OpenTofu
OpenTofu is the open-source infrastructure-as-code engine that reads .tf files, compares them with what exists in AWS and applies the difference. Every AWS resource in the Baseline and the Blueprints is declared for OpenTofu; Terragrunt sits on top to organize the many small configurations.
What it does
OpenTofu turns declarations into API calls. A module is a folder of .tf files with variables and outputs; a provider is the plugin that talks to one platform, here hashicorp/aws; the state is OpenTofu's record of the resources it manages. A run plans first (what would change) and applies second. OpenTofu is a community fork of Terraform under the Linux Foundation; the OpenTofu and Terraform concept page covers the relationship.
How BuiltForProd uses it
Every infrastructure repository pins the same versions in its root.hcl: OpenTofu >= 1.12.6, < 2.0.0 and the AWS provider ~> 6.65. CI installs OpenTofu 1.12.6 exactly. The lower bound matters: the DocumentDB module uses ephemeral resources and write-only arguments, which need OpenTofu 1.11 or later, to keep the master password out of state.
root.hcl is the only place versions are pinned. It generates a versions.tf into every unit (skipped when a module ships its own, which is allowed only for provider aliases or providers such as helm and kubernetes) and a provider.tf with the region, the role to assume and the default tags Namespace, Environment, Stage, ManagedBy=opentofu and Repository. The check-module-versions.py guard fails a pull request whose module versions.tf drifts from the root pins.
Modules come in three tiers, as the design decisions put it: registry modules used directly where they fit (VPC, Transit Gateway), thin wrappers that fix the platform's defaults around a registry module (EKS, S3, Lambda, ElastiCache, CloudFront, ECR), and custom modules where nothing suitable exists (Organizations, IPAM, Client VPN, Lake Formation, Fluent Bit). Registry modules are pinned to exact versions.
State for every account and blueprint lives in one encrypted, versioned S3 bucket in the management account, acme-use1-root-tfstate, with native lockfile locking and access through a dedicated state-access role. Each repository writes under its own key prefix.
Formatting and validation run before every commit through the tofu_fmt, tofu_validate and tofu_docs pre-commit hooks, and again in the plan workflow.
Terms you will see
| Term | Meaning |
|---|---|
| Module | A reusable folder of .tf files with variables and outputs. |
| Provider | The plugin for one platform; the AWS provider is pinned at ~> 6.65. |
| State | OpenTofu's record of managed resources, stored in S3. |
| Plan | The computed diff between code and reality, reviewed before apply. |
| Write-only argument | An input sent to AWS but never written to plan or state. |
Where to read more
- OpenTofu and Terraform
- Infrastructure as code
- Terragrunt for how units and stacks organize the code
- Versioning policy for how pins are updated