Terraform Business License
The terraform business license is the Business Source License that governs HashiCorp Terraform code. It lets teams run the tool for free unless they build a competing product. Engineering teams adopt this tool to build cloud resources with code files. Many teams give broad roles to users and runner jobs during initial setup. When roles are too wide, one bad run can wipe out live cloud networks. How the terraform business license works in practice HashiCorp moved its core tools from an open so
Terraform Security (tfsec, Checkov) + Business Continuity & Security: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
The terraform business license is the Business Source License that governs HashiCorp Terraform code. It lets teams run the tool for free unless they build a competing product. Engineering teams adopt this tool to build cloud resources with code files. Many teams give broad roles to users and runner jobs during initial setup. When roles are too wide, one bad run can wipe out live cloud networks.
How the terraform business license works in practice
HashiCorp moved its core tools from an open source license to a source-available model. Under the terraform business license, most companies can still run the tool at no cost. You can deploy cloud servers, databases, and networks for your own internal apps. You can also use it to manage client clouds if you do not sell hosting.
The main rule restricts building a managed service that competes with HashiCorp commercial products. If you sell a hosted platform that runs Terraform for others, you need a contract. Each software version converts to an open source license after a set number of years. Legal and engineering teams check these terms before they upgrade to newer versions.
Once legal clears the license, platform teams set up remote state storage and runners. The tool reads declarative files, checks the state file, and calls cloud provider APIs. The runner holds cloud keys or assumes a cloud role to make these changes. Every user who can trigger a run inherits the power of that runner role.
What license compliance and native roles leave open
Passing a legal check for the license only clears the software for internal use. It does not make your cloud runs or state files safe from human error. Native cloud roles decide who can log in and start a deployment job. They do not inspect what individual commands or API requests do in flight.
A runner often needs high admin rights to create roles, networks, and database clusters. If an engineer runs a local command with those rights, they bypass pipeline checks. State files also store raw secrets, database passwords, and private data in plain text. Anyone who can read the state bucket can view those secrets in their terminal.
Terraform Security (tfsec, Checkov) + Business Continuity & Security: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
For example, a state dump might return user emails, phone numbers, or card numbers. Native storage permissions only give all-or-nothing read rights to the whole state file. They cannot mask matched fields in results or block a single destructive command in flight. Teams also struggle to approve high-risk runs per command without blocking down daily work.
Managing state and runner permissions at scale
To reduce risk, teams split large state files into smaller units by app or team. This limits the blast radius when a run fails or a role leaks. Teams also remove direct cloud keys from developer laptops and force runs through pipelines.
Even with pipelines, engineers still need break-glass terminal sessions to fix broken state locks. During an outage, teams often grant broad admin roles to fix the issue fast. Those temporary roles often stay active long after the incident ends. Security teams need a way to govern live commands and redact sensitive output fields.
Add runtime guardrails and masking beside your databases and APIs
Login rules, role grants, and CI checks govern who connects to your stack. Yet any allowed script, engineer, or AI agent still runs commands with the full scope of its role. For workloads on Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes, SSH, or internal HTTP services, hoop.dev sits inline in the protocol beside the service as an open-source proxy, a sidecar for your database or API. On every production query an agent or human runs, hoop.dev decides whether to pass, mask, block, or escalate it for review.
Before a query runs, hoop.dev guardrails check the statement against your rules, an AI Analyzer you configure can score intent or hold risky calls for human approval, and hoop.dev data masking rewrites sensitive fields in responses in memory. Explore the MIT-licensed project on GitHub.
Frequently asked questions
Can my company use the terraform business license for free?
Yes, you can use it for free for internal systems and non-competing services. You only need a commercial agreement if you sell a competing managed product.
What happens if we stay on an older version of Terraform?
Older releases before the license change stay under the Mozilla Public License forever. Still, those versions do not get new features or security fixes from the vendor.
Does the license change how state files store secrets?
No, the license is a legal text and does not change how state works. State files still store raw values, so you must secure access and redact outputs.