Home / Terraform / Fix Terraform Provisioner Failed - Remote Execution Script Failure

Terraform

Fix Terraform Provisioner Failed - Remote Execution Script Failure

Resolve errors when Terraform provisioners fail to execute scripts on local or remote resources during creation or destruction.

Published: Nov 27, 20259 min readBy FixWikiHub Editorial Team

Abstract illustration for a troubleshooting knowledge base category.

Introduction

Terraform provisioners are executing scripts or commands during resource creation or destruction, and these executions are failing. Provisioners run after resource creation or before destruction, and failures prevent Terraform from completing the operation successfully.

Symptoms

For remote-exec provisioner:

``` Error: error executing provisioner "remote-exec": timeout - last error: dial tcp 10.0.0.1:22: i/o timeout

Error: remote-exec provisioner error: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey]

Error: Provisioner "remote-exec" failed: exit status 1: sudo: no tty present and no askpass program specified ```

For local-exec provisioner:

``` Error: error executing provisioner "local-exec": exit status 1: /bin/sh: 1: my-script.sh: not found

Error: local-exec provisioner error: command "ansible-playbook -i inventory deploy.yml" exited with non-zero status 2

Error: Provisioner "local-exec" failed: command execution failed: permission denied ```

For file provisioner:

``` Error: error uploading file: ssh: handshake failed: connection refused

Error: file provisioner error: scp: /var/www/html/config.conf: Permission denied ```

Common Causes

Provisioner failures occur due to:

1.Connection timeout - Cannot reach remote host for SSH/WinRM
2.Authentication failure - Wrong credentials or SSH key issues
3.Permission denied - User lacks permissions to execute commands
4.Script errors - Script itself has syntax errors or missing dependencies
5.Command not found - Required binaries not installed on target
6.Working directory issues - Script path not found
7.Environment variables missing - Required env vars not set
8.Provisioner timing - Resource not ready when provisioner runs

Step-by-Step Fix

1.Check logs for specific error messages
2.Verify configuration settings
3.Test network connectivity
4.Review recent changes
5.Apply corrective action
6.Verify the fix

Step 1: Debug Provisioner Execution

Enable detailed logging:

```bash export TF_LOG=DEBUG export TF_LOG_PATH=./terraform-debug.log terraform apply

# Find provisioner-specific errors grep -i "provisioner|ssh|exec" terraform-debug.log grep -i "error|timeout|failed" terraform-debug.log ```

Step 2: Fix Remote-exec Connection Issues

Verify SSH connectivity:

```bash # Test SSH manually ssh -v user@10.0.0.1 -i ~/.ssh/key.pem

# Check if host is reachable ping 10.0.0.1

# Verify SSH port open nc -zv 10.0.0.1 22 ```

Fix connection configuration:

```hcl resource "aws_instance" "web" { ami = "ami-0c55b159cbfafe1f0" instance_type = "t3.micro"

provisioner "remote-exec" { inline = [ "sudo yum update -y", "sudo yum install -y nginx", ]

connection { type = "ssh" user = "ec2-user" host = self.public_ip private_key = file("~/.ssh/my-key.pem") timeout = "5m" # Increase timeout } } } ```

Handle SSH key issues:

```bash # Verify key file exists and is readable ls -la ~/.ssh/my-key.pem chmod 600 ~/.ssh/my-key.pem

# Test key manually ssh -i ~/.ssh/my-key.pem ec2-user@10.0.0.1 ```

Step 3: Fix Authentication Failures

For SSH authentication:

```hcl provisioner "remote-exec" { connection { type = "ssh" user = "ubuntu" # Verify correct user host = self.public_ip private_key = file(var.ssh_key_path)

# For password authentication (less secure) # password = var.ssh_password } }

# For AWS instances, use the correct user: # Amazon Linux: ec2-user # Ubuntu: ubuntu # Debian: admin # RHEL: ec2-user or root # CentOS: centos ```

For WinRM (Windows):

```hcl provisioner "remote-exec" { connection { type = "winrm" user = "Administrator" password = var.admin_password host = self.public_ip port = 5985 timeout = "10m"

# HTTPS for secure connection use_ssl = true insecure = true # For self-signed certificates }

inline = [ "powershell.exe -Command \"Install-WindowsFeature -Name Web-Server\"", ] } ```

Step 4: Fix Permission Issues

Handle sudo permission issues:

```hcl provisioner "remote-exec" { inline = [ # Use sudo with -S flag to read password from stdin "echo '${var.sudo_password}' | sudo -S yum install -y nginx",

# Or run as root directly (if connection uses root) "yum install -y nginx", ]

connection { user = "root" # ... } } ```

For file upload permission issues:

```hcl provisioner "file" { source = "local-config.conf" destination = "/tmp/config.conf" # Upload to tmp first

connection { type = "ssh" user = "ec2-user" private_key = file(var.ssh_key) host = self.public_ip } }

provisioner "remote-exec" { inline = [ "sudo mv /tmp/config.conf /etc/nginx/nginx.conf", "sudo chown root:root /etc/nginx/nginx.conf", "sudo systemctl restart nginx", ]

connection { type = "ssh" user = "ec2-user" private_key = file(var.ssh_key) host = self.public_ip } } ```

Step 5: Fix Local-exec Errors

Verify command exists locally:

```bash # Check if command is available which ansible-playbook which my-script.sh

# Verify script is executable chmod +x scripts/my-script.sh

# Test script manually ./scripts/my-script.sh ```

Fix local-exec configuration:

```hcl provisioner "local-exec" { # Use absolute paths command = "/usr/local/bin/ansible-playbook -i ${self.public_ip}, deploy.yml"

# Or relative path from module directory command = "${path.module}/scripts/deploy.sh ${self.public_ip}"

# Set working directory working_dir = "${path.module}/scripts"

# Add environment variables environment = { ANSIBLE_HOST_KEY_CHECKING = "False" TARGET_HOST = self.public_ip } }

# Handle command failure gracefully provisioner "local-exec" { command = "my-script.sh || echo 'Script failed but continuing'"

# Use on_failure to control behavior on_failure = continue # or fail } ```

Step 6: Handle Timing and Dependency Issues

Wait for resource readiness:

```hcl resource "aws_instance" "web" { ami = "ami-0c55b159cbfafe1f0" instance_type = "t3.micro"

# Wait for instance to be fully running provisioner "remote-exec" { inline = [ "while ! systemctl is-active sshd; do sleep 2; done", "sudo yum update -y", ]

connection { type = "ssh" user = "ec2-user" host = self.public_ip private_key = file(var.ssh_key) timeout = "10m" # Allow extra time } } }

# Use depends_on for proper ordering provisioner "local-exec" { command = "ansible-playbook deploy.yml" working_dir = "${path.module}"

depends_on = [ aws_instance.web, aws_security_group.web ] } ```

Step 7: Use Null Resource for Complex Provisioning

For better control over provisioning:

```hcl resource "aws_instance" "web" { ami = "ami-0c55b159cbfafe1f0" instance_type = "t3.micro" }

# Separate provisioning control resource "null_resource" "configure_web" { # Triggers when instance changes triggers = { instance_id = aws_instance.web.id config_hash = filesha256("${path.module}/config.sh") }

provisioner "remote-exec" { inline = [ "${file("${path.module}/config.sh")}", ]

connection { type = "ssh" user = "ec2-user" host = aws_instance.web.public_ip private_key = file(var.ssh_key) } }

depends_on = [aws_instance.web] } ```

Step 8: Handle Provisioner on Destruction

Use destroy provisioners carefully:

```hcl resource "aws_instance" "web" { ami = "ami-0c55b159cbfafe1f0" instance_type = "t3.micro"

provisioner "remote-exec" { when = destroy # Run on destruction

inline = [ "sudo systemctl stop nginx", "sudo rm -rf /var/log/nginx/*", ]

connection { type = "ssh" user = "ec2-user" host = self.public_ip # Must use self for destroy private_key = file(var.ssh_key) }

on_failure = continue # Don't block destruction on failure } } ```

Step 9: Migrate to Better Alternatives

Consider replacing provisioners with better approaches:

```hcl # Instead of provisioner, use user_data for EC2 resource "aws_instance" "web" { ami = "ami-0c55b159cbfafe1f0" instance_type = "t3.micro"

user_data = <<-EOF #!/bin/bash yum update -y yum install -y nginx systemctl start nginx EOF }

# Use cloud-init for more complex setup user_data = file("${path.module}/cloud-init.yaml")

# Use Ansible/Terraform separately after Terraform apply # terraform apply # ansible-playbook -i inventory deploy.yml ```

Step 10: Handle Specific Common Errors

SSH handshake timeout:

```bash # Check security group allows SSH aws ec2 describe-security-groups --group-ids sg-12345678

# Verify instance is running aws ec2 describe-instances --instance-ids i-12345678 --query 'Reservations[].Instances[].State.Name'

# Check network connectivity nc -zv PUBLIC_IP 22 ```

"No tty present and no askpass program":

hcl

# Use sudo with password piped
inline = [
  "echo '${var.password}' | sudo -S command",
]

"Connection refused":

bash

# SSH service not running - wait longer
# Use timeout and retry logic in inline script
inline = [
  "for i in {1..30}; do ssh -o StrictHostKeyChecking=no localhost && break || sleep 2; done",
]

Verification

After resolving provisioner issues:

```bash # Test SSH connectivity ssh -i ~/.ssh/key.pem user@INSTANCE_IP

# Run apply to verify provisioner works terraform apply

# Check provisioner executed successfully terraform show | grep -A20 provisioner ```

Prevention

Avoid provisioners when possible:

```hcl # Prefer user_data over remote-exec user_data = file("setup.sh")

# Prefer native Terraform resources over local-exec # Instead of: local-exec running kubectl # Use: terraform-provider-kubernetes

# Use configuration management tools separately # terraform apply -> ansible-playbook deploy.yml ```

Document provisioning dependencies:

markdown

## Provisioning Requirements
- SSH key in ~/.ssh/my-key.pem
- Ansible installed locally
- Target host accessible on port 22

[Fix Fix Terraform API Token Issue in Terraform](fix-terraform-api-token)
[Fix Terraform Apply Timeout - Resource Creation Hanging Indefinitely](fix-terraform-apply-timeout)
[How to Fix Terraform AWS Provider Errors](fix-terraform-aws-provider)
[Fix Fix Terraform Azure Backend Issue in Terraform](fix-terraform-azure-backend)
[Fix Terraform Backend Configuration Error - State Backend Setup Failure](fix-terraform-backend-config-error)

Was this guide helpful?

Related search paths

People also search for

If the symptom is close but not identical, these search paths usually surface the right neighboring fixes faster than scrolling the full archive.

Terraform Provisioner Failed - Remote Execution Script Failure Terraform Provisioner Failed - Remote Execution Script Failure Terraform Terraform Provisioner Failed - Remote Execution Script Failure troubleshooting Terraform Provisioner Failed - Remote Execution Script Failure fix Resolve errors when Terraform provisioners fail to execute scripts on local or remote resources during creation or destruction Terraform Resolve errors when Terraform provisioners fail to execute scripts on local or remote resources during creation or destruction

Explore Related Topics

Browse Guides from Other Categories

Discover troubleshooting guides from related categories to expand your knowledge.

FAQ

Terraform Troubleshooting FAQs

Common questions about troubleshooting and preventing similar issues

How do I know if this terraform-errors troubleshooting guide applies to my situation?

This guide is designed for terraform-errors issues. If you're experiencing similar symptoms described in the article, follow the step-by-step instructions. Start with the most common causes and work through the diagnostic process.

Is it safe to follow these terraform-errors troubleshooting steps?

Yes, all steps are designed to be safe and non-destructive. We recommend creating backups before making significant changes and testing each step before proceeding to the next.

How long does it typically take to resolve this type of terraform-errors issue?

Most terraform-errors issues can be resolved within 30 minutes to 2 hours, depending on the complexity and root cause. Follow the troubleshooting flow to identify and fix the problem efficiently.

How can I prevent this terraform-errors issue from happening again?

Regular maintenance, monitoring, and following best practices for terraform-errors configuration can help prevent recurrence. Consider implementing automated checks and alerts for early detection.

Written by

FixWikiHub Editorial Team

Our editorial team consists of experienced DevOps engineers, systems administrators, and cloud architects with hands-on experience in production environments across AWS, Azure, GCP, and on-premises infrastructure.

Every guide undergoes technical review for accuracy and is updated when software versions, commands, or best practices change.

Last updated: Nov 27, 2025

About our team

Important Notice

Disclaimer & Safety Guidelines

The troubleshooting steps in this guide are provided for educational and informational purposes. Before applying any changes to production systems:

Test in a staging environment first — Always verify commands and configurations in a non-production environment before deploying to live systems.
Create backups — Ensure you have current backups of databases, configurations, and critical files before making changes.
Understand the impact — Review how each step may affect your specific environment, dependencies, and users.
Consult official documentation — This guide supplements, but does not replace, official vendor documentation and best practices.

FixWikiHub is not responsible for any damages arising from the use of this content. See our Terms of Use for more information.

Resources

Official Documentation & Further Reading

For authoritative information, consult the official documentation for the technologies discussed in this guide. Our troubleshooting content supplements, but does not replace, vendor documentation.

AWS Documentation — Official Amazon Web Services guides and API references
Kubernetes Documentation — Official Kubernetes documentation
Nginx Documentation — Official Nginx web server documentation
Apache Documentation — Official Apache HTTP Server documentation
Docker Documentation — Official Docker container documentation

Fix Terraform Provisioner Failed - Remote Execution Script Failure

Introduction

Symptoms

Common Causes

Step-by-Step Fix

Step 1: Debug Provisioner Execution

Step 2: Fix Remote-exec Connection Issues

Step 3: Fix Authentication Failures

Step 4: Fix Permission Issues

Step 5: Fix Local-exec Errors

Step 6: Handle Timing and Dependency Issues

Step 7: Use Null Resource for Complex Provisioning

Step 8: Handle Provisioner on Destruction

Step 9: Migrate to Better Alternatives

Step 10: Handle Specific Common Errors

Verification

Prevention

Related Articles

People also search for

Browse Guides from Other Categories

WordPress

SSL

DNS

Terraform Troubleshooting FAQs

FixWikiHub Editorial Team

Disclaimer & Safety Guidelines

Official Documentation & Further Reading

Fix Terraform Provisioner Failed - Remote Execution Script Failure

Introduction

Symptoms

Common Causes

Step-by-Step Fix

Step 1: Debug Provisioner Execution

Step 2: Fix Remote-exec Connection Issues

Step 3: Fix Authentication Failures

Step 4: Fix Permission Issues

Step 5: Fix Local-exec Errors

Step 6: Handle Timing and Dependency Issues

Step 7: Use Null Resource for Complex Provisioning

Step 8: Handle Provisioner on Destruction

Step 9: Migrate to Better Alternatives

Step 10: Handle Specific Common Errors

Verification

Prevention

Related Articles

People also search for

Share this guide

More Terraform Troubleshooting Guides

Browse Guides from Other Categories

Terraform Troubleshooting FAQs

FixWikiHub Editorial Team

Disclaimer & Safety Guidelines

Official Documentation & Further Reading