Under Terragrunt

What you change

1. terraform_binary = "choudoufu" in the file every unit includes, or TG_TF_PATH=choudoufu in the environment.
2. A live block in each unit, naming its estate and the record store:

network/live.tf

terraform {
  live {
    estate = "network"

    record_store "s3" {
      bucket = "my-records-bucket"
    }
  }
}

include, inputs, dependency blocks with mock_outputs, generated providers and remote_state stay as they are. For a unit that already owns resources, pull its state with the stock binary and follow Migrate before the first apply.

What you get

	Stock Terragrunt	On the live backend
One plan covers every unit	No, one per unit	Yes
A changed value reaches the units that read it	No, a dependency reads the last applied outputs	Yes
A new ID reaches the units that read it	Only as mock_outputs	Yes, as known after apply, and the mock is not planned
The approved plan is what applies	--out-dir saves each unit’s plan, mocks included	Yes, and choudoufu refuses a plan that no longer matches
Applies	One per unit	One

The workflow

The pull request plans into plans, and the merge applies those files, planning nothing first:

terragrunt run --all --out-dir plans -- plan
terragrunt run --all --out-dir plans -- apply

Every plan file carries the whole joint plan, so the merge’s job needs only that directory. Separate jobs need one CI secret in CHOUDOUFU_PLAN_HMAC_KEY (why).

Limits

• run --all apply without --out-dir applies one unit at a time, each reading its upstream’s recorded outputs.
• A dependency read is taken from the joint plan when it feeds an input directly, or through OpenTofu functions. An input that also calls get_env, or a value read through read_terragrunt_config, keeps Terragrunt’s value.

A worked example is examples/demo-terragrunt.