Don't Panic — OpenTofu Fundamentals

OpenTofu is a way to write down the infrastructure you want, then make a machine show you the consequences before it starts making phone calls to cloud APIs. This is called infrastructure as code, which sounds grand until you notice that the alternative is often a browser tab named something like final-final-really-final.

The trick has four moving parts. Configuration describes the target. Providers translate that description into requests for remote platforms and services. State remembers which declared resource corresponds to which real object. A plan compares all of that and proposes the actions required to bring them together. Nothing is useful if you remember only one part. A configuration without state has forgotten its history; state without configuration has lost its instructions.

The usual ritual is write, initialize, format, validate, plan, review, and apply. tofu init prepares the working directory, including its backend and dependencies. tofu plan is the important pause. It may propose creation, update, replacement, or destruction, but it does not perform them. tofu apply executes approved actions. That gap is not ceremonial. It is where a harmless-looking edit discovers it would replace something carrying a great deal of real work.

The surprising part is that a valid plan is not a safety certificate. OpenTofu can calculate a path from configuration and state to remote objects. It cannot decide whether a replacement is acceptable, whether a credential should exist in provider settings, or whether a service can tolerate an outage. The tool is politely literal in this respect, which is better than being imaginatively destructive.

Start with one disposable resource and local state. The Cheatsheet holds the command loop and the meanings of addresses, modules, and backends. The Reference tab is where the official details live once a command or configuration block needs exact handling. Then move to shared state, locking, version controls, plan review, recovery, import, testing, policy checks, and controlled automation. The mental model remains stubbornly compact: configuration names the target, providers reach the APIs, state keeps the mapping, and plans control change.