Acme's Infrastructure - Terragrunt Reference Architecture This repository contains rather complete infrastructure configurations where Terragrunt is used to manage infrastructure for Acme Corporation . By the way! This code is very close to the one produced by modules.tf - open-source infrastructure as code generator from visual diagrams created with Cloudcraft.co . Introduction Acme has several environments (prod, staging and dev) entirely separated by AWS accounts. Infrastructure in each environment consists of multiple layers (autoscaling, alb, vpc, ...) where each layer is configured using one of Terraform AWS modules with arguments specified in terraform.tfvars in layer's directory. Terragrunt is used to work with Terraform configurations which allows to orchestrate dependent layers, update arguments dynamically and keep configurations DRY . Environments Primary AWS region for all environments is eu-central-1 (Frankfurt) : acme-prod - Production configurations (AWS account - 111111111111) acme-staging - Staging configurations (AWS account - 444444444444) acme-master - Master AWS account (333333333333) contains: AWS Organizations IAM entities (users, groups) ECR repositories Route53 zones Pre-requirements Terraform 0.11 Terragrunt 0.18 or newer Terraform Docs pre-commit hooks to keep Terraform formatting and documentation up-to-date tfvars-annotations to process & update annotations in tfvars files direnv to automatically set correct environment variables per AWS account as specified in .envrc (optional) If you are using Mac you can install all dependencies using Homebrew: $ brew install terraform terraform-docs terragrunt pre-commit direnv $ brew install https://raw.githubusercontent.com/antonbabenko/tfvars-annotations/master/HomebrewFormula/tfvars-annotations.rb AWS accounts and IAM relations Acme has dedicated AWS account where IAM users, groups and roles are managed. This AWS account is used as a jump account, where IAM users are logged in and then they assume role in other AWS account. AWS access credentials should be set using environment variables: $ export AWS_DEFAULT_REGION=eu-central-1 $ export AWS_ACCESS_KEY_ID=... $ export AWS_SECRET_ACCESS_KEY=... aws-vault , vaulted or other tool can be used to manage your AWS credentials securely locally and switch roles. How to use it? Go to directory for the environment and region you want to work with: $ cd acme-staging/eu-central-1 Initialize the dependencies (download providers and modules). This command is enough to run once: $ terragrunt init To create infrastructure in all layers in a single region: $ terragrunt apply-all Alternatively, you can create infrastructure in a single layer (eg, vpc ): $ cd vpc $ terragrunt apply See official Terragrunt documentation for all available commands and features. Authors This project is created and maintained by Anton Babenko . License This work is licensed under MIT License. See LICENSE for full details. Copyright (c) 2019 Anton Babenko