Interview › Infrastructure as Code (Terraform, Ansible)

What is OpenTofu, and why did it fork from Terraform?

Infrastructure as Code (Terraform, Ansible) · Intermediate level

Answer

OpenTofu is the community-driven open-source fork of Terraform created after HashiCorp changed Terraform's license to BUSL. It aims to preserve an open, vendor-neutral IaC tool with a familiar Terraform-compatible workflow. I consider it when license posture, governance, or open-source guarantees matter to the organization.

Technical explanation

OpenTofu remains familiar to Terraform users, but compatibility and feature divergence should be tested per workspace.

A migration decision should consider provider support, CI tooling, policy tooling, and organizational license requirements.

Do not mix Terraform and OpenTofu against the same state without a deliberate, tested migration plan.

Keep Terraform's ownership boundary clear: one state should own a resource or field, and other tools should consume published outputs instead of modifying it.

Use fmt, validate, linting, policy checks, plan review, and state locking before production applies.

Design for small blast radius by splitting state around lifecycle, permissions, and recovery boundaries.

Hands-on example

1. Build a safe IaC delivery workflow for: What is OpenTofu, and why did it fork from Terraform?

2. Pull request job:

terraform fmt -check

terraform init -backend=false

terraform validate

tflint --recursive

checkov -d .

terraform init

terraform plan -out=tfplan

terraform show -json tfplan > tfplan.json

3. Policy job evaluates plan JSON for public exposure, missing encryption, IAM wildcards, and destructive changes.

4. Apply job runs only after approval, uses remote state locking, short-lived cloud credentials, and applies the saved plan artifact.

5. For failures, rerun plan, inspect state and cloud objects, and fix root cause before any state surgery.

More Infrastructure as Code (Terraform, Ansible) interview questions

• What is Infrastructure as Code, and what problems does it solve over click-ops?
• What is the difference between declarative and imperative IaC, and where do Terraform and Ansible fall?
• What is the difference between configuration management and provisioning?
• What is Terraform, and what is the core plan/apply workflow?
• What does terraform init do?
• What is the Terraform state file, and why is it critical?
• Why should state be stored remotely, and what backend would you use on AWS?
• What is state locking, and why does it matter for teams?

← All Infrastructure as Code (Terraform, Ansible) questions