Installing OpenTofu and HashiCorp Configuration Language HCL Basics

In this lesson we recap how to install OpenTofu and introduce the basics of HashiCorp Configuration Language (HCL). You’ll learn how to get the OpenTofu binary on your PATH, what HCL resource blocks look like, and the core OpenTofu workflow for provisioning resources.

OpenTofu binaries are distributed as pre-built releases for multiple platforms (Linux, macOS, Solaris, OpenBSD). After placing the binary in a directory on your PATH, verify installation with tofu version before proceeding to provisioning.

Install the OpenTofu CLI

Downloading and installing OpenTofu is typically a matter of fetching the release archive for your platform, extracting the binary, and moving it into a directory on your PATH. For example, on a Linux amd64 host:

wget https://github.com/opentofu/opentofu/releases/download/v1.6.1/tofu_1.6.1_linux_amd64.zip
unzip tofu_1.6.1_linux_amd64.zip
sudo mv tofu /usr/local/bin/
tofu version

Example output:

OpenTofu v1.6.1 on linux_amd64

Once the binary responds to tofu version, you’re ready to write HCL and provision infrastructure.

HCL (HashiCorp Configuration Language) basics

OpenTofu configuration files use HCL and typically have the .tf extension. HCL is declarative and organized with blocks and arguments:

Blocks declare infrastructure elements (for example: provider, resource, module).
Arguments within blocks are key = value pairs that configure the block.

A simple example that creates a local file (save as local.tf):

resource "local_file" "pet" {
  filename = "/root/pets.txt"
  content  = "We love pets!"
}

Key points:

Blocks are delimited by { ... }.
The resource block begins with the keyword resource, followed by the resource type and a resource name.
- Resource type here is "local_file". The portion before the underscore (local) indicates the provider; the portion after (file) is the resource kind.
- "pet" is a logical name you choose to reference the resource in your configuration.
Inside the block, filename and content are arguments specific to the local_file resource.

Another example (S3 bucket):

resource "aws_s3_bucket" "data" {
  bucket = "webserver-bucket-org-2207"
  acl    = "private"
}

The structure is identical: resource keyword → resource type (aws_s3_bucket) → resource name (data) → provider-specific arguments. What is a resource?

A resource is an object OpenTofu manages. Examples include local files, compute instances (EC2), cloud storage (S3), IAM users, serverless functions, and more. OpenTofu supports many resource types exposed by community and vendor providers.

How do you know which arguments a resource supports?

OpenTofu reuses providers compatible with Terraform. Consult the provider documentation in the Terraform Registry for the full resource catalog and argument details:
- Terraform Registry: https://registry.terraform.io/

Each provider maintains its own resource catalog and argument set (AWS, GCP, Azure, etc.), so consult the provider docs when authoring configurations.

A diagram comparing cloud providers that maps a "Provider" to "Resource_type" and corresponding "Arguments," with AWS and Google Cloud service icons shown in separate columns. The left side shows the provider/resource/arguments flow while the middle and right display example AWS and GCP resource icons.

Core OpenTofu workflow

A typical OpenTofu workflow has four main steps:

Write one or more configuration files (*.tf).
Initialize the working directory with tofu init.
Review the execution plan with tofu plan.
Apply the changes with tofu apply.

Table: Common OpenTofu commands

Command	Purpose	Example / Notes
`tofu init`	Initialize working directory and download providers	Detects providers and installs plugins (creates `.terraform.lock.hcl`)
`tofu plan`	Show execution plan without making changes	Preview resources to be added/changed/destroyed
`tofu apply`	Apply the planned changes	Interactive confirmation; use `-auto-approve` to skip prompt
`tofu show`	Inspect resource state	Prints the current state of resources in the directory

Initialize the directory

Using the local_file example, first initialize:

$ tofu init

Example output (truncated):

Initializing the backend...

Initializing provider plugins...
- Finding latest version of hashicorp/local...
- Installing hashicorp/local v2.4.1...
- Installed hashicorp/local v2.4.1 (signed, key ID 0C0AF313E5FD9F80)

Providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://opentofu.org/docs/cli/plugins/signing/

OpenTofu has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that OpenTofu can guarantee to make the same selections by default when
you run "tofu init" in the future.

OpenTofu has been successfully initialized!

tofu init detects referenced providers and downloads the provider plugins needed to execute your configuration.

Plan: preview changes

Preview actions with:

$ tofu plan

Example plan output (truncated):

OpenTofu used the selected providers to generate the following execution plan.
Resource actions are indicated with the following symbols:
  + create

OpenTofu will perform the following actions:

  # local_file.pet will be created
  + resource "local_file" "pet" {
      + content               = "We love pets!"
      + content_base64sha256 = (known after apply)
      + content_base64sha512 = (known after apply)
      + content_md5          = (known after apply)
      + content_sha1         = (known after apply)
      + content_sha256       = (known after apply)
      + content_sha512       = (known after apply)
      + directory_permission = "0777"
      + file_permission      = "0777"
      + filename             = "/root/pets.txt"
      + id                   = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Note: You didn't use the -out option to save this plan, so OpenTofu can't guarantee to take exactly these actions if you run "tofu apply" now.

The + indicates resources that will be created.
The plan shows both declared arguments and computed attributes (e.g., file permissions).

Remember: tofu plan only shows what will happen; it does not change anything.

Apply: make changes

When you’re satisfied with the plan, apply it:

$ tofu apply

You will be shown the plan again and prompted to confirm. Type yes to proceed. Example interactive session (truncated):

Do you want to perform these actions?
OpenTofu will perform the actions described above.
Only 'yes' will be accepted to approve.

Enter a value: yes

local_file.pet: Creating...
local_file.pet: Creation complete after 0s [id=cba595b7d9f94ba1107a46f3f731912d95fb3d2c]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

You can bypass the confirmation prompt with:

tofu apply -auto-approve

Use -auto-approve carefully. It bypasses the confirmation prompt and will immediately apply whatever actions are in the plan. As a best practice, always review the plan before applying changes.

Inspecting state

After applying, inspect the latest state:

$ tofu show

Example tofu show output for the local file (truncated and reformatted):

# local_file.pet:
resource "local_file" "pet" {
  content                 = "We love pets!"
  content_base64sha256    = "zUA5Ip/IeKImTQIp...Bp0c="
  content_base64sha512    = "tduqTz5S8Wa3O9Ab5+g0GcGL6kMjM...bjGg=="
  content_md5             = "f510a471c5dc0bcd4759ad9dc81a516f"
  content_sha1            = "cba595b7d9f94ba1107a46f3f731912d95fb3d2c"
  content_sha256          = "cd4039229fc878a9664d0229b65a7dd0974c18077c60b4ad0d78691aad01a747"
  content_sha512          = "b5dbaa4f3e52f166b73bd01be7e83419c18bea4323321eb5be315c326e4a90e3..."
  directory_permission    = "0777"
  file_permission         = "0777"
  filename                = "/root/pets.txt"
  id                      = "cba595b7d9f94ba1107a46f3f731912d95fb3d2c"
}

Additional resources

HCL documentation: https://developer.hashicorp.com/hcl
Terraform Registry (provider docs): https://registry.terraform.io/
OpenTofu CLI docs: https://opentofu.org/docs/cli/

To recap:

Use resource blocks to declare infrastructure objects.
Inside resource blocks, use provider-specific arguments to define resource behavior.
Run tofu init, tofu plan, and tofu apply to provision resources; use tofu show to inspect state.
Always review the execution plan before applying changes.

That’s it for this lesson. A future lesson will cover providers and provider plugins in more detail.

Course Introduction

Introduction to Infrastructure as Code

Getting Started with OpenTofu

OpenTofu Basics

OpenTofu State

Working with OpenTofu

Remote State

OpenTofu Provisioners

OpenTofu Import, Tainting Resources and Deubugging

OpenTofu Modules

OpenTofu Functions and Conditional Expressions

OpenTofu: Beyond Basics

Course Conclusion

Installing OpenTofu and HashiCorp Configuration Language HCL Basics

Install the OpenTofu CLI

HCL (HashiCorp Configuration Language) basics

Core OpenTofu workflow

Initialize the directory

Plan: preview changes

Apply: make changes

Inspecting state

Additional resources

Watch Video

​Install the OpenTofu CLI

​HCL (HashiCorp Configuration Language) basics

​Core OpenTofu workflow

​Initialize the directory

​Plan: preview changes

​Apply: make changes

​Inspecting state

​Additional resources

Watch Video

Install the OpenTofu CLI

HCL (HashiCorp Configuration Language) basics

Core OpenTofu workflow

Initialize the directory

Plan: preview changes

Apply: make changes

Inspecting state

Additional resources