Each provisioner that needs to connect to the instance has a connection block defined. This block is responsible for either SSH or WinRM configuration so that Terraform knows how, with which user, password (or key) to connect to the server. You can execute any scripts on the target server via this connection with the help of the remote-exec provisioner.
There is a built-in Chef provisioner, and it's rather easy to use Ansible (because it doesn't need anything installed on the target system), but what about Puppet? It works very similarly to Chef, with the same server-client model, and it requires Puppet agents to be installed. Let's do it with remote-exec.