---
title: Install
description: Install Terragrunt!
slug: getting-started/install
sidebar:
  order: 3
---

import InstallTabs from '@components/InstallTabs.astro'
import Before from '@components/Before.astro'
import { Aside, Code, Tabs, TabItem } from '@astrojs/starlight/components'
import { getLatestRelease } from '@lib/github';
export const releaseData = await getLatestRelease('gruntwork-io', 'terragrunt');
export const version = releaseData?.tag_name || 'v0.99.0';

## Quick Install

The quickest way to install Terragrunt on Linux or macOS:

```bash
curl -sSfL --proto '=https' --tlsv1.2 https://terragrunt.com/install | bash
```

<Aside type="tip" title="Script options and inspecting the script">
  Run `curl -sSfL --proto '=https' --tlsv1.2 https://terragrunt.com/install | bash -s -- --help` to see all options, or [read the script on GitHub](https://github.com/gruntwork-io/terragrunt/blob/main/docs/public/install).

  Piping a remote script directly into `bash` means executing code you haven't read. If you'd rather review the script before running it, download it to your local filesystem, read through it, and then run it:

  ```bash
  curl -sSfL --proto '=https' --tlsv1.2 -o install.sh https://terragrunt.com/install
  less install.sh
  bash install.sh
  ```
</Aside>

## Download from releases page

1. Go to the [Releases Page](https://github.com/gruntwork-io/terragrunt/releases).
2. Download the archive for your operating system: e.g., if you're on a Mac, download `terragrunt_darwin_amd64.tar.gz`; if you're on Windows, download `terragrunt_windows_amd64.exe.zip`, etc.
3. Download `SHA256SUMS` and optionally `SHA256SUMS.gpgsig` for signature verification.
4. Verify the checksum and optionally the signature (see [Verifying the checksum](#verifying-the-checksum) below).
5. Extract the archive: e.g., `tar -xzf terragrunt_darwin_amd64.tar.gz` or unzip on Windows.
6. Add execute permissions to the binary (Linux/Mac): `chmod u+x terragrunt`.
7. Put the binary somewhere on your `PATH`: e.g., On Linux and Mac: `mv terragrunt /usr/local/bin/terragrunt`.

### Verifying the checksum

When you download the binary from the releases page, you can also use the checksum file to verify the integrity of the binary. This can be useful for ensuring that you have an intact binary and that it has not been tampered with.

To verify the integrity of the file, do the following:

1. Have the binary downloaded, and accessible.
2. Generate the SHA256 checksum of the binary.
3. Download the `SHA256SUMS` file from the releases page.
4. Find the expected checksum for the binary you downloaded.
5. If the checksums match, the binary is intact and has not been tampered with.
6. Optionally, verify the GPG signature:

```bash
# Import Gruntwork's public key (first time only)
curl -s https://gruntwork.io/.well-known/pgp-key.txt | gpg --import

# Verify signature
gpg --verify SHA256SUMS.gpgsig SHA256SUMS
```

:::caution[Verify Key Fingerprint]
After importing the key, verify its fingerprint matches exactly:

```bash
gpg --fingerprint 577774ACA847CC49
```

Expected output:
```
pub   ed25519 2026-01-12 [SC]
      68C8 0F86 DF98 E710 C0F2  2E2E 5777 74AC A847 CC49
uid           [ unknown] Gruntwork (Code Signing Key) <security@gruntwork.io>
```
:::

7. Alternatively, verify with Cosign:

```bash
cosign verify-blob SHA256SUMS \
  --bundle SHA256SUMS.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp "github.com/gruntwork-io/terragrunt"
```

### Verifying releases with the GitHub CLI

<Before version="1.1.0">
<Aside type="note" title="Coming in v1.1.0">
  Terragrunt adopts immutable releases starting with `v1.1.0`. The verification below will be supported once `v1.1.0` is published.
</Aside>
</Before>

Terragrunt releases starting with `v1.1.0` are published as [immutable releases](/process/releases#immutable-releases), and each one includes a release attestation: a signed record binding the release tag, commit SHA, and asset digests. The [GitHub CLI](https://cli.github.com/) (version 2.81.0 or later) can check a release and your downloaded files against that attestation.

To confirm a release exists and is immutable:

```bash
gh release verify v1.1.0 --repo gruntwork-io/terragrunt
```

To confirm a downloaded file exactly matches the published release asset:

```bash
gh release verify-asset v1.1.0 terragrunt_darwin_arm64.tar.gz --repo gruntwork-io/terragrunt
```

This complements the checksum and signature checks above: the attestation proves your download matches what was published on GitHub and that the release cannot have been replaced after publishing, while the GPG signature proves Gruntwork produced it.

<Aside type="note">
  `gh release verify-asset` cannot verify the auto-generated source code zip or tarball, since GitHub creates those on download. Releases before `v1.1.0` predate immutability and cannot be verified this way; use the checksum and signature checks instead.
</Aside>

### Convenience Scripts

<InstallTabs version={version} />

:::note
These scripts automatically verify the SHA256 checksum and GPG signature before completing.
:::

## Install via a package manager

Note that all the different package managers are third party. The third party Terragrunt packages may not be updated with the latest version, but are often close. Please check your version against the latest available on the [Releases Page](https://github.com/gruntwork-io/terragrunt/releases).
If you  want the latest version, the recommended installation option is to [download from the releases page](https://github.com/gruntwork-io/terragrunt/releases).

* **Windows**: You can install Terragrunt on Windows using [Chocolatey](https://chocolatey.org/)

  ```bash
  choco install terragrunt
  ```

* **macOS**: You can install Terragrunt on macOS using [Homebrew](https://brew.sh/):

  ```bash
  brew install terragrunt
  ```

* **Linux (Homebrew)**: Most Linux users can use [Homebrew](https://docs.brew.sh/Homebrew-on-Linux):

  ```bash
  brew install terragrunt
  ```
* **Linux (Pacman)**: Arch Linux users can use [pacman](https://archlinux.org/packages/extra/x86_64/terragrunt/):

  ```bash
  pacman -S terragrunt
  ```

* **Linux (Gentoo)**: Gentoo users can use [emerge](https://repology.org/project/terragrunt/versions):

  ```bash
  emerge -a app-admin/terragrunt-bin
  ```

* **FreeBSD**: You can install Terragrunt on FreeBSD using [Pkg](https://www.freebsd.org/cgi/man.cgi?pkg(7)):

  ```bash
  pkg install terragrunt
  ```

## Install via tool manager

A best practice when using Terragrunt is to pin the version you are using to ensure that you, your colleagues and your CI/CD pipelines are all using the same version. This also allows you to easily upgrade to new versions and rollback to previous versions if needed.

You can use a tool manager to install and manage Terragrunt versions.

* **mise**: You can install Terragrunt using [mise](https://mise.jdx.dev)

  <Code
    lang="bash"
    code={`mise install terragrunt ${version}`}
    frame="terminal"
  >
  </Code>

* **asdf**: You can install Terragrunt using [asdf](https://asdf-vm.com)

  <Code
    lang="bash"
    code={`asdf plugin add terragrunt\nasdf install terragrunt ${version}`}
    frame="terminal"
  >
  </Code>

Both of these tools allow you to pin the version of Terragrunt you are using in a `.tool-versions` (and `.mise.toml` for mise) file in your project directory.

Colleagues and CI/CD pipelines can then install the associated tool manager, and run using the pinned version.

Note that the tools Terragrunt integrates with, such as OpenTofu and Terraform, can also be managed by these tool managers, so you can also pin the versions of those tools in the same file.

**Backend details:**

- **mise** uses [aqua](https://aquaproj.github.io/) as its default backend to install Terragrunt.
- **asdf** uses the asdf-terragrunt plugin, which is maintained by Gruntwork: https://github.com/gruntwork-io/asdf-terragrunt

## Building from source

If you'd like to build from source, you can use `go` to build Terragrunt yourself, and install it:

```shell
git clone https://github.com/gruntwork-io/terragrunt.git
cd terragrunt
# Feel free to checkout a particular tag, etc if you want here.
go install
```

## Install tip or test builds

Every successful CI run on the `main` branch produces a **tip build** of Terragrunt. Maintainers can also trigger **test builds** from any branch. Both are useful for testing unreleased changes or reproducing issues against the most recent code.

Tip builds are served via the builds API at `https://builds.terragrunt.com` and are available for all platforms supported in official releases. While tip builds are always built on every push to `main`, test builds are only built when maintainers explicitly want to distribute a test build of Terragrunt from a branch other than `main` to get stakeholder feedback. Maintainers may ask that you try out a test build to see if a WIP solution solves an issue you are facing, and you are free to request a test build if you want to try the latest in some in-progress work.

<Aside type="caution" title="No retention guarantee">
  Tip and test builds may be reclaimed at any time to reduce hosting costs. Do not rely on a specific build being available indefinitely. Use [official releases](https://github.com/gruntwork-io/terragrunt/releases) for production.
</Aside>

### Quick install for tip and test builds

The same install script used for official releases supports tip and test builds via flags.

To install the latest tip build:

```bash
curl -sSfL --proto '=https' --tlsv1.2 https://terragrunt.com/install | bash -s -- --tip
```

To install a tip build at a specific commit:

```bash
curl -sSfL --proto '=https' --tlsv1.2 https://terragrunt.com/install | bash -s -- --tip --commit <commit-sha>
```

To install a test build at a specific commit:

```bash
curl -sSfL --proto '=https' --tlsv1.2 https://terragrunt.com/install | bash -s -- --test --commit <commit-sha>
```

If you prefer to run the install steps manually, the tabs below show the equivalent commands:

<Tabs>
  <TabItem label="Latest tip">
    ```bash
    set -euo pipefail

    # Set your platform (linux, darwin, windows) and architecture (amd64, arm64, 386)
    OS="linux"
    ARCH="amd64"

    ARCHIVE="terragrunt_${OS}_${ARCH}.tar.gz"

    # Download the archive and checksums
    curl -sL -o "$ARCHIVE" \
      "https://builds.terragrunt.com/api/v1/tip/latest/download?os=${OS}&arch=${ARCH}"
    curl -sL -o SHA256SUMS \
      "https://builds.terragrunt.com/api/v1/tip/latest/download?filename=SHA256SUMS"

    # Verify checksum
    EXPECTED=$(awk -v f="$ARCHIVE" '$2 == f {print $1; exit}' SHA256SUMS)
    ACTUAL=$(sha256sum "$ARCHIVE" | awk '{print $1}')  # macOS: use "shasum -a 256"
    if [ "$EXPECTED" != "$ACTUAL" ]; then
      echo "Checksum verification failed!"
      exit 1
    fi
    echo "Checksum verified!"

    # Extract and install
    tar -xzf "$ARCHIVE"
    chmod +x "terragrunt_${OS}_${ARCH}"
    sudo mv "terragrunt_${OS}_${ARCH}" /usr/local/bin/terragrunt
    ```
  </TabItem>
  <TabItem label="Specific commit">
    ```bash
    set -euo pipefail

    # Set the commit SHA, platform, and architecture
    COMMIT="abc123def456"
    OS="linux"
    ARCH="amd64"

    ARCHIVE="terragrunt_${OS}_${ARCH}.tar.gz"

    # Download the archive and checksums
    curl -sL -o "$ARCHIVE" \
      "https://builds.terragrunt.com/api/v1/tip/${COMMIT}/download?os=${OS}&arch=${ARCH}"
    curl -sL -o SHA256SUMS \
      "https://builds.terragrunt.com/api/v1/tip/${COMMIT}/download?filename=SHA256SUMS"

    # Verify checksum
    EXPECTED=$(awk -v f="$ARCHIVE" '$2 == f {print $1; exit}' SHA256SUMS)
    ACTUAL=$(sha256sum "$ARCHIVE" | awk '{print $1}')  # macOS: use "shasum -a 256"
    if [ "$EXPECTED" != "$ACTUAL" ]; then
      echo "Checksum verification failed!"
      exit 1
    fi
    echo "Checksum verified!"

    # Extract and install
    tar -xzf "$ARCHIVE"
    chmod +x "terragrunt_${OS}_${ARCH}"
    sudo mv "terragrunt_${OS}_${ARCH}" /usr/local/bin/terragrunt
    ```
  </TabItem>
  <TabItem label="Test build">
    ```bash
    set -euo pipefail

    # Set the commit SHA, platform, and architecture
    COMMIT="abc123def456"
    OS="linux"
    ARCH="amd64"

    ARCHIVE="terragrunt_${OS}_${ARCH}.tar.gz"
    BASE_URL="https://builds.terragrunt.com/test/${COMMIT}"

    # Download the archive and checksums
    curl -sL -o "$ARCHIVE" "${BASE_URL}/${ARCHIVE}"
    curl -sL -o SHA256SUMS "${BASE_URL}/SHA256SUMS"

    # Verify checksum
    EXPECTED=$(awk -v f="$ARCHIVE" '$2 == f {print $1; exit}' SHA256SUMS)
    ACTUAL=$(sha256sum "$ARCHIVE" | awk '{print $1}')  # macOS: use "shasum -a 256"
    if [ "$EXPECTED" != "$ACTUAL" ]; then
      echo "Checksum verification failed!"
      exit 1
    fi
    echo "Checksum verified!"

    # Extract and install
    tar -xzf "$ARCHIVE"
    chmod +x "terragrunt_${OS}_${ARCH}"
    sudo mv "terragrunt_${OS}_${ARCH}" /usr/local/bin/terragrunt
    ```
  </TabItem>
</Tabs>

### Verifying signatures

Tip and test builds are signed using the same process as official releases. You can optionally verify the GPG or Cosign signature after downloading:

```bash
# Download signature files (replace "latest" with a commit SHA if needed)
curl -sL -o SHA256SUMS.gpgsig \
  "https://builds.terragrunt.com/api/v1/tip/latest/download?filename=SHA256SUMS.gpgsig"

# GPG verification
curl -s https://gruntwork.io/.well-known/pgp-key.txt | gpg --import
gpg --verify SHA256SUMS.gpgsig SHA256SUMS
```

Alternatively, verify with Cosign:

```bash
curl -sL -o SHA256SUMS.sigstore.json \
  "https://builds.terragrunt.com/api/v1/tip/latest/download?filename=SHA256SUMS.sigstore.json"

cosign verify-blob SHA256SUMS \
  --bundle SHA256SUMS.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp "github.com/gruntwork-io/terragrunt"
```

<Aside>
  For full API documentation and more details about Terragrunt is distributed, see the [Releases documentation](/process/releases#tip-builds).
</Aside>

## Enable tab completion

If you use either Bash or Zsh, you can enable tab completion for Terragrunt commands. To enable autocomplete, first ensure that a config file exists for your chosen shell.

For Bash shell.

```shell
touch ~/.bashrc
```

For Zsh shell.

```shell
touch ~/.zshrc
```

Then install the autocomplete package.

``` shell
terragrunt --install-autocomplete
```

Once the autocomplete support is installed, you will need to restart your shell.

## Gruntwork Pipelines

Gruntwork offers a commercial CI/CD solution for Terragrunt called [Pipelines](https://www.gruntwork.io/platform/pipelines). Pipelines is a fully managed CI/CD service that is designed to work seamlessly with Terragrunt. It provides an out of the box solution for running Terragrunt in CI/CD without the need to setup and maintain your own CI/CD infrastructure.

## Terragrunt GitHub Action

Terragrunt is also available as a GitHub Action.

Instructions on how to use it can be found at [https://github.com/gruntwork-io/terragrunt-action](https://github.com/gruntwork-io/terragrunt-action).
