Why provisioners run scripts on resources in Terraform - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why do Terraform provisioners run scripts on resources?

Terraform provisioners allow you to run scripts or commands on a resource after it is created. What is the main reason for using provisioners in Terraform?

A To configure or customize a resource immediately after creation when Terraform cannot do it natively.

B To replace Terraform's built-in resource creation logic with custom scripts.

C To permanently store state information outside of Terraform's state file.

D To automatically scale resources based on load without manual intervention.

💡 Hint

Think about what Terraform can and cannot do by itself when creating resources.

Provisioners run scripts on resources to perform configuration steps that Terraform does not support natively, such as installing software or running setup commands immediately after resource creation.

❓ Architecture

intermediate

When should you avoid using Terraform provisioners?

Which scenario is NOT a good reason to use Terraform provisioners?

A When the resource supports native Terraform configuration options.

B When you need to run a one-time setup script after resource creation.

C When you want to install software on a virtual machine after it launches.

D When you need to execute commands that Terraform cannot perform directly.

💡 Hint

Consider if Terraform already supports configuring the resource without extra scripts.

If Terraform supports configuring a resource natively, using provisioners is unnecessary and can complicate your infrastructure code.

❓ service_behavior

advanced

What happens if a Terraform provisioner script fails during apply?

Consider a Terraform configuration with a local-exec provisioner that runs a script on a resource. What is the behavior if the script returns a non-zero exit code?

A Terraform ignores the error and continues applying other resources.

B Terraform apply fails and marks the resource as tainted.

C Terraform marks the resource as tainted but continues the apply.

D Terraform retries the script automatically until it succeeds.

💡 Hint

Think about how Terraform treats errors during resource provisioning.

If a provisioner script fails, Terraform treats it as a failure of the resource creation or update, stops the apply process, and marks the resource as tainted.

❓ security

advanced

What is a security risk when using Terraform provisioners to run scripts on resources?

Running scripts on resources with provisioners can introduce security risks. Which of the following is a common risk?

A Provisioners prevent unauthorized access by default through secure tunnels.

B Terraform automatically encrypts all provisioner scripts, preventing exposure.

C Provisioners isolate scripts from the resource, so no risk exists.

D Embedding sensitive data like passwords directly in provisioner scripts or Terraform files.

💡 Hint

Consider how sensitive information is handled in scripts and Terraform configurations.

Embedding secrets directly in provisioner scripts or Terraform files can expose sensitive data in version control or logs, creating security vulnerabilities.

✅ Best Practice

expert

What is the recommended best practice regarding the use of Terraform provisioners?

Which statement best describes the recommended best practice for using Terraform provisioners?

A Avoid provisioners completely and rely only on manual post-deployment scripts.

B Use provisioners extensively to handle all configuration tasks for resources.

C Use provisioners only as a last resort when native Terraform resource features cannot achieve the desired configuration.

D Use provisioners to replace Terraform modules for better flexibility.

💡 Hint

Think about maintainability and reliability of infrastructure code.

Provisioners should be used sparingly and only when Terraform's native resource capabilities cannot perform the needed configuration, to keep infrastructure code clean and reliable.