Terragrunt v1.1.2, published on July 29, 2026, restores correct AWS role reuse for backend operations after a regression in v1.1.1. The release also protects provider cache downloads and reduces repeated filesystem work across large infrastructure estates.
The full release notes and downloads are on the GitHub release page.
AWS role reuse and provider cache protection ¶
For operators using static AWS credentials with iam_role, --iam-assume-role, or TG_IAM_ASSUME_ROLE, v1.1.1 added a second role assumption during backend operations. The run already held a role session, so the role tried to assume itself. AWS returned AccessDenied unless the trust policy happened to allow that unusual path.
Terragrunt v1.1.2 reuses the role session created at the start of the run. This restores the behavior from before v1.1.1 without asking operators to weaken a trust policy. The assume_role setting inside remote_state is not affected. That role remains specific to backend access and is still assumed on top of the supplied credentials, so existing cross account state access keeps its intended chain.
The Provider Cache Server also puts a fresh secret path segment in every provider archive download URL. Terragrunt generates the value when the server starts, redacts it from server logs, and returns 404 for requests that omit it. This closes a local authorization gap where another process on the same machine could ask the cache server to fetch a private registry artifact with the credentials of the process that started Terragrunt.
Faster parent lookup and quieter local sources ¶
find_in_parent_folders("root.hcl") previously tested the requested name and the default configuration names at every ancestor directory. Sibling units then repeated the same probes. In v1.1.2, the walk checks only the requested filename and reuses what it learns about each directory for the rest of the command.
The project benchmark for 100 units nested eight directories deep moves from 4.8 ms to 0.49 ms. Other tested shapes show lookups running 7x to 10x faster. This is a focused configuration lookup benchmark, not a promise for total plan or apply time. The benefit should be most visible in estates with many units and deep shared parent chains.
Local source caching gets a related correction. The stale source hash now covers only files that a copy would deliver. It respects the default hidden file rule plus include_in_copy and exclude_from_copy. Touching an ignored editor file or an excluded scratch note no longer forces a source copy and automatic initialization. Actual copied inputs still change the hash.
Feature defaults stay with their units ¶
During run --all, a feature default was previously stored once for the whole run. The first parsed unit could therefore set a flag value for its siblings. A unit with default = false might observe feature.toggle.value as true because another unit with the same flag name was parsed first.
Defaults now resolve per unit, including values inherited through include. Explicit overrides supplied through --feature or TG_FEATURE still apply across the run. This separates local configuration defaults from deliberate operator overrides and removes parsing order from feature evaluation.
For repositories that mix several infrastructure stacks, this is primarily a correctness fix. It prevents a shared flag name from producing different behavior as traversal order changes, while preserving the fleet wide controls used by automation.