---
title: "Terragrunt: Infrastructure as Code Management"
description: "Test your knowledge of Terragrunt fundamentals with this comprehensive quiz covering DRY principles, remote state management, module dependencies, configuration inheritance, run-all commands, hooks, and best practices for managing Terraform at scale."
author: "Mohammad Abu Mattar"
canonical: https://mkabumattar.com/quizzes/post/terragrunt-iac-management-quiz
---

# Terragrunt: Infrastructure as Code Management

Welcome to the Terragrunt Basics Quiz! This quiz is designed to test your understanding of fundamental Terragrunt concepts, including DRY configuration management, remote state handling, module dependencies, and best practices for managing Terraform at scale. Each question is multiple-choice, and you'll find hints to help you along the way. Good luck!

## Questions

### 1. What is the primary purpose of Terragrunt?

- To serve as a complete replacement for the Terraform binary
  - Terragrunt is a wrapper that requires Terraform to be installed to execute infrastructure changes.
- **To maintain DRY configurations and automate remote state logic** ✅
  - Terragrunt reduces code duplication by allowing developers to define backend and provider logic once for many modules.
- To provide a graphical user interface for resource visualization
  - Terragrunt is a CLI-based tool and does not provide a native dashboard for viewing cloud resources.
- To enable the use of Python as the primary configuration language
  - Terragrunt uses HCL (HashiCorp Configuration Language) and does not replace it with general-purpose languages.

**Hint:** It is a thin wrapper for Terraform.

### 2. Which file name is the standard configuration entry point for Terragrunt?

- `main.tf`
  - The main.tf file is a standard Terraform resource file, not a Terragrunt orchestration file.
- **`terragrunt.hcl`** ✅
  - The terragrunt.hcl file contains the specific logic for module sourcing, dependencies, and configuration inheritance.
- `config.yaml`
  - While Terragrunt can parse YAML data, its primary configuration entry point is always an HCL file.
- `terraform.tfvars`
  - The tfvars file is used by Terraform for variable assignment but is not the entry point for Terragrunt.

**Hint:** It ends in .hcl.

### 3. What does the "include" block do in a terragrunt.hcl file?

- It imports a third-party Docker image into the workspace
  - Container management is handled by Terraform providers, not by the Terragrunt include block.
- **It enables a configuration to inherit settings from a parent** ✅
  - The include block allows child modules to merge their configuration with a central root file, keeping code DRY.
- It renders a static CSS file for infrastructure documentation
  - Terragrunt does not have native features for styling or rendering web-based documentation files.
- It executes a cleanup script to delete unused state files
  - State management is handled via the remote_state block or manual CLI commands, not the include block.

**Hint:** Think about inheritance.

### 4. What is the "dependency" block used for?

- To automate the installation of packages on remote instances
  - Package installation is typically handled by configuration management tools or cloud-init scripts.
- **To pass output variables between independent infrastructure modules** ✅
  - The dependency block allows one module to access the outputs of another (e.g., using a VPC ID in a DB module).
- To download and manage the specific version of the Terraform binary
  - Binary versioning is managed by tools like tfenv or Terragrunt version constraints, not dependency blocks.
- To enforce strict version locking for specific cloud providers
  - Provider versioning is handled within the Terraform block or through the generated lock file.

**Hint:** Passing data between modules.

### 5. How do you run "terraform apply" across multiple directories using Terragrunt?

- **`terragrunt run-all apply`** ✅
  - The run-all command identifies all Terragrunt modules in the directory tree and applies them in dependency order.
- `terragrunt apply --recursive`
  - While recursion is implied, the specific Terragrunt command for multi-module execution is run-all.
- `terraform apply -all-folders`
  - Standard Terraform only operates on the current working directory and lacks a multi-folder apply flag.
- `terragrunt deploy --bulk`
  - The "deploy" and "--bulk" keywords are not part of the standard Terragrunt command-line interface.

**Hint:** Think "All".

### 6. What is the purpose of the "remote_state" block?

- To synchronize the local HCL source code with a Git repository
  - Source code synchronization is handled by Git, while remote_state focuses on the Terraform state file.
- **To automate backend configuration and the creation of state buckets** ✅
  - This block allows Terragrunt to automatically provision the S3 buckets or DynamoDB tables required for state management.
- To trigger the execution of Terraform on a remote build server
  - Remote execution is a feature of Terraform Cloud or Enterprise, not the remote_state block in Terragrunt.
- To encrypt the local working directory using OS-level security
  - Terragrunt manages state encryption via cloud provider settings, not local disk encryption.

**Hint:** Automating the S3/GCS bucket creation.

### 7. What does the "source" attribute in a Terragrunt block define?

- The specific API endpoint for the target cloud service provider
  - Provider endpoints are configured in the provider block within Terraform, not the Terragrunt source attribute.
- **The location of the Terraform module code to be deployed** ✅
  - The source attribute tells Terragrunt where to find the infrastructure blueprints (Git URLs or local paths).
- The primary maintainer and contact email for the infrastructure
  - Maintainer information is metadata that does not impact the functional execution of the source attribute.
- The version of the execution engine required to run the code
  - Engine versions are defined in version constraint blocks, whereas source defines the code location.

**Hint:** Where the Terraform code lives.

### 8. What is the role of "Before" and "After" hooks?

- To schedule recurring backups of the cloud provider account
  - Backups are typically managed by cloud-native services or separate cron jobs rather than execution hooks.
- **To execute custom commands during the Terraform lifecycle** ✅
  - Hooks allow users to run scripts (like notifications or file cleanup) immediately before or after Terraform execution.
- To monitor the total time elapsed during a resource deployment
  - While hooks could trigger a timer, their primary purpose is generic command execution, not telemetry.
- To perform syntax linting on the HCL configuration files
  - Linting is usually performed as a separate pre-commit or CI step, though hooks can technically trigger them.

**Hint:** Custom scripts during the lifecycle.

### 9. What is the "find_in_parent_folders()" function used for?

- To recover deleted configuration files from the system trash
  - The function only searches for active files within the current directory hierarchy, not deleted ones.
- **To locate a parent configuration file for easier inheritance** ✅
  - This helper function allows child modules to dynamically find and include the root terragrunt.hcl file.
- To scan the parent directories for unencrypted secret files
  - Security scanning is handled by tools like tfsec or checkov, not by HCL path-finding functions.
- To list all authorized users within the parent cloud organization
  - This function is strictly for file system navigation and cannot query cloud identity services.

**Hint:** Locating the root configuration.

### 10. How does Terragrunt handle "Inputs"?

- It writes them to a plain-text file named secrets.txt
  - Terragrunt uses environment variables or temporary tfvars files to ensure better integration and security.
- **It maps the HCL inputs block to Terraform variables** ✅
  - Any key-value pair defined in the inputs block is automatically passed to Terraform as a variable at runtime.
- It rejects any input variables that are not of the string type
  - Terragrunt supports complex types including maps, lists, objects, and booleans for input variables.
- It prompts the user to manually enter values during execution
  - Terragrunt is designed for automation; it prioritizes defined configuration over interactive manual prompts.

**Hint:** Passing variables to Terraform.

### 11. What is the "Locals" block in Terragrunt?

- A collection of resources limited to a single cloud region
  - Regional scope is a provider setting and is unrelated to the HCL "locals" variable block.
- **A block for defining reusable variables within a configuration** ✅
  - Locals allow for internal logic, such as string manipulation, to be stored in a variable and reused in the file.
- A set of variables that only execute on a developer workstation
  - Locals are evaluated wherever the HCL is processed, including CI/CD environments and remote runners.
- A specialized security vault for storing sensitive credentials
  - While locals can hold data, sensitive secrets should be managed by dedicated tools like SOPS or Vault.

**Hint:** Internal variables.

### 12. What command would you use to see what Terragrunt plans to do without making changes?

- `terragrunt view-changes`
  - There is no "view-changes" command in the Terragrunt or Terraform command-line interface.
- **`terragrunt plan`** ✅
  - Since Terragrunt is a wrapper, it passes the plan command directly to Terraform to show pending changes.
- `terragrunt dry-run`
  - While common in other CLI tools, the specific keyword for generating an execution preview is "plan".
- `terragrunt check-diff`
  - The check command is typically used for formatting or linting, not for previewing infrastructure changes.

**Hint:** The same as Terraform.

### 13. What is the purpose of "generate" blocks?

- To generate complex passwords for cloud resource attributes
  - Password generation is usually handled by Terraform resources like "random_password".
- **To inject HCL code directly into the Terraform directory** ✅
  - The generate block creates files (like provider.tf) in the working directory before Terraform runs.
- To generate a PDF summary of the current infrastructure state
  - Terragrunt is an automation tool for IaC and does not include document generation or reporting features.
- To generate a new set of SSH keys for server authentication
  - SSH keys are managed as resources or via external scripts, not via the generate block.

**Hint:** Creating files on the fly.

### 14. What happens when you use "terragrunt run-all destroy"?

- It removes all cloud resources in a random, unordered sequence
  - Terragrunt calculates dependencies to ensure resources are deleted in the correct order to avoid errors.
- **It destroys all modules in the reverse order of dependencies** ✅
  - The run-all destroy command ensures that dependent resources (like apps) are removed before their dependencies (like DBs).
- It deletes the local Terragrunt configuration and HCL files
  - The destroy command targets cloud infrastructure, not the local source code or configuration files.
- It uninstalls the Terragrunt binary from the local system
  - Software uninstallation is handled by system package managers, not by an infrastructure command.

**Hint:** Order matters.

### 15. What is the ".terragrunt-cache" folder?

- A storage directory for long-term execution and system logs
  - Logs are usually sent to the console output; the cache folder serves as a functional workspace.
- **The directory where Terragrunt runs Terraform commands** ✅
  - Terragrunt downloads modules and initializes Terraform within this hidden folder to keep the source directory clean.
- A folder used for storing historical backups of the state file
  - State backups are managed by the remote backend (like S3 versioning) rather than a local cache folder.
- A system-level partition used for increasing build speeds
  - The cache is a standard folder within the project structure, not a specialized hardware or OS partition.

**Hint:** The temporary workspace.

### 16. Which function converts a string into an HCL object?

- **`read_terragrunt_config()`** ✅
  - This function allows you to parse another HCL file and access its variables or locals as an object.
- `parse_hcl_string()`
  - This is not a valid Terragrunt built-in function; the standard method is read_terragrunt_config.
- `import_hcl_file()`
  - While descriptive, this is not a standard function name within the Terragrunt HCL syntax.
- `json_decode_config()`
  - The json_decode function is used for JSON data, while Terragrunt configurations require HCL parsing.

**Hint:** It "parses" the HCL.

### 17. What is the "iam_role" attribute used for in Terragrunt?

- To assign a friendly alias to a specific cloud user
  - Aliases are for display purposes; iam_role is a functional security attribute for permissions.
- **To assume a specific IAM role before executing Terraform** ✅
  - This attribute allows Terragrunt to assume a cross-account role to manage resources in different AWS environments.
- To create a new IAM user within the cloud organization
  - Users are created using Terraform resources, whereas this attribute defines the identity Terragrunt uses.
- To encrypt sensitive data using an IAM-managed key
  - Encryption is handled by KMS or similar services; IAM roles define "who" can perform an action.

**Hint:** Assuming an AWS identity.

### 18. What is a "Mock Output"?

- A way to provide humorous feedback in the terminal
  - Mocking is a technical simulation technique and is not related to humor or non-functional text.
- **A placeholder value used when a dependency is not yet deployed** ✅
  - Mocks allow a "plan" to succeed even if the actual dependency output is not yet available in the state.
- A fake error message used to test the failure logic
  - Mocking provides successful dummy data to allow the pipeline to proceed, rather than simulating failures.
- A tool for testing the responsiveness of the web UI
  - Terragrunt is a CLI tool for infrastructure and does not interact with web UI responsiveness.

**Hint:** Simulating data when a dependency isn't built yet.

### 19. How do you tell Terragrunt to use a specific version of Terraform?

- `tf_binary_version = "1.0.0"`
  - The correct attribute name used by Terragrunt is "terraform_version_constraint".
- **`terraform_version_constraint = ">= 1.0.0"`** ✅
  - This setting ensures that Terragrunt validates the local Terraform version before starting an execution.
- `engine_version: 1.0.0`
  - This uses YAML syntax and incorrect terminology for the Terraform versioning block.
- `require_terraform { version = "1.0.0" }`
  - This is not a valid HCL syntax for Terragrunt version management.

**Hint:** terraform_version_constraint.

### 20. What does the "--terragrunt-non-interactive" flag do?

- It suppresses all terminal output and logs
  - Logs are still displayed; only interactive prompts that require user input are removed.
- **It assumes a "yes" response to all interactive prompts** ✅
  - This flag is essential for CI/CD pipelines to prevent the process from hanging while waiting for user confirmation.
- It reduces the execution speed of the deployment
  - Interaction flags do not impact the performance or speed of the underlying Terraform resources.
- It disables all network connections to the cloud
  - Terragrunt requires network access to communicate with backends and cloud provider APIs.

**Hint:** Good for CI/CD.

### 21. What is the "get_env()" function used for?

- To query the current weather in the server region
  - Environmental data like weather is not accessible via HCL configuration functions.
- **To retrieve environment variables from the host system** ✅
  - This function allows Terragrunt to pull in system variables (like shell exports) into the HCL config.
- To create a new environment tier in the cloud
  - Environment tiers are created by provisioning resources, not by calling HCL functions.
- To permanently delete a file from the host machine
  - File deletion is an OS-level action typically handled by hooks or scripts, not get_env.

**Hint:** Accessing system variables.

### 22. What is "Prevent Destroy"?

- A hardware-level safeguard against fire damage
  - Prevent_destroy is a software configuration setting, not a physical fire safety measure.
- **A flag that prevents the accidental deletion of a module** ✅
  - This setting provides a safety layer for critical modules, preventing Terragrunt from running a destroy command on them.
- A command that destroys everything except databases
  - The flag acts as a preventative block; it does not selectively filter what to destroy.
- A security firewall rule that blocks all traffic
  - Firewalls manage network traffic, whereas prevent_destroy manages the infrastructure lifecycle.

**Hint:** Safety for critical resources.

### 23. Which command clears the Terragrunt cache?

- `terragrunt clean-workspace`
  - This is not a standard built-in command for the Terragrunt CLI.
- **`rm -rf .terragrunt-cache`** ✅
  - Because the cache is a standard local directory, manually removing it is the recommended way to clear it.
- `terragrunt reset-cache`
  - There is no native "reset-cache" command; users must interact with the file system directly.
- `terraform refresh-all`
  - Refresh-all updates state files from the cloud but does not impact the local Terragrunt cache folder.

**Hint:** rm -rf .terragrunt-cache

### 24. What is the "path_relative_to_include()" function?

- The physical distance to the cloud data center
  - HCL functions do not measure physical or geographical distances.
- **The relative path from the root to the child config** ✅
  - This function returns the path between the included parent file and the current child module.
- A method for renaming a directory in the project
  - Directory management is an OS-level task and is not performed by path functions.
- A list of all files currently active in the project
  - The function returns a single string path, not a collection or list of file objects.

**Hint:** Finding the distance between files.

### 25. What is "Sops" integration in Terragrunt?

- A way to perform deep-cleaning on the build server
  - Sops is a secret management tool and has no relation to server maintenance.
- **A method for decrypting Mozilla SOPS files at runtime** ✅
  - This integration allows Terragrunt to decrypt secrets stored in HCL/YAML files before passing them to Terraform.
- A specialized database for high-performance storage
  - SOPS is a file-level encryption tool and does not function as a database engine.
- A technique for writing code significantly faster
  - SOPS focuses on security and encryption, not on the speed of code development.

**Hint:** Handling encrypted files.

### 26. How do you pass extra arguments to Terraform via Terragrunt?

- `terraform_flags = ["-lock=false"]`
  - This is not a valid attribute; extra flags must be defined within an extra_arguments block.
- **`extra_arguments "custom" { arguments = ["-lock=false"] }`** ✅
  - This block allows you to automatically append specific flags to Terraform commands like plan or apply.
- `args_list: ["-lock=false"]`
  - This syntax is incorrect for Terragrunt, which uses the specific extra_arguments HCL block.
- `run_terraform --with-flags="-lock=false"`
  - Flags are passed through configuration blocks rather than specialized CLI wrappers like this.

**Hint:** extra_arguments block.

### 27. What is the purpose of "skip = true" in a Terragrunt configuration?

- To bypass the automated testing phase of a build
  - The skip flag ignores the entire directory during a run-all command, not just a single phase.
- **To ignore a directory during "run-all" executions** ✅
  - This is useful for folders that contain helper code or templates that should not be deployed as standalone modules.
- To optimize the code for faster execution speeds
  - Skipping a module reduces the total workload but does not optimize the performance of the remaining modules.
- To bypass the billing cycle of the cloud provider
  - Cloud billing is based on active resources; skipping a Terragrunt module does not impact provider pricing.

**Hint:** Ignoring a directory.

### 28. What is a "Terragrunt Stack"?

- A detailed list of system errors and logs
  - A list of errors is referred to as a "Stack Trace," not a Terragrunt Stack.
- **A set of modules deployed together via "run-all"** ✅
  - A stack represents the entire collection of infrastructure modules managed within a specific directory tree.
- A specialized type of computer hardware memory
  - In computing, this usually refers to the "Call Stack" or RAM, which is unrelated to IaC management.
- A physical arrangement of servers in a data rack
  - Physical server arrangements are hardware stacks, whereas Terragrunt manages logical software stacks.

**Hint:** A collection of modules.

### 29. What does "get_terragrunt_dir()" return?

- The absolute path to the user’s home directory
  - The function returns the path to the configuration directory, not the home directory of the current user.
- **The absolute path to the current HCL file directory** ✅
  - This function returns the full system path to the folder containing the terragrunt.hcl file currently being executed.
- The remote URL of the current GitHub repository
  - It returns a local file-system path, not a remote Git URL or repository link.
- A list of all subdirectories within the project
  - The function returns a single string representing a directory path, not a collection of folders.

**Hint:** The current directory.

### 30. Why would you use Terragrunt over plain Terraform?

- Because Terraform is no longer an active project
  - Terraform is a highly active project; Terragrunt is a supplementary tool for managing it at scale.
- **To reduce code duplication in large deployments** ✅
  - Terragrunt excels at managing hundreds of environments by sharing common logic and simplifying remote state.
- To convert the HCL syntax into JavaScript code
  - Terragrunt maintains HCL as the primary language and does not perform language conversions.
- To eliminate the cost of cloud provider services
  - Both tools are free/open-source, but they do not eliminate the costs associated with the cloud resources they provision.

**Hint:** Managing complexity.