OpenTofu 1.12: How to Migrate from Terraform in 30 Minutes

Introduction

In August 2023, HashiCorp changed the Terraform license from MPL to BSL, triggering the largest fork in DevOps history. Two years later, OpenTofu has 28,000 GitHub stars, full feature parity with Terraform 1.5, and features Terraform never shipped. Version 1.12, released July 2026, adds dynamic prevent_destroy, native state encryption, and a stable provider registry with 3,000+ providers.

If you are still running Terraform, this guide walks you through migrating to OpenTofu in 30 minutes. Same HCL syntax. Same providers. Same state. Just a different binary.

Why Migrate

License certainty. OpenTofu is MPL 2.0, managed by the Linux Foundation. HashiCorp can change Terraform's license again. The Linux Foundation cannot.

Native state encryption. Terraform has no built-in state encryption. OpenTofu 1.12 encrypts state files with AES-256-GCM using a key you provide. No more third-party tools like sops or terraform-encrypt.

Dynamic prevent_destroy. OpenTofu 1.12 evaluates prevent_destroy at plan time, not apply time. You can conditionally prevent destruction based on tags, environments, or cost centers. Terraform's prevent_destroy is a static lifecycle flag - all or nothing.

No migration cost. The migration takes one command: tofu init. Everything else - config, state, providers, modules - works unchanged.

The community has moved. AWS, Cloudflare, and Google maintain official OpenTofu providers. The Terraform registry sees fewer updates each quarter. OpenTofu's provider ecosystem is now larger and more active.

Prerequisites

Terraform installed (any version)
Access to your Terraform state backend (local, S3, GCS, etc.)
A test environment (do not migrate production first)

Step 1: Install OpenTofu

# Ubuntu/Debian
curl -fsSL https://packages.opentofu.org/opentofu/tofu/gpgkey | sudo gpg --dearmor -o /usr/share/keyrings/opentofu.gpg
echo "deb [signed-by=/usr/share/keyrings/opentofu.gpg] https://packages.opentofu.org/opentofu/tofu/any/ any main" | sudo tee /etc/apt/sources.list.d/opentofu.list
sudo apt update && sudo apt install tofu -y

Verify:

tofu version
# OpenTofu v1.12.0

Step 2: Back Up Your State

# Local state
cp terraform.tfstate terraform.tfstate.backup

# S3 backend
aws s3 cp s3://my-bucket/terraform.tfstate s3://my-bucket/terraform.tfstate.backup

# Or create a workspace backup
terraform workspace new tofu-migration

Step 3: Initialize with OpenTofu

In your existing Terraform directory:

tofu init

OpenTofu reads the same backend.tf, downloads the same providers, and connects to the same state. If your backend is S3, GCS, or Azure, it works exactly as Terraform did. No config changes needed.

Step 4: Verify State Integrity

tofu plan

This should show "No changes. Your infrastructure matches the configuration." If you see drift, resolve it with Terraform first before migrating. Do not migrate dirty state.

tofu state list   # same output as terraform state list
tofu output       # same output as terraform output

Step 5: Test a No-Op Apply

tofu apply -auto-approve

This confirms OpenTofu can write to your state backend. The apply should complete with "0 added, 0 changed, 0 destroyed."

Step 6: Update CI/CD Pipelines

Replace terraform with tofu in your pipeline:

# GitHub Actions
- name: OpenTofu Plan
  run: tofu plan -out=tfplan
- name: OpenTofu Apply
  run: tofu apply tfplan

# GitLab CI
opentofu:
  image:
    name: opentofu/opentofu:1.12
  script:
    - tofu init
    - tofu plan
    - tofu apply -auto-approve

Step 7: Update Terraform Cloud / Enterprise Users

If you use Terraform Cloud, migration is a two-step process:

Run tofu login and authenticate to Terraform Cloud (OpenTofu supports the same API)
Migrate state to a different backend if you want full independence:

# Migrate to S3
tofu init -migrate-state -backend-config="bucket=my-bucket" -backend-config="key=terraform.tfstate"

If migrating completely away from HCP, export state first:

terraform state pull > terraform.tfstate
# Update backend.tf to use S3/GCS/Azure
tofu init -migrate-state

OpenTofu-Only Features Worth Using

Once migrated, these tofu-only features improve your workflow:

Native state encryption:

terraform {
  encryption {
    key_provider "pbkdf2" "mykey" {
      passphrase = var.encryption_passphrase
    }
    method "aes_gcm" "encrypt" {
      keys = key_provider.pbkdf2.mykey
    }
    state {
      method = method.aes_gcm.encrypt
    }
    plan {
      method = method.aes_gcm.encrypt
    }
  }
}

Dynamic prevent_destroy:

resource "aws_instance" "web" {
  lifecycle {
    prevent_destroy = var.environment == "production"
  }
}

Provider-defined functions - compute inside HCL:

locals {
  zone = provider::aws::get_availability_zones()[0]
}

Terraform Features Not in OpenTofu

Feature	Status	Workaround
Terraform Cloud run triggers	Not supported	Use GitHub Actions / GitLab CI
Sentinel policy as code	Not supported	Use Open Policy Agent (OPA)
HCP Packer integration	Not supported	Use local or custom registry
`terraform test`	Supported in 1.12	Use `tofu test` (same syntax)

Provider Ecosystem Status

Provider	OpenTofu	Notes
AWS	Full support	Official provider maintained by AWS
GCP	Full support	Official provider maintained by Google
Azure	Full support	Official AzureRM provider
Cloudflare	Full support	Official provider
Kubernetes	Full support	Same hashicorp/kubernetes provider
Helm	Full support	Same hashicorp/helm provider
GitHub	Full support	Same integrations/terraform provider

All major providers work. Niche providers (fewer than 100 stars) may lag behind. Check registry.opentofu.org before migrating if you depend on obscure providers.

Rollback Plan

If something breaks:

rm -rf .terraform .terraform.lock.hcl
terraform init

OpenTofu does not modify your state in a way Terraform cannot read. State format is fully backward-compatible. A rollback takes 30 seconds.

How ServerGurus Helps

Every ServerGurus VPS and bare metal server supports OpenTofu out of the box. We pre-install the OpenTofu binary on Ubuntu 24.04, AlmaLinux 9, and Debian 12. Our managed infrastructure teams run OpenTofu for all internal provisioning. If you need help migrating a large Terraform estate or want a managed IaC pipeline, talk to our team.

Quick Start

# Install
curl -fsSL https://packages.opentofu.org/opentofu/tofu/gpgkey | sudo gpg --dearmor -o /usr/share/keyrings/opentofu.gpg
echo "deb [signed-by=/usr/share/keyrings/opentofu.gpg] https://packages.opentofu.org/opentofu/tofu/any/ any main" | sudo tee /etc/apt/sources.list.d/opentofu.list
sudo apt update && sudo apt install tofu -y

# Migrate
cp terraform.tfstate terraform.tfstate.backup
tofu init
tofu plan
tofu apply -auto-approve

# Verify
tofu state list
tofu output