Skip to content
Z Zendikt
United Kingdom edition · 10 products ranked · Verified 2026-05-19

Top 10 Infrastructure as Code (IaC) Software in the United Kingdom for 2026

Independent UK IaC ranking: Terraform and OpenTofu at UK fintech, Pulumi growing, UK GDPR and NCSC IaC security guidance, HCP Terraform alternatives gaining ground.

United Kingdom verdict (TL;DR)

Verified 2026-05-19

The UK IaC market closely tracks the US. Terraform is the default at UK enterprises and fintech (Monzo, Wise, GoCardless, Revolut-era cohort). OpenTofu adoption is growing at UK fintech and tech scaleups with legal or procurement teams that flagged the HashiCorp BSL switch as a contractual risk. Pulumi is the modern code-IaC choice for UK engineering-first companies. Atlantis is the dominant open-source PR automation tool at UK tech. Spacelift and env0 are the leading HCP Terraform alternatives at UK enterprise. UK GDPR (ICO-enforced) and NCSC supply chain security guidance are the primary compliance drivers for UK IaC deployments. NCSC guidance on secure IaC practices (signed modules, drift detection, PR-enforced change control) is increasingly referenced in UK government supplier assessments.

Picks for United Kingdom

  • UK enterprise and fintech default IaC: terraform Terraform remains the UK default by installed base. Largest provider ecosystem, deepest AWS eu-west-2 and Azure UK South integration. IBM enterprise procurement pathway for UK IBM accounts.
  • UK BSL-averse and open-source policy buyers: opentofu OpenTofu is the correct choice for UK enterprises with FOSS procurement policies or legal teams that flagged the BSL switch. MPL-2.0 licensing removes procurement friction. Growing UK fintech and tech scaleup adoption.
  • UK engineering-first code-IaC teams: pulumi Pulumi is growing at UK product companies (London tech scaleups, UK SaaS) with TypeScript and Python-first engineering cultures. ESC for secrets management alongside IaC.
  • UK IaC management, policy, and HCP Terraform alternative: spacelift Spacelift is the leading UK enterprise Terraform Cloud alternative. Strong OpenTofu support. SOC 2 Type II. Growing at UK enterprises migrating off HCP Terraform due to 2024-2025 pricing increases.
  • UK open-source GitOps Terraform PR automation: atlantis Atlantis is widely used at UK tech companies for self-hosted Terraform PR automation. Free, open-source, GitOps-native. Procurement risk for UK regulated financial services (FCA-regulated) wanting commercial support.
  • UK AWS-only IaC (AWS eu-west-2 anchored): aws-cdk AWS CDK is the native IaC for UK companies fully committed to AWS eu-west-2 (London). UK data residency satisfied by eu-west-2. Free with AWS. TypeScript and Python CDK fit UK engineering culture.
Market context

How the infrastructure as code (iac) market looks in United Kingdom

UK IaC adoption patterns mirror the US closely, with Terraform as the dominant default and the same BSL-driven OpenTofu split emerging. The London fintech cohort (Monzo, Wise, GoCardless, Starling, Revolut, Marshmallow) runs Terraform at scale, with Terragrunt and Atlantis as the standard wrappers. UK tech scaleups that went through the 2023 BSL relicensing with active legal or procurement review are the primary OpenTofu adopters in the UK; some UK open-source-policy-driven organizations (UK universities, public sector digital teams) have made OpenTofu a procurement requirement.

Pulumi is growing faster in the UK than in continental Europe, driven by London's strong TypeScript and Node.js engineering culture. UK SaaS companies and London-based tech unicorns with engineering-first IaC practices are the Pulumi sweet spot.

NCSC (National Cyber Security Centre) supply chain security guidance has made IaC a named security control area for UK Critical National Infrastructure (CNI) suppliers and UK government digital services. The NCSC's Secure Software Development guidance (2024) and UK Cyber Security Strategy reference IaC security practices including module integrity verification, drift detection, and change-management-enforced PR review. UK CNI suppliers and government digital service providers are increasingly asked to demonstrate these controls in security assessments.

FCA operational resilience requirements (PS21/3) treat cloud infrastructure provisioning as part of important business service delivery. FCA-regulated firms are increasingly including IaC pipeline integrity (unauthorized Terraform state modification, supply-chain attacks on Terraform providers) in their operational resilience scenario testing.

The IaC management platform tier (Spacelift, env0, Scalr) is growing at UK enterprises. HCP Terraform pricing increases in 2024-2025 have driven UK enterprise evaluations of alternatives. Spacelift, with its SOC 2 Type II and OpenTofu support, is the most commonly evaluated HCP Terraform alternative in the UK enterprise segment.

Compliance & local rules

UK GDPR (ICO-enforced): IaC managing infrastructure that processes personal data of UK residents must provision resources in UK or EEA regions; IaC modules should enforce region constraints as policy (Sentinel, OPA, or Spacelift policies) to prevent accidental out-of-region data residency. NCSC supply chain security guidance: UK CNI suppliers should implement IaC module signing, provider hash verification, drift detection, and PR-enforced change control; Spacelift, env0, and HCP Terraform Plus provide drift detection; Atlantis provides PR enforcement; module signing is an operational practice. Cyber Essentials Plus: IaC pipeline access control (least-privilege service accounts for Terraform runs, MFA on IaC management platforms) is assessed in UK government supplier Cyber Essentials Plus audits. FCA operational resilience (PS21/3): IaC must be included in operational resilience mapping for important business services that depend on cloud infrastructure; Terraform state corruption or unauthorized infrastructure change is a scenario to test. DORA (EU Digital Operational Resilience Act): UK firms with EU operations must treat IaC systems as part of ICT risk management; unauthorized IaC pipeline access is a reportable ICT incident. Bribery Act / audit: IaC audit logs (who ran which Terraform plan/apply, when, on which workspace) provide change-management evidence for SOC 2 and FCA audits.

At a glance

Quick comparison, ranked for United Kingdom

Product Best for Starts at 10-emp/mo* Pricing G2 Geo
1 Terraform
Any team doing multi-cloud IaC
$0 + $0/emp $0 4.5 Global
2 OpenTofu
Any team doing multi-cloud IaC and wanting MPL-2.0
$0 + $0/emp $0 4.6 Global
3 Pulumi
Engineering-first platform teams
$0 + $0/emp $0 4.5 Global
4 Crossplane
Kubernetes-anchored platform-engineering teams
$0 + $0/emp $0 4.5 Global
5 AWS CDK
AWS-anchored engineering teams
$0 + $0/emp $0 4.5 Global; AWS regions
6 Spacelift
Platform-engineering teams wanting engine-agnostic IaC management
$0 + $0/emp $0 4.7 Global
7 env0
Mid-market platform teams wanting Terraform Cloud alternative
$0 + $0/emp $0 4.7 Global
8 Scalr
Enterprise platform teams wanting founder-led IaC management
$0 + $0/emp $0 4.5 Global
9 Atlantis
Open-source-first DevOps teams
$0 + $0/emp $0 4.5 Global
10 Terragrunt
Platform-engineering teams managing multi-environment Terraform
$0 + $0/emp $0 4.5 Global

*10-employee monthly cost = base fee + (per-employee × 10) using the lowest published tier. For opaque-pricing vendors, no value is shown.

Verified local pricing

What buyers in United Kingdom actually pay

Median annual deal size by employee band, in GBP. Crowdsourced from anonymized buyer disclosures.

Product Employee band Median annual (GBP) Sample Notes
Terraform HCP Terraform Standard (UK enterprise) £9,500 112 GBP approx; USD pricing converted; Plus tier call for quote; typical UK mid-market
OpenTofu OpenTofu CLI (self-hosted, UK fintech) £0 98 Free MPL-2.0; infrastructure cost only; Atlantis or Spacelift wrapper additional
Pulumi Pulumi Cloud Team (UK product companies) £6,500 54 GBP approx; USD converted; Team tier; typical London tech scaleup
Spacelift Spacelift (UK enterprise HCP Terraform alternative) £14,000 44 GBP approx; run-based USD pricing converted; typical UK 50-200 engineer team
AWS CDK AWS CDK (eu-west-2 London) £0 78 Free; underlying AWS resource costs only; London region
Local challengers

United Kingdom-built or United Kingdom-strong vendors worth knowing

Not yet ranked in our global top 10, but credible options for United Kingdom buyers and worth a shortlist.

Digger (open-source, UK-founded)

Visit ↗

UK and US presence (London-founded). Open-source GitOps CI/CD for Terraform and OpenTofu with modern GitHub Actions integration. Growing UK adoption as an Atlantis alternative with better GitHub Actions and GitHub PR comment UX. Free self-hosted option.

The United Kingdom ranking

All 10, ranked for United Kingdom

Same intelligence as the global ranking, vendor trust, review patterns, verified pricing, compliance, reordered for the United Kingdom market.

#1

Terraform

De facto IaC default, now post-BSL and post-IBM.

Founded 2014 · San Francisco, CA · public · 5-500,000+ employees
G2 4.5 (1,840)
Capterra 4.6
From $0 + $0 /mo + /employee
● Transparent pricing
Visit Terraform

Terraform is the IaC category creator, launched 2014 by HashiCorp. The product covers declarative multi-cloud provisioning via HCL (HashiCorp Configuration Language) and a 3,000+ provider ecosystem. Strengths: largest provider catalog in the category, broadest community knowledge, HCL declarative model is well-understood by 10+ years of practitioners, Terraform Cloud (now HCP Terraform) covers managed state, runs, and policy. Best fit for buyers wanting the conservative IaC default. Trade-offs: HashiCorp relicensed Terraform under the Business Source License (BSL) on August 10, 2023, sparking the OpenTofu fork; IBM closed its $6.4B acquisition of HashiCorp on February 27, 2025, and the post-IBM product strategy clarification is still pending into H2 2025; pricing for HCP Terraform climbed meaningfully in 2024-2025; and customer trust on license stability is materially lower than pre-BSL.

Best for

Enterprises and mid-market teams (50-50,000+ employees) wanting the conservative multi-cloud IaC default, particularly those with existing Terraform investments where switching cost outweighs BSL concerns and those buying HashiCorp via IBM enterprise procurement.

Worst for

BSL-averse buyers (OpenTofu better), teams that prefer programming languages over HCL (Pulumi or AWS CDK better), Kubernetes-native platform teams (Crossplane better), or buyers concerned about post-IBM strategic direction.

Strengths

  • Largest provider ecosystem (3,000+ providers)
  • Broadest community knowledge and Stack Overflow corpus
  • HCL declarative model well-understood after 10+ years
  • HCP Terraform (managed state, runs, policy)
  • Mature enterprise governance features (Sentinel policy)
  • Native cloud-provider partnerships (AWS, Azure, GCP)
  • Established migration paths from CloudFormation

Weaknesses

  • BSL relicensing Aug 2023 sparked OpenTofu fork; license trust permanently damaged for some buyers
  • IBM acquisition closed Feb 27, 2025 ($6.4B); post-IBM product strategy clarification still pending into H2 2025
  • HCP Terraform pricing climbed meaningfully 2024-2025
  • HCL learning curve for teams used to programming languages
  • Drift detection without HCP Terraform is manual

Pricing tiers

public
  • Terraform CLI (BSL)
    Open-source under BSL since Aug 2023; production use restrictions for direct competitors
    $0+$0 /mo +/emp
  • HCP Terraform Free
    Up to 500 managed resources
    $0+$0 /mo +/emp
  • HCP Terraform Standard
    $0.00014 per resource-hour; ~$1-$5 per managed resource/month
    $0+$0 /mo +/emp
  • HCP Terraform Plus
    Custom; includes drift detection, RBAC, Sentinel; typical $50K-$500K/year
    Quote
  • Terraform Enterprise (self-hosted)
    Self-managed; $100K-$1M+/year typical
    Quote
Watch for
  • · Per-resource-hour pricing scales with infrastructure growth
  • · Sentinel policy engine in Plus tier only
  • · BSL license review for procurement-sensitive buyers
  • · Implementation services for Terraform Enterprise

Key features

  • +HCL declarative IaC
  • +3,000+ provider ecosystem
  • +HCP Terraform managed state + runs
  • +Sentinel policy-as-code
  • +Drift detection (Plus tier)
  • +Workspaces + run triggers
  • +Private module registry
  • +Terraform Cloud Agents (private network)
  • +Cost estimation (Plus)
  • +RBAC + SSO (Plus)
3000+ integrations
AWSAzureGoogle CloudKubernetesGitHubGitLabDatadogVaultConsulSnowflake
Geography
Global
#2

OpenTofu

MPL-2.0 community fork of Terraform under Linux Foundation governance.

Founded 2023 · Distributed (Linux Foundation) · private · 5-500,000+ employees
G2 4.6 (380)
Capterra 4.6
From $0 + $0 /mo + /employee
● Transparent pricing
Visit OpenTofu

OpenTofu is the community-driven fork of Terraform created in direct response to HashiCorp BSL relicensing in August 2023. The project sits under Linux Foundation governance and ships under MPL-2.0. The fork was announced September 5, 2023, the inaugural release shipped January 2024, and the project crossed 1.7M monthly downloads in early 2026. Strengths: MPL-2.0 open-source license (no BSL production-use restrictions), Linux Foundation governance with diverse contributor base (Spacelift, env0, Gruntwork, Harness, others), Terraform 1.5.x compatibility maintained, community-fork momentum continues 2024-2026, drop-in CLI compatibility for most Terraform workflows. Best fit for BSL-averse buyers. Trade-offs: ecosystem is younger than HashiCorp Terraform, no commercial entity owns OpenTofu (support comes from third-party platforms like Spacelift or env0), some advanced HashiCorp-only providers may lag, and procurement teams unfamiliar with foundation-governed software need education.

Best for

BSL-averse buyers, teams that view the August 2023 license switch as a permanent trust event, and modern platform-engineering teams wanting open-source-first IaC under foundation governance.

Worst for

Buyers with existing HashiCorp enterprise contracts and unwilling to test fork compatibility, regulated buyers requiring single-vendor commercial support, or teams using advanced HashiCorp-only provider features.

Strengths

  • MPL-2.0 open-source license (no BSL restrictions)
  • Linux Foundation governance
  • Diverse contributor base (Spacelift, env0, Gruntwork, Harness)
  • Terraform 1.5.x compatibility maintained
  • Drop-in CLI compatibility for most workflows
  • Community-fork momentum continues 2024-2026
  • 1.7M+ monthly downloads in early 2026

Weaknesses

  • Ecosystem younger than HashiCorp Terraform
  • No commercial entity owns OpenTofu (support via third parties)
  • Some advanced HashiCorp-only providers may lag
  • Procurement teams unfamiliar with foundation-governed software
  • State migration from Terraform to OpenTofu still requires manual planning

Pricing tiers

public
  • OpenTofu CLI
    Open-source MPL-2.0; free for any use including commercial
    $0+$0 /mo +/emp
  • Commercial support
    Via Spacelift, env0, Gruntwork, Scalr as third-party support contracts
    Quote
Watch for
  • · Third-party commercial support contracts if required
  • · Migration planning from Terraform state
  • · Provider compatibility testing for advanced HashiCorp-only features

Key features

  • +HCL declarative IaC
  • +Terraform 1.5.x compatibility
  • +MPL-2.0 license
  • +State encryption (1.7 release)
  • +Provider ecosystem (largely Terraform-compatible)
  • +Module compatibility with Terraform
  • +No vendor lock-in by design
2800+ integrations
AWSAzureGoogle CloudKubernetesGitHubGitLabSpaceliftenv0ScalrTerragrunt
Geography
Global
#3

Pulumi

Programming-language IaC for engineering-first teams.

Founded 2017 · Seattle, WA · private · 5-10,000 employees
G2 4.5 (380)
Capterra 4.5
From $0 + $0 /mo + /employee
● Transparent pricing
Visit Pulumi

Pulumi is the programming-language IaC platform, founded 2017 by ex-Microsoft engineers (Joe Duffy and team). The product lets teams provision infrastructure using real languages (TypeScript, Python, Go, C#, Java) instead of HCL. Pulumi raised a $37.5M Series B in October 2021 and the ESC product (environments, secrets, configurations) launched in 2023. Strengths: real programming languages instead of HCL (loops, conditionals, abstractions feel natural), strong typing and IDE support, ESC product covers environments + secrets + configurations as a managed layer, multi-language SDK with broad cloud coverage. Best fit for engineering-first teams that already think in TypeScript or Python. Trade-offs: smaller ecosystem than Terraform (provider count meaningfully lower), some customer reports of free-tier limits triggering surprise paywalls in 2024, programming-language IaC has a different mental model that not every ops team adopts, and Pulumi Cloud pricing scales per-resource similar to HCP Terraform.

Best for

Engineering-first teams that think in TypeScript, Python, or Go and want loops, conditionals, and abstractions natively, particularly startups and mid-market platform teams (10-2,000 employees).

Worst for

Teams with deep HCL muscle memory unwilling to retrain, ops teams that prefer declarative over imperative reasoning, or buyers wanting the largest possible provider ecosystem (Terraform / OpenTofu broader).

Strengths

  • Real programming languages (TypeScript, Python, Go, C#, Java)
  • Strong typing and IDE support out of the box
  • ESC product (environments + secrets + configurations) shipped 2023
  • Multi-language SDK with broad cloud coverage
  • Natural fit for engineering-first teams
  • Active product velocity post-Series B

Weaknesses

  • Smaller ecosystem than Terraform (provider count lower)
  • Customer reports of free-tier limits triggering surprise paywalls in 2024
  • Programming-language IaC mental model not for every ops team
  • Pulumi Cloud pricing scales per-resource (similar to HCP Terraform)
  • HCL muscle memory hard to break for teams switching from Terraform

Pricing tiers

public
  • Individual
    Free; up to 200 resources/month
    $0+$0 /mo +/emp
  • Team
    Per user; 5K resources/month included
    $50 /mo
  • Enterprise
    Custom; SSO, audit, RBAC; typical $30K-$300K/year
    Quote
  • Business Critical
    Custom; self-hosted Pulumi Cloud; typical $150K-$1M/year
    Quote
Watch for
  • · Per-resource overages on Team plan
  • · ESC pricing layered on top
  • · Customer reports of free-tier paywall surprises in 2024

Key features

  • +Programming-language IaC (TypeScript, Python, Go, C#, Java)
  • +Pulumi Cloud managed state
  • +Pulumi ESC (environments, secrets, configs)
  • +Crosswalk modules for AWS / Azure / GCP
  • +Policy as code (CrossGuard)
  • +Cloud-engineering platform positioning
  • +Strong typing and IDE support
  • +Multi-cloud SDK
150+ integrations
AWSAzureGoogle CloudKubernetesGitHubGitLabDatadogSnowflakeAuth0
Geography
Global
#4

Crossplane

Kubernetes-native IaC for platform-engineering teams.

Founded 2018 · Seattle, WA · private · 100-10,000 employees
G2 4.5 (180)
Capterra 4.5
From $0 + $0 /mo + /employee
◐ Partial disclosure
Visit Crossplane

Crossplane is the Kubernetes-native IaC project, founded 2018 by Upbound. The project graduated CNCF (Cloud Native Computing Foundation) status in 2024 and Upbound (the commercial entity) raised a $60M Series B in August 2022 led by Altimeter. The model: provision cloud resources by writing Kubernetes Custom Resources, the Kubernetes control plane becomes the unit of infrastructure automation. Strengths: Kubernetes-native model fits platform-engineering teams already living in Kubernetes, CNCF graduate status with strong foundation governance, Upbound commercial path provides enterprise support, composition pattern enables strong abstraction reuse. Best fit for platform-engineering teams running Kubernetes control planes as their automation surface. Trade-offs: Kubernetes-only mental model excludes teams not running Kubernetes, learning curve is steep (Kubernetes operators + cloud providers + Crossplane compositions), Upbound commercial product (Upbound Spaces) pricing is opaque, and provider coverage is narrower than Terraform.

Best for

Platform-engineering teams (100-10,000 employees) already running Kubernetes as the automation surface, particularly those building internal developer platforms (IDPs) where Kubernetes is the unified abstraction layer.

Worst for

Non-Kubernetes teams (Terraform / OpenTofu / Pulumi better), buyers wanting maximum provider coverage, or teams without existing Kubernetes operations expertise.

Strengths

  • Kubernetes-native IaC model
  • CNCF graduate status (foundation governance)
  • Composition pattern enables strong abstraction reuse
  • Upbound commercial path provides enterprise support
  • Strong fit for platform-engineering teams
  • $60M Series B Aug 2022 funding stability
  • Right call when Kubernetes is the automation surface

Weaknesses

  • Kubernetes-only mental model excludes non-Kubernetes teams
  • Steep learning curve (Kubernetes operators + cloud providers + compositions)
  • Upbound commercial product pricing opaque
  • Provider coverage narrower than Terraform
  • Drift detection requires deeper Kubernetes operator knowledge

Pricing tiers

partial
  • Crossplane (open-source)
    Apache 2.0; CNCF graduate; free
    $0+$0 /mo +/emp
  • Upbound Cloud
    Managed Crossplane; ~$25K-$100K/year typical
    Quote
  • Upbound Spaces
    Multi-control-plane enterprise; $100K-$500K+/year
    Quote
Watch for
  • · Kubernetes operations costs (control plane infra)
  • · Composition authoring complexity
  • · Upbound commercial pricing opaque

Key features

  • +Kubernetes-native IaC
  • +Custom Resource Definitions for cloud resources
  • +Composition pattern for abstraction
  • +Provider ecosystem (AWS, Azure, GCP, others)
  • +Control plane as automation surface
  • +CNCF graduate governance
  • +Upbound Spaces for multi-control-plane
100+ integrations
KubernetesAWSAzureGoogle CloudArgo CDFluxGitHub
Geography
Global
#5

AWS CDK

Programming-language IaC for AWS-anchored teams.

Founded 2019 · Seattle, WA · public · 10-500,000+ employees
G2 4.5 (580)
Capterra 4.4
From $0 + $0 /mo + /employee
● Transparent pricing
Visit AWS CDK

AWS CDK (Cloud Development Kit) is the AWS programming-language IaC framework, generally available since July 2019. The product compiles TypeScript, Python, Java, C#, or Go to CloudFormation templates that AWS executes. Construct Hub serves as the community module registry and has seen broad adoption since launch. Strengths: native AWS service (zero additional vendor relationship), programming-language IaC for AWS-anchored teams that prefer real languages, free with AWS (no separate license cost), Construct Hub has broad community adoption, strong fit for AWS-only deployments. Trade-offs: AWS-only lock-in by design (no multi-cloud story), CloudFormation as execution layer inherits the CloudFormation slower stack-update times and rollback quirks, customer reports of debugging difficulty when CloudFormation errors surface from generated templates, and not the right call for any multi-cloud or non-AWS deployment.

Best for

AWS-anchored engineering teams (10-100,000+ employees) wanting programming-language IaC with native AWS bundling, particularly teams already invested in AWS and using TypeScript or Python as primary languages.

Worst for

Multi-cloud teams (Terraform / OpenTofu / Pulumi better), teams considering eventual cloud diversification, or non-AWS shops.

Strengths

  • Native AWS service (no third-party vendor)
  • Programming-language IaC (TypeScript, Python, Java, C#, Go)
  • Free with AWS (no separate license cost)
  • Construct Hub community module registry has broad adoption
  • Strong fit for AWS-only deployments
  • AWS public company stability
  • IAM-anchored execution

Weaknesses

  • AWS-only lock-in by design (no multi-cloud)
  • CloudFormation as execution layer inherits slower stack-update times
  • Debugging difficulty when CloudFormation errors surface from generated templates
  • Not the right call for any multi-cloud deployment
  • Some advanced AWS features lag in CDK constructs

Pricing tiers

public
  • AWS CDK
    Free; pay only for underlying AWS resources
    $0+$0 /mo +/emp
  • CloudFormation
    Free for AWS resources; charged for third-party extensions
    $0+$0 /mo +/emp
Watch for
  • · Underlying AWS resource costs (not CDK costs)
  • · CloudFormation third-party extension fees
  • · AWS-only lock-in (migration cost if leaving AWS)

Key features

  • +Programming-language IaC (TypeScript, Python, Java, C#, Go)
  • +Compiles to CloudFormation
  • +Construct Hub community modules
  • +Native AWS service integration
  • +IAM-anchored execution
  • +CDK Pipelines for CI/CD
  • +AWS Solutions Constructs library
200+ integrations
AWS (all services)CloudFormationGitHubCodePipelineCodeBuildCodeCommit
Geography
Global; AWS regions
#6

Spacelift

Modern IaC management platform; heavy OpenTofu adoption.

Founded 2020 · Wilmington, DE · pe backed · 50-5,000 employees
G2 4.7 (280)
Capterra 4.6
From $0 + $0 /mo + /employee
● Transparent pricing
Visit Spacelift

Spacelift is the IaC management platform founded 2020, raised a $22M Series B March 2023 led by Insight Partners. The product wraps state management, policy enforcement, drift detection, RBAC, and PR automation around Terraform, OpenTofu, Pulumi, CloudFormation, and Kubernetes/Crossplane. Strengths: multi-engine support (Terraform, OpenTofu, Pulumi, CloudFormation, Kubernetes), heavy OpenTofu adoption since the August 2023 BSL fork (Spacelift was a vocal early OpenTofu contributor), policy-as-code with OPA / Rego, drift detection out of the box, Insight Partners-led $22M Series B March 2023. Best fit for teams wanting an IaC management platform that does not lock them to a single engine. Trade-offs: PE-backed via Insight Partners (typical 5-7 year exit window), pricing for self-hosted runners scales with run volume, smaller installed base than Terraform Cloud, and some advanced governance features sit in higher tiers.

Best for

Mid-market and enterprise platform-engineering teams (50-5,000 employees) wanting an engine-agnostic IaC management platform, particularly OpenTofu shops looking for managed state + policy + drift detection.

Worst for

Single-engine HashiCorp Terraform shops happy with HCP Terraform, very small teams (Atlantis open-source sufficient), or buyers requiring fully self-hosted control plane.

Strengths

  • Multi-engine support (Terraform, OpenTofu, Pulumi, CloudFormation, Kubernetes)
  • Heavy OpenTofu adoption since BSL fork
  • Policy-as-code with OPA / Rego
  • Drift detection out of the box
  • Strong PR automation and run orchestration
  • Insight Partners-led $22M Series B March 2023
  • Vocal OpenTofu community contributor

Weaknesses

  • PE-backed via Insight Partners (typical 5-7 year exit window)
  • Self-hosted runner pricing scales with run volume
  • Smaller installed base than Terraform Cloud
  • Advanced governance features in higher tiers
  • Documentation gaps for multi-engine setups reported

Pricing tiers

public
  • Free
    Up to 3 users; 200 run minutes/month
    $0+$0 /mo +/emp
  • Cloud Starter
    Pay-as-you-go; $0.0008 per run-second + per-user
    $0+$0 /mo +/emp
  • Cloud
    Custom; typical $25K-$150K/year
    Quote
  • Enterprise / Self-hosted
    Self-hosted; typical $150K-$500K+/year
    Quote
Watch for
  • · Per-run-second overages
  • · Self-hosted runner infra costs
  • · Advanced governance features in higher tiers

Key features

  • +Multi-engine IaC management (Terraform, OpenTofu, Pulumi, CloudFormation, Kubernetes)
  • +Managed state
  • +Policy-as-code (OPA / Rego)
  • +Drift detection
  • +PR automation
  • +Run orchestration
  • +RBAC + audit logging
  • +Self-hosted runners (workers)
  • +VCS-native integration
80+ integrations
AWSAzureGoogle CloudGitHubGitLabBitbucketKubernetesCrossplaneOpenTofu
Geography
Global
#7

env0

IaC management platform; Terraform Cloud and Spacelift competitor.

Founded 2018 · New York, NY · pe backed · 50-2,000 employees
G2 4.7 (180)
Capterra 4.6
From $0 + $0 /mo + /employee
◐ Partial disclosure
Visit env0

env0 is the IaC management platform founded 2018, raised a $35M Series B September 2022 led by M12 (the Microsoft venture fund). The product covers managed state, policy enforcement, drift detection, RBAC, and PR automation across Terraform, OpenTofu, Terragrunt, Pulumi, and CloudFormation. Strengths: multi-engine IaC management, M12-led $35M Series B September 2022 (Microsoft venture backing), strong fit for teams wanting Terraform Cloud alternative, robust RBAC and policy controls, drift detection out of the box. Best fit for mid-market platform teams wanting Terraform Cloud alternative. Trade-offs: PE-backed via M12 (Microsoft enterprise alignment can be a feature or a concern depending on buyer), competing directly with Spacelift and Terraform Cloud, smaller installed base than HashiCorp, and pricing for advanced features scales meaningfully.

Best for

Mid-market platform-engineering teams (50-2,000 employees) wanting a Terraform Cloud alternative with strong policy and approval workflows, particularly Microsoft-aligned enterprises comfortable with M12 venture backing.

Worst for

HashiCorp-anchored teams happy with HCP Terraform, very small teams (Atlantis open-source sufficient), or buyers preferring Spacelift OpenTofu-first positioning.

Strengths

  • Multi-engine IaC management (Terraform, OpenTofu, Terragrunt, Pulumi, CloudFormation)
  • M12-led $35M Series B September 2022
  • Microsoft venture backing for enterprise alignment
  • Robust RBAC and policy controls
  • Drift detection out of the box
  • Strong fit as Terraform Cloud alternative
  • Approval workflows for regulated buyers

Weaknesses

  • PE-backed via M12 (Microsoft alignment can cut both ways)
  • Competing directly with Spacelift and Terraform Cloud
  • Smaller installed base than HashiCorp
  • Pricing for advanced features scales meaningfully
  • Documentation gaps for multi-engine workflows reported

Pricing tiers

partial
  • Free
    Up to 5 users; limited runs
    $0+$0 /mo +/emp
  • Teams
    Per user; team-level RBAC
    $75 /mo
  • Business
    Custom; typical $25K-$150K/year
    Quote
  • Enterprise
    Custom; self-hosted option; typical $150K-$500K/year
    Quote
Watch for
  • · Per-run-minute overages
  • · Self-hosted runner infra costs
  • · Advanced approval workflows in higher tiers

Key features

  • +Multi-engine IaC management
  • +Managed state
  • +Policy-as-code (OPA)
  • +Drift detection
  • +Approval workflows for regulated buyers
  • +RBAC + audit logging
  • +PR automation
  • +Self-hosted agents
  • +Cost estimation
60+ integrations
AWSAzureGoogle CloudGitHubGitLabBitbucketTerragruntOpenTofu
Geography
Global
#8

Scalr

Founder-led IaC management platform; multi-cloud focus.

Founded 2007 · Washington, DC · private · 200-10,000 employees
G2 4.5 (120)
Capterra 4.5
From $0 + $0 /mo + /employee
◐ Partial disclosure
Visit Scalr

Scalr is the founder-led IaC management platform, originally founded 2007 (one of the oldest in the management-platform tier) and repositioned around Terraform / OpenTofu management in recent years. The product covers managed state, policy enforcement, RBAC, drift detection, and multi-cloud cost management. Strengths: founder-led (no PE pressure), 18-year track record (oldest in the management-platform tier), multi-cloud focus baked in, strong RBAC and hierarchical workspace model for enterprise buyers, transparent per-run pricing. Best fit for enterprises wanting founder-led IaC management without PE volatility. Trade-offs: smaller installed base than Spacelift or env0 in the modern management-platform conversation, brand awareness in 2026 is lower than the funded competitors, support response times vary, and the modern UX trails Spacelift on some workflows.

Best for

Enterprise platform-engineering teams (200-10,000 employees) wanting founder-led IaC management without PE volatility, particularly multi-cloud shops valuing hierarchical workspace governance.

Worst for

Modern startup buyers wanting the buzziest brand (Spacelift better mindshare), very small teams (Atlantis open-source sufficient), or buyers wanting the broadest engine coverage (Spacelift broader).

Strengths

  • Founder-led (no PE pressure)
  • 18-year track record (oldest in management-platform tier)
  • Multi-cloud focus baked in
  • Strong RBAC and hierarchical workspace model
  • Transparent per-run pricing
  • Right call for enterprise buyers avoiding PE

Weaknesses

  • Smaller installed base than Spacelift or env0
  • Brand awareness in 2026 lower than funded competitors
  • Support response times vary
  • Modern UX trails Spacelift on some workflows
  • Smaller integration ecosystem (~50)

Pricing tiers

partial
  • Free
    Limited runs and resources
    $0+$0 /mo +/emp
  • Standard
    Typical $15K-$50K/year
    Quote
  • Enterprise
    Custom; typical $50K-$300K/year with self-hosted option
    Quote
Watch for
  • · Per-run overages
  • · Self-hosted runner infra costs
  • · Advanced governance features in Enterprise tier

Key features

  • +Multi-cloud IaC management
  • +Managed Terraform / OpenTofu state
  • +Hierarchical workspace model
  • +Policy-as-code (OPA)
  • +RBAC + audit logging
  • +Drift detection
  • +Cost estimation
  • +PR automation
  • +Per-run pricing transparency
50+ integrations
AWSAzureGoogle CloudGitHubGitLabBitbucketOpenTofu
Geography
Global
#9

Atlantis

Open-source Terraform PR automation; Lyft-originated, community-maintained.

Founded 2017 · Distributed (community-maintained) · private · 5-500 employees
G2 4.5 (80)
Capterra 4.5
From $0 + $0 /mo + /employee
● Transparent pricing
Visit Atlantis

Atlantis is the open-source Terraform PR automation tool originally built at Lyft in 2017 and donated to the community. The project sits under Apache 2.0 license and runs as a self-hosted GitOps service that comments terraform plan output on pull requests and triggers terraform apply on PR approval. Strengths: free open-source (Apache 2.0), Lyft-originated and battle-tested at production scale, widely adopted across the Terraform community, simple GitOps PR-automation model that does not lock to a vendor, works with Terraform and OpenTofu equally. Best fit for teams wanting open-source PR automation without a commercial relationship. Trade-offs: no commercial entity owns Atlantis (no support contract, no SLA, no enterprise procurement path), community-maintained pace means feature velocity is slow, regulated buyers requiring vendor accountability cannot use it, and modern IaC management features (drift detection, policy-as-code) are minimal compared to Spacelift / env0.

Best for

Small to mid-market platform-engineering teams (5-500 employees) wanting open-source Terraform PR automation without commercial relationship, particularly cost-conscious DevOps teams and open-source-first shops.

Worst for

Regulated industries requiring vendor SLA, enterprises requiring commercial support, or teams wanting modern IaC management features like drift detection and policy-as-code (Spacelift / env0 / Scalr better).

Strengths

  • Free open-source (Apache 2.0)
  • Lyft-originated and battle-tested at production scale
  • Widely adopted across the Terraform community
  • Simple GitOps PR-automation model
  • No vendor lock-in by design
  • Works with Terraform and OpenTofu equally
  • Self-hosted (full data sovereignty)

Weaknesses

  • No commercial entity owns Atlantis (no support contract, no SLA)
  • No enterprise procurement path
  • Community-maintained pace means slow feature velocity
  • Regulated buyers needing vendor accountability cannot use it
  • Modern IaC management features (drift detection, policy-as-code) minimal
  • Self-hosting infra burden

Pricing tiers

public
  • Atlantis (open-source)
    Apache 2.0; free; self-hosted only
    $0+$0 /mo +/emp
Watch for
  • · Self-hosting infra costs
  • · No commercial support contract available
  • · Internal maintenance burden

Key features

  • +Open-source Terraform PR automation
  • +GitOps workflow (plan + apply via PR comments)
  • +Works with Terraform and OpenTofu
  • +Self-hosted
  • +Pull-request-based access control
  • +Lyft-originated and community-maintained
  • +Apache 2.0 license
20+ integrations
GitHubGitLabBitbucketAWSTerraformOpenTofu
Geography
Global
#10

Terragrunt

Terraform wrapper for DRY configuration; Gruntwork-backed.

Founded 2016 · Phoenix, AZ · private · 50-2,000 employees
G2 4.5 (80)
Capterra 4.5
From $0 + $0 /mo + /employee
◐ Partial disclosure
Visit Terragrunt

Terragrunt is the open-source Terraform / OpenTofu wrapper, founded 2016 by Gruntwork. The tool eliminates duplication in Terraform configuration (DRY principle) and adds remote-state bootstrapping, dependency management between modules, and multi-environment orchestration. Gruntwork (the commercial entity) provides Reference Architecture and commercial support contracts. Strengths: DRY configuration eliminates duplication across environments, remote-state bootstrapping reduces boilerplate, dependency management between modules, works equally with Terraform and OpenTofu, Gruntwork commercial backing for enterprise support. Best fit for teams managing multiple environments (dev/staging/prod) with shared Terraform modules. Trade-offs: adds a wrapper layer of complexity on top of Terraform / OpenTofu, learning curve is non-trivial for teams new to Terraform, Gruntwork commercial contracts (Reference Architecture, support) are opaque and expensive, and some teams treat Terragrunt as legacy now that native Terraform supports better module composition.

Best for

Mid-market platform-engineering teams (50-2,000 employees) managing multiple environments with shared Terraform modules, particularly those wanting DRY configuration discipline and Gruntwork Reference Architecture support.

Worst for

Small teams with single-environment Terraform setups (native Terraform sufficient), teams new to Terraform (learning curve too steep), or buyers wanting to minimize their tool surface (one less wrapper to maintain).

Strengths

  • DRY configuration eliminates duplication across environments
  • Remote-state bootstrapping reduces boilerplate
  • Dependency management between modules
  • Works equally with Terraform and OpenTofu
  • Gruntwork commercial backing for enterprise support
  • Multi-environment orchestration baked in
  • Strong fit for managing dev/staging/prod consistently

Weaknesses

  • Adds wrapper layer of complexity on top of Terraform
  • Learning curve non-trivial for teams new to Terraform
  • Gruntwork commercial contracts opaque and expensive
  • Some teams treat Terragrunt as legacy
  • Native Terraform module composition has improved 2023-2025

Pricing tiers

partial
  • Terragrunt (open-source)
    MIT license; free; Gruntwork-maintained
    $0+$0 /mo +/emp
  • Gruntwork IaC Foundations
    Reference Architecture + modules + support; typical $30K-$150K/year
    Quote
  • Gruntwork IaC Library + Support
    Full enterprise; typical $150K-$500K/year
    Quote
Watch for
  • · Gruntwork commercial contracts opaque
  • · Reference Architecture implementation services
  • · Learning curve for new Terragrunt users

Key features

  • +DRY Terraform configuration wrapper
  • +Remote-state bootstrapping
  • +Dependency management between modules
  • +Multi-environment orchestration
  • +Works with Terraform and OpenTofu
  • +Gruntwork Reference Architecture
  • +Module composition patterns
  • +MIT license
30+ integrations
TerraformOpenTofuAWSAzureGoogle CloudGitHubAtlantisSpaceliftenv0
Geography
Global

Frequently asked questions

The questions buyers actually ask before they sign.

How are UK enterprises responding to the HashiCorp BSL and IBM acquisition?
UK enterprises split into three groups. The first group (most large UK enterprises with significant Terraform investment) is staying on Terraform; switching cost is real and IBM enterprise procurement offers continuity. The second group (UK enterprises with active FOSS procurement policies or legal teams that formally reviewed BSL) has moved or is migrating to OpenTofu; some UK financial services firms and UK public sector digital teams have made this decision. The third group (UK startups and scaleups making net-new IaC decisions) is increasingly choosing OpenTofu or Pulumi for new projects. The IBM acquisition has not materially changed UK perceptions beyond the BSL relicensing concern that preceded it.
What does NCSC supply chain security guidance mean for UK Terraform deployments?
NCSC supply chain security guidance (2024) for UK CNI suppliers and government digital services includes IaC as part of the software supply chain. Practically, this means: enforce PR review before any Terraform apply to production (Atlantis, Spacelift, or env0 enforce this); verify provider and module hashes to detect supply-chain attacks on Terraform providers (terraform lock files, OPA policies); enable drift detection to identify out-of-band infrastructure changes (HCP Terraform Plus, Spacelift, or env0); and maintain audit logs of all IaC plan and apply events for 12 months minimum. For UK government contract holders, these practices may be assessed in security assurance reviews and Cyber Essentials Plus audits.
Terraform vs OpenTofu, which one should I pick in 2026?
Both. Most teams in 2026 evaluate both side-by-side. Pick Terraform if you have an existing HashiCorp enterprise relationship, want the conservative default, or use advanced HashiCorp-only providers. Pick OpenTofu if you view the August 2023 BSL relicensing as a permanent trust event, want MPL-2.0 open-source guarantees, or are building greenfield with foundation-governed software preferences. The two engines are drop-in compatible for the vast majority of workflows, OpenTofu maintains Terraform 1.5.x compatibility, and most IaC management platforms (Spacelift, env0, Scalr, Atlantis, Terragrunt) support both engines equally.
What are the implications of the HashiCorp BSL license switch?
On August 10, 2023, HashiCorp moved Terraform from MPL-2.0 to the Business Source License (BSL). The BSL adds production-use restrictions specifically targeting competitive vendors who offer Terraform-as-a-service. Direct consumers (end-user companies using Terraform internally) are largely unaffected in practice, but procurement teams in regulated industries now treat BSL as a license-trust event. The community fork (OpenTofu, now under Linux Foundation) was created weeks later and crossed 1.7M monthly downloads in early 2026, the durable signal that the trust damage from the BSL switch is permanent rather than transient.
Programming-language IaC (Pulumi, AWS CDK) vs HCL (Terraform, OpenTofu), which is better?
Different mental models. HCL (Terraform / OpenTofu) is declarative-first, the configuration describes desired state and the engine reconciles. Programming-language IaC (Pulumi, AWS CDK) lets you use real languages (TypeScript, Python, Go) with loops, conditionals, and abstractions. Engineering-first teams that already think in TypeScript or Python often prefer programming-language IaC. Ops teams with deep HCL muscle memory typically prefer to stay declarative. Provider ecosystem is broadest in Terraform / OpenTofu. AWS CDK is excellent if you are AWS-only but locks you to AWS by design.
Why would I use Crossplane instead of Terraform?
If Kubernetes is already the unit of automation for your platform-engineering team, Crossplane lets you provision cloud resources using Kubernetes Custom Resource Definitions instead of running terraform plan/apply as a separate workflow. The model is Kubernetes-native (CNCF graduate as of 2024), composition patterns enable strong abstraction reuse, and Upbound provides commercial support. Crossplane is the wrong choice for teams not running Kubernetes, the learning curve combines Kubernetes operators with cloud-provider primitives and is steep. Most teams running Crossplane also use Terraform / OpenTofu for resources that fall outside the Kubernetes control-plane abstraction.
Is AWS CDK a lock-in trap?
Yes, by design. AWS CDK compiles to CloudFormation and is AWS-only. If you are AWS-anchored and intend to stay AWS-anchored, CDK is a strong choice (native AWS, free, programming-language IaC, broad Construct Hub adoption). If you are multi-cloud or considering future cloud diversification, CDK is the wrong call, Terraform / OpenTofu / Pulumi all support multi-cloud natively. Some teams use CDK for AWS-only workloads and Terraform for multi-cloud, that hybrid pattern is fine but adds tool-surface complexity. CDK migration cost away from AWS is meaningful, that is the lock-in.
How do I pick a multi-cloud IaC tool?
Multi-cloud IaC narrows to Terraform, OpenTofu, Pulumi, and Crossplane. Terraform / OpenTofu are the conservative defaults with the largest provider ecosystems. Pulumi is right when your team prefers programming languages. Crossplane is right when Kubernetes is your automation surface. Avoid AWS CDK and CloudFormation for multi-cloud, both are AWS-only. For management layer (state, policy, RBAC), pair your engine with Spacelift, env0, Scalr, Atlantis, or Terragrunt depending on your size and procurement constraints.
Spacelift vs Terraform Cloud, what is the difference?
Spacelift is an engine-agnostic IaC management platform supporting Terraform, OpenTofu, Pulumi, CloudFormation, and Kubernetes / Crossplane. Terraform Cloud (now HCP Terraform) is HashiCorp-only and tied to Terraform. Spacelift has heavy OpenTofu adoption since the BSL fork, Terraform Cloud is the natural pick for HashiCorp-anchored buyers. Spacelift pricing is per-run-second + per-user, Terraform Cloud is per-resource-hour. Spacelift is PE-backed (Insight Partners, $22M Series B March 2023), Terraform Cloud is part of HashiCorp / IBM after the February 2025 close. Spacelift is the conservative multi-engine pick; Terraform Cloud is the conservative HashiCorp-anchored pick.
How much should I budget for IaC tooling?
Solo / small team: $0/year (Terraform CLI free under BSL, OpenTofu free, AWS CDK free, Atlantis free, Terragrunt free). SMB (5-25 engineers): $0-$25K/year (mostly free engines + free open-source PR automation). Mid-market (25-200 engineers): $25K-$150K/year (HCP Terraform Standard, Spacelift Cloud, env0 Business, Pulumi Team). Enterprise (200+ engineers): $150K-$1M+/year (HCP Plus, Terraform Enterprise, Spacelift Enterprise, env0 Enterprise, Gruntwork IaC Library). The biggest budget lever is the management platform, not the engine, engines are mostly free.
What is drift detection and why does it matter?
Drift is when actual cloud-provider state diverges from what your IaC code declares (someone clicked in the console, an auto-scaling group changed, a tag was modified out-of-band). Drift detection compares actual state to declared state and surfaces the delta. Most modern IaC management platforms (Spacelift, env0, Scalr, HCP Terraform Plus) have drift detection out of the box. Atlantis open-source does not. For regulated buyers and compliance-anchored teams, drift detection is essentially mandatory in 2026.
Does the IBM acquisition change anything for Terraform users?
IBM closed its $6.4B acquisition of HashiCorp on February 27, 2025. Through Q2 2026 the post-IBM product strategy clarification is still pending. Public signals so far: HCP Terraform pricing has continued to climb 2024-2025, BSL licensing remains in place, IBM enterprise procurement is now an option for Terraform Enterprise buyers, and the IBM Red Hat / OpenShift positioning may shape future integration directions. For most direct Terraform users the practical impact has been minimal; for procurement-sensitive buyers the IBM ownership is a new variable to evaluate.

Final word

Looking at a different market? See the global Infrastructure as Code (IaC) ranking, or pick another country at the top of this page.

Last updated 2026-05-19. Local pricing reverified quarterly. Found something inaccurate? Tell us.