Quiz results are saved to your browser's local storage and will persist between sessions.
How the google provider gets its credentials, what required_providers does that a provider block doesn't, and why terraform init is the safest command in the tool. If you are debugging a "why is it using the wrong project" problem, start here.
What does gcloud auth application-default login actually create, and where?
It writes an OAuth refresh token to that file. Terraform's google provider and any Google client library read it automatically. The derived access token expires hourly, but the refresh token doesn't — you authenticate once and forget about it until you explicitly revoke it.
Does terraform init create or touch terraform.tfstate?
init only downloads provider plugins into .terraform/ and writes .terraform.lock.hcl. It's purely tooling setup — safe to rerun anywhere, zero effect on real infrastructure or state. State only gets written once something real is created or read.
A provider block sets project=var.project_id, but every resource in the module also sets its own explicit project=var.project_id. What happens if you delete the provider block's project line entirely?
Provider-block project/region/zone are fallback defaults only, used exclusively by resources that don't set their own. If every resource sets its own value explicitly, the provider block's value is dead code — removing it changes nothing, live-verified via a controlled experiment.
What's the actual difference between the required_providers block in a terraform{} block and a provider "google" {} config block?
These are two independent mechanisms. required_providers (in the terraform block) is what init actually reads to know which provider plugin to fetch — removing the provider config block entirely doesn't stop init from working, since plugin download is unrelated to runtime config. The provider block itself is only about how that plugin authenticates and what defaults it applies at apply time.
Why is data "google_client_config" used to supply the GCP access token to the provider, rather than a resource or a static/stored value?
GCP access tokens expire hourly. A resource is only re-evaluated on apply, and only then if Terraform actually detects drift — it wouldn't reliably refresh an hourly-expiring value. A data source re-queries live every single plan/apply, so it's the only mechanism that guarantees kubectl/Helm/the provider always get a fresh, valid token instead of an expired one.