File provisioner in Terraform - Step-by-Step Execution

Process Flow - File provisioner

Start Terraform Apply

↓

Create Resource (e.g., VM)

↓

Trigger File Provisioner

↓

Connect to Resource via SSH

↓

Copy Local File to Remote Path

↓

Confirm File Transfer Success

↓

Finish Provisioning

↓

Terraform Apply Complete

Terraform creates the resource, then connects via SSH to copy a local file to the remote machine before finishing.

Execution Sample

Terraform

resource "aws_instance" "example" {
  ami           = "ami-12345678"
  instance_type = "t2.micro"

  provisioner "file" {
    source      = "./app.conf"
    destination = "/tmp/app.conf"
  }
}

This code creates an AWS instance and copies the local file app.conf to /tmp/app.conf on the instance.

Process Table

Step	Action	Evaluation	Result
1	Start terraform apply	N/A	Begin resource creation
2	Create aws_instance.example	AMI and instance_type valid	Instance created and running
3	Trigger file provisioner	Provisioner block found	Prepare to copy file
4	Connect via SSH to instance	SSH credentials valid	Connection established
5	Copy ./app.conf to /tmp/app.conf	Local file exists	File copied successfully
6	Confirm file presence on instance	File checksum matches	File verified
7	Finish provisioning	All provisioners successful	Terraform apply completes

💡 All steps completed successfully; file provisioner copied file and Terraform apply finished.

Status Tracker

Variable	Start	After Step 2	After Step 5	Final
aws_instance.example	undefined	created (running)	created (running)	created (running)
file provisioner status	not started	pending	file copied	completed

Key Moments - 3 Insights

Why does Terraform need SSH access for the file provisioner?

Terraform uses SSH to connect to the remote instance to copy the file, as shown in step 4 of the execution_table.

What happens if the local file does not exist?

The file provisioner fails at step 5 because it cannot find the source file to copy, stopping the apply process.

Is the file provisioner run before or after the resource is created?

It runs after the resource is created and running, as seen between steps 2 and 3 in the execution_table.

Visual Quiz - 3 Questions

Look at the execution_table, at which step is the file actually copied to the instance?

A Step 5

B Step 4

C Step 3

D Step 6

💡 Hint

Refer to the 'Action' column in execution_table row 5.

According to variable_tracker, what is the status of the file provisioner after step 5?

A pending

B file copied

C not started

D completed

💡 Hint

Check the 'file provisioner status' row after 'After Step 5' column.

If SSH credentials were invalid, at which step would the process fail?

A Step 2

B Step 5

C Step 4

D Step 6

💡 Hint

Look at the 'Connect via SSH to instance' action in execution_table step 4.

Concept Snapshot

Terraform File Provisioner:
- Runs after resource creation
- Uses SSH to connect to remote machine
- Copies local file to remote destination
- Fails if local file missing or SSH fails
- Useful for simple file transfers during provisioning

Full Transcript

The Terraform file provisioner runs after the resource is created. Terraform connects to the remote machine using SSH. It copies a local file to a specified path on the remote machine. The process verifies the file transfer. If the local file is missing or SSH connection fails, the provisioner stops the apply. This helps automate file setup on new resources.

Practice

1. What is the main purpose of the file provisioner in Terraform?

easy

A. To execute shell commands on a remote server

B. To destroy resources after use

C. To create new cloud resources like virtual machines

D. To copy files from your local machine to a remote server during resource creation

Solution

1. Step 1: Understand the role of the file provisioner

   The file provisioner is designed to transfer files from your local computer to a remote machine during Terraform resource setup.

2. Step 2: Differentiate from other provisioners

   Unlike remote-exec which runs commands, file provisioner only copies files, not executes commands or manages resource lifecycle.

3. Final Answer:

   To copy files from your local machine to a remote server during resource creation -> Option D

4. Quick Check:

   File provisioner copies files = B [OK]

Hint: File provisioner = copy files to server [OK]

Common Mistakes:

• Confusing file provisioner with remote-exec
• Thinking it creates or destroys resources
• Assuming it runs commands on the server

2. Which of the following is the correct syntax to use the file provisioner in a Terraform resource block?

easy

A. provisioner file { source = "./app.conf" destination = "/etc/app.conf" }

B. provisioner "file" { source = "./app.conf" destination = "/etc/app.conf" }

C. provisioner "copy" { src = "./app.conf" dest = "/etc/app.conf" }

D. provisioner "file" { src = "./app.conf" dst = "/etc/app.conf" }

Solution

1. Step 1: Recall correct provisioner block syntax

   The provisioner block requires the provisioner type in quotes, e.g., "file", and uses source and destination keys.

2. Step 2: Identify correct attribute names

   The file provisioner uses source and destination, not src/dest or unquoted provisioner type.

3. Final Answer:

   provisioner "file" { source = "./app.conf" destination = "/etc/app.conf" } -> Option B

4. Quick Check:

   Use quotes and source/destination keys = A [OK]

Hint: Use quotes and source/destination keys for file provisioner [OK]

Common Mistakes:

• Omitting quotes around provisioner type
• Using incorrect attribute names like src/dest
• Using wrong provisioner type like "copy"

3. Given this Terraform snippet inside a resource:

provisioner "file" {
  source      = "./setup.sh"
  destination = "/tmp/setup.sh"
}
provisioner "remote-exec" {
  inline = ["chmod +x /tmp/setup.sh", "/tmp/setup.sh"]
}

What will happen after Terraform applies this resource?

medium

A. The setup.sh script is copied to /tmp and then executed with execute permission

B. The setup.sh script is copied but not executed

C. Terraform will fail because file and remote-exec cannot be used together

D. The script is executed locally but not copied to the server

Solution

1. Step 1: Understand file provisioner behavior

   The file provisioner copies the local file setup.sh to the remote path /tmp/setup.sh.

2. Step 2: Understand remote-exec provisioner behavior

   The remote-exec provisioner runs commands on the remote server, here changing permissions and executing the script.

3. Final Answer:

   The setup.sh script is copied to /tmp and then executed with execute permission -> Option A

4. Quick Check:

   File copies + remote-exec runs commands = A [OK]

Hint: File copies, remote-exec runs commands after [OK]

Common Mistakes:

• Thinking file provisioner runs commands
• Believing file and remote-exec cannot be combined
• Assuming script runs locally instead of remotely

4. You wrote this provisioner block:

provisioner "file" {
  source = "./config.yaml"
  destination = "/etc/config.yaml"
  connection {
    type     = "ssh"
    user     = "ubuntu"
    password = "mypassword"
  }
}

Terraform apply fails with a connection error. What is the most likely cause?

medium

A. The destination path must be a directory, not a file

B. The password authentication is not supported; use private_key instead

C. The connection block is inside the provisioner block, but it should be at the resource level

D. The source file path is incorrect

Solution

1. Step 1: Check connection block placement

   In Terraform, the connection block must be defined at the resource level, not inside the provisioner block.

2. Step 2: Understand connection block scope

   Placing connection inside provisioner causes Terraform to not find connection details, leading to connection errors.

3. Final Answer:

   The connection block is inside the provisioner block, but it should be at the resource level -> Option C

4. Quick Check:

   Connection block at resource level, not inside provisioner = D [OK]

Hint: Place connection block outside provisioner, inside resource [OK]

Common Mistakes:

• Putting connection block inside provisioner
• Assuming password auth is always unsupported
• Mistaking file path or destination format as cause

5. You want to copy multiple files from your local ./scripts folder to the remote server's /usr/local/bin directory using the file provisioner. Which approach is best to achieve this efficiently?

hard

A. Use a single file provisioner with source = "./scripts" and destination = "/usr/local/bin" to copy the whole folder

B. Write multiple file provisioner blocks, one for each file inside ./scripts

C. Compress the folder into a zip file, copy it with file provisioner, then unzip remotely with remote-exec

D. Use a remote-exec provisioner to download files from a public URL instead

Solution

1. Step 1: Understand file provisioner folder copying

   The file provisioner natively supports copying entire folders recursively by specifying a folder as source and a directory as destination.

2. Step 2: Differentiate efficiency of approaches

   Use a single file provisioner with source = "./scripts" and destination = "/usr/local/bin" to copy the whole folder directly copies the directory contents to /usr/local/bin efficiently without extra compression or multiple blocks.

3. Final Answer:

   Use a single file provisioner with source = "./scripts" and destination = "/usr/local/bin" to copy the whole folder -> Option A

4. Quick Check:

   File provisioner copies dir recursively = A [OK]

Hint: File provisioner copies dir recursively with source=dir destination=dir [OK]

Common Mistakes:

• Thinking file provisioner cannot copy folders recursively
• Using multiple provisioner blocks unnecessarily
• Resorting to compression when direct recursive copy works