diff --git a/cli/commands/terraform/action.go b/cli/commands/terraform/action.go
index 652593fcf3..651e013f6a 100644
--- a/cli/commands/terraform/action.go
+++ b/cli/commands/terraform/action.go
@@ -86,15 +86,16 @@ func RunWithTarget(ctx context.Context, opts *options.TerragruntOptions, target
 }
 
 func runTerraform(ctx context.Context, terragruntOptions *options.TerragruntOptions, target *Target) error {
-	if err := checkVersionConstraints(ctx, terragruntOptions); err != nil {
-		return target.runErrorCallback(terragruntOptions, nil, err)
-	}
-
+	// We need to get the credentials from auth-provider-cmd at the very beginning, since the locals block may contain `get_aws_account_id()` func.
 	credsGetter := creds.NewGetter()
 	if err := credsGetter.ObtainAndUpdateEnvIfNecessary(ctx, terragruntOptions, externalcmd.NewProvider(terragruntOptions)); err != nil {
 		return err
 	}
 
+	if err := checkVersionConstraints(ctx, terragruntOptions); err != nil {
+		return target.runErrorCallback(terragruntOptions, nil, err)
+	}
+
 	terragruntConfig, err := config.ReadTerragruntConfig(ctx, terragruntOptions, config.DefaultParserOptions(terragruntOptions))
 	if err != nil {
 		return target.runErrorCallback(terragruntOptions, terragruntConfig, err)
diff --git a/test/fixture-auth-provider-cmd/remote-state/terragrunt.hcl b/test/fixture-auth-provider-cmd/remote-state/terragrunt.hcl
index f1960160bb..57d1049283 100644
--- a/test/fixture-auth-provider-cmd/remote-state/terragrunt.hcl
+++ b/test/fixture-auth-provider-cmd/remote-state/terragrunt.hcl
@@ -1,3 +1,7 @@
+locals {
+  aws_account_id = "${get_aws_account_id()}"
+}
+
 remote_state {
   backend = "s3"
   generate = {