Terragrunt assume-role

aws-config

# typically located at ~/.aws/config

[profile source-profile]
output=json
region=ap-southeast-2
mfa_serial=arn:aws:iam::123456789123:mfa/my-name
# assumes default backend, you can also use `--backend=file` or others
credential_process=aws-vault exec aws-vault-profile --json --prompt=osascript

[profile org-stage-role]
region=ap-southeast-2
role_arn=arn:aws:iam::123456789123:role/Allow-AdminAccess
source_profile=source-profile
# For aws-vault only:
include_profile=source-profile

example.sh

export AWS_SDK_LOAD_CONFIG=1
export AWS_PROFILE=org-stage-role
terragrunt init