v7.23.0

DEPRECATIONS:

• notebooks: google_notebooks_environment is deprecated and will be removed in a future major release. Use google_workbench_instance instead (#11646)
• provider: google_*_iam_* resources and datasources will now show deprecation messages when their parent resource has been deprecated (#11646)

FEATURES:

• New Data Source: google_observability_folder_settings (#11668)
• New Data Source: google_observability_organization_settings (#11649)
• New Data Source: google_observability_project_settings (#11663)
• New Data Source: google_oracle_database_odb_network (#11648)
• New Data Source: google_oracle_database_odb_subnet (#11648)
• New Resource: google_compute_router_named_set (#11667)
• New Resource: google_dataform_config (#11662)
• New Resource: google_observability_folder_settings (#11668)
• New Resource: google_observability_organization_settings (#11649)
• New Resource: google_observability_project_settings (#11663)

IMPROVEMENTS:

• alloydb: added dataplex_config field to google_alloydb_cluster resource (#11651)
• biglake: added primary_location to google_biglake_iceberg_catalog resource (#11654)
• compute: added preemption_notice_duration field to google_compute_instance, google_compute_instance_template, and google_compute_instance_from_machine_image resources (#11655)
• compute: added storage_pool support to google_compute_instance_template and google_compute_region_instance_template disks (#11671)
• container: added control_plane_disk_encryption_key_versions field to user_managed_keys_config in google_container_cluster resource (#11647)
• dataproc: added cluster_type to google_dataproc_cluster resource (#11673)
• discoveryengine: added action_config, bap_config, destination_configs, and data_source_version to google_discovery_engine_data_connector resource (#11645)
• dlp: added actions.publish_to_scc, actions.publish_to_chronicle, actions.export_data.sample_findings_table and targets.big_query_target.filter.table_reference.project_id fields to google_data_loss_prevention_discovery_config resource (#11639)
• gkebackup: added protected_namespace_count field to google_gke_backup_backup_plan resource (#11641)
• netapp: added mode field to google_netapp_storage_pool resource (#11656)
• osconfig: added patch_config.skip_unpatchable_vms field to google_os_config_patch_deployment resource (#11640)
• pubsub: added text_config field to google_pubsub_subscription resource (#11660)
• sql: added clone_context.source_project field to google_sql_database_instance resource to support cross project clone (#11684)

BUG FIXES:

• tags: fixed iam read-after-write consistency issue with conditions in google_tags_tag_key_iam_member resource (#11661)

v7.22.0

DEPRECATIONS:

• dataplex: deprecated google_dataplex_data_asset. Use google_dataplex_data_product_data_asset instead. (#26256)

FEATURES:

• New Resource: google_hypercomputecluster_cluster (#26180)

IMPROVEMENTS:

• compute: initialize_params.size is now updatable in-place in the google_compute_instance resource (#26195)
• compute: added dest_network_context, src_network_context and src_networks fields to google_compute_firewall_policy_rule resource (#26227)
• compute: added dest_network_context, src_network_context and src_networks fields to google_compute_network_firewall_policy_rule resource (#26227)
• compute: added dest_network_context, src_network_context and src_networks fields to google_compute_region_network_firewall_policy_rule resource (#26227)
• compute: added consumer_accept_lists.endpoint_url to google_compute_service_attachment resource (#26234)
• compute: added erase_windows_vss_signature field to google_compute_disk resource (#26249)
• compute: added erase_windows_vss_signature field to google_compute_region_disk resource (#26249)
• developerconnect: added http_config field to google_developer_connect_connection resource (#26232)
• filestore: added source_backupdr_backup field to google_filestore_instance resource (#26238)
• gkehub2: added field spec.workloadidentity to resource google_gke_hub_feature (#26259)
• iam: added AZURE_AD_GROUPS_DISPLAY_NAME enum value to extra_attributes_oauth2_client.attribute-type field in google_iam_workforce_pool_provider resource (#26226)
• kms: added a KMS AutokeyConfig-specific 10s post-create/post-update (#26236)
• netapp: added large_capacity_config block with constituent_count field to google_netapp_volume resource (#26243)
• netapp: added scale_tier field to netapp_storage_pool resource (#26243)
• networkservices: added support for use of multiple ports for google_network_services_gateway resources of type SECURE_WEB_GATEWAY (#26265)
• sql: added auto_upgrade_enabled field to google_sql_database_instance resource. (#26205)
• sql: added data_api_access field to google_sql_database_instance resource (#26217)
• sql: added enhanced_query_insights_enabled field to google_sql_database_instance resource (#26244)

BUG FIXES:

• datastream: fixed permadiff where google_datastream_connection_profile.salesforce_profile.oauth2_client_credentials.client_id is not read properly from the API (#26201)
• servicenetworking: added retry when creating google_service_networking_connection if it looks like the service account permissions haven't yet propagated (#26220)

v7.21.0

FEATURES:

• New Data Source: google_vmwareengine_announcements (#11577)
• New Data Source: google_vmwareengine_upgrades (#11591)
• New Resource: google_compute_region_backend_bucket (#11576)
• New Resource: google_dataform_team_folder (beta) (#11573)
• New Resource: google_hypercomputecluster_cluster (#11596)
• New Resource: google_network_services_agent_gateway (beta) (#11572)

IMPROVEMENTS:

• beyondcorp: added logging field to google_beyondcorp_security_gateway resource (#11581)
• dataproc: added wait_for_completion field to google_dataproc_job resource (#11593)
• discoveryengine: added disable_analytics field to google_discovery_engine_search_engine resource (#11589)
• dlp: added targets.cloud_storage_target.filter.collection.include_tags block to google_data_loss_prevention_discovery_config resource (#11594)
• iap: added client_id, client_secret, and client_secret_sha256 fields to google_iap_settings resource (#11588)

BUG FIXES:

• cloudrun: fixed perma-diff on http_target.uri_override.query_override in google_cloud_tasks_queue (#11590)
• storage: fixed a bug in google_storage_bucket where force_destroy = true would fail to delete buckets with large number of objects due to missing pagination (#11586)

v7.20.0

FEATURES:

• New Data Source: google_access_context_manager_supported_service (#11561)
• New Data Source: google_access_context_manager_supported_services (#11561)
• New Data Source: google_backup_dr_data_sources (#11551)
• New Data Source: google_storage_bucket_object_contents (#11529)
• New Resource: google_biglake_iceberg_namespace (#11547)
• New Resource: google_cloud_identity_policy (#11536)
• New Resource: google_compute_rollout_plan (#11562)
• New Resource: google_dataform_folder (#11542)
• New Resource: google_network_services_agent_gateway (#11571)
• New Resource: google_oracle_database_exadb_vm_cluster (#11508)
• New Resource: google_vector_search_collection (#11566)

IMPROVEMENTS:

• alloydb: added write-only support for initial_user.password_wo to google_alloydb_cluster (#11546)
• ces: added mcp_toolset field to google_ces_toolset resource (#11513)
• compute: added write-only support for private_key to google_compute_region_ssl_certificate resource (#11544)
• compute: added write-only support for private_key to google_compute_ssl_certificate resource (#11544)
• compute: added enable field to google_compute_packet_mirroring resource (#11537)
• compute: added params field to google_compute_external_vpn_gateway resource (#11558)
• compute: added params field to google_compute_ha_vpn_gateway resource (#11558)
• compute: added params field to google_compute_interconnect_attachment resource (#11518)
• compute: added params field to google_compute_vpn_gateway resource (#11558)
• compute: added params field to google_compute_vpn_tunnel resource (#11558)
• compute: added slice_controller_config field to google_container_cluster resource (#11510)
• container: added additional_ip_ranges_config.status to google_container_cluster resource (#11534)
• dataproc: added instance_flexibility_policy to master_config and worker_config in google_dataproc_cluster resource (#11532)
• developerconnect: added target_projects field to google_developer_connect_insights_config resource (#11545)
• filestore: added replica_action to google_filestore_instance resource (#11553)
• networksecurity: added policy_profile, http_rules.0.to.0.operations.0.mcp to google_network_security_authz_policy (#11559)
• networkservices: added ull_multicast_domain field to google_network_services_multicast_domain resource (#11543)
• networkservices: relaxed load_balancing_scheme validation to support non-Backend Service targets in google_network_services_authz_extension (#11559)
• spanner: added support for user_project_override in google_spanner_database_iam and google_spanner_instance_iam resources (#11527)
• vmwareengine: added datastore_mount_config field to google_vmwareengine_cluster resource (#11554)

BUG FIXES:

• bigquery: fixed permadiff with the collation field in google_bigquery_table.schema when it inherits the value from google_bigquery_dataset.default_collation (#11538)
• bigqueryanalyticshub: fixed update failure for replica_locations in google_bigquery_analytics_hub_listing (beta) (#11523)
• iam: fixed an issue where iam resources not retry on error 409 concurrent policy changes (#11564)
• publicca: fixed mac_key fields not being properly set in google_public_ca_external_account_key (#11567)

v7.19.0

DEPRECATIONS:

• backupdr: google_backupdr_restore_workload.name is deprecated and will be removed in a future major release. The backup is identified by the parameters (location, backup_vault_id, data_source_id, backup_id). (#11490)
• publicca: google_public_ca_external_account_key.b64url_mac_key is deprecated and will be removed in a future major release. Use mac_key instead. (#11482)

IMPROVEMENTS:

• compute: added RDMA_FALCON_POLICY and ULL_POLICY values to policy_type field in google_compute_region_network_firewall_policy, google_compute_region_network_firewall_policy_with_rules (#11489)
• compute: added support for network_interface.network_attachment to google_compute_instance_template (GA) (#11496)
• compute: added support for network_interface.network_attachment to google_compute_region_instance_template (#11496)
• compute: added support for network_interface.vlan to google_compute_instance_template, enabling dynamic NIC (#11496)
• compute: added support for network_interface.vlan to google_compute_instance, enabling dynamic NIC. Creating and deleting from an existing instance is not yet supported. (#11496)
• compute: added support for network_interface.vlan to google_compute_region_instance_template, enabling dynamic NIC (#11496)
• discoveryengine: added knowledge_graph_config field to google_discovery_engine_search_engine resource (#11484)
• firestore: added firestore_data_access_mode, mongodb_compatible_data_acess_mode, and realtime_updates_mode fields to the google_firestore_database resource (#11497)
• firestore: added deletion_policy virtual field to google_firestore_index resource (#11488)
• monitoring: added write-only variants (auth_token_wo + auth_token_wo_version, password_wo + password_wo_version, service_key_wo + service_key_wo_version) for google_monitoring_notification_channel.sensitive_labels (#11487)
• networkconnectivity: added support for update operation on google_network_connectivity_gateway_advertised_route resource (#11481)
• provider: added a configurable poll_interval field to the provider for rare cases where it is being used in latency-sensitive situations. This can be set to a custom duration to change operation polling intervals. The default is unchanged, at 10s. (#11500)
• publicca: added mac_key to google_public_ca_external_account_key (#11482)
• run: added readiness_probe field to google_cloud_run_v2_service resource (#11498)
• vertexai: added support for developer_connect_source to spec.source_code_spec in google_vertex_ai_reasoning_engine (#11502)

BUG FIXES:

• compute: fixed issue where it wasn't possible to set both ssl_certificates and certificate_map in google_compute_target_ssl_proxy (#11503)
• container: fixed an issue when toggling default_compute_class_enabled in google_container_cluster with Autopilot enabled (#11483)
• firebaseailogic: fixed bug in google_firebase_ai_logic_config.generative_language_config.api_key_wo where the value set wouldn't be sent to the API. (#11487)
• publicca: fixed b64url_mac_key sometimes being empty in google_public_ca_external_account_key (#11482)

v7.18.0

BREAKING CHANGES:

• alloydb: removed the incorrect top-level field last_successful_backup_consistency_time from google_backup_dr_backup_plan_association. No value has been present in this output-only field. (#11473)

FEATURES:

• New Resource: google_dataplex_data_asset (#11467)
• New Resource: google_firebase_ai_logic_prompt_template_lock (#11448)
• New Resource: google_logging_saved_query (#11466)

IMPROVEMENTS:

• alloydb: added restore_backupdr_backup_source, restore_backupdr_pitr_source, and backupdr_backup_source in google_alloydb_cluster (#11473)
• alloydb: added rules_config_info.last_successful_backup_consistency_time to google_backup_dr_backup_plan_association (#11473)
• compute: updated target_service field to be mutable in google_compute_service_attachment resource (#11469)
• datafusion: added patch_revision field to google_data_fusion_instance resource (#11468)
• firestore: added skip_wait field to google_firestore_index resource, skipping the wait for index creation (#11476)
• gkeonprem: added skip_validations field to google_gkeonprem_vmware_cluster resource (#11465)
• sql: added database_role field and iam_email field to google_sql_user resource to support managing Cloud SQL users with database roles. (#11471)

BUG FIXES:

• cloudbuild: fixed google_cloudbuild_trigger to allow creation without source configuration for manual triggers (#11470)
• cloudrunv2: fix permadiff on scaling.scaling_mode in google_cloud_run_v2_worker_pool (#11472)
• compute: resolved issues where show_nat_ips and nat_ips in google_compute_service_attachment were causing test failures due to an underlying API problem. These fields are now temporarily non-functional and will be ignored. (#11460)
• container: fixed a bug in google_container_node_pool that prevented creation when blue_green_settings was specified (#11464)
• container: fixed perma-diff in google_container_cluster when setting resource_limits with disabled node autoprovisioning (#11474)

v7.17.0

BREAKING CHANGES:

• networkconnectivity: changed services in google_network_connectivity_multicloud_data_transfer_config from TypeList to TypeSet. The order of or value of interpolations referencing the field may change. (#11393)

FEATURES:

• New Data Source: google_vmwareengine_datastore (#11428)
• New Resource: google_compute_region_composite_health_checks (beta) (#11436)
• New Resource: google_dataplex_data_product (#11427)
• New Resource: google_dialogflow_cx_tool_version (#11421)
• New Resource: google_firebase_ai_logic_config (#11429)
• New Resource: google_firebase_ai_logic_prompt_template (#11439)
• New Resource: google_firebase_ai_logic_prompt_template_lock (#11448)
• New Resource: google_gke_hub_rollout_sequence (beta) (#11423)
• New Resource: google_saas_runtime_unit_operation (#11388)
• New Resource: google_vmwareengine_datastore (#11428)

IMPROVEMENTS:

• backupdr: added support for restore compute instance and disk (#11373)
• bigquery: added source_column_match field to csv_options in google_bigquery_table resource (#11441)
• bigqueryanalyticshub: added replica_locations and effective_replicas fields to google_bigquery_analytics_hub_listing and replica_locations field to google_bigquery_analytics_hub_listing_subscription (beta) (#11443)
• compute: added FIPS_202205 enum to PROFILE field in SSL_POLICY and REGION_SSL_POLICY resources, and added TLS_1_3 enum to MIN_TLS_VERSION field in SSL_POLICY and REGION_SSL_POLICY resources. (#11398)
• compute: added attachments field to google_compute_interconnect_attachment_group.logicalStructure.regions.metros.facilities.zones and deprecated attachment field (#11426)
• compute: added enable_enhanced_ipv4_allocation field to google_compute_public_delegated_prefix resource (#11378)
• compute: added ip_collection field to google_compute_address resource (#11378)
• compute: added mac_address field to google_compute_instance (beta) (#11424)
• compute: added source_instant_snapshot field to google_compute_snapshot resource (#11401)
• compute: added support for "IF_L2_FORWARDING" as a value for the availableFeatures field of the google_compute_interconnect resource (#11384)
• compute: added support for "IF_L2_FORWARDING" as a value for the requestedFeatures field of the google_compute_interconnect resource (#11384)
• compute: added support for "L2_DEDICATED" as a value for the type field of the google_compute_interconnect_attachment resource. (#11384)
• compute: added support for igmp_query field in google_compute_instance, google_compute_instance_template, and related instance resources. (#11385)
• compute: added support for the l2Forwarding field to google_compute_interconnect_attachment (#11384)
• container: added accelerator_network_config field to node_pool resource (#11435)
• container: added managed_opentelemetry_config to google_container_cluster resource (#11438)
• container: added node_drain_config field to google_container_node_pool resources (#11409)
• container: added pod_snapshot_config field to google_container_cluster resource (beta) (#11394)
• datastream: added backfill_all.spanner_excluded_objects and source_config.spanner_source_config fields to google_datastream_stream (#11416)
• datastream: added spanner_profile field to google_datastream_connection_profile (#11416)
• dialogflowcx: added serviceAccountAuthConfig field to google_dialogflow_cx_webhook resource (#11402)
• oracledatabase: added peerAutonomousDatabases, disasterRecoverySupportedLocations, sourceConfig fields to Autonomous database resource. (#11437)
• tags: added allowed_values_regex field to google_tags_tag_key resource (#11442)
• tags: added support for dynamic tag keys in google_tags_tag_binding and google_tags_location_tag_binding resources (#11446)
• vertex_ai: added deployment_spec.psc_interface_config to google_vertex_ai_reasoning_engine (#11391)

BUG FIXES:

• bigquery: fixed permadiff with the collation field in google_bigquery_table.schema (#11389)
• cloudasset: fixed bug in google_cloud_asset_folder_feed where folder_id was always empty (#11415)
• cloudbuild: fixed permadiff on google_cloudbuild_trigger.pubsub_config.service_account_email (#11410)
• compute: fix crash when specifying an empty instance_flexibility_policy block on the google_compute_region_instance_group_manager resource (#11377)
• compute: fixed a permadiff that could occur when using mixed short and long form IPv6 addresses in the source_ranges field of google_compute_firewall (#11440)
• iambeta: fixed a permadiff that could occur in the jwks_json field for google_iam_workload_identity_pool_provider resource (#11430)
• netapp: fixed export_policy update bug with squash_mode in netapp volume (#11397)
• networkconnectivity: fixed a diff on services in google_network_connectivity_multicloud_data_transfer_config reordering elements (#11393)
• sql: fixed an issue where transient server errors caused false failures for SQL operations that eventually completed successfully (#11381)
• workbench: made enable-jupyterlab4 metadata key settable for google_workbench_instance (#11395)

v7.16.0

• cloudrunv2: deprecated custom_audience field in the google_cloud_run_v2_worker_pool resource, as this field is not applicable to the WorkerPools resource (#11348)

FEATURES:

• New Data Source: google_compute_routers (#11367)
• New Resource: google_backup_dr_restore_workload (#11373)

IMPROVEMENTS:

• backupdr: added max_custom_on_demand_retention_days field to google_backup_dr_backup_plan resource (#11359)
• bigquery: added support for merge and update operations for dataPolicies in schema field in google_bigquery_table resource when ignore_schema_changes is defined (#11371)
• bigtable: added etag field to google_bigtable_schema_bundle resource (#11346)
• compute: added BPS_400G enum value to bandwidth field in google_compute_interconnect_attachment resource (#11366)
• container: added registry_hosts field to containerd_config in google_container_cluster and google_container_node_pool resources (#11360)
• dataplex: added one_time field to google_dataplex_datascan resource (#11351)
• datastream: added postgresql_profile.ssl_config to google_datastream_connection_profile resource (#11344)
• networkservices: added EXT_AUTHZ_GRPC enum value to wire_format field in google_network_services_authz_extension resource (#11361)
• networkservices: added disable_placement_policy field to google_network_services_multicast_domain_activation resource (#11370)
• networkservices: added metadata, supported_events, request_body_send_mode, and observability_mode fields to google_network_services_lb_route_extension resource (#11356)
• securitycenterv2: added support for supplying location values other than "GLOBAL" to google_scc_v2_project_notification_config resource (#11354)
• storageinsights: added activity_data_retention_period_days field to google_storage_insights_dataset_config resource (#11357)
• workbench: added support to set post-startup script metadata keys with managed EUC in google_workbench_instance resource (#11369)

v7.15.0

NOTES:

• lustre: increased delete and update operation timeouts from 20 minutes to 60 minutes for google_lustre_instance resource (#11339)

BREAKING CHANGES:

• compute: changed cipher_suite fields in the google_compute_vpn_tunnel resource to track order (#11334)

FEATURES:

• New Resource: google_apigee_security_feedback (#11299)
• New Resource: google_apphub_boundary (#11324)
• New Resource: google_biglake_iceberg_catalog_iam_binding (#11322)
• New Resource: google_biglake_iceberg_catalog_iam_member (#11322)
• New Resource: google_biglake_iceberg_catalog_iam_policy (#11322)
• New Resource: google_biglake_iceberg_catalog (#11273)
• New Resource: google_network_connectivity_destination (#11340)
• New Resource: google_network_connectivity_multicloud_data_transfer_config (#11307)

IMPROVEMENTS:

• backupdr: added ignore_read to encryption_config field in google_backup_dr_backup_vault resource (#11345)
• biglakeiceberg: made google_biglake_iceberg_catalog use the resource project as the quota project when user_project_override is true (#11322)
• cloudrunv2: added source_code field to template.container in google_cloud_run_v2_service resource (#11336)
• composer: added new enum ENVIRONMENT_SIZE_EXTRA_LARGE to environment_size field to google_composer_environment resource (#11276)
• compute: added guest_flush field to google_compute_snapshot resource (#11281)
• compute: added prefix_length field to google_compute_addresses data source (#11331)
• iamworkforcepool: added hard_delete support in google_iam_workforce_pool_provider_scim_tenant resource (#11333)
• looker: added periodic_export_config field to google_looker_instance resource (#11308)
• lustre: added access_rules_options field to google_lustre_instance resource to support root squashing and IP-based access control configuration (#11311)
• managedkafka: replaced disk_size_gb with disk_size_gib in broker_capacity_config within the google_managed_kafka_cluster resource (#11310)
• networkservices: added state field to google_network_services_multicast_domain resource (#11277)
• redis: added support for labels to google_redis_cluster (#11323)
• sql: marked replication_cluster.psa_write_endpoint field as Computed in google_sql_database_instance resource (#11289)
• sql: set replication_cluster when update google_sql_database_instance resource if there is a disaster recovery(DR) replica set or there is a PSA write endpoint (#11289)
• storage: updated datasource google_storage_object_signed_url.signed_url to use virtual style hosted url (#11284)
• vertexai: added bigtable, zone, encryption_spec, and bigtable_options fields to google_vertex_ai_feature_online_store resource (#11304)
• vertexai: added psc_automation_configs field to google_vertex_ai_index_endpoint resource (#11286)

BUG FIXES:

• provider: fixed an issue where error type 409 and 412 were not being correctly retried. This commonly shows up in IAM resources, but can appear in other resources as well (#11302)
• alloydb: fixed an issue where boolean fields were ignored when set to false for google_alloydb_cluster and google_alloydb_instance (#11278)
• cloudrunv2: fixed a permadiff when default values of the scaling block were explicitly declared on the google_cloud_run_v2_service resource (#11285)
• compute: fixed a crash in google_compute_disk/google_compute_region_disk when deleting a disk attached to an instance that had any scratch disks attached (#11325)
• compute: fixed issue where endpoints.interconnects.vlan_tags wouldn't be read correctly from the API in google_compute_wire_group resource (#11305)
• compute: fixed update logic that causes empty instance being sent for google_compute_network_endpoints (#11314)
• datacatalog: fixed issue where fields.display_name wouldn't be read correctly from the API in google_data_catalog_tag resource (#11305)
• discoveryengine: marked cmek_config_id field in google_discovery_engine_cmek_config resource as required (#11272)
• securitygateway: allowed empty field for service_discovery in google_beyondcorp_security_gateway (#11330)
• securitygateway: allowed empty fields for user_info, group_info and device_info in google_beyondcorp_security_gateway_application (#11330)
• servicedirectory: fixed an issue where google_service_directory_endpoint or google_service_directory_service without metadata specified would have other fields removed (#11297)
• storage: fixed the behavior in google_storage_bucket resource when force_destroy is set to true. Previously, failing to list anywhere caches would prevent destroying objects on the bucket. Now, both objects and caches are processed independently. (#11332)

v7.14.1

BUG FIXES:

• provider: fixed an issue where error type 409 and 412 were not being correctly retried. This commonly shows up in IAM resources, but can appear in other resources as well (#11302)
• servicedirectory: fixed an issue where google_service_directory_endpoint or google_service_directory_service without metadata specified would have other fields removed on update (#11297)