🔗 Repo: github.com/Push/terraform-aws-labs/day19

🎯 Goal: Understand provisioners — the last-resort tool for bootstrapping, with clear warnings and best-practice patterns.

✅ You’ll master:

• ✅ local-exec: Run commands on your laptop (e.g., curl, echo)
• ✅ remote-exec: Run commands on EC2 via SSH (e.g., apt install nginx)
• ✅ file: Copy files to/from EC2 (e.g., config templates)
• ❗ When to avoid them (and use cloud-init/AMI instead)

🧠 Why Provisioners? (The Right Context)

❌ Anti-Pattern:

# DON'T do this in production!
provisioner "remote-exec" {
  inline = ["sudo apt install nginx", "sudo systemctl start nginx"]
}

✅ Legitimate Uses:

• 🛠️ One-time bootstrapping (e.g., generate certs, join cluster)
• 📦 Deploy immutable artifacts (e.g., copy app-v2.zip → unzip)
• 🔐 Seal secrets (e.g., vault read → write to /etc/secrets)
• 🔁 Post-creation validation (e.g., curl <http://localhost:8080/health>)

💡 Golden Rule:

“If your provisioner runs >5s — bake it into an AMI instead.”

(See Day 25: Packer + AMI pipelines)

📦 Provisioner Cheat Sheet

⚠️ Critical Limitations:

• ❌ Not idempotent — runs every apply (even if no infra change)
• ❌ No drift detection — Terraform won’t reconcile if file is modified later
• ❌ SSH dependency — fails if keys rotate, security groups block port 22

✏️ Hands-On: Provisioners in Action

🔹 File Structure (/day19/)

day19/
├── main.tf           # EC2 + provisioners
├── scripts/
│   └── welcome.sh    # 📜 Sample script to copy
├── terraform.tfvars  # Key name, private key path
└── TASK.md           # 📝 Your challenge (cloud-init, SSM, AMI)