CDKTF Alternatives in 2026: Where to Go After CDK for Terraform

CDK for Terraform let teams write Terraform in TypeScript, Python, Go, Java or C# and still use every Terraform provider. On December 10, 2025, HashiCorp deprecated it and archived the repository. Nothing breaks on the day of deprecation, but every Terraform release and provider update from then on is untested against a frozen tool, and the longer a CDKTF codebase stays, the riskier each upgrade gets.

The right replacement depends on what your CDKTF code actually describes. If it is cloud foundations, such as accounts, networks, DNS and third-party providers, you want another general infrastructure-as-code tool. If most of it is the application's own infrastructure, such as databases, queues, buckets, secrets and the IAM between them, you can stop writing it as separate infrastructure code at all. This guide covers both paths.

CDKTF alternatives at a glance

Each option is covered below, starting with Encore.

Declaring application infrastructure in TypeScript and Go with Encore

Encore combines an open source infrastructure SDK for TypeScript and Go with a platform that provisions and deploys into your own AWS or GCP account. The application declares what it uses and Encore creates it: RDS, SNS and SQS, S3, Secrets Manager and Fargate on AWS, or Cloud SQL, Pub/Sub, Cloud Storage, Secret Manager and Cloud Run on GCP, with an IAM role for each service.

A CDKTF stack for a signup flow typically held a database, a topic with a queue, a secret and the policies tying them to a service. In Encore that is the service:

// signups/signups.ts
import { api } from "encore.dev/api";
import { secret } from "encore.dev/config";
import { Topic } from "encore.dev/pubsub";
import { SQLDatabase } from "encore.dev/storage/sqldb";

const db = new SQLDatabase("signups", { migrations: "./migrations" });

// Secrets Manager on AWS, Secret Manager on GCP. Set with: encore secret set --type prod CrmApiKey
const crmApiKey = secret("CrmApiKey");

export const signedUp = new Topic<{ email: string }>("signed-up", {
  deliveryGuarantee: "at-least-once",
});

export const signup = api(
  { expose: true, method: "POST", path: "/signups" },
  async ({ email }: { email: string }): Promise<{ ok: boolean }> => {
    await db.exec`INSERT INTO signups (email) VALUES (${email}) ON CONFLICT (email) DO NOTHING`;
    await signedUp.publish({ email });
    return { ok: true };
  },
);

// Called by a subscriber elsewhere in the app. The key never appears in config files.
export function crmHeaders(): Record<string, string> {
  return { Authorization: `Bearer ${crmApiKey()}` };
}

The migration in signups/migrations creates the signups table the queries use:

-- signups/migrations/1_create_signups.up.sql
CREATE TABLE signups (
    email TEXT PRIMARY KEY
);

encore run starts Postgres and Pub/Sub locally with the same declarations. Deploys run migrations and update infrastructure together with the application release, in place of a separate cdktf deploy step.

~/orders — claude

Claude Code v2.1.180Opus 5.5~/orders

Encore covers application infrastructure, not your whole cloud estate. Account setup, DNS outside the app or third-party SaaS providers still belong in a general tool, so one option is to move the backend's stacks to Encore and keep a small Terraform or Pulumi project for the rest.

Pulumi: the closest match to CDKTF

Pulumi is what CDKTF users usually mean when they ask for an alternative: infrastructure written in TypeScript, Python, Go, C#, Java or YAML, with loops, functions and packages, deployed by a CLI that keeps state. Many of its providers are bridged from Terraform providers, so resource names and arguments look familiar, and pulumi convert can translate Terraform HCL into a Pulumi program as a starting point.

The migration takes effort, since CDKTF constructs do not map one to one, state has to be imported or resources adopted, and you take on Pulumi's state backend, either Pulumi Cloud or a self-managed bucket. Pulumi is actively developed and keeps the programming model you chose CDKTF for.

AWS CDK: if everything is on AWS

The AWS CDK shares CDKTF's ancestry. Its construct model is what CDKTF was built on, and L2 constructs bring sensible defaults and grant methods for IAM. It synthesizes to CloudFormation, so deploys, rollbacks and drift detection come from AWS.

It only covers AWS, so any Terraform providers you used for GitHub, Datadog, Cloudflare or other services have no equivalent, and the AWS CDK works best for teams that were using CDKTF almost entirely with the AWS provider.

Terraform in HCL: HashiCorp's recommended path

HashiCorp's guidance for CDKTF users is to move to standard Terraform and HCL. You keep every provider, your state and the Terraform workflow your team already runs. A direct bridge is cdktf synth, which writes Terraform JSON for each stack that plain Terraform can plan against the same state, and you rewrite it as HCL stack by stack.

You give up the programming language, since HCL has for_each, modules and functions, but no types, classes or package ecosystem, which is often why the team chose CDKTF to begin with.

OpenTofu: Terraform without the license question

OpenTofu is the open source fork of Terraform, created after HashiCorp moved Terraform to the Business Source License and now governed by the Linux Foundation. It reads the same HCL, works with the same providers and state, and adds features of its own such as client-side state encryption.

For a CDKTF team it is the same migration as Terraform, with a different binary at the end. It suits teams that want to stay on the HCL ecosystem but prefer an open source license and community governance.

How to choose

Look at what your CDKTF stacks contain. If most resources exist to serve one backend, such as its database, queues, buckets, secrets and service roles, Encore removes that code and adds local development the old setup never had. If the stacks manage shared cloud foundations or many third-party providers, Pulumi keeps the programming model, the AWS CDK suits AWS-only estates, and Terraform or OpenTofu keeps everything you already know at the cost of writing HCL.

Related guides

• CDK for Terraform: a guide
• Pulumi alternatives
• Terraform vs Pulumi
• Migrate from Terraform to Pulumi