Terraform vs CloudFormation

The short answer

If everything you run is in AWS and you want AWS to hold the state, roll back failed deployments and stand behind the tool, CloudFormation (often written through the AWS CDK) is the lower-maintenance choice.

If you also manage things outside AWS (another cloud, Kubernetes, DNS, or SaaS such as GitHub, Datadog or PagerDuty) and want one workflow and one plan for all of it, Terraform, or its open-source fork OpenTofu, is usually the better fit.

The difference you feel every day is state. CloudFormation keeps it inside the service, per stack. Terraform keeps it in a state file that you store, lock and protect yourself.

Terraform and CloudFormation side by side

State is the real difference

Terraform records what it created in a state file and compares that file with your configuration on every plan. You decide where the file lives, who can read it and how it is locked so two applies can't run at once. On AWS that is usually an S3 bucket with versioning and S3 locking turned on (use_lockfile; the older DynamoDB locking is deprecated in the S3 backend), or HCP Terraform.

The state file can hold secrets in plain text, such as database passwords and generated keys, so the bucket needs encryption and tight access. In return you get direct control: moved blocks and terraform state commands let you rename, split and refactor without destroying anything.

CloudFormation keeps state for you, per stack. There is nothing to back up or lock, and access is ordinary IAM. The trade-off is that the stack is the unit you work in: change a resource's logical ID and CloudFormation treats it as a new resource and deletes the old one unless its DeletionPolicy is Retain, and moving resources between stacks means retaining them and importing them into the other stack.

What happens when a deployment fails

CloudFormation rolls a failed stack back to its last working state by default, which is what most teams want for production. Rollback can fail too (a resource changed outside the stack is the usual cause), leaving the stack in UPDATE_ROLLBACK_FAILED until you continue the rollback, sometimes skipping the resource that blocks it.

Terraform has no rollback. An apply that fails halfway leaves what it created in place and in state, and the next plan shows exactly what is left to do. Many teams prefer that because nothing is deleted behind their back; others find it harder to reason about during an incident. Either way, run applies from CI with a reviewed plan rather than from laptops.

Reaching past AWS

Terraform's strength is that the same workflow manages AWS, other clouds, Kubernetes, DNS, monitoring, identity providers and source control through providers. A platform team that owns more than AWS gets one plan and one review step for all of it.

CloudFormation can reach outside AWS through third-party resource types in its registry, but those are billed per handler operation and the catalogue is far smaller than Terraform's provider ecosystem. Before you choose either tool for a new AWS service, check that the resource you need is covered: neither is guaranteed to support a new feature on launch day, so look it up in the CloudFormation resource type reference and in the changelog of Terraform's AWS provider.

Drift and day-two operations

Both tools detect drift, but neither stops it. CloudFormation's drift detection runs when you ask (or on a schedule through the AWS Config rule cloudformation-stack-drift-detection-check) and reports differences without fixing them. Terraform shows drift on every plan, and a scheduled plan in CI turns that into an alert.

The fix is the same in both: decide whether the code or the live resource is right, then bring the other one into line. Our guide to drift detection and remediation in Terraform-managed infrastructure covers how to run that loop.

Where the AWS CDK fits

The AWS CDK lets you write infrastructure in a general-purpose language, then synthesizes CloudFormation templates and deploys them as stacks. Choosing the CDK is therefore choosing CloudFormation's state and rollback model with a programming-language front end. If the question on your team is really "CDK or Terraform", the rest of this page still applies.

Licensing and OpenTofu

HashiCorp moved Terraform from the MPL 2.0 to the Business Source License 1.1 in August 2023, starting with version 1.6. Using Terraform to manage your own infrastructure is unaffected; the licence restricts products that compete with HashiCorp's. OpenTofu, a fork of the last MPL release run under the Linux Foundation, uses the same language and providers, and the two have added different features since the split. If the licence matters to you, compare the version you run against OpenTofu's migration guide before switching.

Which one to choose

Choose Terraform if

• You manage more than AWS: another cloud, Kubernetes, DNS, or SaaS you want under code review.
• You want one plan and one approval step across all of it.
• Your team already writes HCL or uses modules from the Terraform Registry.
• You want the option of an open-source tool in OpenTofu.

Choose CloudFormation if

• Everything you run is in AWS and is likely to stay there.
• You would rather AWS hold the state than run a state backend yourself.
• You want failed deployments rolled back automatically.
• You deploy the same baseline to many accounts through AWS Organizations with StackSets.
• You already use the AWS CDK or AWS SAM, which both deploy through CloudFormation.

Questions people ask

Can you use Terraform and CloudFormation together?

Yes. Terraform's AWS provider can create CloudFormation stacks (aws_cloudformation_stack) and read their outputs and exports, which helps when a vendor ships only a CloudFormation template. Don't manage the same resource from both: each will see the other's changes as drift.

Is CloudFormation free?

AWS doesn't charge for CloudFormation when it manages AWS::* and Alexa::* resource types; you pay for the resources it creates. Third-party resource types and hooks from the registry are billed per handler operation. Check the CloudFormation pricing page for the current rates.

Is Terraform still open source?

Not under an open-source licence: releases from 1.6 on are under the Business Source License 1.1. OpenTofu is the open-source fork, licensed MPL 2.0.

How do you move from CloudFormation to Terraform?

Set DeletionPolicy: Retain on the stack's resources and update the stack, then delete the stack (the resources stay), then bring them into Terraform with import blocks. Run a plan before any apply and expect no changes; anything it wants to change is a difference to resolve first.

Does CloudFormation detect drift automatically?

No. Drift detection runs when you start it from the console, CLI or API. To run it on a schedule, use the AWS Config managed rule cloudformation-stack-drift-detection-check.