run-all across many units

Apply a whole environment.

Advanced12 min · lesson 8 of 12

run-all is Terragrunt’s orchestration command: terragrunt run-all plan (or apply) executes the command across every unit under the current directory, in the dependency order Terragrunt computed from the dependency blocks. Point it at live/prod and it plans or applies the whole environment — vpc, then database, then app — in one command, respecting the graph. It is what makes many small units manageable as a unit.

RUN-ALL IN DEPENDENCY ORDER

1run-all at live/prod

plan or apply the whole environment

2Group 1: vpc

no dependencies, runs first

3Group 2: database, cache

after vpc, in parallel

4Group 3: app

after its dependencies

run-all executes across every unit under the directory in the order Terragrunt computes from dependency blocks.

terminal

$ cd live/prod
$ terragrunt run-all plan       # plan every unit, in dependency order
$ terragrunt run-all apply      # apply the whole environment
Group 1: [vpc]
Group 2: [database, cache]       # applied after vpc, in parallel with each other
Group 3: [app]                   # after its dependencies

Power and its caveats

run-all is powerful and, therefore, dangerous: run-all apply changes many units at once, and run-all destroy can tear down a whole environment. Terragrunt runs independent units in parallel for speed, which also means output interleaves. Use --terragrunt-include-dir / exclude to scope a run, always run-all plan and read it before run-all apply, and treat run-all destroy with extreme care behind confirmations.

terminal

$ terragrunt run-all plan --terragrunt-include-dir "app"   # scope the run
$ terragrunt run-all apply --terragrunt-non-interactive    # (CI) — only after a reviewed plan

run-all apply/destroy has environment-wide blast radius

A single run-all apply can change every unit in the tree, and run-all destroy can delete an entire environment including stateful resources. Always run-all plan first and review the aggregate, scope runs with include/exclude, gate run-all apply behind CI approval, and guard destroy heavily. The convenience of one command is exactly the risk — respect the blast radius.

Dependencies & outputsMulti-account & multi-region…