Blog
OpenTofu and Terraform guides.
Practical guides for teams running OpenTofu and Terraform: choosing a platform, migrating, policy as code, and cloud credentials.
Terraform Cloud alternatives in 2026: what to look for
HCP Terraform's legacy free plan ended March 31, 2026. What a Terraform Cloud alternative must do, the main options, and how to switch safely.
Read the guideOpenTofu vs Terraform: the differences that matter
OpenTofu vs Terraform: license, governance, compatibility, OpenTofu-only features like state encryption, and how to switch an existing configuration safely.
Read the guideHow to migrate from Terraform Cloud to OpenTofu, one workspace at a time
Step-by-step: move a workspace from Terraform Cloud (HCP Terraform) to OpenTofu and StackShip with tofu state pull and state push, then verify and cut over.
Read the guideOPA policy for OpenTofu and Terraform plans, with Rego examples
Open Policy Agent (Rego) policies that check every Terraform or OpenTofu plan: required tags, protected databases, opa test, and Sentinel vs OPA.
Read the guideDeploy with OpenTofu and Terraform without cloud access keys
Give OpenTofu and Terraform runs short-lived AWS, Google Cloud, and Azure credentials with OIDC federation instead of stored access keys.
Read the guideTerraform Enterprise alternatives: what enterprises should weigh
Terraform Enterprise alternatives: the real cost of self-hosting, what enterprises need from a hosted platform, and when self-hosting is still right.
Read the guideAtlantis alternatives for OpenTofu and Terraform pull request automation
Atlantis runs OpenTofu and Terraform from pull request comments on a server you host. What it does well, where teams outgrow it, and the alternatives.
Read the guideOpenTofu in GitHub Actions vs a managed platform
Run OpenTofu plan and apply in GitHub Actions with OIDC and an S3 backend, what you must build yourself, and when a managed platform is the better fit.
Read the guideHow to convert Sentinel policies to OPA and Rego
Convert HashiCorp Sentinel policies to Open Policy Agent (Rego): a concept map, a side-by-side rewrite of a common policy, and how to test the result.
Read the guideTerraform approval workflows: apply exactly the plan you approved
Why a Terraform or OpenTofu approval should bind to the exact plan: saved plans, stale plans, auto-apply risks, and how to design an approval workflow.
Read the guideThe Terraform and OpenTofu cloud block, explained
The Terraform and OpenTofu cloud block explained: hostname, organization, workspaces, tofu login, TF_TOKEN_ environment variables for CI, and common errors.
Read the guideTerraform and OpenTofu state locking, explained
How Terraform and OpenTofu state locking works, which backends lock, how to clear a stuck lock with force-unlock, and how to protect state secrets.
Read the guideTerraform workspaces and environments: how to structure dev, staging, and production
Terraform CLI workspaces vs platform workspaces, and how to structure dev, staging, and production in OpenTofu: directories, workspaces, and shared outputs.
Read the guideA private Terraform and OpenTofu module registry, published from GitHub tags
Share OpenTofu and Terraform modules with a private registry: Git sources vs registry versions, semver tags, version constraints, and deprecating releases.
Read the guideAn MCP server for OpenTofu and Terraform: letting AI agents run infrastructure safely
Give Claude, Cursor, or VS Code agents safe access to OpenTofu and Terraform runs with an MCP server: OAuth scopes, roles, plan-bound approvals, and audit.
Read the guide
Get started
Run your first plan today.
Free for every organization. Sign up with email or Google.