# Use local variable in local-exec destroy provisioner

**URL:** <https://discuss.hashicorp.com/t/use-local-variable-in-local-exec-destroy-provisioner/59216>\
**Category:** Terraform\
**Created:** [October 17, 2023, 2:17pm UTC](https://discuss.hashicorp.com/t/use-local-variable-in-local-exec-destroy-provisioner/59216 "2023-10-17T14:17:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tomasbackman1](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/tomasbackman1/32/34700_2.png) [@tomasbackman1](https://discuss.hashicorp.com/u/tomasbackman1)\
**Post date:** [October 17, 2023, 2:17pm UTC](https://discuss.hashicorp.com/t/use-local-variable-in-local-exec-destroy-provisioner/59216/1 "2023-10-17T14:17:37Z")

</div>

using terraform 1.5.7

I know we should not use provisioners if we can avoid it.  
But Im doing stuff with openstack workflow/mistral that the provider does not support so here I am.

I am basically looping setting up cron triggers with a bash script that uses openstack cli from the “local-exec” provisioner with “when: create” running in a terraform\_data resource block. It works nicely

```auto
resource "terraform_data" "my_cron" {
  for_each = { for host, values in var.hosts : host => values if values.extra != null }

  provisioner "local-exec" {
    when = create
    command = "bash ${templatefile("my_create_script.tftpl", {
      cloud_name="${local.cloud_name}"
      exec_description="Created by automation"
      other_variable=each.key
    } )}"
  }

```

But I obviously I want the ability to also remove the cron jobs that I create.  
so added a destroy provisioner to the resource:

```auto
provisioner "local-exec" {
    when = destroy
    command = "bash ${templatefile("my_destroy_script.tftpl", {
      cloud_name="${local.cloud_name}"
    } )}"
  }

```

However this destroy part fails due to the local.cloud\_name not being allowed.

> Destroy-time provisioners and their connection configurations may only reference attributes \>of the related resource, via ‘self’, ‘count.index’, or ‘each.key’.

If I change it to a string directly it works. But I want this as part of a terraform module where the cloud\_name could be different so it should be a variable (var or local) but I cant wrap my head around it.  
One suggestion was to use tags { cloud = local.cloud\_name } in the resource and reference it, but terraform\_data does not seem to suport tags … if I instead put the provisioner in another existing resource that does, then I need to have the provisioners as dynamic depending on the input host var (see for\_each in code) and provisioners does not support that …

So how do I solve this…? It feels like it should be something easy, but Im stuck now.

---

<div class="post-metadata">

**Author:** ![jbardin](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jbardin/32/3325_2.png) [@jbardin](https://discuss.hashicorp.com/u/jbardin)\
**Post date:** [October 17, 2023, 3:38pm UTC](https://discuss.hashicorp.com/t/use-local-variable-in-local-exec-destroy-provisioner/59216/2 "2023-10-17T15:38:09Z")

</div>

Hi @tomasbackman1,

This type of coordination is often [better handled in the workflow outside of Terraform](https://developer.hashicorp.com/terraform/language/resources/provisioners/syntax#provisioners-are-a-last-resort), but if you’re comfortable with the limitations of provisioners, specifically here with the fact that a destroy provisioner cannot work if the configuration is removed entirely, then you can store whatever data you want in the in the `terraform_data` resource.

Assigning the `local.cloud_name` value to one of the resource attributes, like `input` (or `replace_triggered_by` if that extra behavior suits your purposes) will allow you to reference the data via `self` from within the provisioner.

---

<div class="post-metadata">

**Author:** ![tomasbackman1](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/tomasbackman1/32/34700_2.png) [@tomasbackman1](https://discuss.hashicorp.com/u/tomasbackman1)\
**Post date:** [October 17, 2023, 4:02pm UTC](https://discuss.hashicorp.com/t/use-local-variable-in-local-exec-destroy-provisioner/59216/3 "2023-10-17T16:02:07Z")

</div>

Ah input could be used, thank you!  
tags did not, and not

did in resource:

`input = { cloud = local.cloud_name }`  
Then changed the references in the provisioners to `${self.input.cloud}`

Works perfectly now

I did not find this anywhere else, but after looking around some more in the documentation now I found that the terraform\_data has this input argument. Hard to use but useful! =)

> **[The terraform\_data Managed Resource Type | Terraform | HashiCorp Developer](https://developer.hashicorp.com/terraform/language/resources/terraform-data)**
>
> Retrieves the root module output values from a Terraform state snapshot stored in a remote backend.