Advanced Terraform · Module 05

OpenTofu, Terragrunt and Security

Keep secrets out of state and logs with sensitive, ephemeral and write-only values, know what OpenTofu changes and how to migrate, remove boilerplate across many environments with Terragrunt, and run Terraform at scale with provider aliases, multiple accounts and safe performance settings.

Practice interactively →

What you will learn

• Handle secrets with sensitive values, ephemeral resources, write-only arguments and secret stores
• Explain the OpenTofu fork, its extra features such as state encryption, and how to migrate
• Use Terragrunt to share backend and provider settings and to order dependent stacks
• Configure provider aliases and multi-account access, and use -target and -parallelism safely

Lessons

1. Secrets: sensitive, ephemeral and write-only

   sensitive only hides values in output; ephemeral values and write-only arguments keep secrets out of plan and state, and secret stores keep them out of code.

2. OpenTofu: the Open-Source Fork

   OpenTofu forked from Terraform 1.5 after the 2023 licence change; it keeps HCL and state compatible and adds features such as client-side state encryption, early variable evaluation and provider for_each.

3. Terragrunt: DRY Configuration Across Stacks

   Terragrunt wraps Terraform/OpenTofu: one root file generates backends and providers for every unit, include shares settings, dependency blocks pass outputs between units, and run --all applies them in order.

4. Provider Aliases, Many Accounts and Big Runs

   Use provider aliases for several regions or accounts, pass them into modules explicitly, assume a role per account, and keep -target and -parallelism for the rare cases that need them.