Skip to content

Operations

This page covers how the image is secured, where your state lives, how to back it up and update it, and how to get help.

Security model

  • OpenTofu does not listen on any port and does not run as a service. You only need SSH (22/tcp), and only if you do not use Session Manager.
  • No credentials, state or workspace are baked into the image. First boot creates them.
  • /etc/opentofu/backend.env is root:root, mode 0600. The ubuntu user cannot read it.
  • Providers are installed only from the local mirror by default. Direct registry downloads are blocked.
  • Nothing runs tofu apply automatically. Every run is started by you.

Where your data lives

Path Contents
/var/lib/opentofu/workspace/ Your code, lock file and, with the local backend, terraform.tfstate
/etc/opentofu/backend.env Root-only credentials template

Backups

  • With the local backend, your state is on the root volume. Take EBS snapshots, or copy the workspace somewhere safe.
  • Treat state files as sensitive. They can contain secrets from your resources.
  • Moving state to a versioned S3 bucket is the most durable option. See Use an S3 backend.

Updates

  • Ubuntu unattended security updates are enabled.
  • OpenTofu and the AWS provider are pinned release files. They are not APT packages and are not updated by apt.
  • A new AMI version does not update running instances. To move to a new version, launch the new AMI, copy /var/lib/opentofu/workspace/ to it, and run init and plan before you switch over.

Check the installation

Print the version:

tofu version

Run the image self-test:

sudo /opt/sushi/bin/smoke.sh

It checks the files from first boot, confirms that ubuntu cannot read backend.env, and runs init, validate and plan on the example in /var/lib/opentofu/workspace. Run it before you replace the example files.

Service management

There is no long-running OpenTofu service. The only unit is the one-time first-boot service:

systemctl status sushi-opentofu-firstboot.service
sudo journalctl -u sushi-opentofu-firstboot.service --no-pager

Licenses

OpenTofu and terraform-provider-aws are MPL-2.0. License files, the OpenTofu source archive and a source notice are in /usr/share/doc/opentofu/. The provider source is available from the v6.67.0 tag on GitHub.

Support

Software Sushi provides AMI packaging and setup guidance. Email info@softwaresushi.com with the product version and the steps to reproduce your issue. Do not send credentials or state files. Support coverage requires a separate agreement, and OpenTofu project support is not included.