OpenTofu 1.12: Dynamic `prevent_destroy` Solves Decade-Old Terraform Pain Point

The OpenTofu community recently announced the release of version 1.12.0, a significant update that brings several long-requested features to the infrastructure-as-code tool. Among the most impactful additions is the implementation of dynamic `prevent_destroy`, a capability that allows the `prevent_destroy` lifecycle meta-argument to be driven by variables. This seemingly minor change resolves a major pain point for DevOps and platform engineering teams that has persisted in Terraform for nearly a decade. Previously, Terraform's `prevent_destroy` argument could only accept a hard-coded boolean value. While this worked for single-environment setups, it created considerable challenges for organizations utilizing shared modules across various environments, such as development, staging, and production. Teams were often forced to duplicate module code or accept that resources in development environments might be accidentally protected from deletion, hindering agile development. The inability to dynamically control this setting led to workarounds like environment-specific module directories or entirely foregoing the protection, increasing the risk of accidental infrastructure loss. OpenTofu 1.12 now allows `prevent_destroy` to reference any expression within the same module scope. This means a production workspace can set `is_production = true` to enable deletion protection, while a development workspace can leave it `false`, all while using the same module. This enhancement streamlines module management, reduces configuration drift, and improves overall operational efficiency for teams deploying infrastructure across diverse environments. Beyond dynamic `prevent_destroy`, OpenTofu 1.12 introduces other notable improvements. The `tofu init` command now unifies provider checksum handling, populating both `zh:` and `h1:` hashes in a single pass. A new `-json-into=FILENAME` flag has been added, enabling machine-readable JSON output to be written to a file while maintaining human-readable terminal output. Furthermore, a new `destroy = false` meta-argument provides a declarative way to remove a resource from the state file without actually destroying the underlying object, offering a cleaner alternative to previous `terraform state rm` workarounds. On the deprecation front, OpenTofu 1.12 begins phasing out WinRM provisioner support, with warnings issued in this release and full removal planned for version 1.13. Users still relying on WinRM for provisioners are advised to migrate to OpenSSH for Windows. This release underscores OpenTofu's commitment to independent development, addressing community needs and diverging from Terraform's roadmap to deliver features that enhance infrastructure management and security.