Terraform

The most widely used infrastructure-as-code tool: declare resources in HCL, review a plan, and apply it through provider plugins.

What it is: Infrastructure as code
Type: Commercial product
Made by: HashiCorp, an IBM company
License: Business Source License 1.1 since 1.6 (source-available, not OSI open source); MPL 2.0 before the August 2023 change
Facts checked: 5 October 2026

What it is

You describe resources in .tf files written in HCL, HashiCorp’s configuration language. Terraform reads them, builds a dependency graph (the subnet needs the VPC first), and compares the result with its state file, a JSON record of every resource it created and its real ID. terraform plan lists what it will create, change or destroy; terraform apply then calls the cloud APIs, in parallel wherever the graph allows. Each API is reached through a provider plugin, and the Terraform Registry has thousands of them: AWS, Google Cloud, Azure, Kubernetes, GitHub, DNS hosts and many more. That is the main difference from CloudFormation or Bicep: one tool and one workflow across every vendor.

In August 2023 HashiCorp moved Terraform from the open-source MPL 2.0 to the Business Source License 1.1. You can still use it free of charge, in production too; what the licence forbids is building it into a product that competes with HashiCorp, such as a hosted Terraform service. In response, a group of vendors forked the last MPL release as OpenTofu, which stays backward compatible with Terraform and is now a CNCF Sandbox project. IBM completed its acquisition of HashiCorp in February 2025. HCP Terraform is HashiCorp’s hosted service for remote state and runs: free for small teams, with paid editions for larger ones.

Why teams pick it

One language and workflow for every major cloud and hundreds of SaaS APIs, through providers on the Terraform Registry
terraform plan shows exactly what will be created, changed or destroyed before anything is touched
Huge ecosystem of reusable modules, examples and engineers who already know it
The S3 backend can lock state with a lock file in the bucket (use_lockfile), so no separate lock table is needed

Watch out for

The state file is critical and can contain secrets in plain text; it has to live in a remote, locked, access-controlled backend
Changes made by hand in the console stay invisible until the next plan, and renaming or moving resources needs moved blocks or state surgery
No longer OSI open source: companies building a competing product need OpenTofu or a commercial agreement
HCL is declarative; complex logic with count, for_each and conditionals gets awkward compared with Pulumi or the AWS CDK
HashiCorp archived CDK for Terraform (CDKTF) in December 2025, so writing Terraform in TypeScript or Python is no longer supported

Alternatives

What all infrastructure as code have in common →

AWS Cloud Development Kit (CDK)AWSDefine AWS infrastructure in TypeScript, Python, Java, C# or Go; the CDK turns it into CloudFormation templates and CloudFormation deploys them.

HashiCorp PackerCommercialBuilds machine images (AMIs, Azure and Google images, VMware, Docker) from one HCL template, so every server starts already configured.HCP WaypointCommercialHashiCorp’s hosted internal developer platform: developers create apps and add databases from templates that run Terraform modules in HCP Terraform.

OpenTofuOpen sourceThe open-source fork of Terraform, created after HashiCorp’s 2023 licence change: same HCL, same providers, `tofu` instead of `terraform`.

SSTOpen sourceA TypeScript framework that defines a whole app, from Next.js front end to functions, containers and databases, in one config file and deploys it to your own AWS or Cloudflare account.

How it fits with other technologies

What Terraform uses

What uses Terraform

Remote state on S3 and a VPC with one subnet · hcl

terraform {
  backend "s3" {
    bucket       = "acme-tf-state"
    key          = "prod/network.tfstate"
    region       = "eu-west-1"
    use_lockfile = true # S3-native state locking
  }
}
resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}
resource "aws_subnet" "app" {
  vpc_id     = aws_vpc.main.id # dependency: the VPC is created first
  cidr_block = "10.0.1.0/24"
}

See it in a real stack

No architecture uses Terraform yet. Drop it into the playground and wire it up yourself.Open playground →

Worth exploring

Article· March 2023The Great Lambda Migration to Kubernetes Jobs: a Journey in Three PartsLiav Yona, InfoQA first-person account of how Firefly moved event-driven work off Lambda (after hitting the 15-minute timeout), briefly onto ECS, and finally onto Kubernetes Jobs on EKS, with practical notes on reusing container images, swapping an IAM trust policy for EKS OIDC, moving environment variables into ConfigMaps and a blue/green cutover. It is one company’s story with few numbers, and the author’s employer sells infrastructure-as-code tooling, which colours the emphasis on IaC.

All resources →

Where it came from2011–2025

On February 25, 2011, AWS launched CloudFormation, which builds a whole stack of AWS resources from one JSON template, in the right order. The very next day Mitchell Hashimoto blogged that he was impressed by the idea, but that what was really needed was an open-source, cloud-agnostic solution: the same workflow whichever cloud you used. CloudFormation only knew AWS.

Nobody else built it, so three and a half years later Hashimoto’s company, HashiCorp, did. Terraform 0.1 came out on July 28, 2014, supporting only AWS and DigitalOcean. Downloads were mostly flat for the first 18 months, and the team even talked about shutting the project down. Then they began doubling every month, and in 2017 Microsoft became its first major cloud partner.

By version 1.0 in 2021 Terraform had been downloaded more than 100 million times and had over a thousand providers. In August 2023 HashiCorp moved it to the Business Source License, a group of companies forked the last open-source release as OpenTofu, and in February 2025 IBM completed its purchase of HashiCorp.

Why it’s built this way

Providers as separate plugins: Being cloud-agnostic meant the core could know nothing about any one API. Each cloud or service gets its own provider plugin, which is how one tool grew from two clouds to thousands of providers.
Plan first, then apply: Terraform shows an execution plan of what it will create, change or destroy and acts only on approval, so infrastructure changes can be reviewed like code before anything is touched.
A state file as the record of what exists: Mapping each resource in the code to a real ID lets Terraform work out the difference between configuration and reality, at the cost of a file that must be stored, locked and protected.
HCL instead of JSON or a programming language: HashiCorp designed HCL as a compromise between a data format like JSON and configuration written in a full language like Ruby: easy for humans to read and write, declarative, with a JSON form for machines.

Timeline

2011
Hashimoto calls for an open, cloud-agnostic CloudFormation
2014
Terraform 0.1 released in July with AWS and DigitalOcean
2017
Microsoft partnership; downloads take off
2019
Terraform 0.12 overhauls the configuration language
2021
Terraform 1.0, after more than 100 million downloads
2023
Relicensed under the BSL in August; OpenTofu fork follows
2025
IBM completes its acquisition of HashiCorp in February

Sources15 · facts checked 5 October 2026

Improve this page on GitHub