Terraform vendor lock-in operates at multiple layers: the tool itself (now under IBM/HashiCorp's BSL license), the HCP Terraform platform with proprietary features like Sentinel, cloud provider-specific resources, state backends, and module registries. While Terraform ironically serves as a strong defense against cloud provider lock-in through its multi-cloud HCL approach, it introduces its own tooling and platform lock-in risks. The post covers five types of lock-in, compares Terraform against CloudFormation, Pulumi, OpenTofu, and Bicep, and offers practical mitigation strategies: keeping modules provider-aware, using portable state backends, avoiding over-adoption of proprietary platform features, maintaining OpenTofu compatibility, and pinning versions. OpenTofu is highlighted as the most direct answer to tooling lock-in, offering the same syntax and providers under open CNCF governance.
Table of contents
What is vendor lock-in?Types of vendor lock-in to consider when using TerraformHow Terraform helps avoid cloud provider lock-inTerraform vs other IaC tools: Lock-in-trade-offsBest practices to avoid vendor lock-in with TerraformHow managed platforms like Spacelift help reduce lock-inKey points254 Impressions1 Comment