terragrunt run can skip auth-provider commands during discovery

Introduced 2026-07-01 · score 0.91

HOW TO USE IT

When configuration parsing resolves without credentials, run the change-based selection with `--no-discovery-auth-provider-cmd` to skip auth-provider invocations during discovery; auth still runs for executing units. Do not enable it if discovery parsing needs credentials, and `--experiment opt-out-auth` is not required in v1.1.0.

WHY THIS HELPS

Run a change-based unit selection when parsing configuration does not need credentials.

BEFORE THIS CHANGE

Terragrunt invoked `--auth-provider-cmd` once for every discovered unit by default. The flag was previously gated behind the `opt-out-auth` experiment.

REQUIREMENTS AND LIMITATIONS

• Version: v1.1.0
• --all (required): Run the command against all discovered units, subject to selection options.
• --no-discovery-auth-provider-cmd: Skip `--auth-provider-cmd` invocations during discovery; `TG_NO_DISCOVERY_AUTH_PROVIDER_CMD` is the corresponding environment variable.
• --queue-include-units-reading (required): Limit `run --all` to units that read the specified file via an HCL function or include. Takes a string; `TG_QUEUE_INCLUDE_UNITS_READING` is the corresponding environment variable.
• -- (required): Separates Terragrunt arguments from the underlying command and its arguments; `plan` is the command passed through here.
• Prerequisite: Use the discovery skip only when parsing resolves without credentials; credential-dependent parsing, such as via `get_aws_account_id()`, can fail when enabled.
• Use only when parsing resolves without credentials; configuration that depends on values from `--auth-provider-cmd` during discovery will fail to parse when enabled.

FIRST-PARTY EVIDENCE

• https://github.com/gruntwork-io/terragrunt/releases/tag/v1.1.0
• https://docs.terragrunt.com/reference/cli/commands/run/

Check the installed version and the source before using it. Entry JSON

Report a problem with this card