AWS CDK vs OpenTofu

AWS CDK is a framework for defining AWS cloud application infrastructure with familiar programming languages and deploying it through AWS CloudFormation. Stable bindings are available for TypeScript, JavaScript, Python, Java, C#/.NET, and Go. The AWS Construct Library supplies reusable constructs for AWS services and features. CDK Pipelines supports CI/CD deployment to testing, integration, and production environments. In Visual Studio Code, the AWS CDK Explorer preview can browse projects, stacks, resources, and policies. The tool supports AWS only and provides managed state, policy as code, drift detection, importing existing resources, and self-hosted execution. CDK itself has no charge, although deployed AWS resources may incur charges. Developers need Node.js 22.x or later regardless of application language. Deployments use configured AWS credentials and IAM roles. AWS recommends IAM security practices, and custom constructs cannot guarantee compliance because general-purpose code can bypass their checks.

OpenTofu is a free infrastructure as code tool for defining cloud and on-premises resources in human-readable configuration files. Its workflow moves from writing configuration to generating a plan and applying approved changes in dependency order. Providers connect it with cloud platforms, SaaS services and APIs, including AWS, Azure, Google Cloud Platform, Kubernetes, Helm, GitHub, Splunk and Datadog. Reusable modules and a public registry support configurable infrastructure collections. OpenTofu tracks resources in a state file, builds a dependency graph and can change independent resources in parallel. Built-in client-side state encryption supports key providers such as PBKDF2, AWS KMS, GCP KMS and OpenBao. Providers can be installed from registries, local mirrors or caches, including for air-gapped environments. OpenTofu is presented as a Terraform replacement that preserves existing workflows and configurations. OCI registries can host modules and serve as a secondary provider source, but not yet the primary source. Official installation options cover Linux, macOS, Windows, FreeBSD and OCI container images.