What makes declarative IaC different from a provisioning script?

Why this is the answer

A script says how — create this, then that — and running it twice does the work twice. A declarative configuration says what the result should be, and the tool computes the difference from what exists, which is what makes the same file safe to apply repeatedly. Credentials are still yours to supply.