Does the Terraform BSL license affect your company

Most internal teams can keep running Terraform under the Business Source License, but the answer depends on whether you sell a competing offering, embed the CLI, or sell support. This page sets out the questions legal and platform teams should settle before choosing between Terraform and OpenTofu.

On this page

Does the Terraform BSL license affect your company for internal use?

For most companies, running Terraform 1.6.0 or later to manage their own infrastructure is the common case the Business Source License covers, and the exposure sits in three places: offering a competing product or service to others, embedding Terraform inside something you distribute, and selling paid support arrangements built on it. HashiCorp's announcement of the license change said the main restriction targets vendors offering competitive services, which is where most platform teams begin their reading. HashiCorp's announcement of the Business Source License is the natural starting point. This page is a licensing decision aid, not legal advice. Your counsel should read the exact license text that ships with the Terraform version you run, because that wording decides the answer.

The practical work is a short set of questions for legal and platform leads to answer in writing. Does any part of the business sell hosted infrastructure management, Terraform-based tooling or consulting that delivers Terraform to customers? Do you ship software that bundles or calls the Terraform binary? Do you operate Terraform for clients as a managed service provider? Is any support contract priced around Terraform itself? Ask counsel specifically how subsidiaries, contractors and affiliates are treated, since those are common grey areas for internal use. Record each answer and the license version it was checked against, so the decision can be revisited when the license or your operating model changes. Those answers are illustrative of the kind of questions to ask, not a complete checklist.

If every answer is no and counsel confirms internal production use, staying on Terraform is a valid option, and the decision can be reviewed again at each upgrade. If any answer is yes or still unclear, the alternative is OpenTofu, an open-source fork of Terraform licensed under the Mozilla Public License 2.0 and described by its project as a drop-in replacement for Terraform. The MPL 2.0 terms still need confirmation by counsel for your specific use, but they remove the competitive-offering question that drives this analysis. The migration steps, and what changes once you move, are covered on the sibling pages.

Which BSL terms decide your exposure

Five terms in the Business Source License determine whether your current Terraform use needs closer legal review. Each card names the question counsel should answer, and the answers depend on the license text attached to the Terraform version you run. Record the answers before you choose between staying on Terraform and moving to OpenTofu.

Internal production use

The first question is whether running Terraform to build and manage your own infrastructure, including production environments, falls within the license's permitted use. Most organizations use the CLI this way, so this is usually the baseline everything else builds on. Ask counsel to confirm that internal production use is covered under the additional use grant in the current license text, and to note any conditions attached to it.

Definition of a competitive offering

HashiCorp said the main restriction targets vendors that offer competitive services. Legal should determine whether your product, managed service or internal platform could be read as a competing offering to HashiCorp's products. The license defines this term precisely, so the wording matters more than the general announcement. Confirm the definition in the license text and document how your services relate to it.

Embedding the CLI in products

If you ship Terraform inside a commercial product, bundle it in an appliance, or run it on behalf of customers as part of a hosted service, the embedding terms apply. This is a different question from internal use, because the software leaves your own infrastructure. Ask counsel whether embedding or redistribution is permitted, and whether a customer-facing run environment counts as a use the license restricts.

Paid support arrangements

Many platform teams and consultancies sell support, training or managed operations around Terraform. Whether those arrangements fall under the restriction depends on how the license describes the services you provide and who receives them. Ask counsel to review your support contracts against the current license, including any services that run Terraform for a customer's account or environment.

The change date

Under the Business Source License, each released version of Terraform carries a change date after which it converts to an open-source license. Platform teams often pin older versions for stability, so the date that applies depends on the version in use, not only the latest release. Ask counsel to confirm the change date for every Terraform version your organization runs, and check how that date affects your upgrade plan before you commit to a version.

How the answer changes by business model

An internal platform team runs Terraform to provision infrastructure for its own company's products and teams. This is the situation the Business Source License was least likely to restrict, because the company is not offering a competing product to third parties. The licensing question to take to counsel is narrow: confirm that the internal use falls within the production use permitted by the license text, and confirm that no internal business unit is billed as a separate commercial service. Illustrative example: a bank's platform group provisions networks and clusters for its own lines of business, and no outside party consumes that tooling. This setup usually points toward staying on Terraform under a documented BSL review, provided counsel agrees with the reading. Teams that want a license with no field-of-use limits and a neutral governance model often still choose OpenTofu for this case.

  • Internal production use: Running Terraform to manage your own infrastructure is the core use the license is designed to allow, so confirm the wording with counsel.
  • Internal shared services: If other departments are charged internal rates, ask counsel whether that counts as offering a service to third parties.
  • Contractors on your team: Ask whether contractors who operate the platform on your behalf change the analysis.
  • Version pinning: Record which Terraform version is in use, since the license terms apply to each release.
  • Governance preference: Weigh whether a Linux Foundation and CNCF governed fork matters to your architecture board.

Confirm the internal scope in writing with counsel before the next major upgrade.

Staying on Terraform or moving to OpenTofu compared

This table compares Terraform under the Business Source License, OpenTofu under MPL 2.0 and the self-hosted run platforms that pair with either CLI. Read each row against your legal team's view of the license, your provider mix and how much you depend on features that exist only in one fork. The main takeaway is that the license question and the compatibility question are separate, and both need an answer before you choose.

OptionLicense positionFit with a license-driven constraintTrade-offs to confirm
Terraform (BSL 1.1)Business Source License 1.1 for releases from 1.6.0 onward, per HashiCorp's announcementInternal production use is the case the license is designed around, but legal should confirm how the competitive-offering restriction applies to your servicesProvider and feature roadmap follows HashiCorp and IBM; confirm your use against the license text
OpenTofu (MPL 2.0)Mozilla Public License 2.0, a permissive file-level copyleft license, under Linux Foundation stewardshipRemoves the BSL restriction question for the CLI itself, since the code is MPL 2.0Compatibility with future Terraform releases is not guaranteed; the FAQ aims for feature parity while the community decides which features to adopt
Terrakube (Apache 2.0) with OpenTofu or TerraformApache 2.0 for the run and state platformKeeps remote runs and state on your infrastructure, and documents both OpenTofu and Terraform as the CLIConfirm which Terraform or OpenTofu version each workspace uses and how it handles your provider mirror
Atlantis (Apache 2.0) with OpenTofu or TerraformApache 2.0 for pull request automationRuns plans from pull requests in your own environment and documents OpenTofu supportAtlantis focuses on pull request plan and apply, so confirm how it covers state access and approvals you need
OpenTofu features added after the forkIncluded in the MPL 2.0 codebaseExamples include state and plan encryption, early evaluation of variables and locals, provider for_each and the -exclude flagConfigs that use these features may not run on Terraform, so check the divergence before any move back
Governance and project statusOpenTofu is a CNCF Sandbox project, accepted April 23, 2025 (CNCF)Gives a neutral foundation and public governance for the forkSandbox is an early maturity level; ask your vendors and auditors how they assess it
Terraform under IBM ownershipIBM completed its acquisition of HashiCorp on February 27, 2025 (IBM newsroom)Changes the commercial owner of the license terms and roadmapConfirm with procurement how ownership affects support terms and product direction
Current HCP Terraform Free planLegacy Free plan ends March 31, 2026, with organizations moved to the enhanced Free tierRelevant if your Terraform runs currently sit on a hosted free planCheck your account's status and the limits of the tier you are moved to

How far OpenTofu can replace Terraform without rewriting code

OpenTofu presents itself as a drop-in replacement for Terraform that preserves existing workflows and configurations, so for most teams the switch is a change of CLI rather than a rewrite. The OpenTofu website states that aim, but it is a statement of intent about the current codebase, not a guarantee for every future release. Before you commit, run tofu plan against your real stacks and confirm that the plan output matches your existing Terraform plans with no unexpected changes. Pay particular attention to modules and providers that your legal or platform teams have pinned, because those are where small differences tend to surface.

Since the fork, OpenTofu has added language and CLI features that Terraform does not have. Early evaluation of variables and locals arrived in v1.8, and provider for_each and the -exclude flag arrived in v1.9. State and plan encryption, introduced in v1.7, lets you encrypt state at rest with key providers such as AWS KMS, GCP KMS, OpenBao and Azure Vault. The OpenTofu Registry lists more than 3,900 providers and 23,600 modules, which covers most public provider needs, but you should check the specific providers and private modules your organization depends on rather than assume coverage. Any configuration that adopts these features is one that Terraform may not be able to read, so decide early whether you want to stay within the shared subset.

The project states an aim of feature parity with Terraform while its community decides which features OpenTofu adopts, so future releases of the two tools may diverge. Treat compatibility as something to verify on each upgrade, not something to assume once. Pin CLI versions in your pipelines, keep a canary workspace that runs both the new and current versions, and read release notes before moving production stacks. If your roadmap depends on a specific Terraform feature, ask the vendor or your implementation partner to confirm its status in OpenTofu before you plan the migration.

How to move from Terraform to OpenTofu if the license requires it

This sequence takes an organization from Terraform under the Business Source License to OpenTofu, with state, pipelines and dependencies checked at each step so the move can be reversed if a check fails.

  1. Confirm the license position with counsel

    Legal counsel reviews the Business Source License terms against how your company uses Terraform, including internal production use, any customer-facing service built on Terraform, and any embedded or resold tooling. The output is a short written decision that records whether you stay on Terraform or move to OpenTofu, and why. Do not start the technical steps until that decision is signed off by the people who own the risk.

  2. Inventory configurations, state and dependencies

    The platform team lists every root module, workspace, backend and Terraform version in use, then searches the codebase for terraform_remote_state data sources. Those references tie one configuration's outputs to another's state, so they need to be mapped before any change. The output is an inventory that names each state location and each cross-state dependency, and every item has an owner.

  3. Export state and back up code

    Before any change, the team takes a full backup of the code and of the state for each workspace. For HCP Terraform, state is read through the state versions API, which includes a JSON state download for states created by Terraform 1.3 or later, so that is how state leaves the platform. Store the backups in a location the platform team controls, and confirm that each file opens and that its serial and lineage match the source. Keep the originals untouched.

  4. Install OpenTofu and pin the version

    Engineers install the tofu CLI on a test runner and pin a specific release in the project's version file so every developer and pipeline uses the same binary. Check the release notes against the Terraform version you currently run, since OpenTofu aims for feature parity but does not guarantee compatibility with future Terraform releases. The check is complete when tofu version reports the pinned release on every runner that will execute plans.

  5. Re-initialize against the same backend

    On a copy of one configuration, the team runs tofu init against the existing backend, reviewing the migration prompts and making no state changes beyond what the prompts describe. Remote state, provider versions and modules are checked as they are resolved. Next, the state encryption options are decided, since they affect how state is read after the move. The step is done when initialization succeeds without changing the backend configuration.

  6. Verify with a no-change plan

    The engineer runs a plan on each migrated configuration and expects no resource changes. Any unexpected diff is investigated before the next workspace moves, because it can indicate a provider difference, a variable change or a state problem. The migration overview describes the process as designed to be safe and reversible, so keep the Terraform binary and the state backups available until the verification passes. The output is a written record of the plan result for every workspace.

  7. Test with a small change and update CI

    The team applies one low-risk change in a non-production workspace to confirm that apply works end to end. In parallel, the platform owner points Terrakube or Atlantis at the tofu binary, updates the pipeline images and pull request workflows, and removes Terraform-specific steps. The step closes when a real change has been planned and applied through the new run platform, and the old CI path has been disabled for that workspace.

  8. Retire old access and document the decision

    Once every workspace passes verification, the team revokes HCP Terraform API tokens and workspace access that are no longer needed, and records the final configuration, backend locations and key management in the runbook. Confirm with your legal and compliance owners that the written license decision still matches how the platform is run. The output is a closed change record with the owner, date and evidence for each migrated workspace.

Questions legal and platform teams ask before deciding

Can our company use Terraform internally in production under the BSL?

For ordinary internal use, such as provisioning your own cloud accounts and data centers, the Business Source License is generally aimed at a different target, but the license text decides your case, so have counsel read it. HashiCorp's announcement said that future releases would move to the Business Source License 1.1 and that the main restriction targets vendors offering competitive services. Confirm three points with counsel: which Terraform versions your teams use, whether an internal platform team serves outside customers or subsidiaries under a charge-back model, and whether you embed Terraform in a product you ship. OpenTofu is licensed under the Mozilla Public License 2.0, which avoids this question for the CLI itself.

What counts as a competing offering under Terraform's license?

A competing offering is generally a product or service that gives third parties Terraform functionality in a way that competes with HashiCorp's own commercial offerings, and the exact test comes from the license wording. Patterns that sit closer to that line include:

  • Hosting Terraform runs or state for other companies as a managed service
  • Building a commercial product that bundles Terraform for customers to operate
  • Selling managed automation whose core value depends on Terraform execution

An internal platform team that serves only its own company is on the other side of that line. Borderline cases, such as shared platforms billed to subsidiaries, need a written opinion from counsel before you rely on any interpretation.

Can a consultancy run Terraform for its clients under the BSL?

It depends on what the consultancy does with Terraform, and counsel should settle the answer for the specific arrangement. Writing Terraform code and running it in a client's own cloud accounts, where the client remains the operator, is a different pattern from the following:

  • Operating a Terraform platform that the consultancy hosts for several clients
  • Reselling a managed Terraform run or state service under its own brand

The first pattern looks like professional services for a client's internal use. The second and third sit closer to the offering the license restricts. Under OpenTofu's MPL 2.0 license, the CLI carries no such restriction. DeployOpen implements self-hosted open-source platforms inside the client's own infrastructure, so the client keeps operational control of the run and state layer.

What drives the effort of switching from Terraform to OpenTofu?

Effort is driven mainly by the state and dependencies around the CLI, and the binary swap itself is small. The main drivers are:

  • State volume: the number of workspaces and state files, and whether they sit in HCP Terraform or a self-managed remote backend
  • terraform_remote_state dependencies: OpenTofu's migration guide warns that configurations sharing data this way need extra care
  • CI changes: runner images, plan and apply scripts, and any hard-coded calls to the terraform binary
  • Provider and module resolution: confirming pinned versions and private registry modules still resolve
  • Team training: engineers need to learn the tofu command set and any new state encryption options

For HCP Terraform states, the state versions API offers a JSON download for states created by Terraform 1.3 or later. Build a per-workspace inventory before you estimate effort, because that inventory sets the scope.

Can our own team migrate from Terraform to OpenTofu in-house?

Yes, a team with few workspaces, simple dependencies and an engineer who owns CI can often complete the CLI migration itself. OpenTofu's migration overview describes four steps: back up state and code, install OpenTofu, initialize and verify the configuration, and test with a small change. The project describes the process as designed to be safe and reversible, but each step stays low risk only when someone checks its output. The harder part is the operating layer. A run and state platform such as Terrakube or Atlantis needs access control, backups, upgrades and monitoring, and your team owns all of those after the migration. Count that ongoing work before deciding in-house.

What should we ask a partner for in a fixed-scope quote?

Ask for a written scope that names the workspaces, platform components and environments included, along with deliverables and a timeline agreed before work starts. Useful items to request are:

  • An inventory of workspaces, state files, providers and modules in scope
  • The target architecture: OpenTofu version, Terrakube or Atlantis, state backend and where each component runs
  • How terraform_remote_state dependencies and CI changes will be handled
  • The state encryption approach, the key provider and who holds the keys
  • Backup, test and rollback steps, with clear acceptance criteria
  • Documentation, handover and any ongoing support, which is usually a separate retainer

DeployOpen works on fixed-scope engagements with scope, deliverables and timelines agreed in writing first, and it does not publish a price list, so the quote follows from that written scope.

Does the HCP Terraform Free plan change affect our costs?

It matters if your organization was on the legacy free plan, which HashiCorp announced on December 17, 2025 would reach end of life on March 31, 2026. Remaining organizations moved automatically to the enhanced Free tier, which allows up to 500 managed resources with unlimited users. Paid HCP Terraform tiers bill per managed resource, and HashiCorp's pricing page lists Essentials at $0.10, Standard at $0.47 and Premium at $0.99 per resource per month, while Terraform Enterprise is custom priced. Check your current plan and managed resource count in your own account, since cost grows with that count. A self-hosted platform replaces those subscription fees with infrastructure, staffing and support costs that you must model yourself.

What to keep on file to show a license decision was reasoned

The first record a legal or procurement reviewer will ask for is a written license review signed off with counsel. It should quote the Terraform license terms in force for the versions you run, not a summary, and answer the questions that matter for your company: whether internal production use is covered, whether any product or service you sell could be read as a competitive offering, whether you embed or redistribute Terraform in anything you ship, and whether your support arrangements with vendors change the answer. Counsel should date the review and name the Terraform version it covers, because the license applies to releases from 1.6.0 onward and older versions carry different terms. The review is a legal document prepared by your lawyers, and DeployOpen does not provide legal opinions on it.

The second record is a usage inventory. Reviewers want to see how Terraform is used, not only that it is used. List each workspace or repository, the Terraform version it pins, whether it runs in internal pipelines, developer machines or customer-facing environments, and any place Terraform output or tooling reaches outside the company, including managed services built on top of it. Note which teams own each item and which state backends hold the data. This inventory is the factual basis for the counsel review, so it should be completed before the memo is drafted, and it should be refreshed when new pipelines or providers are added.

The third record is a decision memo that connects the two. It states the options considered (stay on Terraform under the Business Source License, or move to OpenTofu under the Mozilla Public License 2.0), the criteria, the cost components and who pays for each, and the recommended path with its named owner and review date. If you choose OpenTofu, add migration test evidence: the state backup and checksum record, the output of a no-change plan after the switch, and the results of any terraform_remote_state dependency checks, as described in the OpenTofu migration guide. DeployOpen can prepare this evidence and the test records as part of a fixed-scope engagement, but the memo must be approved by your own accountable owners and reviewed by counsel. Independent auditors and certification bodies, not DeployOpen, decide whether any of it satisfies an assessment.

How DeployOpen works on this

DeployOpen is a Chainscore Labs company that plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For teams deciding whether the Terraform license change affects them, we start with a written scope that separates the legal questions for counsel from the platform questions we can answer through a migration plan.

How we scope

  • Written scope agreed before work starts, listing which Terraform versions, teams and workspaces are in view
  • Inventory of how Terraform is used today, including CLI versions, remote backends and any terraform_remote_state dependencies
  • Clear list of questions for your legal team, such as whether your use fits the production and competitive offering terms
  • Fixed-scope engagements, with deliverables and timelines confirmed in writing before any change

How we build

  • Proof-of-concept of OpenTofu with a chosen run and state platform, either Terrakube or Atlantis, in your own cloud or data center
  • Configuration of state storage, access controls and state encryption against your key management choices
  • Test migration on a small, non-critical workspace with a no-change plan used as verification
  • Security testing of the self-hosted platform, including its access paths and secrets handling, where in scope

How we hand over

  • Runbooks covering installation, upgrades, state recovery and rollback to Terraform if your legal position changes
  • Documented decision record showing the options considered, the chosen platform and the open questions handed to counsel
  • Evidence and configuration records prepared for your compliance assessors, which independent auditors then evaluate
  • Knowledge transfer sessions for platform and security engineers who will run the system after handover

How we support

  • Ongoing support, upgrades and continuous testing available as a retainer after handover
  • Tracking of OpenTofu and Terrakube or Atlantis releases so your upgrade plan stays current
  • Periodic review of your Terraform and OpenTofu usage as your license position or product needs evolve
  • Support scope and response arrangements confirmed in the written agreement, with pricing from a quote based on that scope

Sources and further reading

Talk to our team.

Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.

  • 30-minute call: free, with no obligation.
  • NDA on request: we can sign before you share details.
  • Clear next steps: a scope and plan after the call.