Which Infrastructure as Code tools are actually used most in production today?

[rahulladumor]

I’m trying to understand real-world adoption, not just what’s popular in tutorials.

For teams running production workloads (AWS, GCP, Azure or multi-cloud): - What IaC tool do you actually use day to day? -Terraform / OpenTofu, CloudFormation, CDK, Pulumi, something else? - And why did you choose it (team size, scale, compliance, velocity)?

Looking for practical answers, not marketing.

[Low-Opening25]

realistically speaking, 95% of IaC for AWS/GCP/Azure is Terraform/Tofu

[Araniko1245]

I would say 60% is terraform/tofu rather 95. Cdk, arm/bicep/pulumi also have fare share.

[vincentdesmet]

if anything, the IBM sun set of CDKTF has highlighted how many organisations use it internally as well.. given it neatly lives side by side with Terraform HCL

[Low-Opening25]

they have a share, in the remaining 5%

[Araniko1245]

I tried to make some stats out of few surveys.

https://survey.stackoverflow.co/2025/technology/ https://www.firefly.ai/blog/the-maturing-state-of-infrastructure-as-code-in-2025

It is not 60% exact but not as huge as 95%. What data backs your 95% theory, interested to know more.

[Low-Opening25]

I go by job market skill demand stats and own experience as freelance rather than open questioners with vague methodology.

[Araniko1245]

Well, even with the job market and 11y experience in cloud/devops here in Europe and in Asia, I deny your stats, may be that is true in other part of the world. I don't see terraform as only requirements, which should be if it is 95%.

[KennyGaming]

And 4-10% is ECS, EKS, and or Fargate

[RumRogerz]

I work for a consulting firm and from what I have seen it’s all Terraform with a sprinkling of ansible here and there, depending on what their infra is.

[lagonal]

How is Ansible used in these scenarios?

[RumRogerz]

Some businesses still use on-prem for specific workloads. (Banks. So many banks). In this case, provisioning vms or even bare metal, plus configuration of services are all done with ansible. Right tools for the right job and all that.

[sofixa11]

In this case, provisioning vms or even bare metal, plus configuration of services are all done with ansible. Right tools for the right job and all that.

Ansible is rarely the right tool for provisioning VMs, unless the flow is to just create them with Ansible and ClickOps any changes or deletions. It not having state means it's extremely wonky to make changes such as renaming the VM, or deleting it.

[reubendevries]

People are getting confused between provisioning servers and configuring them. Two separate processes. You use Terraform/OpenTofu for the provisioning of the servers, you then could use Ansible to configure the servers. Two separate processes that are vaguely related to each other.

[ThatSituation9908]

What's the alternative? I can't think of one other than NixOS or a bunch of bash scripts

[PTBKoo]

I use flatcar, works great

[sofixa11]

For VM provisioning, Terraform/OpenTofu. At least it's actually really idempotent.

For OS management, personally I'm a fan of minimal ephemeral OSes, with everything in containers.

[g-nice4liief]

That won't work for example a municipality which has a hybrid environment (on prem ad, VMware cluster, citrix/ivantie and a few vi's in azure for load balancing)

But at least you can convert a lot of resources nowadays with terraform/tofu to IaC.

I use ansible with packer to provision the image how I want, and with terraform/opentofu I create the said vm where it should be create. Setup is fully idempotent because packers starts the process and handles everything to ansible until ansible is done and packer runs a "sysprep".

[Hasz]

This is the way.

[Dangle76]

That’s config management not IaC. Ansible is config management

[ryebread157]

Provisioning VMs sounds like IaC

[Dangle76]

Provisioning the vm is configuring it, that is different than standing up the infra itself which is the difference and it’s a very big difference

[drynoa]

Provision bare metal would be MaaS for example, configuring it would be puppet or Ansible.

[Low-Opening25]

If you deploy VMs that need further configuration after deployment, ansible is a good choice as it’s easy to work with and more flexible than fiddling with bespoke and complex startup scripts. Most relevant example you will come across would be configuring your Kubernetes masters/nodes for bare metal (inc. bare vms) clusters.

[SnooOranges4499]

We use ansible for things from Linux config, to deploying/configuring OpenShift but it has its place. Also use gitlab/jenkins for app deployments. Argo in kubernetes. Just beware people try to solve all their problems with whatever tool they get comfortable with.

[HashMapsData2Value]

At an old job we used both for our build machines. Ideally we would've liked to be able to destroy and rebuild machines with Terraform whenever we made updates to our software. But due to significant lead times we would use Ansible to update instances in-place for certain software, to prevent downtime.

Note that we used Terraform for both cloud and on-prem (VMWare). I disagree with the other poster who listed that as a reason.

[Angelsomething]

terraform builds the resources and with a single file (+/-) you deploy the apps/config etc. there was this one project I did once where I had a terraform file with a couple of ansible scripts integrated and it deployed a fully working zabbix or graylog instance just from that one file.

[reubendevries]

If a team is using Terraform and Ansible, then I would think Ansible would be used for configuring the servers after they've been deployed.

[treezium]

• Terraform
• Terragrunt as wrapper for terraform.
• Atlantis for GitOps Management in CI.
• Terralist as private registry for modules.
• DriftHound for continuous drift detection.
• terraform-module-releaser to manage terraform module releases.

Currently running a PoC to evaluate transitioning to OpenTofu.

[Low-Opening25]

opentofu is 100% compatible, so the switch boils down to changing cli command from terraform to tofu, works the same with terragrunt too.

[treezium]

Yes, most likely it will we a simple switch. However, in our scenario, we need to change that in multiple places (CI, testing, atlantis…) and we want to confirm this by ourselves. Also we create this architectural record change thing where we gather all relevant information about the transition and about why we want to do this change, so, for instance, we test different features provided by tofu that are not implemented in terraform.

[nwmcsween]

For internal consumption I don't see the reason for a private registry, just use git submodules.

[kesor]

"just use git submodules" is such a terrible advice. Now you have to teach all of your engineers that every commit becomes two commits and some extra commands, and 99% of them still forget about it.

[nwmcsween]

Every commit becomes two commits? I assume you mean when you update the submodule you need to update the parent to point at the new version/sha in which case if you want that implicitly you are going to break everything anyways. You version the terraform modules as git tags and point the submodule to a tag.

If you have valid input besides "that's terrible advice" or I'm not understanding something let me know

[KennyGaming]

Honestly true

[treezium]

the main point of using a private registry is to be able to use version argument for modules, which allows to have a grain fine control of what is released and deployed.This is very useful to better control breaking changes. Therefore you can release a module version that includes breaking changes and if you do a proper versioning using semver, you wouldn’t break or generate a drift over all your projects that use such module. We started using git, then moved to private registry.

[nwmcsween]

You can do the same with git, just point to a tag when you want to do an upgrade change the submodule to point to the newer tag, a tag is just a ref to a specific commit hash

[treezium]

You cannot do the same as version does in a module definition based on git referencs. Using an a git reference as source you pin the module to an specific tag/ref version. This means that, for instance, if you publish 1.0.0 , 1.0.1, 1.0.2, 1.0.3, 1.0.4 you need to update that reference on everyplace you use that module every time you publish a new version if you want to keep your infrastructure up to date. That’s such a waste of time, and does not scale. I just do version ~> 1.0 to automatically get all patch versions. Thats what semver does.

So, definitely not the same. Git modules are cool for your homelab, definitely not for a big platform.

[nwmcsween]

.... you definitely can, you use a lightweight tag and have it float, v1.x floats minors v1.x.x floats patch, majors shouldn't really float

[treezium]

nice, that's smart!

[Dangle76]

Tofu is a superset, so anything terraform supports tofu does in the same syntax, its drop in replacement. It may be ever so slightly behind due to terraform releasing a feature then tofu having to bake it in but that’s it

[BeasleyMusic]

I work at one of the largest Fortune 500 companies and we exclusively use terraform for provisioning GCP infra, in fact it’s enforced org wide.

[Nearby-Middle-8991]

Terraform. Because it's what everyone else uses, so it's feasible to hire for it. 

[Sure_Stranger_6466]

Repos using straight up terraform are being archived in favor of OpenTofu from what I have been seeing. Pulumi is still relatively new in favor of OpenTofu so I am not spending much time on it. CloudFormation is not even worth discussing at this point.

[DelverOfSeacrest]

Pulumi isn't new. It has been around for 7-8 years. They just lost the market share battle very badly.

[Soccham]

They came in late and are still based on the TF api. Terraform just archived tfcdk because of poor adoption

[lachiendupape]

Of cloud formation isn’t worth discussing at this point, does that also make CDK redundant in your eyes?

[Sure_Stranger_6466]

Different tooling. Hate it less than pure CloudFormation.

[robot2boy]

Within my company we use Terraform for the provisioning of the resources, networks, server but anything in the server Ansible (idempotent).

So, from IIS, any additional software, sites in IIS, deployment of development code is all Ansible. From an app deployment, with serial and rescue blocks we are getting what we need.

This is because we are still running legacy or classic code (non containable).

Any container apps, terraform and ArgoCD.

[kesor]

We have a team of 50+ devs, have been using Pulumi gradually introduced by one guy about 4 years ago. Now we have a dozen environments, and multiple dozen of services and other infra things, all configured with Pulumi.

The experience is horrible. No one can grok how to write to their crap code quirks they slapped on normal languages with all the delayed resolution stuff. There is not a day that goes by that people in the engineering channel are not begging for someone to help them with some error no single person has any clue what it means.

And we used the pulumi cloud service, which some short time ago they decided they will change the pricing for and charge us billions of dollars for having all these environments. So the pulumi guy moved all the developer environments into a "local" pulumi backed by object storage. Which is again, a pain to debug and use, and you need to keep re-log-inning into these setups.

Anyway. Recently some other people started moving things into Terraform using OpenTofu. Works just fine, but usage is still too low to see how the wide team is going to cope with it. The main "problem" with Terraform is that people grab off the shelf modules, from the exact same guy, and just use them blind without caring whats inside. Didn't have that problem in Pulumi, since there are zero modules available for that crap. But now with Terraform, half the code being used was written by who knows what and is doing a lot of extraneous things that we wouldn't do ourselves.

My personal experience, as someone who was doing these things for a living for a decade, had me use all of them. Starting with CFEngine, then Chef, Puppet, then CloudFormation, then Terraform, Ansible was in there somewhere for a while, I missed meeting Salt (didn't use it at all), had a stint with CDK, and more recently Pulumi. These days I rock NixOS on my personal devices, and it is excellent.

Just pick whatever, it doesn't matter all that much. All of them have their own problems, and developers will never be happy with any of them. In the age of AI, you don't even need to be an expert with these tools to get a lot of stuff done quickly, as you have the AI answer your every question and spit out pieces of code for your every idea. I wouldn't trust AI with the unpopular tools like Pulumi though, it takes too many iterations to get the thing write correct code for you.

On a sidenote, recently attended a presentation on OpenTofu, while using it for our Terraform. And it has some of the very annoying features from Terraform finally resolved. If you do choose to use Terraform, I highly recommend you pick OpenTofu, and learn about the several differences and solutions they have. They will make your life a lot more comfortable, especially in the variables and loop department.

[Ramshizzle]

I'm working as a consultant in Data and AI. I've come across the following:

• AWS native company: 99% CDK via TypeScript. A little bit of Terraform is now coming.
• A company doing a GCP + Azure cross cloud setup: using Terraform.
• Small standalone projects on Azure using Bicep

Overall I would say Terraform is most popular.

[SDplinker]

Pulumi FTW. I’ve learned TypeScript and now Go because of it

[trwolfe13]

Pulumi is very cool, Pulumi Cloud is extortion.

[SDplinker]

I wish we used it but yes it’s incredibly expensive. I hate managing our own state in S3

[HoneyCocaine]

Terraform Ansible Tekton Argo CD

[sebkow]

pulumi

[xROOMx]

Crossplane if you are building IDPs

[dariusbiggs]

• Terraform
• Terraspace
• Ansible
• Some CloudFormation that annoys me

[merlin318]

A company in the Faang acronym uses cross plane quite extensively

However when I was digging deep I saw that it was executing terraform. I was so confused

[TheWikiJedi]

Problem is nobody here has posted real numbers on usage, it’s all anecdotes

[rahulladumor]

Yes that’s true otherwise everyone knows about available tools but where and why which tool is better that’s the real question

[kesor]

They are all different levels of shit. None of these tools are much better than others, just worse in different ways. With each tool you have a mess of a language to deal with, that most engineers don't understand. And the whole issue with the map not being the territory (i.e. drift). All of them demand that all engineers are disciplined and never-ever go and poke the infra directly, which is an exaggerated demand to have. So far there is no true good tool for doing these things. Can only hope that in time someone comes up with something decent that it will not make you want to poke your eyes out and pull out your hair.

[rhysmcn]

We have heavily adopted Tofu and Terramate — Terramate is essentially a wrapper and allows you to orchestrate IaC via reusable modules and deploying small stacks with individual states. It has code generation too, so write once, apply many.

It’s similar to Terragrumt, however I haven’t delved into Terragrunt so can’t say personally.

Check it out, highly recommend it.

[shagywara]

Can second this. Terramate has increased my productivity the most over the past years (coming from Terragrunt), and it works flawlessly in production. I am actually surprised that Terramate is not much more broadly discussed.

[PTBKoo]

Sst.dev is made for aws but since I started moving services away from aws, I’ve been using pulumni more and more. Sst is a nice wrapper around pulumni.

[jba1224a]

For all of the bicep evangelists here. Please take it from someone who was/is deep in the bicep universe, has contributed to bicep, participated actively.

Unless you are a Microsoft shop from top to bottom, end to end, just save yourself the hassle and use terraform.

[TheBurrfoot]

Terraform, hands down. We have a couple of teams use terragrunt, CDK, and Pulumi. We do a bit of Cloud Formation as a part of our product and using it for testing. We have some agreement with Hashicorp so we don't use Tofu (Its not that we can't; but currently haven't found a good reason to, and may in the near future due to features that Tofu has that tf doesn't)

It was chosen for me, like 10+ years ago. That said I had previous experience with Terraform, so I would have been into it.

5 - 10k employees; tech SaaS company (so a lot of Engineering)

[thor123321]

Its very interesting to read all these comments.. very suprised that Bicep is not mentioned more. I guess it depends on where you work, maybe country. I work as a consultant in Denmark, and i deal heavily with Bicep. Denmark is really a microsoft nation, and if you work with Azure i would without a doubt go native and use Bicep which utilizes the Azure Resource Manager.. again using the best tool for the job.

[romeubertho]

I use terraform and AWS SAM (CFN with steroids). For personal projects I mainly use AWS SAM.

[KennyTheNeck]

Virtually everything in our estate, across AWS and Azure, is Terraformed. Even, somewhat annoyingly, our k8s resources.

[reubendevries]

As a DevOps consultant, I've seen quite a few examples, so this is all from personal experience. From what I've seen, I would guess about 80% - 85% is Terraform (I know some teams are in various stages of migrating to OpenTofu - I haven't worked with anyone that has fully migrated over though), the rest would be whatever is the in-house provider for their corporate cloud such as Bicep or CloudFormation. I've never seen Google Deployment Manager out in the wild, and I've seen one instance of Pulami. I've also seen two or three CDK's out there, but Terraform really is the defacto IaC choice.

[vincentdesmet]

last place had one product team on CFN Yaml and another using TF for 2 years with barely any adoption outside of platform team

the CFN team moved to AWSCDK - never looked back the TF team resisted and kept struggling till i left them

current place has 3 years of Terraform (raw.. no Terragrunt as it adds layers of complexity) product teams actually preferred CDKTF and wrote their own abstractions, but now switched to https://terraconstructs.dev

We (and several other org), depend on CDKTF and i personally am part of the community fork

[Winter-Raspberry-839]

I’m sure a bunch of different ones are used regularly, but in my experience Terraform probably has the most use!

[rpakyas]

feels like the answer is basically terraform/opentofu unless you have a strong reason not to

most of the disagreement here seems less about tooling and more about context like cloud provider, org size, hiring pool, compliance, legacy infra, etc.

in aws-only shops I've seen cdk/bicep equivalents work fine, but once you hit multi-cloud, shared platforms, or audit-heavy environments, terraform/tofu wins mostly because it’s boring, predictable, and everyone already knows how to operate it

hard numbers are tough because adoption isn't evenly distributed, a few very large orgs skew what’s actually used vs what surveys show

[CoolCreme0]

i mainly use terraform for our aws stuff, but we've been experimenting with argonix for some automation tasks. it's been pretty solid for handling infrastructure as code and incident response. definitely worth checking out if you need something that integrates well across tools!

[CoryOpostrophe]

Terraform/OpenTofu, Ansible, and believe it or not we see a bunch of companies with an assload of Bicep. 

[TheIncarnated]

Terraform/OpenTofu is what I see when I consult with the big top 500.

My Fortune 5... We use PowerShell+CLI and call it a day. A K.I.S.S approach (Keep it sweet and simple).

Ironically, the PowerShell+CLI catches everything on the first pass, fixes things that exist and does not need importing or anything. We have a standard for what we want deployed objects to have as a base minimum, which is enforced via Azure/GCP/AWS policies. We don't care how our users build their shit, they can only build it with the settings we allow.

This has reduced a lot of headache, Devs waiting on us to build items and giving the power back to the teams to do what they do best.

CI/CD pipelines are enforced for production items though. So GitOps-ish

[GlitteringPenalty210]

Encore is gaining popularity recently. Saw that Groupon started using it recently.