# Infrastructure as Code Tools in 2026: The Best IaC Tools Compared URL: https://www.devopsness.com/blog/best-iac-tools Author: Kiril Urbonas Published: 2026-07-18 Updated: 2026-10-12 Categories: DevOps Tags: Terraform, DevOps, Iac, Automation, Infrastructure As Code Summary: Terraform, OpenTofu, Pulumi, CDK, CloudFormation, Crossplane, and Ansible each solve a different slice of the IaC problem. This is how they compare on license, language, state, and cost. --- # Infrastructure as Code Tools in 2026: The Best IaC Tools Compared The best infrastructure as code tools in 2026 are Terraform and OpenTofu (declarative HCL, the largest provider ecosystem), Pulumi (TypeScript, Python, Go), AWS CDK and CloudFormation (AWS only), and Crossplane (Kubernetes-native). Ansible is configuration management, not provisioning. For a new multi-cloud project, OpenTofu is our default. Every option here can create a VPC and a database. What separates them is the license you accept, the language your team writes, and where state lives. ## The IaC tools, side by side Licenses come from each project's repository and prices from vendor pricing pages, checked October 2026. | Tool | Best for | License | Pricing model | Key limit | |---|---|---|---|---| | Terraform 1.16 | Teams wanting the biggest ecosystem and vendor support | BUSL 1.1 (source-available) | CLI free; HCP Terraform free up to 500 managed resources, then per resource | Not open source; competing hosted offerings restricted | | OpenTofu 1.13 | New multi-cloud projects that want Terraform without the license question | MPL 2.0 | Free | Some HCP-specific features have no equivalent | | Pulumi | Teams that want loops, functions, and unit tests in a real language | Apache 2.0 | Pulumi Cloud Free for one user; Essentials $40/month with up to 500 resources | Smaller pool of examples than HCL | | AWS CDK | AWS-only teams writing TypeScript or Python | Apache 2.0 | Free; synthesizes to CloudFormation | AWS only; inherits CloudFormation limits | | CloudFormation | AWS-native stacks with managed rollback | Proprietary AWS service | No charge for `AWS::*` resources; third-party handlers $0.0009 per operation after 1,000 free | AWS only; verbose YAML or JSON | | Crossplane | Platform teams building self-service APIs on Kubernetes | Apache 2.0, CNCF graduated | Free | Needs a Kubernetes cluster and controller expertise | | Ansible | Configuring servers and running ordered tasks | Open source | Free; Red Hat sells Ansible Automation Platform | Weak at tracking cloud resource state | ## The Terraform family: Terraform and OpenTofu Terraform is still the center of gravity: the provider registry covers every major cloud and most SaaS APIs. HashiCorp moved Terraform to the Business Source License 1.1 in 2023, and the license file now names IBM as licensor; the current release is Terraform 1.16.5 as of October 2026. For teams managing their own infrastructure, the BUSL changes little. OpenTofu is the community fork, licensed MPL 2.0 and a CNCF sandbox project since April 2025, at version 1.13.1 as of October 2026. Moving an existing codebase is usually a binary swap plus a state check: ```bash $ tofu init -upgrade # reads the same .tf files and lock file $ tofu plan -detailed-exitcode # exit code 0 means no drift after the swap ``` **Where they win:** provider breadth, mature modules, and HCL examples for nearly everything. **Where they don't:** HCL gets awkward with deep conditional logic, and state is a file you must lock, back up, and protect. The detailed migration path is in [Terraform vs OpenTofu](/blog/terraform-vs-opentofu). ## Real programming languages: Pulumi and AWS CDK Pulumi lets you write infrastructure in TypeScript, Python, Go, C#, or Java, against the same cloud APIs Terraform uses. The engine is Apache 2.0; Pulumi Cloud is the paid state and collaboration backend, with an Essentials tier at $40 a month covering up to 500 managed resources as of October 2026. You can also keep state in your own S3 or Azure Blob bucket for free. AWS CDK takes the same idea but compiles to CloudFormation templates. That means AWS handles state, rollback, and drift detection, and you never run a state backend. The tradeoff is that you are bound to AWS and to CloudFormation's deployment speed. We compare the two in [Pulumi vs AWS CDK](/blog/pulumi-vs-cdk). **Where they win:** teams of application developers who would rather test infrastructure code with the same tools they test services. **Where they don't:** real languages make it easy to write clever infrastructure that only its author can review. ## AWS-native and Kubernetes-native: CloudFormation and Crossplane CloudFormation is the only tool here with server-side state and automatic rollback built in. There is no additional charge for `AWS::*` resource types; you pay for what the stack creates. Third-party resource providers and hooks cost $0.0009 per handler operation after 1,000 free a month, as of October 2026. Crossplane turns cloud resources into Kubernetes custom resources that controllers reconcile continuously, so drift gets corrected rather than reported. It graduated in the CNCF on October 28, 2025. It earns its complexity when a platform team exposes a "database" API to developers through `kubectl` or Argo CD. ## Ansible is not a Terraform replacement Ansible connects over SSH and runs ordered tasks such as installing packages and templating config files. It can call cloud APIs, but it does not keep a state file, so it cannot reliably tell you what it created last month or delete what it no longer manages. The common pattern is Terraform or OpenTofu to provision, Ansible to configure what runs inside. The full split is in [Ansible vs Terraform](/blog/ansible-vs-terraform). ## The automation layer: where IaC runs Once more than two people apply changes, the tool matters less than the workflow around it: remote state, locking, plan review on pull requests, policy checks, and drift detection. As of October 2026: - **HCP Terraform:** the enhanced Free tier covers 500 managed resources with unlimited users (the legacy free plan ended March 31, 2026). Paid tiers start at $0.10 per resource per month on Essentials. - **Spacelift:** free for 2 users and 1 public worker; Starter+ is $20,000 a year. - **env0:** a commercial platform in the same category; [Spacelift vs env0](/blog/spacelift-vs-env0) covers the head-to-head. - **Atlantis:** open source, self-hosted, runs `plan` and `apply` from pull request comments on GitHub, GitLab, Bitbucket, or Azure DevOps. Atlantis is the cheapest serious option for a small team; past a few thousand resources, compare the [Terraform Cloud alternatives](/blog/terraform-cloud-alternatives). ## Questions people ask ### What are the most popular infrastructure as code tools? Terraform is the most widely used, followed by its fork OpenTofu, Pulumi, AWS CloudFormation with AWS CDK, and Crossplane on Kubernetes. Ansible is popular too, but it is a configuration management tool. Most job postings that mention IaC mean Terraform-style HCL. ### Is Terraform still free to use? The Terraform CLI is free to use under the Business Source License 1.1 for running your own infrastructure. It is source-available rather than open source, and the license restricts products that compete with HashiCorp. HCP Terraform is free up to 500 managed resources as of October 2026, then billed per resource. ### What is the difference between IaC tools and IaC platforms? An IaC tool (Terraform, OpenTofu, Pulumi) turns code into cloud resources. An IaC automation platform (HCP Terraform, Spacelift, env0, Atlantis) runs that tool for a team: remote state, locking, pull request plans, approvals, policy, and drift detection. You need the tool from day one and a platform once several people apply changes. ### Should I learn Terraform or Pulumi first? Learn Terraform or OpenTofu first. HCL is the most common syntax in job descriptions, docs, and modules, and the concepts of providers, state, and plans transfer directly to Pulumi. Move to Pulumi when your team wants unit-tested infrastructure in a language it already writes daily. ## The decision, concretely - **New project, multi-cloud, no strong language preference?** OpenTofu, with state in an encrypted bucket. - **Already on Terraform with HCP features you depend on?** Stay on Terraform; the license rarely affects end users. - **Application developers own the infrastructure?** Pulumi, or AWS CDK if everything is on AWS. - **Building an internal platform on Kubernetes?** Crossplane, behind a GitOps controller. ## The call we'd make Default to OpenTofu for a new project: you keep the whole HCL ecosystem and remove the license question for good. Pick Pulumi only when your team will actually test its infrastructure code. Put remote state, locking, and pull request plans in place before the third engineer joins, with Atlantis if budget is tight. Most IaC pain we see comes from undisciplined state, not from the wrong tool. ## Sources - [OpenTofu releases on GitHub](https://github.com/opentofu/opentofu/releases) - [HashiCorp: HCP Terraform pricing](https://www.hashicorp.com/en/pricing) - [HashiCorp: Continuing HCP Terraform's enhanced free tier](https://www.hashicorp.com/en/blog/continuing-hcp-terraform-s-enhanced-free-tier-experience) - [Pulumi pricing](https://www.pulumi.com/pricing/) - [AWS CloudFormation pricing](https://aws.amazon.com/cloudformation/pricing/) - [CNCF: Crossplane project page](https://www.cncf.io/projects/crossplane/)