Skip to main content
Terragrunt’s run_cmd is a powerful interpolation function that lets you execute shell commands during a run and return their standard output. By integrating run_cmd into your configurations, you can:
  • Dynamically adapt module inputs based on external context
  • Incorporate existing workflows or scripts
  • Feed custom data into Terraform resources at plan/apply time
The image is an infographic titled "run_cmd" that outlines three benefits: adapting based on custom command execution, integrating workflows within Terragrunt, and allowing custom script execution during Terragrunt runs.

​
Best Practices for run_cmd

  • Always validate and sanitize any external scripts or commands to mitigate security risks.
  • Prefer native Terraform/Terragrunt functions (like timestamp() and file()) when possible.
  • Reserve run_cmd for scenarios where built-in functions cannot produce the needed output.
Executing arbitrary shell commands can introduce security vulnerabilities. Ensure you trust and sanitize any external inputs or scripts invoked via run_cmd.

​
Example: Tagging AWS VPC Resources with the Current User

In this example, we’ll consume the Terraform AWS VPC module and automatically tag every resource with the username running Terragrunt.
When you run the command locally:
Terragrunt will interpolate the result into your Terraform plan:
Every resource provisioned by this Terragrunt configuration will now carry the tag CreatedBy = "abc". With run_cmd, you can extend this pattern to pull data from any script, API call, or toolchain, giving you a highly flexible Terragrunt workflow.

Watch Video