OpenTofu 1.12: The Feature Terraform Never Shipped

2026-05-21 · Source: InfoQ · Field: Technology & Digital — Cloud Computing & IT Infrastructure, Software Development & Engineering · Depth: Intermediate, short

Summary

OpenTofu 1.12.0, released on May 14, 2026, introduces several key features addressing long-standing infrastructure management challenges. The most significant is dynamic `prevent_destroy`, which allows resource protection from accidental deletion to be controlled by variables, enabling shared module use across diverse environments like development and production without code duplication. This feature resolves an issue first requested in Terraform 0.7 in 2016. The update also improves OperProvider checksum handling, with the OpenTofu Registry now providing both `zh:` and `h1:` hashes during `tofu init` for streamlined dependency lock file management. A new `-json-into=FILENAME` flag facilitates building tooling by allowing JSON output to a file while preserving terminal output. Additionally, a `destroy = false` meta-argument simplifies removing resources from state without actual destruction. WinRM provisioner support and 32-bit architecture builds are being deprecated, with removal planned for 1.13.

Key takeaway

For DevOps Engineers managing infrastructure with shared modules across environments, OpenTofu 1.12's dynamic `prevent_destroy` feature eliminates the need for module duplication, simplifying lifecycle management. You should evaluate upgrading to leverage this and the improved `tofu init` checksum handling, which streamlines provider dependency management. Additionally, if you build custom tooling, the new `-json-into=FILENAME` flag offers cleaner integration by separating machine-readable output from terminal logs. Plan to migrate any WinRM provisioners to OpenSSH before 1.13.

Key insights

OpenTofu 1.12 delivers long-requested features like dynamic `prevent_destroy`, showcasing community-driven development's responsiveness to user needs.

Principles

• Community-driven development prioritizes user needs.
• Flexible configuration reduces module duplication.
• Standardized checksums streamline dependency management.

In practice

• Use dynamic `prevent_destroy` in shared modules.
• Stream JSON output to files for tooling.
• Migrate WinRM provisioners to OpenSSH.

Topics

• OpenTofu 1.12
• Infrastructure as Code
• Dynamic `prevent_destroy`
• Shared Modules
• Provider Checksums
• WinRM Deprecation

Code references

• hashicorp/terraform

Best for: DevOps Engineer, Software Engineer, IT Professional

Related on AIssential

• the tiny file that makes openclaw feel less fragile — A dedicated state object file prevents AI agents from losing context on active tasks, improving reliability.
• Kubernetes vs. OpenShift: Choosing DevOps and CI/CD Workflows — OpenShift extends Kubernetes into a comprehensive, integrated platform for streamlined DevOps and CI/CD workflows.
• GitHub Acknowledges Recent Outages, Cites Scaling Challenges and Architectural Weaknesses — GitHub publicly addressed a series of recent availability and performance issues in early 2026, attributing them to rapid growth, architectural coupling, scaling limitations, and an inability to effectively shed load.
• Article: Building Production-Ready tRPC APIs: The TypeScript Alternative to Apollo Federation — tRPC offers superior performance and type safety for TypeScript monorepos compared to GraphQL Federation.
• CI/CD with Robert Erez — Effective software delivery balances automation, controlled progressive releases, and adaptable infrastructure, prioritizing practical outcomes over dogmatic approaches.
• An Operational Toolchain for Microsoft Foundry Private Networks — Proactive checks, precise diagnostics, and systematic cleanup are crucial for robust private network deployments.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by InfoQ.