SecureAnyCloud
Deployment guide

OpenTofu

Overview

OpenTofu is the open source, community-driven fork of Terraform for infrastructure as code, governed by the Linux Foundation. You declare your infrastructure in HCL, and OpenTofu plans and applies the changes across hundreds of providers, including Azure, AWS and Kubernetes. It brings state management, modules and a full plan/apply workflow.

The SecureAnyCloud image installs OpenTofu 1.12.3 system-wide as a ready-to-use command-line workstation and CI runner. A pre-initialised worked example lets you run a plan within seconds of logging in. This is a command-line product with no web UI.

What you get:

  • OpenTofu 1.12.3 installed at /usr/local/bin/tofu
  • A pre-initialised worked example at /opt/opentofu/example, using the random and local providers, with the providers cached
  • A per-user writable copy at ~/opentofu-example for every login user
  • unzip and git for archives and module sources
  • A login banner that points to the example and the user guide
  • Ubuntu 24.04 LTS with the latest security patches applied at build time
  • 24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is plenty for a CLI workstation.

Configure the NSG to allow inbound 22/tcp from your management network. OpenTofu reaches the OpenTofu provider registry over HTTPS to fetch any providers that are not already cached.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for OpenTofu by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22).

Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:opentofu-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name opentofu \
  --image sac1647283583153:opentofu-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

Step 3 - Connect to your VM

Connect as azureuser, using the public IP address of your VM:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm OpenTofu is installed

Print the installed version:

tofu version

The output shows OpenTofu v1.12.3 and the provider platform.

Step 5 - Initialise the worked example

Every login user gets a writable copy of the example at ~/opentofu-example. Initialise it. The providers are pre-cached, so this is instant and works offline:

[ -d ~/opentofu-example ] || cp -r /opt/opentofu/example ~/opentofu-example cd ~/opentofu-example && tofu init

OpenTofu reports OpenTofu has been successfully initialized!.

Step 6 - Plan

Preview what OpenTofu would create:

cd ~/opentofu-example && tofu plan

The plan shows two resources to add, a random_pet name and a local_file. It ends with Plan: 2 to add, 0 to change, 0 to destroy.

Step 7 - Apply

Create the resources:

cd ~/opentofu-example && tofu apply -auto-approve && cat hello.txt

OpenTofu reports Apply complete! Resources: 2 added and prints the pet_name output. The file hello.txt contains a greeting with the random resource name.

Step 8 - Tear the example down

Destroy the example resources:

cd ~/opentofu-example && tofu destroy -auto-approve

OpenTofu reports Destroy complete! Resources: 2 destroyed.

Step 9 - Manage real infrastructure

Replace main.tf with your own configuration and add a provider. For Azure, add the azurerm provider and authenticate the VM with a managed identity or az login. Then run tofu init to download the provider:

terraform { required_providers { azurerm = { source = "registry.opentofu.org/hashicorp/azurerm" version = "~> 4.0" } } } provider "azurerm" { features {} } resource "azurerm_resource_group" "example" { name = "rg-opentofu-demo" location = "eastus" }

For team use, store state remotely, for example in an Azure Storage backend. To drive OpenTofu from CI, run tofu init, tofu plan and tofu apply non-interactively.

Maintenance

  • Reference template: the read-only example lives at /opt/opentofu/example. Your writable copy is ~/opentofu-example.
  • Upgrades: download a newer OpenTofu release and replace /usr/local/bin/tofu.
  • Providers: tofu init fetches and caches providers for each project. Pin versions in required_providers.
  • Security patches: unattended-upgrades remains enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch OpenTofu on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure