Interview › Infrastructure as Code (Terraform, Ansible)
What are provisioners, and why are they considered a last resort?
Infrastructure as Code (Terraform, Ansible) · Basic level
Answer
Provisioners run scripts or commands during resource creation or destruction. They are a last resort because they are hard to model declaratively, can be non-idempotent, make dependency behavior fragile, and often hide configuration that belongs in images, cloud-init, Ansible, or a platform-native API.
Technical explanation
Provisioners run after resource creation or before destruction but are not part of the provider's normal desired-state model.
They can fail after the resource exists, leaving partial configuration and confusing retries.
Prefer provider-native resources, cloud-init, images, or Ansible for post-provision configuration.
Keep Terraform's ownership boundary clear: one state should own a resource or field, and other tools should consume published outputs instead of modifying it.
Use fmt, validate, linting, policy checks, plan review, and state locking before production applies.
Design for small blast radius by splitting state around lifecycle, permissions, and recovery boundaries.
Hands-on example
1. Demonstrate the risk and replacement for: What are provisioners, and why are they considered a last resort?
2. Avoid this as a default pattern:
provisioner "remote-exec" {
inline = ["sudo yum install -y nginx", "sudo systemctl enable --now nginx"]
}
3. Replace it with a baked AMI, user_data, SSM document, or Ansible role. For example, put bootstrap in cloud-init and detailed config in Ansible:
ansible-playbook -i inventory/aws_ec2.yml site.yml --limit tag_Role_web --check --diff
4. If a provisioner remains necessary, make it small, retry-safe, logged, and documented as a temporary bridge.
Check how well your resume matches the role with our free resume checker— match score, ATS check, and the skills you're missing.
More Infrastructure as Code (Terraform, Ansible) interview questions
- What is Infrastructure as Code, and what problems does it solve over click-ops?
- What is the difference between declarative and imperative IaC, and where do Terraform and Ansible fall?
- What is the difference between configuration management and provisioning?
- What is Terraform, and what is the core plan/apply workflow?
- What does terraform init do?
- What is the Terraform state file, and why is it critical?
- Why should state be stored remotely, and what backend would you use on AWS?
- What is state locking, and why does it matter for teams?