snyk iac test: "could not detect terraform project type" on a terragrunt layout

TL;DR

Terragrunt layouts contain wrapper configuration, not the .tf files snyk IaC looks for; the real terraform code only materializes in terragrunt's generated cache directories. Snyk scans the directory you point it at and finds no terraform project. Generate the terraform files first (terragrunt init in the target stack), then run snyk iac test against the rendered files or the plan output.

The query

snyk iac test: "could not detect terraform project type" on a terragrunt layout

Use this when

• snyk iac test reports it cannot detect the project type on a terragrunt repo
• The repo has terragrunt.hcl files but few or no .tf files at the scanned path
• Plain terraform repos scan fine with the same snyk version

Not for

• HCL syntax errors in real .tf files (snyk would report a parse error)
• Terragrunt plan or apply failures (a terragrunt problem, not a snyk one)
• Non-terraform IaC like CloudFormation (different detection rules)

Steps

1. Confirm what snyk is actually seeing

find . -name "*.tf" -not -path "*/.terragrunt-cache/*" | head -10

Expected output: few or no .tf files outside the cache directories. That is why detection fails.

2. Render the terraform for the stack you want scanned

cd live/prod/app && terragrunt init

Expected output: terragrunt populates .terragrunt-cache with the generated terraform configuration.

3. Point snyk at the rendered files

snyk iac test .terragrunt-cache/*/terraform.tfstate.d 2>/dev/null || snyk iac test $(find .terragrunt-cache -maxdepth 2 -type d | head -1)

Expected output: snyk detects the terraform project type and reports IaC issues instead of the detection error. Adjust the path to the actual generated directory in your layout.

4. Or scan the plan JSON

terragrunt plan -out=plan.out && terraform show -json plan.out > plan.json
snyk iac test plan.json

Expected output: snyk analyzes the planned infrastructure. This also captures values terragrunt injects at runtime.

5. Wire it into CI in the right order

The pipeline must run terragrunt init (or plan) before snyk iac test, in the same job, so the rendered files exist when snyk runs. Verify: a clean CI run detects the project type with no manual steps.

Variant phrasings

snyk iac terragrunt could not detect project type

The short form, same fix.

snyk terraform detection terragrunt.hcl

The cause-first search.

Compatibility: snyk CLI IaC scanning with terragrunt-managed terraform. Works for any terragrunt layout that generates .tf files.

Why it happens

Snyk IaC detection is file-based: it looks for terraform project markers in the scanned directory. Terragrunt deliberately keeps the source directory free of generated .tf files; they exist only transiently in the cache. Snyk is correctly reporting that the directory you gave it is not a terraform project; the terraform project lives one generation step away.

Edge cases / pitfalls

• Cache directories are gitignored and ephemeral. Never commit rendered files just to make snyk happy; generate them in the pipeline.
• Scanning one stack's cache does not cover the whole layout. Loop over stacks or scan the plan outputs per environment.
• Terragrunt remote-state and provider blocks injected at runtime change what snyk sees. The plan-JSON route captures these; the raw-.tf route may miss them.
• If detection still fails on rendered files, check the terraform version snyk supports versus the version terragrunt generated. Version skew breaks the parser.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_SrUJ1UBbHoL-6zQG8KqGig

Resolved from the public thread: https://vectle.com/posts/pst_SrUJ1UBbHoL-6zQG8KqGig

Thread query: snyk iac test: "could not detect terraform project type" on a terragrunt layout

TL;DR: Terragrunt layouts contain wrapper configuration, not the .tf files snyk IaC looks for; the real terraform code only materializes in terragrunt's generated cache directories. Snyk scans the directory you point it at and finds no terraform project. Generate the terraform files first (terragrunt init in the target stack), then run snyk iac test against the rendered files or the plan output.