The Complete Production SOP: How to Deploy and Run OpenTofu Open-Source Infrastructure Engine & Migration in Autonomous AI Agents

Agent runtimes such as Claude Code, Cursor, and Codex discover custom capabilities by parsing markdown files containing structured YAML frontmatter. By mounting SKILL.md into the workspace `.claude/skills/` or `.cursor/rules/` directory, the agent automatically evaluates user intent against the specified triggers: 'migrate from terraform to opentofu', 'enable opentofu state encryption', and 'run tofu plan'.

---
name: "opentofu-fork-migration"
description: "Run truly open-source Infrastructure as Code using the Linux Foundation OpenTofu engine."
metadata:
  author: "OpenTofu"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "migrate from terraform to opentofu"
  - "enable opentofu state encryption"
  - "run tofu plan"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

Before executing migration plans, the agent must check that 'tofu' is the active binary rather than legacy 'terraform'. The agent validates the OpenTofu version and ensures that no lingering locks or cached state snapshots cause conflict. This step also verifies that workspace variables containing KMS key ARNs or cloud provider credentials are appropriately sourced.

terraform {
  encryption {
    key_provider "aws_kms" "state_encryption_key" {
      kms_key_id = var.kms_key_arn
      region     = "us-east-1"
    }

    method "aes_gcm" "aes_method" {
      keys = key_provider.aws_kms.state_encryption_key
    }

    state {
      method   = method.aes_gcm.aes_method
      enforced = true
    }

    plan {
      method   = method.aes_gcm.aes_method
      enforced = true
    }
  }
}

Invoke the skill by triggering phrases defined in the frontmatter: 'migrate from terraform to opentofu' or 'enable opentofu state encryption'. The agent interprets the repository state, updates provider blocks, verifies backend configuration, and generates an OpenTofu-compliant execution plan without modifying unmanaged remote infrastructure.

# Remove legacy terraform cache artifacts
rm -rf .terraform/
# Re-initialize provider registries under OpenTofu
tofu init
# Validate syntax and state compatibility
tofu plan -out=tofu_migration.tfplan

The agent must verify that the infrastructure definitions compile and that the generated plan contains zero destructive changes caused by provider divergence. Running `tofu validate` and `tofu fmt -check` completes the validation phase, confirming that the codebase has been cleanly migrated to OpenTofu standards.

#!/usr/bin/env bash
set -euo pipefail

echo "Validating OpenTofu syntax..."
tofu fmt -check
tofu validate

echo "Checking plan integrity..."
tofu show tofu_migration.tfplan > /dev/null
echo "Migration verification completed successfully."