Use the core Terraform workflow →hardMultiple ChoiceObjective-mapped

TF-004 Use the core Terraform workflow Practice Question

Exhibit

Refer to the exhibit.

```
Error: Error applying plan!

  on main.tf line 12, in resource "aws_instance" "web":
  12:   ami = "ami-0c55b159cbfafe1f0"

The resource "aws_instance" "web" was successfully created but failed to initialize after creation. The following errors may help:

Error: timeout - last error: SSH connection failed (unreachable)
```

An operator runs terraform apply and receives the exhibit error. The instance was created but Terraform reports a failure. What is the most likely cause?

⚠ Common exam trap

HashiCorp often tests the distinction between resource creation failures (which prevent the resource from existing) and provisioner failures (which occur after creation and leave the resource running but tainted), leading candidates to incorrectly select an API error or AMI issue when the instance clearly exists.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

A provisioner block is configured to wait for SSH, but the instance is not reachable

The error indicates that the instance was created successfully but Terraform reports a failure during the apply phase. This typically occurs when a provisioner block (e.g., file or remote-exec) is configured to wait for SSH connectivity, but the instance is not reachable within the timeout period. Terraform marks the resource as 'tainted' and reports a failure, even though the cloud resource itself was provisioned.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The state file is locked and cannot be updated
Why it's wrong here
State locking is a mechanism designed to prevent concurrent operations from corrupting the Terraform state file. If a state lock were in place, `terraform apply` would typically fail immediately upon attempting to acquire the lock, presenting an error message indicating a lock acquisition failure or a timeout while waiting for the lock. This failure would occur before any resources are provisioned, not after an instance has been created and then times out during a subsequent phase.
✗
The AMI ID is incorrect and the instance failed to boot
Why it's wrong here
An incorrect or invalid AMI ID would prevent the AWS API from successfully launching the EC2 instance in the first place. Terraform would receive an immediate API error during the `aws_instance` resource creation phase, indicating a problem with the image ID, and the instance would never transition to a running state. The exhibit implies the instance was created successfully, but a subsequent operation failed, which contradicts an AMI ID issue preventing initial creation.
✗
The AWS API returned an error during instance creation
Why it's wrong here
If the AWS API returned an error during the `aws_instance` creation, Terraform would report an API-specific error message directly from AWS, indicating a failure to provision the resource. This would typically occur during the initial API call to `RunInstances` and prevent the instance from being created at all. The exhibit implies the instance was successfully created, but a subsequent operation, likely a provisioner, failed to complete due to a timeout.
✓
A provisioner block is configured to wait for SSH, but the instance is not reachable
Why this is correct
Terraform provisioners, particularly the `remote-exec` provisioner, often require network connectivity (like SSH or WinRM) to the newly created instance to execute commands. If the instance is created successfully but is not reachable via the configured connection (e.g., due to security group rules, network ACLs, an incorrect key pair, or the instance not being fully booted), the provisioner will repeatedly attempt to connect until a timeout is reached. This scenario perfectly aligns with an instance being created but then failing during a post-creation step.

Go deeper

TF-004 Use the core Terraform workflow Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question