AWS CloudFormation vs OpenTofu

AWS CloudFormation models, provisions, and manages related AWS and third-party resources as infrastructure as code. YAML or JSON templates define AWS resources and their properties. StackSets deploy a common set of resources across multiple AWS accounts and Regions; Change Sets preview proposed stack updates, including possible deletion or replacement, and Drift Detection tracks changes made outside the service. For authoring, AWS CDK supports TypeScript, Python, Java, and .NET, while AWS SAM offers shorthand YAML for serverless resources that is converted during deployment. The CloudFormation Registry supports third-party resources and modules, and stacks can be updated from remote Git repositories. The service is available through API, Linux, macOS, web, and Windows, and manages state. CloudFormation itself has a free plan, with no additional charge for AWS and Alexa resource providers, but created AWS resources are billed at their standard rates. Third-party provider and custom hook operations may also incur charges. Access can be managed with IAM, and CloudTrail logs API calls.

OpenTofu is a free infrastructure as code tool for defining cloud and on-premises resources in human-readable configuration files. Its workflow moves from writing configuration to generating a plan and applying approved changes in dependency order. Providers connect it with cloud platforms, SaaS services and APIs, including AWS, Azure, Google Cloud Platform, Kubernetes, Helm, GitHub, Splunk and Datadog. Reusable modules and a public registry support configurable infrastructure collections. OpenTofu tracks resources in a state file, builds a dependency graph and can change independent resources in parallel. Built-in client-side state encryption supports key providers such as PBKDF2, AWS KMS, GCP KMS and OpenBao. Providers can be installed from registries, local mirrors or caches, including for air-gapped environments. OpenTofu is presented as a Terraform replacement that preserves existing workflows and configurations. OCI registries can host modules and serve as a secondary provider source, but not yet the primary source. Official installation options cover Linux, macOS, Windows, FreeBSD and OCI container images.