Pro ยท Lesson 11 of 12
Secrets belong outside git and outside a chatty plan. Policy belongs in a tool your runner actually executes. OpenTofu gets its own comparison here so it is not waved through as Terraform.
Sign in to save your place.
A password in a tfvars file is a key left on the desk. Policy is the rule that says which desks may exist. OpenTofu is a different company of locksmiths who learned from the same early manual. Their later locks are not automatically the same.
Do not commit tfvars with passwords, cloud keys, or tokens. Prefer environment variables or a secret store the provider can read at plan time. The value still lands in state if a resource argument stores it. Protect the state backend the way you protect a password database: tight IAM, encryption the backend documents, and no public bucket.
A sensitive output is a display hint. Rotate a secret that already reached a state file or a CI log. Redaction in the next plan does not scrub the old log.
HashiCorp documents Sentinel and, in places, OPA-style policy for HCP Terraform. Those are features of that product. A CLI-only run does not grow Sentinel because the HCL parsed. If you need a policy check in your own CI, install the policy tool you chose and run it as a step. Say its name.
OpenTofu does not include Sentinel. It has had its own work on features such as state encryption that Terraform does not copy one-for-one. When a design says "we encrypt state", name the binary and the feature flag. Do not write "Terraform/OpenTofu state encryption" as one switch.
Both tools can plan and apply HCL with providers, and both can store remote state. That is the overlap. It is not a feature matrix.
License: Terraform is under the Business Source License. OpenTofu is MPL-2.0. Your legal review cares. This course is not that review.
Registries: HashiCorp's registry and the OpenTofu registry are different. A provider version you saw on one is not automatically published on the other. Pin the source your binary is configured to use.
Cloud product: HCP Terraform is HashiCorp's. OpenTofu does not ship it. Similar CLI workspace commands do not create HCP workspaces.
Newer language: import, moved, removed, tests, and S3 lock files landed on timelines. Check the docs for the version in terraform version or tofu version. A blog that says "they match" without a version is not evidence.
| Topic | Fair to say | Unfair to say |
|---|---|---|
| Commands | plan and apply exist in both families | Every flag matches on every version |
| License | They differ | OpenTofu is the free mode of terraform |
| HCP Terraform | It is a HashiCorp service | It runs tofu if you ask nicely |
| State lock on S3 | Read each backend page | use_lockfile means the same deprecation schedule |
Step 1 of 3HCL, state, and plan are the shared ideas.
Step 2 of 3License, HCP Terraform, and Sentinel belong to HashiCorp's product story.
Step 3 of 3OpenTofu has its own binary, license, registry, and docs. Read those.
Answer yes or no for a real repo you work in. A no is a useful result.
Secrets in git: no
State bucket public: no
State lock understood for our binary version: yes/no
CI prints terraform version or tofu version: yes/no
Policy tool we actually run (name it, or none):
We did not write "Terraform/OpenTofu" as if it were one product: yes
Checked against the linked documentation in October 2026. A later release can move a flag, a price, or a supported pair. Use the page for the version you installed.