My setup is quite simpler. I have created different environments based on terragrunt, i.e. to separate prod and no-prod environments. Then I have some "macro mo

My setup is quite simpler. I have created different environments based on terragrunt, i.e. to separate prod and no-prod environments. Then I have some "macro modules" with separated state files. I try to avoid too much state files, so for a medium sized setup on AWS I got: - Network Module - IAM Security module (which is region-free) - Application modules (for instance one for specific topic: my docker cluster, my S3 buckets and so on) One macro module can load other one state outputs, so for instance network module define default vpc you will likely use in the other one. Secrets are variables you must put in TF_VAR during manual apply, so no password is stored in terraform files.