Provisioner failure behavior in Terraform - Step-by-Step Execution

Process Flow - Provisioner failure behavior

Start Terraform Apply

↓

Create Resource

↓

Run Provisioner

↓

Provisioner Success?

No→Handle Failure

↓

Fail or Continue

↓

Resource Ready

↓

End

Terraform creates a resource, runs the provisioner, then checks if it succeeded. On failure, it either stops or continues based on settings.

Execution Sample

Terraform

resource "aws_instance" "example" {
  ami           = "ami-123456"
  instance_type = "t2.micro"

  provisioner "local-exec" {
    command = "exit 1"
  }
}

This Terraform code creates an AWS instance and runs a local-exec provisioner that fails (exit 1).

Process Table

Step	Action	Provisioner Result	Behavior
1	Start terraform apply	N/A	Begin resource creation
2	Create aws_instance.example	N/A	Resource creation started
3	Run local-exec provisioner	Failure (exit 1)	Provisioner failed
4	Check failure handling	Failure detected	Terraform stops apply by default
5	Apply terminates	N/A	Resource creation rolled back

💡 Provisioner failed and Terraform stopped apply, rolling back resource creation

Status Tracker

Variable	Start	After Step 2	After Step 3	Final
Resource State	Not created	Creating	Provisioner failed	Rolled back
Provisioner Status	Not run	Not run	Failed	Failed

Key Moments - 2 Insights

Why does Terraform stop the apply when the provisioner fails?

By default, Terraform treats provisioner failure as a critical error and stops the apply to avoid inconsistent state, as shown in step 4 of the execution_table.

Can Terraform continue if a provisioner fails?

Yes, if you set 'on_failure = "continue"' in the provisioner block, Terraform will continue despite failure. This is not shown in the sample but changes behavior after step 4.

Visual Quiz - 3 Questions

Look at the execution_table, what is the provisioner result at step 3?

A Failure (exit 1)

B Success

C Not run

D Skipped

💡 Hint

Check the 'Provisioner Result' column at step 3 in the execution_table.

At which step does Terraform decide to stop the apply due to provisioner failure?

A Step 2

B Step 4

C Step 3

D Step 5

💡 Hint

Look at the 'Behavior' column to see when Terraform stops, in step 4.

If 'on_failure = continue' was set, how would the behavior at step 4 change?

A Terraform would stop apply immediately

B Provisioner would not run

C Terraform would continue apply despite failure

D Resource creation would be skipped

💡 Hint

Refer to key_moments about continuing on provisioner failure.

Concept Snapshot

Terraform runs provisioners after resource creation.
If a provisioner fails, Terraform stops apply by default.
Use 'on_failure = continue' to continue despite failure.
Failure causes resource rollback to keep state consistent.

Full Transcript

Terraform applies start by creating resources. After creation, provisioners run to perform extra setup. If a provisioner fails, Terraform detects this failure and stops the apply process to avoid inconsistent infrastructure. This means the resource creation is rolled back. However, you can configure provisioners with 'on_failure = continue' to let Terraform continue even if the provisioner fails. This behavior ensures your infrastructure state remains reliable and predictable.

Practice

1.

What does the on_failure argument in a Terraform provisioner control?

easy

A. It controls what happens if the provisioner script or command fails.

B. It sets the timeout duration for the provisioner execution.

C. It defines the order in which provisioners run.

D. It specifies the operating system for the provisioner.

Solution

1. Step 1: Understand provisioner purpose

   Provisioners run scripts or commands after resource creation.

2. Step 2: Role of on_failure

   The on_failure argument controls what Terraform does if the provisioner fails.

3. Final Answer:

   It controls what happens if the provisioner script or command fails. -> Option A

4. Quick Check:

   on_failure controls failure behavior [OK]

Hint: Remember: on_failure decides action on provisioner failure [OK]

Common Mistakes:

• Confusing on_failure with timeout settings
• Thinking on_failure sets provisioner order
• Assuming on_failure defines OS type

2.

Which of the following is the correct syntax to make a provisioner continue even if it fails?

provisioner "local-exec" {
  command = "echo Hello"
  on_failure = ?
}

easy

A. "continue"

B. "fail"

C. "ignore"

D. "skip"

Solution

1. Step 1: Recall valid on_failure values

   Terraform supports fail and continue as valid on_failure values.

2. Step 2: Identify correct value to continue on failure

   To continue even if the provisioner fails, use continue.

3. Final Answer:

   "continue" -> Option A

4. Quick Check:

   on_failure = "continue" continues on failure [OK]

Hint: Use "continue" to ignore failure and proceed [OK]

Common Mistakes:

• Using invalid values like "ignore" or "skip"
• Confusing "fail" with continuing on failure
• Omitting quotes around the value

3.

Given this Terraform snippet, what happens if the local-exec provisioner command fails?

resource "null_resource" "example" {
  provisioner "local-exec" {
    command = "exit 1"
    on_failure = "fail"
  }
}

medium

A. Terraform retries the provisioner command automatically.

B. Terraform ignores the failure and continues applying other resources.

C. Terraform stops and reports an error, halting the apply process.

D. Terraform logs a warning but marks the resource as created.

Solution

1. Step 1: Analyze provisioner command and on_failure

   The command "exit 1" will fail. The on_failure is set to "fail".

2. Step 2: Understand effect of on_failure = "fail"

   This setting causes Terraform to stop and report an error if the provisioner fails.

3. Final Answer:

   Terraform stops and reports an error, halting the apply process. -> Option C

4. Quick Check:

   on_failure = "fail" stops on failure [OK]

Hint: Fail stops Terraform; continue lets it proceed [OK]

Common Mistakes:

• Assuming Terraform retries automatically
• Thinking failure is ignored with "fail"
• Believing resource is created despite failure

4.

Identify the error in this provisioner block that causes Terraform to ignore failures unexpectedly:

provisioner "remote-exec" {
  inline = ["false_command"]
  on_failure = fail
}

medium

A. The on_failure argument is not allowed in provisioners.

B. The on_failure value should be a string with quotes.

C. The provisioner type remote-exec is not supported.

D. The inline command is invalid and causes syntax error.

Solution

1. Step 1: Check on_failure syntax

   The value for on_failure must be a quoted string, e.g., "fail" or "continue".

2. Step 2: Identify impact of missing quotes

   Without quotes, Terraform treats it as an identifier, causing unexpected behavior or ignoring the setting.

3. Final Answer:

   The on_failure value should be a string with quotes. -> Option B

4. Quick Check:

   on_failure values require quotes [OK]

Hint: Always quote on_failure values "fail" or "continue" [OK]

Common Mistakes:

• Omitting quotes around on_failure values
• Confusing command errors with syntax errors
• Thinking on_failure is unsupported

5.

You want to run a local-exec provisioner that might fail but should not stop Terraform from creating other resources. Which configuration achieves this?

resource "null_resource" "example" {
  provisioner "local-exec" {
    command = "some_command"
    on_failure = ?
  }
}

hard

A. "fail" to stop on failure

B. "retry" to try again on failure

C. "ignore" to silently skip failure

D. "continue" to ignore failure and proceed

Solution

1. Step 1: Understand requirement to not stop Terraform

   The provisioner may fail but Terraform should continue creating other resources.

2. Step 2: Choose correct on_failure value

   Using on_failure = "continue" tells Terraform to ignore provisioner failure and proceed.

3. Final Answer:

   "continue" to ignore failure and proceed -> Option D

4. Quick Check:

   on_failure = "continue" allows continuation on failure [OK]

Hint: Use "continue" to keep going despite provisioner failure [OK]

Common Mistakes:

• Using unsupported values like "retry" or "ignore"
• Choosing "fail" which stops Terraform
• Not quoting the on_failure value