---
type: reference
title: Terraform and OpenTofu
description: Current best practices for Terraform and OpenTofu - module structure, state management, backends, and orchestration.
tags:
  - terraform
  - opentofu
  - iac
  - infrastructure
  - engineering
timestamp: 2026-08-11
verified: 2026-08-28
---
# Terraform and OpenTofu

This page covers current (2025/2026) best practices for Terraform and OpenTofu.

## OpenTofu vs Terraform

OpenTofu is the open-source fork of Terraform. It uses the MPL 2.0 license. Terraform moved to the Business Source License. Both remain compatible with the same configurations and most providers.

Use OpenTofu when license portability matters. Use Terraform when you need HashiCorp's commercial extensions.

## Module Structure

Separate infrastructure into layers:

```
infrastructure/
├── modules/           # Reusable building blocks
└── environments/
    ├── dev/
    ├── stage/
    └── prod/
```

Environment modules call the reusable modules. Root modules declare providers and the backend.

## State Management

Never commit `.tfstate` to version control. Use a remote backend only.

The AWS remote backend uses S3 and DynamoDB:

* `bucket` for the state bucket.
* `key` for the state file path.
* `dynamodb_table` for state locking.
* `encrypt` for encryption at rest.

Enable versioning and server-side encryption on the state bucket.

Use separate state files per environment. Do not use workspaces for separate environments.

## Security and Lifecycle

* Mark sensitive values with `sensitive = true`.
* Pin provider versions with `required_providers`.
* Run `terraform import` to adopt existing infrastructure.
* Run `terraform plan` periodically to detect drift.
* Use lifecycle blocks for resource replacement policies.

## Related Tools

* Terragrunt for orchestration: DRY config, hooks, and run queues.
* Pulumi for infrastructure as code in real programming languages.
* Packer for building machine images.
* Atlantis for pull request based Terraform CI/CD.

## Citations

* [Terraform documentation](https://developer.hashicorp.com/terraform)
* [OpenTofu](https://opentofu.org/)
* [Terragrunt](https://terragrunt.com/)
* [AWS backend](https://developer.hashicorp.com/terraform/language/settings/backends/s3)

## See Also

* [Cloud Providers](cloud.md)
* [Kubernetes](kubernetes.md)