Preconditions and postconditions in Terraform - Step-by-Step Execution

Process Flow - Preconditions and postconditions

Start Terraform Apply

↓

Check Preconditions

↓

Stop with Error

↓

Create/Update Resources

↓

Check Postconditions

↓

Stop with Error

↓

Finish Apply Successfully

Terraform first checks preconditions before creating resources. After creation, it checks postconditions to ensure success.

Execution Sample

Terraform

terraform {
  required_version = ">= 1.3"
}

resource "null_resource" "example" {
  provisioner "local-exec" {
    command = "echo Hello"
  }

  lifecycle {
    precondition {
      condition     = length("Hello") > 0
      error_message = "String must not be empty"
    }
    postcondition {
      condition     = true
      error_message = "Postcondition failed"
    }
  }
}

This Terraform resource uses precondition to check a string is not empty before creation, and a postcondition that always passes after creation.

Process Table

Step	Action	Condition Checked	Result	Next Step
1	Start terraform apply	N/A	N/A	Check preconditions
2	Check precondition: length("Hello") > 0	length("Hello") > 0	True	Create resource
3	Create resource null_resource.example	N/A	Resource created	Check postconditions
4	Check postcondition: true	true	True	Finish apply
5	Finish terraform apply	N/A	Success	End

💡 All preconditions and postconditions passed, apply finishes successfully.

Status Tracker

Variable	Start	After Precondition	After Resource Creation	After Postcondition	Final
length("Hello")	N/A	5	5	5	5
precondition result	N/A	True	True	True	True
postcondition result	N/A	N/A	N/A	True	True
resource state	Not created	Not created	Created	Created	Created

Key Moments - 2 Insights

Why does Terraform stop if a precondition fails?

Terraform stops immediately on a failed precondition to prevent creating resources with invalid inputs, as shown in execution_table step 2 where a false condition would stop the process.

What happens if a postcondition fails after resource creation?

Terraform stops the apply with an error after resource creation if a postcondition fails, preventing a false success state, as indicated in execution_table step 4.

Visual Quiz - 3 Questions

Look at the execution_table, what is the result of the precondition check at step 2?

A Error

B True

C False

D Not evaluated

💡 Hint

Check the 'Result' column in row for step 2 in execution_table.

At which step does Terraform create the resource?

A Step 3

B Step 2

C Step 1

D Step 4

💡 Hint

Look for the 'Create resource' action in execution_table.

If the precondition was false, what would happen?

A Terraform would continue to create the resource

B Terraform would ignore the precondition and check postcondition

C Terraform would stop with an error before creating the resource

D Terraform would skip postcondition checks

💡 Hint

Refer to the concept_flow where 'No' from precondition leads to stopping with error.

Concept Snapshot

Terraform Preconditions and Postconditions:
- Preconditions run before resource creation to validate inputs.
- Postconditions run after creation to verify success.
- If any condition fails, Terraform stops apply with an error.
- Use lifecycle blocks with precondition and postcondition.
- Helps catch errors early and ensure resource correctness.

Full Transcript

Terraform applies resources by first checking preconditions to ensure inputs are valid. If preconditions fail, Terraform stops and shows an error to avoid creating bad resources. If preconditions pass, Terraform creates or updates the resource. After creation, postconditions run to verify the resource state is as expected. If postconditions fail, Terraform stops with an error to avoid false success. This process ensures safe and correct infrastructure deployment.

Practice

1. What is the main purpose of precondition blocks in Terraform?

easy

A. To check conditions before applying changes

B. To verify outputs after deployment

C. To define resource dependencies

D. To configure provider settings

Solution

1. Step 1: Understand preconditions role

   Preconditions are rules that Terraform checks before making any changes to infrastructure.

2. Step 2: Differentiate from postconditions

   Postconditions check after changes, but preconditions ensure safety before changes.

3. Final Answer:

   To check conditions before applying changes -> Option A

4. Quick Check:

   Preconditions = Before changes check [OK]

Hint: Preconditions run before changes to avoid errors [OK]

Common Mistakes:

• Confusing preconditions with postconditions
• Thinking preconditions run after deployment
• Assuming preconditions configure providers

2. Which of the following is the correct syntax to define a postcondition in a Terraform resource?

easy

A. postcondition {
condition = var.enabled
error_message = "Must be enabled"
}

B. postconditions {
condition = var.enabled == true
error_message = "Must be enabled"
}

C. postcondition {
condition = var.enabled == true
error_message = "Must be enabled"
}

D. postcondtion {
condition = var.enabled == true
error_message = "Must be enabled"
}

Solution

1. Step 1: Recall correct block name and syntax

   The block is singular postcondition with a condition attribute.

2. Step 2: Check condition expression format

   Using var.enabled == true is explicit and correct for boolean check.

3. Final Answer:

   postcondition { condition = var.enabled == true error_message = "Must be enabled" } -> Option C

4. Quick Check:

   Correct syntax uses singular postcondition and explicit condition [OK]

Hint: Use singular 'postcondition' with condition attribute [OK]

Common Mistakes:

• Using plural 'postconditions' block
• Omitting '== true' for boolean checks
• Misspelling 'postcondition'

3. Given this Terraform snippet inside a resource:

precondition {
  condition     = var.size > 0
  error_message = "Size must be positive"
}
postcondition {
  condition     = length(self.id) > 0
  error_message = "Resource ID must be set"
}

What happens if var.size is 0 during apply?

medium

A. Terraform applies changes but shows a warning

B. Terraform stops and shows "Size must be positive" error

C. Terraform applies changes and postcondition fails silently

D. Terraform ignores precondition and applies changes

Solution

1. Step 1: Understand precondition behavior

   Preconditions run before applying changes and block apply if false.

2. Step 2: Evaluate condition with var.size = 0

   Condition var.size > 0 is false, so Terraform stops with error message.

3. Final Answer:

   Terraform stops and shows "Size must be positive" error -> Option B

4. Quick Check:

   Precondition false stops apply with error [OK]

Hint: Precondition false stops apply with error message [OK]

Common Mistakes:

• Thinking preconditions only warn, not stop
• Confusing precondition with postcondition timing
• Assuming apply continues despite precondition failure

4. You wrote this postcondition in a Terraform resource:

postcondition {
  condition     = self.name != ""
  error_message = "Name must not be empty"
}

But Terraform never shows the error even if name is empty. What is the likely problem?

medium

A. Postconditions run after apply, but self.name is not set yet

B. The condition should use length(self.name) > 0 instead of self.name != ""

C. The postcondition block is misspelled and ignored

D. Postconditions run before resource creation, so condition is not checked properly

Solution

1. Step 1: Understand postcondition timing

   Postconditions run after resource creation to verify results.

2. Step 2: Analyze condition evaluation

   If self.name is null (not set) rather than empty string after apply, self.name != "" is true because null != "", so no error is triggered.

3. Final Answer:

   Postconditions run after apply, but self.name is not set yet -> Option A

4. Quick Check:

   null != "" passes; check availability [OK]

Hint: Postconditions check after apply; ensure attribute is set [OK]

Common Mistakes:

• Assuming postconditions run before apply
• Using wrong condition syntax without checking attribute availability
• Misspelling postcondition block name

5. You want to ensure a Terraform resource only applies if var.region is either "us-east-1" or "us-west-2", and after apply, the resource's status attribute must be "active". Which is the correct way to write preconditions and postconditions?

hard

A. precondition {
condition = var.region == "us-east-1" && var.region == "us-west-2"
error_message = "Region must be us-east-1 and us-west-2"
}
postcondition {
condition = self.status != "active"
error_message = "Status must not be active"
}

B. precondition {
condition = var.region == "us-east-1" || var.region == "us-west-2"
error_message = "Region must be us-east-1 or us-west-2"
}
postcondition {
condition = self.status != "active"
error_message = "Status must not be active"
}

C. precondition {
condition = var.region != "us-east-1" && var.region != "us-west-2"
error_message = "Region must not be us-east-1 or us-west-2"
}
postcondition {
condition = self.status == "active"
error_message = "Status must be active"
}

D. precondition {
condition = var.region == "us-east-1" || var.region == "us-west-2"
error_message = "Region must be us-east-1 or us-west-2"
}
postcondition {
condition = self.status == "active"
error_message = "Status must be active"
}

Solution

1. Step 1: Write correct precondition for region

   Use logical OR (||) to allow either region, with proper error message.

2. Step 2: Write correct postcondition for status

   Check that self.status equals "active" after apply, with matching error message.

3. Final Answer:

   Precondition uses OR for region check; postcondition checks status equals "active" -> Option D

4. Quick Check:

   Precondition OR and postcondition equality check [OK]

Hint: Use OR for precondition, equality for postcondition [OK]

Common Mistakes:

• Using AND instead of OR in precondition
• Checking for inequality in postcondition wrongly
• Mixing error messages with wrong logic