Terraform Multi-Environment Patterns describe how teams run the same infrastructure-as-code configuration safely across dev, staging, and production without copy-pasting whole codebases, while Terragrunt is a thin wrapper that keeps that repetition (backend blocks, provider config, variable values) out of every environment folder. Once a team stops managing one throwaway terraform apply and starts running the same infrastructure at multiple maturity levels, state isolation, environment-specific variables, and a repeatable promotion path become the real engineering problem, not the HCL syntax itself. The mental model worth keeping in mind: state boundaries decide blast radius, not folder names or workspace labels, so every pattern below is really a different answer to "which resources share one state file, and who can touch it."
What This Cheat Sheet Covers
This topic spans 13 focused tables and 105 indexed concepts. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
A jump-to index of every table row in this cheat sheet.
An interactive map of every table and concept in this topic.
Table 1: Environment Separation Strategies
Before touching workspaces or Terragrunt, every team must decide how dev, staging, and production are isolated from each other at the state and backend level. This table compares the primary strategies teams reach for, from simplest to most structurally isolated.
| Strategy | Example | Description |
|---|---|---|
environments/dev/main.tf, environments/prod/main.tf, each with its own backend | Each environment gets its own state file and directory, referencing shared modules; the most common isolation pattern in production. | |
terraform workspace new staging | Multiple named states share one config and one backend; convenient for short-lived replicas, not for environments needing separate credentials. | |
Separate AWS account IDs for dev/staging/prod under one Organization | Environments are isolated at the cloud-provider account boundary, giving the strongest blast-radius and credential separation. | |
live/prod/vpc/terragrunt.hcl | Extends directory-per-environment with DRY includes so each unit's terragrunt.hcl stays a few lines. |