Why Terraform Is Still the Default IaC Choice
Where Terraform earns the default pick, and where the BSL license and state overhead actually bite.
- Multi-cloud teams
- Orgs prioritizing provider coverage over license purity
- Teams with existing Terraform expertise to hire from
Terraform is the tool you reach for by default, and after running it across three cloud providers for two years on a platform team, the reasons are mostly good ones — but “default” and “best fit” aren’t always the same thing, and it’s worth being honest about where they diverge.
Where it wins
Provider ecosystem. If a service has an API, there’s almost certainly a Terraform provider for it. This alone settles most build-vs-buy debates for IaC before they start.
HCL reads well in review. Declarative syntax means a reviewer can reason about a diff without executing anything mentally — the plan output does that work for them.
Institutional knowledge. Nearly every infra hire already knows it. Onboarding cost is close to zero compared to a less common tool, and that compounds across a growing team.
Where it falls short
The BSL license change (v1.6+). It’s no longer OSI-approved open source. For most teams this changes nothing practical day to day, but it’s worth flagging to anyone who chose Terraform specifically for its open-source terms — OpenTofu exists precisely because of this, and migration cost is close to zero if it matters to you.
State file is a single point of failure. Remote state with locking solves the coordination problem, but it’s infrastructure you now have to run and back up — Terraform doesn’t give you that for free.
No native drift detection without paying for HCP Terraform or Enterprise. You find out about drift when the next plan surprises you, not proactively.
Setup notes
Standard practice: remote state in S3 (or GCS/Azure Blob) with a DynamoDB table for locking, workspace-per-environment, and modules pinned to specific versions in a private registry once you’re past a handful of engineers touching infra.
Verdict
For a team standardizing on one IaC tool with wide provider coverage as the top priority, Terraform remains the safe default. If the BSL license is a hard blocker — regulated industries sometimes make it one — OpenTofu is a drop-in replacement worth evaluating first.