Terraform Cloud alternatives in 2026: what to look for

What changed with Terraform Cloud

Terraform Cloud is now called HCP Terraform, and three changes have pushed teams to look at alternatives:

• Licensing. In August 2023 HashiCorp moved Terraform from the open-source MPL 2.0 to the Business Source License, starting with Terraform 1.6. The community fork, OpenTofu, kept the MPL 2.0.
• Pricing. Paid HCP Terraform plans bill per resource under management. Costs grow with the size of your state, not with the number of people or runs.
• The free plan. The legacy free plan reached end of life on March 31, 2026. Remaining organizations moved to a free tier capped at 500 managed resources. A single Kubernetes cluster with its network, IAM roles, and node groups can use a large share of that.

HashiCorp is also now part of IBM. None of this makes HCP Terraform a bad product, but it is a good moment to check whether it is still the right one for you.

What a Terraform Cloud alternative must do

Replacing Terraform Cloud means replacing everything it did for you, not just the state file. Check any option against this list:

1. Remote state with locking, version history, and a way to download or restore any version.
2. Remote runs that plan and apply in a clean, isolated environment rather than on a laptop.
3. Pull request plans posted back to your Git provider, so reviewers see the change before it merges.
4. Approvals that bind to the exact plan someone reviewed, so the apply can't drift from what was approved.
5. Policy as code that checks every plan before approval.
6. Short-lived cloud credentials through OIDC federation, instead of long-lived access keys stored as variables.
7. A private module registry for shared modules.
8. Identity and audit: SSO, SCIM, roles, and an audit log your security team can read.
9. An API for automation, and a CLI workflow that still feels like plan and apply.
10. A way out. You should be able to take your state and leave with ordinary commands.

The three kinds of alternatives

1. Build it yourself

Store state in an object storage backend such as S3, Google Cloud Storage, or Azure Blob Storage, and run plans and applies from CI or an open-source pull request bot such as Atlantis. You pay only for compute and storage.

The cost is everything on the checklist above that you now own: locking, approvals that bind to a plan, policy checks, credential federation per workspace, audit, and keeping the runners patched. It works well for a small number of stacks and a team that enjoys running its own platform.

2. A commercial infrastructure automation platform

Several vendors sell Terraform and OpenTofu automation with broad feature sets: drift detection, multiple VCS providers, self-hosted agents, and more. Look closely at the billing model (per run, per user, per resource, or per concurrency), at whether they speak the native cloud block protocol, and at which policy language they use.

3. A managed OpenTofu platform

If you are already on OpenTofu, or ready to move, a platform built for it can be a drop-in replacement for the Terraform Cloud workflow. This is where StackShip fits.

Questions to ask before you switch

• Does it support the cloud block? If it does, migrating a workspace is a hostname change plus a tofu state push. If not, every configuration needs a new backend block.
• How does billing grow? Model your next two years of resources, runs, and users, not just today.
• Which policy language? Sentinel is specific to HashiCorp. Open Policy Agent (Rego) is an open standard that you can test locally and reuse elsewhere.
• Is apply bound to the approved plan? Some tools re-plan at apply time, so what runs can differ from what was reviewed.
• Where do cloud credentials live? Prefer federation with short-lived tokens over stored keys.

Where StackShip fits

StackShip is a managed OpenTofu platform that speaks the same cloud block protocol as Terraform Cloud. It provides remote state with history, isolated runs, pull request plans as GitHub checks, OPA policy checks, required approval bound to the exact plan, short-lived AWS, Google Cloud, and Azure credentials, a private module registry, SSO and SCIM, and an MCP server for AI agents. It is free for every organization.

To be clear about the limits:

• StackShip runs OpenTofu 1.6.0 and newer, not Terraform binaries.
• GitHub is the supported Git provider.
• Every plan with changes needs a human approval. There is no auto-apply.
• Sentinel policies need to be rewritten in Rego.

See the full StackShip and Terraform Cloud comparison for a feature-by-feature table.

How to switch without a big-bang migration

Move one workspace at a time, starting with something low-risk. For each one: stop writes to the old workspace, export its state, point the cloud block at the new platform, push the state, and confirm that tofu plan shows no changes. The step-by-step migration guide walks through every command.