PF-04 · AWS · Terragrunt
AWS Terragrunt DRY IaC
Sixteen Terraform modules behind one root config, with Terragrunt running them in order from their dependency graph.
- 16
- Terraform modules and units
- 1
- Root config replacing 16 copies
- -40%
- Deployment time (production result)
- Problem
-
Each Terraform root repeated its backend and provider blocks, and the order between roots lived in people's heads.
- Approach
-
Modules stay plain Terraform and Terragrunt wraps them. The backend, provider, and common inputs are generated once from live/root.hcl. _envcommon holds module sources and dependencies, and each unit states only its inputs. dependency blocks build the graph, and mock_outputs let the whole stack validate without a cloud account.
- Result
-
This repository groups 16 modules and 16 units into four dependency levels and validates them without cloud credentials. The 40% shorter deployment time came from moving a live production estate to this pattern.
- What I learned
-
The key point was that Terragrunt does not replace Terraform; it decides where code lives. Modules stay plain Terraform while the backend, provider, and common inputs are generated from one root, so a structure that copied the same settings 16 times became one where a single edit reaches everything. Writing run order as dependency blocks moves it from people's memory into a graph, and mock_outputs let the whole stack validate without cloud credentials. The demo keeps state local, but where several people share an environment, where state lives has to be settled first, and I now treat that as part of the design from day one.