Comprehensive toolkit for generating best practice Terragrunt configurations (HCL files) following current standards and conventions. Use this skill when creating new Terragrunt resources (root configs, child modules, stacks, environment setups), or building multi-environment Terragrunt projects.
Comprehensive toolkit for generating best practice Terragrunt configurations (HCL files) following current standards and conventions. Use this skill when creating new Terragrunt resources (root configs, child modules, stacks, environment setups), or building multi-environment Terragrunt projects.
Terragrunt Generator
Overview
Generate production-ready Terragrunt configurations following current best practices, naming conventions, and security standards. All generated configurations are automatically validated.
Terragrunt 2025 Features Supported:
Stacks - Infrastructure blueprints with terragrunt.stack.hcl (GA since v0.78.0)
terragrunt stack generate # Generate unit configurations
terragrunt stack run plan # Plan all units
terragrunt stack run apply # Apply all units
terragrunt stack output # Get aggregated outputs
terragrunt stack clean # Clean generated directories
CRITICAL: Feature flag default values MUST be static (boolean, string, number).
They CANNOT reference local.* values. Use static defaults and override via CLI/env vars.
Correct:
feature "enable_monitoring" {
default = false # Static value - OK
}
Production Recommendation: For critical production resources, add exclude blocks to prevent accidental destruction:
# Protect production databases from accidental destroy
exclude {
if = true
actions = ["destroy"]
exclude_dependencies = false
}
# Also use prevent_destroy for critical resources
prevent_destroy = true
Re-validate (repeat until ALL errors are resolved)
If validation succeeds: Present configurations with usage instructions
Skip validation only for: Partial snippets, documentation examples, or explicit user request
Presentation Requirements
MANDATORY: After successful validation, you MUST present ALL of the following sections. Incomplete presentation is not acceptable. Copy and fill in the templates below.
1. Directory Structure Summary (MANDATORY)
# Show the generated structure
tree <infrastructure-directory>
2. Files Generated (MANDATORY)
Output this table with all generated files:
| File | Purpose |
|------|---------|
| root.hcl | Shared configuration for all child modules (state backend, provider) |
| dev/env.hcl | Development environment variables |
| prod/env.hcl | Production environment variables |
| dev/vpc/terragrunt.hcl | VPC module for development |
| ... | ... |
3. Usage Instructions (MANDATORY)
You MUST include this section. Copy the template below and fill in the actual values:
## Usage Instructions### Prerequisites
Before running Terragrunt commands, ensure:
1. AWS credentials are configured (`aws configure` or environment variables)
2. S3 bucket `<BUCKET_NAME>` exists for state storage
3. DynamoDB table `<TABLE_NAME>` exists for state locking
### Commands# Navigate to infrastructure directory
cd <INFRASTRUCTURE_DIR># Initialize all modules
terragrunt run --all init
# Preview changes for a specific environment
cd <ENV>/vpc && terragrunt plan
# Preview all changes
terragrunt run --all plan
# Apply changes (requires approval)
terragrunt run --all apply
# Destroy (use with extreme caution)
terragrunt run --all destroy
4. Environment-Specific Notes (MANDATORY)
You MUST include this section. Copy the template below and fill in the actual values:
## Environment Notes### Required Environment Variables
| Variable | Description | Example |
|----------|-------------|---------|
| AWS_PROFILE | AWS CLI profile to use | `my-profile` |
| AWS_REGION | AWS region (or set in provider) | `us-east-1` |
### Prerequisites- [ ] S3 bucket `<BUCKET_NAME>` must exist before first run
- [ ] DynamoDB table `<TABLE_NAME>` must exist for state locking
- [ ] IAM permissions for Terraform state management
### Production-Specific Protections
| Module | Protection | Description |
|--------|------------|-------------|
| prod/rds | `prevent_destroy = true` | Prevents accidental database deletion |
| prod/rds | `exclude { actions = ["destroy"] }` | Blocks destroy commands |
5. Next Steps (Optional)
Suggest what the user might want to do next (add more modules, customize configurations, etc.)
Best Practices
Reference ../devops-skills:terragrunt-validator/references/best_practices.md for comprehensive guidelines.
Key principles:
Use include blocks to inherit root configuration (DRY)
Always provide mock outputs for dependencies
Enable state encryption (encrypt = true)
Use generate blocks for provider configuration
Specify bounded version constraints (~> 5.0, not >= 5.0) for local/Git modules
Never hardcode credentials or secrets
Configure retry logic for transient errors
Note on Version Constraints with Registry Modules: When using Terraform Registry modules (e.g., tfr:///terraform-aws-modules/vpc/aws?version=5.1.0), they typically define their own required_providers. In this case, you may omit generating required_providers in root.hcl to avoid conflicts. The module's pinned version (?version=X.X.X) provides the version constraint. See "Common Issues → Provider Conflict with Registry Modules" for details.
Anti-patterns to avoid:
Hardcoded account IDs, regions, or environment names
Missing mock outputs for dependencies
Duplicated configuration across modules
Unencrypted state storage
Missing or loose version constraints (except when using registry modules that define their own)
Root.hcl trying to read env.hcl that doesn't exist at root level
Error: Attempt to get attribute from null value
on ./root.hcl line X:
This value is null, so it does not have any attributes.
Cause: Root.hcl is trying to read env.hcl via find_in_parent_folders("env.hcl"), but env.hcl doesn't exist at the root level.
Solution: Make root.hcl environment-agnostic:
# DON'T do this in root.hcl for multi-environment setups:
locals {
env_vars = read_terragrunt_config(find_in_parent_folders("env.hcl")) # FAILS
}
# DO use static values or get_env():
generate "provider" {
path = "provider.tf"
if_exists = "overwrite_terragrunt"
contents = <<EOF
provider "aws" {
region = "us-east-1" # Static value, or use get_env("AWS_REGION", "us-east-1")
}
EOF
}
Provider Conflict with Registry Modules
When using Terraform Registry modules (e.g., tfr:///terraform-aws-modules/vpc/aws), they may define their own required_providers block. This can conflict with provider configuration generated by root.hcl.
Symptoms:
Error: Duplicate required providers configuration
Solutions:
Remove conflicting generate block - If using registry modules that manage their own providers, avoid generating duplicate required_providers:
# In root.hcl - only generate provider config, not required_providers
generate "provider" {
path = "provider.tf"
if_exists = "overwrite_terragrunt"
contents = <<EOF
provider "aws" {
region = "us-east-1"
}
EOF
}
Use if_exists = "skip" - Skip generation if file already exists:
If you see Unknown variable; There is no variable named "local" in feature blocks, ensure defaults are static values (see Feature Flags section above).
Child Module Cannot Find env.hcl
Symptom:
Error: Attempt to get attribute from null value
on ./dev/vpc/terragrunt.hcl line X:
