Terraform "Provider produced inconsistent final plan" in CI
By Kaveh Alemi·Latchkey
Terraform checks that what a provider promised during plan matches what it produces during apply. A mismatch is an internal consistency error, most often a provider bug or an attribute that should have been marked unknown.
What this error means
terraform apply aborts with "Provider produced inconsistent final plan", naming an attribute whose planned and actual values differ and asking you to report it as a provider bug.
terraform
Error: Provider produced inconsistent final plan
When expanding the plan for aws_instance.web to include new values learned
so far during apply, provider "aws" produced an invalid new value for
.user_data: was cty.StringVal("..."), but now cty.StringVal("...").
This is a bug in the provider, which should be reported in the provider's
own issue tracker.
Diagnose it: init, state, or credentials?
Terraform failures in CI are dominated by backend and credential problems rather than configuration errors. Confirm the runner can initialise, authenticate, and lock state before reading the plan.
A known defect in the provider mishandles an attribute between plan and apply.
Computed attribute not marked unknown
The provider planned a concrete value for something it actually computes server-side, then it differs at apply.
Inputs changed between plan and apply
A value derived from outside Terraform (timestamp, external data) changed between the two phases.
How to fix it
Upgrade or pin a known-good provider
Move to a provider version where the bug is fixed, or pin away from a broken one.
Terminal
terraform init -upgrade
Stabilize the offending attribute
Avoid feeding non-deterministic values (timestamps, random without keepers) into the attribute.
Use ignore_changes on the attribute if the drift is cosmetic and provider-driven.
Search the provider issue tracker for the exact attribute and version.
How to prevent it
Pin provider versions and upgrade deliberately.
Avoid non-deterministic inputs to resource arguments.
Test provider upgrades in a lower environment before prod.
Frequently asked questions
What causes Terraform "Provider produced inconsistent final plan" in CI?
There are 3 common causes: provider bug in a specific version, computed attribute not marked unknown, and inputs changed between plan and apply. A known defect in the provider mishandles an attribute between plan and apply.
How do I fix Terraform "Provider produced inconsistent final plan" in CI?
There are 2 fixes depending on which cause you have: upgrade or pin a known-good provider and stabilize the offending attribute. Work through them in order, since the first is the most common.
What does Terraform "Provider produced inconsistent final plan" in CI actually mean?
terraform apply aborts with "Provider produced inconsistent final plan", naming an attribute whose planned and actual values differ and asking you to report it as a provider bug.
How do I stop Terraform "Provider produced inconsistent final plan" in CI happening again?
Pin provider versions and upgrade deliberately. The prevention section lists 3 changes that keep it from recurring.
