Terragrunt Best practice: dependencies between modules - terraform

Question

I have a terragrunt project like this
├── common_vars.hcl
├── envs
│   ├── dev
│   │   ├── env_vars.hcl
│   │   ├── rds-aurora
│   │   │   └── terragrunt.hcl
│   │   ├── rds-sg
│   │   │   └── terragrunt.hcl
│   │   └── vpc
│   │   └── terragrunt.hcl
│   └── prod
│   ├── env_vars.hcl
│   ├── rds-sg
│   │   └── terragrunt.hcl
│   └── vpc
│   └── terragrunt.hcl
├── modules
│   ├── aws-data
│   │   ├── main.tf
│   │   └── outputs.tf
│   ├── rds-aurora
│   │   └── main.tf
│   ├── rds-sg
│   │   └── main.tf
│   └── vpc
│   └── main.tf
└── terragrunt.hcl
The rds-sg is the security group depends on the vpc.
The terragrunt.hcl under dev and prod has the same code like this.
terraform {
source = format("%s/modules//%s", get_parent_terragrunt_dir(), path_relative_to_include())
}
include {
path = find_in_parent_folders()
}
dependencies {
paths = ["../vpc"] # not dry
}
dependency "vpc" {
config_path = "../vpc" # not dry
}
inputs = {
vpc_id = dependency.vpc.outputs.vpc_id # if something changes or we need more inputs
}
As described in the comments, some codes are not so DRY. If I want to change something like change to another vpc or add more inputs, then I need to modify this file everywhere.
So I want something in the main.tf under modules
module "rds-sg" {
source = "terraform-aws-modules/security-group/aws//modules/mysql"
name = "${var.name_prefix}-db-sg"
description = "Security group for mysql 3306 port open within VPC"
vpc_id = ""
# I want something like
# vpc_id = dependency.vpc.outputs.vpc_id
}
Is that possible? or some better practices to solve this problem?
Thanks very much.
Maybe using terraform_remote_state can fix this problem. Any better idea?
This comment may explain this problem better.
https://github.com/gruntwork-io/terragrunt/issues/759#issuecomment-687610130

Answer 1

I would use Data sources to read any ID for any resources:
Add this to the module that uses VPC ID.
data "aws_vpc" "this" {
filter {
name = "tag:Name"
values = [var.name]
}
}
...
vpc_id = data.aws_vpc.this.id
This way you are making sure to read from AWS API not from State file, which has on plan validation also.