A platform team uses remote-exec provisioners on aws_instance resources to install packages and push configuration after boot. Over months, servers built from the same configuration have drifted apart because package mirrors and scripts changed between runs, and failed provisioners leave instances tainted mid-setup. Which deployment strategy best addresses the root cause?
Select an answer to reveal the explanation.
Short Explanation
Think of your servers like cookies from one cutter: if you want them identical, you change the cutter, not each cookie after it's baked. Provisioners that patch live boxes are a last resort, and rerunning them more often just patches more often. The trap is hiding the drift instead of removing the reason it happens.
Full Explanation
Immutable infrastructure removes configuration drift by never modifying a running server. An image pipeline, for example Packer, produces a versioned machine image with packages and configuration baked in, and Terraform rolls out a change by updating the image reference so instances are replaced, typically with create_before_destroy or a rolling update in an autoscaling group. Every server built from the same image is identical, and a bad release is rolled back by pointing at the previous image. HashiCorp documents provisioners as a last resort because their actions are not modelled in the plan and a failure taints the resource. Wrapping the same scripts in terraform_data with triggers_replace still mutates live servers and inherits the nondeterminism of changing mirrors. Adding ignore_changes only suppresses differences Terraform would otherwise show; it does nothing about servers diverging internally. A refresh-only apply records current remote attributes in state, which accepts drift rather than preventing it, and it cannot see package versions on the guest anyway. Exam caveat: replacement-based rollouts need health checks and spare capacity so that swapping instances does not cause an outage. Operational check: confirm the image argument references a pipeline-built image version and that a configuration change plans a replacement, not a remote-exec step.