Visibility in this ranking can be paid for. Payment moves a vendor's position within the
shortlist; it never adds a vendor, and it never changes a word of the review. The largest vendors in infrastructure as code tools
cannot hold places 1 to 3. Places 1 to 3 go to challengers, vendors outside the best-known brands in a category,
wherever the category has them; the established names follow from place 4 in their ranked order. How it works: placement disclosure ·
editorial process.
The 12 tools, reviewed
#1 OpenTofu
Open source Terraform fork under the Linux Foundation · United States · opentofu.org
Open source Terraform-compatible State encryption
OpenTofu earns first place by removing the questions that dominate the other eleven entries. There is no per-resource meter, no seat count and no sales contact, and the project says it works with existing Terraform providers and with state files up to the 1.5.x line.
- Pricing: Open source + paid platforms. Free and open source; hosted runs, state and policy come from third-party platforms that support it. Free plan: open source.
- Best for: Teams that want Terraform's workflow without a vendor
- Strengths: Declarative HCL configuration; Plan and apply workflow; Provider ecosystem.
Where it falls short
OpenTofu is an engine only. It has no hosted service of its own, so state storage, locking, approvals and drift checks are yours to assemble or to buy elsewhere.
Wrong for
Teams that want one vendor to answer the phone for engine, state and policy.
Visit OpenTofu →
#2 Pulumi
Infrastructure as code in general-purpose programming languages · United States · pulumi.com
General-purpose languages Published editions Policy as code
Pulumi is the only entry where the unit of reuse is a normal package in a language your developers already know. Loops, conditionals, unit tests and shared libraries work without HCL workarounds, and the Automation API lets a product embed infrastructure changes in its own code.
- Pricing: Per edition + resources. Free for one user. Free plan: free plan.
- Best for: Software engineering teams who dislike HCL
- Strengths: TypeScript, Python, Go, .NET, Java and YAML; Pulumi Cloud state management; Automation API.
Where it falls short
Cost follows managed resources, and the edition ceilings (500, 2,000 and 4,750) are a wall that forces an upgrade, not a gradual slope. Drift detection, SAML and audit logs only arrive at Pro.
Wrong for
Operations-led teams who read HCL fluently and have no developers to spare.
Visit Pulumi →
#3 Spacelift
Hosted run platform for several IaC engines · United States · spacelift.io
Multi-engine Policy as code Hosted runs
Spacelift ranks third because it is the platform least tied to one engine. Its pricing page lists OpenTofu, Terraform, Terragrunt, Pulumi and Kubernetes under IaC support, adds Ansible in its integrations, and gives every plan unlimited users.
- Pricing: Quote only. Always-free plan for small teams; Starter+, Business, Enterprise and Enterprise+ are quote-only, with unlimited users and private workers counted per plan. Free plan: free plan.
- Best for: Platform teams running mixed engines
- Strengths: OpenTofu, Terraform, Terragrunt, Pulumi and Kubernetes support; Policy as Code engine; Drift detection.
Where it falls short
Paid plans are all quote-based, and the private worker counts (1, 3, 5 or more, 12 or more) are a pricing lever that is hard to predict before a demo.
Wrong for
Teams with one engine, one cloud account and fewer than five engineers.
Visit Spacelift →
#4 Terraform
The incumbent infrastructure as code engine, now owned by IBM · United States · developer.hashicorp.com
Incumbent Largest ecosystem BUSL license
Terraform is still the reference point for the category, and the documentation lists thousands of providers for AWS, Azure, Google Cloud, Kubernetes and SaaS products. HCP Terraform adds remote execution, a private registry, SAML single sign-on and a free plan for up to 500 managed resources, with Essentials billed per resource per hour and Standard adding policy enforcement and cost estimation.
- Pricing: Per managed resource / hour. Free CLI; HCP Terraform free up to 500 managed resources, Essentials pay-as-you-go per managed resource per hour, Standard and Premium by quote. Free plan: free plan.
- Best for: Established estates already written in HCL
- Strengths: Declarative HCL; Terraform Registry providers; Plan and apply workflow.
Where it falls short
Releases from 1.6.0 use the Business Source License, which restricts competing hosted offerings, and the upper-tier prices are not published in what we could read.
Wrong for
Buyers whose compliance policy requires an OSI-approved license, or who sell infrastructure services built on the engine.
Visit Terraform →
Orchestration DRY configuration Free pipeline
Terragrunt solves a problem that appears after the first year: the same backend, provider and variable blocks pasted into forty folders. It lets you define them once with includes, break a monolithic estate into units with their own state, and control order through its run queue. Hooks and retries handle the flaky-network cases most teams otherwise script by hand.
- Pricing: Open source + paid services. Open source tool; a Terragrunt-native CI/CD pipeline is free for up to 25 infrastructure units; Gruntwork plans and Terragrunt Scale are quote-based. Free plan: open source.
- Best for: Large OpenTofu or Terraform estates with copied config
- Strengths: Includes for shared configuration; Hooks before and after runs; Run queue ordering.
Where it falls short
It does not replace an engine, a state backend or a policy product, so it adds a tool to learn rather than removing one. A small estate with one environment gets no benefit.
Wrong for
A team with a handful of modules and one environment.
Visit Terragrunt →
#6 Scalr
Per-run hosted platform positioned as a Terraform Cloud replacement · United States · scalr.com
Per-run pricing HCP Terraform replacement GitOps
Scalr's best feature is that its invoice can be computed on a napkin: $0.99 a run, with no charge for users, workspaces, managed resources, private agents or SAML. The vendor says the Free and Business plans are the same product apart from volume, and since September 2026 each new account starts with five concurrent runs.
- Pricing: Per run / month. Free up to 50 runs a month. Free plan: free plan.
- Best for: HCP Terraform users facing a renewal
- Strengths: Remote state and runs; Pull request slash commands; Apply-before-merge workflow.
Where it falls short
Per-run billing punishes the opposite shape: a busy pipeline with hundreds of daily runs costs more than a flat or per-resource plan, and nothing in the price caps a runaway CI loop.
Wrong for
Teams that run many applies a day or need a multi-engine platform with Pulumi and Kubernetes.
Visit Scalr →
#7 env0
Self-service infrastructure platform with governance and cost controls · United States · env0.com
Self-service Cost controls Drift management
env0 centers on the environment as the unit: developers request a short-lived copy of infrastructure, it expires on a time-to-live, and finance sees the cost. That suits platform teams who spend their week approving requests for test stacks.
- Pricing: Per apply or environment, quote. Free tier of 250 runs a month and 30 active environments; Cloud Navigator and Cloud Pilot are custom priced per successful apply or environment. Free plan: free plan.
- Best for: Platform teams building developer self-service
- Strengths: Terraform and Terragrunt support; Environment time to live; Drift detection and remediation.
Where it falls short
Both paid tiers are quote-only, priced per successful apply or per environment, so forecasting cost needs a sales conversation. The free tier caps concurrency at one run.
Wrong for
Teams without a need for self-service environments or cost governance.
Visit env0 →
#8 Ansible
Open source IT automation engine with a Red Hat enterprise edition · United States · redhat.com
Configuration Open source Red Hat platform
Ansible belongs in an infrastructure as code ranking because most companies still have machines to configure after the cloud resources exist. Red Hat describes it as an open source automation engine for provisioning, configuration management, application deployment and orchestration, free to use. Playbooks are readable by operations staff who do not write code.
- Pricing: Open source + subscription. The Ansible engine is free and open source. Free plan: open source.
- Best for: Teams configuring servers and network devices
- Strengths: Playbooks; Provisioning; Configuration management.
Where it falls short
Ansible does not keep a state file of cloud resources, so it cannot show a plan of what will change or notice drift the way an engine with state does. Long playbooks can be slow against large fleets.
Wrong for
Teams whose main job is creating and destroying cloud resources with a reviewable plan.
Visit Ansible →
#9 AWS CloudFormation
AWS's own template-based provisioning service · United States · aws.amazon.com
AWS native No extra charge Stacks
For a company that has decided to stay on AWS, CloudFormation has the shortest path and the cleanest bill. There is no additional charge for resources in the AWS and Alexa namespaces: you pay for the EC2 instances and load balancers, not for the tool.
- Pricing: No charge + usage on extensions. No additional charge for AWS and Alexa resource types. Free plan: free plan.
- Best for: Teams running only on AWS
- Strengths: JSON and YAML templates; Stacks and stack sets; Change sets.
Where it falls short
It only targets AWS and AWS-registered extensions, so a second cloud means a second tool. Templates in JSON or YAML are verbose, and what they define cannot be moved to another engine without a rewrite.
Wrong for
Multi-cloud teams and anyone who might leave AWS.
Visit AWS CloudFormation →
#10 Azure Bicep
Declarative language for deploying Azure resources · United States · learn.microsoft.com
Azure native No state files Open source
Bicep fixes the biggest complaint about the older Azure Resource Manager JSON templates: it is concise and readable, with type safety and reusable modules. Microsoft's overview says Azure stores the state, so there is no state file to manage or lock, and that Bicep has no cost, is open source and supported by Microsoft Support.
- Pricing: Free. Free and open source; you pay only for the Azure resources you deploy, and Microsoft Support covers it. Free plan: open source.
- Best for: Teams running only on Azure
- Strengths: Declarative syntax; Type safety; Modules.
Where it falls short
Bicep targets Azure and nothing else, so a company with AWS or SaaS resources in the same estate needs a second tool. Experimental features are not covered by Microsoft Support.
Wrong for
Companies that use AWS, Google Cloud or SaaS APIs alongside Azure.
Visit Azure Bicep →
#11 Crossplane
Kubernetes control plane framework for cloud resources · International (open-source project) · crossplane.io
Kubernetes CNCF graduated Control plane
Crossplane takes a different route: instead of running a plan from a pipeline, you install it in a Kubernetes cluster and request cloud resources as Kubernetes objects. A controller then watches them and, in the project's words, corrects drift against desired state.
- Pricing: Open source + commercial. Open source with no license fee; commercial platform and support come from Upbound on quote. Free plan: open source.
- Best for: Platform teams already on Kubernetes
- Strengths: Compositions; Managed resources; Composition functions.
Where it falls short
It demands Kubernetes operations skills and a mental shift from plan and apply to continuous reconciliation. There is no preview that matches an engine's plan, error messages come through controller status and the learning curve is steep.
Wrong for
Teams without an existing cluster, and anyone who wants reviewable plans on pull requests.
Visit Crossplane →
#12 Puppet
Agent-based configuration management and compliance enforcement · United States · puppet.com
Configuration management Compliance Agent-based
Puppet continues to make sense where the problem is keeping hundreds of servers in a known state. It enforces desired state continuously, supports both agent-based and agentless work, and the commercial tiers add role-based access, patching and reports.
- Pricing: Per node, quote. Puppet Core is free under 25 nodes; Commercial (25+ nodes), Enterprise and Enterprise Advanced are custom priced. Free plan: free plan.
- Best for: Server fleets with compliance baselines
- Strengths: Continuous enforcement of desired state; Agent-based and agentless modes; Role-based access control.
Where it falls short
Puppet is built around nodes and agents, which is a poor match for serverless and managed cloud resources that have no machine to configure. It has its own declarative language and server infrastructure to run.
Wrong for
Cloud-native teams with few long-lived servers.
Visit Puppet →
Questions and answers
What is the best infrastructure as code tool in 2026?
OpenTofu ranks first of 12, best for teams that want Terraform's workflow without a vendor. Pulumi is second (software engineering teams who dislike HCL) and Spacelift third (platform teams running mixed engines). Places 1 to 3 go to challengers, vendors outside the best-known brands, wherever the category has them.
Is OpenTofu a drop-in replacement for Terraform?
Largely, with limits. OpenTofu describes itself as a drop-in replacement, uses the same providers from the Terraform ecosystem and reads state files created with Terraform up to the 1.5.x versions.
Did Terraform stop being open source?
Yes, in the Open Source Initiative sense. Terraform versions from 1.6.0 are released under the Business Source License, and the repository lists IBM as licensor.
Do we need a platform such as Spacelift or env0, or is a CI pipeline enough?
A CI pipeline with a remote state backend is enough for one team and one cloud account.
Is Pulumi better than Terraform if my team writes TypeScript or Python?
Often, for that team. Pulumi supports TypeScript, Python, Go, .NET, Java and YAML, so loops, tests and shared libraries use normal language tools instead of HCL conventions.
How much does HCP Terraform cost?
The free plan supports up to 500 managed resources with one concurrent remote run. Essentials bills per managed resource per hour, and the Standard and Premium plans are priced through sales according to the vendor's documentation.
Are CloudFormation and Bicep worth using instead of Terraform?
Yes, when you run on one cloud and want no extra vendor.
What is Terragrunt and do I need it?
Terragrunt is a wrapper around OpenTofu and Terraform from Gruntwork that reduces repeated configuration, orchestrates many stacks and adds hooks and error handling.
Is Ansible an infrastructure as code tool or a configuration tool?
Both, depending on use. Red Hat describes Ansible as an open source automation engine for provisioning, configuration management, application deployment and orchestration.
When does Crossplane make sense?
It makes sense when your platform team already runs Kubernetes and wants to expose cloud resources as Kubernetes APIs that developers request, with a controller correcting drift continuously.
How do we move from Terraform to OpenTofu or to a hosted platform?
Moving the engine is usually a version pinning exercise: confirm your Terraform version is 1.5.x or compatible, run plan with OpenTofu against a copy of the state, then switch the binary in CI.
