TL;DR: Your single-unit `destroy` isn't failing on YOUR unit. Terragrunt's runner pool discovers the whole stack, parses every environment's config, and dies on `sops_decrypt_file` in an environment whose KMS key you can't decrypt. Scope the run so it doesn't parse what it shouldn't.

```text
ERROR  Error: Error in function call
ERROR    on ../../../prod/env.hcl line 5, in locals:
ERROR     5:   secrets         = yamldecode(sops_decrypt_file("secrets.yaml"))
ERROR  Call to function "sops_decrypt_file" failed: error occurred:
```

## Steps

1. Read which file failed: it's in ANOTHER environment's directory (e.g. `prod/env.hcl` while you're destroying `dev/example`).
   Expected: you confirm the failure is cross-environment, not your unit.
2. Narrow discovery: run from the unit with flags that limit the tree (e.g. `--filter` on the 1.x CLI, or the legacy `--terragrunt-working-dir` scoping), so the runner pool doesn't walk into environments you can't decrypt.
   Expected: only your unit's configs are parsed.
3. Re-run the destroy.
   Expected: it plans (or reports no resources) instead of dying on `sops_decrypt_file`.

## When this applies

- `destroy` (or any command) from one unit fails in `sops_decrypt_file` inside a DIFFERENT environment's config.
- Each environment's secrets are encrypted to different KMS keys and you can only decrypt your own.

## When it doesn't apply

- `sops_decrypt_file` fails on YOUR unit's own secrets file: that's a key/access problem in your environment, fixable with key access, not scoping.
- `error decrypting key ... AccessDeniedException`: also cross-account KMS, but check whether the run SHOULD be touching that environment at all.

## Tool versions

Terragrunt 1.x (runner-pool discovery).

## Why it happens

Stack-aware commands discover units by walking the tree and parsing configs, and `sops_decrypt_file` runs at parse time. Parsing `prod/env.hcl` decrypts prod's secrets even though your destroy would never touch prod infrastructure.

## Edge cases

- The same escalation hits `plan`/`apply` with stack filters that still walk the tree; always verify the failing file's directory before debugging your own config.
- Long-term, per-environment KMS keys plus least-privilege CI roles make this a hard wall by design; the fix is scoping discovery, not widening key access.