.0.0.0/16"
  }
}

Provider function calls:

# Call provider functions directly in HCL
locals {
  subnet_ids = provider::aws::arn_parse(var.subnet_arn).resource
}

State encryption at rest (native, no custom backend needed).

The OpenTofu Case

If you are already on Terraform and want to stay with HCL, OpenTofu is the better choice in 2026. It is truly open source, has a compatible state format, and is adding features faster than Terraform.

Pulumi

Pulumi takes a fundamentally different approach: write infrastructure in a real programming language.

// TypeScript — real types, real IDE support, real testing
import * as aws from "@pulumi/aws";
import * as eks from "@pulumi/eks";
 
const cluster = new eks.Cluster("production", {
  version: "1.30",
  instanceType: "t3.medium",
  desiredCapacity: 3,
  minSize: 1,
  maxSize: 10,
  // TypeScript catches typos at compile time
  // Terraform/OpenTofu catch them at plan time
});
 
// Real loops — no workarounds needed
const namespaces = ["production", "staging", "monitoring"];
namespaces.forEach(ns => {
  new k8s.core.v1.Namespace(ns, {
    metadata: { name: ns }
  }, { provider: cluster.provider });
});
 
export const kubeconfig = cluster.kubeconfig;

Where Pulumi Wins

Type safety catches errors at compile time — before pulumi plan, your IDE flags invalid property names.

Real programming = real power. Loops, conditionals, functions, classes, unit tests — everything a real language provides.

# Python example — generate 10 EC2 instances with a loop
import pulumi
import pulumi_aws as aws
 
for i in range(10):
    instance = aws.ec2.Instance(f"worker-{i}",
        ami="ami-0c55b159cbfafe1f0",
        instance_type="t3.medium",
        tags={"Name": f"worker-{i}", "Index": str(i)}
    )

// Unit test Pulumi code like normal code
import { expect } from "chai";
import * as pulumi from "@pulumi/pulumi";
 
describe("EKS Cluster", () => {
  it("should use correct Kubernetes version", async () => {
    const cluster = new eks.Cluster("test", { version: "1.30" });
    const version = await cluster.version.promise();
    expect(version).to.equal("1.30");
  });
});

Where Pulumi Falls Short

Provider ecosystem is smaller. Pulumi's native providers cover AWS, Azure, GCP, Kubernetes well. For specialized tools (Datadog, PagerDuty, Cloudflare), Pulumi bridges to Terraform providers — which works but feels like a workaround.

Steeper learning curve. You need to understand async programming and the Pulumi execution model. TypeScript beginners get confused by Output<T> and .apply().

Pulumi Cloud pricing is $50/user/month for team features. Self-hosted state (S3 backend) is free.

Which Should You Choose?

Choose Terraform (classic) if:

• Your team already knows it and migration is not worth it
• You use HCP Terraform and are happy with it
• You need provider coverage for a niche tool

Choose OpenTofu if:

• You want to stay with HCL but prefer open source
• You are starting fresh with an HCL-based stack
• You want to test infrastructure code natively

Choose Pulumi if:

• Your team writes TypeScript or Python professionally
• You want type safety and real unit tests
• You are building a platform product (not just ops scripts)
• You have complex logic that HCL makes painful

The migration path that makes sense:

• Terraform → OpenTofu: 1 day, zero code changes
• Terraform → Pulumi: 2-4 weeks per module (real rewrite)

Most large teams in 2026 are on one of two paths: moving from Terraform to OpenTofu (license concern), or adopting Pulumi for new projects while keeping Terraform for existing infrastructure.

More IaC comparisons? Read our Terraform vs Ansible comparison and OpenTofu complete guide.