OpenTofu 1.13

Apply these rules to OpenTofu configurations, modules, state, plans, and automation. Check resource arguments against the selected provider's documentation; OpenTofu does not define each provider's security defaults.

Release and platform

• Run the newest patch of an OpenTofu release series that still receives security fixes; let a line-following installer or execution image select the patch, and obtain the exact version from the official releases page instead of memory.
• Constrain language.compatible_with to the intended release series, and run the same CLI release in planning and apply jobs; do not loosen an existing constraint to get an install through.
• Read OpenTofu release notes and repository security advisories when changing CLI releases; audit modules and providers in CI, and check the OpenTofu CLI separately because provider audits do not cover it.
• Authenticate release archives and checksum files using OpenTofu's signing instructions; inspect downloaded installer scripts and reject their verification-skip options in deployment jobs.
• Select official CLI and provider packages for the worker's operating system and architecture; verify provider protocol compatibility and encrypted-state recovery before changing execution images.

Initialization and worker isolation

• Treat modules, providers, provisioner programs, and saved plans as privileged inputs that can affect infrastructure and secrets.
• Review new registry, module, provider, and remote-backend hosts before the first tofu init that contacts them, including hosts introduced by child modules.