Understand Terraform's purpose →hardMultiple ChoiceObjective-mapped

TF-004 Understand Terraform's purpose Practice Question

Exhibit

Refer to the exhibit.

```hcl
resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
}

resource "null_resource" "provisioner" {
  provisioner "local-exec" {
    command = "echo ${aws_instance.web.public_ip}"
  }
}
```

A team member runs terraform apply with the configuration shown in the exhibit. The apply succeeds, but the output of the local-exec provisioner shows an empty string for the public IP address. What is the most likely cause?

⚠ Common exam trap

HashiCorp often tests the misconception that `local-exec` runs on the remote instance or that `self.public_ip` is always populated, when in reality it depends on the network configuration and the provisioner's execution context.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The aws_instance resource does not have a public IP assigned because it is launched in a default VPC without auto-assign public IP, and no Elastic IP is attached.

The `local-exec` provisioner runs on the machine executing Terraform, not on the AWS instance itself. If the instance is launched in a default VPC without `auto-assign public IP` enabled and no Elastic IP is attached, the `self.public_ip` attribute will be an empty string. The provisioner then outputs that empty string, as it simply reads the attribute value from the resource state.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
There is a dependency cycle between the aws_instance and null_resource causing Terraform to skip the provisioner.
Why it's wrong here
A dependency cycle in Terraform occurs when resource A depends on B, and B depends on A, creating an unresolvable loop. In this scenario, a `null_resource` provisioner referencing an `aws_instance` attribute, like `aws_instance.example.public_ip`, establishes a valid implicit dependency where the `null_resource` waits for the `aws_instance` to be created and its attributes populated. This is a unidirectional dependency, not a cycle, allowing the provisioner to execute after the instance is ready.
✗
The local-exec provisioner only runs during terraform destroy, not during apply.
Why it's wrong here
The `local-exec` provisioner, by default, executes during the `create` phase of a resource's lifecycle, which occurs during `terraform apply` when the resource is being created or updated. It is not exclusively tied to `destroy` operations unless explicitly configured with `when = destroy` within the provisioner block. Therefore, if the `aws_instance` is being created or modified, the provisioner would attempt to run during the `apply` operation.
✓
The aws_instance resource does not have a public IP assigned because it is launched in a default VPC without auto-assign public IP, and no Elastic IP is attached.
Why this is correct
By default, EC2 instances launched into a default VPC do not automatically receive a public IP address unless the specific subnet's 'Auto-assign public IPv4 address' setting is enabled, or an Elastic IP (EIP) is explicitly associated with the instance. If neither of these conditions is met, the `aws_instance.public_ip` attribute will remain empty. This absence prevents the provisioner from establishing a connection using a public IP, leading to connection failures.
✗
The provisioner cannot access the aws_instance resource's attributes because it is defined in a separate resource block.
Why it's wrong here
Terraform's interpolation syntax, such as `aws_instance.example.public_ip`, allows provisioners to reference attributes from any other resource defined within the same Terraform configuration. This mechanism establishes an implicit dependency, ensuring the referenced resource is created and its attributes are available before the provisioner attempts to access them. The physical separation of the provisioner into a different resource block does not restrict attribute access.

Go deeper

TF-004 Understand Terraform's purpose Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question