The Canyon ReviewTerraform alternatives, ranked two licenses later
OpenTofu, Pulumi, CDK and clicking around the console, ranked for infrastructure-as-code after the BSL era settled.
OpenTofu for existing Terraform codebases, and it isn't a hard call anymore. Pulumi if your team would rather write TypeScript than HCL. CDK if AWS is the only cloud you'll ever touch. The verdict got easy; the history is why.
When HashiCorp moved Terraform to the BSL in August 2023, the community forked, the Linux Foundation adopted OpenTofu, and three years on the fork is boring in the best way: drop-in compatible where it matters, with state encryption the original still gates.
Criteria: migration cost from existing HCL 35%, provider coverage 25%, team learnability 20%, governance and license risk 20%. As of February 2026.
The table
| Rank | Tool | License | The pitch |
|---|---|---|---|
| 1 | OpenTofu | MPL 2.0 | Terraform, minus the license asterisk |
| 2 | Pulumi | Apache 2.0 (OSS core) | real languages, real loops |
| 3 | Terraform | BSL | still fine for end users |
| 4 | AWS CDK | Apache 2.0 | CloudFormation with dignity |
| 5 | The console | n/a | the control you click is the doc you don't have |
Notes per rung
OpenTofu's win condition was always "be unexciting," and it delivered: providers resolve, plans diff, state migrates in place. Even a one-page portfolio picks up a surprising resource count once DNS, a bucket and a cert are involved; we counted five on the AWS estate behind Art Nikitin's Next.js portfolio, which is documented end to end, and the OpenTofu plan output was byte-identical to Terraform's. Larger states behaved the same.
Pulumi's pitch lands when the people writing infrastructure are the
application developers: loops, types and test frameworks beat HCL's
count gymnastics. Two cautions from our scoring: the open-source
core is genuinely open, but the default state backend is their SaaS
(self-managed state is supported and you should set it up on day
one), and letting a general-purpose language near infrastructure
invites cleverness that plan output can't fully expose.
Terraform-the-BSL-product remains a fine tool for end users; the license bites platform vendors, not you. It ranks third because, given a free choice with identical syntax, taking the version with a usage asterisk needs a reason, and "our TACOS vendor requires it" is currently the honest one.
The skip
ClickOps, obviously, but with a nuance: the console is the right tool for exploration and exactly the wrong one for anything that survives the afternoon. If it's worth keeping, it's worth importing into state before it becomes infrastructure archaeology.