What causes "host for provisioner cannot be empty" in hashicorp/terraform?

Set a non-empty host in the connection block, either as a literal or a valid resource attribute.

host for provisioner cannot be empty

Error message

host for provisioner cannot be empty

What it means

Raised in parseConnectionInfo when the 'host' attribute of the SSH connection block is empty. The host is the remote target address and is strictly required; without it the communicator cannot dial anywhere. This is a configuration-validation error returned before any network activity.

Source

Thrown at internal/communicator/ssh/provisioner.go:189

	// To default Agent to true, we need to check the raw string, since the
	// decoded boolean can't represent "absence of config".
	//
	// And if SSH_AUTH_SOCK is not set, there's no agent to connect to, so we
	// shouldn't try.
	agent := v.GetAttr("agent")
	if agent.IsNull() && os.Getenv("SSH_AUTH_SOCK") != "" {
		connInfo.Agent = true
	}

	if connInfo.User == "" {
		connInfo.User = DefaultUser
	}

	// Check if host is empty.
	// Otherwise return error.
	if connInfo.Host == "" {
		return nil, fmt.Errorf("host for provisioner cannot be empty")
	}

	// Format the host if needed.
	// Needed for IPv6 support.
	connInfo.Host = shared.IpFormat(connInfo.Host)

	if connInfo.Port == 0 {
		connInfo.Port = DefaultPort
	}
	// Set default targetPlatform to unix if it's empty
	if connInfo.TargetPlatform == "" {
		connInfo.TargetPlatform = TargetPlatformUnix
	} else if connInfo.TargetPlatform != TargetPlatformUnix && connInfo.TargetPlatform != TargetPlatformWindows {
		return nil, fmt.Errorf("target_platform for provisioner has to be either %s or %s", TargetPlatformUnix, TargetPlatformWindows)
	}
	// Choose an appropriate default script path based on the target platform. There is no single
	// suitable default script path which works on both UNIX and Windows targets.
	if connInfo.ScriptPath == "" && connInfo.TargetPlatform == TargetPlatformUnix {

View on GitHub (pinned to c9def3e214)

Solutions

Set a non-empty host in the connection block, either as a literal or a valid resource attribute.
If referencing a resource attribute, ensure that attribute is known and non-empty at the time the provisioner runs (e.g. use public_ip or public_dns only when the instance has one).
For instances without public IPs, use a bastion_host or set host to a private IP reachable from the runner.

Example fix

// before
connection {
  type = "ssh"
  user = "root"
  # host missing
}

// after
connection {
  type = "ssh"
  host = aws_instance.web.public_ip
  user = "root"
}

Defensive patterns

Strategy: validation

Validate before calling

// Validate host is non-empty before constructing the communicator
func validateConnectionHost(host string) error {
    if strings.TrimSpace(host) == "" {
        return errors.New("host for provisioner cannot be empty")
    }
    return nil
}

Prevention

Always set host in the connection block to a known, non-empty value.
When referencing resource attributes (e.g. public_ip), ensure they are known and non-null at provision time.
For instances without public IPs, use a bastion or set host to a private IP.

When it happens

Trigger: The connection block's host attribute resolves to an empty string, either because it was omitted entirely or because the variable/resource attribute it references is null or empty at plan/apply time.

Common situations: host references a resource attribute that is not yet known or is null (e.g. aws_instance.example.public_ip when the instance has no public IP), the connection block omits host entirely, or a variable defaulting to empty string is used.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/a945ac605cfc48b2. Report an issue: GitHub.