Is Terraform no longer Open Source?
For many developers, licenses have become something they barely even think about. Few if any of the most popular libraries use anything but open and permissive licenses like MIT and even GNU. Gone are also the days when large corporate entities like Microsoft shunned open source. It has never seemed more like the future of software development would be open.
However, this is happening in the licensing world, and even though you might not have to purchase a license for the most popular code libraries and tools anymore, being license-aware is an extremely important part of using open software. open source licenses come in a huge variety of flavors, with some very important differences that limit the ways in which the software can be used.
The latest news from the IaC tool Terraform is not about a new feature or huge bug fixes. Instead, it is about what some would call a quite radical shift in the terms of its license. Some are even calling it a shift away from Open Source entirely. In this article I try to make sense of this change and what it means for you as a Terraform user.
Background
Terraform is a popular and widely used tool for managing cloud resources as code. Since its initial release in 2014, it has become a mainstay of infrastructure operations and is widely used in production. Terraform also has an enthusiastic community and a large user base, which makes it a safe bet for anyone who wants to modernize their infrastructure operations.
Terraform is backed by a company called Hashicorp. Like most other companies, Hashicorp is required to make money. Hashicorps commercial Terraform platform is called Terraform Cloud, which offers versioning and deployment of Terraform code. Although the tooling itself has been entirely open source, this managed offering has been a popular alternative for many users who don’t want to manage their own Terraform deployments and Terraform state.
Terraform Cloud soon found itself facing stiff competition from other platforms. Some of these alternatives, like Spacelift and Env0, offer a wide array of enhancements and benefits when compared to Terraform, like being able to orchestrate multiple IaC and provisioning tools, or offer a self-service portal for citizen developers to provision their own infrastructure. This increasing commercial pressure on Terraform Cloud might be one of the reasons for the license change that was just made by Hashicorp in a bid to secure commercial rights for their open-source Tooling.
Licensing
Since its inception in 2014, Terraform has been developed under the permissive Mozilla Public License (MPL). The MPL is a license that compromises between the more commercially oriented MIT and BSD licenses, and the noncommercial GPL license. Code licensed under MPL can freely be used to create commercial products, but one cannot in any way restrict access to the code when providing this product or services from this product to customers.
Following an announcement from Hashicorp on August 10th 2023, Terraform will be licensed under the Business Source License (BUSL). The important difference between BUSL and MPL is that Hashicorp now retains the right to create commercial products from Terraform, unless a separate agreement is made. What this means in practice is that offering Terraform as a service, or as a significant part of a service that competes with Hashicorp's own Terraform Cloud would no longer be allowed.
Since Terraform Cloud is currently in direct competition with many services that do offer Terraform as a service, this change will greatly affect the larger landscape of IaC PaaS offerings. Many popular competing services will have to either partner with Hashicorp or cease to receive Terraform updates beyond the latest commit that was licensed under the MPL.
What does this mean for me?
Hashicorp has released an FAQ that emphasizes that “end users” will not be affected in any way by the change in licensing. Indeed, if you are not running your own commercial Terraform offering, you will not have to do anything to be in compliance with the license, as it only seems to affect competing offerings to Hashicorp's own Terraform Cloud.
However, the change will definitely have an effect on the IaC landscape. Changes in licensing and commercial practice from backers of large codebases always leads to discussion, forks, spinoffs, and alternative tools springing up. What this will mean in practice remains to be known, but I am almost certain about one thing: The already popular and rising Terraform alternative Pulumi will gain even more momentum from this.
Pulumi has been touted as a Terraform successor for a while now, and I am pretty sure that at least some part of the Terraform community will now be looking to move on to Pulumi. While most developers are not going to be affected by the Terraform license change directly, the cooldown effect it will have on the larger landscape of service providers and contributions to Terraform will drive this development even more.
Many users are currently deeply invested in Terraform, however, with large codebases of HCL and little appetite for new tooling. As mentioned here and emphasized by Hashicorp, these users can safely keep using Terraform as long as they are not running an IaC platform.
Summing up
Licenses can not be ignored when, like everyone else these days, you rely on open-source tools and libraries. Being license-aware and staying up to date on the licensing of your most important dependencies is therefore very important.
The Terraform shift from MPL to BUSL is an example of a situation where a license change might have big consequences for some actors, and will certainly affect the whole field of infrastructure as code. It is also an interesting example of how corporate-backed open-source projects are part of a larger corporate commercial strategy, that affects decisions about licensing.
Terraform's new license will certainly not require you to pay a premium if you wish to continue defining your infrastructure as code, but if you use a Terraform Cloud competitor, or if you are interested in the growth of new and exciting alternatives like Pulumi, you might see some changes in the coming months. Also, it might be wise to take a moment and consider the other open-source tools in your toolkit that have corporate backing, especially if what you are building is commercial, or in competition with any of these corporations.
