Why provisioners run scripts on resources in Terraform - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why do Terraform provisioners run scripts on resources?

Terraform provisioners allow you to run scripts or commands on a resource after it is created. What is the main reason for using provisioners in Terraform?

A To configure or customize a resource immediately after creation when Terraform cannot do it natively.

B To replace Terraform's built-in resource creation logic with custom scripts.

C To permanently store state information outside of Terraform's state file.

D To automatically scale resources based on load without manual intervention.

💡 Hint

Think about what Terraform can and cannot do by itself when creating resources.

Provisioners run scripts on resources to perform configuration steps that Terraform does not support natively, such as installing software or running setup commands immediately after resource creation.

❓ Architecture

intermediate

When should you avoid using Terraform provisioners?

Which scenario is NOT a good reason to use Terraform provisioners?

A When the resource supports native Terraform configuration options.

B When you need to run a one-time setup script after resource creation.

C When you want to install software on a virtual machine after it launches.

D When you need to execute commands that Terraform cannot perform directly.

💡 Hint

Consider if Terraform already supports configuring the resource without extra scripts.

If Terraform supports configuring a resource natively, using provisioners is unnecessary and can complicate your infrastructure code.

❓ service_behavior

advanced

What happens if a Terraform provisioner script fails during apply?

Consider a Terraform configuration with a local-exec provisioner that runs a script on a resource. What is the behavior if the script returns a non-zero exit code?

A Terraform ignores the error and continues applying other resources.

B Terraform apply fails and marks the resource as tainted.

C Terraform marks the resource as tainted but continues the apply.

D Terraform retries the script automatically until it succeeds.

💡 Hint

Think about how Terraform treats errors during resource provisioning.

If a provisioner script fails, Terraform treats it as a failure of the resource creation or update, stops the apply process, and marks the resource as tainted.

❓ security

advanced

What is a security risk when using Terraform provisioners to run scripts on resources?

Running scripts on resources with provisioners can introduce security risks. Which of the following is a common risk?

A Provisioners prevent unauthorized access by default through secure tunnels.

B Terraform automatically encrypts all provisioner scripts, preventing exposure.

C Provisioners isolate scripts from the resource, so no risk exists.

D Embedding sensitive data like passwords directly in provisioner scripts or Terraform files.

💡 Hint

Consider how sensitive information is handled in scripts and Terraform configurations.

Embedding secrets directly in provisioner scripts or Terraform files can expose sensitive data in version control or logs, creating security vulnerabilities.

✅ Best Practice

expert

What is the recommended best practice regarding the use of Terraform provisioners?

Which statement best describes the recommended best practice for using Terraform provisioners?

A Avoid provisioners completely and rely only on manual post-deployment scripts.

B Use provisioners extensively to handle all configuration tasks for resources.

C Use provisioners only as a last resort when native Terraform resource features cannot achieve the desired configuration.

D Use provisioners to replace Terraform modules for better flexibility.

💡 Hint

Think about maintainability and reliability of infrastructure code.

Provisioners should be used sparingly and only when Terraform's native resource capabilities cannot perform the needed configuration, to keep infrastructure code clean and reliable.

Practice

1. Why do Terraform provisioners run scripts on resources?

easy

A. To backup resource data before creation

B. To delete resources automatically

C. To configure resources after they are created

D. To monitor resource usage continuously

Solution

1. Step 1: Understand provisioners' purpose

   Provisioners run scripts to configure resources after Terraform creates them.

2. Step 2: Identify correct use case

   They help install software or run commands Terraform cannot manage directly.

3. Final Answer:

   To configure resources after they are created -> Option C

4. Quick Check:

   Provisioners configure resources post-creation = D [OK]

Hint: Provisioners run scripts after resource creation [OK]

Common Mistakes:

• Thinking provisioners delete resources
• Assuming provisioners monitor resources
• Believing provisioners backup data

2. Which of the following is the correct syntax to use a local-exec provisioner in Terraform?

easy

A. provisioner "local-exec" { command = "echo Hello" }

B. provisioner local_exec { run = "echo Hello" }

C. provisioner "local-exec" (command: "echo Hello")

D. provisioner local-exec { execute = "echo Hello" }

Solution

1. Step 1: Recall correct provisioner block syntax

   Terraform uses provisioner blocks with type in quotes and a command attribute.

2. Step 2: Match syntax to options

   provisioner "local-exec" { command = "echo Hello" } matches the correct syntax: provisioner "local-exec" { command = "echo Hello" }.

3. Final Answer:

   provisioner "local-exec" { command = "echo Hello" } -> Option A

4. Quick Check:

   Correct provisioner syntax uses quotes and command attribute = A [OK]

Hint: Use quotes and command attribute for local-exec provisioner [OK]

Common Mistakes:

• Omitting quotes around provisioner type
• Using wrong attribute names like run or execute
• Using parentheses instead of braces

3. Given this Terraform snippet, what will happen when the resource is created?

resource "null_resource" "example" {
  provisioner "local-exec" {
    command = "echo Resource created"
  }
}

medium

A. Terraform will fail because null_resource cannot have provisioners

B. Terraform will print 'Resource created' after creating the resource

C. Terraform will create the resource but not run the command

D. Terraform will run the command before creating the resource

Solution

1. Step 1: Understand null_resource and local-exec provisioner

   null_resource supports provisioners; local-exec runs commands on the machine running Terraform after resource creation.

2. Step 2: Analyze command execution timing

   The command 'echo Resource created' runs after the resource is created, printing the message.

3. Final Answer:

   Terraform will print 'Resource created' after creating the resource -> Option B

4. Quick Check:

   local-exec runs command post-creation = A [OK]

Hint: local-exec runs commands after resource creation [OK]

Common Mistakes:

• Thinking null_resource disallows provisioners
• Assuming commands run before resource creation
• Believing commands won't run at all

4. You wrote this provisioner block but Terraform shows an error:

provisioner "remote-exec" {
  command = "sudo apt-get update"
}

What is the likely cause of the error?

medium

A. Provisioners cannot run sudo commands

B. The command attribute is invalid for remote-exec

C. remote-exec provisioner requires a local script file

D. Missing connection block to specify how to connect to the resource

Solution

1. Step 1: Check remote-exec requirements

   remote-exec provisioner needs a connection block to connect to the resource (SSH or WinRM).

2. Step 2: Identify missing connection block

   The snippet lacks a connection block, causing Terraform to error because it cannot connect to run the command.

3. Final Answer:

   Missing connection block to specify how to connect to the resource -> Option D

4. Quick Check:

   remote-exec needs connection block = C [OK]

Hint: Always add connection block for remote-exec provisioners [OK]

Common Mistakes:

• Assuming command attribute is invalid
• Thinking sudo commands are disallowed
• Believing remote-exec runs local scripts only

5. You want to install software on a new VM after Terraform creates it. Which approach best uses provisioners to do this reliably?

hard

A. Use a remote-exec provisioner with a connection block to run installation commands after creation

B. Use a local-exec provisioner to run installation commands on your local machine

C. Run installation commands manually after Terraform finishes

D. Use a provisioner without connection block to run commands remotely

Solution

1. Step 1: Identify provisioner type for remote VM configuration

   remote-exec provisioner runs commands on the remote VM after creation using a connection block.

2. Step 2: Evaluate options for reliability

   Using remote-exec with connection block automates installation reliably; local-exec runs locally, manual runs are error-prone, and missing connection causes failure.

3. Final Answer:

   Use a remote-exec provisioner with a connection block to run installation commands after creation -> Option A

4. Quick Check:

   remote-exec + connection block = reliable remote config [OK]

Hint: Use remote-exec with connection block for remote installs [OK]

Common Mistakes:

• Using local-exec for remote installs
• Skipping connection block for remote-exec
• Relying on manual post-creation steps