v7.45.0

FEATURES:

• New Data Source: google_iam_workload_identity_pool_openid_config (#12903)
• New Resource: google_agentic_applications_analyst_agent_persona (#12895)
• New Resource: google_firestore_change_stream (#12908)

IMPROVEMENTS:

• accesscontextmanager: added dry_run_access_levels and principal fields to google_access_context_manager_gcp_user_access_binding resource (#12885)
• accesscontextmanager: updated group_key to be optional and conflict with principal on google_access_context_manager_gcp_user_access_binding resource (#12885)
• bigqueryreservation: added labels field to google_bigquery_reservation resource (#12852)
• certificatemanager: enabled write-only support for pem_private_key on google_certificate_manager_certificate resource (#12905)
• ces: added snippets_config field to data_store_tool.modality_configs and service_directory_config field to python_function in google_ces_tool (#12878)
• chronicle: added schedule_customizations field to google_chronicle_rule_deployment resource (#12856)
• cloudrunv2: added templates.sandboxes field to google_cloud_run_v2_service resource (#12868)
• colab: added custom_environment_spec.shielded_instance_config and workbench_runtime.vm_image fields to google_colab_notebook_execution resource (#12892)
• securityscanner: added static_ip_scan field to google_security_scanner_scan_config resource (#12899)
• sql: added cpu_utilization_threshold_percent, memory_usage_threshold_percent, history_list_length_threshold_count, semaphore_wait_threshold_count, transaction_lock_wait_threshold_count, transaction_kill_threshold_seconds, transaction_kill_type, and transaction_kill_excluded_user_hosts fields to settings.performance_capture_config in google_sql_database_instance resource (#12910)
• vertexai: added spec.container_spec.port field to google_vertex_ai_reasoning_engine resource (#12881)
• workbench: added compute_instance_id field to google_workbench_instance resource (#12891)

BUG FIXES:

• alloydb: fixed an issue where updateMask URL parameter was dropped during cluster updates (e.g. database_version upgrade) due to variable shadowing (#12909)
• appengine: fixed permadiff in google_app_engine_standard_app_version (#12863)
• apphub: fixed panic in google_apphub_service and google_apphub_workload resources when parsing extended_metadata containing MCP server definitions (#12883)
• bigquery: fixed an issue where updating google_bigquery_dataset overwrote fine-grained IAM permissions (#12893)
• cloudsecuritycompliance: fixed state drift on supported_enforcement_modes in google_cloud_security_compliance_framework resource (#12851)
• colab: fixed drift detection on direct_notebook_source.content field in google_colab_notebook_execution resource (#12892)
• compute: fixed a panic in google_compute_shared_vpc_service_project during terraform plan/refresh when the shared VPC link had been removed outside of Terraform (#12869)
• compute: fixed permadiff on adaptive_protection_config.layer_7_ddos_defense_config.enable in google_compute_security_policy when field is not set in config (#12870)
• compute: fixed permadiffs for google_compute_disk on Fedora CoreOS images (#12853)
• networksecurity: fixed google_network_security_gateway_security_policy to force replacement when name or location is modified (#12894)
• networkservices: fixed google_network_services_gateway to force replacement when name or location is modified (#12902)

v7.44.0

FEATURES:

• New List Resource: google_bigquery_dataset_iam_member (#12809)
• New List Resource: google_bigquery_table (#12807)
• New Resource: google_vertex_ai_evaluation_metric (#12840)

IMPROVEMENTS:

• bigquery: added resource identity support to google_bigquery_table (#12806)
• cloudrunv2: added cpu_utilization and concurrency_utilization fields to google_cloud_run_v2_service revision scaling configuration (#12814)
• container: added high_scale_checkpointing_config block to addons_config in google_container_cluster (#12844)
• dataproc: added attached_disk_config to disk_config to support attached disks in the google_dataproc_cluster resource (#12816)
• memorystore: documented TOKEN_AUTH as a google-beta-only value for authorization_mode field on google_memorystore_instance resource (#12810)
• networkservices: added allow_global_access field to google_network_services_gateway (#12815)
• oracledatabase: added identity_connector to google_oracle_database_exadb_vm_cluster for CMEK support (#12817)
• securesourcemanager: added service_account and scan_config fields to google_secure_source_manager_repository (#12837)
• sql: added password_secret_version and user fields into google_sql_provision_script resource (#12821)
• sql: removed ForceNew config from disk_type field in google_sql_database_instance, allowing it to change in future without requiring the database instance to be destroyed and recreated (#12818)
• vertexai: added generation_trigger_config block to google_vertex_ai_reasoning_engine (#12831)
• workstations: added idle_action field to google_workstations_workstation_config (#12804)

BUG FIXES:

• backupdr: fixed issue where google_backup_dr_restore_workload dropped resource_manager_tags during restore requests, causing tags shown in plan to not be applied to restored resources (#12812)
• biglakeiceberg: fixed a permadiff in google_biglake_iceberg_table by suppressing diffs on location when the API-returned path contains a suffix folder (#12808)
• biglakeiceberg: fixed permadiff on write.parquet.compression-codec in google_biglake_iceberg_table (#12836)
• bigquery: fixed a provider panic when reading incomplete IAM conditions on google_bigquery_dataset_iam_member (#12819)
• cloudrunv2: fixed permadiff by setting template.scaling.max_instance_count to computed in google_cloud_run_v2_service (#12829)
• cloudrunv2: fixed permadiff in template.containers.resources.limits block in google_cloud_run_v2_service resource (#12845)
• cloudsecuritycompliance: fixed state drift on supported_enforcement_modes in google_cloud_security_compliance_framework resource (#12851)
• container: fixed a permadiff where ignore_node_count_changes was not persisted in google_container_cluster.node_pool (#12805)
• container: fixed an issue where google_container_node_pool and google_container_cluster failed to invalidate their Instance Group Manager cache when a resize occurred or when ignore_node_count_changes was active (#12811)
• networkconnectivity: made network field in google_network_connectivity_transport optional (#12823)
• recaptchaenterprise: fixed updates to google_recaptcha_enterprise_key so existing challenge_settings.action_settings entries are preserved when the action map changes (#12848)
• servicenetworking: fixed google_service_networking_connection ignoring the configured delete timeout, which used the create timeout instead (#12824)

v7.43.0

NOTES:

• docs(workflows): added warning to source_contents field on google_workflows_workflow noting that it will become required in version 8.0.0 (#12788)
• firestore: clarified which resource to use for which kind of index in Standard and Enterprise editions (#12793)

FEATURES:

• New List Resource: google_compute_instance (#12797)
• New List Resource: google_discovery_engine_assistant (#12790)
• New List Resource: google_discovery_engine_chat_engine (#12790)
• New List Resource: google_discovery_engine_cmek_config (#12790)
• New List Resource: google_discovery_engine_control (#12790)
• New List Resource: google_discovery_engine_data_store (#12790)
• New List Resource: google_discovery_engine_license_config (#12790)
• New List Resource: google_discovery_engine_recommendation_engine (#12790)
• New List Resource: google_discovery_engine_schema (#12790)
• New List Resource: google_discovery_engine_search_engine (#12790)
• New List Resource: google_discovery_engine_serving_config (#12790)
• New List Resource: google_discovery_engine_sitemap (#12790)
• New List Resource: google_discovery_engine_target_site (#12790)
• New List Resource: google_discovery_engine_user_store (#12790)
• New List Resource: google_project_iam_custom_role (#12791)
• New List Resource: google_pubsub_subscription_iam_member (#12798)
• New List Resource: google_service_account_iam_member (#12802)
• • New Resource: google_apihub_runtime_project_attachment (#12764)
• New Resource: google_cloud_support_support_event_subscription (#12783)
• New Resource: google_compute_region_network_policy_traffic_classification_rule (#12778)
• New Resource: google_apihub_runtime_project_attachment (#12764)
• New Resource: google_netapp_trial (#12777)

IMPROVEMENTS:

• apigee: added service_account field to google_apigee_api_deployment resource (#12801)
• apihub: added source_project_id field to google_apihub_plugin_instance resource (#12794)
• artifactregistry: added no_cache field to google_artifact_registry_repository.remote_repository_config (#12779)
• bigquery: added data_governance_tags_info field to google_bigquery_table resource (#12796)
• bigqueryanalyticshub: added proposer field to google_bigquery_analytics_hub_query_template (#12784)
• bigquerydatapolicyv2: added data_governance_tag field to google_bigquery_datapolicyv2_data_policy resource (#12766)
• bigqueryreservation: added principal field to google_bigquery_reservation_assignment resource (#12781)
• cloudrunv: added sandbox_launcher field to the containers of google_cloud_run_service resource (#12786)
• cloudrunv2: added sandbox_launcher field to the containers of google_cloud_run_v2_service resource (#12786)
• discoveryengine: added acl_enabled field to google_discovery_engine_data_store resource (#12768)
• privateca: made config.subject_config.subject.organization optional in google_privateca_certificate (#12767)
• vertexai: added traffic_config field and live traffic split update support to google_vertex_ai_reasoning_engine (#12775)
• workstations: added idle_action field to google_workstations_workstation_config (#12804)

BUG FIXES:

• apigee: fixed continue_on_error argument being dropped in google_apigee_flowhook, aligning provider behavior with the Apigee API (#12803)
• gkehub2: made field spec.workloadidentity.scopeTenancyPool in resource google_gke_hub_feature not required. (#12774)

v7.42.0

NOTES:

• compute: migrated google_compute_region_instance_template resource to use direct HTTP rather than a client library (#12752)

DEPRECATIONS:

• vertexai: deprecated google_vertex_ai_schedule, an accidentally-added duplicate resource; use google_colab_schedule instead. (#12739)

FEATURES:

• New List Resource: google_service_account_key (#12750)
• New Resource: google_agent_identity_auth_provider (#12762)
• New Resource: google_apihub_runtime_project_attachment (#12764)
• New Resource: google_chronicle_big_query_export (#12737)
• New Resource: google_vector_search_data_object (#12755)
• New Resource: google_vertex_ai_persistent_resource (#12756)

IMPROVEMENTS:

• bigquery: added table_type field to google_bigquery_routine resource (#12761)
• colab: added catch_up, create_pipeline_job_request, create_time, last_pause_time, last_resume_time, last_scheduled_run_response, max_concurrent_active_run_count, next_run_time, started_run_count, update_time fields, and sub-fields under create_notebook_execution_job_request.notebook_execution_job (create_time, custom_environment_spec, encryption_spec, job_state, kernel_name, labels, name, schedule_resource_name, workbench_runtime) and under create_notebook_execution_job_request (notebook_execution_job_id, parent) to google_colab_schedule resource (#12739)
• composer: added config.node_config.traffic_routing_config field to google_composer_environment resource (#12733)
• compute: added effective_location field to google_compute_interconnect resource (#12742)
• compute: added request_headers and response_headers fields to log_config on google_compute_backend_service and google_compute_region_backend_service resources (#12746)
• compute: added identity support to google_compute_instance, allowing resource import using an identity block (#12754)
• compute: changed location field to mutable for google_compute_interconnect resource (#12742)
• container: added addons_config.node_readiness_config field to google_container_cluster resource (#12743)
• container: added rollback_safe_upgrade, desired_emulated_version, and emulated_version fields to google_container_cluster resource (#12757)
• container: increased default timeout to 2 hours for google_container_node_pool resource (#12727)
• dataproc: added confidential_instance_type field to google_dataproc_cluster resource (#12725)
• gkehub: added min_control_plane_version, min_node_version, target_control_plane_version, target_node_version, and operational_state fields to google_gke_hub_rollout_sequence resource (#12749)
• hypercomputecluster: increased default timeouts for google_hypercomputecluster_cluster to 120 minutes (#12763)
• modelarmor: added template_metadata.filter_version_selector field to google_model_armor_template resource (#12736)
• sql: added identity support to google_sql_user for terraform query support (#12748)

BUG FIXES:

• bigtable: fixed an issue where bigtable_custom_endpoint and universe_domain were ignored when creating Bigtable resources (#12738)
• compute: fixed an issue where diffs in google_compute_security_policy were not detected (#12745)
• gkehub: fixed rollout_creation_scope and upgrade_types fields in google_gke_hub_rollout_sequence resource (#12749)
• osconfig: added client-side validation to ensure resource_hierarchy_selector and location_selector are not set at the same time in google_os_config_v2_policy_orchestrator, google_os_config_v2_policy_orchestrator_for_folder, and google_os_config_v2_policy_orchestrator_for_organization (#12740)
• secretmanager: fixed an issue where google_secret_manager_secret_version would fail at apply time if neither secret_data nor secret_data_wo was set (#12744)
• sql: fixed issue where updates to settings.ip_configuration.psc_config.allowed_consumer_projects in google_sql_database_instance were silently ignored on in-place updates (#12759)
• vertexai: fixed google_vertex_ai_endpoint_with_model_garden_deployment destroying and recreating the endpoint when min_replica_count, max_replica_count, required_replica_count, or autoscaling_metric_specs changed (#12735)

v7.41.0

FEATURES:

• New Resource: google_biglake_hive_table (#12721)
• New Resource: google_compute_global_vm_extension_policy (#12673)
• New List Resource: google_compute_backend_bucket_signed_url_key (#12713)
• New List Resource: google_compute_backend_service_signed_url_key (#12713)
• New List Resource: google_compute_network_firewall_policy (#12713)
• New List Resource: google_compute_network_firewall_policy_association (#12713)
• New List Resource: google_compute_network_firewall_policy_packet_mirroring_rule (#12713)
• New List Resource: google_compute_preview_feature (#12713)
• New List Resource: google_compute_public_advertised_prefix (#12713)
• New List Resource: google_compute_region_backend_bucket (#12713)
• New List Resource: google_compute_region_network_firewall_policy (#12713)

IMPROVEMENTS:

• accesscontextmanager: added allowed_service_patterns and service_patterns_enforcement_scopes fields to google_access_context_manager_service_perimeter to support VPC Service Controls for non-GCP APIs. (#12705)
• accesscontextmanager: added pscEndpoint to sources in ingress_from and egress_from under resources google_access_context_manager_service_perimeter and variants (#12678)
• backupdr: added backup_blocked_by_vault_access_restriction to data.google_backup_dr_data_source resource (#12717)
• backupdr: added force_update_access_restriction to google_backup_dr_backup_vault resource (#12717)
• backupdr: added update support for access_restriction to google_backup_dr_backup_vault resource (#12717)
• certificatemanager: added in-place update support for the self_managed certificate data (pem_certificate / pem_private_key) on google_certificate_manager_certificate; changing the certificate data is now applied via update instead of forcing recreation (#12696)
• cloudrunv2: added tags field to google_cloud_run_v2_service and google_cloud_run_v2_job resources to allow setting tags for services and jobs at creation time. (#12690)
• cloudsql: added max_custom_on_demand_retention_days to create backup_plan example for sqladmin (#12700)
• compute: added 3500GB and 7000GB SSD partition size to google_compute_instance_template resource (#12708)
• compute: added FLEX_START and RESERVATION_BOUND support to google_compute_instance, google_compute_instance_template, and google_compute_region_instance_template resources (#12720)
• container: added the support for updating node_image_config and image_type fields at the same time (#12674)
• dataform: added git_repository_link field to google_dataform_repository resource (#12683)
• dataproc: added confidential_instance_type to google_dataproc_cluster resource (#12725)
• dataproc: added instance_selection.disk_config field to google_dataproc_cluster resource (#12698)
• discoveryengine: added enable_llm_layout_parsing and enable_get_processed_document fields to google_discovery_engine_data_store resource (#12675)
• sql: added instance_auto_dns_status and write_endpoint_auto_dns_status output fields to psc_auto_connections block in google_sql_database_instance resource (#12692)
• sql: added include_replicas_for_major_version_upgrade field to google_sql_database_instance resource (#12702)
• sql: added switch_transaction_logs_to_cloud_storage_enabled field to google_sql_database_instance resource (#12686)
• vertexai: added traffic_config, url, agent_server_mode, agent_gateway_config, keep_alive_probe, dedicated_ingress_endpoint_enabled, agent_config_source, agent_card, example_store, build_spec, and example_store_config fields to google_vertex_ai_reasoning_engine (#12671)
• workbench: added enable_deletion_protection field to google_workbench_instance resource (#12712)
• workbench: added resource_policies field to google_workbench_instance resource (#12710)
• workbench: added support for min_cpu_platform in google_workbench_instance resource (#12723)
• workstations: added instance_metadata field to google_workstations_workstation_config resource (#12699)

BUG FIXES:

• compute: fixed bug where a permadiff on google_compute_reservation_region_commitment.existing_reservations would persist after upgrading (#12709)
• compute: fixed permadiff on keepalive_interval for google_compute_router bgp block when set to default value (#12676)
• resourcemanager: fixed validation of target_service_account and delegates in the google_service_account_access_token, google_service_account_id_token, and google_service_account_jwt data sources, and of name in the google_service_account_key data source, to reject identifiers that contain path separators (#12679)
• securityposture: fixed a bug where the enforce field in google_securityposture_posture was always set, causing failures for list constraints. (#12715)
• vmwareengine: added correct update_mask value to google_vmwareengine_private_cloud updates (#12716)

v7.40.0

DEPRECATIONS:

• storage: the admit-on-second-miss value for google_storage_anywhere_cache.admission_policy is deprecated and will be removed in a future major release. The backend will ignore this attribute and treat it as admit-on-first-miss. (#12632)

NOTES:

• compute: migrated google_compute_instance code related to advanced machine features to use direct HTTP rather than a client library (#12610)

FEATURES:

• New Data Source: google_data_catalog_taxonomy (#12655)
• New Data Source: google_oracle_database_exascale_db_storage_vault (#12664)
• New List Resource: 'google_project' (#12602)
• New List Resource: google_compute_instant_snapshot (#12661)
• New List Resource: google_compute_region_instant_snapshot (#12661)
• New List Resource: google_compute_region_target_http_proxy (#12661)
• New List Resource: google_compute_region_target_tcp_proxy (#12661)
• New List Resource: google_compute_region_url_map (#12661)
• New List Resource: google_compute_rollout_plan (#12661)
• New List Resource: google_compute_target_grpc_proxy (#12661)
• New List Resource: google_compute_target_http_proxy (#12661)
• New List Resource: google_compute_target_ssl_proxy (#12661)
• New List Resource: google_compute_target_tcp_proxy (#12661)
• New List Resource: google_dns_managed_zone (#12662)
• New List Resource: google_oracle_database_exascale_db_storage_vaults (#12664)
• New Resource: google_bigquery_analytics_hub_query_template (#12669)
• New Resource: google_chronicle_environment_group (#12627)
• New Resource: google_chronicle_soar_domain (#12635)
• New Resource: google_iap_agent_registry_agent_iam_binding (#12651)
• New Resource: google_iap_agent_registry_agent_iam_member (#12651)
• New Resource: google_iap_agent_registry_agent_iam_policy (#12651)
• New Resource: google_iap_agent_registry_endpoint_iam_binding (#12651)
• New Resource: google_iap_agent_registry_endpoint_iam_member (#12651)
• New Resource: google_iap_agent_registry_endpoint_iam_policy (#12651)
• New Resource: google_iap_agent_registry_mcp_server_iam_binding (#12651)
• New Resource: google_iap_agent_registry_mcp_server_iam_member (#12651)
• New Resource: google_iap_agent_registry_mcp_server_iam_policy (#12651)
• New Resource: google_tags_tag_binding_collection (#12619)
• New Resource: google_vector_search_index (#12656)
• New Resource: google_vertex_ai_semantic_governance_policy_engine (#12624)
• New Resource: google_chronicle_data_export (#12657)

IMPROVEMENTS:

• agentregistry: added name field to google_agent_registry_binding resource (#12629)
• agentregistry: added name field to google_agent_registry_service resource (#12629)
• appengine: added app_engine_bundled_services field to google_app_engine_standard_app_version resource (#12634)
• biglakeiceberg: add support for CATALOG_TYPE_FEDERATED with federated_catalog_options to google_biglake_iceberg_catalog (#12659)
• compute: added target_type and target_forwarding_rules to google_compute_region_network_firewall_policy_with_rules resource (#12607)
• compute: added workload_identity_config fields to resource_compute_instance and resource_compute_instance_template resources (#12670)
• container: added ANY_RESERVATION_THEN_FAIL option to consume_reservation_type field in google_container_cluster and google_container_node_pool resources (#12606)
• container: added recurring_maintenance_window field to google_container_cluster resource (#12647)
• container: added custom_node_init configuration block to node_config (supporting Cloud Storage and Secret Manager) for both google_container_cluster and google_container_node_pool resources. (#12666)
• container: added maintenance_policy field to google_container_node_pool resource (#12638)
• dataplex: added catalog_publishing_enabled field to google_dataplex_datascan resource (#12652)
• dlp: added inspect_config.min_likelihood_per_info_type to google_data_loss_prevention_inspect_template (#12654)
• firestore: added skip_wait field to google_firestore_field resource, skipping the wait for index creation (#12642)
• oracledatabase: added support for configuring Exascale-based VM clusters on top of dedicated storage vaults via the exascale_db_storage_vault parameter and storage_management_type to determine if VM Cluster is ASM or EXASCALE in google_oracle_database_cloud_vm_cluster (#12626)
• oracledatabase: added exadata_infrastructure field to google_oracle_database_exascale_db_storage_vault resource (#12616)
• oracledatabase: added exascale_db_storage_vault and storage_management_type fields to google_oracle_database_cloud_vm_clusters data source (#12664)
• sql: added enforce_new_sql_network_architecture field to google_sql_database_instance resource (#12653)
• sql: added psc_auto_connection_policy_enabled field and output-only service_connection_policy and service_connection_policy_creation_result fields to google_sql_database_instance resource (#12645)
• storagetransfer: added private_network_service to resource google_storage_transfer_job (#12617)
• vertex_ai: added customization_configs and structured_memory_configs fields to google_vertex_ai_reasoning_engine resource (#12618)
• vertexai: added traffic_config, url, agent_server_mode, agent_gateway_config, keep_alive_probe, dedicated_ingress_endpoint_enabled, agent_config_source, agent_card, example_store, build_spec, traffic_config, and example_store_config fields to google_vertex_ai_reasoning_engine (#12671)

BUG FIXES:

• bigtable: fixed a bug where row_affinity updates did not persist on google_bigtable_app_profile (#12636)
• bug: fixed labels di...

v7.39.0

NOTES:

• compute: migrated google_compute_instance_template resource partially to use direct HTTP rather than a client library (#12576)
• compute: migrated google_compute_network_peering resource to use direct HTTP rather than a client library (#12587)

FEATURES:

• New Data Source: google_agent_registry_agent (#12590)
• New Data Source: google_agent_registry_endpoint (#12590)
• New Data Source: google_agent_registry_mcp_server (#12590)
• New Data Source: google_compute_instance_groups (#12554)
• New Data Source: google_storage_control_folder_intelligence_findings_summary (#12585)
• New Data Source: google_storage_control_organization_intelligence_findings_summary (#12585)
• New Data Source: google_storage_control_project_intelligence_findings_summary (#12585)
• New Resource: google_agent_registry_binding (#12590)
• New Resource: google_agent_registry_service (#12590)
• New Resource: google_artifact_registry_project_config (#12575)
• New Resource: google_biglake_hive_database (#12580)
• New Resource: google_compute_bulk_per_instance_config (#12592)
• New Resource: google_compute_firewall_policy_iam_binding (#12552)
• New Resource: google_compute_firewall_policy_iam_member (#12552)
• New Resource: google_compute_firewall_policy_iam_policy (#12552)
• New Resource: google_compute_network_firewall_policy_iam_binding (#12552)
• New Resource: google_compute_network_firewall_policy_iam_member (#12552)
• New Resource: google_compute_network_firewall_policy_iam_policy (#12552)
• New Resource: google_compute_region_network_firewall_policy_iam_binding (#12552)
• New Resource: google_compute_region_network_firewall_policy_iam_member (#12552)
• New Resource: google_compute_region_network_firewall_policy_iam_policy (#12552)
• New Resource: google_compute_region_network_policy (#12579)
• New Resource: google_compute_zone_vm_extension_policy (#12595)
• New Resource: google_iap_agent_registry_iam_binding (#12593)
• New Resource: google_iap_agent_registry_iam_member (#12593)
• New Resource: google_iap_agent_registry_iam_policy (#12593)
• New Resource: google_iap_location_web_iam_binding (#12593)
• New Resource: google_iap_location_web_iam_member (#12593)
• New Resource: google_iap_location_web_iam_policy (#12593)
• New Resource: google_oracle_database_cloud_exadata_infrastructure_exascale_config (#12594)
• New Resource: google_vertex_ai_model_garden_enable_model (#12577)
• New List Resource: google_bigquery_dataset (#12571)
• New List Resource: google_compute_cross_site_network (#12584)
• New List Resource: google_compute_external_vpn_gateway (#12584)
• New List Resource: google_compute_global_network_endpoint_group (#12584)
• New List Resource: google_compute_ha_vpn_gateway (#12584)
• New List Resource: google_compute_interconnect_attachment_group (#12584)
• New List Resource: google_compute_interconnect_group (#12584)
• New List Resource: google_compute_public_delegated_prefix (#12584)
• New List Resource: google_compute_region_commitment (#12584)
• New List Resource: google_compute_region_network_endpoint_group (#12584)
• New List Resource: google_compute_vpn_gateway (#12584)
• New List Resource: google_compute_wire_group (#12584)
• New List Resource: google_folder_iam_member (#12565)
• New List Resource: google_kms_crypto_key_version (#12572)
• New List Resource: google_project (#12602)
• New List Resource: google_project_service (#12562)

IMPROVEMENTS:

• bigquery: added external_runtime_options.container_request_concurrency field to google_bigquery_routine resource (#12591)
• compute: added instance_lifecycle_policy.on_failed_health_check field in resources google_compute_instance_group_manager and google_compute_region_instance_group_manager (ga) (#12564)
• container: added new fields shutdown_grace_period_seconds and shutdown_grace_period_critical_pods_seconds to node_kubelet_config block. (#12581)
• dataplex: added icon field to google_dataplex_data_product resource (#12559)
• dataplex: added name field to google_dataplex_data_product_data_asset resource (#12586)
• dlp: added allow_limited_availability_info_types to google_data_loss_prevention_inspect_template (#12589)
• networkservices: added forward_attributes field to google_network_services_lb_edge_extension, google_network_services_lb_route_extension, and google_network_services_lb_traffic_extension resources (#12578)

BUG FIXES:

• compute: fixed a panic in google_compute_project_metadata and google_compute_project_metadata_item when project common instance metadata items contain null/empty values. (#12574)
• compute: fixed a validation error on google_compute_instance (Provisioned IOPS cannot be specified with disk type pd-balanced) that occurred during updates on instances with Hyperdisk Balanced boot disks. (#12550)
• dataproc: fixed a bug where changing policy_id on google_dataproc_autoscaling_policy planned an in-place update and failed; it now correctly forces resource replacement (destroy and recreate). (#12597)
• iam: fixed ephemeral google_service_account_key producing a 404 due to duplicate /keys in the URL when fetch_key = true and name is provided (#12553)

v7.38.0

NOTES:

• bigquery: migrated google_bigquery_table resource to use direct HTTP rather than a client library (#12520)
• compute: migrate resource_compute_instance_template_test.go.tmpl resource to use direct HTTP rather than a client library (#12492)
• compute: migrated google_compute_resource_compute_instance to use direct HTTP rather than a client library (#12530)
• compute: migrated parts of google_compute_instance and shared instance functions to use direct HTTP (#12483)
• migrated compute_instance_helpers interfaces (#12506)

FEATURES:

• New Data Source: google_storage_control_project_intelligence_finding_revision (#12523)
• New Data Source: google_storage_control_project_intelligence_finding_revisions (#12523)
• New Resource: google_biglake_hive_catalog (#12509)
• New Resource: google_chronicle_findings_refinement_deployment (#12532)
• New Resource: google_chronicle_parser_extension (#12517)
• New Resource: google_dataplex_metadata_feed (#12537)
• New Resource: google_vertex_ai_schedule (#12510)
• New Resource: google_vertex_ai_tensorboard_run (#12524)
• New List Resource: google_compute_address (#12528)
• New List Resource: google_compute_cross_site_network (#12497)
• New List Resource: google_compute_https_health_check (#12528)
• New List Resource: google_compute_machine_image (#12528)
• New List Resource: google_compute_node_template (#12528)
• New List Resource: google_compute_packet_mirroring (#12528)
• New List Resource: google_compute_region_autoscaler (#12528)
• New List Resource: google_compute_region_composite_health_check (#12528)
• New List Resource: google_compute_region_health_aggregation_policy (#12528)
• New List Resource: google_compute_region_health_source (#12528)
• New List Resource: google_project_iam_member (#12516)
• New List Resource: google_pubsub_topic (#12525)
• New List Resource: google_secret_manager_secret (#12521)

IMPROVEMENTS:

• apigee: added consumer_key and consumer_secret fields to google_apigee_developer_app to allow specifying a static credential (#12487)
• artifactregistry: added update support to upstream_credentials in google_artifact_registry_repository (#12486)
• biglakeiceberg: added CATALOG_TYPE_BIGLAKE enum to catalog_type field and added restricted_locations_config.restricted_locations field in google_biglake_iceberg_catalog resource (#12534)
• biglakeiceberg: added sort_order field to google_biglake_iceberg_table resource (#12498)
• ces: added timeout and tool_fake_config fields to google_ces_tool and google_ces_toolset resource (#12518)
• compute: added params.resource_manager_tags field to google_compute_snapshot resource (#12502)
• compute: made network_endpoints.ip_address optional in google_compute_network_endpoints resource to support attaching endpoints to a network endpoint group of type GCE_VM_IP_DEDICATED_BACKEND (#12503)
• container: added dataplane_optimization_mode in google_container_cluster (#12494)
• container: added ignore_node_count_changes field to google_container_cluster and google_container_node_pool resources. When set to true, the provider ignores drift via external node count changes and skips related IGM API queries, resolving long plan times on clusters with a large number of instance groups. (#12511)
• container: added skip_node_pool_refresh field to google_container_cluster resource. When set to true, the google_container_cluster skips refreshing and setting node_pools from the API, resolving long plan times on clusters with a large number of node pools. Note that this results in node_pools being set to an empty list in state (#12511)
• container: added taint_config block to google_container_cluster and google_container_node_pool (#12505)
• container: improved GKE node pool read performance by caching instance group metadata longer (#12511)
• datastream: added additional_options field to google_datastream_connection_profile resource (#12526)
• gkehub: added support for specifying soak_duration in minutes, hours and days to the google_gke_hub_rollout_sequence resource (#12512)
• iamworkforcepool: added write-only support for oidc.client_secret in google_iam_workforce_pool_provider (#12500)
• kms: added resource identity support for google_kms_crypto_key_version resource (#12504)
• networkservices: added dns_peering_config field to google_network_services_agent_gateway resource (#12481)
• sql: added mode, dns_servers, admin_credential_secret_name, and organizational_unit fields to active_directory_config block in google_sql_database_instance resource for SQL Server instances (#12495)
• sql: added performance_capture_config to google_sql_database_instance (#12536)
• storage: added lifecycle_rule.condition.size_above_bytes and lifecycle_rule.condition.size_below_bytes fields to google_storage_bucket resource (#12490)

BUG FIXES:

• apigee: google_apigee_developer_app now updates api_products and scopes on the existing credential instead of creating a new credential (consumer key) on update (#12533)
• biglake: allow location to be set on google_biglake_iceberg_namespace (#12482)
• biglake: fixed creation failure of google_biglake_iceberg_table resource when the referenced google_biglake_iceberg_catalog has credential_mode set to CREDENTIAL_MODE_VENDED_CREDENTIALS due to a missing X-Iceberg-Access-Delegation header (#12514)
• compute: fixed broken import of share_settings on google_compute_reservation (#12527)
• datastream: fixed a positional diff when adding objects to the salesforce_source_config.include_objects field in google_datastream_stream resource (#12531)
• iamworkforcepool: marked sensitive and ignore_read as true for security_token in google_iam_workforce_pool_provider_scim_token resource (#12480)
• networkconnectivity: fixed google_network_connectivity_regional_endpoint being recreated on every apply when address is s...

v7.37.0

NOTES:

• compute: migrated EnableDisplay fields in google_compute_instance resources to use direct HTTP rather than a client library (#12456)
• compute: migrated desired_status block and startInstanceOperation in resource_compute_instance.go.tmpl to use direct HTTP rather than a client library (#12437)
• compute: migrated getInstance, getDisk, Delete and the setMetadata update block in resource_compute_instance.go.tmpl to use direct HTTP rather than a client library (#12418)
• compute: migrated part of google_compute_instance to use direct HTTP rather than a client library (#12463)

DEPRECATIONS:

• cloudrunv2: deprecated http_get.http_headers.port field in container startup probe and liveness probe in google_cloud_run_v2_worker_pool resource because it is not supported in Cloud Run API. This field will be removed in a future major release. (#12476)
• cloudsecuritycompliance: deprecated the organization field on google_cloud_security_compliance_cloud_control, google_cloud_security_compliance_framework, and google_cloud_security_compliance_framework_deployment. Use parent instead (#12449)
• networkservices: deprecated protocols on google_network_services_agent_gateway (#12478)

FEATURES:

• New Data Source: google_oracle_database_goldengate_deployment_versions (#12451)
• New Data Source: google_storage_control_project_intelligence_finding (#12444)
• New Data Source: google_storage_control_project_intelligence_findings (#12444)
• New Resource: google_chronicle_parser (#12477)
• New Resource: google_chronicle_soar_network (#12439)
• New Resource: google_migration_center_import_data_file (#12423)
• New Resource: google_network_services_agent_gateway (#12479)
• New Resource: google_vertex_ai_tensorboard_experiment (#12472)
• New List Resource: google_bigquery_dataset_access (#12441)
• New List Resource: google_cloud_scheduler_job (#12441)
• New List Resource: google_dns_record_set (#12467)
• New List Resource: google_monitoring_alert_policy (#12441)
• New List Resource: google_pubsub_subscription (#12441)

IMPROVEMENTS:

• apigee: added new resource google_apigee_environment_debugmask for managing Apigee environment debug masks (#12421)
• backupdr: added support for use_project_service_account flag in google_backup_dr_restore_workload disk and compute restores (#12473)
• cloudrunv2: added http_get.http_headers.name field to container startup probe and liveness probe in google_cloud_run_v2_worker_pool resource (#12476)
• cloudrunv2: added template.client and template.client_version fields to google_cloud_run_v2_worker_pool resource (#12440)
• cloudsecuritycompliance: added support for project parent to google_cloud_security_compliance_cloud_control, google_cloud_security_compliance_framework, and google_cloud_security_compliance_framework_deployment via the new parent field. The organization field has been deprecated. (#12449)
• compute: added params.resource_manager_tags field to google_compute_reservation resource (#12450)
• compute: added data sources for google_compute_target_http_proxy, google_compute_target_https_proxy, google_compute_region_target_http_proxy, and google_compute_region_target_https_proxy (#12447)
• container: added addons_config.slurm_operator_config field to google_container_cluster resource (#12445)
• container: added node_image_config field to google_container_node_pool and google_container_cluster resources (#12470)
• databasemigrationservice: added state and stop_on_warnings fields to google_database_migration_service_migration_job resource (#12430)
• dns: added resource identity support for google_dns_record_set resource (#12467)
• networksecurity: added network_rules field on google_network_security_authz_policy resource (#12488)
• pubsub: added first_revision_id and last_revision_id fields to google_pubsub_topic resource (#12420)
• sql: added settings.ip_configuration.psc_config.psc_auto_dns_enabled and settings.ip_configuration.psc_config.psc_write_endpoint_dns_enabled fields to google_sql_database_instance resource (#12454)

BUG FIXES:

• apigee: fixed google_apigee_api not detecting local bundle changes due to a missing default on detect_md5hash, and fixed the test sweeper's list URL (#12466)
• apigee: fixed google_apigee_security_action update failure by enabling PATCH-based updates now that the Apigee Security Actions API supports mutations (#12448)
• apigee: fixed a perma-diff for api_products and scopes fields in google_apigee_developer_app resource when updating them with multiple items (#12464)
• apigee: fixed an issue where the resource would attempt recreation if the key_expires_in field was set in google_apigee_developer_app resource (#12457)
• backupdr: updated the Beta provider to point to the v1beta API endpoint (#12461)
• ces: fixed persistent diff in google_ces_guardrail when llm_prompt_security is configured with default_settings (#12446)
• cloudrun: fixed a permadiff for the run.googleapis.com/gpu-zonal-redundancy-disabled annotation in google_cloud_run_service (#12462)
• cloudrunv2: fixed bug where only one http_get.http_headers block could be specified in container startup probe and liveness probe in google_cloud_run_v2_worker_pool resource (#12476)
• compute: fixed an issue in google_compute_subnetwork where secondary_ip_range entries linked to an internal_range could not be removed and adding new ranges would sometimes fail due to positional shifts (#27175) (#12422)
• compute: fixed diff when using existing_reservations field in google_region_commitment (#12453)
• compute: fixed rules in google_compute_security_policy being unnecessarily recreated due to TypeSet hash instability (#12436)
• sql: fixed inconsistent result after apply error when adding users of type CLOUD_IAM_GROUP with capitalized domain names for MySQL (#12460)
• storage: fixed OOM issue for google_storage_bucket force_destroy by limiting the number of outstanding tasks to 2000 (#12455)

v7.36.0

FEATURES:

• New Data Source: google_apigee_instance (#12393)
• New Data Source: google_oracle_database_goldengate_deployment_types (#12361)
• New Resource: google_apigee_datastore (#12358)
• New Resource: google_chronicle_customlist (#12378)
• New Resource: google_chronicle_environment (#12385)
• New Resource: google_chronicle_findings_refinement (#12348)
• New Resource: google_discovery_engine_search_engine_iam_binding (#12409)
• New Resource: google_iam_organization_access_policy (#12398)
• New Resource: google_license_manager_configuration (#12413)
• New Resource: google_migration_center_import_job (#12351)
• New List Resource: google_compute_disk (#12359)
• New List Resource: google_compute_image (#12359)
• New List Resource: google_compute_snapshot (#12359)
• New List Resource: google_storage_hmac_key (#12364)

IMPROVEMENTS:

• accesscontextmanager: added in-place update for egress_from and egress_to fields in google_access_context_manager_service_perimeter_egress_policy resource (#12397)
• accesscontextmanager: added in-place update for egress_from and egress_to fields in google_access_context_manager_service_perimeter_ingress_policy resource (#12397)
• bigquery: added IAM support (google_bigquery_routine_iam_policy, google_bigquery_routine_iam_binding, google_bigquery_routine_iam_member) for google_bigquery_routine (#12410)
• bigtable: added automated_backup_policy.locations field in google_bigtable_table resource (#12365)
• ces: added agent_tool, file_search_tool, and widget_tool support to the google_ces_tool resource (#12392)
• ces: added google_search_tool.prompt_config and data_store_tool.data_store_source fields in google_ces_tool resource (#12392)
• ces: exposed remote_agent_tool, connector_tool, and mcp_tool as read-only (output-only) attributes in google_ces_tool (#12392)
• container: added node_creation_config field to google_container_cluster resource (#12408)
• container: added node_drain_config.pdb_timeout_duration and node_drain_config.grace_termination_duration fields to google_container_node_pool and google_container_cluster resources (#12401)
• data_catalog: added RICHTEXT to allowed values of primitive_type on google_data_catalog_tag_template fields. (#12383)
• dataform: added disabled field to google_dataform_repository_workflow_config resource (#12394)
• dataplex: added IAM support for google_dataplex_data_product (iam_policy, iam_binding, iam_member) (#12371)
• dataplex: added access_approval_config field to google_dataplex_data_product (#12371)
• firebaseailogic: added regional_propagation_disabled field to google_firebase_ai_logic_prompt_template and google_firebase_ai_logic_prompt_template_lock resources (#12349)
• hypercomputecluster: marked network_resources field as required in google_hypercomputecluster_cluster resource to align with API validation (#12374)
• securesourcemanager: added psc_allowed_projects field to google_secure_source_manager_instance resource (#12402)
• securityscanner: added ignore_http_status_errors field to google_security_scanner_scan_config resource (#12352)
• workbench: added NVIDIA_RTX6000 to the supported gce_setup.accelerator_configs.type values on google_workbench_instance (#12415)

BUG FIXES:

• apigee: send zero values for ip_header_index in google_apigee_environment (#12381)
• backupdr: fixed an issue where google_backup_dr_restore_workload did not use the correct API JSON names for networking/reservation fields (#12391)
• compute: fixed an issue where updating connection_limit in the consumer_accept_lists block of google_compute_service_attachment would not trigger a resource update. (#12395)
• compute: fixed regional backend reference in google_compute_regional_url_map (#12411)
• dlp: fixed error when reading google_data_loss_prevention_discovery_config caused by nested error details (#12380)
• firebaseailogic: fixed perma-diff in google_firebase_ai_logic_config template_only field on google_firebase_ai_logic_config resource (#12375)
• sql: fixed permadiff on connection_pool_config when connection_pooling_enabled is set to false (#12417)
• storage: fixed missing identity error when updating values in google_storage_bucket resource (#12356)
• tags: fixed google_tags_location_tag_binding failing with Operation location does not match service location 'global' during creation (#12379)
• vertexai: fixed terraform import of google_vertex_ai_index_endpoint_deployed_index failing with "Cannot determine region" when provider-level region/zone is unset (#12399)