Warning signs include provider references that still point to the HashiCorp registry, inconsistent use of fully qualified module names, and stacks that do not validate cleanly after the engine switch. If teams cannot prove the code will download dependencies from the intended registry, the migration is not ready. Drift checks and post switch apply tests help expose those gaps.
What Manual Review Is Still Looking For After an OpenTofu Switch
An opentofu migration is not finished when the syntax changes compile. manual review is still needed where the configuration may behave differently at dependency resolution, module sourcing, provider lookup, or plan execution time. That is why teams should treat a clean engine switch as a checkpoint, not proof of equivalence, especially when the workspace pulls from external registries or relies on inherited assumptions about how modules are named and resolved. The NIST SP 800-53 Rev 5 Security and Privacy Controls is useful here because it reinforces the need to verify configuration integrity and controlled change before declaring the environment stable. In practice, many teams discover the remaining issues only after the first post-switch plan or apply has already exposed an unexpected dependency path.
How the Remaining Gaps Usually Show Up in Practice
The clearest sign is that the migration is technically parsable but not yet operationally trustworthy. A stack can validate, yet still pull a provider or module from a location the team did not intend, especially if references were copied forward from Terraform-era patterns. FQDN-style module naming, registry source strings, and version constraints need to be checked as a set, because each one affects how the tool resolves code and dependencies. If one piece is inconsistent, the migration may work in one environment and fail or drift in another.
Teams should also look at what happens after the switch, not just during parsing. Drift detection and apply testing reveal whether the new engine sees the same desired state the old engine did. Where those checks produce unexpected replacement actions, missing providers, or unresolved modules, the issue is usually not the engine itself but an assumption about source location, module identity, or state continuity. That is why a manual review is not simply a formatting exercise; it is a verification of dependency behavior and runtime intent.
- Check provider source addresses and confirm they resolve to the intended registry.
- Review module references for consistent fully qualified naming and version pinning.
- Run validation and compare the result with a representative plan in a safe environment.
- Inspect drift and post-switch apply output for surprises that indicate hidden coupling.
The guidance breaks down when a workspace depends on dynamic generation, nested wrappers, or cross-repository conventions that static validation cannot fully interpret.
When the Simple Checklist Is Not Enough
Tighter migration rules often increase review effort, so teams need to balance speed against confidence. The standard checks are usually sufficient for small, self-contained stacks, but they become less reliable when modules are shared widely, registry paths are customized, or multiple teams maintain the same codebase. In those cases, a migration can appear clean while still hiding a dependency mismatch or a source resolution problem.
Another common edge case is partial migration. A repository may mix updated OpenTofu references with older Terraform-oriented assumptions, and the result is a configuration that looks modern but still behaves inconsistently. Guidance versus consensus is important here: there is broad agreement that dependency resolution must be verified, but teams differ on how much manual inspection is enough before cutover. The practical answer is to treat any unresolved source mapping, unexpected provider path, or unexplained drift as a reason to pause rather than as an acceptable nuisance.
If the stack cannot prove that it will download dependencies from the intended registry and reproduce the same outcome in validation and apply, it still needs human review.
Risk and Threat Considerations
An incomplete OpenTofu migration creates configuration integrity and supply-chain exposure. The main risk is not just failure to deploy, but silent use of an unintended registry, module source, or provider path that changes what code is actually executed. That can produce drift, broken builds, or unplanned dependency trust on infrastructure the team did not mean to rely on.
Failure mechanism: Inconsistent source references, unresolved module naming, or weak validation can let the engine resolve dependencies differently than expected. If teams skip manual review, they may miss a path where the configuration still points at the wrong registry or behaves differently after state refresh, plan, or apply.
Impact: The environment may become non-reproducible, drift may go undetected, and a change that looked safe can introduce unstable deployment behavior or unintended dependency trust.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS 4 — Secure Configuration of Enterprise Assets and Software | Migration review is about trusted configuration and dependency resolution. |
| CIS 16 — Application Software Security | Infrastructure code should be validated for safe dependency handling and runtime behavior. | |
| Recommendation — Verify provider and module sources before cutover to prevent unintended dependency resolution. Test the migrated configuration in a controlled environment before production apply. | ||
| NIST CSF 2.0 | PR.DS — Data Security | Source integrity and controlled dependency use affect configuration trust and change safety. |
| PR.IP — Information Protection Processes and Procedures | Manual review is a change-control step for infrastructure code migrations. | |
| Recommendation — Validate that the stack resolves only approved sources before accepting the migration. Require post-switch validation and drift checks before declaring the migration complete. | ||
| MITRE ATT&CK | T1071 — Application Layer Protocol | Unexpected dependency lookups can hide in normal networked resolution paths. |
| Recommendation — Hunt for unexpected provider and module resolution paths during migration review. | ||
Practitioner Guidance
What to verify: Confirm that every provider and module resolves from the intended source, then compare validation output with a real plan and apply in a controlled environment. If any dependency path is ambiguous, treat the migration as incomplete rather than assuming the engine switch fixed it.
Common mistake: Teams often stop at successful syntax validation and miss the higher-value question of whether the resolved dependency graph is actually the one they expect. That shortcut is especially risky when a repository contains inherited module conventions or mixed-source references.
Practitioner takeaway: A clean OpenTofu conversion only proves the code is readable; manual review is still required until dependency resolution, validation, and post-switch behavior all line up.
Related resources from NHI Mgmt Group
- What breaks when certificate lifecycle management is still manual during PQC migration?
- What breaks when phishing reporting still depends on manual analyst review?
- What breaks when identity review is still manual in environments with many machine identities?
- How do teams know if manual review is still adding value?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 10, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
