Terraform Enterprise alternatives: what enterprises should weigh
Terraform Enterprise is the self-hosted edition of Terraform Cloud. Teams choose it for control, then spend a lot of time running it. Here is how to weigh the alternatives, including when self-hosting is still right.
Why teams pick Terraform Enterprise
- Runs and state stay inside their own network and accounts.
- Runs can reach private resources such as internal APIs and databases.
- Security reviews start from "we host it".
- It supports air-gapped environments.
What self-hosting really costs
The license is only part of it. Someone on your team also owns:
- the application, its database, object storage, and backups;
- upgrades, which you schedule, test, and roll back yourself;
- capacity for run workers as the number of workspaces grows;
- certificates, monitoring, and on-call; and
- disaster recovery, since state for every environment lives there.
On top of that, Terraform Enterprise runs Terraform, which has been under the Business Source License since version 1.6.
What an enterprise needs from a hosted platform
| Requirement | What to check |
|---|---|
| Identity | SSO over OIDC and SAML, SCIM provisioning, and clear roles |
| Change control | Required approval bound to the plan, and policy as code |
| Cloud access | Short-lived federated credentials; no stored keys |
| Isolation | A fresh, single-use environment for every plan and apply |
| Audit | An audit log with an API, covering approvals and state reads |
| Data residency | A choice of where runs execute |
| Exit | State downloads and an open engine, so you can leave |
How StackShip covers it
- Identity: email and password, Google, enterprise SSO over OIDC and SAML 2.0 with verified domains, SCIM provisioning, and owner, admin, and member roles. See SSO and SCIM.
- Change control: every plan with changes needs an owner or admin to approve it, and the apply runs that exact plan. Open Policy Agent policies check every plan.
- Cloud access: AWS, Google Cloud, and Azure through short-lived federation scoped per workspace and run phase.
- Isolation: each plan and apply runs in a fresh Linux environment that is discarded afterwards.
- Audit: approvals, overrides, credential changes, state downloads, and more, readable in the dashboard and through the API. Events never contain secret values or state.
- Regions: six execution regions across North America, Europe, Asia-Pacific, and South America. A workspace's runs never move out of its region.
- Exit: OpenTofu is open source, and any state version can be downloaded.
When self-hosting is still the right call
Be honest about the limits of any hosted platform, including ours:
- Private networks. StackShip runs can't reach resources that are only reachable inside your VPC or data center.
- Air-gapped environments. Hosted platforms need the internet.
- Contractual hosting requirements that say runs and state must stay in your accounts.
If none of these apply, a hosted platform removes a whole system from your on-call rotation. Read how StackShip handles security, or compare it with Terraform Cloud.