GCP provider setup in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Configuration

intermediate

Correct GCP provider block for Terraform

Which Terraform provider block correctly sets up the Google Cloud provider with project ID "my-project" and region "us-central1"?

A

provider "google" {
  project = "my-project"
  zone    = "us-central1"
}

B

provider "gcp" {
  project_id = "my-project"
  region    = "us-central1"
}

C

provider "google" {
  project_id = "my-project"
  location   = "us-central1"
}

D

provider "google" {
  project = "my-project"
  region  = "us-central1"
}

💡 Hint

The official Terraform provider for Google Cloud is named "google" and uses "project" and "region" keys.

The correct provider block uses provider "google" with project and region keys. Option D matches this exactly. Option D uses wrong provider name and keys. Option D uses incorrect keys. Option D uses zone instead of region.

🧠 Conceptual

intermediate

Service Account Authentication in GCP Provider

Which option correctly describes how to authenticate Terraform with a GCP service account JSON key file?

A Include the JSON key file content directly inside the provider block under a 'credentials' attribute.

B Use the 'access_token' attribute in the provider block with the service account email.

C Set the environment variable GOOGLE_APPLICATION_CREDENTIALS to the path of the JSON key file before running Terraform.

D No authentication is needed if you run Terraform on any machine inside GCP.

💡 Hint

Terraform uses environment variables or explicit credentials file paths for authentication.

Terraform authenticates to GCP by reading the JSON key file path from the environment variable GOOGLE_APPLICATION_CREDENTIALS. Option C is correct and recommended. Option C is possible using the credentials attribute with raw JSON content or a file path, but hardcodes credentials and is not recommended for production. Option C is wrong because 'access_token' expects an OAuth token, not an email. Option C is false; authentication is always required.

❓ Architecture

advanced

Best practice for managing multiple GCP projects in Terraform

You manage infrastructure across multiple GCP projects. Which Terraform setup best isolates configurations and credentials per project?

A Create separate Terraform root modules for each project, each with its own provider block and state file.

B Use a single provider block with multiple project IDs listed in an array.

C Manage all projects in one Terraform configuration with conditional resource creation.

D Use one Terraform workspace and switch the project ID in the provider block dynamically with variables.

💡 Hint

Isolating state and credentials per project reduces risk and complexity.

Option A is best practice: separate root modules per project with dedicated provider blocks and state files. This isolates credentials and state, reducing risk. Option A risks state conflicts. Option A is invalid; provider blocks do not accept arrays. Option A complicates management and risks errors.

❓ security

advanced

Least privilege principle for GCP provider service accounts

Which option best follows the least privilege principle when assigning roles to a service account used by Terraform's GCP provider?

A Assign the 'Owner' role to the service account for full access during deployment.

B Assign only the specific roles needed to create and manage the resources Terraform will handle.

C Assign the 'Editor' role to cover most resource management needs.

D Assign no roles and rely on default permissions.

💡 Hint

Grant only permissions necessary for the tasks Terraform performs.

Option B follows the least privilege principle by granting only necessary roles. Option B is too broad and risky. Option B is broad and may grant unnecessary permissions. Option B will cause failures due to lack of permissions.

❓ service_behavior

expert

Terraform GCP provider behavior with missing project attribute

What happens when you run Terraform with a GCP provider block that omits the 'project' attribute and no project is set in environment variables or default credentials?

Terraform

provider "google" {
  region = "us-east1"
}

A Terraform throws an error indicating the project ID is missing and stops execution.

B Terraform applies resources in the default project linked to the credentials automatically.

C Terraform prompts the user to input a project ID during apply.

D Terraform uses the region value as the project ID by default.

💡 Hint

The project ID is required unless set in credentials or environment.

Without a project attribute or environment variable, Terraform cannot determine the project and throws an error. It does not prompt or guess. Option A is correct. Option A is false if no default project is set. Option A does not happen. Option A is invalid.