A platform team's monthly HCP Terraform bill jumped 40% overnight with no code changes and no new environments. The cause: a Kubernetes module they'd added six months earlier was managing 3,000+ granular resources - security group rules, IAM policy bindings, individual pod annotations - that nobody had counted when estimating cost. Resources Under Management pricing doesn't care how often you run terraform apply. It cares how much state you're carrying, every hour, whether you touch it or not.
That's the trap most teams fall into when comparing HCP Terraform, Terraform Enterprise, and a self-hosted backend: they compare list prices instead of comparing what actually drives the bill, and RUM pricing's real cost driver - total managed resources, not team size or run frequency - catches almost everyone off guard at least once.
All three options run the same Terraform (or OpenTofu) engine underneath. What differs is who hosts the execution environment, who owns the state backend, and how the bill scales.
HCP Terraform: SaaS, HashiCorp-hosted. Resources Under
Management (RUM) pricing - per resource,
per hour, billed on peak hourly count.
No infrastructure to run yourself.
Terraform Enterprise: Self-hosted, same feature set as HCP
Terraform's Business tier. Custom
contract pricing, full network control,
your infrastructure and ops burden.
Self-hosted backend: DIY - an S3 bucket + DynamoDB lock table,
or a third-party remote-ops platform
(Spacelift, env0, Scalr). No per-resource
fee; you build governance yourself.
HCP Terraform's pitch is zero infrastructure ownership in exchange for a bill that scales with your total resource footprint, not your team's activity. Terraform Enterprise's pitch is the same feature set with full control over networking and data residency, in exchange for owning the infrastructure and a much larger contract. A bare self-hosted backend's pitch is no per-resource fee at all, in exchange for building policy enforcement, drift detection, and audit logging yourself - or buying it from a third party built specifically for that gap.
HCP Terraform (formerly Terraform Cloud) runs five pricing tiers as of 2026:
- Free - up to 500 managed resources, unlimited users, one policy set of up to five policies
- Essentials - $0.10/resource/month
- Standard - $0.47/resource/month
- Premium - $0.99/resource/month
- Enterprise - self-managed, custom pricing (this is Terraform Enterprise)
The legacy free tier - unlimited resources for small teams under the old user-based model - ended March 31, 2026. Existing organizations were automatically moved to the new 500-resource Free tier, which is a meaningfully smaller allowance for any team with real production infrastructure.
RUM pricing surprises most teams for the same reason: a single AWS security group with 9 rules can count as 10 resources in state, and Kubernetes-heavy workloads routinely run 3-5x higher actual resource counts than teams estimate from "50 EC2 instances" style back-of-envelope math. HashiCorp does exclude null_resource and terraform_data from the RUM count, but that's a small mercy against nested modules and for_each over long lists, which are the real source of resource sprawl. Check your module structure for accidental sprawl before estimating your tier.
Terraform Enterprise is Terraform Cloud's Business-tier feature set, self-hosted in your own network. Real contract pricing, per Vendr transaction data from 2026, ranges from roughly $15,000/year for small five-workspace installs, to an average contract value around $36,700/year, up to $300,000+/year for large-scale deployments.
Terraform Enterprise buys full network customization - VPC-level control, private networking, air-gapped installs - that HCP Terraform's managed SaaS environment cannot offer at any tier. That control comes with a real operational cost beyond the contract: you own upgrades, patching, and the infrastructure TFE itself runs on.
There's a dated deployment-method deadline that changes TFE ops in 2026: HashiCorp ended support for the Replicated installation method on April 1, 2026. Teams still on Replicated must migrate to Docker, Kubernetes, Podman, or Nomad. Existing air-gapped Replicated installs keep running until December 31, 2027, but no new installs or upgrades are possible on it.
If your organization is still running Terraform Enterprise on Replicated, this deadline is a real, dated migration item - not a someday task. Air-gapped environments get a longer runway, but every other install needs a concrete plan before upgrades stop working.
terraform {
backend "s3" {
bucket = "payments-terraform-state"
key = "prod/terraform.tfstate"
region = "ap-south-1"
dynamodb_table = "terraform-state-lock"
encrypt = true
}
}
A bare S3-plus-DynamoDB backend costs close to nothing and works fine for teams that don't need policy-as-code, drift detection, or run history built in. The gap it leaves is real: no approval workflow, no audit trail of who ran what, no automatic drift detection - all of which either gets built manually in CI, or bought from a third-party remote-ops platform designed specifically to fill that gap without HCP Terraform's per-resource pricing model.
Third-party remote-ops platforms - Spacelift, env0, Scalr - fill this gap with a different pricing meter entirely: per-run or per-seat pricing instead of RUM, which can be meaningfully cheaper for teams managing large resource counts but running Terraform infrequently.
Pricing Model and Ownership:
| Factor |
HCP Terraform |
Terraform Enterprise |
| Pricing model |
RUM - per resource, per hour |
Custom contract |
| Typical annual cost |
$0.10-$0.99/resource/month |
$15,000-$300,000+/year |
| Infrastructure ownership |
HashiCorp-hosted |
Self-hosted, your infra |
Pricing Model and Ownership, continued:
| Factor |
Self-hosted backend |
Best fit |
| Pricing model |
Storage cost only (or 3rd-party per-run) |
Small teams, cost-sensitive |
| Policy-as-code, drift detection |
Build yourself or buy separately |
Teams with existing CI investment |
| Network control |
Full - it's just your S3/DynamoDB |
Compliance-light environments |
For most teams under 500-1,000 managed resources, HCP Terraform's Free or Essentials tier is the lowest-friction option - no infrastructure to run, and the per-resource cost stays small at that scale. Audit your actual resource count before committing to a tier estimate; nested modules and for_each over long lists routinely produce 3-5x more resources than a rough headcount suggests.
For regulated environments needing air-gapped deployment, VPC-level network control, or strict data residency - common for Indian fintechs under RBI or SEBI data-localization requirements - Terraform Enterprise's self-hosted model is the only option among the three that satisfies those constraints directly. Budget for the operations team and infrastructure cost on top of the contract price, not just the licensing line item.
For teams with strong existing CI/CD investment and no near-term need for HCP Terraform's policy-as-code or drift detection, a bare S3/DynamoDB backend plus a third-party remote-ops platform (Spacelift, env0, Scalr) often beats both HashiCorp options on cost at scale, since per-run or per-seat pricing doesn't compound with resource count the way RUM does. This is the right call for teams whose resource count is growing faster than their run frequency - exactly the profile RUM pricing penalizes hardest.
INFORMATIONReferences and Further Reading
Discussion0