local-exec, remote-exec, and file

Scenario: A local-exec command works on one engineer's laptop but fails in CI because the tool, shell, and path differ.

local-exec runs where Terraform runs; remote-exec runs commands on a remote connection; file transfers content. Their execution environment and credentials must be explicit. Creation-time and destroy-time provisioners have different restrictions and failure modes. on_failure = continue can conceal incomplete infrastructure, while retries can duplicate side effects.

Analogy: A local provisioner hires the worker standing beside the blueprint, not one inside the new building. Changing the runner changes the worker's tools.

A worked configuration

provisioner "local-exec" {
  command     = "./notify.sh ${self.id}"
  interpreter = ["/bin/bash", "-c"]
}

If an escape hatch is unavoidable, make the command idempotent, pin its runtime, avoid secrets in command lines, capture auditable output, bound timeouts, and document recovery. Keep it small enough to replace later.

Note: Treat the plan as a change contract: understand every create, update, replacement, and destroy before approving it.

Goal: Reinforce this lesson in the tf-terraform-data-triggers Terraform lab. Open /labs/terraform and choose slug tf-terraform-data-triggers; the lab runs real Terraform against the offline FakeCloud provider.