Plan infrastructure changes from a clean, pinned runner. OpenTofu 1.13.1 on Ubuntu 24.04 with a local AWS provider mirror, so tofu init works fast and repeatably. It validates and plans on demand and never applies on its own.
Run OpenTofu from a clean, repeatable runner in your account. This image installs OpenTofu 1.13.1 with a pinned mirror of the hashicorp/aws provider, an example workspace and a tofu wrapper, and it never applies changes automatically.
Launch the approved version on t3.medium with at least 16 GiB encrypted root storage and at least 4 GiB RAM. Connect with AWS Systems Manager as ubuntu or restrict SSH to your administrative CIDR. First boot writes a localhost workspace; nothing sensitive is baked into the image. OpenTofu does not listen on a TCP port, does not run a daemon, and does not apply infrastructure changes automatically. You start every validate and plan. Keep credentials out of recordings and tickets.
The standard software fee is described in the AWS Marketplace offer terms. EC2, EBS and data-transfer charges are billed separately. See the offer terms for applicable billing promotions.
After launch, wait for cloud-init to finish, then follow the bundled README for configuration, backup and day-2 operations. IAM is optional until you point the workspace at your own AWS resources.
Reach it from other machines: OpenTofu is a command-line tool with no inbound service, so there is nothing to open to other hosts. Give the instance an IAM role for the AWS accounts it should plan against.
This is a repackaged open source software product wherein additional charges apply for independent AWS packaging, validation, maintenance and setup documentation. The OpenTofu project publishes OpenTofu under MPL-2.0, and HashiCorp publishes terraform-provider-aws under MPL-2.0; Software Sushi supplies the AMI recipe, digest-pinned linux/amd64 binaries, a first-boot localhost workspace, and setup documentation without claiming upstream endorsement.
Highlights
Pinned OpenTofu 1.13.1 and terraform-provider-aws with provenance receipts.
User-started validate and plan on a localhost workspace. No automatic apply.
Bundled configuration, backup and day-2 operations documentation.
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Try this product free for 5 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
This listing uses one usage-based pricing dimension billed hourly on a t3.medium instance. You pay the hourly software fee for each running instance, with no upfront commitment or tiers to choose from. The fee covers the packaged software only. Amazon EC2, EBS storage, and data transfer are billed separately by AWS. The t3.medium size provides 2 vCPU and 4 GiB RAM, which the documentation recommends as a workable baseline. Charges stop when you stop or terminate the instance, so cost scales with how long each instance runs.
Top-of-mind questions for buyers
What do I actually get for the t3.medium hourly rate?
You get a running EC2 instance sized at 2 vCPU and 4 GiB RAM. It runs Ubuntu 24.04 with the packaged software, a pinned CLI, and an offline provider mirror for validate and plan runs. Each running instance bills one hourly software fee.
Am I charged when the instance is stopped?
The hourly software fee applies only while the instance runs. Stopping or terminating the instance stops the software charge. The software does not run as a daemon or listen on any port, so there is no background metering. Stored EBS volumes may still incur separate AWS storage charges.
What costs are separate from the hourly software fee?
The fee covers the packaged software only. Amazon EC2 compute, EBS storage, and data transfer are billed separately by AWS. The documentation recommends at least a 16 GiB encrypted gp3 root volume, which adds storage cost. Review the current listing terms before subscribing.
docs.softwaresushi.com
Helpful?
Vendor refund policy
We offer a full refund of software charges for the first 48 hours billing starts if the product does not perform as described. To request a refund, email info@softwaresushi.com with your EC2 instance ID and a description of the issue. AWS infrastructure costs (EC2, EBS, data transfer) are not eligible for refund by us.
How can we make this page better?
Tell us how we can improve this page, or report an issue with this product.
Give us feedbackReport a problem with this product or seller
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA).
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
OpenTofu 1.13.1 on Ubuntu 24.04 LTS for t3.medium. Includes the pinned CLI, a pinned AWS provider filesystem mirror, and a localhost workspace for user-started validate and plan. No daemon and no automatic apply. Connect with Session Manager as ubuntu and run bash /opt/sushi/docs/demo.sh after first boot.
Additional details
Usage instructions
Launch t3.medium (16 GiB or larger encrypted gp3, IMDSv2) with an instance profile that has AmazonSSMManagedInstanceCore and outbound HTTPS. No inbound rules are needed. Copy-paste launch kit (role, security group, run-instances, CloudFormation): https://docs.softwaresushi.com/launch-kit/
Connect: aws ssm start-session --target <instance-id>. After cloud-init finishes, run: sudo -iu ubuntu bash /opt/sushi/docs/demo.sh (expect a final line ending in DEMO_PASSED).
Use it: As ubuntu: tofu -chdir=/var/lib/opentofu/workspace init -input=false, then validate and plan. Put your own .tf files in /var/lib/opentofu/workspace.
Secrets and access: No passwords and no listening service. Use an IAM role attached to the instance for AWS credentials, and see /etc/opentofu/backend.env for the commented backend template.
Reach it from another host: OpenTofu is a command-line tool with no network service, so there is nothing to open. Use Session Manager, or SSH from your own CIDR if you prefer.
Guide: https://docs.softwaresushi.com/opentofu/ . Support: info@softwaresushi.com
Software Sushi provides AMI packaging and setup guidance. Contact info@softwaresushi.com for installation questions. Support coverage requires a separate agreement. This offer does not include OpenTofu project support.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Build stateful workflows with LangGraph OSS, SQLite checkpoints and a human-approval API on Ubuntu 24.04. This is paid repackaged open-source software.
Give partners a secure place to drop files without giving them a shell. A private SFTP server on Ubuntu 24.04 with key-only logins, chrooted users and one writable incoming folder. A ready transfer user lets you upload your first file within minutes.
Be the first to review this product. We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.