Skip to content
Terragrunt Logo
🎉 Terragrunt v1.0 is here! Read the announcement to learn more.

Active Strict Controls

The following strict controls are available. See the strict controls overview for how to enable them.

bare-include

Throw an error when using a bare include.

bare-include - Reason

Backwards compatibility for supporting bare includes results in a performance penalty for Terragrunt, and deprecating support provides a significant performance improvement. For more information, see the Bare Include Migration Guide.

cli-redesign

Throw an error when using commands that were deprecated as part of the CLI redesign.

cli-redesign - Commands

  • run-all
  • graph
  • graph-dependencies
  • hclfmt
  • hclvalidate
  • output-module-groups
  • render-json
  • terragrunt-info
  • validate-inputs
  • aws-provider-patch

cli-redesign - Reason

These commands have been deprecated in favor of more consistent and intuitive commands as part of the CLI redesign. For more information, see the CLI Redesign Migration Guide.

The aws-provider-patch command was a workaround for a legacy Terraform bug where dynamic values in nested provider blocks were not handled correctly during terraform import. This workaround is no longer needed and the command has been deprecated. Remove it from any scripts or CI/CD pipelines.

default-command

Throw an error when using the Terragrunt default command.

default-command - Reason

Terragrunt now supports a special run command that can be used to explicitly forward commands to OpenTofu/Terraform when no shortcut exists in the Terragrunt CLI.

default-command - Example

The default command is deprecated and will be removed in a future version. Use terragrunt run instead.

deprecated-hidden-flag

Throw an error when using the deprecated --hidden flag.

deprecated-hidden-flag - Reason

Hidden directories are now included by default in find and list command results. The --hidden flag is no longer needed and has been deprecated. Use --no-hidden if you need to exclude hidden directories.

deprecated-hidden-flag - Example

Terminal window
# This will show a warning (or error with strict control enabled)
$ terragrunt find --hidden
WARN  The `--hidden` flag is deprecated and will be removed in a future version of Terragrunt. Hidden directories are now included by default. Use `--no-hidden` to exclude them.

disable-command-validation

Throw an error when using the deprecated --disable-command-validation flag.

disable-command-validation - Reason

Command validation has been removed entirely from Terragrunt. The run command now accepts any command and passes it through to the underlying OpenTofu/Terraform binary. The --disable-command-validation flag is no longer needed and does nothing.

disable-dependent-modules

Throw an error when using the deprecated --disable-dependent-modules flag.

disable-dependent-modules - Reason

Dependent modules discovery has been removed from terragrunt render. The --disable-dependent-modules flag is no longer needed and has no effect.

disable-dependent-modules - Example

Terminal window
# This will show a warning (or error with strict control enabled)
$ terragrunt render --format=json --disable-dependent-modules
WARN  The `--disable-dependent-modules` flag is deprecated and will be removed in a future version of Terragrunt. Dependent modules discovery has been removed from `terragrunt render`, so this flag has no effect.

legacy-internal-tflint

Force the use of external tflint binary.

legacy-internal-tflint - Reason

The embedded version of tflint has been held back by upstream’s adoption of the BUSL license. As a result, the embedded version is horribly out of date, and we are deprecating it for removal in a future version of Terragrunt. You may use --terragrunt-external-tflint in your tflint hook to opt in to the use of an external tflint binary, or enable this strict control.

no-destroy-dependencies-check

Throw an error when using the deprecated --no-destroy-dependencies-check flag.

no-destroy-dependencies-check - Reason

The --no-destroy-dependencies-check flag is deprecated and no longer affects Terragrunt’s behavior. Dependency checks are now disabled by default during destroy operations. Use --destroy-dependencies-check to explicitly enable dependency checks when needed.

queue-exclude-external

Throw an error when using the deprecated --queue-exclude-external flag.

queue-exclude-external - Reason

External dependencies are now excluded by default. The --queue-exclude-external flag is no longer needed and has been deprecated. Use --queue-include-external if you need to include external dependencies.

queue-exclude-external - Example

Terminal window
# This will show a warning (or error with strict control enabled)
$ terragrunt run --all plan --queue-exclude-external
WARN  The `--queue-exclude-external` flag is deprecated and will be removed in a future version of Terragrunt. External dependencies are now excluded by default.

queue-strict-include

Throw an error when using the deprecated --queue-strict-include flag.

queue-strict-include - Reason

The behavior of Terragrunt when using --queue-strict-include is now the default behavior. The --queue-strict-include flag is no longer needed and has been deprecated.

queue-strict-include - Example

Terminal window
# This will show a warning (or error with strict control enabled)
$ terragrunt run --all plan --queue-strict-include
WARN  The `--queue-strict-include` flag is deprecated and will be removed in a future version of Terragrunt. The behavior of Terragrunt when using `--queue-strict-include` is now the default behavior.

root-terragrunt-hcl

Throw an error when users try to reference a root terragrunt.hcl file using find_in_parent_folders.

This control will also try to find other scenarios where users may be using terragrunt.hcl as the root configuration, including when using commands like scaffold and catalog, which can generate a terragrunt.hcl file expecting a terragrunt.hcl file at the root of the project. Enabling this flag adjusts the defaults for those commands so that they expect a recommended root.hcl file by default, and will throw an error if a terragrunt.hcl file is explicitly set.

root-terragrunt-hcl - Reason

Using a root terragrunt.hcl file was previously the recommended pattern to use with Terragrunt, but that is no longer the case. For more information see Migrating from root terragrunt.hcl.

terragrunt-prefix-env-vars

Throw an error when using the TERRAGRUNT_ prefix for environment variables.

terragrunt-prefix-env-vars - Reason

This prefix has been renamed to TG_ to shorten the prefix, due to the work in RFC #3445.

terragrunt-prefix-env-vars - Example

The TERRAGRUNT_LOG_LEVEL env var is deprecated and will be removed in a future version. Use TG_LOG_LEVEL=info instead.

units-that-include

Throw an error when using the deprecated --units-that-include flag.

units-that-include - Reason

The --units-that-include flag has been deprecated. Use --filter='reading=<path>' to include units that include or read the specified configuration.

units-that-include - Example

Terminal window
# This will show a warning (or error with strict control enabled)
$ terragrunt run --all plan --units-that-include=root.hcl
WARN  The `--units-that-include` flag is deprecated and will be removed in a future version of Terragrunt. Use `--filter='reading=<path>'` to include units that include or read the specified configuration.