Provisioner failure behavior in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What happens when a local-exec provisioner fails during resource creation?

In Terraform, if a local-exec provisioner attached to a resource fails during the resource creation phase, what is the resulting behavior?

A Terraform marks the resource as created but reports the provisioner failure as a warning and continues.

B Terraform aborts the apply, marks the resource as tainted, and does not complete the resource creation.

C Terraform ignores the provisioner failure and completes the resource creation successfully.

D Terraform retries the provisioner indefinitely until it succeeds before marking the resource created.

💡 Hint

Think about how Terraform treats provisioner failures during resource creation.

Terraform treats provisioner failures during resource creation as errors, aborting the apply and marking the resource as tainted to indicate it needs recreation.

❓ service_behavior

intermediate

What is the default behavior of Terraform when a remote-exec provisioner fails during resource destruction?

If a remote-exec provisioner fails during the destruction of a resource, what does Terraform do by default?

A Terraform retries the provisioner once and then continues destroying the resource regardless of success.

B Terraform aborts the destroy operation and leaves the resource intact.

C Terraform ignores the failure and continues destroying the resource.

D Terraform marks the resource as tainted and stops the destroy operation.

💡 Hint

Consider how Terraform treats provisioner failures during destroy phase.

By default, Terraform ignores provisioner failures during resource destruction and continues with the destroy operation.

❓ Architecture

advanced

Which option correctly describes the effect of on_failure = 'continue' in a provisioner block?

In a Terraform provisioner block, setting on_failure = 'continue' changes the failure behavior. What is the exact effect of this setting?

A Terraform aborts the apply immediately on provisioner failure regardless of this setting.

B Terraform continues the apply even if the provisioner fails, but marks the resource as tainted.

C Terraform retries the provisioner until it succeeds before continuing the apply.

D Terraform continues the apply and does not mark the resource as tainted despite provisioner failure.

💡 Hint

Think about how on_failure controls marking resources as tainted.

Setting on_failure = 'continue' tells Terraform to continue the apply even if the provisioner fails and not mark the resource as tainted.

❓ security

advanced

What security risk arises if a provisioner script fails silently due to on_failure = 'continue'?

If a provisioner script that configures security settings fails but on_failure = 'continue' is set, what is the main security risk?

A The resource may be created without the intended security hardening, leaving it vulnerable.

B Terraform will alert the user immediately, preventing deployment.

C Terraform will roll back the resource, preventing insecure configurations.

D The provisioner failure will trigger an automatic security patch update.

💡 Hint

Consider what happens if security steps are skipped silently.

If the provisioner fails silently, the resource may lack critical security configurations, exposing it to vulnerabilities.

✅ Best Practice

expert

Which approach best ensures reliable provisioning with Terraform provisioners?

To minimize failures and ensure reliable execution of provisioner scripts in Terraform, which approach is best?

A Avoid provisioners entirely; use configuration management tools or cloud-init for provisioning instead.

B Use multiple provisioners with retries and <code>on_failure = 'continue'</code> to cover all failure cases.

C Use provisioners only for critical configuration and set <code>on_failure = 'continue'</code> to avoid apply failures.

D Run provisioners manually after Terraform apply to ensure success.

💡 Hint

Think about Terraform's recommended best practices for provisioning.

Terraform recommends avoiding provisioners when possible and using dedicated configuration management or cloud-init for reliable provisioning.

Practice

1.

What does the on_failure argument in a Terraform provisioner control?

easy

A. It controls what happens if the provisioner script or command fails.

B. It sets the timeout duration for the provisioner execution.

C. It defines the order in which provisioners run.

D. It specifies the operating system for the provisioner.

Solution

1. Step 1: Understand provisioner purpose

   Provisioners run scripts or commands after resource creation.

2. Step 2: Role of on_failure

   The on_failure argument controls what Terraform does if the provisioner fails.

3. Final Answer:

   It controls what happens if the provisioner script or command fails. -> Option A

4. Quick Check:

   on_failure controls failure behavior [OK]

Hint: Remember: on_failure decides action on provisioner failure [OK]

Common Mistakes:

• Confusing on_failure with timeout settings
• Thinking on_failure sets provisioner order
• Assuming on_failure defines OS type

2.

Which of the following is the correct syntax to make a provisioner continue even if it fails?

provisioner "local-exec" {
  command = "echo Hello"
  on_failure = ?
}

easy

A. "continue"

B. "fail"

C. "ignore"

D. "skip"

Solution

1. Step 1: Recall valid on_failure values

   Terraform supports fail and continue as valid on_failure values.

2. Step 2: Identify correct value to continue on failure

   To continue even if the provisioner fails, use continue.

3. Final Answer:

   "continue" -> Option A

4. Quick Check:

   on_failure = "continue" continues on failure [OK]

Hint: Use "continue" to ignore failure and proceed [OK]

Common Mistakes:

• Using invalid values like "ignore" or "skip"
• Confusing "fail" with continuing on failure
• Omitting quotes around the value

3.

Given this Terraform snippet, what happens if the local-exec provisioner command fails?

resource "null_resource" "example" {
  provisioner "local-exec" {
    command = "exit 1"
    on_failure = "fail"
  }
}

medium

A. Terraform retries the provisioner command automatically.

B. Terraform ignores the failure and continues applying other resources.

C. Terraform stops and reports an error, halting the apply process.

D. Terraform logs a warning but marks the resource as created.

Solution

1. Step 1: Analyze provisioner command and on_failure

   The command "exit 1" will fail. The on_failure is set to "fail".

2. Step 2: Understand effect of on_failure = "fail"

   This setting causes Terraform to stop and report an error if the provisioner fails.

3. Final Answer:

   Terraform stops and reports an error, halting the apply process. -> Option C

4. Quick Check:

   on_failure = "fail" stops on failure [OK]

Hint: Fail stops Terraform; continue lets it proceed [OK]

Common Mistakes:

• Assuming Terraform retries automatically
• Thinking failure is ignored with "fail"
• Believing resource is created despite failure

4.

Identify the error in this provisioner block that causes Terraform to ignore failures unexpectedly:

provisioner "remote-exec" {
  inline = ["false_command"]
  on_failure = fail
}

medium

A. The on_failure argument is not allowed in provisioners.

B. The on_failure value should be a string with quotes.

C. The provisioner type remote-exec is not supported.

D. The inline command is invalid and causes syntax error.

Solution

1. Step 1: Check on_failure syntax

   The value for on_failure must be a quoted string, e.g., "fail" or "continue".

2. Step 2: Identify impact of missing quotes

   Without quotes, Terraform treats it as an identifier, causing unexpected behavior or ignoring the setting.

3. Final Answer:

   The on_failure value should be a string with quotes. -> Option B

4. Quick Check:

   on_failure values require quotes [OK]

Hint: Always quote on_failure values "fail" or "continue" [OK]

Common Mistakes:

• Omitting quotes around on_failure values
• Confusing command errors with syntax errors
• Thinking on_failure is unsupported

5.

You want to run a local-exec provisioner that might fail but should not stop Terraform from creating other resources. Which configuration achieves this?

resource "null_resource" "example" {
  provisioner "local-exec" {
    command = "some_command"
    on_failure = ?
  }
}

hard

A. "fail" to stop on failure

B. "retry" to try again on failure

C. "ignore" to silently skip failure

D. "continue" to ignore failure and proceed

Solution

1. Step 1: Understand requirement to not stop Terraform

   The provisioner may fail but Terraform should continue creating other resources.

2. Step 2: Choose correct on_failure value

   Using on_failure = "continue" tells Terraform to ignore provisioner failure and proceed.

3. Final Answer:

   "continue" to ignore failure and proceed -> Option D

4. Quick Check:

   on_failure = "continue" allows continuation on failure [OK]

Hint: Use "continue" to keep going despite provisioner failure [OK]

Common Mistakes:

• Using unsupported values like "retry" or "ignore"
• Choosing "fail" which stops Terraform
• Not quoting the on_failure value