With the caveat that terraform provisioners are a non-deterministic action that does not result in the (exact) same resource state. In this example, updating packages at two points in time will result in different versions and dependencies installed on the machine. For this reason, changing a provisioner results in the resource being destroyed and recreated (i.e., adding a new command will not only run that command on an existing resource).