locals {
  remote_state_bucket        = "terraform-state-${local.product_name}-${local.account_name}-${local.aws_region}"
  remote_state_bucket_prefix = "${path_relative_to_include()}/terraform.tfstate"
}

remote_state {
  backend = "s3"
  config = {
    encrypt        = true
    bucket         = "${local.remote_state_bucket}"
    key            = "${local.remote_state_bucket_prefix}"
    region         = local.aws_region
    dynamodb_table = "terraform-locks"
  }
  ...
}

terragrunt
├── gumgum-ads
│   ├── account.hcl
│   └── virginia
├── gumgum-ai
│   ├── account.hcl
│   ├── oregon
│   └── virginia
├── terragrunt.hcl
└── versioning.hcl

# Create the `tf` alias that will spin up a docker container
# with all the tooling required to operate Verity infrastructure

export GIT_WORKSPACE=${HOME}/Workspace"

alias tf='docker run -it --rm \
    -v ~/.aws:/root/.aws \
    -v ~/.ssh:/root/.ssh \
    -v ~/.kube:/root/.kube \
    -v "$(pwd):/terragrunt" \
    -v "${GIT_WORKSPACE}:/modules" \
    -w /terragrunt \
    lowess/terragrunt:0.12.29'

### Terminal Laptop
$ cd $GIT_WORKSPACE/verity-infra-ops/terraform/terragrunt
$ tf

### Entered docker container
/terragrunt $ cd <path-to-component-you-want-to-test>

### Plan with terragrunt module override (point to local)
/terragrunt $ terragrunt plan --terragrunt-source /modules/terraform-verity-modules//<somemodule>

#!/usr/bin/env python

import boto3

client = boto3.client('sqs')

sqs_queue = "ops-talk-sqs"

response = client.create_queue(
    QueueName=sqs_queue,
    Attributes = {
      'DelaySeconds': 90
    },
    tags={
        'Name': sqs_queue,
      	'Environment': 'dev'
    }
)

print(response)

# terraform.tf

locals {
  sqs_name = "sqs-ops-talk"
}

resource "aws_sqs_queue" "terraform_queue" {
  name          = "${local.sqs_name}"
  delay_seconds = 90
  tags = {
    Name = "${local.sqs_name}"
    Environment = "dev"
  }
}

# ---------------------------------------------------------------------------------------------------------------------
# TERRAGRUNT CONFIGURATION
# This is the configuration for Terragrunt, a thin wrapper for Terraform that supports locking and enforces best
# practices: https://github.com/gruntwork-io/terragrunt
# ---------------------------------------------------------------------------------------------------------------------

locals {
  # Automatically load environment-level variables
  environment_vars = read_terragrunt_config(find_in_parent_folders("env.hcl"))

  # Extract out common variables for reuse
  env = local.environment_vars.locals.environment
}

# Terragrunt will copy the Terraform configurations specified by the source parameter, along with any files in the
# working directory, into a temporary folder, and execute your Terraform commands in that folder.
terraform {}

# Include all settings from the root terragrunt.hcl file
include {
  path = find_in_parent_folders()
}

# These are the variables we have to pass in to use the module specified in the terragrunt configuration above
inputs = {}

# ---------------------------------------------------------------------------------------------------------------------
# TERRAGRUNT CONFIGURATION
# This is the configuration for Terragrunt, a thin wrapper for Terraform that supports locking and enforces best
# practices: https://github.com/gruntwork-io/terragrunt
# ---------------------------------------------------------------------------------------------------------------------

locals {
  # Automatically load environment-level variables
  environment_vars = read_terragrunt_config(find_in_parent_folders("env.hcl"))
  # Extract out common variables for reuse
  env = local.environment_vars.locals.environment
}

# Terragrunt will copy the Terraform configurations specified by the source parameter, along with any files in the
# working directory, into a temporary folder, and execute your Terraform commands in that folder.
terraform {
  source = "git::ssh://git@bitbucket.org/..."
}

generate "provider" {
  path = "providers.tf"
  if_exists = "overwrite_terragrunt"
  contents = <<EOF
    # Configure the AWS provider
    provider "aws" {
      version = "~> 2.9.0"
      region = var.aws_region
    }
  EOF
}

# Include all settings from the root terragrunt.hcl file
include {
  path = find_in_parent_folders()
}

# These are the variables we have to pass in to use the module specified in the terragrunt configuration above
inputs = {}

$ tree -L 1 /terragrunt/gumgum-ai/virginia/prod/verity-api/dynamodb-*

    dynamodb-verity-image
    └── terragrunt.hcl
    dynamodb-verity-images
    └── terragrunt.hcl
    dynamodb-verity-pages
    └── terragrunt.hcl
    dynamodb-verity-text
    └── terragrunt.hcl
    dynamodb-verity-text-source
    └── terragrunt.hcl
    dynamodb-verity-video
    └── terragrunt.hcl

# dynamodb-*/terragrunt.hcl

terraform {
  source = "/terraform-verity-modules//verity-api/dynamodb?ref=1.4.2"
}

locals {
  ### Ease the access of sg ids from the peered VPC
  peer_scheduler_sg        = "${module.peer_discovery.security_groups_json["scheduler"]}"
  peer_kafka_monitoring_sg = "${module.peer_discovery.security_groups_json["monitoring"]}"
  peer_tws_sg              = "${module.peer_discovery.security_groups_json["tws"]}"
  peer_pqp_sg              = "${module.peer_discovery.security_groups_json["pqp"]}"

  verity_api_sg            = data.terraform_remote_state.verity_ecs.outputs.ecs_sg_id
  hce_sg                   = data.terraform_remote_state.hce_ecs.outputs.ecs_sg_id
  
  sg_description = "Access cluster from [${var.account_name}] "
}

resource "aws_security_group_rule" "kafka_tcp_9092_ads_scheduler" {
  type                     = "ingress"
  from_port                = 9092
  to_port                  = 9092
  protocol                 = "tcp"
  source_security_group_id = local.peer_scheduler_sg  ### ---> locals leads to cleaner code
  security_group_id        = aws_security_group.kafka.id
  description              = "${local.sg_description} ${local.peer_scheduler_sg}"
}

<module>
├── datasources.tf
├── ec2.tf
├── ecs.tf
├── outputs.tf
├── providers.tf
├── templates
│   └── ec2-cloud-config.yml.tpl
├── userdata.tf
├── variables.tf
└── versions.tf

locals {
  memcached_sgs = {
    memcached-japanese-verity = data.terraform_remote_state.memcached_japanese_verity.outputs.memcached_sg_id
    memcached-metadata-verity = data.terraform_remote_state.memcached_metadata_verity.outputs.memcached_sg_id
  }
}

data "terraform_remote_state" "memcached_metadata_verity" {
  backend = "s3"

  config = {
    bucket = var.remote_state_bucket
    key    = "${var.remote_state_bucket_prefix}/../../../../memcached-metadata-verity/terraform.tfstate"
    region = var.aws_region
  }
}


data "terraform_remote_state" "memcached_metadata_verity" {
  backend = "s3"

  config = {
    bucket = var.remote_state_bucket
    key    = "${var.remote_state_bucket_prefix}/../../../../memcached-metadata-verity/terraform.tfstate"
    region = var.aws_region
  }
}

# Do something with local.memcached_sgs

resource "aws_security_group_rule" "memcached_tcp_11211_ecs_cluster" {
  for_each                 = { for key, val in local.memcached_nlp_sgs: key => val }
  type                     = "ingress"
  from_port                = 11211
  to_port                  = 11211
  protocol                 = "tcp"
  description              = "Access from ${title(var.ecs_cluster_name)}"
  source_security_group_id = aws_security_group.ecs.id
  security_group_id        = each.value
}

locals {
  source_sg = "sg-60f3be13"
  kafka_sgs = toset([
    "sg-078f01cdfc0c41c9a",
    "sg-09e683e9740fc3d8c"
  ])
}

resource "aws_security_group_rule" "kafka_tcp_9092_newapp" {
  count                    = length(local.kafka_sgs)
  type                     = "ingress"
  from_port                = 9092
  to_port                  = 9092
  protocol                 = "tcp"
  security_group_id        = element(tolist(local.kafka_sgs), count.index)
  source_security_group_id = local.source_sg
  description              = "Access Kafka cluster from ops-talk"
}

resource "aws_security_group_rule" "kafka_tcp_9092_newapp" {
  for_each                  = local.kafka_sgs
  type                     = "ingress"
  from_port                = 9092
  to_port                  = 9092
  protocol                 = "tcp"
  security_group_id        = each.value
  source_security_group_id = local.source_sg
  description              = "Access Kafka cluster from ops-talk"
}