Terragrunt v1.2.0: base64gzip Output Change, S3 Policy Fix and Catalog Format

Looking for what changed in Terragrunt v1.2.0? The release was published on October 21, 2026 and is a large minor release. The two items to check before upgrading are the new base64gzip() output and the removal of the S3 RootAccess bucket policy statement.

The full release notes and downloads are on the GitHub release page. This is a stable release, not a prerelease. It also completes 11 experiments, including block-iteration, oci, azure-backend and profiling.

base64gzip() output changes

Go 1.27 changed the output of its gzip encoder. Terragrunt v1.1.5 kept the old output and warned once per run. In v1.2.0, base64gzip() returns what the Go 1.27 encoder produces.

The decoded value is the same. The encoded string is not. A resource that compares it can plan a replacement on the first run after the upgrade. The notes give an aws_instance with user_data_base64 and user_data_replace_on_change = true as an example.

If the value must stay stable, use the experimental base64gzip_compat(). It returns the v1.1.3 output and sits behind the base64gzip-compat experiment:

terragrunt run --all --experiment base64gzip-compat -- plan

S3 bootstrap no longer adds RootAccess

When bootstrapping an S3 state bucket, Terragrunt used to add a policy statement with the Sid RootAccess. It granted s3:* to the account root ARN, which covers the whole AWS account. The maintainers removed it because state files often hold secrets and the account already owns the bucket.

Three details matter:

  • skip_bucket_root_access is now deprecated. It still works and warns during bootstrap.
  • The skip-bucket-root-access strict control turns that warning into an error.
  • Set enable_bucket_root_access = true in the remote_state config if you want the statement back.

Buckets that already have the statement keep it. The state backend docs explain how to remove it by hand.

Catalog output and profiling without experiments

terragrunt catalog now takes --format (env: TG_FORMAT). Use --format=jsonl for one JSON object per entry, or --format=md for a Markdown document. The --experiment catalog-format flag is no longer needed.

terragrunt catalog --format=jsonl | jq -c '{kind, title, component_source}'

Without --format, the TUI opens only when both standard input and output are terminals. In a pipe you get jsonl, so scripts need no flag.

Profiling also left the experiment stage. Use --profile-cpu, --profile-mem, --profile-goroutine, or --profile-dir to collect all three. Read the files with go tool pprof. They cover Terragrunt itself, not the OpenTofu or Terraform processes it starts.

Bounded discovery

Graph filters search up to the Git repository root and follow dependencies wherever they point. In a monorepo that can parse sibling environments a command never needed. A (dir) operand in a graph filter now stops traversal at that directory, and there is a --discovery-boundary flag for the same purpose. The notes shown here are cut off, so check the release page for the full detail.

Upgrade notes

  • Run a plan after upgrading and look for replacements on resources fed by base64gzip().
  • Search your configs for skip_bucket_root_access and decide if you want enable_bucket_root_access instead.
  • Both breaking changes are described by the maintainers as within the 1.0 guarantees.

Where to get it

← All updates