Terraform is IBM's now, OpenTofu has shipped features Terraform does not have, CDK for Terraform is archived, HCP Terraform's free tier is capped at 500 resources, and AWS CDK gained Mixins. What changed, what each tool costs, and how we choose.
We first wrote this comparison in early 2025. Since then, IBM closed its acquisition of HashiCorp, HashiCorp archived CDK for Terraform, HCP Terraform moved its free tier to a resource cap, OpenTofu shipped three releases, and AWS CDK gained Mixins and a refactor command. The tools are all still good. The tradeoffs moved.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
IBM completed its acquisition of HashiCorp in February 2025.
Terraform 1.10 and 1.11 added ephemeral values and write-only attributes, so secrets no longer have to land in state. Terraform 1.14 (November 2025) added actions, for operations outside create-read-update-delete such as invalidating a CloudFront cache, and terraform query, which lists existing infrastructure and can generate import configuration.
HCP Terraform's legacy free plan ended on March 31, 2026. The free tier now covers up to 500 managed resources with unlimited users and one concurrent run. Paid tiers are billed per managed resource per month.
CDK for Terraform was archived on December 10, 2025. See our post on what to do if you use it.
State encryption at rest, built in (1.7). Terraform still relies on the backend for this.
for_each on provider blocks (1.9), which makes multi-Region and multi-account configurations far shorter.
OCI registry support for providers and modules (1.10), so you can host them in ECR or any container registry.
Ephemeral resources, write-only attributes and an enabled meta-argument that replaces the count = var.x ? 1 : 0 idiom (1.11, December 2025).
OpenTofu reads Terraform configuration and state, and for most teams on Terraform 1.5 or earlier the switch is a binary swap. The two are drifting apart, though: each now has features the other lacks, so code that uses them stops being portable.
The CDK Toolkit Library (GA May 2025) exposes synth, deploy and destroy as a library, so you can drive deployments from your own code and tests rather than shelling out to the CLI.
cdk refactor (September 2025) moves and renames resources between constructs and stacks without CloudFormation replacing them. It removes one of CDK's most painful failure modes.
CDK Mixins (GA March 2026) apply reusable behavior, such as encryption, versioning or a compliance rule, to any construct with .with(), including L1s. Platform teams can enforce standards without wrapping every resource in a custom L2.
AWS CDK: free. CloudFormation is free for AWS resources; third-party resource types bill per handler operation.
Terraform and OpenTofu CLIs: free. The cost is where you run them and store state. HCP Terraform is free to 500 resources and per resource above it; Spacelift, env0, Scalr and others sell alternatives that run both.
Pulumi: the Individual plan is free. Team is $40 a month including 40 credits, with IaC resources at about $0.18 each per month beyond that. You can self-manage state and pay nothing.
AWS-only, team writes TypeScript or Python: CDK. Real abstractions, type checking, tests in the same language as the app, and CloudFormation handles state and rollback. This site and its analytics pipeline are deployed with CDK. The cost is CloudFormation's speed and its occasional stuck stack.
Several clouds or many SaaS providers (Datadog, Cloudflare, GitHub, Okta): Pulumi, by preference. The same reasons we like CDK — real languages, real tests, real abstractions — and it can use Terraform providers, so the ecosystem comes with it. We have built tooling on Pulumi and would pick it over Terraform for anything that isn't AWS-only.
Starting fresh with Terraform-style IaC and no HCP Terraform contract: OpenTofu. Same providers, an open licence, and the features above. Stay on Terraform if you rely on HCP Terraform, Sentinel or a HashiCorp support agreement.
Terraform or OpenTofu instead when the team already writes HCL well, the estate is large and stable, or you depend on HCP Terraform, Sentinel or a HashiCorp support agreement. Tradeoffs, not winners: a team fluent in HCL ships faster in HCL.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Pulumi vs Terraform in 2026: Why We Pick Pulumi When It Isn't Only AWS (and CDK When It Is)
Our rule is short: CDK when everything is on AWS, Pulumi over Terraform when it isn't. Pulumi gives you real languages, real tests and an engine you can call from code, and it can use any Terraform or OpenTofu provider, so the ecosystem comes with it. What Pulumi costs, where Terraform is still the better call, and how to move.
Read
CDK for Terraform Is Archived: Your Four Options and How to Pick
HashiCorp archived CDK for Terraform on December 10, 2025. Existing stacks still deploy, but nothing will be fixed. Export to HCL, move to Pulumi, move to AWS CDK, or adopt the community fork: the effort and risk of each.
Read
As of October 25, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.