Why provisioners are a last resort in Terraform - Visual Breakdown

Process Flow - Why provisioners are a last resort

Start Terraform Apply

↓

Create Resource

↓

Check if Provisioner Needed?

No→Finish

Yes↓

Run Provisioner Script

↓

Provisioner Success?

No→Error: Fail Apply

Yes↓

Finish

Terraform creates resources first, then runs provisioners only if needed. If provisioners fail, the apply fails, so they are used only as a last step.

Execution Sample

Terraform

resource "aws_instance" "example" {
  ami           = "ami-123456"
  instance_type = "t2.micro"

  provisioner "local-exec" {
    command = "echo Hello"
  }
}

This Terraform code creates an AWS instance and runs a local command after creation.

Process Table

Step	Action	Resource State	Provisioner Run	Result
1	Start apply	No resources	No	Begin deployment
2	Create aws_instance.example	Instance created	No	Resource ready
3	Check provisioner	Instance created	Yes	Run local-exec
4	Run provisioner command	Instance created	Yes	Command executed successfully
5	Provisioner success?	Instance created	Yes	Apply completes successfully

💡 Provisioners run only after resource creation; failure causes apply to fail, so use sparingly.

Status Tracker

Variable	Start	After Step 2	After Step 4	Final
Resource State	None	Created	Created	Created
Provisioner Status	Not run	Not run	Success	Success

Key Moments - 3 Insights

Why does Terraform run provisioners only after resource creation?

Because provisioners depend on the resource existing; as shown in execution_table step 3, provisioners run after creation to configure the resource.

What happens if a provisioner fails during apply?

Terraform stops and marks apply as failed, as seen in the flow where failure leads to error and no finish, so provisioners can cause deployment to fail.

Why should provisioners be a last resort?

Because they add risk of failure and reduce Terraform's ability to manage resources declaratively, shown by the dependency on provisioner success to complete apply.

Visual Quiz - 3 Questions

Look at the execution_table, at which step does Terraform run the provisioner?

A Step 2

B Step 3

C Step 1

D Step 5

💡 Hint

Check the 'Provisioner Run' column in execution_table rows.

According to variable_tracker, what is the Provisioner Status after step 4?

A Success

B Not run

C Failed

D Unknown

💡 Hint

Look at the 'Provisioner Status' row and the 'After Step 4' column.

If the provisioner command fails, what happens to the apply process?

A Apply continues without error

B Apply retries automatically

C Apply fails and stops

D Provisioner is skipped

💡 Hint

Refer to concept_flow where failure leads to 'Error: Fail Apply'.

Concept Snapshot

Terraform creates resources first.
Provisioners run only after resource creation.
If provisioners fail, apply fails.
Use provisioners only as a last resort.
They add risk and reduce declarative control.

Full Transcript

Terraform first creates the resource. After creation, it checks if any provisioners need to run. If yes, it runs the provisioner scripts. If the provisioner succeeds, the apply finishes successfully. If the provisioner fails, Terraform stops and marks the apply as failed. Because provisioners can cause failures and reduce Terraform's declarative management, they should be used only as a last resort.