HashiCorp did not stop publishing source code. On August 10, 2023, it announced that future releases of Terraform, Vault, Consul and other products would move from the Mozilla Public License 2.0 (MPL 2.0) to the Business Source License 1.1 (BSL). The source remains available, and HashiCorp says internal use, ordinary consulting and many self-hosted deployments remain permitted. The contentious change is the additional restriction on certain competitive commercial offerings.
Existing releases made under MPL 2.0 remain governed by that license. OpenTofu emerged from the dispute as a Terraform-compatible fork for organizations that want an open-source licensing foundation.
As an Amazon Associate I earn from qualifying purchases.
What changed in 2023?
HashiCorp’s core tools became widely used under MPL 2.0 while the company built hosted and enterprise products around them. HashiCorp said cloud providers and other vendors could commercialize those tools without contributing proportionally to their development. On August 10, 2023, it announced that future releases would use BSL 1.1 instead.
The announcement covered Terraform, Vault, Consul, Boundary, Nomad, Waypoint, Packer and Vagrant, among other products and libraries. The exact terms can differ by product, repository, component, edition and release, so check the relevant LICENSE file, copyright headers, release notes and HashiCorp’s licensing FAQ.
#1 Best Overall
Developers and vendors objected to the change because it was made by the copyright holder rather than through a conventional community governance process, and because “competitive offering” can be difficult to classify. The OpenTF initiative formed in response and became OpenTofu. IBM announced an agreement to acquire HashiCorp on April 24, 2024, for approximately $6.4 billion in enterprise value. That acquisition changed corporate ownership, but it did not cause the 2023 license decision.
MPL 2.0 and BSL 1.1: the practical difference
| Issue | MPL 2.0 | BSL 1.1 |
|---|---|---|
| License category | Open-source license | Source-available business license |
| Commercial use | Generally allowed, subject to license obligations | Additional-use restrictions can limit competitive commercialization |
| Modification and redistribution | MPL copyleft and notice requirements apply | BSL terms, additional-use grant and other conditions apply |
| Competitive hosted product | Generally possible under the license | May be prohibited or require separate permission |
| Future licensing | Rights for released code remain under MPL 2.0 | Usually includes a change date and later licensing mechanism; inspect the exact version |
| Main compliance question | Are copyright, notices and file-level copyleft obligations met? | Is the use a restricted competitive offering, embedding or hosted service? |
BSL software can be free to download and use in many circumstances. “Free” describes price; “open source” describes legally granted rights. The Open Source Initiative’s explanation of delayed-open licensing is available at opensource.org. Calling BSL software “closed source” is therefore imprecise: HashiCorp publishes source, but the license does not provide the broad rights required for an OSI-approved open-source license.
What HashiCorp says users can still do
HashiCorp describes its FAQ as binding interpretive guidance. Read that guidance together with the license text when assessing a real deployment.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Internal infrastructure: use Terraform in an organization’s own CI/CD systems to provision its own cloud accounts and services.
- Internal platforms: host Vault, Consul or related products for the organization’s own employees and systems.
- Consulting and professional services: install Terraform for a client, write modules, design infrastructure, operate a client’s environment, provide training or deliver support.
- Noncompetitive components: integrate HashiCorp software into an internal system that is not itself a competing commercial product.
- Older releases: continue using versions released under MPL 2.0 according to that license.
“Internal” does not simply mean “behind a login.” A service sold to external customers remains an external commercial offering even when it runs in a private cloud or customer VPC.
Rank #2
Where the uncertainty begins
The central BSL question is whether an offering competes with a HashiCorp commercial product or service. The answer depends on the product’s purpose, how customers access it, whether HashiCorp functionality is embedded or exposed, and the relationship to HashiCorp’s paid offerings.
- A managed Terraform-compatible service.
- A cloud platform offering Terraform as one of its infrastructure services.
- A proprietary control plane that embeds Terraform as a core capability.
- A commercial developer tool packaging HashiCorp functionality for customers.
- A consultancy that has evolved from client services into a general-purpose hosted platform.
- An orchestration product that exposes HashiCorp functionality to multiple paying customers.
HashiCorp says its guidance permits ordinary consulting and internal use. OpenTofu’s FAQ argues that the license and additional-use grant can remain ambiguous in future competitive situations. Neither position is an independent court ruling. Customer-facing platforms, embedded products and hosted services warrant legal and commercial review.
Who is most affected?
- Terraform-compatible SaaS vendors: their core service may look directly competitive.
- Cloud and infrastructure-management companies: offering Terraform-based provisioning as a product can raise embedding and competition questions.
- Commercial tools built around HashiCorp products: the architecture and customer-facing functionality matter more than the product label.
- Consultancies with managed platforms: client-specific professional services are different from selling a general-purpose provisioning service.
- Ordinary internal users: they are generally less affected under HashiCorp’s stated interpretation, provided the use stays internal and the exact version is compliant.
Are older Terraform versions still usable?
Existing MPL-licensed releases remain under their original terms. OpenTofu identifies Terraform state compatibility up to state files created with Terraform 1.5.x, which is significant because the pre-BSL Terraform line became the basis for the fork.
Staying on an older version is not automatically the best answer. It can mean missing later features, fixes and security updates; encountering provider or state compatibility issues; carrying extra maintenance work; and explaining unsupported software to auditors or procurement teams. Identify the exact release, inspect its license and support status, and decide whether its operational and security horizon is acceptable.
What happened with OpenTF and OpenTofu?
OpenTF was organized in response to the BUSL change and became OpenTofu, now a Linux Foundation project. OpenTofu aims to remain Terraform-compatible while preserving an open-source license.
- It can use existing Terraform state files up to Terraform 1.5.x.
- It is intended to work with current Terraform providers.
- It uses a separate registry.
- Provider licenses remain controlled by provider authors, not automatically by Terraform or OpenTofu.
Compatibility is an objective, not a promise of identical behavior. Check language features, state handling, provider installation, registry addresses, backends, CLI behavior, enterprise integrations and third-party platforms in a proof of concept. Migration also requires testing, documentation updates, staff training and a rollback plan.
What about Terraform providers?
A provider is generally a separate plugin maintained by a cloud vendor, software company or community project. HashiCorp’s FAQ and OpenTofu’s FAQ treat provider licensing separately from Terraform core. Changing Terraform’s license did not automatically relicense every provider.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsFor each provider, review its repository license, registry source, redistribution terms and OpenTofu compatibility. Also check whether it relies on Terraform-specific APIs or behavior. The same review applies to modules, backends and ancillary tools.
IBM’s role
IBM announced its HashiCorp acquisition on April 24, 2024. IBM support materials now list IBM HashiCorp products including Terraform, Vault, Consul, Nomad and Boundary. The documented sequence is straightforward: HashiCorp announced the BSL move in 2023; IBM announced the acquisition in 2024.
There is no cited evidence that IBM caused the license change, will tighten it, or will reverse it. Treat predictions about future licensing, packaging or product strategy as speculation unless IBM or HashiCorp documents them.
A decision framework for your organization
Use this worksheet before selecting a version, platform or migration path:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- Identify the product and exact version. Record the repository, edition and release date.
- Read the applicable terms. Check the version’s license file, headers, release notes and the HashiCorp FAQ.
- Map the users. Is the software used only by your organization, or is functionality delivered to paying external customers?
- Describe the architecture. Is HashiCorp code embedded, hosted, exposed through an API or used only as an internal tool?
- Assess competition. Could a reasonable description of the offering resemble a HashiCorp commercial product?
- Review dependencies. Check provider, module, backend, registry and integration licenses independently.
- Set the support requirement. Decide whether an older MPL release can receive the fixes and support your security and compliance programs require.
- Test alternatives. Validate OpenTofu or another platform with representative state, providers, modules, CI/CD jobs and backends.
- Obtain advice where needed. Have counsel review customer-facing, embedded, hosted or potentially competitive offerings.
Choosing a path
Remain with HashiCorp or IBM products
This is usually the least disruptive choice when use is clearly internal, existing workflows are stable, and HCP Terraform, Terraform Enterprise, Vault, Consul or related offerings provide required governance and support. Confirm that any commercial product architecture has been reviewed.
Evaluate OpenTofu
OpenTofu is a strong candidate when open-source licensing is a strategic requirement, reducing dependence on one vendor’s future decisions matters, or the organization is building a platform that could be viewed as competitive. Budget for compatibility testing, migration work, support and training.
Evaluate Pulumi
Pulumi uses general-purpose languages such as TypeScript, Python, Go, C#, and Java. It can suit teams wanting richer programming abstractions, testing and software-engineering workflows. It is not a drop-in Terraform fork: infrastructure code, state and team practices may need substantial changes. See Pulumi’s pricing page for current plans.
Evaluate a management platform
Scalr, Spacelift and env0 can be considered when the main need is policy, approvals, drift management and team governance around Terraform or OpenTofu workflows. Review whether each supports your chosen engine, where agents run, how state and secrets are handled, and whether its architecture depends on BSL-licensed components. Official pages include Scalr, Spacelift, Spacelift pricing, env0 and env0 pricing.
Common misconceptions
- “It is free, so commercial use is unrestricted.” Price and license rights are different.
- “We expose only an API.” API exposure can still involve embedding or hosting functionality; examine the architecture.
- “Private means internal.” A private deployment serving external customers is still customer-facing.
- “We use Terraform only for clients.” Client-specific consulting may be permitted, while a general-purpose managed platform may require review.
- “A fork of the last MPL version can copy every later feature.” Later BSL code has different restrictions; provenance and clean-room review are essential.
- “OpenTofu is identical to Terraform.” It aims for compatibility, but differences can appear in features, providers, state, registries, backends and integrations.
- “Providers inherit Terraform’s license.” Providers are separate projects and must be checked independently.
- “IBM changed the license.” The BSL announcement predates IBM’s acquisition announcement.
Bottom line
The key question is not whether Terraform is free to download. It is whether your organization needs broad open-source rights for a product or service that may compete with HashiCorp, or whether it is using a specific HashiCorp release internally. Internal automation, self-hosting and ordinary consulting remain within HashiCorp’s stated permitted uses; customer-facing, embedded and competitive offerings need a version-specific legal review. Organizations that require a permanently open-source foundation should evaluate OpenTofu and test the migration rather than assuming either an old Terraform release or a future license change will solve the issue.
This is an explanatory overview, not legal advice. License interpretation depends on the exact release, repository, architecture, contracts and jurisdiction.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
