key_groups should only require 1 group to decrypt minimum about sops HOT 2 OPEN

my solution for now, because I am using this alongside terragrunt is to just use the sops terraform provider directly in my TF manifests vs loading the file in using terragrunt's syntax

from sops.

Why don't you put all keys into the same group, if you want to decrpyt with only one key?

creation_rules:
- path_regex: \.yaml$
  key_groups:
  - kms:
    - arn: 'arn'
      role: 'arn'
    age:
        - ageblah

from sops.