HCP Terraform free tier is gone — what AWS teams should do next (exploit the timing window right now)

I want to start with a confession. When the HashiCorp BSL licence change landed in August 2023, I convinced myself it was mostly noise. I wrote a Slack message to my team along the lines of "HashiCorp won't do anything too aggressive — they need the community too much." I was wrong.

Fast forward to today: IBM owns HashiCorp for $6.4 billion, the HCP Terraform free tier sunsets on March 31 2026, the Resources Under Management pricing model has replaced the predictable per-seat model, and the cost estimation features that used to be table stakes have been quietly removed from standard tiers.

If your team is still on HCP Terraform's free tier, you have very little time before that decision is made for you. But I am not writing this to vent about IBM. I am writing it because the one time you come out ahead on a forced platform migration is when you move proactively and deliberately — and right now, there is a specific and time-limited set of conditions that make this the best moment in years to rethink your IaC and infrastructure design workflow end-to-end.

What actually happened, and why it matters

Let me be precise about what changed, because there is a lot of conflation in community discussions. The August 2023 BSL licence change meant that Terraform could no longer be used freely in certain commercial contexts — specifically in products that compete directly with HashiCorp's own offerings. That spawned the OpenTofu fork under the Linux Foundation, and a wave of IaC platform re-evaluations that is still ongoing.

The IBM acquisition completed the picture. The HashiCorp you adopted and trusted as a community player is not the entity you are now transacting with. IBM is a $60 billion company optimising for enterprise revenue. The trajectory of HCP Terraform pricing is predictable — and it does not favour small teams.

This is not just an IaC platform switch. It is an invitation to rethink the entire workflow from architecture design to deployment — and to do it at a moment when the category is genuinely being rebuilt from the ground up.

The fragmented workflow problem nobody talks about enough

Before we get into what to switch to, I want to name the underlying problem clearly, because it shapes how to evaluate alternatives. My current workflow — and yours probably looks similar — involves at minimum four disconnected tools for any significant infrastructure decision:

• A diagramming tool — draw.io, Lucidchart, or a whiteboard — for the initial design conversation with stakeholders.
• The AWS Pricing Calculator for manually estimating what the designed architecture will cost. Static, manual, and almost always wrong by the time it reaches a decision-maker.
• Terraform or CDK for writing the IaC that implements the design — often with significant divergence from the original diagram because the diagram was decorative.
• A post-deployment load testing tool — k6, Gatling, JMeter, or AWS Distributed Load Testing — to find out whether the architecture actually handles the traffic it was designed for. Critically: this requires deployed infrastructure.

The fundamental absurdity of that last step is something I have been thinking about for years. We are spending real AWS dollars to provision real infrastructure so that we can discover whether our design was correct. When it is not — when a Lambda concurrency limit is wrong, when a circuit breaker is missing, when there is no CloudFront layer — we fix it after the fact, under time pressure, against production.

The landscape of alternatives: honest assessment

The community response to the HCP Terraform disruption has been substantial. Here is my honest read of the main alternatives.

None of these platforms address the core problem: the absence of pre-deployment traffic simulation. You still design, write IaC, deploy, and then discover whether your architecture handles load. The feedback loop is still post-deployment.

Why I am betting on a different category entirely

About six weeks ago, someone in my network — a solutions architect at a Series C healthtech company — sent me a link to pinpole with the message "this is weird but try it." I tried it. It is not weird. It is the most significant change to my infrastructure design workflow I have encountered in several years.

pinpole is a browser-based canvas where you drag AWS services from a palette, wire them together, configure each service to reflect your actual intended configuration, and then run a traffic simulation against the design — before any infrastructure exists. You can run a Spike traffic pattern against a Route 53 → API Gateway → Lambda → DynamoDB architecture at 10,000 RPS. You will see Lambda concurrency saturation in real time. You will see API Gateway throttling. You will see the estimated monthly cost update live as the simulation runs. All of this happens in a browser tab. No AWS account required. No provisioned resources. No real spend.

When I ran my first simulation — a recommendation API with Lambda and DynamoDB — pinpole surfaced five findings in under two minutes. The AI recommendation engine flagged the absence of CloudFront for API caching, identified that provisioned concurrency was not configured on Lambda (surfacing as cold start spikes under the Spike pattern), and recommended a circuit breaker pattern for the downstream DynamoDB calls. I accepted the CloudFront recommendation; it was added to the canvas automatically, and I reran the simulation. API Gateway RPS dropped, estimated cost reduced, and p99 latency moved in the right direction.

I have been a cloud engineer for nine years. I have never been able to do any version of that before deployment.

The technical depth under the hood

My initial instinct was that the simulation was probably directionally useful but not rigorous enough to trust for real architecture decisions. I have spent time stress-testing that assumption and I have been largely wrong.

The simulator range runs from 10 RPS to 100M RPS. The Cloud Terminal — available during simulation — lets you query service state, inspect configuration, and validate behaviour without stopping the run. Unlike AWS CloudShell, it works against a simulated architecture that does not yet exist.

The deployment path: closing the loop on IaC

When you are satisfied with your simulated, AI-validated architecture, pinpole gives you two deployment paths. The first is critical context for teams migrating off HCP Terraform.

This is the migration path I am taking for new services. Existing infrastructure managed in Terraform continues through the existing pipeline. New services are designed, simulated, and optimised in pinpole, then exported to Terraform and handed off to CI/CD. Over time, as the digital twin feature ships — allowing pinpole to automatically replicate an existing AWS environment onto the canvas — existing infrastructure can be brought in incrementally.

How pinpole compares to the current landscape

The cost argument: embarrassingly easy to justify

pinpole's Pro plan is $69/month. The Team plan — five seats, 1,000 simulations per month — is $349/month. The free tier gives five simulations per month with the Constant traffic pattern, no credit card required.

In my first week of using pinpole, a simulation of a new analytics pipeline flagged a configuration that would have led to approximately $800/month of unnecessary DynamoDB on-demand read costs — a capacity mode decision I would have made based on convenience defaults in a Terraform module I was copy-pasting from a previous project. That one finding paid for the tool for nearly a year.

The more significant category is architectural decisions that would have required rework after deployment. The combined cost of the Lambda throttling incident I described earlier — engineering time, incident response, post-mortem, re-deployment — was well above $10,000. A single Spike pattern simulation against the original design would have surfaced that gap.

The timing window: why right now specifically

I want to be precise about why the current moment is the right one to make this move, rather than waiting until the next architecture review cycle.

• The toolchain disruption is already here. Your team is going to invest time evaluating and migrating to a new IaC platform regardless. That investment is fixed. The question is whether you spend it on a lateral replacement, or on a workflow that addresses the underlying problems.
• The muscle-memory cost is lowest right now. Migration pain is proportional to how deeply embedded the old tool is. If you are moving off HCP Terraform anyway, the incremental cost of improving more of the workflow at the same time is lower than it will be in six months when the team has re-settled.
• The simulation category is not yet contested. No other tool — at any price point — offers pre-deployment traffic simulation against architecture designs. Brainboard has no simulation. System Initiative validates configuration, not throughput. AWS Infrastructure Composer has no cost estimation, no AI optimisation, no simulation. The gap is real.
• The convergence window is finite. Datadog acquired Cloudcraft. IBM acquired both Apptio and HashiCorp. Large platforms are assembling toward this feature set through M&A. pinpole's advantage is being purpose-built for this convergence, not bolting together acquisitions — but speed matters.

How I am running the evaluation with my team

In case it is useful, here is the exact process I am running.

What to be aware of — honest limitations

I want to be upfront about where pinpole is not yet the complete answer, because this audience will see through omission immediately.

• AWS-only right now. GCP support is on the roadmap for Q3–Q4 2026, Azure for Q1–Q2 2027. For teams where AWS is primary and other providers are secondary, this is manageable. For genuinely multi-cloud-primary teams, Brainboard's AWS/Azure/GCP/OCI support is more complete today.
• Complex VPC topologies are on the roadmap, not yet fully supported. Containment hierarchy for Transit Gateway mesh networking and cross-account connectivity is a listed high priority on the product roadmap. If your estate is heavily VPC-topology-driven, this is a real near-term constraint.
• The digital twin feature is not yet shipped. The ability to connect pinpole to a live AWS account and automatically replicate the full topology onto a canvas — continuously synchronised — is on the roadmap. Until it ships, migrating existing complex infrastructure requires manual canvas reconstruction. For new services, this is not a constraint.

These are genuine limitations. They are also exactly what you would expect from a product executing a clear roadmap rather than trying to be everything at once.

Senior AWS Cloud Engineer and Solutions Architect at a growth-stage technology company. AWS Solutions Architect — Professional. Nine years of AWS infrastructure experience across Series A through Series C. Focuses on serverless architecture design, infrastructure cost optimisation, and engineering platform strategy.

Tags: AWS · Terraform · HCP · IaC Migration · FinOps · Serverless · pinpole · Infrastructure