OpenTofu

https://opentofu.org/docs
Admin
OpenTofu is an infrastructure as code tool that enables you to define, provision, and manage cloud...
Tokens:404,122
Snippets:3,067
Trust Score:9.8
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### startswith examples

Source: https://opentofu.org/docs/language/functions/startswith

Example calls of startswith with their results. The first returns true because the string starts with "hello"; the second returns false because it does not start with "world".

```hcl
> startswith("hello world", "hello")  
true  
  
> startswith("hello world", "world")  
false  
```

--------------------------------

### Install OpenTofu using the installer script

Source: https://opentofu.org/docs/intro/install/deb

Downloads, inspects, and runs the OpenTofu installer script with the --install-method deb option, then removes the installer. Use this to install OpenTofu on Debian-based systems via the official installer.

```bash
# Download the installer script:  
curl --proto '=https' --tlsv1.2 -fsSL https://get.opentofu.org/install-opentofu.sh -o install-opentofu.sh  
# Alternatively: wget --secure-protocol=TLSv1_2 --https-only https://get.opentofu.org/install-opentofu.sh -O install-opentofu.sh  
  
# Give it execution permissions:  
chmod +x install-opentofu.sh  
  
# Please inspect the downloaded script  
  
# Run the installer:  
./install-opentofu.sh --install-method deb  
  
# Remove the installer:  
rm -f install-opentofu.sh  
```

--------------------------------

### Install OpenTofu from FreeBSD ports

Source: https://opentofu.org/docs/intro/install/bsd

Install OpenTofu from the FreeBSD ports tree. First fetch and extract the ports collection with portsnap, then build and install the opentofu port from /usr/ports/sysutils/opentofu.

```shell
portsnap fetch extract  
make -C /usr/ports/sysutils/opentofu install clean  

```

--------------------------------

### Install OpenTofu with snap install --classic

Source: https://opentofu.org/docs/intro/install/snap

Install OpenTofu via Snapcraft on Linux. The --classic flag is required for the snap to work properly. Snap is available by default on Ubuntu Linux and can be installed on other distributions.

```bash
snap install --classic opentofu  

```

--------------------------------

### Install OpenTofu with winget

Source: https://opentofu.org/docs/intro/install/windows

Installs OpenTofu from the winget repository. If installation fails, ensure %LOCALAPPDATA%\Microsoft\WinGet\Links is in the PATH environment variable.

```shell
winget install --exact --id=OpenTofu.Tofu  
```

--------------------------------

### Install OpenTofu with Zypper (refresh repositories first)

Source: https://opentofu.org/docs/intro/install/rpm

Installs OpenTofu using Zypper: first refreshes the OpenTofu repositories (auto-importing GPG keys), then installs the tofu package.

```bash
zypper --gpg-auto-import-keys refresh opentofu
zypper --gpg-auto-import-keys refresh opentofu-source
zypper install -y tofu
```

--------------------------------

### Installation script with Ubuntu

Source: https://opentofu.org/docs/intro/install/docker

Dockerfile for Ubuntu 24.04 that uses the standalone installation script to install OpenTofu. Requires the install-opentofu.sh script to be placed next to the Dockerfile. Installs curl and gpg as dependencies for the script.

```dockerfile
FROM ubuntu:24.04  

# Copy the installation script  
COPY install-opentofu.sh /tmp/install-opentofu.sh  

# Install dependencies  
RUN apt-get update && apt-get install -y \  
    curl \  
    gpg \  
    && rm -rf /var/lib/apt/lists/*  

# Run the installation script  
RUN chmod +x /tmp/install-opentofu.sh && \  
    /tmp/install-opentofu.sh --install-method standalone --install-path /usr/local/bin && \  
    rm /tmp/install-opentofu.sh  

# Add your other dependencies  
RUN apt-get update && apt-get install -y \  
    git \  
    && rm -rf /var/lib/apt/lists/*  

WORKDIR /workspace  
```

--------------------------------

### Install OpenTofu with scoop

Source: https://opentofu.org/docs/intro/install/windows

Adds the main bucket and installs OpenTofu from the scoop repository.

```shell
scoop bucket add main  
scoop install main/opentofu  
```

--------------------------------

### Install OpenTofu on Alpine using the installer script

Source: https://opentofu.org/docs/intro/install/alpine

Downloads the OpenTofu installer script, makes it executable, runs it with the --install-method apk flag, and removes the installer. The script is fetched over HTTPS with TLS 1.2; inspect the script before running it.

```bash
# Download the installer script:  
curl --proto '=https' --tlsv1.2 -fsSL https://get.opentofu.org/install-opentofu.sh -o install-opentofu.sh  
# Alternatively: wget --secure-protocol=TLSv1_2 --https-only https://get.opentofu.org/install-opentofu.sh -O install-opentofu.sh  
  
# Give it execution permissions:  
chmod +x install-opentofu.sh  
  
# Please inspect the downloaded script  
  
# Run the installer:  
./install-opentofu.sh --install-method apk  
  
# Remove the installer:  
rm -f install-opentofu.sh  
```

--------------------------------

### Install OpenTofu standalone on POSIX systems

Source: https://opentofu.org/docs/intro/install/standalone

Downloads and runs the OpenTofu installer script for Linux/MacOS/BSD/Unix. The installer verifies file integrity; you need cosign or GnuPG, or use --skip-verify to disable verification.

```bash
# Download the installer script:  
curl --proto '=https' --tlsv1.2 -fsSL https://get.opentofu.org/install-opentofu.sh -o install-opentofu.sh  
# Alternatively: wget --secure-protocol=TLSv1_2 --https-only https://get.opentofu.org/install-opentofu.sh -O install-opentofu.sh  
  
# Grant execution permissions:  
chmod +x install-opentofu.sh  
  
# Please inspect the downloaded script at this point.  
  
# Run the installer:  
./install-opentofu.sh --install-method standalone  
  
# Remove the installer:  
rm -f install-opentofu.sh  
```

--------------------------------

### Configure provider_installation with network_mirror and direct methods

Source: https://opentofu.org/docs/cli/config/config-file

Configures provider installation methods with a network mirror for example.com providers and direct installation for all others. The network_mirror method uses the URL https://example.com/ and includes only example.com/*/* providers, while direct excludes those. Both methods set download_retry_count to retry on retryable errors (connection reset and a range of 500 errors).

```hcl
provider_installation {  
  network_mirror {  
    url                  = "https://example.com/"  
    include              = ["example.com/*/*"]  
    download_retry_count = 2  
  }  
  direct {  
    exclude              = ["example.com/*/*"]  
    download_retry_count = 3  
  }  
}  

```

--------------------------------

### pathexpand examples

Source: https://opentofu.org/docs/language/functions/pathexpand

Shows the result of calling `pathexpand` with a path starting with `~` and with a path that does not start with `~`. The first call expands `~` to the user's home directory, while the second returns the path unchanged.

```hcl
> pathexpand("~/.ssh/id_rsa")  
/home/steve/.ssh/id_rsa  
> pathexpand("/etc/resolv.conf")  
/etc/resolv.conf  

```

--------------------------------

### List Available Installation Packages - Sample Response (JSON)

Source: https://opentofu.org/docs/internals/provider-network-mirror-protocol

A successful response is a JSON object with an 'archives' property. Each key is a target platform identifier (e.g., darwin_amd64) and each value contains a 'url' and optional 'hashes' array.

```json
{  
  "archives": {  
    "darwin_amd64": {  
      "url": "terraform-provider-random_2.0.0_darwin_amd64.zip",  
      "hashes": [  
        "h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs="  
      ]  
    },  
    "linux_amd64": {  
      "url": "terraform-provider-random_2.0.0_linux_amd64.zip",  
      "hashes": [  
        "h1:lCJCxf/LIowc2IGS9TPjWDyXY4nOmdGdfcwwDQCOURQ="  
      ]  
    }  
  }  
}  
```

--------------------------------

### slice function example

Source: https://opentofu.org/docs/language/functions/slice

Example call to slice with a list of four strings, extracting indices 1 through 2 (inclusive start, exclusive end). The output shows the resulting list containing "b" and "c".

```hcl
> slice(["a", "b", "c", "d"], 1, 3)  
[  
  "b",  
  "c",  
]  
```

--------------------------------

### Set up OpenTofu GPG keys

Source: https://opentofu.org/docs/intro/install/deb

Sets up the OpenTofu GPG keys in /etc/apt/keyrings to verify package authenticity. Downloads the OpenTofu GPG key and the repository GPG key, dearmors the latter, and sets read permissions.

```bash
sudo install -m 0755 -d /etc/apt/keyrings  
curl -fsSL https://get.opentofu.org/opentofu.gpg | sudo tee /etc/apt/keyrings/opentofu.gpg >/dev/null  
curl -fsSL https://packages.opentofu.org/opentofu/tofu/gpgkey | sudo gpg --no-tty --batch --dearmor -o /etc/apt/keyrings/opentofu-repo.gpg >/dev/null  
sudo chmod a+r /etc/apt/keyrings/opentofu.gpg /etc/apt/keyrings/opentofu-repo.gpg  
```

--------------------------------

### Example main.tf with variable and resource

Source: https://opentofu.org/docs/cli/commands/console

A sample OpenTofu configuration defining a map variable `apps` and a `random_pet` resource using `for_each`. This is used as the basis for the console examples.

```hcl
variable "apps" {  
  type = map(any)  
  default = {  
    "foo" = {  
      "region" = "us-east-1",  
    },  
    "bar" = {  
      "region" = "eu-west-1",  
    },  
    "baz" = {  
      "region" = "ap-south-1",  
    },  
  }  
}  
  
resource "random_pet" "example" {  
  for_each = var.apps  
}  

```

--------------------------------

### substr basic example

Source: https://opentofu.org/docs/language/functions/substr

Extracts a substring starting at offset 1 with length 4 from "hello world", returning "ello".

```hcl
> substr("hello world", 1, 4)  
ello  
```

--------------------------------

### sort list of strings

Source: https://opentofu.org/docs/language/functions/sort

Call `sort` with a list of strings to get a new list sorted by Unicode codepoints. The example shows the input list and the resulting sorted output.

```hcl
> sort(["e", "d", "a", "x"])
[
  "a",
  "d",
  "e",
  "x",
]

```

--------------------------------

### Initialize repository and OpenTofu

Source: https://opentofu.org/docs/intro/core-workflow

Initializes a new Git repository, creates the initial OpenTofu configuration file, and runs `tofu init` to initialize the working directory. The output confirms successful initialization.

```bash
# Create repository  
$ git init my-infra && cd my-infra  
  
Initialized empty Git repository in /.../my-infra/.git/  
  
# Write initial config  
$ vim main.tf  
  
# Initialize OpenTofu  
$ tofu init  
  
Initializing provider plugins...  
# ...  
OpenTofu has been successfully initialized!  

```

--------------------------------

### Generic Git repository sources (HTTPS and SSH)

Source: https://opentofu.org/docs/language/modules/sources

Arbitrary Git repositories can be used by prefixing the address with the git:: prefix. This example shows HTTPS and SSH protocols. OpenTofu installs modules by running git clone and respects local Git configuration and credentials.

```hcl
module "vpc" {  
  source = "git::https://example.com/vpc.git"  
}  
  
module "storage" {  
  source = "git::ssh://username@example.com/storage.git"  
}  

```

--------------------------------

### Create OpenTofu source list

Source: https://opentofu.org/docs/intro/install/deb

Creates the OpenTofu source list at /etc/apt/sources.list.d/opentofu.list with both deb and deb-src entries signed by the OpenTofu GPG keys, then sets read permissions.

```bash
echo \  
  "deb [signed-by=/etc/apt/keyrings/opentofu.gpg,/etc/apt/keyrings/opentofu-repo.gpg] https://packages.opentofu.org/opentofu/tofu/any/ any main  
deb-src [signed-by=/etc/apt/keyrings/opentofu.gpg,/etc/apt/keyrings/opentofu-repo.gpg] https://packages.opentofu.org/opentofu/tofu/any/ any main" | \  
  sudo tee /etc/apt/sources.list.d/opentofu.list > /dev/null  
sudo chmod a+r /etc/apt/sources.list.d/opentofu.list  
```

--------------------------------

### for_each example configuration

Source: https://opentofu.org/docs/cli/state/resource-addressing

OpenTofu configuration that creates multiple instances using the for_each meta-argument with a map of keys to values.

```hcl
resource "aws_instance" "web" {  
  # ...  
  for_each = {  
    "tofu": "value1",  
    "resource":  "value2",  
    "indexing":  "value3",  
    "example":   "value4",  
  }  
}  
```

--------------------------------

### Validate OpenTofu Installation

Source: https://opentofu.org/docs/intro/install/homebrew

Verifies that the Homebrew installation of OpenTofu is working. Run this after installing OpenTofu.

```bash
tofu -version  

```

--------------------------------

### Create a new workspace with tofu workspace new

Source: https://opentofu.org/docs/cli/commands/workspace/new

Creates a new workspace named 'example' and switches to it. The output confirms the switch and notes that the new workspace is empty and isolated from existing state.

```shell
$ tofu workspace new example  
Created and switched to workspace "example"!  
  
You're now on a new, empty workspace. Workspaces isolate their state,  
so if you run "tofu plan" OpenTofu will not see any existing state  
for this configuration.  

```

--------------------------------

### Targeting file with resource addresses

Source: https://opentofu.org/docs/cli/state/resource-addressing

A targeting file used with the -target-file planning option. Lines starting with # are comments, blank lines are ignored, and each resource address is added to the target set. This example targets all instances of resources under module.network and module.cluster, plus the specific instances aws_iam_role.all["base"] and aws_iam_role_policy.all["base"].

```hcl
# These modules must be targeted during initial creation.  
module.network  
module.cluster  
  
# The following resources must also be included on initial  
# creation.  
aws_iam_role.all["base"]  
aws_iam_role_policy.all["base"]  

```

--------------------------------

### List Available Installation Packages - Sample Request (curl)

Source: https://opentofu.org/docs/internals/provider-network-mirror-protocol

Use this curl command to request the version-specific JSON file for a provider. The version must exactly match one returned from the List Available Versions operation.

```bash
curl 'https://tofu.example.com/providers/registry.tofu.io/hashicorp/random/2.0.0.json'  
```

--------------------------------

### Verify OpenTofu installation

Source: https://opentofu.org/docs/intro/migration/migration-guide

Run this command to confirm OpenTofu is installed and accessible. It should output the installed version.

```bash
tofu --version  
```

--------------------------------

### apply_start message example

Source: https://opentofu.org/docs/internals/machine-readable-ui

Example JSON message for the apply_start hook, showing the resource object and action field. The hook object includes resource identification and the action to be taken (e.g., create).

```json
{  
  "@level": "info",  
  "@message": "random_pet.animal: Creating...",  
  "@module": "tofu.ui",  
  "@timestamp": "2021-05-25T13:32:41.825308-04:00",  
  "hook": {  
    "resource": {  
      "addr": "random_pet.animal",  
      "module": "",  
      "resource": "random_pet.animal",  
      "implied_provider": "random",  
      "resource_type": "random_pet",  
      "resource_name": "animal",  
      "resource_key": null  
    },  
    "action": "create"  
  },  
  "type": "apply_start"  
}  

```

--------------------------------

### bcrypt example with output

Source: https://opentofu.org/docs/language/functions/bcrypt

Example call to bcrypt with the string "hello world" and its resulting hash. The output shows the $2a$ prefix and a random salt, so the exact hash will differ on each call.

```hcl
> bcrypt("hello world")  
$2a$10$D5grTTzcsqyvAeIAnY/mYOIqliCoG7eAMX0/oFcuD.iErkksEbcAa  
```

--------------------------------

### Install OpenTofu with Homebrew

Source: https://opentofu.org/docs/intro/install/homebrew

Installs OpenTofu from the Homebrew Core repository. Run these commands in a terminal on macOS or Linux with Homebrew installed.

```bash
brew update  
brew install opentofu  

```

--------------------------------

### Basic local-exec provisioner usage

Source: https://opentofu.org/docs/language/resources/provisioners/local-exec

Example of using the local-exec provisioner to run a command on the machine running OpenTofu after resource creation. The command writes the private IP of the resource to a file.

```HCL
resource "aws_instance" "web" {  
  # ...  
  
  provisioner "local-exec" {  
    command = "echo ${self.private_ip} >> private_ips.txt"  
  }  
}  

```

--------------------------------

### Installation script with Alpine Linux

Source: https://opentofu.org/docs/intro/install/docker

Dockerfile for Alpine Linux that uses the standalone installation script to install OpenTofu. Requires the install-opentofu.sh script to be placed next to the Dockerfile. Installs bash, curl, gpg, and gpg-agent as dependencies for the script.

```dockerfile
FROM alpine:3.20  

# Copy the installation script  
COPY install-opentofu.sh /tmp/install-opentofu.sh  

# Install dependencies needed for the script  
RUN apk add --no-cache bash curl gpg gpg-agent  

# Run the installation script  
RUN chmod +x /tmp/install-opentofu.sh && \  
    /tmp/install-opentofu.sh --install-method standalone --install-path /usr/local/bin && \  
    rm /tmp/install-opentofu.sh  

# Add your other dependencies  
RUN apk add --no-cache git  

WORKDIR /workspace  
```

--------------------------------

### join function examples

Source: https://opentofu.org/docs/language/functions/join

Examples of join with different separators and list sizes. The first example returns a quoted string, while the others return unquoted output.

```hcl
> join("-", ["foo", "bar", "baz"])  
"foo-bar-baz"  
> join(", ", ["foo", "bar", "baz"])  
foo, bar, baz  
> join(", ", ["foo"])  
foo  
```

--------------------------------

### cidrsubnets examples with IPv4 and IPv6

Source: https://opentofu.org/docs/language/functions/cidrsubnets

Two example calls showing IPv4 and IPv6 prefixes with their resulting lists of CIDR ranges. The IPv4 example uses newbits 4, 4, 8, 4; the IPv6 example uses newbits 16, 16, 16, 32.

```hcl
> cidrsubnets("10.1.0.0/16", 4, 4, 8, 4)  
[  
  "10.1.0.0/20",  
  "10.1.16.0/20",  
  "10.1.32.0/24",  
  "10.1.48.0/20",  
]  
  
> cidrsubnets("fd00:fd12:3456:7890::/56", 16, 16, 16, 32)  
[  
  "fd00:fd12:3456:7800::/72",  
  "fd00:fd12:3456:7800:100::/72",  
  "fd00:fd12:3456:7800:200::/72",  
  "fd00:fd12:3456:7800:300::/88",  
]  
```

--------------------------------

### formatlist examples with list and non-list arguments

Source: https://opentofu.org/docs/language/functions/formatlist

Two interactive examples showing `formatlist` with a list of names and a non-list greeting. The first uses a list for the `%s` placeholder, and the second uses a non-list string with a list, demonstrating that non-list arguments are repeated for each element.

```hcl
> formatlist("Hello, %s!", ["Valentina", "Ander", "Olivia", "Sam"])  
[  
  "Hello, Valentina!",  
  "Hello, Ander!",  
  "Hello, Olivia!",  
  "Hello, Sam!",  
]  
> formatlist("%s, %s!", "Salutations", ["Valentina", "Ander", "Olivia", "Sam"])  
[  
  "Salutations, Valentina!",  
  "Salutations, Ander!",  
  "Salutations, Olivia!",  
  "Salutations, Sam!",  
]  
```

--------------------------------

### Select workspace example

Source: https://opentofu.org/docs/cli/commands/workspace/select

Shows listing workspaces with `tofu workspace list` and then selecting the `default` workspace with `tofu workspace select default`. The output confirms the switch with 'Switched to workspace "default".'

```shell
$ tofu workspace list  
  default  
* development  
  jsmith-test  
  
$ tofu workspace select default  
Switched to workspace "default".  

```

--------------------------------

### Install OpenTofu using pkg on FreeBSD

Source: https://opentofu.org/docs/intro/install/bsd

Use the FreeBSD pkg package manager to update the package repository and install OpenTofu. Run these commands as root or with sudo privileges.

```shell
pkg update -f  
pkg install opentofu  

```

--------------------------------

### Install OpenTofu with yum

Source: https://opentofu.org/docs/intro/install/rpm

Installs OpenTofu using the Yum package manager.

```bash
sudo yum install -y tofu
```
Tokens:
Raw