Terraform Provisioners Explained: local-exec, remote-exec, and When to Avoid Them

Terraform Provisioners Explained#

Learn what Terraform provisioners are, how local-exec and remote-exec work, when they are useful, and why they should be used carefully.

What is a Terraform provisioner?#

A provisioner runs scripts or commands during resource creation or destruction. Provisioners can be useful, but they should not become the main way to configure infrastructure.

local-exec example#

resource "null_resource" "example" { provisioner "local-exec" { command = "echo Resource created" } }

remote-exec example#

provisioner "remote-exec" { inline = [ "sudo apt update", "sudo apt install -y nginx" ] }

When provisioners are used#

• Bootstrap a VM after creation.
• Run a one-time local command.
• Call external tooling carefully.
• Temporary migration workflows.

Common mistakes#

• Using provisioners for all server configuration.
• Making Terraform depend on fragile SSH connections.
• Storing secrets in inline commands.
• Not handling retries or partial failures.

Best practices#

• Use provisioners only when there is no better option.
• Keep commands idempotent where possible.
• Do not print secrets.
• Prefer immutable images or cloud-init for VM setup.

Related guides#

• Terraform Learning Path
• Terraform Commands Explained

Official references#

• Terraform provisioners documentation