Terraform and Vault under IBM: what the bill depends on, and when OpenTofu or OpenBao makes sense

Terraform and Vault are IBM products now, and IBM sends the invoices. Before your next renewal, count two things yourself: the resources Terraform manages for you and the clients that log in to Vault. Those two numbers drive most of the usage-based bill, and they also tell you whether moving to OpenTofu or OpenBao would actually save anything.

Usage pricing feels cheap per unit and then surprises people. Ten cents sounds like nothing until someone multiplies it by every security group rule, DNS record and Kubernetes object in state. On the Vault side, the unit is a client, and a single app talking to two namespaces counts twice. Nobody in the team gets a bigger bill on purpose. The estate just grows, and the invoice follows it.

The self-managed editions have no public price at all, so the only number you can control there is the count you bring to the negotiation. If you walk in without your own resource and client counts, you're negotiating against IBM's numbers.

For engineers: a managed resourcedefinitionSomething Terraform built and now tracks in state, like a VM or a DNS record. HCP Terraform bills you for each one, every hour it exists. is anything in an HCP Terraform state file with mode = "managed". Data sources, locals, variables, null_resource and terraform_data don't count. It starts counting the first time a plan or apply touches the resource.

Less than the forum threads suggest, but enough to check your contract. The licence that worries people predates IBM. The pricing model for HCP Terraform, per managed resource, predates IBM too. What IBM changed is who bills you, how support works and how long each release is looked after.

HashiCorp told customers moved off legacy products that they'd get the newer products at the same price they pay today. That's a promise about the move itself. It says nothing about what your next renewal will look like if your counts have grown.

The number that moves is the resource count. A Kubernetes namespace, a role binding and a config map are three resources, and if you manage cluster objects through Terraform they can outnumber the cloud resources. At the published Standard starting rate, 10,000 managed resources works out to about $4,700 a month at list. That's our arithmetic from the public price, before any Flex discount, and it's the reason to count before you talk to sales.

Policy is a common reason to need a higher tier. Standard is where policy enforcement with Sentinel, OPA or the new native Terraform policy shows up in HashiCorp's plan table, and Terraform policy needs version 1.17 or later. If nobody writes policies, you may be paying Standard prices for Essentials use.

# Billable resources in one workspace
$ terraform show -json | jq '[.. | objects | select(.mode? == "managed") | select(.type != "null_resource" and .type != "terraform_data")] | length'
1843
# example output: run it per workspace and add the results up

HCP Terraform also shows a managed resource count on the organization's usage page, so check your own number against IBM's before renewal. Terraform Enterprise is the other branch. There's no public price, the last LTS release (v1.2) is looked after until November 2027, and newer releases follow Support Cycle-2definitionHow long IBM looks after releases from April 2026 onward. For Vault Enterprise that's two years of base support, one extended, then three more with no new fixes. Plan upgrades around it.. If you still run a Replicated install, its support ended on April 1, 2026, so that upgrade is overdue whatever you decide about licensing.

On HCP Vault Dedicated the bill has two parts: an hourly cluster price and a flat hourly charge per client. IBM's indicative table lists $72.92 a month per client on Essentials and Standard, and production cluster hours from about $1.58 (Small Essentials) to $9.41 (Large Standard). At 500 clients the client line alone is about $36,500 a month at list, again our arithmetic. Client counts reset monthly, and you can't bring a count down before the billing period ends.

Self-managed Vault Enterprise has no public price, and since 2.0 the contract can meter usage as well as clients. Check which model your contract uses, because the utilization report only applies the metrics in your contract. Vault Enterprise also sends usage reports to HashiCorp, now IBM, automatically by default, so IBM will see your numbers whether or not you look at them.

Both forks are free and run under the Linux Foundation on the MPL 2.0 licence. OpenTofu forked Terraform. OpenBaodefinitionVault's open-source twin, kept by the Linux Foundation's OpenSSF on MPL 2.0. Namespaces come free, where Vault charges Enterprise prices for them. forked Vault from code written before the licence change, between 1.14.8, the last open-licence release, and 1.14.9. Switching saves licence fees only where you pay for HashiCorp's commercial products. If you use the free Terraform CLI with an S3 backend, the BSL doesn't charge you anything, and the case for OpenTofu rests on features and governance rather than money.

Two things here won't be in the announcements.

• OpenTofu's FAQ only promises to read state written by Terraform up to 1.5.x. If you've kept upgrading to 1.17, test every workspace instead of assuming it'll just work.
• OpenBao's migration guide was tested only on Vault Community 1.14.1 with Raft storage and manual unseal. It makes no promise about storage compatibility and Enterprise wasn't tested, so plan a new cluster and a data move for a Vault Enterprise estate.

It's not a fringe move any more. In a post on the OpenTofu blog, Fidelity Investments described an estate of more than 50,000 state files across over 2,000 applications and said OpenTofu is now its default for new deployments, with the rest moving over time. On the Vault side, companies such as ControlPlane and Adfinis now sell commercial support for OpenBao, which matters if your auditors want a support contract behind every production system.

# Clients per namespace this year
$ vault operator usage -start-time=2026-01-01
# One row per namespace: entities, non-entity tokens, secret syncs and ACME clients, then the active client total that client-based contracts bill on

Most of the savings come from deciding where things live. Kubernetes objects change all day and usually sit better in a GitOps tool than in Terraform state. Vault namespaces are handy for isolation, but each one counts the same client again. We'd give them to real tenants, like a subsidiary, and say no when a team just wants its own space.

Cohash counts managed resources and Vault clients for you, sorts out which paid features you really use, and runs the OpenTofu or OpenBao test on copies of your own workspaces, so the renewal decision rests on numbers. See our Terraform and Vault pages, hire engineers who do this work, or start with an assessment.