Terragrunt v1.1.1 - Backend And Filter Correctness

Terragrunt v1.1.1 was published on July 14, 2026. The main correction is chained role assumption for S3 backend operations, which brings Terragrunt state setup into line with the credentials and role behavior already used by OpenTofu or Terraform.

The full release notes and downloads are on the GitHub release page.

Terragrunt can receive AWS credentials through --auth-provider-cmd or environment variables. Before v1.1.1, those credentials were used directly for Terragrunt backend work, even when the remote_state block also declared assume_role. OpenTofu or Terraform assumed the configured role during a run, but Terragrunt did not assume it while bootstrapping the state bucket. Cross account setups could therefore pass the main run and still fail during backend work.

The supplied credentials now act as the source identity. Terragrunt assumes the role configured for remote_state on top of that identity. The same chaining applies to iam_role, the --iam-assume-role flag, and direct reads of dependency outputs from S3 state.

This fix removes a credential path mismatch rather than changing the HCL model. Operators should still check both the source identity and the target role when diagnosing an access error, but Terragrunt and the IaC engine now follow the same intended chain.

Git based filters in terragrunt find and terragrunt list now include units inside generated stacks. Earlier versions created comparison worktrees without generating the stacks there. A changed terragrunt.stack.hcl, a changed unit file, or a file consumed through read_terragrunt_config or mark_glob_as_read could be absent from discovery even though terragrunt run --all selected the unit.

Terragrunt now generates stacks inside the comparison worktrees used by these commands. It does not generate stacks in the current working directory by default. That boundary matters for automation because discovery becomes accurate without adding generated files to the checkout that launched the command.

The release also fixes a concurrency fault in dependency discovery for graph filters such as [HEAD~1...HEAD].... A dependency reached from several units could become visible before its working directory was assigned, leading run --all to report that the component lacked a working directory. The working directory is now set before the dependency is published to concurrent traversal, so behavior no longer depends on the size or shape of the graph.

Provider cache warming now respects -lockfile=readonly. Previously, Terragrunt could create or update .terraform.lock.hcl before the IaC engine checked the flag. That made the later check pass and defeated the requested protection. Terragrunt now leaves the file alone so OpenTofu or Terraform can reject a missing or incomplete lock file. The behavior also covers TF_CLI_ARGS and TF_CLI_ARGS_init.

Per unit terraform_binary settings are also honored by run --all when both tofu and terraform are on PATH. Earlier, cloned stack options retained the automatically detected engine and ignored the unit setting. Explicit --tf-path or TG_TF_PATH values still take precedence.

For CI, both fixes restore useful failure modes. A read only lock policy can fail where it should, and a mixed engine stack can execute the binary selected by each unit rather than the first binary found automatically.