Remote-exec provisioner in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What is the output of this Terraform remote-exec provisioner block?

Given the following Terraform resource configuration, what will be the output when the remote-exec provisioner runs successfully?

Terraform

resource "aws_instance" "example" {
  ami           = "ami-12345678"
  instance_type = "t2.micro"

  provisioner "remote-exec" {
    inline = [
      "echo Hello World > /tmp/hello.txt",
      "cat /tmp/hello.txt"
    ]

    connection {
      type        = "ssh"
      user        = "ec2-user"
      private_key = file("~/.ssh/id_rsa")
      host        = self.public_ip
    }
  }
}

A The provisioner will create /tmp/hello.txt but will not output anything in the logs.

B The provisioner will fail because the file /tmp/hello.txt does not exist before the echo command.

C The file /tmp/hello.txt will contain 'Hello World' and the provisioner outputs 'Hello World' in logs.

D The provisioner will output an error due to missing sudo privileges.

💡 Hint

Think about what the inline commands do and how remote-exec outputs command results.

The inline commands first create a file with 'Hello World' and then output its contents. The remote-exec provisioner logs the output of commands, so 'Hello World' appears in the logs.

❓ Configuration

intermediate

Which option correctly configures a remote-exec provisioner with a WinRM connection?

You want to run a remote-exec provisioner on a Windows instance using WinRM. Which configuration snippet is correct?

A

connection {
  type     = "winrm"
  user     = "Administrator"
  password = var.winrm_password
  host     = self.private_ip
  https    = true
}

B

connection {
  type     = "ssh"
  user     = "Administrator"
  password = var.winrm_password
  host     = self.public_ip
}

C

connection {
  type     = "winrm"
  user     = "Administrator"
  private_key = file("~/.ssh/id_rsa")
  host     = self.public_ip
}

D

connection {
  type     = "winrm"
  user     = "Administrator"
  password = var.winrm_password
  host     = self.public_ip
  https    = false
}

💡 Hint

WinRM uses username and password, not SSH keys, and can use HTTP or HTTPS.

Option D correctly sets type to winrm, uses user and password, sets host to public IP, and disables HTTPS which is common for testing.

❓ Architecture

advanced

What is the main risk of using remote-exec provisioner in Terraform for production infrastructure?

Consider a production environment where Terraform uses remote-exec provisioners to configure instances after creation. What is the biggest architectural risk of this approach?

A Remote-exec provisioners always fail if the instance is in a private subnet.

B Remote-exec provisioners can cause configuration drift because they run outside Terraform's state management.

C Remote-exec provisioners automatically rollback changes if the script fails.

D Remote-exec provisioners require manual approval before running.

💡 Hint

Think about how Terraform tracks resources and what happens when changes happen outside Terraform.

Remote-exec runs commands on instances but Terraform does not track the changes made by those commands, leading to possible drift between actual and declared state.

❓ security

advanced

Which option describes a security best practice when using remote-exec provisioners?

When using remote-exec provisioners in Terraform, which practice improves security?

A Use ephemeral SSH keys and limit their scope to the provisioning session only.

B Store private keys in the Terraform configuration files for easy access.

C Use the root user for all remote-exec connections to avoid permission issues.

D Disable all firewall rules to allow unrestricted access during provisioning.

💡 Hint

Think about minimizing exposure of credentials and limiting access.

Using ephemeral SSH keys that exist only during provisioning reduces risk if keys are compromised. Avoid storing private keys in code or using root unnecessarily.

🧠 Conceptual

expert

What happens if a remote-exec provisioner command fails during Terraform apply?

During a Terraform apply, a remote-exec provisioner runs a command that returns a non-zero exit code. What is Terraform's behavior?

A Terraform stops the apply process and marks the resource creation as failed, rolling back changes if possible.

B Terraform ignores the error and continues applying other resources.

C Terraform retries the command indefinitely until it succeeds.

D Terraform completes the apply but marks the resource as tainted.

💡 Hint

Consider how Terraform treats provisioner failures during resource creation.

Terraform treats provisioner failures as resource creation failures, stops the apply, and attempts to rollback or destroy the resource to keep state consistent.

Practice

1. What is the main purpose of the remote-exec provisioner in Terraform?

easy

A. To run commands on a remote machine after it is created

B. To create a new virtual machine in the cloud

C. To store Terraform state files remotely

D. To manage user permissions on the local machine

Solution

1. Step 1: Understand the role of provisioners

   Provisioners in Terraform run scripts or commands on resources after creation.

2. Step 2: Identify what remote-exec does

   The remote-exec provisioner connects to the remote machine and runs commands there.

3. Final Answer:

   To run commands on a remote machine after it is created -> Option A

4. Quick Check:

   remote-exec runs remote commands = D [OK]

Hint: remote-exec runs commands remotely after resource creation [OK]

Common Mistakes:

• Confusing remote-exec with resource creation
• Thinking remote-exec manages local files
• Mixing remote-exec with state management

2. Which of the following is the correct syntax to define a remote-exec provisioner inside a Terraform resource?

easy

A. remote_exec { commands = ["echo Hello"] }

B. provisioner remote-exec { script = "hello.sh" }

C. provisioner "remote-exec" { inline = ["echo Hello"] }

D. exec_remote { inline = ["echo Hello"] }

Solution

1. Step 1: Recall Terraform provisioner syntax

   Provisioners are defined with the keyword provisioner followed by the provisioner type in quotes.

2. Step 2: Check the correct block structure for remote-exec

   The remote-exec provisioner uses inline to run commands directly.

3. Final Answer:

   provisioner "remote-exec" { inline = ["echo Hello"] } -> Option C

4. Quick Check:

   Correct provisioner block syntax = B [OK]

Hint: Use provisioner "remote-exec" with inline commands [OK]

Common Mistakes:

• Using underscores instead of hyphens in provisioner name
• Omitting quotes around provisioner type
• Using wrong block names like exec_remote

3. Given this Terraform snippet inside an AWS EC2 resource:

provisioner "remote-exec" {
  inline = ["sudo apt-get update", "sudo apt-get install -y nginx"]
  connection {
    type        = "ssh"
    user        = "ubuntu"
    private_key = file("~/.ssh/id_rsa")
    host        = self.public_ip
  }
}

What will happen when this runs successfully?

medium

A. The commands will run locally on the Terraform machine

B. The EC2 instance will update packages and install nginx via SSH

C. Terraform will fail because private_key cannot be a file

D. The EC2 instance will reboot automatically after installation

Solution

1. Step 1: Understand remote-exec with connection block

   The provisioner connects via SSH using the given user, key, and host to run commands remotely.

2. Step 2: Analyze the inline commands

   The commands update package lists and install nginx on the remote EC2 instance.

3. Final Answer:

   The EC2 instance will update packages and install nginx via SSH -> Option B

4. Quick Check:

   remote-exec runs commands remotely = C [OK]

Hint: remote-exec runs inline commands on remote host via SSH [OK]

Common Mistakes:

• Thinking commands run locally
• Assuming private_key cannot be a file
• Expecting automatic reboot after install

4. You have this Terraform snippet:

provisioner "remote-exec" {
  inline = ["sudo apt-get update", "sudo apt-get install -y nginx"]
  connection {
    type     = "ssh"
    user     = "ubuntu"
    password = "mypassword"
    host     = self.public_ip
  }
}

After running Terraform apply, you get a connection timeout error. What is the most likely cause?

medium

A. The EC2 instance's security group does not allow SSH (port 22) inbound

B. The password authentication is not supported by SSH

C. The inline commands have syntax errors

D. The host attribute should be a private IP, not public IP

Solution

1. Step 1: Understand connection timeout causes

   Timeout usually means network connection to SSH port 22 is blocked or unreachable.

2. Step 2: Check common network issues

   If the EC2 security group lacks inbound SSH rules, connection fails despite correct credentials.

3. Final Answer:

   The EC2 instance's security group does not allow SSH (port 22) inbound -> Option A

4. Quick Check:

   Timeout = network block on SSH port 22 [OK]

Hint: Timeout usually means SSH port 22 blocked in firewall/security group [OK]

Common Mistakes:

• Blaming inline command syntax for connection errors
• Assuming password auth is always unsupported
• Confusing public and private IP for SSH host

5. You want to use remote-exec to run a script on multiple newly created instances in a loop. Which approach is best to ensure commands run on each instance correctly?

hard

A. Use local-exec provisioner to SSH manually to each instance

B. Define one resource and run remote-exec with a list of all instance IPs in one provisioner

C. Run remote-exec provisioner only once after all instances are created using a null_resource

D. Use a for_each on the resource and include a remote-exec provisioner inside each resource block

Solution

1. Step 1: Understand resource loops with provisioners

   Using for_each creates multiple resource instances, each with its own provisioner execution.

2. Step 2: Why per-resource provisioner is best

   Provisioners inside each resource run commands on that specific instance, ensuring correct targeting.

3. Final Answer:

   Use a for_each on the resource and include a remote-exec provisioner inside each resource block -> Option D

4. Quick Check:

   Provisioner per resource instance = A [OK]

Hint: Use for_each with provisioner inside resource for multiple instances [OK]

Common Mistakes:

• Trying to run remote-exec on all IPs in one provisioner
• Using null_resource without proper triggers
• Using local-exec instead of remote-exec for remote commands