.
├── .kiro/
│ ├── steering/ # AI context and conventions
│ ├── hooks/ # Agent hooks (fmt, validate, scan)
│ └── skills/ # Domain skills (terraform-skill)
├── .mise/
│ └── tasks/ # Automated mise tasks (tg, create-workload, etc.)
├── .github/
│ └── workflows/ # CI pipelines (validation, release)
├── iam-roles/ # IAM role templates for Terragrunt execution
├── live/ # Terragrunt environment configs (per account/region)
│ ├── management/
│ │ └── us-east-1/
│ │ ├── env.hcl # All config values for this scope
│ │ └── {module}/terragrunt.hcl
│ ├── security/
│ ├── shared-services/
│ ├── monitoring/
│ ├── sandbox/
│ └── production/
├── modules/ # Custom Terraform/OpenTofu modules
│ └── {module}/
│ ├── main.tf
│ ├── variables.tf
│ ├── outputs.tf
│ ├── versions.tf
│ └── README.md
├── root.hcl # Remote state + provider generation
├── project.hcl # Org-wide constants (account IDs, project name)
├── mise.toml # Tool versions
├── .pre-commit-config.yaml # Commit hooks (commitizen)
└── README.md
project.hcl → org-wide constants
root.hcl → remote state (S3 with native locking), provider with role assumption
live/{account}/
account.hcl → account name + ID
{region}/
env.hcl → all config values, skip_module map, tags
{module}/
terragrunt.hcl → sources module, passes inputs from env.hcl