Terraform "Provider produced inconsistent final plan" in CI

Terraform caught the provider returning a value during apply that did not match what it promised at plan time. This is a provider-level inconsistency, not a mistake in your config syntax.

What this error means

apply aborts with "Provider produced inconsistent final plan" (or "inconsistent result after apply"), naming the attribute that differed and asking you to report it as a provider bug. The same config may plan cleanly yet fail at apply.

terraform apply output

Error: Provider produced inconsistent final plan

When expanding the plan for aws_instance.app to include new values learned so
far during apply, provider "registry.terraform.io/hashicorp/aws" produced an
invalid new value for .private_ip: was known, but now unknown.

This is a bug in the provider, which should be reported in the provider's own
issue tracker.

Common causes

A provider bug on a specific attribute

The provider computed an attribute differently between plan and apply. It is a known class of provider defect, often fixed in a newer provider release.

Computed values used in dependent config

Feeding an unknown/computed value into count, for_each, or another resource can surface the inconsistency. Restructuring how the value flows often avoids it.

How to fix it

Upgrade the provider

These are frequently fixed in provider releases. Bump to the latest compatible version and re-lock.

Terminal

terraform init -upgrade
git add .terraform.lock.hcl

Avoid feeding computed values where they cause it

Identify the attribute named in the error.
Avoid using that not-yet-known value in count/for_each or another resource’s required argument.
Use indirection (locals, depends_on, or a static value) so the computed value is not needed at plan-expansion time.
If it persists on the latest provider, report it on the provider issue tracker with a minimal repro.

How to prevent it

Keep providers reasonably current and re-lock after upgrades.
Avoid driving count/for_each directly from computed attributes.
Pin provider versions so a bad release is not silently picked up.