Terraform vs CloudFormation on AWS (2026): Enterprise IaC Decision Guide

CloudFormation Hooks deploy org-wide via service-managed StackSets. AWS documents the pattern for baseline guardrails across OUs without per-account CLI runs. Terraform 1.8+ and OpenTofu 1.8+ remain the default for application teams with existing modules and multi-provider needs. The enterprise question is which layer each tool owns.

This post compares Terraform/OpenTofu and CloudFormation/StackSets for enterprise AWS. For authoring frameworks, see Terraform vs CDK. For language choice, see Terraform vs Pulumi. For CFN-only how-to, see CloudFormation best practices.

Artifacts: IaC decision matrix, enterprise criteria worksheet CSV.

Decision table

Opinionated take: Hybrid. Use StackSets for the platform baseline and Terraform for application stacks. One-tool mandates fail when security needs org rollouts and apps need HCL velocity.

When CloudFormation and StackSets win

• Organizations auto-deployment: new accounts in OU get baseline stacks automatically
• CloudFormation Hooks: proactive compliance (e.g., S3 public access block) at deploy time
• No S3 state bucket: one less secret-leak surface
• Service Catalog integration for governed self-service

# Context: CloudFormation StackSet excerpt — service-managed permissions (July 2026)
# Deploy baseline to entire OU; enable trusted access in Organizations first.
Resources:
  GuardDutyEnable:
    Type: AWS::GuardDuty::Detector
    Properties:
      Enable: true

Platform team owns the template; member accounts receive stack instances without local Terraform.

When Terraform and OpenTofu win

• for_each / dynamic blocks for N environments without copy-paste YAML
• Terraform Registry modules shared across repos
• Multi-provider: AWS + Datadog + Cloudflare in one plan
• Existing estate: migration cost dominates the switch-to-CFN math

# Context: Terraform 1.8+, AWS provider ~5.x — app stack pattern
resource "aws_ecs_service" "api" {
  for_each = var.environments
  name     = "api-${each.key}"
  cluster  = aws_ecs_cluster.main.id
  # ...
}

What broke in the StackSets rollout

Hybrid reference architecture

Management account
├── StackSets (service-managed) → Config, GuardDuty, CloudTrail, Hooks
├── SCPs (Organizations)
└── Delegated admin for StackSets

Member accounts (app teams)
└── Terraform/OpenTofu → ECS, RDS, Lambda (remote state in shared account)

Align with enterprise governance OU taxonomy.

When NOT to use each

What to do this week

1. Score your org on enterprise-criteria-worksheet.csv.
2. Run decision matrix and assign a platform vs app layer.
3. If no StackSets baseline: pilot 2 accounts in one OU before org-wide.
4. If Terraform state on S3: verify versioning + MFA delete + lock table today.
5. Document the hybrid pattern in your internal wiki and end the “Terraform vs CFN” argument.

What this post doesn’t cover

• CDK authoring depth: Terraform vs CDK guide.
• Application Composer visual IaC: Application Composer post.
• Full Terraform state migration: state management guide.
• Pulumi: OpenTofu vs Pulumi.

Related: DevOps pipeline setup · Enterprise governance

Frequently asked questions