Remote-exec provisioner in Terraform - Mini Project: Build & Apply

Using Terraform Remote-exec Provisioner

📖 Scenario: You are setting up a cloud server and want to run a simple command on it right after it is created. This helps you install software or configure the server automatically.

🎯 Goal: Build a Terraform configuration that creates a virtual machine and uses the remote-exec provisioner to run a command on the server after creation.

📋 What You'll Learn

Create an AWS EC2 instance resource named aws_instance.example

Add a remote-exec provisioner inside the instance resource

Use the provisioner to run the command echo Hello, Terraform! on the instance

Configure connection details for the provisioner using SSH

💡 Why This Matters

🌍 Real World

Automating server setup by running commands immediately after the server is created saves time and reduces manual errors.

💼 Career

Cloud engineers and DevOps professionals use remote-exec provisioners to automate configuration and deployment tasks on cloud instances.

1

Create AWS EC2 instance resource

Create a resource block named aws_instance.example with ami set to "ami-0c55b159cbfafe1f0" and instance_type set to "t2.micro".

Terraform

# Your code here to create aws_instance.example resource

Hint

The resource block defines the EC2 instance with the given AMI and instance type.

2

Add SSH connection configuration

Add a connection block inside aws_instance.example with type set to "ssh", user set to "ec2-user", and private_key set to file("~/.ssh/id_rsa").

Terraform

resource "aws_instance" "example" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"

  # Add connection block here
}

Hint

The connection block tells Terraform how to connect to the instance via SSH.

3

Add remote-exec provisioner to run a command

Inside aws_instance.example, add a provisioner "remote-exec" block that runs the command echo Hello, Terraform! using the inline argument.

Terraform

resource "aws_instance" "example" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"

  connection {
    type        = "ssh"
    user        = "ec2-user"
    private_key = file("~/.ssh/id_rsa")
  }

  # Add remote-exec provisioner here
}

Hint

The remote-exec provisioner runs commands on the remote instance after creation.

4

Add public IP to connect to the instance

Add associate_public_ip_address = true inside the aws_instance.example resource to ensure the instance gets a public IP for SSH connection.

Terraform

resource "aws_instance" "example" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"

  connection {
    type        = "ssh"
    user        = "ec2-user"
    private_key = file("~/.ssh/id_rsa")
  }

  provisioner "remote-exec" {
    inline = ["echo Hello, Terraform!"]
  }

  # Add associate_public_ip_address here
}

Hint

Setting associate_public_ip_address to true allows SSH access to the instance.

Practice

1. What is the main purpose of the remote-exec provisioner in Terraform?

easy

A. To run commands on a remote machine after it is created

B. To create a new virtual machine in the cloud

C. To store Terraform state files remotely

D. To manage user permissions on the local machine

Solution

1. Step 1: Understand the role of provisioners

   Provisioners in Terraform run scripts or commands on resources after creation.

2. Step 2: Identify what remote-exec does

   The remote-exec provisioner connects to the remote machine and runs commands there.

3. Final Answer:

   To run commands on a remote machine after it is created -> Option A

4. Quick Check:

   remote-exec runs remote commands = D [OK]

Hint: remote-exec runs commands remotely after resource creation [OK]

Common Mistakes:

• Confusing remote-exec with resource creation
• Thinking remote-exec manages local files
• Mixing remote-exec with state management

2. Which of the following is the correct syntax to define a remote-exec provisioner inside a Terraform resource?

easy

A. remote_exec { commands = ["echo Hello"] }

B. provisioner remote-exec { script = "hello.sh" }

C. provisioner "remote-exec" { inline = ["echo Hello"] }

D. exec_remote { inline = ["echo Hello"] }

Solution

1. Step 1: Recall Terraform provisioner syntax

   Provisioners are defined with the keyword provisioner followed by the provisioner type in quotes.

2. Step 2: Check the correct block structure for remote-exec

   The remote-exec provisioner uses inline to run commands directly.

3. Final Answer:

   provisioner "remote-exec" { inline = ["echo Hello"] } -> Option C

4. Quick Check:

   Correct provisioner block syntax = B [OK]

Hint: Use provisioner "remote-exec" with inline commands [OK]

Common Mistakes:

• Using underscores instead of hyphens in provisioner name
• Omitting quotes around provisioner type
• Using wrong block names like exec_remote

3. Given this Terraform snippet inside an AWS EC2 resource:

provisioner "remote-exec" {
  inline = ["sudo apt-get update", "sudo apt-get install -y nginx"]
  connection {
    type        = "ssh"
    user        = "ubuntu"
    private_key = file("~/.ssh/id_rsa")
    host        = self.public_ip
  }
}

What will happen when this runs successfully?

medium

A. The commands will run locally on the Terraform machine

B. The EC2 instance will update packages and install nginx via SSH

C. Terraform will fail because private_key cannot be a file

D. The EC2 instance will reboot automatically after installation

Solution

1. Step 1: Understand remote-exec with connection block

   The provisioner connects via SSH using the given user, key, and host to run commands remotely.

2. Step 2: Analyze the inline commands

   The commands update package lists and install nginx on the remote EC2 instance.

3. Final Answer:

   The EC2 instance will update packages and install nginx via SSH -> Option B

4. Quick Check:

   remote-exec runs commands remotely = C [OK]

Hint: remote-exec runs inline commands on remote host via SSH [OK]

Common Mistakes:

• Thinking commands run locally
• Assuming private_key cannot be a file
• Expecting automatic reboot after install

4. You have this Terraform snippet:

provisioner "remote-exec" {
  inline = ["sudo apt-get update", "sudo apt-get install -y nginx"]
  connection {
    type     = "ssh"
    user     = "ubuntu"
    password = "mypassword"
    host     = self.public_ip
  }
}

After running Terraform apply, you get a connection timeout error. What is the most likely cause?

medium

A. The EC2 instance's security group does not allow SSH (port 22) inbound

B. The password authentication is not supported by SSH

C. The inline commands have syntax errors

D. The host attribute should be a private IP, not public IP

Solution

1. Step 1: Understand connection timeout causes

   Timeout usually means network connection to SSH port 22 is blocked or unreachable.

2. Step 2: Check common network issues

   If the EC2 security group lacks inbound SSH rules, connection fails despite correct credentials.

3. Final Answer:

   The EC2 instance's security group does not allow SSH (port 22) inbound -> Option A

4. Quick Check:

   Timeout = network block on SSH port 22 [OK]

Hint: Timeout usually means SSH port 22 blocked in firewall/security group [OK]

Common Mistakes:

• Blaming inline command syntax for connection errors
• Assuming password auth is always unsupported
• Confusing public and private IP for SSH host

5. You want to use remote-exec to run a script on multiple newly created instances in a loop. Which approach is best to ensure commands run on each instance correctly?

hard

A. Use local-exec provisioner to SSH manually to each instance

B. Define one resource and run remote-exec with a list of all instance IPs in one provisioner

C. Run remote-exec provisioner only once after all instances are created using a null_resource

D. Use a for_each on the resource and include a remote-exec provisioner inside each resource block

Solution

1. Step 1: Understand resource loops with provisioners

   Using for_each creates multiple resource instances, each with its own provisioner execution.

2. Step 2: Why per-resource provisioner is best

   Provisioners inside each resource run commands on that specific instance, ensuring correct targeting.

3. Final Answer:

   Use a for_each on the resource and include a remote-exec provisioner inside each resource block -> Option D

4. Quick Check:

   Provisioner per resource instance = A [OK]

Hint: Use for_each with provisioner inside resource for multiple instances [OK]

Common Mistakes:

• Trying to run remote-exec on all IPs in one provisioner
• Using null_resource without proper triggers
• Using local-exec instead of remote-exec for remote commands