FWIW, I set up one client using the reference-architecture last year. It’s going well, but there are a few limitations with using the full terraform featureset (due to the -from-module approach.) For all clients since then I’ve simplified things and have been using Terragrunt and Terraform natively. To be fair, all of these clients are on Mac/Linux or I am managing it all for them (on Mac.) None of them need CI/CD with Terraform. So the simple approach is working well. For authentication, i’m using aws-vault with my AWS account assuming roles in the clients’ and the awscli’s

credential_process

option. That said, I am really looking forward to see what the Cloudposse team have been working on for their updated reference architecture! This Terragrunt reference architecture could help some of you in the meantime. It’s not exactly how I’m using it, but pretty close.