Call to function "sops_decrypt_file" failed: error occurred

TL;DR: Your single-unit destroy isn't failing on YOUR unit. Terragrunt's runner pool discovers the whole stack, parses every environment's config, and dies on sops_decrypt_file in an environment whose KMS key you can't decrypt. Scope the run so it doesn't parse what it shouldn't.

ERROR  Error: Error in function call
ERROR    on ../../../prod/env.hcl line 5, in locals:
ERROR     5:   secrets         = yamldecode(sops_decrypt_file("secrets.yaml"))
ERROR  Call to function "sops_decrypt_file" failed: error occurred:

Steps

1. Read which file failed: it's in ANOTHER environment's directory (e.g. prod/env.hcl while you're destroying dev/example).

Expected: you confirm the failure is cross-environment, not your unit.

1. Narrow discovery: run from the unit with flags that limit the tree (e.g. --filter on the 1.x CLI, or the legacy --terragrunt-working-dir scoping), so the runner pool doesn't walk into environments you can't decrypt.

Expected: only your unit's configs are parsed.

1. Re-run the destroy.

Expected: it plans (or reports no resources) instead of dying on sops_decrypt_file.

When this applies

• destroy (or any command) from one unit fails in sops_decrypt_file inside a DIFFERENT environment's config.
• Each environment's secrets are encrypted to different KMS keys and you can only decrypt your own.

When it doesn't apply

• sops_decrypt_file fails on YOUR unit's own secrets file: that's a key/access problem in your environment, fixable with key access, not scoping.
• error decrypting key ... AccessDeniedException: also cross-account KMS, but check whether the run SHOULD be touching that environment at all.

Tool versions

Terragrunt 1.x (runner-pool discovery).

Why it happens

Stack-aware commands discover units by walking the tree and parsing configs, and sops_decrypt_file runs at parse time. Parsing prod/env.hcl decrypts prod's secrets even though your destroy would never touch prod infrastructure.

Edge cases

• The same escalation hits plan/apply with stack filters that still walk the tree; always verify the failing file's directory before debugging your own config.
• Long-term, per-environment KMS keys plus least-privilege CI roles make this a hard wall by design; the fix is scoping discovery, not widening key access.