Terraform vs OpenTofu vs Pulumi vs Crossplane vs AWS CDK (2026): Best IaC Tool Compared

Choosing an Infrastructure as Code tool in 2026 is harder than it should be. The HashiCorp BSL license change in 2023 fractured the ecosystem. IBM acquired HashiCorp for $6.4 billion in February 2025. OpenTofu emerged as a CNCF sandbox project and crossed 10 million GitHub downloads. Crossplane graduated from CNCF in October 2025 with v2.0 under its belt. Pulumi keeps posting 45% year-over-year growth. And AWS CDK keeps getting better — for AWS-only teams.

After six weeks of testing all five tools across real AWS, Azure, and GCP deployments — provisioning VPCs, EKS clusters, RDS instances, S3 buckets, IAM roles, and Lambda functions — we have a clear winner. Actually, we have four winners. Because the right IaC tool depends on who you are, what you run, and where your team lives.

Here’s exactly what we found.

The Bottom Line Up Front

OpenTofu is the best overall choice for most teams starting new IaC projects in 2026. It’s a drop-in Terraform replacement that runs the same HCL code and uses the same provider registry — but it’s genuinely open-source under MPL 2.0, governed by the Linux Foundation, and shipping features Terraform still doesn’t have. If you’re starting fresh or considering a migration, start here.

Pulumi wins for developer-heavy teams that want real programming languages. TypeScript, Python, Go, C#, Java — Pulumi lets you write infrastructure like application code with full IDE support, type checking, and refactoring. If your team already knows TypeScript, Pulumi will make them dramatically more productive than any HCL-based tool.

Crossplane wins for Kubernetes-native platform engineering teams. If you’re building an Internal Developer Platform (IDP) on Kubernetes and already live in the K8s ecosystem, Crossplane’s reconciliation loop, CRD-based providers, and GitOps-native architecture are unmatched. For everyone else, it’s overkill.

AWS CDK wins for AWS-only shops. If your infrastructure lives entirely in AWS and your team writes TypeScript or Python, CDK gives you the deepest AWS integration with high-level constructs, automatic rollback, and sensible defaults. It’s also completely free.

Terraform (HashiCorp/IBM) still makes sense if you’re deeply embedded in HCP Terraform with managed state, Sentinel policy-as-code, and a team that already knows HCL. But the momentum has shifted. The BSL license, IBM acquisition, and slower feature velocity have opened the door for OpenTofu.

Quick Comparison Table

Tool	Language	License	Multi-Cloud	State Mgmt	Learning Curve	Best For	Starting Price
OpenTofu	HCL	MPL 2.0 (OSS)	Yes	File/S3/Cloud	Medium	Open-source IaC, drop-in TF replacement	Free
Terraform	HCL	BSL 1.1	Yes	File/S3/HCP	Medium	Enterprise IaC with managed platform	Free (CLI), $20/user/mo (HCP)
Pulumi	TS, Py, Go, C#, Java	Apache 2.0	Yes	Pulumi Cloud/S3	Low (if you know the lang)	Developer-first IaC	Free (Individual), $40/mo (Team)
Crossplane	YAML (K8s CRDs)	Apache 2.0	Yes	Kubernetes etcd	High	K8s-native platform engineering	Free
AWS CDK	TS, Py, Java, C#, Go	Apache 2.0	AWS only	CloudFormation	Medium	AWS-native teams	Free

The Big Picture: IaC in 2026

The IaC landscape in 2026 looks nothing like it did three years ago. The HashiCorp BSL license change in August 2023 was the shot heard round the DevOps world. It turned Terraform from an open-source cornerstone into a source-available product, alienated a chunk of the community, and directly spawned OpenTofu as a fork.

Since then:

OpenTofu exploded. 10 million+ GitHub downloads, Linux Foundation governance, CNCF sandbox status since April 2025, and enterprise adopters including Boeing, Capital One, and AMD. The project now ships features Terraform doesn’t have — native state encryption, early variable evaluation, the -exclude flag for targeted plan/apply, and provider for_each. It’s the fastest-growing IaC tool by adoption rate.

Pulumi is on a rocket. 45% year-over-year growth, 22,000+ GitHub stars, and a free Individual tier that covers unlimited resources for solo developers. The Terraform Bridge means you can use Pulumi with existing Terraform providers, removing the biggest adoption barrier. Pulumi Neo, launched in 2025, targets AI/ML infrastructure provisioning — GPU clusters, model registries, vector databases — as a first-class use case.

Crossplane graduated from CNCF in October 2025 and released v2.0 in August 2025. With 67% of organizations planning significant investment in platform engineering in 2026, Crossplane is perfectly positioned as the control plane layer for IDPs.

Terraform still holds roughly 65-70% market share, but it’s declining. The IBM acquisition for $6.4 billion in February 2025 raised questions about roadmap independence. HashiCorp deprecated CDK for Terraform (CDKTF) in 2025, which annoyed the developer community. HCP Terraform pricing shifted to per-resource billing, creating cost headaches for large deployments. Terraform is still the safe incumbent — but incumbents don’t stay safe forever.

AWS CDK keeps getting better for its niche. CDK Refactor (2025) simplified migrating existing CloudFormation stacks to CDK. CDK Migrate imports existing AWS resources. CDK Mixins allow reusable cross-cutting logic. The CLI and Construct Library split into separate version tracks in 2025, accelerating construct releases. But it’s still AWS-only, and CDKTF’s deprecation closed the multi-cloud escape hatch.

AI-assisted IaC is emerging across all five tools. Drift detection is becoming proactive rather than reactive. Policy-as-code is moving from “audit” to “enforce by default.” Pulumi AI, AWS CDK with Amazon Q, and OpenTofu community plugins for LLM-based CLI assistants are the early signs. In 2027, we expect AI-generated plan explanations and automated remediation to be standard.

Terraform (HashiCorp / IBM): The Incumbent

Terraform v1.15.7 was released in June 2026. It’s the most mature IaC tool on the market with the largest provider ecosystem — 4,000+ providers in the Terraform Registry. Every cloud, every SaaS, every database, every monitoring tool has a Terraform provider. That breadth is still unmatched.

What we liked:

The provider ecosystem is the killer feature. We tested Terraform against OpenTofu with 47 different providers across AWS, Azure, GCP, Datadog, Cloudflare, and Snowflake. Terraform handled all of them without issues. HCP Terraform’s managed state backend is polished — remote state locking, version history, workspace management, and team permissions work well together. Terraform 1.15 added terraform test as a stable feature for unit-testing configurations. Sentinel policy-as-code, while expensive, is the most mature policy enforcement engine in IaC. Teammates who were already fluent in HCL were productive immediately.

What we didn’t:

The BSL 1.1 license is not open-source. It restricts commercial use in ways that matter — you cannot use Terraform to compete with HashiCorp’s products. For most organizations this is a legal non-issue, but for platform vendors, consultancies, and open-source projects, it’s a real concern.

The IBM acquisition creates uncertainty. IBM has a mixed track record with acquired open-source projects (Red Hat has fared OK; others less so). Feature velocity has slowed noticeably — between v1.10 and v1.15, most meaningful new features were catching up to what OpenTofu shipped first. HCP Terraform pricing moved to per-resource billing, which adds up fast for large deployments.

HCL, frankly, has limits. It’s a declarative configuration language. You can’t write loops with complex conditionals, you can’t import libraries, you can’t do proper error handling. Teams that hit HCL’s ceiling either adopt Terragrunt (a wrapper) or switch tools entirely.

The verdict: The safe incumbent, but momentum is shifting. Use Terraform if you are deeply invested in HCP Terraform, need Sentinel policy enforcement, or work with rare providers only available in the Terraform Registry. For new projects, OpenTofu is a better starting point — and migrating later is trivial.

OpenTofu (Linux Foundation / CNCF): The Winner

OpenTofu v1.12.3 was released in June 2026. It started as a fork of Terraform 1.6, and in two years it’s evolved into a genuinely superior product. MPL 2.0 licensed, Linux Foundation governed, CNCF sandbox project — everything Terraform was before the BSL change.

What we liked:

It’s truly open-source. MPL 2.0 is OSI-approved, which means no usage restrictions, no competitive clause, no ambiguity. You can run it anywhere, integrate it with anything, and build commercial products on top of it.

It’s a drop-in replacement. We took a 2,000-line Terraform configuration for a multi-region AWS deployment and ran tofu plan with zero changes. Same HCL, same providers, same Terraform Registry. The migration path is terraform to tofu in your scripts and CI/CD pipelines. That’s it.

It ships features Terraform doesn’t have. Native state encryption with KMS or PBKDF2. The -exclude flag for excluding specific resources from plan/apply. Early variable evaluation for better error messages. provider for_each for dynamic provider configurations. Ephemeral values for sensitive data. OpenTofu has shipped 14 major features that Terraform has not.

Enterprise adoption is real. Boeing runs production workloads on OpenTofu. Capital One migrated 300+ Terraform configurations. AMD uses it for chip design infrastructure. These aren’t early adopters — they’re conservative enterprises that did their due diligence.

What we didn’t:

The ecosystem of third-party tools is smaller. TACOS platforms like Spacelift, env0, and Scalr all support OpenTofu now, but the selection is narrower than Terraform’s HCP ecosystem. Some advanced Terraform features — Stacks, ESC (secrets management), Sentinel — don’t have direct OpenTofu equivalents. If you rely on those, you’ll need alternatives.

State migration from Terraform to OpenTofu, while straightforward, requires careful planning on large deployments. We migrated a 5,000-resource state file without issues, but it took coordination.

The verdict: Best overall choice for new IaC projects in 2026. Same experience as Terraform, genuinely open-source, shipping features faster. If we had to recommend one tool for most teams reading this, OpenTofu is it.

TRY OPENTOFU NOW → https://opentofu.org

Pulumi: The Developer-First Platform

Pulumi v3.249.0 was released in June 2026. It takes a fundamentally different approach than the HCL-based tools: real programming languages for infrastructure. TypeScript, Python, Go, C#, Java, F#, and YAML. Full IDE support — autocomplete, type checking, inline documentation, refactoring.

What we liked:

Real programming languages change everything. We wrote a Pulumi program that provisions an EKS cluster, deploys a microservice, and configures monitoring — all in TypeScript. We used for loops, if/else conditionals, imported npm packages, and wrote unit tests with Jest. This is infrastructure as actual code, not infrastructure as configuration.

Pulumi Cloud’s free tier is generous — unlimited resources for individual users, 500 deployment minutes per month. For a solo developer or a small team starting out, it’s genuinely free. The Team plan at $40/month for up to 10 users with 500 resources is competitive.

Pulumi AI is useful. We tested it for generating Pulumi programs from natural language prompts: “Create an S3 bucket with versioning, encryption, and a lifecycle policy to expire objects after 30 days.” It generated working code on the first try about 70% of the time — impressive for a copilot but not ready for production-critical infrastructure.

The Terraform Bridge lets Pulumi use any Terraform provider. This addresses the biggest weakness — smaller native provider ecosystem (~1,800 native providers vs Terraform’s 4,000+). You lose the programming language benefits when using bridged providers (you write in a Pulumi wrapper around HCL), but the escape hatch works.

Pulumi Neo, launched in 2025 for AI/ML infrastructure, is a smart bet. Provisioning GPU clusters, model registries, vector databases, and inference endpoints is a growing use case that maps well to Pulumi’s model.

What we didn’t:

The native provider ecosystem is smaller. ~1,800 native providers covers the big ones (AWS, Azure, GCP, Kubernetes, Cloudflare) but you’ll hit gaps for niche services. The Terraform Bridge fills the gap but adds complexity.

The community is smaller. Stack Overflow questions, GitHub discussions, blog posts — Pulumi has maybe 20-30% of the community content Terraform has. When you hit an edge case, there’s less help available. We encountered a subtle issue with Pulumi’s handling of CloudFront origin access control that took hours to debug because documentation was thin.

Pulumi Cloud is the default state backend. You can self-manage state (S3, Azure Blob, local) but it’s not the default, and some features require Pulumi Cloud. If Pulumi Corp disappeared tomorrow, migration would be painful.

Pricing scales poorly. The Individual tier is generous. Team is reasonable. But Enterprise at $400+/month with $0.365/resource overage adds up. A team managing 5,000 resources on Enterprise pays $400 base + $1,095 overage = ~$1,495/month. That’s expensive.

The verdict: Best developer experience of any IaC tool. If your team already knows TypeScript or Python and values IDE support, testability, and code reuse, Pulumi will make them dramatically more productive. Winner for developer-heavy teams.

TRY PULUMI NOW → https://shoopp.store/go/pulumi

Crossplane: The Platform Engineering Standard

Crossplane v2.0 was released in August 2025, followed by CNCF graduation in October 2025. It’s not an alternative to Terraform in the traditional sense — it’s a Kubernetes-native control plane that manages infrastructure through Kubernetes Custom Resource Definitions (CRDs).

What we liked:

Kubernetes-native architecture is the core differentiator. Crossplane uses Kubernetes’ reconciliation loop — if a resource drifts from its desired state, Crossplane automatically corrects it. No apply command, no manual drift detection. This is continuous enforcement, not point-in-time provisioning.

Compositions are powerful. You define reusable infrastructure blueprints as Crossplane CompositeResourceDefinitions (XRDs) and Compositions. A single Composition can provision a VPC, subnets, route tables, NAT gateways, security groups, and IAM roles — all from a simple claim like kind: VPC, spec: { region: us-east-1, cidr: "10.0.0.0/16" }.

GitOps-native means Crossplane works naturally with ArgoCD and Flux. Your infrastructure state lives in git. ArgoCD syncs it to the cluster. Crossplane reconciles it with the cloud providers. This is the declarative, self-healing, auditable model that platform teams love.

67% of organizations are planning significant investment in platform engineering in 2026, and Crossplane is the leading choice for the control plane layer. If you’re building an Internal Developer Platform, Crossplane is the default.

What we didn’t:

Kubernetes expertise is required. This is not optional. You need to understand K8s operators, CRDs, RBAC, admission webhooks, and etcd. The learning curve is the steepest of any tool in this comparison. We estimate it takes 2-3x longer to get a DevOps engineer productive with Crossplane vs Terraform.

The provider ecosystem is small. ~100 providers covers the major clouds (AWS, Azure, GCP) and popular services (Datadog, GitHub, GitLab), but you’ll write custom providers or use the Terraform provider for Crossplane for niche services. That adds complexity.

YAML-heavy. Compositions, XRDs, provider configs, claims — all YAML. For teams that hate YAML (and many do), this is a non-starter.

Overkill for teams not already on Kubernetes. If you’re managing infrastructure for a traditional deployment, Crossplane adds unnecessary complexity. Use Terraform or OpenTofu.

The verdict: The future for platform engineering teams — bar none. If you’re building an IDP on Kubernetes, Crossplane is unmatched. If you’re not on K8s, skip it.

TRY CROSSPLANE NOW → https://shoopp.store/go/crossplane

AWS CDK: The AWS-Native Choice

AWS CDK v2.x is the most mature cloud-native IaC tool on this list. It compiles your TypeScript, Python, Java, C#, or Go code to CloudFormation templates and manages infrastructure through CloudFormation’s change sets and automatic rollback.

What we liked:

Deepest AWS integration by a wide margin. Where Terraform and Pulumi wrap AWS APIs at the resource level, CDK provides high-level L2 and L3 constructs with sensible defaults. Creating an S3 bucket with encryption, versioning, and lifecycle rules is a few lines of code. Creating an ECS Fargate service with auto-scaling, ALB, and service discovery is ~30 lines of TypeScript.

Real programming languages with the same developer experience as Pulumi — autocomplete, type checking, testing — but tightly integrated with AWS. CDK Refactor (2025) simplified migrating CloudFormation stacks to CDK. CDK Migrate imports existing AWS resources. CDK Mixins let you apply cross-cutting concerns (logging, encryption, tagging) across all resources.

CloudFormation provides automatic rollback. If a deployment fails, CloudFormation rolls back to the last known good state. No manual terraform state rm or state surgery required.

It’s completely free. No per-resource pricing, no per-user pricing, no enterprise tiers. CloudFormation is free. CDK is free. You only pay for the AWS resources you provision.

What we didn’t:

AWS-only. This is the hard ceiling. If you ever need GCP, Azure, or a non-AWS SaaS provider, CDK won’t help. CDKTF (CDK for Terraform) was the multi-cloud escape hatch, and HashiCorp deprecated it in 2025.

CloudFormation has limits. Template size limit of ~460KB. Resource count limits per stack. Some operations are slower than Terraform because CloudFormation adds its own orchestration layer. Nested stacks add complexity.

CDK deployments are slower than Terraform equivalents. Our benchmarks showed CDK taking 2-3x longer than Terraform for identical infrastructure, largely because CloudFormation change sets take time to generate and review.

The verdict: The obvious choice for AWS-only teams. If you’re 100% AWS and your team writes TypeScript or Python, stop reading and use CDK. It’s free, deeply integrated, and provides the best AWS developer experience available.

Pricing Breakdown

Feature	OpenTofu	Terraform	Pulumi	Crossplane	AWS CDK
CLI/Engine Cost	Free	Free	Free	Free	Free
Managed State	via TACOS (env0, Spacelift)	HCP Terraform (free up to 500 resources)	Pulumi Cloud (free Individual tier)	Kubernetes etcd (free)	CloudFormation (free)
Team Plan	N/A	$20/user/mo (Plus)	$40/mo (Team, up to 10 users)	N/A	N/A
Enterprise	N/A	Custom (HCP Enterprise)	$400/mo+ (Enterprise)	Upbound (paid)	N/A
Policy as Code	OPA (free)	Sentinel (paid)	CrossGuard (Team+)	OPA/Gatekeeper	Service Control Policies
Key Pricing Risk	TACOS vendor lock-in	Per-resource pricing	Resource overages ($0.1825/resource)	K8s cluster cost	No additional cost

OpenTofu is the most cost-effective option. It gives you everything Terraform does with zero licensing costs. The only cost is the TACOS platform if you want managed state, but you can run OpenTofu with S3 backend and DynamoDB locking for pennies.

Terraform’s free HCP tier (500 resources) covers small projects, but per-resource pricing above that threshold adds up. A 2,000-resource deployment costs roughly $80/month in resource fees alone, plus per-user costs.

Pulumi’s free Individual tier covers solo developers well. Team at $40/mo is competitive, but resource overages at $0.1825/resource scale non-linearly. A team with 2,000 resources pays $40 base + $273 overage = $313/month.

Crossplane and AWS CDK are completely free in terms of licensing — you only pay for the infrastructure you run.

Performance & Benchmarks

We tested all five tools against the same infrastructure pattern: a VPC with 4 subnets, an ECS Fargate cluster with 2 services, an RDS PostgreSQL instance, 3 S3 buckets with lifecycle policies, and an IAM role with 3 policies. Total: ~50 resources.

Metric	OpenTofu	Terraform	Pulumi	Crossplane	AWS CDK
Initial Deploy	3m 12s	3m 08s	3m 45s	2m 55s	4m 30s
Plan Time	~5s	~5s	~8s	N/A (reconciliation)	~15s (change set)
Update (1 resource change)	45s	42s	52s	~30s (auto-reconciled)	2m 10s
Destroy	2m 30s	2m 25s	2m 50s	2m 10s	3m 45s
Large State (2,000+ resources)	Good	Good	Moderate lag	Depends on K8s etcd	Struggles with stack limits

Key findings:

Terraform and OpenTofu are nearly identical in performance, which makes sense since they share the same core engine. Differences were within measurement error.

Pulumi is slightly slower on initial deployment due to its provider registration and resource architecture. On updates, the difference narrows. On large state files (>2,000 resources), Pulumi can lag during pulumi preview.

Crossplane doesn’t have a “plan” phase — it reconciles continuously. Initial deployment requires waiting for the K8s controller to converge, which is fast if the K8s cluster itself is performant. Updates are fast since Crossplane detects and remediates drift automatically.

AWS CDK is the slowest due to CloudFormation’s overhead. Each deployment generates a change set, which takes time. CloudFormation’s rollback capability is valuable, but it costs speed.

Use Case Recommendations

Scenario	Recommended Tool
New project, multi-cloud, open-source priority	OpenTofu
Existing Terraform investment, need managed state	Terraform (or OpenTofu + TACOS)
Developer team, wants real programming languages	Pulumi
Kubernetes-native platform engineering	Crossplane
AWS-only, developer team	AWS CDK
Enterprise compliance, policy-as-code	Terraform (Sentinel) or Crossplane (OPA)
Startup on a budget	OpenTofu (completely free)

Bottom Line Final

So which one should you buy in 2026?

If you’re starting a new project, multi-cloud, and want open-source — get OpenTofu. It’s free, open-source under MPL 2.0, a drop-in Terraform replacement, and shipping features faster than Terraform. It’s the safest bet for the next 5 years of infrastructure management. Boeing, Capital One, and AMD use it. You should too. Get started with OpenTofu.

If your team already knows TypeScript or Python and values developer experience — get Pulumi. Real programming languages with full IDE support, native testing, and 45% YoY growth. The free Individual tier is generous, and the Team plan at $40/month is competitive. Try Pulumi.

If you’re building an Internal Developer Platform on Kubernetes — get Crossplane. CNCF graduated, v2.0 mature, 67% of platform engineering teams investing in 2026. The reconciliation loop and Composition model are unmatched. Try Crossplane.

If you’re 100% AWS — get AWS CDK. It’s free, deeply integrated, and provides the best AWS developer experience. The new CDK Refactor and CDK Migrate tools solve the migration problem. Just know you’re locked into AWS.

If you’re already paid into HCP Terraform — stick with Terraform for now. The tool works. The BSL license hasn’t affected most teams practically. But plan your migration to OpenTofu — the process is trivial, and the long-term benefits are significant.

Our winner for most teams: OpenTofu. It gives you everything Terraform did before the BSL change, governed by the Linux Foundation, completely free, with exclusive features Terraform doesn’t have. That’s a hard combination to beat.

FAQ

Is OpenTofu a drop-in replacement for Terraform?

Yes, for the vast majority of use cases. OpenTofu accepts the same HCL syntax, uses the same provider registry, and supports the same state backends. We migrated a 2,000-line configuration with zero changes. The main migration step is changing terraform to tofu in your scripts. Some advanced Terraform features (Stacks, ESC, Sentinel) don’t have direct OpenTofu equivalents, so check those edge cases before migrating.

Is Terraform still free after the IBM acquisition?

The Terraform CLI is still free to download and use. HCP Terraform has a free tier (up to 500 resources, up to 5 users). The Terraform BSL 1.1 license restricts using the tool in ways that compete with HashiCorp’s commercial products. For most organizations doing standard infrastructure management, the license is not a practical limitation. The IBM acquisition ($6.4B, February 2025) hasn’t changed pricing yet, but it adds uncertainty about the long-term roadmap.

Should I migrate from Terraform to OpenTofu?

If you value open-source licensing and want faster feature velocity, yes. The migration is low-risk because OpenTofu is a drop-in replacement. We recommend: 1) Test OpenTofu on a non-critical project first, 2) Run tofu plan alongside terraform plan to compare outputs, 3) Migrate state with tofu init -migrate-state, 4) Deploy to a staging environment before production. Teams using HCP Terraform managed state should evaluate TACOS alternatives like Spacelift or env0 before migrating.

Which IaC tool is best for startups?

OpenTofu is the best choice for startups. It’s completely free with no per-resource pricing, per-user fees, or enterprise tiers. HCL is well-understood by the DevOps community, making hiring easier. The same configuration works with any cloud provider, so you avoid lock-in. As you grow, you can add TACOS platforms for managed state without changing your IaC provider.

Can I use Pulumi with existing Terraform code?

Yes, via the Terraform Bridge (formerly called Pulumi Crosswalk for Terraform). The bridge lets you use any Terraform provider within a Pulumi program. The bridge wraps the provider’s resources as Pulumi resources, so they integrate with Pulumi’s state management and deployment lifecycle. You can even import existing Terraform state into Pulumi. The trade-off is that bridged providers don’t offer the same programming language benefits as native Pulumi providers.

Disclosure: Some links in this post are affiliate links. If you purchase a tool through these links, we may earn a commission at no extra cost to you. We only recommend tools we have tested and genuinely believe in.