OpenTofu relies on plugins called "providers" in order to manage various types of resources. (For more information about providers, see Providers in the OpenTofu language docs.)
Providers are the only plugin type most OpenTofu users interact with. OpenTofu also supports third-party provisioner plugins, but we discourage their use.
OpenTofu downloads and/or installs any providers required by a configuration when initializing a working directory. By default, this works without any additional interaction but requires network access to download providers from their source registry.
You can configure OpenTofu's provider installation behavior to limit or skip network access, and to enable use of providers that aren't available via a networked source. OpenTofu also includes some commands to show information about providers and to reduce the effort of installing providers in airgapped environments.
Configuring Plugin Installation
OpenTofu's configuration file includes options for caching downloaded plugins, or explicitly specifying a local or HTTPS mirror to install plugins from. For more information, see CLI Config File.
Getting Plugin Information
tofu providers command to get information
about the providers required by the current working directory's configuration.
tofu version command (or
tofu -version) to show the specific provider versions installed for the
current working directory.
tofu providers schema command to
get machine-readable information about the resources and configuration options
offered by each provider.
Managing Plugin Installation
tofu providers mirror command to
download local copies of every provider required by the current working
directory's configuration. This directory will use the nested directory layout
that OpenTofu expects when installing plugins from a local source, so you can
transfer it directly to an airgapped system that runs OpenTofu.
tofu providers lock command
to update the lock file that OpenTofu uses to ensure predictable runs when
using ambiguous provider version constraints.