There is no single best replacement for OpenTofu. Pulumi is worth evaluating when you want general-purpose languages or broad cloud and SaaS coverage; AWS CDK and CloudFormation fit infrastructure managed entirely on AWS; and Crossplane is aimed at teams building a Kubernetes-centered platform. The right choice depends on more than syntax: compare cloud scope, state and secrets, deployment workflow, governance, and the amount of existing configuration you can retain.
Which OpenTofu alternative fits your environment?
| Option | Best fit | What changes from OpenTofu |
|---|---|---|
| Pulumi | Teams seeking general-purpose programming languages or broad cloud and SaaS coverage | Can use languages such as Python, TypeScript, JavaScript, Go, .NET, and Java, as well as YAML and HCL. State and collaboration options differ. |
| AWS CDK and CloudFormation | Infrastructure managed entirely on AWS | CDK code is synthesized into CloudFormation templates, and CloudFormation deploys them. The model is AWS-specific. |
| Crossplane | Kubernetes-centered platform teams | Infrastructure is declared through Kubernetes APIs and YAML and reconciled through a Kubernetes control plane, rather than managed solely through a CLI-centered workflow. |
These are different operating models, not interchangeable syntax choices. AWS Prescriptive Guidance says there is no one-size-fits-all approach to IaC selection; its recommendations are specifically framed around AWS environments. Read the AWS guidance.
As an Amazon Associate I earn from qualifying purchases.
Pulumi: keep some HCL or move to programming languages
Pulumi provisions resources across cloud providers and SaaS platforms. Its documented authoring options include Python, TypeScript, JavaScript, Go, .NET, Java, YAML, and HCL. For teams considering a move from OpenTofu, Pulumi documents an HCL runtime that can run existing .tf files, with exceptions, and says it resolves providers against the OpenTofu registry by default. It also documents a way to convert OpenTofu or Terraform providers into Pulumi SDKs. These routes may reduce rewriting, but they do not guarantee that a particular configuration or provider will work unchanged; validate the actual estate before committing to migration. See Pulumi’s OpenTofu comparison and compatibility details.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesAccount for state, secrets, and collaboration
Pulumi Cloud manages state by default, while Pulumi also documents self-managed storage options such as object storage and local files. OpenTofu uses self-managed state by default and can use remote backends or third-party managed services. Pulumi documents first-class secret values and encryption settings; OpenTofu added state and plan encryption in version 1.7. Audit and collaboration capabilities for OpenTofu may depend on hosted or external services, so compare the complete service arrangement rather than assuming the CLI alone provides them.
#1 Best Overall
Check licensing as well as compatibility
Pulumi’s CLI and SDKs are open source under Apache 2.0, while Pulumi Cloud is a commercial offering. The comparison describes OpenTofu as an MPL 2.0 project governed by the Linux Foundation. Licenses and project terms can change; consult the current project notices before making a decision based on licensing.
AWS CDK and CloudFormation: for AWS-only infrastructure
AWS CDK lets developers define AWS infrastructure in supported programming languages. It synthesizes that application into CloudFormation templates, which the CloudFormation service deploys. That makes CDK a candidate when the estate is entirely on AWS and the team accepts CloudFormation as its deployment foundation—not a general multi-cloud substitute for OpenTofu. AWS Prescriptive Guidance recommends CDK or CloudFormation for infrastructure managed entirely on AWS, citing native state management and the ability to use new AWS features and resources. Review Pulumi’s CDK comparison and AWS Prescriptive Guidance.
Before choosing, consider whether your team already uses CloudFormation patterns, how it will review synthesized templates, and how it will operate deployments and troubleshoot failures in CloudFormation. Language choice alone does not remove those operational responsibilities.
Crossplane: for infrastructure exposed through Kubernetes
Crossplane is relevant when the goal is to build a platform around Kubernetes APIs. Teams declare resources using Kubernetes YAML and install providers into a cluster as packages. This is a control-plane approach: it calls for a Kubernetes environment and the ability to operate it, unlike a workflow centered on running an IaC CLI to plan and apply changes.
Rank #3
Crossplane v2 was released in August 2025. The comparison source describes v2 as making composite and managed resources namespaced by default, removing the separate claim concept, replacing patch-and-transform composition with composition functions, and allowing compositions to include arbitrary Kubernetes resources. Confirm the behavior for the version you plan to deploy in Crossplane’s current documentation. The same source identifies managed control planes and an enterprise distribution from Upbound; check current packaging and support terms directly. See the Crossplane comparison.
Compare the operating model before migrating
Use these questions to narrow the shortlist. A strong match on one dimension does not settle the decision if the tool conflicts with your existing workflows or operating constraints.
- Cloud and service scope: Is the estate AWS-only, multi-cloud, hybrid, Kubernetes-centered, or dependent on SaaS providers? AWS’s recommendations focus on AWS; for other environments, assess provider and service coverage directly.
- Authoring model: Does the team want to keep HCL, write general-purpose code, or manage infrastructure as Kubernetes YAML? Consider fluency, abstraction needs, review and testing habits, and the cost of translating existing modules and workflows.
- State and secrets: Who operates state, where is it stored, how is it encrypted, and which collaboration or audit controls come from the tool versus a hosted or third-party service?
- Execution and recovery: Compare local and remote runs, plan or preview behavior, template synthesis, reconciliation, and how the team will respond to partial failures.
- Ecosystem and governance: Check provider coverage, policy-as-code needs, support model, license, and whether the organization is prepared to operate a separate control plane or hosted service.
- Migration and coexistence: Determine which existing HCL, providers, and configurations can remain, be adapted, or must be rewritten. Test Pulumi’s documented compatibility paths against representative parts of your infrastructure before relying on them.
A practical way to make the choice
- Set the scope. Write down the clouds, SaaS services, and Kubernetes resources the tool must manage now, plus the scope you expect it to support.
- Choose the workflow your team can operate. Decide whether you want a CLI-centered IaC workflow, code synthesized for CloudFormation, or infrastructure managed through a Kubernetes control plane.
- Map state and access requirements. Identify who owns state storage, secrets, collaboration, and audit controls, including any hosted or third-party services required.
- Test migration on a representative slice. Include the providers and patterns that are most important to your existing estate; verify imports, plans or previews, and deployment behavior rather than assuming broad compatibility.
- Compare the whole lifecycle. Evaluate review, deployment, failure recovery, governance, support, and ongoing operations—not only how quickly a small example can be written.
For primary references, consult Pulumi’s OpenTofu comparison, its AWS CDK comparison and Crossplane comparison, alongside AWS Prescriptive Guidance. The Pulumi pages are vendor-authored comparisons; treat product-feature descriptions accordingly.
Recommended Free Tools
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
