HCP Terraform's Free Tier Ended in March. Now Read the Meter

HashiCorp retired the legacy HCP Terraform free plan on 31 March 2026 and moved every organization still on it to the enhanced Free tier. That date is behind us, so this is no longer a deadline post. It is a “you are already there, now what” post, and the answer changed over the summer because the alternatives repriced.

The enhanced tier flips the model. The legacy plan counted users and capped them. The new one gives you unlimited users and up to 500 managed resources, and it throws in SSO, policy as code with Sentinel and OPA, run tasks, and agents, which the legacy plan did not have. For a homelab or a side project it is a genuine upgrade.

The catch is how fast 500 resources goes. A managed resource is anything in state where mode = "managed", counted from the first plan or apply. That is not the EC2 instances you think about. It is every subnet, route table, IAM policy attachment, security group rule, and CloudWatch alarm that came along with them. One moderately complex environment can clear 500 by itself. And the move to the enhanced tier does not reverse.

Plans and prices below came off the vendor pricing pages on 22 August 2026.

First, pull your state

Before you evaluate anything, back up your state files. Workspace deletion in HCP Terraform is not recoverable, and state is the one artifact you cannot regenerate. Your configuration and modules live in Git. A lost state file means reconciling reality by hand.

terraform state pull > backup-$(date +%F).tfstate

With more than a handful of workspaces, script it against the API using your workspace IDs and a token, and put the output somewhere versioned. Then open the files and check they parse. A zero-byte backup because the token lacked permission is the kind of thing you discover at exactly the wrong moment.

Do this even if you decide to stay. It takes ten minutes and removes the scariest failure mode from the whole question.

Three vendors, three meters

The feature checklists across these products converge. The pricing models do not, and the model matters more, because a platform that is cheap for a small team with large infrastructure can be punishing for a large team with modest infrastructure.

	What it counts	Free tier	Entry paid
HCP Terraform	Managed resources	500 resources, unlimited users	Essentials from $0.10 per resource per month
Scalr	Runs	50 runs a month, 2 concurrent	$0.99 per run, volume discounts
Spacelift	Workers	2 users, 1 public worker	Starter+ at $20,000 a year

That Spacelift figure is not a typo, and it is the number that changed since this was first written. Spacelift’s pricing page now lists Starter+ at $20,000 annually with one private worker and two public ones, and Business, Enterprise, and Enterprise+ above it on request, allocated by private worker count. Comparisons written in the spring, mine included, quoted a few hundred dollars a month and described resource-based pricing. Whatever the history, the current entry point is an annual contract in five figures, so price it against what you were actually going to spend.

Scalr is the easiest to reason about because runs are countable in advance. Free gives 50 runs a month with 2 concurrent, Business is $0.99 a run with volume discounts, and concurrency is not a paywall: you start at 5 and can raise the quota at no charge, and each self-hosted agent adds 5 more. If your infrastructure is large but you apply rarely, per-run billing is the cheapest shape on this list by a distance.

env0 sits on a per-environment and per-apply model and is strong on ephemeral environments, cost visibility, and TTL-based teardown, with no limit on concurrent runs. Its list pricing is quote-gated, which is the opposite of Scalr’s posture and makes it hard to compare on paper.

Do the arithmetic before you leave

Here is the part the March coverage got wrong, mine included. Everyone treated leaving HCP Terraform as the obvious response to losing the free plan. Look at what staying now costs.

HCP Terraform’s paid tiers are Essentials, Standard, and Premium, priced per resource per month: $0.10, $0.47, and $0.99 respectively, rated hourly. At Essentials, a thousand managed resources is around $100 a month. Two thousand is around $200. Those are not the numbers of a vendor trying to push you out, and they are well under the entry contract at one of the alternatives.

So the honest decision tree starts with a subtraction rather than a migration. Count your managed resources, multiply by the tier you actually need, and compare that against a year of whatever you were going to move to plus the engineering time to move. For a lot of teams sitting a little over 500 resources, the cheapest correct answer is to pay HashiCorp $60 a month and go back to work.

Migrating is right when the meter is wrong for your shape. Huge resource counts with infrequent applies argue for Scalr’s per-run model. A platform team that needs many private workers and heavy policy enforcement is the shape Spacelift’s worker allocation is built around. An environments-per-branch workflow is what env0 optimizes for.

The self-hosted paths, and what they actually cost

If swapping one SaaS bill for another does not sit right, two options cost nothing to license.

Atlantis is the veteran: open a pull request, it runs terraform plan and posts the output as a comment, and you atlantis apply from the PR after approval. Free, open source, and proven at scale. You run it, which means a server with network reach into your cloud, credential management, upgrades, and some answer for what happens when it is down during an incident. You also assemble drift detection, RBAC, and policy dashboards yourself instead of getting them bundled. For a team that already lives in GitHub with someone comfortable operating a service, that is a fine trade. For a team whose goal was to stop operating infrastructure tooling, it is a step backward.

OpenTofu inside the CI you already run is the other route. You write the plan and apply steps, store state in S3 or GCS with locking, and gate applies behind your existing review process. OpenTofu has one feature that makes this materially nicer than the same pipeline on stock Terraform: state encryption is built into the backend configuration, with keys from AWS KMS, GCP KMS, or a passphrase. On Terraform that is something you bolt on at the storage layer. If state is going into your own bucket, having encryption be a first-class setting is worth something.

Neither gives you a drift dashboard unless you schedule a plan job and parse the output.

While you are here: OpenTofu or Terraform

Since you are already moving things, it is a reasonable moment to ask. Module and provider compatibility is excellent, because OpenTofu forked from Terraform and stays close to it, and the registry has a mirror.

The real reason people switch is licensing. Terraform is under the Business Source License; OpenTofu is MPL and governed by the Linux Foundation. If your organization has a policy against BSL terms, that settles it. If you are paying for a hosted platform anyway, the licensing difference matters less and staying on the tool your vendor supports first is defensible. Just decide it deliberately instead of on vibes.

By team size

Solo or homelab: stay on enhanced Free if you fit under 500 resources. If you do not, OpenTofu plus GitHub Actions with an S3 backend and state encryption costs roughly what the bucket costs. You do not need a platform. You need a plan on PR and an apply on merge.

Small team: run the subtraction above first. HCP Essentials or Scalr’s per-run billing will both come in under a few hundred a month for most infrastructure of this size, and both buy back the engineering time that babysitting Atlantis would cost. Pick Scalr if your applies are infrequent relative to your resource count, HCP if the reverse.

Platform team: concurrency, RBAC, policy as code, and self-hosted runners stop being nice to have. This is where Spacelift’s worker model and env0’s environment model earn their contracts, and where Scalr’s free concurrency per self-hosted agent is worth modeling seriously. If your team genuinely wants to own the stack, Atlantis or OpenTofu with a real CD platform behind it works, priced in engineer-hours rather than licenses.

The mechanics are the same wherever you land: export state, stand up the new backend, migrate state into it, run a plan, and confirm zero diff. That zero-diff plan is your proof the migration worked. If it wants to destroy and recreate half your infrastructure, stop and find out why before you type yes.