HASHICORP AND TERRAFORM

HashiCorp BSL and managed service providers.

The HashiCorp BSL and managed service providers sit in an uneasy relationship, because the Business Source License restricts exactly the competitive use that many MSP business models rely on. This article explains where the line falls, who needs to look closely, and what the options are.

No group has more reason to read the Business Source License carefully than the managed service provider. The relationship between the HashiCorp BSL and managed service providers is tense by design, because the license restricts competitive production use and the MSP business is built on running other people's infrastructure for them. Whether a given provider is affected turns on a single distinction: using the tools to deliver a service, versus offering the tools themselves as a competing product. This article walks through that line and what to do on either side of it.

What HashiCorp changed

As of August 2023 HashiCorp moved Terraform, Vault, Consul, Nomad and Packer from an open source license to the Business Source License 1.1. IBM later acquired HashiCorp. The Business Source License restricts competitive production use and converts to an open license after a delay, commonly four years. It is source available, not open source, and it is not approved by the Open Source Initiative. The community fork of Terraform, OpenTofu, continues the last open release under an open source license. For the full background, see the HashiCorp and Terraform pillar.

The phrase that matters for service providers is competitive production use. The Business Source License grants broad use rights but carves out use that competes with the licensor's commercial offering. For an ordinary enterprise running Terraform to manage its own infrastructure, that carve out is usually distant. For a provider whose product looks like the licensor's product, it is close. The MSP sits exactly where the carve out was aimed.

Where the competitive line falls for an MSP

The useful mental model is to separate the tool from the service. A managed service provider that uses Terraform internally to provision and manage infrastructure on behalf of clients is using the tool as a means to deliver its own distinct service. A provider that packages Terraform itself, or offers a Terraform like capability as the product clients buy, is closer to offering a competing version of what HashiCorp sells. The first looks like ordinary use. The second looks like competitive use.

Most real MSPs live somewhere between those poles, which is why this needs care rather than a reflex. A provider that exposes Terraform workflows to clients through its own platform, that resells a hosted Terraform experience, or that builds a self service infrastructure product on the HashiCorp tools should treat the question as live. The closer the service is to the thing HashiCorp commercializes, the more important it is to examine the specific facts against the specific license text.

Why this is a risk advisory question, not a verdict

It would be convenient to publish a rule that says a given MSP model is or is not permitted. That would also be wrong. The Business Source License attaches an additional use grant that varies, and the meaning of competitive use depends on the facts and on how a court or the licensor would read them. The honest posture is to treat the question as one for your own counsel, informed by a clear map of how the tools are actually used in your service. The risk advisory work is building that map and sizing the exposure. The legal interpretation belongs with your lawyers.

Map before you worry or relax

Many providers either panic without cause or relax without basis, both because they never mapped where the tools sit. The first step is an honest inventory: every product line, every client offering, and every internal pipeline that touches Terraform, Vault, or the other affected tools. Only against that map can you tell which parts of the business are plausibly competitive and which are clearly internal. The companion article on assessing Terraform exposure across teams sets out how to build that picture.

The options for a concerned MSP

A provider that finds genuine competitive exposure has three broad paths, and the right one depends on the service model and the cost to change. The first is to migrate the affected workflows to OpenTofu, the open source fork of Terraform, which removes the Business Source License restriction for the forked tool. The second is to restructure the service so it stays clear of competitive use, for example by changing how the capability is exposed to clients. The third is to negotiate a commercial license with the vendor, which can be the right answer where migration is costly and the relationship is strategic.

Each path has tradeoffs. The fork removes the license problem but requires testing for compatibility and a commitment to the fork's roadmap. Restructuring preserves the tool but may constrain the product. A commercial license preserves both but carries cost, and the negotiation goes better when you can credibly point to the fork as an alternative. A sized comparison of the three, rather than instinct, is what turns this into a decision the business can defend.

Acting before it is forced

The worst time to confront the HashiCorp BSL is during a vendor inquiry or a client audit, when the questions arrive on someone else's timeline. The best time is now, while the choice of fork, restructure, or license is yours to make calmly. Map the use, size the exposure, take the interpretation question to counsel, and choose the path deliberately. For the common follow on questions, see the HashiCorp BSL frequently misunderstood terms.

COMMON QUESTIONS

Questions buyers ask.

CONTAINMENT

Know where your service meets the BSL line.

A confidential relicensing exposure review. Independent, buyer side, paid only by you.

Not ready to talk? Read the free open source license risk guides first.