Terragrunt CLI
Terragrunt organizes OpenTofu and Terraform configurations into units with shared inputs, dependencies and ordered execution.
- 9,913 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- Infrastructure execution can create, modify and destroy cloud resources with provider-account permissions.
Install
Manual install
Use the official installation guide linked by the README. Verify engine, environment and dependencies, starting with configuration review and planning.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Infrastructure execution can create, modify and destroy cloud resources with provider-account permissions.
This is third-party code. Review the repository files before installing.
What it does
In `terragrunt.hcl`, engineers connect modules to environments through sources, inputs and dependencies. Reuse an OpenTofu or Terraform module without copying the same settings across units. Terragrunt runs units in dependency order and passes outputs to dependent configurations. Engineers review the plan and decide separately whether to apply it. Infrastructure engines and providers remain external components; their credentials determine which real resources can be affected.
Who it is for. Infrastructure teams reusing OpenTofu or Terraform modules across environments and managing dependencies.
Good fit when
- Reuse one module in test and production environments with different inputs.
- Pass one unit’s outputs to another unit’s inputs.
- Review a multi-unit plan in dependency order before making changes.
- Keep execution rules beside infrastructure code for Git review.
Not a fit when
- The process cannot be trusted with live cloud access.
- Changes would apply without environment and plan approval.
- You need to replace rather than orchestrate OpenTofu or Terraform.
Example request
Inspect Terragrunt unit dependencies and propose a staging validation plan without applying infrastructure changes.Limitations
Terragrunt invokes a separately installed OpenTofu or Terraform with compatible providers. Before the source unit’s first apply, its outputs do not exist; engineers must explicitly supply mock values for a preliminary plan. Apply and destroy change real resources and state, so verify the account and environment before running them. Installation methods and dependencies vary by operating system; prepare them using the guide for your platform.
How to disable. Stop runs and disable related CI jobs. Uninstalling the CLI does not remove resources or undo state changes.
FAQ
Is Terraform no longer needed?
You still need OpenTofu or Terraform. Terragrunt invokes it with the prepared configuration.
Where are environment inputs defined?
In `terragrunt.hcl` inputs, which are passed to the module.
How does one unit consume another?
Set config_path in a `dependency` block to point to the source configuration. Read its values as dependency.<name>.outputs.<output>.
Why are values missing before the first apply?
The source unit has not produced outputs yet. Define mock_outputs in its dependency block and add `mock_outputs_allowed_terraform_commands = ["plan"]` there to allow those test values only during planning.
Does planning automatically apply changes?
Application is separate. Engineers decide whether to execute changes after reviewing the plan.
Discussion
No questions or reviews yet.
Related
CLI toolsTerraform Skill
Terraform & OpenTofu Skill for AI Agents
A Terraform and OpenTofu best-practices skill: tests, modules, state, CI/CD and security scanning for AWS, Azure and GCP
A Rust MCP server for Terraform: the agent inspects a project, builds a saved plan, reviews its risks and applies that same plan
A Terraform skill for Claude Code, Codex, Antigravity and Gemini CLI: cuts hallucinations and keeps code on HashiCorp's official practices
With modulestf, the agent reviews and maintains Terraform modules, seeking separate approval before posting findings to GitHub.
HashiCorp's official MCP server for the Terraform Registry and HCP Terraform: providers, modules, policies and workspaces
31 DevOps skills for Claude Code and Codex: config generators, validators and a Kubernetes debugger for Terraform, Helm, CI and Docker
README in short
Terragrunt copies downloaded modules into .terragrunt-cache and runs them there. If a module creates local files, set an explicit output directory or they may end up in the cache.