terraform: ensure provisioner runs only on instance create