Infrastructure as Code

The big tools

• ★ OpenTofu — fork of Terraform that stayed open source after HashiCorp's BSL relicense. Drop-in compatible. The default for new IaC projects in 2026.
• Terraform — still huge install base; HashiCorp's commercial enterprise tier. Use OpenTofu for OSS, Terraform if you have HashiCorp Cloud / paid relationship.
• ★ Pulumi — IaC in real languages (TS, Python, Go, .NET, Java). The default for teams that prefer typed code over HCL.
• AWS CDK — Pulumi-shape but AWS-only; outputs CloudFormation. AWS-native.
• CDK for Terraform (CDKTF) — CDK syntax, Terraform output.
• SST — TypeScript IaC for serverless apps; great DX for Next.js / Astro on AWS.
• Crossplane — IaC as Kubernetes CRDs; provision AWS / GCP / Azure from k8s manifests. Pairs with GitOps.
• Bicep — Azure-native, cleaner than ARM templates.
• CloudFormation — AWS-native, verbose; usually Pulumi / CDK / Terraform sit on top.

State management

• ★ Terraform Cloud / HCP Terraform — managed state + run pipeline.
• tofu + S3 / GCS / Azure Blob backend — cheap DIY state store with object lock for safety.
• scalr — TFC alternative with better team / RBAC story.
• Spacelift — GitOps-style IaC pipeline; supports OpenTofu, Terraform, Pulumi.
• env0 — competitor; nice for multi-env workflows.
• Atlantis — open-source PR-based Terraform automation.
• Pulumi Cloud — Pulumi's managed state.

Module / chart registries

• Terraform Registry — public + private modules.
• OpenTofu Registry — separate registry for OpenTofu modules.
• Pulumi Registry — provider catalog.
• Crossplane Marketplace — for Crossplane providers / configurations.

Linting / scanning

• ★ Checkov — IaC scanner; covers Terraform / Pulumi / Helm / Dockerfile / k8s YAML / CloudFormation.
• tfsec — Terraform-specific security scanner; merging into trivy.
• kics — broad IaC scanner.
• Snyk IaC — paid; same niche.
• terraform fmt + validate — built-in.
• TFLint — Terraform linter; provider-aware.
• Conftest — generic OPA-based config testing; works on IaC.

Drift detection / inventory

• driftctl — detects unmanaged infra resources.
• Steampipe — query cloud state as SQL; great for "what's actually deployed?"
• Resoto — open-source cloud asset graph.
• Spacelift / env0 / TFC all do drift detection.

Patterns to know

• ★ Remote state with locking, always. Never commit state files; never run apply against shared state without a lock.
• ★ Plan in CI, apply with approval. Atlantis / TFC / Spacelift / env0 all do this.
• Workspaces or directories per env — pick one approach; consistent across the org.
• Module conventions — input/output schemas, version pinning, README per module.
• Don't generate terraform from Pulumi (or vice versa) — pick one tool per stack.

Pick this if…

• Default new IaC project, OSS: OpenTofu.
• You'd rather write TypeScript than HCL: Pulumi.
• AWS-only, want AWS-native ergonomics: CDK or SST.
• k8s-native infra-as-CRDs: Crossplane.
• Have many engineers running Terraform plans: add Atlantis or Spacelift early.
• PR-driven Terraform on OSS budget: Atlantis.