What causes "invalid empty string in 'script'" in hashicorp/terraform?

Set 'script' to a real path, or omit it and use 'inline'/'scripts' instead.

invalid empty string in 'script'

Error message

invalid empty string in 'script'

What it means

Error from collectScripts() when the singular 'script' attribute of the remote-exec provisioner is non-null but equals the empty string "". The script path must be non-empty.

Source

Thrown at internal/builtin/provisioners/remote-exec/resource_provisioner.go:195

		scripts, err := generateScripts(inline)
		if err != nil {
			return nil, err
		}

		var r []io.ReadCloser
		for _, script := range scripts {
			r = append(r, io.NopCloser(bytes.NewReader([]byte(script))))
		}

		return r, nil
	}

	// Collect scripts
	var scripts []string
	if script := v.GetAttr("script"); !script.IsNull() {
		s := script.AsString()
		if s == "" {
			return nil, errors.New("invalid empty string in 'script'")
		}
		scripts = append(scripts, s)
	}

	if scriptList := v.GetAttr("scripts"); !scriptList.IsNull() {
		for _, script := range scriptList.AsValueSlice() {
			if script.IsNull() {
				return nil, errors.New("invalid null string in 'script'")
			}
			s := script.AsString()
			if s == "" {
				return nil, errors.New("invalid empty string in 'script'")
			}
			scripts = append(scripts, s)
		}
	}

	// Open all the scripts

View on GitHub (pinned to c9def3e214)

Solutions

Set 'script' to a real path, or omit it and use 'inline'/'scripts' instead.
Guard with a conditional: only include the provisioner when the path is set.

Example fix

// before
provisioner "remote-exec" {
  script = var.script_path
}
// after
provisioner "remote-exec" {
  script = "/opt/scripts/bootstrap.sh"
}

Defensive patterns

Strategy: validation

Validate before calling

# Only set 'script' when the path is non-empty, or switch to inline:
# script = var.script_path != "" ? var.script_path : null
# Better: guard the whole provisioner with count.

Prevention

Give script-path variables a real default or omit them.
Use count = 0 on the resource when the script path is unset.
Validate configuration in CI.

When it happens

Trigger: provisioner "remote-exec" { script = "" } — typically from a variable resolving to an empty string.

Common situations: A var.script_path that defaults to "" and is never overridden; templating that blanks out the path.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/57ad0588c27a7f0e. Report an issue: GitHub.