How do I destroy a single module in the Ref Arch with Terragrunt?

[zackproser]

A customer asked:

How do I destroy a single module in the Ref Arch with Terragrunt?

---

Tracked in ticket #109073

[zackproser]

You can use terragrunt destroy with the -target option to specify a particular module whose resources you wish to destroy.

For example, let's say you have a deployed CIS-Benchmark compliant Gruntwork Reference Architecture and you wish to destroy only the Cloudtrail module's benchmark_metric_filters` module, which looks like this:

# -----------------------------------------------------------------------------------------------
# CREATE LOG FILTERS FOR ALERTING
# -----------------------------------------------------------------------------------------------

module "benchmark_metric_filters" {
  source = "../cloudwatch-logs-metric-filters"

  cloudwatch_logs_group_name  = module.cloudtrail.cloudwatch_group_name
  custom_metric_map           = var.benchmark_alarm_custom_metric_map
  sns_topic_already_exists    = var.benchmark_alarm_sns_topic_already_exists
  sns_topic_arn               = var.benchmark_alarm_sns_topic_arn
  sns_topic_name              = var.benchmark_alarm_sns_topic_name
  sns_topic_kms_master_key_id = var.benchmark_alarm_sns_topic_kms_master_key_id
  is_root_account             = var.is_root_account
}

You would first cd into the account-baseline directory for your target environment. Let's start with the logs environment / account:

cd logs/_global/account-baseline

terragrunt destroy -target module.cloudtrail.module.benchmark_metric_filters

When prompted for confirmation, enter yes:

Do you really want to destroy all resources?
  Terraform will destroy all your managed infrastructure, as shown above.
  There is no undo. Only 'yes' will be accepted to confirm.

  Enter a value: yes

Note that you'll receive the following warning after destruction of your resources is complete:

╷
│ Warning: Applied changes may be incomplete
│
│ The plan was created with the -target option in effect, so some changes
│ requested in the configuration may have been ignored and the output values
│ may not be fully updated. Run the following command to verify that no other
│ changes are pending:
│     terraform plan
│
│ Note that the -target option is not suitable for routine use, and is
│ provided only for exceptional situations such as recovering from errors or
│ mistakes, or when Terraform specifically suggests to use it as part of an
│ error message.
╵

Note that, if your Ref Arch is configured with Gruntwork Pipelines for CI/CD, changes that you make via `terragrunt destroy -target` will be overwritten on subsequent applies. That said, it can still be useful in edge cases to be able to temporarily tear down a group of resources. 

[pdeva]

what kinda permissions are needed to run this terragrunt command? does the box it runs from have to be in some particular vpc?