Install & the terragrunt.hcl model

Wrapping a Terraform module.

Advanced12 min · lesson 2 of 12

Terragrunt is a single binary you install alongside Terraform (or OpenTofu); it invokes whichever binary you point it at. The unit of work is a terragrunt.hcl file in a directory — the wrapper for one Terraform module. At its simplest, a terragrunt.hcl declares a source (the Terraform module to run) and the inputs to pass it, and running terragrunt behaves like running terraform in that generated module.

terminal
$ terragrunt --version
terragrunt version v0.58.x
$ terraform --version # (or tofu) — Terragrunt calls this under the hood
Terraform v1.9.x
$ cd live/prod/vpc
$ terragrunt plan # behaves like terraform plan, with Terragrunt’s glue applied
live/prod/vpc/terragrunt.hcl
terraform {
source = "git::git@github.com:acme/modules.git//vpc?ref=v1.4.0"
}
inputs = {
cidr_block = "10.20.0.0/16"
environment = "prod"
}

source and the module cache

The source can be a local path or a remote module reference pinned to a version (a Git ref, a registry version). Terragrunt downloads it into a local .terragrunt-cache and runs Terraform there, injecting the generated backend and inputs. Pinning the source ref is essential — it is exactly the module-versioning discipline from Terraform, and it makes each unit reproducible.

Pin the module source ref
A source without a pinned ?ref (or with a moving branch) pulls whatever the module repo serves now, so a plan can change without your config changing. Always pin the module to a tag or commit SHA in source; unpinned modules are the same reproducibility and supply-chain risk as unpinned dependencies anywhere else.