File provisioner in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Configuration

intermediate

File Provisioner Destination Path Behavior

You use a Terraform file provisioner to copy a file to a remote VM. What will happen if the destination path points to a directory that does not exist on the remote machine?

Terraform

provisioner "file" {
  source      = "app.conf"
  destination = "/etc/myapp/config/"
}

A Terraform creates the missing directory path automatically and copies the file inside it.

B Terraform copies the file to the user's home directory instead.

C Terraform copies the file but renames it to the directory name.

D Terraform fails with an error because the destination directory does not exist.

💡 Hint

Think about how file copying works on remote systems when the target folder is missing.

The file provisioner requires the destination directory to exist. It does not create directories automatically. If the directory is missing, Terraform returns an error.

❓ service_behavior

intermediate

File Provisioner Execution Timing

When does the Terraform file provisioner run during the resource lifecycle?

A Before the resource is created.

B After the resource is created and after all other provisioners.

C After the resource is created but before any <code>remote-exec</code> provisioners.

D Only during resource destruction.

💡 Hint

Consider the order of provisioners in Terraform.

The file provisioner runs immediately after the resource is created, before any remote-exec provisioners run. This allows files to be copied before commands execute remotely.

❓ security

advanced

File Provisioner and Sensitive Data Handling

You need to copy a sensitive configuration file containing secrets to a remote server using the Terraform file provisioner. Which approach best protects the sensitive data during provisioning?

A Use the <code>source</code> attribute pointing to a local file and rely on SSH encryption.

B Store the file content in a Terraform variable marked as sensitive and use <code>content</code> attribute in the provisioner.

C Encode the file content in base64 and decode it on the remote server after copying.

D Copy the file normally and delete it immediately after provisioning.

💡 Hint

Think about Terraform's sensitive variable feature and how it prevents data exposure.

Marking the file content as a sensitive variable and using the content attribute avoids storing the file on disk and reduces exposure in logs. SSH encrypts data in transit but does not prevent local exposure.

❓ Architecture

advanced

File Provisioner Usage in Immutable Infrastructure

In an immutable infrastructure approach, which statement about using the Terraform file provisioner is correct?

A File provisioners should be avoided because they modify resources after creation, breaking immutability.

B File provisioners are ideal because they allow dynamic file changes after resource creation.

C File provisioners are required to configure immutable resources during creation.

D File provisioners automatically create new immutable resources when files change.

💡 Hint

Recall what immutable infrastructure means for resource changes.

Immutable infrastructure means resources are replaced rather than modified. Using file provisioners modifies resources after creation, which breaks immutability principles.

🧠 Conceptual

expert

Terraform File Provisioner Behavior on Resource Update

If you update the source file used in a Terraform file provisioner and run terraform apply without changing the resource configuration, what happens?

A Terraform does not detect changes in the source file and does not re-run the provisioner.

B Terraform throws an error about unmanaged file changes.

C Terraform detects the file change and re-runs the provisioner to update the remote file.

D Terraform destroys and recreates the resource to apply the updated file.

💡 Hint

Think about how Terraform tracks changes and what triggers provisioners.

Terraform does not track changes in local files used by the file provisioner. Without resource configuration changes, it does not re-run provisioners or update remote files.

Practice

1. What is the main purpose of the file provisioner in Terraform?

easy

A. To execute shell commands on a remote server

B. To destroy resources after use

C. To create new cloud resources like virtual machines

D. To copy files from your local machine to a remote server during resource creation

Solution

1. Step 1: Understand the role of the file provisioner

   The file provisioner is designed to transfer files from your local computer to a remote machine during Terraform resource setup.

2. Step 2: Differentiate from other provisioners

   Unlike remote-exec which runs commands, file provisioner only copies files, not executes commands or manages resource lifecycle.

3. Final Answer:

   To copy files from your local machine to a remote server during resource creation -> Option D

4. Quick Check:

   File provisioner copies files = B [OK]

Hint: File provisioner = copy files to server [OK]

Common Mistakes:

• Confusing file provisioner with remote-exec
• Thinking it creates or destroys resources
• Assuming it runs commands on the server

2. Which of the following is the correct syntax to use the file provisioner in a Terraform resource block?

easy

A. provisioner file { source = "./app.conf" destination = "/etc/app.conf" }

B. provisioner "file" { source = "./app.conf" destination = "/etc/app.conf" }

C. provisioner "copy" { src = "./app.conf" dest = "/etc/app.conf" }

D. provisioner "file" { src = "./app.conf" dst = "/etc/app.conf" }

Solution

1. Step 1: Recall correct provisioner block syntax

   The provisioner block requires the provisioner type in quotes, e.g., "file", and uses source and destination keys.

2. Step 2: Identify correct attribute names

   The file provisioner uses source and destination, not src/dest or unquoted provisioner type.

3. Final Answer:

   provisioner "file" { source = "./app.conf" destination = "/etc/app.conf" } -> Option B

4. Quick Check:

   Use quotes and source/destination keys = A [OK]

Hint: Use quotes and source/destination keys for file provisioner [OK]

Common Mistakes:

• Omitting quotes around provisioner type
• Using incorrect attribute names like src/dest
• Using wrong provisioner type like "copy"

3. Given this Terraform snippet inside a resource:

provisioner "file" {
  source      = "./setup.sh"
  destination = "/tmp/setup.sh"
}
provisioner "remote-exec" {
  inline = ["chmod +x /tmp/setup.sh", "/tmp/setup.sh"]
}

What will happen after Terraform applies this resource?

medium

A. The setup.sh script is copied to /tmp and then executed with execute permission

B. The setup.sh script is copied but not executed

C. Terraform will fail because file and remote-exec cannot be used together

D. The script is executed locally but not copied to the server

Solution

1. Step 1: Understand file provisioner behavior

   The file provisioner copies the local file setup.sh to the remote path /tmp/setup.sh.

2. Step 2: Understand remote-exec provisioner behavior

   The remote-exec provisioner runs commands on the remote server, here changing permissions and executing the script.

3. Final Answer:

   The setup.sh script is copied to /tmp and then executed with execute permission -> Option A

4. Quick Check:

   File copies + remote-exec runs commands = A [OK]

Hint: File copies, remote-exec runs commands after [OK]

Common Mistakes:

• Thinking file provisioner runs commands
• Believing file and remote-exec cannot be combined
• Assuming script runs locally instead of remotely

4. You wrote this provisioner block:

provisioner "file" {
  source = "./config.yaml"
  destination = "/etc/config.yaml"
  connection {
    type     = "ssh"
    user     = "ubuntu"
    password = "mypassword"
  }
}

Terraform apply fails with a connection error. What is the most likely cause?

medium

A. The destination path must be a directory, not a file

B. The password authentication is not supported; use private_key instead

C. The connection block is inside the provisioner block, but it should be at the resource level

D. The source file path is incorrect

Solution

1. Step 1: Check connection block placement

   In Terraform, the connection block must be defined at the resource level, not inside the provisioner block.

2. Step 2: Understand connection block scope

   Placing connection inside provisioner causes Terraform to not find connection details, leading to connection errors.

3. Final Answer:

   The connection block is inside the provisioner block, but it should be at the resource level -> Option C

4. Quick Check:

   Connection block at resource level, not inside provisioner = D [OK]

Hint: Place connection block outside provisioner, inside resource [OK]

Common Mistakes:

• Putting connection block inside provisioner
• Assuming password auth is always unsupported
• Mistaking file path or destination format as cause

5. You want to copy multiple files from your local ./scripts folder to the remote server's /usr/local/bin directory using the file provisioner. Which approach is best to achieve this efficiently?

hard

A. Use a single file provisioner with source = "./scripts" and destination = "/usr/local/bin" to copy the whole folder

B. Write multiple file provisioner blocks, one for each file inside ./scripts

C. Compress the folder into a zip file, copy it with file provisioner, then unzip remotely with remote-exec

D. Use a remote-exec provisioner to download files from a public URL instead

Solution

1. Step 1: Understand file provisioner folder copying

   The file provisioner natively supports copying entire folders recursively by specifying a folder as source and a directory as destination.

2. Step 2: Differentiate efficiency of approaches

   Use a single file provisioner with source = "./scripts" and destination = "/usr/local/bin" to copy the whole folder directly copies the directory contents to /usr/local/bin efficiently without extra compression or multiple blocks.

3. Final Answer:

   Use a single file provisioner with source = "./scripts" and destination = "/usr/local/bin" to copy the whole folder -> Option A

4. Quick Check:

   File provisioner copies dir recursively = A [OK]

Hint: File provisioner copies dir recursively with source=dir destination=dir [OK]

Common Mistakes:

• Thinking file provisioner cannot copy folders recursively
• Using multiple provisioner blocks unnecessarily
• Resorting to compression when direct recursive copy works