The Problem with Self-Managed Terraform State
If you've managed Terraform state with S3 + DynamoDB, you know the pain: someone forgets to run terraform init with the right backend config, two engineers run plan simultaneously and corrupt state, the DynamoDB lock gets stuck after a failed apply, and there's zero audit trail for who changed what and when.
This was our reality managing 6 AWS environments for a 40-person engineering team. I estimated we spent about 4-6 hours per month dealing with state-related incidents before Terraform Cloud.
Context: My team managed AWS infrastructure across dev, staging, and 4 production environments using Terraform. Team size: 3 SREs, 40 engineers with occasional Terraform access. We ran ~200 workspaces before migrating to Terraform Cloud.
What Terraform Cloud Actually Adds
Terraform Cloud Pricing — Honest Breakdown
- Remote state storage
- Remote execution
- VCS integration
- 5 users max
- No SSO, no Sentinel
- Sentinel policy enforcement
- SSO / SAML
- Audit logging
- Team management
- Run tasks integration
- Self-hosted option (TFE)
- Multi-organization
- Drift detection
- Advanced security controls
- SLA + dedicated support
Terraform Cloud vs. Self-Managed — What Actually Changed
| Concern | S3 + DynamoDB (Self-managed) | Terraform Cloud |
|---|---|---|
| State locking | Manual DynamoDB — gets stuck | Automatic, reliable |
| Secret management | tfvars files (dangerous) | Encrypted workspace vars |
| Audit trail | None — hope CloudTrail catches it | Full run history with who/when/what |
| Access control | IAM policies (coarse-grained) | Workspace-level permissions |
| Policy enforcement | Code review only (humans fail) | Sentinel — automated, enforced |
| Multi-team setup | Painful — everyone needs S3 access | Clean team/workspace model |
| Cost | ~$5/month S3 + DynamoDB | $20/user/month |
| Monorepo support | Works fine with any structure | VCS triggers need careful config |
The Sharp Edges No One Talks About
VCS-driven workflows are tricky with monorepos
If you run multiple Terraform workspaces from a single repo (very common in large orgs), configuring VCS triggers correctly is genuinely complex. You'll spend real time tuning working directory patterns and trigger filters. The CLI-driven workflow is much simpler and what I recommend starting with.
The free tier resource limit is real
The 500-resource limit on the free tier sounds like a lot until you start counting — each security group rule, each subnet, each IAM policy attachment is a resource. A typical 3-tier web app with RDS can hit 200+ resources easily. Most real teams need Plus within 6 months.
Migration from S3 backend takes a day, not an hour
Migrating existing workspaces required a careful sequence: create workspace, configure backend, run terraform init -migrate-state, verify state. We had one workspace where a corrupt state required manual editing. Budget 4-8 hours for a team of 10-20 workspaces.
What Justified the Cost
- Zero state corruption incidents since migration (vs. 3-4 per quarter before)
- Sentinel policies catch security violations before they reach production
- Audit log paid for itself the first time an incident required post-mortems
- Non-SRE engineers can safely plan without risk of applying to prod
- Encrypted variable storage eliminated tfvars-in-git security risk
Still Frustrating After a Year
- $20/user/month adds up fast for a large engineering org
- VCS workflow trigger configuration is genuinely complex
- UI feels dated compared to modern SaaS tools — functional but not polished
- Run queue can back up during peak hours on shared runner pool
- No native drift detection below Business tier — use Atlantis for this
The OpenTofu Question
Since HashiCorp changed Terraform's license to BSL in 2023, OpenTofu (the open-source fork) has become a serious alternative. If vendor lock-in and licensing concerns are on your radar, OpenTofu + Atlantis + S3 backend is now a fully viable enterprise stack that costs a fraction of Terraform Cloud Plus.
My recommendation: if you're starting fresh today with a strong DevOps team, evaluate OpenTofu. If you're already in the HashiCorp ecosystem with HCP Vault and Consul, Terraform Cloud is the path of least resistance.
Start with Terraform Cloud Free
The free tier handles 500 resources with full remote state and VCS integration — enough to evaluate the platform properly before committing to Plus.
Try Terraform Cloud Free →Affiliate disclosure: I earn a commission if you upgrade to a paid plan. My review reflects real production experience and is not influenced by this relationship.