What happens by default if a Terraform creation-time provisioner fails?

When a creation-time provisioner fails in Terraform, the resource is marked as "tainted." This marking indicates that the resource is in an undesirable state due to the failure during the provisioning process, which could be caused by a variety of factors such as incorrect configurations or network issues. By marking the resource as tainted, Terraform signals that the resource needs attention and potentially requires a re-creation in the next apply phase to reach the desired state.

The concept of resources being "tainted" is crucial for maintaining the integrity of your infrastructure. It ensures that any subsequent Terraform apply operation will recognize that the existing resource is not functioning as intended and will replace it to achieve the desired configuration specified in the Terraform code.

In contrast, the other options either misrepresent what happens during a failure or do not accurately capture the default behavior of Terraform. Unlike the notion that Terraform will automatically retry, it instead focuses on marking resources that encounter issues for further examination and remediation.