Terragrunt run-all plan Across a Live Repo with Kestra

id: terragrunt-run-all-plan
namespace: company.team
description: |
  Plan every Terragrunt unit in a live infrastructure repository in one
  execution. The flow ships a tiny two-unit estate inline, runs
  terragrunt run-all plan non-interactively, keeps the full plan log as
  an execution artifact, and posts a Slack summary with the number of
  units covered.

tasks:
  - id: plan_estate
    type: io.kestra.plugin.terragrunt.cli.TerragruntCLI
    description: Run terragrunt run-all plan across the whole live folder so pending
      changes for every unit surface in a single task, capture the log, and emit
      the unit count through the outputs protocol.
    containerImage: alpine/terragrunt
    inputFiles:
      live/root.hcl: |
        inputs = {
          owner = "platform-team"
        }
      live/network/terragrunt.hcl: |
        include "root" {
          path = find_in_parent_folders("root.hcl")
        }

        terraform {
          source = "${get_terragrunt_dir()}/../../modules/network"
        }
      live/app/terragrunt.hcl: |
        include "root" {
          path = find_in_parent_folders("root.hcl")
        }

        terraform {
          source = "${get_terragrunt_dir()}/../../modules/app"
        }
      modules/network/main.tf: |
        variable "owner" {
          type = string
        }

        resource "local_file" "network_manifest" {
          filename = "${path.module}/network-manifest.txt"
          content  = "network owned by ${var.owner}\n"
        }

        output "network_manifest_path" {
          value = local_file.network_manifest.filename
        }
      modules/app/main.tf: |
        variable "owner" {
          type = string
        }

        resource "local_file" "app_manifest" {
          filename = "${path.module}/app-manifest.txt"
          content  = "app owned by ${var.owner}\n"
        }

        output "app_manifest_path" {
          value = local_file.app_manifest.filename
        }
    commands:
      - 'ec=0'
      - 'terragrunt run-all plan --non-interactive --working-dir live -no-color
        > plan.log 2>&1 || ec=$?'
      - cat plan.log
      - 'UNITS=$(find live -mindepth 2 -name terragrunt.hcl | wc -l | tr -d " ")'
      - 'echo "::{\"outputs\":{\"units\":$UNITS}}::"'
      - 'exit $ec'
    outputFiles:
      - plan.log

  - id: notify
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: Post a one-line summary so the team knows the estate-wide plan ran
      and how many units it covered.
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "text": "Terragrunt run-all plan finished across {{ outputs.plan_estate.vars.units }} unit(s). The full plan log is attached to execution {{ execution.id }}."
      }

errors:
  - id: alert_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: Alert the team when the estate-wide plan fails so a broken unit
      never hides until apply time.
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "text": "Terragrunt run-all plan FAILED in flow {{ flow.id }} (execution {{ execution.id }}). Check plan.log in the execution outputs for the failing unit."
      }

See the whole estate's pending changes in one execution. Terragrunt mono-repos split infrastructure into many small units, which keeps blast radius low but makes "what would change right now" a question that spans dozens of folders. This blueprint answers it with a single io.kestra.plugin.terragrunt.cli.TerragruntCLI task: terragrunt run-all plan walks every unit under the live folder, resolves the dependency graph, plans each unit, and the flow keeps the combined log as an execution artifact and posts a Slack summary.

The demo ships a miniature but structurally faithful repository inline through inputFiles: a root.hcl with shared inputs, two units (live/network and live/app) that include it, and two local modules that only create local_file resources, so the flow runs end to end without any cloud credentials.

How it works

plan_estate (io.kestra.plugin.terragrunt.cli.TerragruntCLI) materializes the repository layout from inputFiles into the task working directory. The terragrunt binary is on the PATH inside the task container, and the underlying terraform binary ships with the alpine/terragrunt image.
terragrunt run-all plan --non-interactive --working-dir live discovers both units, includes the shared root.hcl in each, and plans them in dependency order. The output is captured to plan.log and echoed to the task log.
The task counts the units it covered with find and emits the number through Kestra's outputs protocol, so it is available as {{ outputs.plan_estate.vars.units }}.
The exit code of the plan is preserved: the flow still fails when any unit fails to plan, but only after the log has been captured.
notify posts the unit count to Slack, and the errors block posts a distinct alert when the plan fails anywhere in the estate.

What you get

One execution that shows pending changes for every unit instead of a folder-by-folder crawl.
The complete run-all plan log stored as a downloadable artifact on the execution.
A unit count emitted as a first-class flow output, ready for thresholds or downstream tasks.
A repository layout you can replace wholesale with your real repo via namespaceFiles or a Git clone.

Who it's for

Platform teams running Terragrunt mono-repos who want a scheduled, auditable answer to "what has changed underneath us".
Infrastructure engineers reviewing estate-wide impact before a promotion or a provider upgrade.
Anyone evaluating the Terragrunt plugin who wants a runnable example with zero cloud setup.

Why orchestrate this with Kestra

Running run-all plan from a laptop produces a wall of text that disappears with the terminal session. Kestra turns the same command into a governed operation: the log becomes a stored artifact, the unit count becomes structured output, Slack gets a summary, failures raise a distinct alert, and every run is preserved in the execution history so you can compare this week's estate against last week's.

Prerequisites

A Slack incoming webhook for summaries and failure alerts.
No cloud credentials are needed for the demo, the modules only create local files. For a real estate, pass provider credentials through the task env from {{ secret('...') }}.

Secrets

SLACK_WEBHOOK_URL: Slack incoming webhook URL.

Quick start

Add the SLACK_WEBHOOK_URL secret to your Kestra namespace.
Execute the flow and open plan.log in the execution outputs to see both units planned.
Check the Slack message reports 2 units.

How to extend

Replace the inline inputFiles with namespaceFiles so the task mounts your real infrastructure repository from namespace storage, or clone it with io.kestra.plugin.git.Clone inside a WorkingDirectory task.
Switch the underlying binary to OpenTofu by using a container image that ships tofu and setting the TERRAGRUNT_TFPATH environment variable through the task env.
Add a Schedule trigger to run the estate-wide plan every morning, as shown in the Terragrunt drift watch blueprint.
Scope the plan to one environment folder with --working-dir, as shown in the Terragrunt environment promotion blueprint.

Plan an Entire Terragrunt Estate with run-all in One Execution

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

New to Kestra?

Plan an Entire Terragrunt Estate with run-all in One Execution

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

More Infrastructure Blueprints

Triage Aikido Vulnerabilities by Reachability, Auto-Snooze Unreachable Findings and Page Only on Real Risk

IIS Site Provisioning with SSL Binding and Health Check

IDM User Provisioning Request via Webhook with Retries

Ansible Scalability, Deploy Configuration Files to Multiple Servers at Scale

Automate Incident Response, Create Jira Tickets, Alert Slack, and Log to Database

Patch an Actively Exploited CVE Across the Fleet with Ansible, Gated by Human Approval and Verified by Aikido

New to Kestra?