Remote-exec provisioner in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What is the output of this Terraform remote-exec provisioner block?

Given the following Terraform resource configuration, what will be the output when the remote-exec provisioner runs successfully?

Terraform

resource "aws_instance" "example" {
  ami           = "ami-12345678"
  instance_type = "t2.micro"

  provisioner "remote-exec" {
    inline = [
      "echo Hello World > /tmp/hello.txt",
      "cat /tmp/hello.txt"
    ]

    connection {
      type        = "ssh"
      user        = "ec2-user"
      private_key = file("~/.ssh/id_rsa")
      host        = self.public_ip
    }
  }
}

A The provisioner will create /tmp/hello.txt but will not output anything in the logs.

B The provisioner will fail because the file /tmp/hello.txt does not exist before the echo command.

C The file /tmp/hello.txt will contain 'Hello World' and the provisioner outputs 'Hello World' in logs.

D The provisioner will output an error due to missing sudo privileges.

💡 Hint

Think about what the inline commands do and how remote-exec outputs command results.

The inline commands first create a file with 'Hello World' and then output its contents. The remote-exec provisioner logs the output of commands, so 'Hello World' appears in the logs.

❓ Configuration

intermediate

Which option correctly configures a remote-exec provisioner with a WinRM connection?

You want to run a remote-exec provisioner on a Windows instance using WinRM. Which configuration snippet is correct?

A

connection {
  type     = "winrm"
  user     = "Administrator"
  password = var.winrm_password
  host     = self.private_ip
  https    = true
}

B

connection {
  type     = "ssh"
  user     = "Administrator"
  password = var.winrm_password
  host     = self.public_ip
}

C

connection {
  type     = "winrm"
  user     = "Administrator"
  private_key = file("~/.ssh/id_rsa")
  host     = self.public_ip
}

D

connection {
  type     = "winrm"
  user     = "Administrator"
  password = var.winrm_password
  host     = self.public_ip
  https    = false
}

💡 Hint

WinRM uses username and password, not SSH keys, and can use HTTP or HTTPS.

Option D correctly sets type to winrm, uses user and password, sets host to public IP, and disables HTTPS which is common for testing.

❓ Architecture

advanced

What is the main risk of using remote-exec provisioner in Terraform for production infrastructure?

Consider a production environment where Terraform uses remote-exec provisioners to configure instances after creation. What is the biggest architectural risk of this approach?

A Remote-exec provisioners always fail if the instance is in a private subnet.

B Remote-exec provisioners can cause configuration drift because they run outside Terraform's state management.

C Remote-exec provisioners automatically rollback changes if the script fails.

D Remote-exec provisioners require manual approval before running.

💡 Hint

Think about how Terraform tracks resources and what happens when changes happen outside Terraform.

Remote-exec runs commands on instances but Terraform does not track the changes made by those commands, leading to possible drift between actual and declared state.

❓ security

advanced

Which option describes a security best practice when using remote-exec provisioners?

When using remote-exec provisioners in Terraform, which practice improves security?

A Use ephemeral SSH keys and limit their scope to the provisioning session only.

B Store private keys in the Terraform configuration files for easy access.

C Use the root user for all remote-exec connections to avoid permission issues.

D Disable all firewall rules to allow unrestricted access during provisioning.

💡 Hint

Think about minimizing exposure of credentials and limiting access.

Using ephemeral SSH keys that exist only during provisioning reduces risk if keys are compromised. Avoid storing private keys in code or using root unnecessarily.

🧠 Conceptual

expert

What happens if a remote-exec provisioner command fails during Terraform apply?

During a Terraform apply, a remote-exec provisioner runs a command that returns a non-zero exit code. What is Terraform's behavior?

A Terraform stops the apply process and marks the resource creation as failed, rolling back changes if possible.

B Terraform ignores the error and continues applying other resources.

C Terraform retries the command indefinitely until it succeeds.

D Terraform completes the apply but marks the resource as tainted.

💡 Hint

Consider how Terraform treats provisioner failures during resource creation.

Terraform treats provisioner failures as resource creation failures, stops the apply, and attempts to rollback or destroy the resource to keep state consistent.