Terragrunt Validator

# Terragrunt/Terraform generated directories
**/.terragrunt-cache/
**/.terraform/

#!/usr/bin/env python3
"""
Terragrunt Custom Resource Detector

This script analyzes Terragrunt and Terraform configurations to identify:
- Custom Terraform providers (non-HashiCorp official)
- Custom modules (local or remote)
- Provider versions used

Outputs a report that can be used to guide documentation lookup via WebSearch or Context7.
"""

import re
import json
import argparse
import sys
from pathlib import Path
from typing import List
from collections import defaultdict


# Known official HashiCorp providers (comprehensive list)
OFFICIAL_PROVIDERS = {
    # Core providers
    'hashicorp/aws', 'hashicorp/azurerm', 'hashicorp/google', 'hashicorp/google-beta',
    'hashicorp/kubernetes', 'hashicorp/kubernetes-alpha',

    # Utility providers
    'hashicorp/null', 'hashicorp/random', 'hashicorp/local', 'hashicorp/template',
    'hashicorp/external', 'hashicorp/archive', 'hashicorp/http', 'hashicorp/time',
    'hashicorp/tls', 'hashicorp/cloudinit',

    # HashiCorp products
    'hashicorp/vault', 'hashicorp/consul', 'hashicorp/nomad', 'hashicorp/tfe',
    'hashicorp/hcp', 'hashicorp/boundary', 'hashicorp/waypoint',

    # Kubernetes ecosystem
    'hashicorp/helm',

    # Cloud providers (additional)
    'hashicorp/azuread', 'hashicorp/azurestack', 'hashicorp/googleworkspace',
    'hashicorp/opc', 'hashicorp/oraclepaas',

    # Infrastructure providers
    'hashicorp/vsphere', 'hashicorp/dns', 'hashicorp/ad',

    # Also accept short forms (without hashicorp/ prefix)
    'aws', 'azurerm', 'google', 'google-beta', 'kubernetes', 'null', 'random',
    'local', 'template', 'external', 'archive', 'http', 'time', 'tls',
    'cloudinit', 'vault', 'consul', 'nomad', 'tfe', 'hcp', 'boundary',
    'waypoint', 'helm', 'azuread', 'azurestack', 'googleworkspace', 'vsphere',
    'dns', 'ad', 'opc', 'oraclepaas',

    # OpenTofu registry format
    'registry.opentofu.org/hashicorp/aws',
    'registry.opentofu.org/hashicorp/azurerm',
    'registry.opentofu.org/hashicorp/google',
    'registry.opentofu.org/hashicorp/kubernetes',
}

# Paths that should never be scanned for source detection.
IGNORED_DIR_NAMES = {
    '.git',
    '.terraform',
    '.terragrunt-cache',
    '.idea',
    '.venv',
    'venv',
    '__pycache__',
    'node_modules',
}


class ResourceDetector:
    def __init__(self, target_dir: str):
        self.target_dir = Path(target_dir)
        self.custom_providers = defaultdict(set)
        self.custom_modules = defaultdict(list)
        self.terragrunt_configs = []

    def _is_ignored_path(self, path: Path) -> bool:
        """Return True when a file is inside ignored/generated directories."""
        return any(part in IGNORED_DIR_NAMES for part in path.parts)

    def find_hcl_files(self) -> List[Path]:
        """Find all .hcl and .tf files in the target directory."""
        hcl_files = []
        for ext in ['*.hcl', '*.tf']:
            for file_path in self.target_dir.rglob(ext):
                if self._is_ignored_path(file_path):
                    continue
                hcl_files.append(file_path)
        return sorted(hcl_files)

    def _record_custom_provider(self, provider_source: str, provider_version: str) -> None:
        """Store custom provider in normalized form."""
        normalized_source = provider_source.strip()
        if not normalized_source:
            return

        version = provider_version.strip() if provider_version else "unspecified"
        if normalized_source not in OFFICIAL_PROVIDERS:
            self.custom_providers[normalized_source].add(version)

    def _extract_required_providers(self, content: str) -> None:
        """Extract provider declarations from required_providers blocks."""
        start_pattern = r'required_providers\s*{'
        matches = list(re.finditer(start_pattern, content, re.MULTILINE))

        for match in matches:
            start_pos = match.end() - 1
            block_content = self._extract_balanced_braces(content, start_pos)
            if not block_content:
                continue

            provider_block_pattern = r'(\w+)\s*=\s*{'
            for provider_match in re.finditer(provider_block_pattern, block_content):
                provider_name = provider_match.group(1)
                provider_start = provider_match.end() - 1
                provider_body = self._extract_balanced_braces(block_content, provider_start)
                if not provider_body:
                    continue

                source_match = re.search(r'source\s*=\s*"([^"]+)"', provider_body)
                version_match = re.search(r'version\s*=\s*"([^"]+)"', provider_body)

                provider_source = source_match.group(1) if source_match else provider_name
                provider_version = version_match.group(1) if version_match else "unspecified"

                self._record_custom_provider(provider_source, provider_version)

    def extract_providers(self, content: str, filepath: str) -> None:
        """Extract provider configurations from HCL content."""
        self._extract_required_providers(content)

        # Also look for standalone provider blocks
        standalone_provider_pattern = r'provider\s+"(\w+)"\s*{([^}]+)}'
        for match in re.finditer(standalone_provider_pattern, content, re.MULTILINE | re.DOTALL):
            provider_name = match.group(1)
            # Try to find version in the block
            version_match = re.search(r'version\s*=\s*"([^"]+)"', match.group(2))
            if version_match:
                version = version_match.group(1)
                self._record_custom_provider(provider_name, version)

        # Check for providers in Terragrunt generate blocks
        # Format: generate "name" { ... contents = <<EOT ... EOT } (supports custom delimiters)
        generate_pattern = r'generate\s+"[^"]+"\s*{.*?contents\s*=\s*<<-?([A-Za-z0-9_]+)\n(.*?)\n\s*\1'
        for match in re.finditer(generate_pattern, content, re.MULTILINE | re.DOTALL):
            generated_content = match.group(2)
            # Recursively extract providers from generated content
            self._extract_providers_from_block(generated_content)

    def _extract_providers_from_block(self, content: str) -> None:
        """Helper to extract providers from a content block."""
        self._extract_required_providers(content)

    def _extract_balanced_braces(self, content: str, start_pos: int) -> str:
        """Extract content within balanced braces starting from start_pos."""
        if start_pos >= len(content) or content[start_pos] != '{':
            return ""

        depth = 0
        for i in range(start_pos, len(content)):
            if content[i] == '{':
                depth += 1
            elif content[i] == '}':
                depth -= 1
                if depth == 0:
                    return content[start_pos+1:i]

        return content[start_pos+1:]  # Return rest if unbalanced

    def extract_modules(self, content: str, filepath: str) -> None:
        """Extract module configurations from HCL content."""
        # Use balanced-brace extraction (same approach as _extract_required_providers) so
        # that module blocks with nested objects before the source attribute are handled
        # correctly.  The old non-greedy regex stopped at the first closing brace it saw,
        # which caused it to miss the source when any nested block appeared first.
        module_start_pattern = r'module\s+"([^"]+)"\s*\{'
        for match in re.finditer(module_start_pattern, content, re.MULTILINE):
            module_name = match.group(1)
            # match.end() points to the character after '{'; step back to land on '{'.
            start_pos = match.end() - 1
            block_content = self._extract_balanced_braces(content, start_pos)
            if not block_content:
                continue

            source_match = re.search(r'source\s*=\s*"([^"]+)"', block_content)
            if not source_match:
                continue

            source = source_match.group(1)
            version_match = re.search(r'version\s*=\s*"([^"]+)"', block_content)
            version = version_match.group(1) if version_match else "latest"

            module_info = {
                'name': module_name,
                'source': source,
                'version': version,
                'file': str(filepath),
                'type': self._categorize_module_source(source)
            }

            # Only add if it's a custom or remote module (not local relative paths)
            if module_info['type'] in ['git', 'registry', 'http', 'custom']:
                self.custom_modules[source].append(module_info)

        # Also check for Terragrunt-style terraform blocks.
        # Format: terraform { source = "tfr://..." }
        # Use balanced-brace extraction here too so that terraform blocks with nested
        # extra_arguments or hook sub-blocks are parsed correctly regardless of attribute
        # order (e.g., root.hcl terraform blocks that have no source should be skipped).
        tf_start_pattern = r'terraform\s*\{'
        for match in re.finditer(tf_start_pattern, content, re.MULTILINE):
            start_pos = match.end() - 1
            block_content = self._extract_balanced_braces(content, start_pos)
            if not block_content:
                continue

            source_match = re.search(r'source\s*=\s*"([^"]+)"', block_content)
            if not source_match:
                continue

            source = source_match.group(1)

            # Parse version from source string (e.g., tfr:///.../module?version=1.0.0)
            version = "latest"
            version_in_source = re.search(r'[?&]version=([^&"]+)', source)
            if version_in_source:
                version = version_in_source.group(1)

            # Parse ref from git sources (e.g., git::...?ref=v1.0.0)
            ref_in_source = re.search(r'[?&]ref=([^&"]+)', source)
            if ref_in_source:
                version = ref_in_source.group(1)

            # Clean the source for categorization
            clean_source = re.sub(r'\?.*$', '', source)

            module_info = {
                'name': Path(filepath).parent.name,  # Use directory name as module name
                'source': clean_source,
                'version': version,
                'file': str(filepath),
                'type': self._categorize_module_source(clean_source)
            }

            if module_info['type'] in ['git', 'registry', 'http', 'custom', 'terragrunt']:
                self.custom_modules[clean_source].append(module_info)

    def _categorize_module_source(self, source: str) -> str:
        """Categorize the module source type."""
        if source.startswith('./') or source.startswith('../'):
            return 'local'
        elif source.startswith('tfr:///'):
            # Terragrunt registry format
            return 'terragrunt'
        elif source.startswith('git::') or 'github.com' in source or 'gitlab.com' in source:
            return 'git'
        elif source.startswith('http://') or source.startswith('https://'):
            return 'http'
        elif '/' in source and not source.startswith('.'):
            # Check if this looks like a provider source (org/name) vs module (org/name/provider)
            # Provider sources have exactly 2 path components (e.g., hashicorp/aws, datadog/datadog)
            # Module sources have 3+ components (e.g., terraform-aws-modules/vpc/aws)
            parts = source.split('/')
            if len(parts) == 2:
                # This looks like a provider source, not a module
                # Filter these out as they're detected separately in extract_providers
                return 'provider'
            else:
                # Likely Terraform Registry format (e.g., terraform-aws-modules/vpc/aws)
                return 'registry'
        else:
            return 'custom'

    def analyze_directory(self) -> None:
        """Analyze all HCL files in the target directory."""
        hcl_files = self.find_hcl_files()

        if not hcl_files:
            print(f"No .hcl or .tf files found in {self.target_dir}", file=sys.stderr)
            return

        for filepath in hcl_files:
            try:
                with open(filepath, 'r', encoding='utf-8') as f:
                    content = f.read()
                    self.extract_providers(content, filepath)
                    self.extract_modules(content, filepath)
            except Exception as e:
                print(f"Error reading {filepath}: {e}", file=sys.stderr)

    def generate_report(self, output_format: str = 'text') -> str:
        """Generate a report of custom resources found."""
        if output_format == 'json':
            return self._generate_json_report()
        else:
            return self._generate_text_report()

    def _generate_json_report(self) -> str:
        """Generate JSON format report."""
        report = {
            'custom_providers': {
                provider: sorted(list(versions))
                for provider, versions in sorted(self.custom_providers.items())
            },
            'custom_modules': {
                source: modules
                for source, modules in sorted(self.custom_modules.items())
            }
        }
        return json.dumps(report, indent=2)

    def _generate_text_report(self) -> str:
        """Generate human-readable text report."""
        lines = []
        lines.append("=" * 80)
        lines.append("Terragrunt Custom Resource Detection Report")
        lines.append("=" * 80)
        lines.append("")

        # Custom Providers Section
        if self.custom_providers:
            lines.append("CUSTOM PROVIDERS DETECTED:")
            lines.append("-" * 80)
            for provider, versions in sorted(self.custom_providers.items()):
                lines.append(f"\nProvider: {provider}")
                lines.append(f"  Versions: {', '.join(sorted(versions))}")
                lines.append(f"  → Action: Resolve with Context7 library lookup:")
                lines.append(f"            mcp__context7__resolve-library-id (libraryName: \"{provider} terraform provider\")")
                lines.append(f"            mcp__context7__query-docs (query: \"authentication and configuration\")")
                lines.append(f"            or search web: '{provider} terraform provider documentation'")
            lines.append("")
        else:
            lines.append("CUSTOM PROVIDERS: None detected")
            lines.append("")

        # Custom Modules Section
        if self.custom_modules:
            lines.append("CUSTOM MODULES DETECTED:")
            lines.append("-" * 80)
            for source, modules in sorted(self.custom_modules.items()):
                module_info = modules[0]  # Take first occurrence for details
                lines.append(f"\nModule Source: {source}")
                lines.append(f"  Type: {module_info['type']}")
                lines.append(f"  Version: {module_info['version']}")
                lines.append(f"  Used in: {module_info['file']}")
                lines.append(f"  Used {len(modules)} time(s)")

                # Provide search guidance based on module type
                if module_info['type'] == 'git':
                    clean_source = source.replace('git::', '')
                    lines.append(f"  → Action: Search repository docs for '{clean_source}'")
                elif module_info['type'] == 'registry' or module_info['type'] == 'terragrunt':
                    # Clean up tfr:/// prefix for registry lookup
                    clean_source = source.replace('tfr:///', '')
                    registry_source = clean_source.split('//')[0]
                    lines.append(f"  → Action: Visit https://registry.terraform.io/modules/{registry_source}")
                    lines.append(f"            and resolve with Context7: \"{registry_source}\"")
                else:
                    lines.append(f"  → Action: Search for documentation related to this module source")
            lines.append("")
        else:
            lines.append("CUSTOM MODULES: None detected")
            lines.append("")

        # Summary
        lines.append("=" * 80)
        lines.append("SUMMARY")
        lines.append("=" * 80)
        lines.append(f"Custom Providers: {len(self.custom_providers)}")
        lines.append(f"Custom Modules: {len(self.custom_modules)}")
        lines.append("")

        if self.custom_providers or self.custom_modules:
            lines.append("RECOMMENDED ACTIONS:")
            lines.append("1. Use WebSearch to look up documentation for each custom resource")
            lines.append("2. Pay attention to version compatibility")
            lines.append("3. Review provider/module documentation for required configuration")
            lines.append("4. Check for any known issues or breaking changes")
        else:
            lines.append("No custom providers or modules detected.")
            lines.append("All resources appear to be standard HashiCorp providers or local modules.")
        lines.append("")

        return "\n".join(lines)


def main():
    parser = argparse.ArgumentParser(
        description='Detect custom providers and modules in Terragrunt/Terraform configurations'
    )
    parser.add_argument(
        'directory',
        nargs='?',
        default='.',
        help='Directory to analyze (default: current directory)'
    )
    parser.add_argument(
        '--format',
        choices=['text', 'json'],
        default='text',
        help='Output format (default: text)'
    )

    args = parser.parse_args()

    detector = ResourceDetector(args.directory)
    detector.analyze_directory()
    report = detector.generate_report(args.format)
    print(report)


if __name__ == '__main__':
    main()

#!/usr/bin/env bash
#
# Deterministic CI entrypoint for terragrunt-validator.
# Runs syntax checks plus regression tests that do not depend on cloud access.

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
readonly SCRIPT_DIR
SKILL_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
readonly SKILL_DIR

VALIDATOR_SCRIPT="$SKILL_DIR/scripts/validate_terragrunt.sh"
DETECTOR_SCRIPT="$SKILL_DIR/scripts/detect_custom_resources.py"
SHELL_REGRESSION_TEST="$SKILL_DIR/test/test_validate_terragrunt.sh"
PYTHON_REGRESSION_TEST="$SKILL_DIR/test/test_detect_custom_resources.py"
SELF_SCRIPT="$SCRIPT_DIR/$(basename "${BASH_SOURCE[0]}")"

usage() {
    cat <<'EOF'
Usage: run_ci_checks.sh [OPTIONS]

Deterministic CI checks for terragrunt-validator.

Options:
  --require-shellcheck   Fail when shellcheck is unavailable.
  --skip-shellcheck      Skip shellcheck stage.
  -h, --help             Show this help message.

Environment:
  CI=true|1              Defaults to --require-shellcheck unless overridden.
EOF
}

is_true() {
    local value="${1:-}"
    [[ "$value" == "true" || "$value" == "1" ]]
}

main() {
    local require_shellcheck=0
    local skip_shellcheck=0
    local shellcheck_overridden=0

    while [[ $# -gt 0 ]]; do
        case "$1" in
            --require-shellcheck)
                require_shellcheck=1
                skip_shellcheck=0
                shellcheck_overridden=1
                ;;
            --skip-shellcheck)
                skip_shellcheck=1
                require_shellcheck=0
                shellcheck_overridden=1
                ;;
            -h|--help)
                usage
                exit 0
                ;;
            *)
                echo "Error: unknown option '$1'" >&2
                usage
                exit 1
                ;;
        esac
        shift
    done

    if [[ "$shellcheck_overridden" -eq 0 ]] && is_true "${CI:-}"; then
        require_shellcheck=1
    fi

    if [[ "$skip_shellcheck" -eq 1 && "$require_shellcheck" -eq 1 ]]; then
        echo "Error: --skip-shellcheck and --require-shellcheck cannot be combined." >&2
        exit 1
    fi

    export LC_ALL=C
    export LANG=C
    export TZ=UTC

    echo "[1/5] bash syntax checks"
    bash -n "$VALIDATOR_SCRIPT" "$SHELL_REGRESSION_TEST" "$SELF_SCRIPT"

    echo "[2/5] python syntax checks"
    python3 -m py_compile "$DETECTOR_SCRIPT" "$PYTHON_REGRESSION_TEST"

    echo "[3/5] python regression tests"
    python3 "$PYTHON_REGRESSION_TEST"

    echo "[4/5] shell regression tests"
    bash "$SHELL_REGRESSION_TEST"

    echo "[5/5] shellcheck"
    if [[ "$skip_shellcheck" -eq 1 ]]; then
        echo "ShellCheck: SKIP (--skip-shellcheck)"
    elif command -v shellcheck >/dev/null 2>&1; then
        shellcheck "$VALIDATOR_SCRIPT" "$SHELL_REGRESSION_TEST" "$SELF_SCRIPT"
        echo "ShellCheck: PASS"
    elif [[ "$require_shellcheck" -eq 1 ]]; then
        echo "ShellCheck: required but not installed" >&2
        exit 1
    else
        echo "ShellCheck: SKIP (not installed; use --require-shellcheck to enforce)"
    fi

    echo "PASS: terragrunt-validator CI checks"
}

main "$@"

#!/bin/bash

# Terragrunt Validation Script
# This script performs comprehensive validation of Terragrunt configurations including:
# - HCL formatting checks
# - HCL input validation (new in 0.93+)
# - Terragrunt validation
# - Terraform validation
# - Linting with tflint
# - Security scanning with Trivy (preferred) or tfsec (legacy)
# - Dependency graph validation
#
# Designed for Terragrunt 0.93+ with the new CLI redesign

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Configuration
TARGET_DIR_INPUT="${1:-.}"
# Convert to absolute path when target exists, keep input value otherwise
# so main() can print a friendly, consistent error message.
if [[ -d "$TARGET_DIR_INPUT" ]]; then
    TARGET_DIR=$(cd "$TARGET_DIR_INPUT" && pwd)
else
    TARGET_DIR="$TARGET_DIR_INPUT"
fi
SKIP_PLAN="${SKIP_PLAN:-false}"
SKIP_SECURITY="${SKIP_SECURITY:-false}"
SKIP_LINT="${SKIP_LINT:-false}"
SKIP_INPUT_VALIDATION="${SKIP_INPUT_VALIDATION:-false}"
SKIP_INIT="${SKIP_INIT:-false}"
SKIP_BACKEND_INIT="${SKIP_BACKEND_INIT:-false}"
SOFT_FAIL_SECURITY="${SOFT_FAIL_SECURITY:-false}"

# Security scanner preference (trivy, tfsec, checkov, or auto)
SECURITY_SCANNER="${SECURITY_SCANNER:-auto}"

# Build strict mode flag
STRICT_FLAG=""
if [[ "${TG_STRICT_MODE:-false}" == "true" ]]; then
    STRICT_FLAG="--strict-mode"
fi

print_header() {
    echo -e "\n${BLUE}===================================${NC}"
    echo -e "${BLUE}$1${NC}"
    echo -e "${BLUE}===================================${NC}\n"
}

print_success() {
    echo -e "${GREEN}✓ $1${NC}"
}

print_error() {
    echo -e "${RED}✗ $1${NC}"
}

print_warning() {
    echo -e "${YELLOW}⚠ $1${NC}"
}

print_info() {
    echo -e "${BLUE}ℹ $1${NC}"
}

# Detect execution mode from Terragrunt files in target directory.
# Modes:
# - multi: nested terragrunt units exist
# - single: current dir is a single Terragrunt unit
# - root-only: root.hcl exists but no unit in current directory
# - none: no recognizable Terragrunt config found
detect_target_mode() {
    local has_direct_terragrunt=false
    local has_nested_terragrunt=false

    if [[ -f "$TARGET_DIR/terragrunt.hcl" || -f "$TARGET_DIR/terragrunt.stack.hcl" ]]; then
        has_direct_terragrunt=true
    fi

    if find "$TARGET_DIR" -mindepth 2 -type f \
        \( -name "terragrunt.hcl" -o -name "terragrunt.stack.hcl" \) \
        ! -path "*/.terragrunt-cache/*" | grep -q .; then
        has_nested_terragrunt=true
    fi

    if [[ "$has_nested_terragrunt" == "true" ]]; then
        echo "multi"
    elif [[ "$has_direct_terragrunt" == "true" ]]; then
        echo "single"
    elif [[ -f "$TARGET_DIR/root.hcl" ]]; then
        echo "root-only"
    else
        echo "none"
    fi
}

# Check if required tools are installed
check_dependencies() {
    print_header "Checking Dependencies"

    local missing_tools=()

    if ! command -v terragrunt &> /dev/null; then
        missing_tools+=("terragrunt")
    else
        local tg_version
        tg_version=$(terragrunt --version | head -n1)
        print_success "terragrunt $tg_version"

        # Check if version is >= 0.93 for new CLI
        if [[ "$tg_version" =~ v0\.([0-9]+) ]]; then
            local minor_version="${BASH_REMATCH[1]}"
            if (( minor_version < 93 )); then
                print_warning "Terragrunt version < 0.93 detected. Some new CLI features may not work."
                print_info "Consider upgrading to 0.93+ for best compatibility."
            fi
        fi
    fi

    if ! command -v terraform &> /dev/null; then
        if command -v tofu &> /dev/null; then
            print_success "opentofu $(tofu version -json 2>/dev/null | jq -r '.terraform_version' 2>/dev/null || tofu --version | head -n1)"
        else
            missing_tools+=("terraform or opentofu")
        fi
    else
        print_success "terraform $(terraform version -json 2>/dev/null | jq -r '.terraform_version' 2>/dev/null || terraform --version | head -n1)"
    fi

    if [[ "$SKIP_LINT" != "true" ]] && ! command -v tflint &> /dev/null; then
        print_warning "tflint not found - skipping lint checks"
        SKIP_LINT=true
    elif [[ "$SKIP_LINT" != "true" ]]; then
        print_success "tflint $(tflint --version | head -n1)"
    fi

    # Check for security scanners
    if [[ "$SKIP_SECURITY" != "true" ]]; then
        local found_scanner=false

        if [[ "$SECURITY_SCANNER" == "auto" ]] || [[ "$SECURITY_SCANNER" == "trivy" ]]; then
            if command -v trivy &> /dev/null; then
                print_success "trivy $(trivy --version 2>&1 | head -n1)"
                SECURITY_SCANNER="trivy"
                found_scanner=true
            fi
        fi

        if [[ "$found_scanner" == "false" ]] && { [[ "$SECURITY_SCANNER" == "auto" ]] || [[ "$SECURITY_SCANNER" == "checkov" ]]; }; then
            if command -v checkov &> /dev/null; then
                print_success "checkov $(checkov --version 2>&1 | head -n1)"
                SECURITY_SCANNER="checkov"
                found_scanner=true
            fi
        fi

        if [[ "$found_scanner" == "false" ]] && { [[ "$SECURITY_SCANNER" == "auto" ]] || [[ "$SECURITY_SCANNER" == "tfsec" ]]; }; then
            if command -v tfsec &> /dev/null; then
                print_warning "tfsec found but is deprecated - consider migrating to Trivy"
                print_success "tfsec $(tfsec --version 2>&1 | head -n1)"
                SECURITY_SCANNER="tfsec"
                found_scanner=true
            fi
        fi

        if [[ "$found_scanner" == "false" ]]; then
            print_warning "No security scanner found (trivy, checkov, or tfsec) - skipping security checks"
            print_info "Install trivy: brew install trivy (macOS) or see https://trivy.dev"
            SKIP_SECURITY=true
        fi
    fi

    if [ ${#missing_tools[@]} -ne 0 ]; then
        print_error "Missing required tools: ${missing_tools[*]}"
        echo -e "\nInstallation instructions:"
        for tool in "${missing_tools[@]}"; do
            case $tool in
                terragrunt)
                    echo "  - terragrunt: https://terragrunt.gruntwork.io/docs/getting-started/install/"
                    ;;
                "terraform or opentofu")
                    echo "  - terraform: https://developer.hashicorp.com/terraform/downloads"
                    echo "  - opentofu: https://opentofu.org/docs/intro/install/"
                    ;;
            esac
        done
        exit 1
    fi
}

# Format check
format_check() {
    print_header "HCL Format Check"

    cd "$TARGET_DIR"

    # Try new command first, fall back to old if needed
    if terragrunt hcl fmt --check 2>/dev/null; then
        print_success "All HCL files are properly formatted"
    elif terragrunt hcl format --check 2>/dev/null; then
        print_success "All HCL files are properly formatted"
    else
        print_error "HCL files are not properly formatted"
        echo -e "\nRun 'terragrunt hcl fmt' to fix formatting issues"
        return 1
    fi
}

# Validate HCL inputs (new in Terragrunt 0.93+)
validate_inputs() {
    print_header "HCL Input Validation"

    cd "$TARGET_DIR"

    local mode
    mode=$(detect_target_mode)
    local -a validate_cmd=()

    if [[ "$mode" == "multi" ]]; then
        validate_cmd=(terragrunt hcl validate --inputs --all)
        print_info "Running input validation across all units..."
    elif [[ "$mode" == "single" ]]; then
        validate_cmd=(terragrunt hcl validate --inputs)
        print_info "Running input validation on single unit..."
    elif [[ "$mode" == "root-only" ]]; then
        print_warning "No terragrunt.hcl in current directory for input validation"
        print_info "Root-only directory detected (root.hcl). Run this script in a unit directory or keep multi-unit layout."
        return 0
    else
        print_warning "No terragrunt.hcl files found for input validation"
        return 0
    fi

    # Run the validation command
    local output
    if output=$("${validate_cmd[@]}" 2>&1); then
        print_success "All inputs validated successfully"
    else
        local exit_code=$?
        # Check if it's a "command not found" error (127) or actual validation failure
        if [[ $exit_code -eq 127 ]]; then
            print_warning "Input validation command not available"
            print_info "This feature requires Terragrunt 0.93+"
        elif echo "$output" | grep -q "unknown command\|unknown flag"; then
            print_warning "Input validation not supported in this Terragrunt version"
            print_info "This feature requires Terragrunt 0.93+"
        else
            # Show the actual error for debugging
            echo "$output" | head -20
            print_warning "Input validation completed with warnings or errors"
            # Don't fail the entire validation for input warnings
        fi
    fi
}

# Validate Terragrunt configuration syntax
# Uses 'terragrunt hcl validate' which checks HCL structure without requiring
# Terraform providers or remote credentials.  This is distinct from format_check()
# (whitespace/indentation) and validate_inputs() (variable alignment).
validate_terragrunt() {
    print_header "Terragrunt Configuration Check"

    cd "$TARGET_DIR"

    # Check if .hcl files exist (exclude cache dirs to avoid false positives)
    if ! find . -name "*.hcl" -type f ! -path "*/.terragrunt-cache/*" | grep -q .; then
        print_error "No .hcl files found in $TARGET_DIR"
        return 1
    fi

    local mode
    mode=$(detect_target_mode)
    local -a validate_cmd=(terragrunt hcl validate)

    case "$mode" in
        multi)
            validate_cmd+=(--all)
            print_info "Multi-unit directory detected, validating all units..."
            ;;
        single)
            print_info "Single-unit directory detected, validating current unit..."
            ;;
        root-only)
            print_warning "No terragrunt.hcl in current directory for syntax validation"
            print_info "Root-only directory detected (root.hcl). Run this script in a unit directory or keep multi-unit layout."
            return 0
            ;;
        *)
            print_error "No Terragrunt configuration files found in $TARGET_DIR"
            return 1
            ;;
    esac

    local output
    if output=$("${validate_cmd[@]}" 2>&1); then
        print_success "Terragrunt HCL syntax is valid"
    else
        local hcl_exit=$?

        # Compatibility fallback for Terragrunt variants where hcl validate
        # exists but does not accept --all.
        if [[ "$mode" == "multi" ]] && echo "$output" | grep -qi "unknown flag.*--all"; then
            print_warning "Terragrunt does not support 'hcl validate --all'; falling back to single-command validation"
            if output=$(terragrunt hcl validate 2>&1); then
                print_success "Terragrunt HCL syntax is valid (fallback path)"
                return 0
            fi
            hcl_exit=$?
        fi

        # Command not found (127) or unknown command means pre-0.93 Terragrunt.
        # Fall back to format check as a best-effort proxy — it at least catches
        # structural HCL errors even though it is not a pure syntax validator.
        if [[ $hcl_exit -eq 127 ]] || echo "$output" | grep -q "unknown command"; then
            print_warning "terragrunt hcl validate not available (requires 0.93+), using format check as proxy"
            if terragrunt hcl fmt --check > /dev/null 2>&1 || terragrunt hcl format --check > /dev/null 2>&1; then
                print_success "Terragrunt configuration syntax appears valid (format check passed)"
            else
                print_warning "Configuration files may have formatting or syntax issues"
            fi
        else
            print_error "Terragrunt HCL syntax validation failed"
            echo "$output" | head -20
            return 1
        fi
    fi
}

# Validate Terraform configuration
validate_terraform() {
    print_header "Terraform Validation"

    cd "$TARGET_DIR"

    local mode
    mode=$(detect_target_mode)

    # For multi-unit directories, run init+validate across all units.
    if [[ "$mode" == "multi" ]]; then
        print_info "Multi-unit directory detected, using 'run --all validate'"

        if [[ "$SKIP_INIT" != "true" ]]; then
            local -a multi_init_cmd=(terragrunt)
            if [[ -n "$STRICT_FLAG" ]]; then
                multi_init_cmd+=("$STRICT_FLAG")
            fi
            multi_init_cmd+=(run --all init)

            if [[ "$SKIP_BACKEND_INIT" == "true" ]]; then
                multi_init_cmd+=("-backend=false")
                print_info "Backend initialization disabled for multi-unit init"
            fi

            if ! "${multi_init_cmd[@]}" 2>&1; then
                print_error "Terraform initialization failed across one or more units"
                return 1
            fi
        else
            print_info "Skipping terraform init step (SKIP_INIT=true)"
        fi

        local -a multi_validate_cmd=(terragrunt)
        if [[ -n "$STRICT_FLAG" ]]; then
            multi_validate_cmd+=("$STRICT_FLAG")
        fi
        multi_validate_cmd+=(run --all validate)

        if "${multi_validate_cmd[@]}" 2>&1; then
            print_success "Terraform configuration is valid across all units"
        else
            print_error "Terraform validation failed across one or more units"
            return 1
        fi
        return 0
    fi

    # For single unit directories
    if [[ "$mode" == "single" ]]; then
        # Initialize if needed unless explicitly skipped.
        if [[ "$SKIP_INIT" != "true" ]] && [ ! -d ".terraform" ] && [ ! -d ".terragrunt-cache" ]; then
            echo "Initializing Terraform..."
            local -a single_init_cmd=(terragrunt)
            if [[ -n "$STRICT_FLAG" ]]; then
                single_init_cmd+=("$STRICT_FLAG")
            fi
            single_init_cmd+=(init)
            if [[ "$SKIP_BACKEND_INIT" == "true" ]]; then
                single_init_cmd+=("-backend=false")
                print_info "Backend initialization disabled for single-unit init"
            fi

            if ! "${single_init_cmd[@]}" 2>&1; then
                print_error "Terraform initialization failed"
                return 1
            fi
        elif [[ "$SKIP_INIT" == "true" ]]; then
            print_info "Skipping terraform init step (SKIP_INIT=true)"
        fi

        local -a single_validate_cmd=(terragrunt)
        if [[ -n "$STRICT_FLAG" ]]; then
            single_validate_cmd+=("$STRICT_FLAG")
        fi
        single_validate_cmd+=(validate)

        if "${single_validate_cmd[@]}" 2>&1; then
            print_success "Terraform configuration is valid"
        else
            print_error "Terraform validation failed"
            return 1
        fi
    elif [[ "$mode" == "root-only" ]]; then
        print_warning "No terragrunt.hcl found for Terraform validation"
        print_info "Root-only directory detected (root.hcl). Run this script from a unit directory or a multi-unit parent."
    else
        print_error "No Terragrunt configuration files found in $TARGET_DIR"
        return 1
    fi
}

# Run tflint
run_tflint() {
    print_header "TFLint Analysis"

    cd "$TARGET_DIR"

    # Initialize tflint if .tflint.hcl exists
    if [ -f ".tflint.hcl" ]; then
        tflint --init 2>/dev/null || true
    fi

    if tflint --recursive 2>&1; then
        print_success "No linting issues found"
    else
        print_error "Linting issues detected"
        return 1
    fi
}

# Run security scan with the available scanner
run_security_scan() {
    print_header "Security Scan ($SECURITY_SCANNER)"

    cd "$TARGET_DIR"

    case "$SECURITY_SCANNER" in
        trivy)
            print_info "Using Trivy (recommended) for security scanning"
            if trivy config . --severity HIGH,CRITICAL --exit-code 1 2>&1; then
                print_success "No critical security issues found"
            else
                if [[ "$SOFT_FAIL_SECURITY" == "true" ]]; then
                    print_warning "Security issues detected but not failing build (SOFT_FAIL_SECURITY=true)"
                else
                    print_error "Security issues detected"
                    return 1
                fi
            fi
            ;;
        checkov)
            print_info "Using Checkov for security scanning"
            if checkov -d . --framework terraform 2>&1; then
                print_success "No critical security issues found"
            else
                if [[ "$SOFT_FAIL_SECURITY" == "true" ]]; then
                    print_warning "Security issues detected but not failing build (SOFT_FAIL_SECURITY=true)"
                else
                    print_error "Security issues detected"
                    return 1
                fi
            fi
            ;;
        tfsec)
            print_warning "Using tfsec (deprecated) - consider migrating to Trivy"
            print_info "Migration guide: https://github.com/aquasecurity/tfsec/blob/master/tfsec-to-trivy-migration-guide.md"
            if tfsec . 2>&1; then
                print_success "No critical security issues found"
            else
                if [[ "$SOFT_FAIL_SECURITY" == "true" ]]; then
                    print_warning "Security issues detected but not failing build (SOFT_FAIL_SECURITY=true)"
                else
                    print_error "Security issues detected"
                    return 1
                fi
            fi
            ;;
        *)
            print_warning "Unknown security scanner: $SECURITY_SCANNER"
            return 1
            ;;
    esac
}

# Generate and validate dependency graph
validate_dependencies() {
    print_header "Dependency Graph Validation"

    cd "$TARGET_DIR"

    # Check if dependencies are properly configured
    if find . -name "*.hcl" -type f ! -path "*/.terragrunt-cache/*" -exec grep -l "dependency" {} \; | grep -q .; then
        print_success "Dependency blocks found in configuration"

        # Try to generate DAG graph (new in 0.93+)
        if terragrunt dag graph > /dev/null 2>&1; then
            print_success "Dependency graph is valid (no cycles detected)"
        else
            print_info "Could not generate dependency graph"
            print_info "Use 'terragrunt run --all plan' to validate dependency resolution"
        fi
    else
        print_success "No dependencies to validate"
    fi
}

# Dry-run plan
run_plan() {
    print_header "Terragrunt Plan (Dry-Run)"

    cd "$TARGET_DIR"

    if [[ -n "$STRICT_FLAG" ]]; then
        print_info "Running with strict mode enabled"
    fi

    local mode
    mode=$(detect_target_mode)

    if [[ "$mode" == "multi" ]]; then
        echo "Running terragrunt run --all plan..."
        local -a plan_cmd=(terragrunt)
        if [[ -n "$STRICT_FLAG" ]]; then
            plan_cmd+=("$STRICT_FLAG")
        fi
        plan_cmd+=(run --all plan)

        if "${plan_cmd[@]}" 2>&1; then
            print_success "Plan generated successfully across all units"
        else
            print_error "Plan generation failed across one or more units"
            return 1
        fi
    elif [[ "$mode" == "single" ]]; then
        echo "Running terragrunt plan..."
        local -a plan_cmd=(terragrunt)
        if [[ -n "$STRICT_FLAG" ]]; then
            plan_cmd+=("$STRICT_FLAG")
        fi
        plan_cmd+=(plan -out=tfplan)

        if "${plan_cmd[@]}" 2>&1; then
            print_success "Plan generated successfully"
            echo -e "\nTo review the plan, run:"
            echo "  terragrunt show tfplan"
        else
            print_error "Plan generation failed"
            return 1
        fi
    else
        print_warning "No unit terragrunt.hcl found for plan step"
        print_info "Skipping plan in non-unit directory"
    fi
}

# Main execution
main() {
    echo -e "${BLUE}╔═══════════════════════════════════════╗${NC}"
    echo -e "${BLUE}║   Terragrunt Validation Suite         ║${NC}"
    echo -e "${BLUE}║   (Designed for Terragrunt 0.93+)     ║${NC}"
    echo -e "${BLUE}╚═══════════════════════════════════════╝${NC}"

    if [[ -n "$STRICT_FLAG" ]]; then
        print_info "Strict mode enabled - deprecated features will cause errors"
    fi

    if [[ ! -d "$TARGET_DIR" ]]; then
        print_error "Target directory does not exist: $TARGET_DIR"
        exit 1
    fi

    check_dependencies

    local exit_code=0

    # Run all checks
    format_check || exit_code=$?

    if [[ "$SKIP_INPUT_VALIDATION" != "true" ]]; then
        validate_inputs || true  # Don't fail on input validation (may not be available)
    fi

    validate_terragrunt || exit_code=$?
    validate_terraform || exit_code=$?

    if [[ "$SKIP_LINT" != "true" ]]; then
        run_tflint || exit_code=$?
    fi

    if [[ "$SKIP_SECURITY" != "true" ]]; then
        run_security_scan || exit_code=$?
    fi

    validate_dependencies || exit_code=$?

    if [[ "$SKIP_PLAN" != "true" ]]; then
        run_plan || exit_code=$?
    fi

    # Summary
    print_header "Validation Summary"
    if [ $exit_code -eq 0 ]; then
        print_success "All validation checks passed!"
    else
        print_error "Some validation checks failed. Please review the output above."
    fi

    exit $exit_code
}

# Show usage if --help is passed
if [[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
    echo "Usage: $0 [TARGET_DIR]"
    echo ""
    echo "Validates Terragrunt configurations with comprehensive checks."
    echo "Designed for Terragrunt 0.93+ with the new CLI redesign."
    echo ""
    echo "Options:"
    echo "  TARGET_DIR              Directory containing Terragrunt files (default: current directory)"
    echo ""
    echo "Environment Variables:"
    echo "  SKIP_PLAN=true          Skip the terragrunt plan step"
    echo "  SKIP_SECURITY=true      Skip security scanning"
    echo "  SKIP_LINT=true          Skip linting with tflint"
    echo "  SKIP_INPUT_VALIDATION=true  Skip HCL input validation"
    echo "  SKIP_INIT=true          Skip terraform init step before validate"
    echo "  SKIP_BACKEND_INIT=true  Run terraform init with -backend=false"
    echo "  SOFT_FAIL_SECURITY=true Do not fail on scanner findings"
    echo "  SECURITY_SCANNER=X      Force specific scanner: trivy, checkov, tfsec, or auto (default)"
    echo "  TG_STRICT_MODE=true     Enable Terragrunt strict mode (errors on deprecated features)"
    echo ""
    echo "Security Scanners (in order of preference):"
    echo "  trivy   - Recommended, actively maintained (replaces tfsec)"
    echo "  checkov - Alternative with 750+ built-in policies"
    echo "  tfsec   - Legacy, deprecated (merged into Trivy)"
    echo ""
    echo "Examples:"
    echo "  $0                                    # Validate current directory"
    echo "  $0 ./infrastructure                   # Validate specific directory"
    echo "  SKIP_PLAN=true $0                     # Skip plan generation"
    echo "  SECURITY_SCANNER=trivy $0             # Force Trivy for security"
    echo "  SKIP_BACKEND_INIT=true $0             # Avoid remote backend auth during init"
    echo "  TG_STRICT_MODE=true $0                # Enable strict mode"
    exit 0
fi

main

# Common variables shared across all environments

locals {
  # AWS Region
  region = "us-east-1"

  # Availability zones
  availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"]

  # VPC CIDR blocks per environment
  vpc_cidrs = {
    dev     = "10.0.0.0/16"
    staging = "10.1.0.0/16"
    prod    = "10.2.0.0/16"
  }

  # Common resource naming convention
  name_prefix = "myapp"

  # Backup retention periods
  backup_retention = {
    dev     = 7
    staging = 14
    prod    = 30
  }

  # Instance sizes per environment
  instance_sizes = {
    dev = {
      database = "db.t3.micro"
      cache    = "cache.t3.micro"
      app      = "t3.small"
    }
    staging = {
      database = "db.t3.small"
      cache    = "cache.t3.small"
      app      = "t3.medium"
    }
    prod = {
      database = "db.r6g.large"
      cache    = "cache.r6g.large"
      app      = "t3.large"
    }
  }

  # Multi-AZ configuration
  multi_az = {
    dev     = false
    staging = false
    prod    = true
  }

  # High availability configuration
  ha_config = {
    dev = {
      min_size     = 1
      max_size     = 2
      desired_size = 1
    }
    staging = {
      min_size     = 1
      max_size     = 3
      desired_size = 2
    }
    prod = {
      min_size     = 2
      max_size     = 10
      desired_size = 3
    }
  }
}

# Application ECS Configuration for Development

include "root" {
  path = find_in_parent_folders("root.hcl")
}

terraform {
  source = "tfr:///terraform-aws-modules/ecs/aws?version=5.7.0"
}

# Dependencies
dependency "vpc" {
  config_path = "../vpc"

  mock_outputs = {
    vpc_id             = "vpc-mock-123456"
    private_subnet_ids = ["subnet-mock-1", "subnet-mock-2"]
  }

  mock_outputs_allowed_terraform_commands = ["validate", "plan", "init"]
}

dependency "database" {
  config_path = "../database"

  mock_outputs = {
    db_instance_endpoint = "mock-db-endpoint.rds.amazonaws.com:5432"
    db_instance_name     = "myappdb"
  }

  mock_outputs_allowed_terraform_commands = ["validate", "plan", "init"]
}

dependency "cache" {
  config_path = "../cache"

  mock_outputs = {
    endpoint = "mock-redis-endpoint.cache.amazonaws.com:6379"
  }

  mock_outputs_allowed_terraform_commands = ["validate", "plan", "init"]
}

locals {
  common = read_terragrunt_config(find_in_parent_folders("common.hcl"))
}

inputs = {
  cluster_name = "${local.common.locals.name_prefix}-dev-cluster"

  cluster_configuration = {
    execute_command_configuration = {
      logging = "OVERRIDE"
      log_configuration = {
        cloud_watch_log_group_name = "/aws/ecs/${local.common.locals.name_prefix}-dev"
      }
    }
  }

  # Fargate capacity providers
  fargate_capacity_providers = {
    FARGATE = {
      default_capacity_provider_strategy = {
        weight = 50
        base   = 20
      }
    }
    FARGATE_SPOT = {
      default_capacity_provider_strategy = {
        weight = 50
      }
    }
  }

  # Service configuration
  services = {
    myapp = {
      cpu    = 512
      memory = 1024

      container_definitions = {
        app = {
          cpu       = 512
          memory    = 1024
          essential = true
          image     = "nginx:latest"

          port_mappings = [
            {
              name          = "http"
              containerPort = 80
              hostPort      = 80
              protocol      = "tcp"
            }
          ]

          environment = [
            {
              name  = "DATABASE_ENDPOINT"
              value = dependency.database.outputs.db_instance_endpoint
            },
            {
              name  = "REDIS_ENDPOINT"
              value = dependency.cache.outputs.endpoint
            },
            {
              name  = "ENVIRONMENT"
              value = "dev"
            }
          ]

          readonly_root_filesystem = false
        }
      }

      subnet_ids = dependency.vpc.outputs.private_subnet_ids

      security_group_rules = {
        ingress_http = {
          type        = "ingress"
          from_port   = 80
          to_port     = 80
          protocol    = "tcp"
          cidr_blocks = ["10.0.0.0/16"]
        }
      }
    }
  }

  tags = {
    Module = "app"
  }
}

# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
terraform {
  backend "s3" {
    bucket         = "terraform-state-123456789012"
    dynamodb_table = "terraform-locks"
    encrypt        = true
    key            = "dev/terraform.tfstate"
    region         = "us-east-1"
  }
}

# ElastiCache Redis Configuration for Development

include "root" {
  path = find_in_parent_folders("root.hcl")
}

terraform {
  # Using a Git module source to test custom module detection
  source = "git::https://github.com/cloudposse/terraform-aws-elasticache-redis.git?ref=0.52.0"
}

# Dependency on VPC
dependency "vpc" {
  config_path = "../vpc"

  mock_outputs = {
    vpc_id             = "vpc-mock-123456"
    private_subnet_ids = ["subnet-mock-1", "subnet-mock-2", "subnet-mock-3"]
  }

  mock_outputs_allowed_terraform_commands = ["validate", "plan", "init"]
}

locals {
  common = read_terragrunt_config(find_in_parent_folders("common.hcl"))
}

inputs = {
  name      = "${local.common.locals.name_prefix}-dev-redis"
  namespace = "myapp"
  stage     = "dev"

  vpc_id  = dependency.vpc.outputs.vpc_id
  subnets = dependency.vpc.outputs.private_subnet_ids

  cluster_size               = 1
  instance_type              = "cache.t3.micro"
  engine_version             = "7.0"
  family                     = "redis7"
  at_rest_encryption_enabled = true
  transit_encryption_enabled = true

  automatic_failover_enabled = false
  multi_az_enabled           = false

  parameter = [
    {
      name  = "maxmemory-policy"
      value = "allkeys-lru"
    }
  ]

  tags = {
    Module = "cache"
  }
}

# RDS Database Configuration for Development

include "root" {
  path = find_in_parent_folders("root.hcl")
}

terraform {
  source = "tfr:///terraform-aws-modules/rds/aws?version=6.3.0"
}

# Dependency on VPC
dependency "vpc" {
  config_path = "../vpc"

  mock_outputs = {
    vpc_id                     = "vpc-mock-123456"
    database_subnet_ids        = ["subnet-mock-1", "subnet-mock-2", "subnet-mock-3"]
    database_subnet_group_name = "mock-subnet-group"
  }

  mock_outputs_allowed_terraform_commands = ["validate", "plan", "init"]
  mock_outputs_merge_strategy_with_state  = "shallow"
}

locals {
  common  = read_terragrunt_config(find_in_parent_folders("common.hcl"))
  db_name = "myappdb"
}

inputs = {
  identifier = "${local.common.locals.name_prefix}-dev-db"

  engine               = "postgres"
  engine_version       = "15.4"
  family               = "postgres15"
  major_engine_version = "15"
  instance_class       = local.common.locals.instance_sizes["dev"]["database"]

  allocated_storage     = 20
  max_allocated_storage = 100

  db_name  = local.db_name
  username = "dbadmin"
  port     = 5432

  # Use VPC outputs
  db_subnet_group_name   = dependency.vpc.outputs.database_subnet_group_name
  vpc_security_group_ids = [] # Should create security group

  multi_az                = false
  deletion_protection     = false
  backup_retention_period = 7
  skip_final_snapshot     = true

  enabled_cloudwatch_logs_exports = ["postgresql", "upgrade"]
  create_cloudwatch_log_group     = true

  parameters = [
    {
      name  = "autovacuum"
      value = 1
    },
    {
      name  = "client_encoding"
      value = "utf8"
    }
  ]

  tags = {
    Module = "database"
  }
}

# Development Environment Configuration

include "root" {
  path = find_in_parent_folders("root.hcl")
}

locals {
  environment = "dev"
  common      = read_terragrunt_config(find_in_parent_folders("common.hcl"))

  env_tags = {
    Environment = "development"
    CostCenter  = "engineering"
  }
}

inputs = {
  environment        = local.environment
  vpc_cidr           = local.common.locals.vpc_cidrs[local.environment]
  availability_zones = local.common.locals.availability_zones
  backup_retention   = local.common.locals.backup_retention[local.environment]
  multi_az           = local.common.locals.multi_az[local.environment]

  tags = merge(
    local.env_tags,
    {
      Environment = local.environment
    }
  )
}

# Monitoring Configuration for Development with Datadog

include "root" {
  path = find_in_parent_folders("root.hcl")
}

terraform {
  source = "tfr:///terraform-aws-modules/cloudwatch/aws//modules/log-group?version=4.3.0"
}

# Generate Datadog provider configuration (custom provider)
generate "datadog_provider" {
  path      = "datadog_provider.tf"
  if_exists = "overwrite_terragrunt"
  contents  = <<EOF
terraform {
  required_providers {
    datadog = {
      source  = "datadog/datadog"
      version = "~> 3.30.0"
    }
  }
}

provider "datadog" {
  api_key = var.datadog_api_key
  app_key = var.datadog_app_key
}

variable "datadog_api_key" {
  type      = string
  sensitive = true
}

variable "datadog_app_key" {
  type      = string
  sensitive = true
}
EOF
}

# Dependencies
dependency "app" {
  config_path = "../app"

  mock_outputs = {
    cluster_name = "myapp-dev-cluster"
  }

  mock_outputs_allowed_terraform_commands = ["validate", "plan", "init"]
}

locals {
  common = read_terragrunt_config(find_in_parent_folders("common.hcl"))
}

inputs = {
  name              = "/aws/ecs/${local.common.locals.name_prefix}-dev"
  retention_in_days = 7

  tags = {
    Module      = "monitoring"
    Application = dependency.app.outputs.cluster_name
  }
}

# Datadog monitors and dashboards would be configured here as well
# using the datadog provider resources

# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
provider "aws" {
  region = "us-east-1"

  default_tags {
    tags = { "ManagedBy" : "Terragrunt", "Repository" : "infrastructure", "Team" : "platform", "Terraform" : "true" }
  }
}

# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
terraform {
  required_version = ">= 1.6.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

# VPC Configuration for Development

include "root" {
  path = find_in_parent_folders("root.hcl")
}

terraform {
  # Using Terraform Registry module
  source = "tfr:///terraform-aws-modules/vpc/aws?version=5.1.0"
}

locals {
  common = read_terragrunt_config(find_in_parent_folders("common.hcl"))
  env    = read_terragrunt_config(find_in_parent_folders("env.hcl"))
}

inputs = {
  name = "${local.common.locals.name_prefix}-dev-vpc"
  cidr = "10.0.0.0/16"

  azs              = ["us-east-1a", "us-east-1b", "us-east-1c"]
  private_subnets  = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  public_subnets   = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]
  database_subnets = ["10.0.201.0/24", "10.0.202.0/24", "10.0.203.0/24"]

  enable_nat_gateway   = true
  single_nat_gateway   = true # Cost savings for dev
  enable_dns_hostnames = true
  enable_dns_support   = true

  # VPC Flow Logs
  enable_flow_log                      = true
  create_flow_log_cloudwatch_iam_role  = true
  create_flow_log_cloudwatch_log_group = true

  tags = {
    Module = "vpc"
  }
}

# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
terraform {
  backend "s3" {
    bucket         = "terraform-state-123456789012"
    dynamodb_table = "terraform-locks"
    encrypt        = true
    key            = "prod/terraform.tfstate"
    region         = "us-east-1"
  }
}

# RDS Database Configuration for Production

include "root" {
  path = find_in_parent_folders("root.hcl")
}

terraform {
  source = "tfr:///terraform-aws-modules/rds/aws?version=6.3.0"
}

dependency "vpc" {
  config_path = "../vpc"

  mock_outputs = {
    vpc_id                     = "vpc-mock-123456"
    database_subnet_ids        = ["subnet-mock-1", "subnet-mock-2", "subnet-mock-3"]
    database_subnet_group_name = "mock-subnet-group"
  }

  mock_outputs_allowed_terraform_commands = ["validate", "plan", "init"]
  mock_outputs_merge_strategy_with_state  = "shallow"
}

locals {
  common  = read_terragrunt_config(find_in_parent_folders("common.hcl"))
  db_name = "myappdb"
}

inputs = {
  identifier = "${local.common.locals.name_prefix}-prod-db"

  engine               = "postgres"
  engine_version       = "15.4"
  family               = "postgres15"
  major_engine_version = "15"
  instance_class       = local.common.locals.instance_sizes["prod"]["database"]

  allocated_storage     = 100
  max_allocated_storage = 500
  storage_encrypted     = true

  db_name  = local.db_name
  username = "dbadmin"
  port     = 5432

  db_subnet_group_name   = dependency.vpc.outputs.database_subnet_group_name
  vpc_security_group_ids = []

  # Production settings
  multi_az                  = true
  deletion_protection       = true
  backup_retention_period   = 30
  skip_final_snapshot       = false
  final_snapshot_identifier = "${local.common.locals.name_prefix}-prod-db-final-snapshot"

  # Performance Insights
  performance_insights_enabled          = true
  performance_insights_retention_period = 7
  enabled_cloudwatch_logs_exports       = ["postgresql", "upgrade"]
  create_cloudwatch_log_group           = true

  # Automated backups
  backup_window      = "03:00-06:00"
  maintenance_window = "Mon:00:00-Mon:03:00"

  parameters = [
    {
      name  = "autovacuum"
      value = 1
    },
    {
      name  = "client_encoding"
      value = "utf8"
    },
    {
      name  = "log_min_duration_statement"
      value = "1000"
    }
  ]

  tags = {
    Module     = "database"
    Compliance = "required"
  }
}

# Production Environment Configuration

include "root" {
  path = find_in_parent_folders("root.hcl")
}

locals {
  environment = "prod"
  common      = read_terragrunt_config(find_in_parent_folders("common.hcl"))

  env_tags = {
    Environment = "production"
    CostCenter  = "operations"
    Compliance  = "required"
  }
}

inputs = {
  environment        = local.environment
  vpc_cidr           = local.common.locals.vpc_cidrs[local.environment]
  availability_zones = local.common.locals.availability_zones
  backup_retention   = local.common.locals.backup_retention[local.environment]
  multi_az           = local.common.locals.multi_az[local.environment]

  # Production-specific settings
  enable_deletion_protection = true
  enable_encryption          = true

  tags = merge(
    local.env_tags,
    {
      Environment = local.environment
    }
  )
}

# Monitoring Configuration for Production with Datadog and New Relic

include "root" {
  path = find_in_parent_folders("root.hcl")
}

terraform {
  source = "tfr:///terraform-aws-modules/cloudwatch/aws//modules/log-group?version=4.3.0"
}

# Generate Datadog provider configuration
generate "datadog_provider" {
  path      = "datadog_provider.tf"
  if_exists = "overwrite_terragrunt"
  contents  = <<EOF
terraform {
  required_providers {
    datadog = {
      source  = "datadog/datadog"
      version = "~> 3.30.0"
    }
    newrelic = {
      source  = "newrelic/newrelic"
      version = "~> 3.25.0"
    }
  }
}

provider "datadog" {
  api_key = var.datadog_api_key
  app_key = var.datadog_app_key
  api_url = "https://api.datadoghq.com/"
}

provider "newrelic" {
  account_id = var.newrelic_account_id
  api_key    = var.newrelic_api_key
  region     = "US"
}

variable "datadog_api_key" {
  type      = string
  sensitive = true
}

variable "datadog_app_key" {
  type      = string
  sensitive = true
}

variable "newrelic_account_id" {
  type = string
}

variable "newrelic_api_key" {
  type      = string
  sensitive = true
}
EOF
}

# Dependencies
dependency "database" {
  config_path = "../database"

  mock_outputs = {
    db_instance_identifier = "myapp-prod-db"
    db_instance_endpoint   = "mock-db-endpoint.rds.amazonaws.com:5432"
  }

  mock_outputs_allowed_terraform_commands = ["validate", "plan", "init"]
}

locals {
  common = read_terragrunt_config(find_in_parent_folders("common.hcl"))
}

inputs = {
  name              = "/aws/ecs/${local.common.locals.name_prefix}-prod"
  retention_in_days = 90 # Longer retention for production

  tags = {
    Module      = "monitoring"
    Environment = "production"
    Compliance  = "required"
  }
}

# Additional monitoring resources would be configured using datadog and newrelic providers
# Examples:
# - Datadog monitors for database metrics
# - Datadog APM configuration
# - New Relic alert policies
# - New Relic dashboards

# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
provider "aws" {
  region = "us-east-1"

  default_tags {
    tags = { "ManagedBy" : "Terragrunt", "Repository" : "infrastructure", "Team" : "platform", "Terraform" : "true" }
  }
}

# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
terraform {
  required_version = ">= 1.6.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

# VPC Configuration for Production

include "root" {
  path = find_in_parent_folders("root.hcl")
}

terraform {
  source = "tfr:///terraform-aws-modules/vpc/aws?version=5.1.0"
}

locals {
  common = read_terragrunt_config(find_in_parent_folders("common.hcl"))
}

inputs = {
  name = "${local.common.locals.name_prefix}-prod-vpc"
  cidr = "10.2.0.0/16"

  azs              = ["us-east-1a", "us-east-1b", "us-east-1c"]
  private_subnets  = ["10.2.1.0/24", "10.2.2.0/24", "10.2.3.0/24"]
  public_subnets   = ["10.2.101.0/24", "10.2.102.0/24", "10.2.103.0/24"]
  database_subnets = ["10.2.201.0/24", "10.2.202.0/24", "10.2.203.0/24"]

  enable_nat_gateway     = true
  single_nat_gateway     = false # Multiple NAT gateways for HA
  one_nat_gateway_per_az = true  # One per AZ for production
  enable_dns_hostnames   = true
  enable_dns_support     = true

  enable_flow_log                      = true
  create_flow_log_cloudwatch_iam_role  = true
  create_flow_log_cloudwatch_log_group = true

  tags = {
    Module     = "vpc"
    Compliance = "required"
  }
}

# Root Terragrunt Configuration
# This file contains shared configuration for all modules

# Require Terragrunt 0.93+ for new CLI features
terragrunt_version_constraint = ">= 0.93.0"

# Require Terraform/OpenTofu 1.6+
terraform_version_constraint = ">= 1.6.0"

locals {
  # Automatically load account and region variables
  account_id = get_env("AWS_ACCOUNT_ID", "123456789012")
  aws_region = "us-east-1"

  # Common tags applied to all resources
  common_tags = {
    Terraform  = "true"
    ManagedBy  = "Terragrunt"
    Repository = "infrastructure"
    Team       = "platform"
  }
}

# Generate AWS provider configuration
# Note: Using "skip" to avoid conflicts with modules that have their own provider.tf
generate "provider" {
  path      = "provider.tf"
  if_exists = "skip"
  contents  = <<EOF
provider "aws" {
  region = "${local.aws_region}"

  default_tags {
    tags = ${jsonencode(local.common_tags)}
  }
}
EOF
}

# Configure Terraform version and required providers
# Note: Using "skip" to avoid conflicts with registry modules that have their own versions.tf
generate "versions" {
  path      = "versions.tf"
  if_exists = "skip"
  contents  = <<EOF
terraform {
  required_version = ">= 1.6.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}
EOF
}

# Configure remote state
remote_state {
  backend = "s3"

  config = {
    bucket         = "terraform-state-${local.account_id}"
    key            = "${path_relative_to_include()}/terraform.tfstate"
    region         = local.aws_region
    encrypt        = true
    dynamodb_table = "terraform-locks"

    s3_bucket_tags = {
      Name = "Terraform State Storage"
    }

    dynamodb_table_tags = {
      Name = "Terraform Lock Table"
    }
  }

  generate = {
    path      = "backend.tf"
    if_exists = "overwrite_terragrunt"
  }
}

# Configure Terragrunt behavior
terraform {
  # Log level for Terraform
  extra_arguments "common_vars" {
    commands = get_terraform_commands_that_need_vars()
  }

  # Retry on transient errors
  extra_arguments "retry_lock" {
    commands = get_terraform_commands_that_need_locking()

    arguments = [
      "-lock-timeout=5m"
    ]
  }
}