[Question] How do I set different iam_role for prod and non-prod folders ?

[robertomoutinho]

How do I set different iam_role for prod and non-prod folders?

considering this PR from 2018 => https://github.com/gruntwork-io/terragrunt/pull/599/files#diff-04c6e90faac2675aa89e2176d2eec7d8 it seems that I can configure a specific iam_role to be used by terragrunt (and terraform).

My goal is to have a CI/CD (Atlantis) to assume roles when executing the terragrunt command.

How can I set up one role for non-prod folder and a different one for the prod folder?

[brikis98]

There are a number of options, including:

1. Have a different root prod/terragrunt.hcl and non-prod/terragrunt.hcl, each with different iam_role setting, that all the child modules include.
2. Have a single root terragrunt.hcl that uses generate to generate a provider block with an assume_role block within. The assume_role block can set role_arn to a variable, which in prod envs you set to a different value than non-prod envs.

[nilsdebruin]

To add another option:

I am making use of direnv (https://direnv.net) for which I create .envrc files in the different account folders. This is what I include: export TERRAGRUNT_IAM_ROLE=arn:aws:iam::ACCOUNTID:role/ROLE and other env variables as needed.

I am then able to go into the directory with the right role assumed and then being able to run Terragrunt.

[nilsdebruin]

Based on the input of @brikis98, I have created an example for option 2, see:

https://github.com/nilsdebruin/terragrunt-infrastructure-live-example/tree/assumed-role-example

If it is interesting enough, I could create a pull request for it.