--- title: "Managing Terraform at Scale with Terragrunt" lang: "en" author: "Mohammad Abu Mattar" canonical: https://mkabumattar.com/post/terraform-terragrunt-wrappers --- ![Blog post image for Managing Terraform at Scale with Terragrunt - How Terragrunt wraps Terraform to remove duplicated backend and provider config across dev, staging, and production: defining shared settings once, overriding per environment, and letting Terragrunt handle state and module dependencies.](/_astro/hero.DUZZoi07_2sLht2.webp) [Home](/)›[Devtips](/devtips)›[All Categories](/devtips/categories)›[Cloud & Infrastructure Automation](/devtips/categories/cloud--infrastructure-automation) Devtips [Prev in Cloud & Infrastructure AutomationOrganizing Terraform with Modules](/devtips/post/organizing-terraform-modules)[Next in Cloud & Infrastructure AutomationTerraform Workspaces vs. Directory-Based Environments: What Actually Scales](/devtips/post/terraform-workspaces-vs-directory-environments) [Cloud & Infrastructure Automation](/devtips/categories/cloud--infrastructure-automation) # Managing Terraform at Scale with Terragrunt [Mohammad Abu Mattar](/authors/mohammad-abu-mattar)Published: 21 Dec 202503 Mins read04 Mins listen [Markdown for AI(opens in a new tab)](/post/terraform-terragrunt-wrappers/index.md "Open the plain-Markdown version of this page, for pasting into an AI tool") TL;DR How Terragrunt wraps Terraform to remove duplicated backend and provider config across dev, staging, and production: defining shared settings once, overriding per environment, and letting Terragrunt handle state and module dependencies. Series [Mastering Terraform](/series/mastering-terraform)3/4 [PreviousHashiCorp Pulls the Plug on CDKTF](/devtips/post/cdktf-deprecation-hashicorp-terraform)[NextTerraform Workspaces vs. Directory-Based Environments: What Actually Scales](/devtips/post/terraform-workspaces-vs-directory-environments) All posts in this series (4) DevTips4 1. [Organizing Terraform with Modules](/devtips/post/organizing-terraform-modules) 2. [HashiCorp Pulls the Plug on CDKTF](/devtips/post/cdktf-deprecation-hashicorp-terraform) 3. [Managing Terraform at Scale with TerragruntYou are here](/devtips/post/terraform-terragrunt-wrappers) 4. [Terraform Workspaces vs. Directory-Based Environments: What Actually Scales](/devtips/post/terraform-workspaces-vs-directory-environments) ### Managing Terraform at Scale with Terragrunt Contents [The problem with Terraform at scale](#the-problem-with-terraform-at-scale)[Duplicated code across environments](#duplicated-code-across-environments)[Maintenance overhead](#maintenance-overhead)[Why Terraform gets messy](#why-terraform-gets-messy)[Repetitive configuration](#repetitive-configuration)[Environment-specific boilerplate](#environment-specific-boilerplate)[State management](#state-management)[The fix: the Terragrunt wrapper](#the-fix-the-terragrunt-wrapper)[How Terragrunt works](#how-terragrunt-works)[Configuration inheritance](#configuration-inheritance)[Environment-specific overrides](#environment-specific-overrides)[What it looks like in practice](#what-it-looks-like-in-practice)[What Terragrunt gives you](#what-terragrunt-gives-you)[DRY infrastructure code](#dry-infrastructure-code)[State management you don't write](#state-management-you-dont-write)[Consistent configuration](#consistent-configuration)[Why Terragrunt matters for teams](#why-terragrunt-matters-for-teams)[Scaling past a few environments](#scaling-past-a-few-environments)[Productivity](#productivity)[Less to hold in your head](#less-to-hold-in-your-head)[What's your Terraform strategy?](#whats-your-terraform-strategy)[Community approaches](#community-approaches)[Alternative tools](#alternative-tools) ## [The problem with Terraform at scale](#the-problem-with-terraform-at-scale) ### [Duplicated code across environments](#duplicated-code-across-environments) If you’re managing infrastructure with Terraform across several environments or projects, you’ve probably hit the point where every new environment is a copy of the last one. That’s what wrappers like Terragrunt exist for: they keep the shared parts in one file. ### [Maintenance overhead](#maintenance-overhead) With plain Terraform, a change to the backend block is a change in every environment directory. Miss one and that environment quietly runs on the old settings until someone notices the state file in the wrong bucket. ## [Why Terraform gets messy](#why-terraform-gets-messy) ### [Repetitive configuration](#repetitive-configuration) Plain Terraform is fine for one environment. Once you’re running dev, staging and production, you’re duplicating backend configuration, provider settings and variable files across directories. Every update means the same edit three times, and the third one is the one you forget. ### [Environment-specific boilerplate](#environment-specific-boilerplate) Each environment needs almost the same configuration with two values changed. That “almost” is where copy-paste errors live, because a diff of two 40-line files is not something you read carefully at 5 PM. ### [State management](#state-management) Every environment needs its own state file, its own lock table and its own key prefix. Setting that up by hand for each one is both tedious and the sort of thing that goes wrong silently. ## [The fix: the Terragrunt wrapper](#the-fix-the-terragrunt-wrapper) ### [How Terragrunt works](#how-terragrunt-works) Terragrunt is a thin wrapper around Terraform that fills in the parts Terraform leaves to you. You define your backend config, provider settings and common variables once, and each environment inherits them. Your Terraform modules stay generic, and Terragrunt supplies the environment-specific values. ### [Configuration inheritance](#configuration-inheritance) The root `terragrunt.hcl` holds the shared settings. Each child config points at it with an `include` block, so the backend and provider definitions exist in exactly one file. ### [Environment-specific overrides](#environment-specific-overrides) A child config adds only what differs: instance sizes, CIDR ranges, replica counts. The module never learns which environment it is running in, which is what makes it safe to reuse. ### [What it looks like in practice](#what-it-looks-like-in-practice) Instead of duplicating the backend config in every environment, you define it once in the root `terragrunt.hcl` and let Terragrunt generate the per-environment state key from the directory path. ## [What Terragrunt gives you](#what-terragrunt-gives-you) ### [DRY infrastructure code](#dry-infrastructure-code) - Use Terragrunt to remove duplicate code across environments. - Define backend and provider configs once, reuse everywhere. - Keep your Terraform modules generic and environment-agnostic. - Let Terragrunt handle state management and dependencies between modules. ### [State management you don’t write](#state-management-you-dont-write) Terragrunt derives each state key from the directory structure and creates the backend if it doesn’t exist, so a new environment is a new folder rather than a checklist. ### [Consistent configuration](#consistent-configuration) Every environment starts from the same base, and the differences are the handful of values you wrote down on purpose. ## [Why Terragrunt matters for teams](#why-terragrunt-matters-for-teams) ### [Scaling past a few environments](#scaling-past-a-few-environments) Terragrunt keeps a Terraform repo readable as it grows. Less time copying files, more time on the infrastructure itself. It does add a tool and a config language to learn, and that cost is real, though it’s paid once rather than per environment. ### [Productivity](#productivity) An update lands in one file and applies everywhere, so the “did we update staging too?” conversation stops happening. ### [Less to hold in your head](#less-to-hold-in-your-head) There’s less code between a new hire and their first change, and most of what’s left is the part that actually describes your infrastructure. ## [What’s your Terraform strategy?](#whats-your-terraform-strategy) ### [Community approaches](#community-approaches) Do you use Terragrunt or another wrapper for Terraform? How do you keep your infrastructure code clean across environments? ### [Alternative tools](#alternative-tools) Terragrunt, Terraspace and hand-rolled wrapper scripts all solve this, and the shell script is genuinely the right call for some teams. I’d like to know which one you kept. Was this useful? ## Tags [#Terraform](/devtips/tags/terraform)[#Terragrunt](/devtips/tags/terragrunt)[#Infrastructure as Code](/devtips/tags/infrastructure-as-code)[#DevOps](/devtips/tags/devops)[#IaC](/devtips/tags/iac)[#Cloud Automation](/devtips/tags/cloud-automation)[#DRY Principle](/devtips/tags/dry-principle) ## Share [Facebook](https://facebook.com/sharer/sharer.php?u=https%3A%2F%2Fmkabumattar.com%2Fdevtips%2Fpost%2Fterraform-terragrunt-wrappers "Share on Facebook")[Twitter](https://twitter.com/intent/tweet/?text=Managing%20Terraform%20at%20Scale%20with%20Terragrunt&url=https%3A%2F%2Fmkabumattar.com%2Fdevtips%2Fpost%2Fterraform-terragrunt-wrappers "Share on Twitter")[LinkedIn](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fmkabumattar.com%2Fdevtips%2Fpost%2Fterraform-terragrunt-wrappers&title=Managing%20Terraform%20at%20Scale%20with%20Terragrunt&summary=How%20Terragrunt%20wraps%20Terraform%20to%20remove%20duplicated%20backend%20and%20provider%20config%20across%20dev%2C%20staging%2C%20and%20production%3A%20defining%20shared%20settings%20once%2C%20overriding%20per%20environment%2C%20and%20letting%20Terragrunt%20handle%20state%20and%20module%20dependencies.&source=https://mkabumattar.com "Share on LinkedIn")[WhatsApp](https://wa.me/?text=Managing%20Terraform%20at%20Scale%20with%20Terragrunt%20https%3A%2F%2Fmkabumattar.com%2Fdevtips%2Fpost%2Fterraform-terragrunt-wrappers "Share on WhatsApp")[Telegram](https://t.me/share/url?url=https%3A%2F%2Fmkabumattar.com%2Fdevtips%2Fpost%2Fterraform-terragrunt-wrappers&text=Managing%20Terraform%20at%20Scale%20with%20Terragrunt "Share on Telegram")[Reddit](https://www.reddit.com/submit?url=https%3A%2F%2Fmkabumattar.com%2Fdevtips%2Fpost%2Fterraform-terragrunt-wrappers&title=Managing%20Terraform%20at%20Scale%20with%20Terragrunt "Share on Reddit")[Hacker News](http://news.ycombinator.com/submitlink?u=https%3A%2F%2Fmkabumattar.com%2Fdevtips%2Fpost%2Fterraform-terragrunt-wrappers&t=Managing%20Terraform%20at%20Scale%20with%20Terragrunt "Share on Hacker News")[Pinterest](https://pinterest.com/pin/create/button/?url=https%3A%2F%2Fmkabumattar.com%2Fdevtips%2Fpost%2Fterraform-terragrunt-wrappers&media=&description=How%20Terragrunt%20wraps%20Terraform%20to%20remove%20duplicated%20backend%20and%20provider%20config%20across%20dev%2C%20staging%2C%20and%20production%3A%20defining%20shared%20settings%20once%2C%20overriding%20per%20environment%2C%20and%20letting%20Terragrunt%20handle%20state%20and%20module%20dependencies. "Share on Pinterest")[Email]() ## Comments ## You might also enjoy More posts on similar topics [![Organizing Terraform with Modules](/_astro/hero.5dVJEd3X_Z16rLJ8.webp)](/devtips/post/organizing-terraform-modules) ## [Organizing Terraform with Modules](/devtips/post/organizing-terraform-modules) - [Mohammad Abu Mattar](/authors/mohammad-abu-mattar) - [Cloud & Infrastructure Automation](/devtips/categories/cloud--infrastructure-automation) Why organize your Terraform code? Where the complexity comes from If you're using Terraform to build out your infrastructure, you know how quickly things get complicated. Every new environmen [#Terraform](/devtips/tags/terraform)[#Infrastructure as Code](/devtips/tags/infrastructure-as-code)[#Modules](/devtips/tags/modules)+4 tags [read more](/devtips/post/organizing-terraform-modules) [![HashiCorp Pulls the Plug on CDKTF](/_astro/hero.BBIsBB2t_Z22hNwP.webp)](/devtips/post/cdktf-deprecation-hashicorp-terraform) ## [HashiCorp Pulls the Plug on CDKTF](/devtips/post/cdktf-deprecation-hashicorp-terraform) - [Mohammad Abu Mattar](/authors/mohammad-abu-mattar) - [Cloud & Infrastructure Automation](/devtips/categories/cloud--infrastructure-automation) CDKTF is officially deprecated The deprecation announcement Well, it finally happened. HashiCorp (now owned by IBM) officially deprecated the Cloud Development Kit for Terraform (CDKTF) [#Terraform](/devtips/tags/terraform)[#CDKTF](/devtips/tags/cdktf)[#HashiCorp](/devtips/tags/hashicorp)+6 tags [read more](/devtips/post/cdktf-deprecation-hashicorp-terraform) [![Terraform Workspaces vs. Directory-Based Environments: What Actually Scales](/_astro/hero.utyGomxG_Z2cpb8C.webp)](/devtips/post/terraform-workspaces-vs-directory-environments) ## [Terraform Workspaces vs. Directory-Based Environments: What Actually Scales](/devtips/post/terraform-workspaces-vs-directory-environments) - [Mohammad Abu Mattar](/authors/mohammad-abu-mattar) - [Cloud & Infrastructure Automation](/devtips/categories/cloud--infrastructure-automation) Why this choice matters Hey, want to stop sweating every prod apply? The way you split dev, staging, and prod in Terraform decides how much damage a single mistake can do. Get it right and a [#Terraform](/devtips/tags/terraform)[#Workspaces](/devtips/tags/workspaces)[#Environments](/devtips/tags/environments)+3 tags [read more](/devtips/post/terraform-workspaces-vs-directory-environments) [![Understanding Kubernetes Services: ClusterIP vs NodePort vs LoadBalancer](/_astro/hero.DBNjupL__148EQW.webp)](/devtips/post/kubernetes-services-clusterip-nodeport-loadbalancer) ## [Understanding Kubernetes Services: ClusterIP vs NodePort vs LoadBalancer](/devtips/post/kubernetes-services-clusterip-nodeport-loadbalancer) - [Mohammad Abu Mattar](/authors/mohammad-abu-mattar) - [DevOps & Kubernetes](/devtips/categories/devops--kubernetes) If you're working with Kubernetes, you've probably noticed that Pods come and go, and their IP addresses keep changing. That's where Services come in. They give you a stable way to keep your apps acce [#Kubernetes](/devtips/tags/kubernetes)[#K8s Services](/devtips/tags/k8s-services)[#ClusterIP](/devtips/tags/clusterip)+5 tags [read more](/devtips/post/kubernetes-services-clusterip-nodeport-loadbalancer) [![Docker Is Eating Your Disk Space (And How PruneMate Fixes It)](/_astro/hero.BD8-gtdG_26qrXW.webp)](/devtips/post/docker-disk-space-prunemate) ## [Docker Is Eating Your Disk Space (And How PruneMate Fixes It)](/devtips/post/docker-disk-space-prunemate) - [Mohammad Abu Mattar](/authors/mohammad-abu-mattar) - [Containers & Docker](/devtips/categories/containers--docker) The problem: Docker is eating your disk space What it looks like when it happens Your Docker host is running out of space. Again. You've been spinning up containers, testing new services [#Docker](/devtips/tags/docker)[#Containers](/devtips/tags/containers)[#Home Lab](/devtips/tags/home-lab)+5 tags [read more](/devtips/post/docker-disk-space-prunemate) [![Policy-as-Code Governance with OPA/Rego](/_astro/hero.CwAJ64Mi_1WeH9p.webp)](/devtips/post/policy-as-code-opa-rego) ## [Policy-as-Code Governance with OPA/Rego](/devtips/post/policy-as-code-opa-rego) - [Mohammad Abu Mattar](/authors/mohammad-abu-mattar) - [DevOps & DevSecOps](/devtips/categories/devops--devsecops) Why policy-as-code matters The governance problem Managing infrastructure at scale gets complicated fast. As your infrastructure grows, keeping it consistent and compliant gets harder. M [#Policy as Code](/devtips/tags/policy-as-code)[#OPA/Rego](/devtips/tags/oparego)[#Compliance](/devtips/tags/compliance)+4 tags [read more](/devtips/post/policy-as-code-opa-rego) 6 related posts