diff --git a/.ci/README.md b/.ci/README.md
index 2c0c8b56d144..e156ca5be35e 100644
--- a/.ci/README.md
+++ b/.ci/README.md
@@ -82,6 +82,13 @@ done
 
 In the event of a failure, this will stop running.  If it succeeds, update the sync tag with `git push origin HEAD:tpg-sync`.
 
+### Downstream build job is not triggered by commits.
+This is rare but we've seen this happened before. In this case, we need to manually trigger a Cloud Build job by running 
+```
+gcloud builds triggers run build-downstreams --project=graphite-docker-images --substitutions=BRANCH_NAME=<BASE_BRANCH_NAME> --sha=<COMMIT_SHA>
+```
+You'll need to substitute `<COMMIT_SHA>` with the commit sha that you'd like to trigger the build against and `<BASE_BRANCH_NAME>` with base branch that this commit is pushed into, likely `main` but could be feature branches in some cases.
+
 ## Deploying the pipeline
 The code on the PR's branch is used to plan actions - no merge is performed.
 If you are making changes to the workflows, your changes will not trigger a workflow run, because of the risk of an untrusted contributor introducing malicious code in this way.  You will need to test locally by using the [cloud build local builder](https://cloud.google.com/cloud-build/docs/build-debug-locally).
@@ -89,7 +96,6 @@ If you are making changes to the containers, your changes will not apply until t
 
 Pausing the pipeline is done in the cloud console, by setting the downstream-builder trigger to disabled.  You can find that trigger [here](https://console.cloud.google.com/cloud-build/triggers/edit/f80a7496-b2f4-4980-a706-c5425a52045b?project=graphite-docker-images)
 
-
 ## Dependency change handbook:
 If someone (often a bot) creates a PR which updates Gemfile or Gemfile.lock, they will not be able to generate diffs.  This is because bundler doesn't allow you to run a binary unless your installed gems exactly match the Gemfile.lock, and since we have to run generation before and after the change, there is no possible container that will satisfy all requirements.
 
diff --git a/.ci/containers/go-plus/Dockerfile b/.ci/containers/go-plus/Dockerfile
index 6a6d48d9038f..c7b8641eb297 100644
--- a/.ci/containers/go-plus/Dockerfile
+++ b/.ci/containers/go-plus/Dockerfile
@@ -1,5 +1,25 @@
-from golang:1.19-bullseye as resource
+# Stage 1: Download go module cache for builds
+FROM golang:1.19-bullseye AS builder
+ENV GOCACHE=/go/cache
+
+RUN apt-get update && apt-get install -y unzip
+WORKDIR /app1
+# Add the source code and build
+ADD "https://github.com/GoogleCloudPlatform/magic-modules/archive/refs/heads/main.zip" source.zip
+RUN unzip source.zip && rm source.zip
+WORKDIR /app1/magic-modules-main/.ci/magician
+# Build the binary (we won't use it in the final image, but it's cached)
+RUN go build -o /dev/null .
+
+# Stage 2: Creating the final image
+FROM golang:1.19-bullseye
 SHELL ["/bin/bash", "-c"]
+ENV GOCACHE=/go/cache
+
+# Copy Go dependencies and Go build cache
+COPY --from=builder /go/pkg/mod /go/pkg/mod
+COPY --from=builder /go/cache /go/cache
+
 # Set up Github SSH cloning.
 RUN ssh-keyscan github.com >> /known_hosts
 RUN echo "UserKnownHostsFile /known_hosts" >> /etc/ssh/ssh_config
diff --git a/.ci/containers/membership-checker/Dockerfile b/.ci/containers/membership-checker/Dockerfile
deleted file mode 100644
index 81f0e6b35dab..000000000000
--- a/.ci/containers/membership-checker/Dockerfile
+++ /dev/null
@@ -1,8 +0,0 @@
-FROM golang:1.20
-
-WORKDIR /src
-COPY . ./
-
-RUN go build
-
-ENTRYPOINT [ "/src/membership-checker" ]
\ No newline at end of file
diff --git a/.ci/containers/membership-checker/community.go b/.ci/containers/membership-checker/community.go
deleted file mode 100644
index 18062d370018..000000000000
--- a/.ci/containers/membership-checker/community.go
+++ /dev/null
@@ -1,152 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"os"
-
-	"google.golang.org/api/cloudbuild/v1"
-)
-
-func approveCommunityChecker(prNumber, projectId, commitSha string) error {
-	buildId, err := getPendingBuildId(projectId, commitSha)
-	if err != nil {
-		return err
-	}
-
-	if buildId == "" {
-		return fmt.Errorf("Failed to find pending build for PR %s", prNumber)
-	}
-
-	err = approveBuild(projectId, buildId)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func postAwaitingApprovalBuildLink(prNumber, GITHUB_TOKEN, projectId, commitSha string) error {
-	buildId, err := getPendingBuildId(projectId, commitSha)
-	if err != nil {
-		return err
-	}
-
-	if buildId == "" {
-		return fmt.Errorf("Failed to find pending build for PR %s", prNumber)
-	}
-
-	targetUrl := fmt.Sprintf("https://console.cloud.google.com/cloud-build/builds;region=global/%s?project=%s", buildId, projectId)
-
-	postBody := map[string]string{
-		"context":    "Approve Build",
-		"state":      "success",
-		"target_url": targetUrl,
-	}
-
-	err = postBuildStatus(prNumber, GITHUB_TOKEN, commitSha, postBody)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func postBuildStatus(prNumber, GITHUB_TOKEN, commitSha string, body map[string]string) error {
-
-	url := fmt.Sprintf("https://api.github.com/repos/GoogleCloudPlatform/magic-modules/statuses/%s", commitSha)
-
-	_, err := requestCall(url, "POST", GITHUB_TOKEN, nil, body)
-	if err != nil {
-		return err
-	}
-
-	fmt.Printf("Successfully posted community-checker build link to pull request %s\n", prNumber)
-
-	return nil
-}
-
-func getPendingBuildId(projectId, commitSha string) (string, error) {
-	COMMUNITY_CHECKER_TRIGGER, ok := os.LookupEnv("COMMUNITY_CHECKER_TRIGGER")
-	if !ok {
-		return "", fmt.Errorf("Did not provide COMMUNITY_CHECKER_TRIGGER environment variable")
-	}
-
-	ctx := context.Background()
-
-	c, err := cloudbuild.NewService(ctx)
-	if err != nil {
-		return "", err
-	}
-
-	filter := fmt.Sprintf("trigger_id=%s AND status=PENDING", COMMUNITY_CHECKER_TRIGGER)
-	// Builds will be sorted by createTime, descending order.
-	// 50 should be enough to include the one needs auto approval
-	pageSize := int64(50)
-
-	builds, err := c.Projects.Builds.List(projectId).Filter(filter).PageSize(pageSize).Do()
-	if err != nil {
-		return "", err
-	}
-
-	for _, build := range builds.Builds {
-		if build.Substitutions["COMMIT_SHA"] == commitSha {
-			return build.Id, nil
-		}
-	}
-
-	return "", nil
-}
-
-func approveBuild(projectId, buildId string) error {
-	ctx := context.Background()
-
-	c, err := cloudbuild.NewService(ctx)
-	if err != nil {
-		return err
-	}
-
-	name := fmt.Sprintf("projects/%s/builds/%s", projectId, buildId)
-
-	approveBuildRequest := &cloudbuild.ApproveBuildRequest{
-		ApprovalResult: &cloudbuild.ApprovalResult{
-			Decision: "APPROVED",
-		},
-	}
-
-	_, err = c.Projects.Builds.Approve(name, approveBuildRequest).Do()
-	if err != nil {
-		return err
-	}
-
-	fmt.Println("Auto approved build ", buildId)
-
-	return nil
-}
-
-func addAwaitingApprovalLabel(prNumber, GITHUB_TOKEN string) error {
-	url := fmt.Sprintf("https://api.github.com/repos/GoogleCloudPlatform/magic-modules/issues/%s/labels", prNumber)
-
-	body := map[string][]string{
-		"labels": []string{"awaiting-approval"},
-	}
-	_, err := requestCall(url, "POST", GITHUB_TOKEN, nil, body)
-
-	if err != nil {
-		return fmt.Errorf("Failed to add awaiting approval label: %s", err)
-	}
-
-	return nil
-
-}
-
-func removeAwaitingApprovalLabel(prNumber, GITHUB_TOKEN string) error {
-	url := fmt.Sprintf("https://api.github.com/repos/GoogleCloudPlatform/magic-modules/issues/%s/labels/awaiting-approval", prNumber)
-	_, err := requestCall(url, "DELETE", GITHUB_TOKEN, nil, nil)
-
-	if err != nil {
-		return fmt.Errorf("Failed to remove awaiting approval label: %s", err)
-	}
-
-	return nil
-}
diff --git a/.ci/containers/membership-checker/main.go b/.ci/containers/membership-checker/main.go
deleted file mode 100644
index d9a1d2bb0dbd..000000000000
--- a/.ci/containers/membership-checker/main.go
+++ /dev/null
@@ -1,131 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"os"
-)
-
-func main() {
-	GITHUB_TOKEN, ok := os.LookupEnv("GITHUB_TOKEN")
-	if !ok {
-		fmt.Println("Did not provide GITHUB_TOKEN environment variable")
-		os.Exit(1)
-	}
-	if len(os.Args) <= 7 {
-		fmt.Println("Not enough arguments")
-		os.Exit(1)
-	}
-
-	projectId := "graphite-docker-images"
-	repoName := "magic-modules"
-
-	target := os.Args[1]
-	fmt.Println("Trigger Target: ", target)
-
-	prNumber := os.Args[2]
-	fmt.Println("PR Number: ", prNumber)
-
-	commitSha := os.Args[3]
-	fmt.Println("Commit SHA: ", commitSha)
-
-	branchName := os.Args[4]
-	fmt.Println("Branch Name: ", branchName)
-
-	headRepoUrl := os.Args[5]
-	fmt.Println("Head Repo URL: ", headRepoUrl)
-
-	headBranch := os.Args[6]
-	fmt.Println("Head Branch: ", headBranch)
-
-	baseBranch := os.Args[7]
-	fmt.Println("Base Branch: ", baseBranch)
-
-	substitutions := map[string]string{
-		"BRANCH_NAME":    branchName,
-		"_PR_NUMBER":     prNumber,
-		"_HEAD_REPO_URL": headRepoUrl,
-		"_HEAD_BRANCH":   headBranch,
-		"_BASE_BRANCH":   baseBranch,
-	}
-
-	author, err := getPullRequestAuthor(prNumber, GITHUB_TOKEN)
-	if err != nil {
-		fmt.Println(err)
-		os.Exit(1)
-	}
-
-	authorUserType := getUserType(author, GITHUB_TOKEN)
-	trusted := authorUserType == coreContributorUserType || authorUserType == googlerUserType
-
-	if target == "auto_run" && authorUserType != coreContributorUserType {
-		fmt.Println("Not core contributor - assigning reviewer")
-
-		firstRequestedReviewer, err := getPullRequestRequestedReviewer(prNumber, GITHUB_TOKEN)
-		if err != nil {
-			fmt.Println(err)
-			os.Exit(1)
-		}
-
-		previouslyInvolvedReviewers, err := getPullRequestPreviousAssignedReviewers(prNumber, GITHUB_TOKEN)
-		if err != nil {
-			fmt.Println(err)
-			os.Exit(1)
-		}
-
-		reviewersToRequest, newPrimaryReviewer := chooseReviewers(firstRequestedReviewer, previouslyInvolvedReviewers)
-
-		for _, reviewer := range reviewersToRequest {
-			err = requestPullRequestReviewer(prNumber, reviewer, GITHUB_TOKEN)
-			if err != nil {
-				fmt.Println(err)
-				os.Exit(1)
-			}
-		}
-
-		if newPrimaryReviewer != "" {
-			comment := formatReviewerComment(newPrimaryReviewer, authorUserType, trusted)
-			err = postComment(prNumber, comment, GITHUB_TOKEN, authorUserType)
-			if err != nil {
-				fmt.Println(err)
-				os.Exit(1)
-			}
-		}
-	}
-
-	// auto_run(contributor-membership-checker) will be run on every commit or /gcbrun:
-	// only triggers builds for trusted users
-
-	// needs_approval(community-checker) will be run after approval:
-	// 1. will be auto approved (by contributor-membership-checker) for trusted users
-	// 2. needs approval from team reviewer via cloud build for untrusted users
-	// 3. only triggers build for untrusted users (because trusted users will be handled by auto_run)
-	if (target == "auto_run" && trusted) || (target == "needs_approval" && !trusted) {
-		err = triggerMMPresubmitRuns(projectId, repoName, commitSha, substitutions)
-		if err != nil {
-			fmt.Println(err)
-			os.Exit(1)
-		}
-	}
-
-	// in contributor-membership-checker job:
-	// 1. auto approve community-checker run for trusted users
-	// 2. add awaiting-approval label to external contributor PRs
-	if target == "auto_run" {
-		if trusted {
-			err = approveCommunityChecker(prNumber, projectId, commitSha)
-			if err != nil {
-				fmt.Println(err)
-				os.Exit(1)
-			}
-		} else {
-			addAwaitingApprovalLabel(prNumber, GITHUB_TOKEN)
-			postAwaitingApprovalBuildLink(prNumber, GITHUB_TOKEN, projectId, commitSha)
-		}
-	}
-
-	// in community-checker job:
-	// remove awaiting-approval label from external contributor PRs
-	if target == "needs_approval" {
-		removeAwaitingApprovalLabel(prNumber, GITHUB_TOKEN)
-	}
-}
diff --git a/.ci/containers/membership-checker/reviewer_assignment.go b/.ci/containers/membership-checker/reviewer_assignment.go
deleted file mode 100644
index 4dca8ff47e22..000000000000
--- a/.ci/containers/membership-checker/reviewer_assignment.go
+++ /dev/null
@@ -1,163 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"net/http"
-	"strings"
-	"text/template"
-
-	_ "embed"
-)
-
-var (
-	//go:embed REVIEWER_ASSIGNMENT_COMMENT.md
-	reviewerAssignmentComment string
-)
-
-// Returns a list of users to request review from, as well as a new primary reviewer if this is the first run.
-func chooseReviewers(firstRequestedReviewer string, previouslyInvolvedReviewers []string) (reviewersToRequest []string, newPrimaryReviewer string) {
-	hasPrimaryReviewer := false
-	newPrimaryReviewer = ""
-
-	if firstRequestedReviewer != "" {
-		hasPrimaryReviewer = true
-	}
-
-	if previouslyInvolvedReviewers != nil {
-		for _, reviewer := range previouslyInvolvedReviewers {
-			if isTeamReviewer(reviewer) {
-				hasPrimaryReviewer = true
-				reviewersToRequest = append(reviewersToRequest, reviewer)
-			}
-		}
-	}
-
-	if !hasPrimaryReviewer {
-		newPrimaryReviewer = getRandomReviewer()
-		reviewersToRequest = append(reviewersToRequest, newPrimaryReviewer)
-	}
-
-	return reviewersToRequest, newPrimaryReviewer
-}
-
-func getPullRequestAuthor(prNumber, GITHUB_TOKEN string) (string, error) {
-	url := fmt.Sprintf("https://api.github.com/repos/GoogleCloudPlatform/magic-modules/issues/%s", prNumber)
-
-	var pullRequest struct {
-		User struct {
-			Login string `json:"login"`
-		} `json:"user"`
-	}
-
-	_, err := requestCall(url, "GET", GITHUB_TOKEN, &pullRequest, nil)
-	if err != nil {
-		return "", err
-	}
-
-	return pullRequest.User.Login, nil
-}
-
-func getPullRequestRequestedReviewer(prNumber, GITHUB_TOKEN string) (string, error) {
-	url := fmt.Sprintf("https://api.github.com/repos/GoogleCloudPlatform/magic-modules/pulls/%s/requested_reviewers", prNumber)
-
-	var requestedReviewers struct {
-		Users []struct {
-			Login string `json:"login"`
-		} `json:"users"`
-	}
-
-	_, err := requestCall(url, "GET", GITHUB_TOKEN, &requestedReviewers, nil)
-	if err != nil {
-		return "", err
-	}
-
-	if requestedReviewers.Users == nil || len(requestedReviewers.Users) == 0 {
-		return "", nil
-	}
-
-	return requestedReviewers.Users[0].Login, nil
-}
-
-func getPullRequestPreviousAssignedReviewers(prNumber, GITHUB_TOKEN string) ([]string, error) {
-	url := fmt.Sprintf("https://api.github.com/repos/GoogleCloudPlatform/magic-modules/pulls/%s/reviews", prNumber)
-
-	var reviews []struct {
-		User struct {
-			Login string `json:"login"`
-		} `json:"user"`
-	}
-
-	_, err := requestCall(url, "GET", GITHUB_TOKEN, &reviews, nil)
-	if err != nil {
-		return nil, err
-	}
-
-	previousAssignedReviewers := map[string]struct{}{}
-	for _, review := range reviews {
-		previousAssignedReviewers[review.User.Login] = struct{}{}
-	}
-
-	result := []string{}
-	for key, _ := range previousAssignedReviewers {
-		result = append(result, key)
-	}
-
-	return result, nil
-}
-
-func requestPullRequestReviewer(prNumber, assignee, GITHUB_TOKEN string) error {
-	url := fmt.Sprintf("https://api.github.com/repos/GoogleCloudPlatform/magic-modules/pulls/%s/requested_reviewers", prNumber)
-
-	body := map[string][]string{
-		"reviewers":      []string{assignee},
-		"team_reviewers": []string{},
-	}
-
-	reqStatusCode, err := requestCall(url, "POST", GITHUB_TOKEN, nil, body)
-	if err != nil {
-		return err
-	}
-
-	if reqStatusCode != http.StatusCreated {
-		return fmt.Errorf("Error adding reviewer for PR %s", prNumber)
-	}
-
-	fmt.Printf("Successfully added reviewer %s to pull request %s\n", assignee, prNumber)
-
-	return nil
-}
-
-func formatReviewerComment(newPrimaryReviewer string, authorUserType userType, trusted bool) string {
-	tmpl, err := template.New("REVIEWER_ASSIGNMENT_COMMENT.md").Parse(reviewerAssignmentComment)
-	if err != nil {
-		panic(fmt.Sprintf("Unable to parse REVIEWER_ASSIGNMENT_COMMENT.md: %s", err))
-	}
-	sb := new(strings.Builder)
-	tmpl.Execute(sb, map[string]interface{}{
-		"reviewer":       newPrimaryReviewer,
-		"authorUserType": authorUserType.String(),
-		"trusted":        trusted,
-	})
-	return sb.String()
-}
-
-func postComment(prNumber, comment, GITHUB_TOKEN string, authorUserType userType) error {
-	url := fmt.Sprintf("https://api.github.com/repos/GoogleCloudPlatform/magic-modules/issues/%s/comments", prNumber)
-
-	body := map[string]string{
-		"body": comment,
-	}
-
-	reqStatusCode, err := requestCall(url, "POST", GITHUB_TOKEN, nil, body)
-	if err != nil {
-		return err
-	}
-
-	if reqStatusCode != http.StatusCreated {
-		return fmt.Errorf("Error posting comment for PR %s", prNumber)
-	}
-
-	fmt.Printf("Successfully posted comment to pull request %s\n", prNumber)
-
-	return nil
-}
diff --git a/.ci/containers/membership-checker/utils.go b/.ci/containers/membership-checker/utils.go
deleted file mode 100644
index b08a7572691e..000000000000
--- a/.ci/containers/membership-checker/utils.go
+++ /dev/null
@@ -1,48 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"net/http"
-
-	"golang.org/x/exp/slices"
-)
-
-func requestCall(url, method, credentials string, result interface{}, body interface{}) (int, error) {
-	client := &http.Client{}
-	jsonBody, err := json.Marshal(body)
-	if err != nil {
-		return 1, fmt.Errorf("Error marshaling JSON: %s", err)
-	}
-	req, err := http.NewRequest(method, url, bytes.NewBuffer(jsonBody))
-	if err != nil {
-		return 2, fmt.Errorf("Error creating request: %s", err)
-	}
-	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", credentials))
-	req.Header.Set("Content-Type", "application/json")
-	resp, err := client.Do(req)
-	if err != nil {
-		return 3, err
-	}
-	defer resp.Body.Close()
-
-	if result != nil {
-		if err = json.NewDecoder(resp.Body).Decode(&result); err != nil {
-			return 4, err
-		}
-	}
-
-	return resp.StatusCode, nil
-}
-
-func removes(s1 []string, s2 []string) []string {
-	result := make([]string, 0, len(s1))
-
-	for _, v := range s1 {
-		if !slices.Contains(s2, v) {
-			result = append(result, v)
-		}
-	}
-	return result
-}
diff --git a/.ci/gcb-changelog-checker.yml b/.ci/gcb-changelog-checker.yml
deleted file mode 100644
index aa2c5289675f..000000000000
--- a/.ci/gcb-changelog-checker.yml
+++ /dev/null
@@ -1,10 +0,0 @@
----
-steps:
-  - name: 'gcr.io/graphite-docker-images/bash-plus'
-    entrypoint: 'bash'
-    args:
-      - -c
-      - echo "This build step has been moved to a github action."
-
-
-# noop - moved to pull_request event on https://github.com/GoogleCloudPlatform/magic-modules/pull/8727.
diff --git a/.ci/gcb-community-checker.yml b/.ci/gcb-community-checker.yml
index eaf3d6456b36..9aba1d2d9478 100644
--- a/.ci/gcb-community-checker.yml
+++ b/.ci/gcb-community-checker.yml
@@ -1,17 +1,66 @@
 ---
 steps:
-    - name: 'gcr.io/graphite-docker-images/membership-checker'
-      id: community-checker
-      secretEnv: ["GITHUB_TOKEN", "GENERATE_DIFFS_TRIGGER", "RAKE_TESTS_TRIGGER"]
-      timeout: 8000s
-      args:
-          - "needs_approval"
-          - $_PR_NUMBER
-          - $COMMIT_SHA
-          - $BRANCH_NAME
-          - $_HEAD_REPO_URL
-          - $_HEAD_BRANCH
-          - $_BASE_BRANCH
+  # The GCB / GH integration uses a shallow clone of the repo. We need to convert
+  # that to a full clone in order to work with it properly.
+  # https://cloud.google.com/source-repositories/docs/integrating-with-cloud-build#unshallowing_clones
+  - name: "gcr.io/cloud-builders/git"
+    args:
+      - fetch
+      - --unshallow
+
+  # Configure git
+  - name: "gcr.io/cloud-builders/git"
+    args:
+      - config
+      - --global
+      - user.email
+      - magic-modules+differ@google.com
+  - name: "gcr.io/cloud-builders/git"
+    args:
+      - config
+      - --global
+      - user.name
+      - "Modular Magician Diff Process"
+
+  # Display commit log for clarity
+  - name: "gcr.io/cloud-builders/git"
+    args:
+      - log
+      - "--oneline"
+      - "-n 10"
+
+  # Find common ancestor commit and apply diff for the .ci folder.
+  - name: "gcr.io/cloud-builders/git"
+    id: findMergeBase
+    entrypoint: "bash"
+    args:
+      - "-c"
+      - |
+        git fetch origin main
+        if [ "$_BASE_BRANCH" != "main" ]; then
+          echo "Checking out .ci/ folder from main"
+          git checkout origin/main -- .ci/
+        else
+          base_commit=$(git merge-base origin/main HEAD)
+          echo "Common ancestor commit: $base_commit"
+          git diff $base_commit origin/main -- .ci/
+          git diff $base_commit origin/main -- .ci/ > /workspace/ci.diff
+          git apply ./ci.diff --allow-empty
+        fi
+
+  - name: 'gcr.io/graphite-docker-images/go-plus'
+    entrypoint: '/workspace/.ci/scripts/go-plus/magician/exec.sh'
+    id: community-checker
+    secretEnv: ["GITHUB_TOKEN", "GENERATE_DIFFS_TRIGGER"]
+    timeout: 8000s
+    args:
+        - "community-checker"
+        - $_PR_NUMBER
+        - $COMMIT_SHA
+        - $BRANCH_NAME
+        - $_HEAD_REPO_URL
+        - $_HEAD_BRANCH
+        - $_BASE_BRANCH
 
 availableSecrets:
   secretManager:
@@ -19,5 +68,3 @@ availableSecrets:
       env: GITHUB_TOKEN
     - versionName: projects/673497134629/secrets/ci-trigger-generate-diffs/versions/latest
       env: GENERATE_DIFFS_TRIGGER
-    - versionName: projects/673497134629/secrets/ci-trigger-rake-test/versions/latest
-      env: RAKE_TESTS_TRIGGER
diff --git a/.ci/gcb-contributor-membership-checker.yml b/.ci/gcb-contributor-membership-checker.yml
index a8ce69bb3371..713918f91e35 100644
--- a/.ci/gcb-contributor-membership-checker.yml
+++ b/.ci/gcb-contributor-membership-checker.yml
@@ -1,17 +1,67 @@
 ---
 steps:
-    - name: 'gcr.io/graphite-docker-images/membership-checker'
-      id: contributor-membership-checker
-      secretEnv: ["GITHUB_TOKEN", "GENERATE_DIFFS_TRIGGER", "RAKE_TESTS_TRIGGER", "COMMUNITY_CHECKER_TRIGGER"]
-      timeout: 8000s
-      args:
-          - "auto_run"
-          - $_PR_NUMBER
-          - $COMMIT_SHA
-          - $BRANCH_NAME
-          - $_HEAD_REPO_URL
-          - $_HEAD_BRANCH
-          - $_BASE_BRANCH
+  # The GCB / GH integration uses a shallow clone of the repo. We need to convert
+  # that to a full clone in order to work with it properly.
+  # https://cloud.google.com/source-repositories/docs/integrating-with-cloud-build#unshallowing_clones
+  - name: "gcr.io/cloud-builders/git"
+    args:
+      - fetch
+      - --unshallow
+
+  # Configure git
+  - name: "gcr.io/cloud-builders/git"
+    args:
+      - config
+      - --global
+      - user.email
+      - magic-modules+differ@google.com
+  - name: "gcr.io/cloud-builders/git"
+    args:
+      - config
+      - --global
+      - user.name
+      - "Modular Magician Diff Process"
+
+  # Display commit log for clarity
+  - name: "gcr.io/cloud-builders/git"
+    args:
+      - log
+      - "--oneline"
+      - "-n 10"
+
+  # Find common ancestor commit and apply diff for the .ci folder.
+  - name: "gcr.io/cloud-builders/git"
+    id: findMergeBase
+    entrypoint: "bash"
+    args:
+      - "-c"
+      - |
+        git fetch origin main
+        if [ "$_BASE_BRANCH" != "main" ]; then
+          echo "Checking out .ci/ folder from main"
+          git checkout origin/main -- .ci/
+        else
+          base_commit=$(git merge-base origin/main HEAD)
+          echo "Common ancestor commit: $base_commit"
+          git diff $base_commit origin/main -- .ci/
+          git diff $base_commit origin/main -- .ci/ > /workspace/ci.diff
+          git apply ./ci.diff --allow-empty
+        fi
+
+  - name: "gcr.io/graphite-docker-images/go-plus"
+    entrypoint: "/workspace/.ci/scripts/go-plus/magician/exec.sh"
+    id: contributor-membership-checker
+    secretEnv:
+      ["GITHUB_TOKEN", "GENERATE_DIFFS_TRIGGER", "COMMUNITY_CHECKER_TRIGGER"]
+    timeout: 8000s
+    args:
+      - "membership-checker"
+      - $_PR_NUMBER
+      - $COMMIT_SHA
+      - $BRANCH_NAME
+      - $_HEAD_REPO_URL
+      - $_HEAD_BRANCH
+      - $_BASE_BRANCH
 
 availableSecrets:
   secretManager:
@@ -19,7 +69,5 @@ availableSecrets:
       env: GITHUB_TOKEN
     - versionName: projects/673497134629/secrets/ci-trigger-generate-diffs/versions/latest
       env: GENERATE_DIFFS_TRIGGER
-    - versionName: projects/673497134629/secrets/ci-trigger-rake-test/versions/latest
-      env: RAKE_TESTS_TRIGGER
     - versionName: projects/673497134629/secrets/ci-trigger-community-checker/versions/latest
       env: COMMUNITY_CHECKER_TRIGGER
diff --git a/.ci/gcb-generate-diffs-new.yml b/.ci/gcb-generate-diffs-new.yml
index 1a69cfd12b6e..5beac1aa4a95 100644
--- a/.ci/gcb-generate-diffs-new.yml
+++ b/.ci/gcb-generate-diffs-new.yml
@@ -182,23 +182,16 @@ steps:
           - $_PR_NUMBER
 
     - name: 'gcr.io/graphite-docker-images/go-plus'
-      entrypoint: '/workspace/.ci/scripts/go-plus/tgc-tester/test_tgc.sh'
       id: tgc-test
       allowFailure: true
+      entrypoint: '/workspace/.ci/scripts/go-plus/magician/exec.sh'
       secretEnv: ["GITHUB_TOKEN"]
       waitFor: ["tpgb-head", "tpgb-base", "tgc-head", "tgc-base"]
-      env:
-        - TEST_PROJECT=$_VALIDATOR_TEST_PROJECT
-        - TEST_FOLDER_ID=$_VALIDATOR_TEST_FOLDER
-        - TEST_ANCESTRY=$_VALIDATOR_TEST_ANCESTRY
-        - TEST_ORG_ID=$_VALIDATOR_TEST_ORG
       args:
-          - $_PR_NUMBER
-          - $COMMIT_SHA
-          - $BUILD_ID
-          - $PROJECT_ID
-          - "17"  # Build step
-          - terraform-google-conversion
+        - 'test-tgc'
+      env:
+        - COMMIT_SHA=$COMMIT_SHA
+        - PR_NUMBER=$_PR_NUMBER
 
     - name: 'gcr.io/graphite-docker-images/go-plus'
       id: tgc-test-integration-0.12.31
@@ -240,29 +233,27 @@ steps:
           - "19"  # Build step
           - terraform-google-conversion
 
-    - name: 'gcr.io/graphite-docker-images/bash-plus'
+    - name: 'gcr.io/graphite-docker-images/go-plus'
       id: tpgb-test
-      entrypoint: '/workspace/.ci/scripts/bash-plus/terraform-tester/test_terraform.sh'
+      allowFailure: true
+      entrypoint: '/workspace/.ci/scripts/go-plus/magician/exec.sh'
       secretEnv: ["GITHUB_TOKEN"]
       waitFor: ["tpgb-head", "tpgb-base"]
+      args:
+        - 'test-tpg'
       env:
         - VERSION=beta
         - COMMIT_SHA=$COMMIT_SHA
         - PR_NUMBER=$_PR_NUMBER
 
-    - name: 'gcr.io/graphite-docker-images/bash-plus'
+    - name: 'gcr.io/graphite-docker-images/go-plus'
       id: tpg-test
-      entrypoint: '/workspace/.ci/scripts/bash-plus/terraform-tester/test_terraform.sh'
+      allowFailure: true
+      entrypoint: '/workspace/.ci/scripts/go-plus/magician/exec.sh'
       secretEnv: ["GITHUB_TOKEN"]
       waitFor: ["tpg-head", "tpg-base"]
       args:
-          - 'ga'                               # remove after 07/2023
-          - $_PR_NUMBER                        # remove after 07/2023
-          - $COMMIT_SHA                        # remove after 07/2023
-          - $BUILD_ID                          # remove after 07/2023
-          - $PROJECT_ID                        # remove after 07/2023
-          - GoogleCloudPlatform/magic-modules  # remove after 07/2023
-          - "21"                               # remove after 07/2023
+        - 'test-tpg'
       env:
         - VERSION=ga
         - COMMIT_SHA=$COMMIT_SHA
diff --git a/.ci/gcb-run-rake-tests.yml b/.ci/gcb-run-rake-tests.yml
deleted file mode 100644
index 9d9072cbaf74..000000000000
--- a/.ci/gcb-run-rake-tests.yml
+++ /dev/null
@@ -1,10 +0,0 @@
----
-steps:
-- name: 'gcr.io/graphite-docker-images/build-environment'
-  id: run-rake-tests
-  entrypoint: bundle
-  dir: mmv1
-  args:
-      - exec
-      - rake
-      - test
diff --git a/.ci/infra/terraform/README.md b/.ci/infra/terraform/README.md
index 94356c2f0bb6..6d09096610fd 100644
--- a/.ci/infra/terraform/README.md
+++ b/.ci/infra/terraform/README.md
@@ -66,3 +66,4 @@ Quotas that will need to be adjusted to support all tests:
 - compute.googleapis.com/regional_in_use_addresses (us-central1)
 - compute.googleapis.com/regional_static_addresses (us-central1)
 - compute.googleapis.com/routers
+- compute.googleapis.com/c2_cpus (us-central1)
diff --git a/.ci/infra/terraform/main.tf b/.ci/infra/terraform/main.tf
index fa6d3a584595..a6bf36234b21 100644
--- a/.ci/infra/terraform/main.tf
+++ b/.ci/infra/terraform/main.tf
@@ -201,6 +201,7 @@ module "project-services" {
     "cloudtrace.googleapis.com",
     "composer.googleapis.com",
     "compute.googleapis.com",
+    "connectors.googleapis.com",
     "container.googleapis.com",
     "containeranalysis.googleapis.com",
     "containerfilesystem.googleapis.com",
@@ -213,6 +214,7 @@ module "project-services" {
     "dataform.googleapis.com",
     "datafusion.googleapis.com",
     "datamigration.googleapis.com",
+    "datapipelines.googleapis.com",
     "dataplex.googleapis.com",
     "dataproc.googleapis.com",
     "datastore.googleapis.com",
@@ -241,7 +243,6 @@ module "project-services" {
     "firebasestorage.googleapis.com",
     "firestore.googleapis.com",
     "firestorekeyvisualizer.googleapis.com",
-    "gameservices.googleapis.com",
     "gkebackup.googleapis.com",
     "gkeconnect.googleapis.com",
     "gkehub.googleapis.com",
@@ -300,6 +301,7 @@ module "project-services" {
     "storage-api.googleapis.com",
     "storage-component.googleapis.com",
     "storage.googleapis.com",
+    "storageinsights.googleapis.com",
     "storagetransfer.googleapis.com",
     "test-file.sandbox.googleapis.com",
     "testing.googleapis.com",
diff --git a/.ci/containers/membership-checker/build_trigger.go b/.ci/magician/cloudbuild/build_trigger.go
similarity index 64%
rename from .ci/containers/membership-checker/build_trigger.go
rename to .ci/magician/cloudbuild/build_trigger.go
index 2a6b90bc0cf8..04ecaf80c748 100644
--- a/.ci/containers/membership-checker/build_trigger.go
+++ b/.ci/magician/cloudbuild/build_trigger.go
@@ -1,4 +1,4 @@
-package main
+package cloudbuild
 
 import (
 	"context"
@@ -8,13 +8,13 @@ import (
 	"google.golang.org/api/cloudbuild/v1"
 )
 
-func triggerMMPresubmitRuns(projectId, repoName, commitSha string, substitutions map[string]string) error {
+func (cb cloudBuild) TriggerMMPresubmitRuns(commitSha string, substitutions map[string]string) error {
 	presubmitTriggerId, ok := os.LookupEnv("GENERATE_DIFFS_TRIGGER")
 	if !ok {
-		return fmt.Errorf("Did not provide GENERATE_DIFFS_TRIGGER environment variable")
+		return fmt.Errorf("did not provide GENERATE_DIFFS_TRIGGER environment variable")
 	}
 
-	err := triggerCloudBuildRun(projectId, presubmitTriggerId, repoName, commitSha, substitutions)
+	err := triggerCloudBuildRun(PROJECT_ID, presubmitTriggerId, REPO_NAME, commitSha, substitutions)
 	if err != nil {
 		return err
 	}
@@ -26,7 +26,7 @@ func triggerCloudBuildRun(projectId, triggerId, repoName, commitSha string, subs
 	ctx := context.Background()
 	c, err := cloudbuild.NewService(ctx)
 	if err != nil {
-		return fmt.Errorf("Failed to create Cloud Build service client: %s", err)
+		return fmt.Errorf("failed to create Cloud Build service client: %s", err)
 	}
 
 	repoSource := &cloudbuild.RepoSource{
@@ -38,7 +38,7 @@ func triggerCloudBuildRun(projectId, triggerId, repoName, commitSha string, subs
 
 	_, err = c.Projects.Triggers.Run(projectId, triggerId, repoSource).Do()
 	if err != nil {
-		return fmt.Errorf("Failed to create Cloud Build run: %s", err)
+		return fmt.Errorf("failed to create Cloud Build run: %s", err)
 	}
 
 	fmt.Println("Started Cloud Build Run: ", triggerId)
diff --git a/.ci/magician/cloudbuild/community.go b/.ci/magician/cloudbuild/community.go
new file mode 100644
index 000000000000..ff7634b82d7d
--- /dev/null
+++ b/.ci/magician/cloudbuild/community.go
@@ -0,0 +1,100 @@
+package cloudbuild
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"google.golang.org/api/cloudbuild/v1"
+)
+
+func (cb cloudBuild) ApproveCommunityChecker(prNumber, commitSha string) error {
+	buildId, err := getPendingBuildId(PROJECT_ID, commitSha)
+	if err != nil {
+		return err
+	}
+
+	if buildId == "" {
+		return fmt.Errorf("Failed to find pending build for PR %s", prNumber)
+	}
+
+	err = approveBuild(PROJECT_ID, buildId)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (cb cloudBuild) GetAwaitingApprovalBuildLink(prNumber, commitSha string) (string, error) {
+	buildId, err := getPendingBuildId(PROJECT_ID, commitSha)
+	if err != nil {
+		return "", err
+	}
+
+	if buildId == "" {
+		return "", fmt.Errorf("failed to find pending build for PR %s", prNumber)
+	}
+
+	targetUrl := fmt.Sprintf("https://console.cloud.google.com/cloud-build/builds;region=global/%s?project=%s", buildId, PROJECT_ID)
+
+	return targetUrl, nil
+}
+
+func getPendingBuildId(projectId, commitSha string) (string, error) {
+	COMMUNITY_CHECKER_TRIGGER, ok := os.LookupEnv("COMMUNITY_CHECKER_TRIGGER")
+	if !ok {
+		return "", fmt.Errorf("Did not provide COMMUNITY_CHECKER_TRIGGER environment variable")
+	}
+
+	ctx := context.Background()
+
+	c, err := cloudbuild.NewService(ctx)
+	if err != nil {
+		return "", err
+	}
+
+	filter := fmt.Sprintf("trigger_id=%s AND status=PENDING", COMMUNITY_CHECKER_TRIGGER)
+	// Builds will be sorted by createTime, descending order.
+	// 50 should be enough to include the one needs auto approval
+	pageSize := int64(50)
+
+	builds, err := c.Projects.Builds.List(projectId).Filter(filter).PageSize(pageSize).Do()
+	if err != nil {
+		return "", err
+	}
+
+	for _, build := range builds.Builds {
+		if build.Substitutions["COMMIT_SHA"] == commitSha {
+			return build.Id, nil
+		}
+	}
+
+	return "", nil
+}
+
+func approveBuild(projectId, buildId string) error {
+	ctx := context.Background()
+
+	c, err := cloudbuild.NewService(ctx)
+	if err != nil {
+		return err
+	}
+
+	name := fmt.Sprintf("projects/%s/builds/%s", projectId, buildId)
+
+	approveBuildRequest := &cloudbuild.ApproveBuildRequest{
+		ApprovalResult: &cloudbuild.ApprovalResult{
+			Decision: "APPROVED",
+		},
+	}
+
+	_, err = c.Projects.Builds.Approve(name, approveBuildRequest).Do()
+	if err != nil {
+		return err
+	}
+
+	fmt.Println("Auto approved build ", buildId)
+
+	return nil
+}
diff --git a/.ci/magician/cloudbuild/constants.go b/.ci/magician/cloudbuild/constants.go
new file mode 100644
index 000000000000..a64c5fce7c61
--- /dev/null
+++ b/.ci/magician/cloudbuild/constants.go
@@ -0,0 +1,4 @@
+package cloudbuild
+
+const PROJECT_ID = "graphite-docker-images"
+const REPO_NAME = "magic-modules"
diff --git a/.ci/magician/cloudbuild/init.go b/.ci/magician/cloudbuild/init.go
new file mode 100644
index 000000000000..e2d29face5a2
--- /dev/null
+++ b/.ci/magician/cloudbuild/init.go
@@ -0,0 +1,14 @@
+package cloudbuild
+
+type cloudBuild bool
+
+type CloudBuild interface {
+	ApproveCommunityChecker(prNumber, commitSha string) error
+	GetAwaitingApprovalBuildLink(prNumber, commitSha string) (string, error)
+	TriggerMMPresubmitRuns(commitSha string, substitutions map[string]string) error
+}
+
+func NewCloudBuildService() CloudBuild {
+	var x cloudBuild = true
+	return x
+}
diff --git a/.ci/magician/cmd/community_checker.go b/.ci/magician/cmd/community_checker.go
new file mode 100644
index 000000000000..f1b8a943d08e
--- /dev/null
+++ b/.ci/magician/cmd/community_checker.go
@@ -0,0 +1,106 @@
+/*
+Copyright © 2023 NAME HERE <EMAIL ADDRESS>
+*/
+package cmd
+
+import (
+	"fmt"
+	"magician/cloudbuild"
+	"magician/github"
+	"os"
+
+	"github.com/spf13/cobra"
+)
+
+type ccGithub interface {
+	GetPullRequestAuthor(prNumber string) (string, error)
+	GetUserType(user string) github.UserType
+	RemoveLabel(prNumber string, label string) error
+	PostBuildStatus(prNumber string, title string, state string, targetUrl string, commitSha string) error
+}
+
+type ccCloudbuild interface {
+	TriggerMMPresubmitRuns(commitSha string, substitutions map[string]string) error
+}
+
+// communityApprovalCmd represents the communityApproval command
+var communityApprovalCmd = &cobra.Command{
+	Use:   "community-checker",
+	Short: "Run presubmit generate diffs for untrusted users and remove awaiting-approval label",
+	Long: `This command processes pull requests and performs various validations and actions based on the PR's metadata and author.
+
+	The following PR details are expected as arguments:
+	1. PR Number
+	2. Commit SHA
+	3. Branch Name
+	4. Head Repo URL
+	5. Head Branch
+	6. Base Branch
+
+	The command performs the following steps:
+	1. Retrieve and print the provided pull request details.
+	2. Get the author of the pull request and determine their user type.
+	3. If the author is not a trusted user (neither a Core Contributor nor a Googler):
+			a. Trigger cloud builds with specific substitutions for the PR.
+	4. For all pull requests, the 'awaiting-approval' label is removed.
+	`,
+	Run: func(cmd *cobra.Command, args []string) {
+		prNumber := args[0]
+		fmt.Println("PR Number: ", prNumber)
+
+		commitSha := args[1]
+		fmt.Println("Commit SHA: ", commitSha)
+
+		branchName := args[2]
+		fmt.Println("Branch Name: ", branchName)
+
+		headRepoUrl := args[3]
+		fmt.Println("Head Repo URL: ", headRepoUrl)
+
+		headBranch := args[4]
+		fmt.Println("Head Branch: ", headBranch)
+
+		baseBranch := args[5]
+		fmt.Println("Base Branch: ", baseBranch)
+
+		gh := github.NewGithubService()
+		cb := cloudbuild.NewCloudBuildService()
+		execCommunityChecker(prNumber, commitSha, branchName, headRepoUrl, headBranch, baseBranch, gh, cb)
+	},
+}
+
+func execCommunityChecker(prNumber, commitSha, branchName, headRepoUrl, headBranch, baseBranch string, gh ccGithub, cb ccCloudbuild) {
+	substitutions := map[string]string{
+		"BRANCH_NAME":    branchName,
+		"_PR_NUMBER":     prNumber,
+		"_HEAD_REPO_URL": headRepoUrl,
+		"_HEAD_BRANCH":   headBranch,
+		"_BASE_BRANCH":   baseBranch,
+	}
+
+	author, err := gh.GetPullRequestAuthor(prNumber)
+	if err != nil {
+		fmt.Println(err)
+		os.Exit(1)
+	}
+
+	authorUserType := gh.GetUserType(author)
+	trusted := authorUserType == github.CoreContributorUserType || authorUserType == github.GooglerUserType
+
+	// only triggers build for untrusted users (because trusted users will be handled by membership-checker)
+	if !trusted {
+		err = cb.TriggerMMPresubmitRuns(commitSha, substitutions)
+		if err != nil {
+			fmt.Println(err)
+			os.Exit(1)
+		}
+	}
+
+	// in community-checker job:
+	// remove awaiting-approval label from external contributor PRs
+	gh.RemoveLabel(prNumber, "awaiting-approval")
+}
+
+func init() {
+	rootCmd.AddCommand(communityApprovalCmd)
+}
diff --git a/.ci/magician/cmd/community_checker_test.go b/.ci/magician/cmd/community_checker_test.go
new file mode 100644
index 000000000000..dec9682e50a2
--- /dev/null
+++ b/.ci/magician/cmd/community_checker_test.go
@@ -0,0 +1,91 @@
+package cmd
+
+import (
+	"magician/github"
+	"reflect"
+	"testing"
+)
+
+func TestExecCommunityChecker_CoreContributorFlow(t *testing.T) {
+	gh := &mockGithub{
+		author:        "core_author",
+		userType:      github.CoreContributorUserType,
+		calledMethods: make(map[string][][]any),
+	}
+	cb := &mockCloudBuild{
+		calledMethods: make(map[string][][]any),
+	}
+
+	execCommunityChecker("pr1", "sha1", "branch1", "url1", "head1", "base1", gh, cb)
+
+	if _, ok := cb.calledMethods["TriggerMMPresubmitRuns"]; ok {
+		t.Fatal("Presubmit runs redundantly triggered for core contributor")
+	}
+
+	method := "RemoveLabel"
+	expected := [][]any{{"pr1", "awaiting-approval"}}
+	if calls, ok := gh.calledMethods[method]; !ok {
+		t.Fatal("awaiting-approval label not removed for PR ")
+	} else if !reflect.DeepEqual(calls, expected) {
+		t.Fatalf("Wrong calls for %s, got %v, expected %v", method, calls, expected)
+	}
+
+}
+
+func TestExecCommunityChecker_GooglerFlow(t *testing.T) {
+	gh := &mockGithub{
+		author:            "googler_author",
+		userType:          github.GooglerUserType,
+		calledMethods:     make(map[string][][]any),
+		firstReviewer:     "reviewer1",
+		previousReviewers: []string{github.GetRandomReviewer(), "reviewer3"},
+	}
+	cb := &mockCloudBuild{
+		calledMethods: make(map[string][][]any),
+	}
+
+	execCommunityChecker("pr1", "sha1", "branch1", "url1", "head1", "base1", gh, cb)
+
+	if _, ok := cb.calledMethods["TriggerMMPresubmitRuns"]; ok {
+		t.Fatal("Presubmit runs redundantly triggered for googler")
+	}
+
+	method := "RemoveLabel"
+	expected := [][]any{{"pr1", "awaiting-approval"}}
+	if calls, ok := gh.calledMethods[method]; !ok {
+		t.Fatal("awaiting-approval label not removed for PR ")
+	} else if !reflect.DeepEqual(calls, expected) {
+		t.Fatalf("Wrong calls for %s, got %v, expected %v", method, calls, expected)
+	}
+}
+
+func TestExecCommunityChecker_AmbiguousUserFlow(t *testing.T) {
+	gh := &mockGithub{
+		author:            "ambiguous_author",
+		userType:          github.CommunityUserType,
+		calledMethods:     make(map[string][][]any),
+		firstReviewer:     github.GetRandomReviewer(),
+		previousReviewers: []string{github.GetRandomReviewer(), "reviewer3"},
+	}
+	cb := &mockCloudBuild{
+		calledMethods: make(map[string][][]any),
+	}
+
+	execCommunityChecker("pr1", "sha1", "branch1", "url1", "head1", "base1", gh, cb)
+
+	method := "TriggerMMPresubmitRuns"
+	expected := [][]any{{"sha1", map[string]string{"BRANCH_NAME": "branch1", "_BASE_BRANCH": "base1", "_HEAD_BRANCH": "head1", "_HEAD_REPO_URL": "url1", "_PR_NUMBER": "pr1"}}}
+	if calls, ok := cb.calledMethods[method]; !ok {
+		t.Fatal("Presubmit runs not triggered for ambiguous user")
+	} else if !reflect.DeepEqual(calls, expected) {
+		t.Fatalf("Wrong calls for %s, got %v, expected %v", method, calls, expected)
+	}
+
+	method = "RemoveLabel"
+	expected = [][]any{{"pr1", "awaiting-approval"}}
+	if calls, ok := gh.calledMethods[method]; !ok {
+		t.Fatal("awaiting-approval label not removed for PR ")
+	} else if !reflect.DeepEqual(calls, expected) {
+		t.Fatalf("Wrong calls for %s, got %v, expected %v", method, calls, expected)
+	}
+}
diff --git a/.ci/magician/cmd/generate_comment.go b/.ci/magician/cmd/generate_comment.go
new file mode 100644
index 000000000000..c38b68009189
--- /dev/null
+++ b/.ci/magician/cmd/generate_comment.go
@@ -0,0 +1,462 @@
+package cmd
+
+import (
+	"fmt"
+	"magician/exec"
+	"magician/github"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+
+	"github.com/spf13/cobra"
+)
+
+const allowBreakingChangesLabel = 4598495472
+
+type gcGithub interface {
+	GetPullRequestLabelIDs(prNumber string) (map[int]struct{}, error)
+	PostBuildStatus(prNumber, title, state, targetURL, commitSha string) error
+	PostComment(prNumber, comment string) error
+}
+
+type gcRunner interface {
+	GetCWD() string
+	Copy(src, dest string) error
+	RemoveAll(path string) error
+	PushDir(path string) error
+	PopDir() error
+	Run(name string, args, env []string) (string, error)
+	MustRun(name string, args, env []string) string
+}
+
+type ProviderVersion string
+
+type Repository struct {
+	Name        string // Name in GitHub (e.g. magic-modules)
+	Title       string // Title for display (e.g. Magic Modules)
+	Path        string // local Path once checked out, including Name
+	Version     ProviderVersion
+	DiffCanFail bool // whether to allow the command to continue if cloning or diffing the repo fails
+}
+
+var generateCommentCmd = &cobra.Command{
+	Use:   "generate-comment",
+	Short: "Run presubmit generate comment",
+	Long: `This command processes pull requests and performs various validations and actions based on the PR's metadata and author.
+
+	The following PR details are expected as environment variables:
+	1. BUILD_ID
+	2. PROJECT_ID
+	3. BUILD_STEP
+	4. COMMIT_SHA
+	5. PR_NUMBER
+	6. GITHUB_TOKEN
+
+	The command performs the following steps:
+	1. Clone the tpg, tpgb, tfc, and tfoics repos from modular-magician.
+	2. Compute the diffs between auto-pr-# and auto-pr-#-old branches.
+	3. Run the diff processor to detect breaking changes.
+	4. Run the missing test detector to detect missing tests for fields changed.
+	5. Report the results in a PR comment.
+	6. Run unit tests for the missing test detector.
+	`,
+	Run: func(cmd *cobra.Command, args []string) {
+		buildID := os.Getenv("BUILD_ID")
+		fmt.Println("Build ID: ", buildID)
+
+		projectID := os.Getenv("PROJECT_ID")
+		fmt.Println("Project ID: ", projectID)
+
+		buildStep := os.Getenv("BUILD_STEP")
+		fmt.Println("Build Step: ", buildStep)
+
+		commit := os.Getenv("COMMIT_SHA")
+		fmt.Println("Commit SHA: ", commit)
+
+		pr := os.Getenv("PR_NUMBER")
+		fmt.Println("PR Number: ", pr)
+
+		githubToken, ok := os.LookupEnv("GITHUB_TOKEN")
+		if !ok {
+			fmt.Println("Did not provide GITHUB_TOKEN environment variable")
+			os.Exit(1)
+		}
+
+		gh := github.NewGithubService()
+		rnr, err := exec.NewRunner()
+		if err != nil {
+			fmt.Println("Error creating a runner: ", err)
+			os.Exit(1)
+		}
+		execGenerateComment(buildID, projectID, buildStep, commit, pr, githubToken, gh, rnr)
+	},
+}
+
+func execGenerateComment(buildID, projectID, buildStep, commit, pr, githubToken string, gh gcGithub, r gcRunner) {
+	newBranch := "auto-pr-" + pr
+	oldBranch := "auto-pr-" + pr + "-old"
+	wd := r.GetCWD()
+	mmLocalPath := filepath.Join(wd, "..", "..")
+	tpgRepoName := "terraform-provider-google"
+	tpgLocalPath := filepath.Join(mmLocalPath, "..", "tpg")
+	tpgbRepoName := "terraform-provider-google-beta"
+	tpgbLocalPath := filepath.Join(mmLocalPath, "..", "tpgb")
+	tfoicsRepoName := "docs-examples"
+	tfoicsLocalPath := filepath.Join(mmLocalPath, "..", "tfoics")
+	// For backwards compatibility until at least Nov 15 2021
+	tfcRepoName := "terraform-google-conversion"
+	tfcLocalPath := filepath.Join(mmLocalPath, "..", "tfc")
+
+	var diffs string
+	for _, repo := range []Repository{
+		{
+			Name:  tpgRepoName,
+			Title: "Terraform GA",
+			Path:  tpgLocalPath,
+		},
+		{
+			Name:  tpgbRepoName,
+			Title: "Terraform Beta",
+			Path:  tpgbLocalPath,
+		},
+		{
+			Name:        tfcRepoName,
+			Title:       "TF Conversion",
+			Path:        tfcLocalPath,
+			DiffCanFail: true,
+		},
+		{
+			Name:  tfoicsRepoName,
+			Title: "TF OiCS",
+			Path:  tfoicsLocalPath,
+		},
+	} {
+		// TPG/TPGB difference
+		repoDiffs, err := cloneAndDiff(repo, oldBranch, newBranch, githubToken, r)
+		if err != nil {
+			fmt.Printf("Error cloning and diffing tpg repo: %v\n", err)
+			if !repo.DiffCanFail {
+				os.Exit(1)
+			}
+		}
+		diffs += "\n" + repoDiffs
+	}
+
+	var showBreakingChangesFailed bool
+	var err error
+	diffProcessorPath := filepath.Join(mmLocalPath, "tools", "diff-processor")
+	// versionedBreakingChanges is a map of breaking change output by provider version.
+	versionedBreakingChanges := make(map[ProviderVersion]string, 2)
+
+	for _, repo := range []Repository{
+		{
+			Title:   "TPG",
+			Path:    tpgLocalPath,
+			Version: "ga",
+		},
+		{
+			Title:   "TPGB",
+			Path:    tpgbLocalPath,
+			Version: "beta",
+		},
+	} {
+		// TPG diff processor
+		err = buildDiffProcessor(diffProcessorPath, repo.Path, oldBranch, newBranch, r)
+		if err != nil {
+			fmt.Println(err)
+			os.Exit(1)
+		}
+		output, err := computeBreakingChanges(diffProcessorPath, r)
+		if err != nil {
+			fmt.Println("Error computing TPG breaking changes: ", err)
+			showBreakingChangesFailed = true
+		}
+		versionedBreakingChanges[repo.Version] = output
+		err = addLabels(diffProcessorPath, githubToken, pr, r)
+		if err != nil {
+			fmt.Println("Error adding TPG labels to PR: ", err)
+		}
+		err = cleanDiffProcessor(diffProcessorPath, r)
+		if err != nil {
+			fmt.Println("Error cleaning up diff processor: ", err)
+			os.Exit(1)
+		}
+	}
+
+	var breakingChanges string
+	if showBreakingChangesFailed {
+		breakingChanges = `## Breaking Change Detection Failed
+The breaking change detector crashed during execution. This is usually due to the downstream provider(s) failing to compile. Please investigate or follow up with your reviewer.`
+	} else {
+		breakingChanges = combineBreakingChanges(versionedBreakingChanges["ga"], versionedBreakingChanges["beta"])
+	}
+
+	// Missing test detector
+	missingTests, err := detectMissingTests(mmLocalPath, tpgbLocalPath, oldBranch, r)
+	if err != nil {
+		fmt.Println("Error setting up missing test detector: ", err)
+		os.Exit(1)
+	}
+
+	message := "Hi there, I'm the Modular magician. I've detected the following information about your changes:\n\n"
+	breakingState := "success"
+	if breakingChanges != "" {
+		message += breakingChanges + "\n\n"
+
+		labels, err := gh.GetPullRequestLabelIDs(pr)
+		if err != nil {
+			fmt.Printf("Error getting pull request labels: %v\n", err)
+			os.Exit(1)
+		}
+		if _, ok := labels[allowBreakingChangesLabel]; !ok {
+			breakingState = "failure"
+		}
+	}
+
+	if diffs == "" {
+		message += "## Diff report\nYour PR hasn't generated any diffs, but I'll let you know if a future commit does."
+	} else {
+		message += "## Diff report\nYour PR generated some diffs in downstreams - here they are.\n" + diffs
+		if missingTests != "" {
+			message += "\n" + missingTests + "\n"
+		}
+	}
+
+	if err := gh.PostComment(pr, message); err != nil {
+		fmt.Printf("Error posting comment to PR %s: %v\n", pr, err)
+	}
+
+	targetURL := fmt.Sprintf("https://console.cloud.google.com/cloud-build/builds;region=global/%s;step=%s?project=%s", buildID, buildStep, projectID)
+	if err := gh.PostBuildStatus(pr, "terraform-provider-breaking-change-test", breakingState, targetURL, commit); err != nil {
+		fmt.Printf("Error posting build status for pr %s commit %s: %v\n", pr, commit, err)
+		os.Exit(1)
+	}
+
+	if err := r.PushDir(mmLocalPath); err != nil {
+		fmt.Println(err)
+		os.Exit(1)
+	}
+	if diffs := r.MustRun("git", []string{"diff", "HEAD", "origin/main", "tools/missing-test-detector"}, nil); diffs != "" {
+		fmt.Printf("Found diffs in missing test detector:\n%s\nRunning tests.\n", diffs)
+		if err := testTools(mmLocalPath, tpgbLocalPath, pr, commit, buildID, buildStep, projectID, gh, r); err != nil {
+			fmt.Printf("Error testing tools in %s: %v\n", mmLocalPath, err)
+			os.Exit(1)
+		}
+	}
+	if err := r.PopDir(); err != nil {
+		fmt.Println(err)
+		os.Exit(1)
+	}
+}
+
+func cloneAndDiff(repo Repository, oldBranch, newBranch, githubToken string, r gcRunner) (string, error) {
+	// Clone the repo to the desired repo.Path.
+	url := fmt.Sprintf("https://modular-magician:%s@github.com/modular-magician/%s", githubToken, repo.Name)
+	if _, err := r.Run("git", []string{"clone", "-b", newBranch, url, repo.Path}, nil); err != nil {
+		return "", fmt.Errorf("error cloning %s: %v\n", repo.Name, err)
+	}
+
+	// Push dir to the newly cloned repo.
+	if err := r.PushDir(repo.Path); err != nil {
+		return "", err
+	}
+	if _, err := r.Run("git", []string{"fetch", "origin", oldBranch}, nil); err != nil {
+		return "", fmt.Errorf("error fetching branch %s in repo %s: %v\n", oldBranch, repo.Name, err)
+	}
+
+	// Return summary, if any, and return to original directory.
+	if summary, err := r.Run("git", []string{"diff", "origin/" + oldBranch, "origin/" + newBranch, "--shortstat"}, nil); err != nil {
+		return "", fmt.Errorf("error diffing %s and %s: %v\n", oldBranch, newBranch, err)
+	} else if summary != "" {
+		summary = strings.TrimSuffix(summary, "\n")
+		return fmt.Sprintf("%s: [Diff](https://github.com/modular-magician/%s/compare/%s..%s) (%s)", repo.Title, repo.Name, oldBranch, newBranch, summary), r.PopDir()
+	}
+	return "", r.PopDir()
+}
+
+// Build the diff processor for tpg or tpgb
+func buildDiffProcessor(diffProcessorPath, providerLocalPath, oldBranch, newBranch string, r gcRunner) error {
+	if err := r.PushDir(diffProcessorPath); err != nil {
+		return err
+	}
+	for _, path := range []string{"old", "new"} {
+		if err := r.Copy(providerLocalPath, filepath.Join(diffProcessorPath, path)); err != nil {
+			return err
+		}
+	}
+	if _, err := r.Run("make", []string{"build"}, []string{"OLD_REF=" + oldBranch, "NEW_REF=" + newBranch}); err != nil {
+		return fmt.Errorf("Error running make build in %s: %v\n", diffProcessorPath, err)
+	}
+	return r.PopDir()
+}
+
+func computeBreakingChanges(diffProcessorPath string, r gcRunner) (string, error) {
+	if err := r.PushDir(diffProcessorPath); err != nil {
+		return "", err
+	}
+	breakingChanges, err := r.Run("bin/diff-processor", []string{"breaking-changes"}, nil)
+	if err != nil {
+		return "", err
+	}
+	return breakingChanges, r.PopDir()
+}
+
+func addLabels(diffProcessorPath, githubToken, pr string, r gcRunner) error {
+	if err := r.PushDir(diffProcessorPath); err != nil {
+		return err
+	}
+	output, err := r.Run("bin/diff-processor", []string{"add-labels", pr}, []string{fmt.Sprintf("GITHUB_TOKEN=%s", githubToken)})
+	fmt.Println(output)
+	if err != nil {
+		return err
+	}
+	return r.PopDir()
+}
+
+func cleanDiffProcessor(diffProcessorPath string, r gcRunner) error {
+	for _, path := range []string{"old", "new", "bin"} {
+		if err := r.RemoveAll(filepath.Join(diffProcessorPath, path)); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// Get the breaking change message including the unique tpg messages and all tpgb messages.
+func combineBreakingChanges(tpgBreaking, tpgbBreaking string) string {
+	var allMessages []string
+	if tpgBreaking == "" {
+		if tpgbBreaking == "" {
+			return ""
+		}
+		allMessages = strings.Split(tpgbBreaking, "\n")
+	} else if tpgbBreaking == "" {
+		allMessages = strings.Split(tpgBreaking, "\n")
+	} else {
+		dashExp := regexp.MustCompile("-.*")
+		tpgMessages := strings.Split(tpgBreaking, "\n")
+		tpgbMessages := strings.Split(tpgbBreaking, "\n")
+		tpgbSet := make(map[string]struct{}, len(tpgbMessages))
+		var tpgUnique []string
+		for _, message := range tpgbMessages {
+			simple := dashExp.ReplaceAllString(message, "")
+			tpgbSet[simple] = struct{}{}
+		}
+		for _, message := range tpgMessages {
+			simple := dashExp.ReplaceAllString(message, "")
+			if _, ok := tpgbSet[simple]; !ok {
+				tpgUnique = append(tpgUnique, message)
+			}
+		}
+		allMessages = append(tpgUnique, tpgbMessages...)
+	}
+	if len(allMessages) > 0 {
+		return `Breaking Change(s) Detected
+The following breaking change(s) were detected within your pull request.
+
+* ` + strings.Join(allMessages, "\n* ") + `
+
+If you believe this detection to be incorrect please raise the concern with your reviewer.
+If you intend to make this change you will need to wait for a [major release](https://www.terraform.io/plugin/sdkv2/best-practices/versioning#example-major-number-increments) window.
+An ` + "`override-breaking-change`" + `label can be added to allow merging.
+`
+	}
+	return ""
+}
+
+// Run the missing test detector and return the results.
+// Returns an empty string unless there are missing tests.
+// Error will be nil unless an error occurs during setup.
+func detectMissingTests(mmLocalPath, tpgbLocalPath, oldBranch string, r gcRunner) (string, error) {
+	tpgbLocalPathOld := tpgbLocalPath + "old"
+
+	if err := r.Copy(tpgbLocalPath, tpgbLocalPathOld); err != nil {
+		return "", err
+	}
+
+	if err := r.PushDir(tpgbLocalPathOld); err != nil {
+		return "", err
+	}
+	if _, err := r.Run("git", []string{"checkout", "origin/" + oldBranch}, nil); err != nil {
+		return "", err
+	}
+
+	if err := updatePackageName("old", tpgbLocalPathOld, r); err != nil {
+		return "", err
+	}
+	if err := updatePackageName("new", tpgbLocalPath, r); err != nil {
+		return "", err
+	}
+	if err := r.PopDir(); err != nil {
+		return "", err
+	}
+
+	missingTestDetectorPath := filepath.Join(mmLocalPath, "tools", "missing-test-detector")
+	if err := r.PushDir(missingTestDetectorPath); err != nil {
+		return "", err
+	}
+	if _, err := r.Run("go", []string{"mod", "edit", "-replace", fmt.Sprintf("google/provider/%s=%s", "new", tpgbLocalPath)}, nil); err != nil {
+		fmt.Printf("Error running go mod edit: %v\n", err)
+	}
+	if _, err := r.Run("go", []string{"mod", "edit", "-replace", fmt.Sprintf("google/provider/%s=%s", "old", tpgbLocalPathOld)}, nil); err != nil {
+		fmt.Printf("Error running go mod edit: %v\n", err)
+	}
+	if _, err := r.Run("go", []string{"mod", "tidy"}, nil); err != nil {
+		fmt.Printf("Error running go mod tidy: %v\n", err)
+	}
+	missingTests, err := r.Run("go", []string{"run", ".", fmt.Sprintf("-services-dir=%s/google-beta/services", tpgbLocalPath)}, nil)
+	if err != nil {
+		fmt.Printf("Error running missing test detector: %v\n", err)
+		missingTests = ""
+	} else {
+		fmt.Printf("Successfully ran missing test detector:\n%s\n", missingTests)
+	}
+	return missingTests, r.PopDir()
+}
+
+// Update the provider package name to the given name in the given path.
+// name should be either "old" or "new".
+func updatePackageName(name, path string, r gcRunner) error {
+	oldPackageName := "github.com/hashicorp/terraform-provider-google-beta"
+	newPackageName := "google/provider/" + name
+	fmt.Printf("Updating package name in %s from %s to %s\n", path, oldPackageName, newPackageName)
+	if err := r.PushDir(path); err != nil {
+		return err
+	}
+	if _, err := r.Run("find", []string{".", "-type", "f", "-name", "*.go", "-exec", "sed", "-i.bak", fmt.Sprintf("s~%s~%s~g", oldPackageName, newPackageName), "{}", "+"}, nil); err != nil {
+		return fmt.Errorf("error running find: %v\n", err)
+	}
+	if _, err := r.Run("sed", []string{"-i.bak", fmt.Sprintf("s|%s|%s|g", oldPackageName, newPackageName), "go.mod"}, nil); err != nil {
+		return fmt.Errorf("error running sed: %v\n", err)
+	}
+	if _, err := r.Run("sed", []string{"-i.bak", fmt.Sprintf("s|%s|%s|g", oldPackageName, newPackageName), "go.sum"}, nil); err != nil {
+		return fmt.Errorf("error running sed: %v\n", err)
+	}
+	return r.PopDir()
+}
+
+// Run unit tests for the missing test detector and diff processor.
+// Report results using Github API.
+func testTools(mmLocalPath, tpgbLocalPath, pr, commit, buildID, buildStep, projectID string, gh gcGithub, r gcRunner) error {
+	missingTestDetectorPath := filepath.Join(mmLocalPath, "tools", "missing-test-detector")
+	r.PushDir(missingTestDetectorPath)
+	if _, err := r.Run("go", []string{"mod", "tidy"}, nil); err != nil {
+		fmt.Printf("error running go mod tidy in %s: %v\n", missingTestDetectorPath, err)
+	}
+	servicesDir := filepath.Join(tpgbLocalPath, "google-beta", "services")
+	state := "success"
+	if _, err := r.Run("go", []string{"test"}, []string{"SERVICES_DIR=" + servicesDir}); err != nil {
+		fmt.Printf("error from running go test in %s: %v\n", missingTestDetectorPath, err)
+		state = "failure"
+	}
+	targetURL := fmt.Sprintf("https://console.cloud.google.com/cloud-build/builds;region=global/%s;step=%s?project=%s", buildID, buildStep, projectID)
+	if err := gh.PostBuildStatus(pr, "unit-tests-missing-test-detector", state, targetURL, commit); err != nil {
+		return err
+	}
+	return r.PopDir()
+}
+
+func init() {
+	rootCmd.AddCommand(generateCommentCmd)
+}
diff --git a/.ci/magician/cmd/generate_comment_test.go b/.ci/magician/cmd/generate_comment_test.go
new file mode 100644
index 000000000000..b05acfa4f8e3
--- /dev/null
+++ b/.ci/magician/cmd/generate_comment_test.go
@@ -0,0 +1,92 @@
+package cmd
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestExecGenerateComment(t *testing.T) {
+	mr := NewMockRunner()
+	gh := &mockGithub{
+		calledMethods: make(map[string][][]any),
+	}
+	execGenerateComment("build1", "project1", "17", "sha1", "pr1", "*******", gh, mr)
+
+	for method, expectedCalls := range map[string][][]any{
+		"Copy": {
+			{"/mock/dir/tpg", "/mock/dir/magic-modules/tools/diff-processor/old"},
+			{"/mock/dir/tpg", "/mock/dir/magic-modules/tools/diff-processor/new"},
+			{"/mock/dir/tpgb", "/mock/dir/magic-modules/tools/diff-processor/old"},
+			{"/mock/dir/tpgb", "/mock/dir/magic-modules/tools/diff-processor/new"},
+			{"/mock/dir/tpgb", "/mock/dir/tpgbold"},
+		},
+		"RemoveAll": {
+			{"/mock/dir/magic-modules/tools/diff-processor/old"},
+			{"/mock/dir/magic-modules/tools/diff-processor/new"},
+			{"/mock/dir/magic-modules/tools/diff-processor/bin"},
+			{"/mock/dir/magic-modules/tools/diff-processor/old"},
+			{"/mock/dir/magic-modules/tools/diff-processor/new"},
+			{"/mock/dir/magic-modules/tools/diff-processor/bin"},
+		},
+		"Run": {
+			{"/mock/dir/magic-modules/.ci/magician", "git", []string{"clone", "-b", "auto-pr-pr1", "https://modular-magician:*******@github.com/modular-magician/terraform-provider-google", "/mock/dir/tpg"}, []string(nil)},
+			{"/mock/dir/tpg", "git", []string{"fetch", "origin", "auto-pr-pr1-old"}, []string(nil)},
+			{"/mock/dir/tpg", "git", []string{"diff", "origin/auto-pr-pr1-old", "origin/auto-pr-pr1", "--shortstat"}, []string(nil)},
+			{"/mock/dir/magic-modules/.ci/magician", "git", []string{"clone", "-b", "auto-pr-pr1", "https://modular-magician:*******@github.com/modular-magician/terraform-provider-google-beta", "/mock/dir/tpgb"}, []string(nil)},
+			{"/mock/dir/tpgb", "git", []string{"fetch", "origin", "auto-pr-pr1-old"}, []string(nil)},
+			{"/mock/dir/tpgb", "git", []string{"diff", "origin/auto-pr-pr1-old", "origin/auto-pr-pr1", "--shortstat"}, []string(nil)},
+			{"/mock/dir/magic-modules/.ci/magician", "git", []string{"clone", "-b", "auto-pr-pr1", "https://modular-magician:*******@github.com/modular-magician/terraform-google-conversion", "/mock/dir/tfc"}, []string(nil)},
+			{"/mock/dir/tfc", "git", []string{"fetch", "origin", "auto-pr-pr1-old"}, []string(nil)},
+			{"/mock/dir/tfc", "git", []string{"diff", "origin/auto-pr-pr1-old", "origin/auto-pr-pr1", "--shortstat"}, []string(nil)},
+			{"/mock/dir/magic-modules/.ci/magician", "git", []string{"clone", "-b", "auto-pr-pr1", "https://modular-magician:*******@github.com/modular-magician/docs-examples", "/mock/dir/tfoics"}, []string(nil)},
+			{"/mock/dir/tfoics", "git", []string{"fetch", "origin", "auto-pr-pr1-old"}, []string(nil)},
+			{"/mock/dir/tfoics", "git", []string{"diff", "origin/auto-pr-pr1-old", "origin/auto-pr-pr1", "--shortstat"}, []string(nil)},
+			{"/mock/dir/magic-modules/tools/diff-processor", "make", []string{"build"}, []string{"OLD_REF=auto-pr-pr1-old", "NEW_REF=auto-pr-pr1"}},
+			{"/mock/dir/magic-modules/tools/diff-processor", "bin/diff-processor", []string{"breaking-changes"}, []string(nil)},
+			{"/mock/dir/magic-modules/tools/diff-processor", "bin/diff-processor", []string{"add-labels", "pr1"}, []string{"GITHUB_TOKEN=*******"}},
+			{"/mock/dir/magic-modules/tools/diff-processor", "make", []string{"build"}, []string{"OLD_REF=auto-pr-pr1-old", "NEW_REF=auto-pr-pr1"}},
+			{"/mock/dir/magic-modules/tools/diff-processor", "bin/diff-processor", []string{"breaking-changes"}, []string(nil)},
+			{"/mock/dir/magic-modules/tools/diff-processor", "bin/diff-processor", []string{"add-labels", "pr1"}, []string{"GITHUB_TOKEN=*******"}},
+			{"/mock/dir/tpgbold", "git", []string{"checkout", "origin/auto-pr-pr1-old"}, []string(nil)},
+			{"/mock/dir/tpgbold", "find", []string{".", "-type", "f", "-name", "*.go", "-exec", "sed", "-i.bak", "s~github.com/hashicorp/terraform-provider-google-beta~google/provider/old~g", "{}", "+"}, []string(nil)},
+			{"/mock/dir/tpgbold", "sed", []string{"-i.bak", "s|github.com/hashicorp/terraform-provider-google-beta|google/provider/old|g", "go.mod"}, []string(nil)},
+			{"/mock/dir/tpgbold", "sed", []string{"-i.bak", "s|github.com/hashicorp/terraform-provider-google-beta|google/provider/old|g", "go.sum"}, []string(nil)},
+			{"/mock/dir/tpgb", "find", []string{".", "-type", "f", "-name", "*.go", "-exec", "sed", "-i.bak", "s~github.com/hashicorp/terraform-provider-google-beta~google/provider/new~g", "{}", "+"}, []string(nil)},
+			{"/mock/dir/tpgb", "sed", []string{"-i.bak", "s|github.com/hashicorp/terraform-provider-google-beta|google/provider/new|g", "go.mod"}, []string(nil)},
+			{"/mock/dir/tpgb", "sed", []string{"-i.bak", "s|github.com/hashicorp/terraform-provider-google-beta|google/provider/new|g", "go.sum"}, []string(nil)},
+			{"/mock/dir/magic-modules/tools/missing-test-detector", "go", []string{"mod", "edit", "-replace", "google/provider/new=/mock/dir/tpgb"}, []string(nil)},
+			{"/mock/dir/magic-modules/tools/missing-test-detector", "go", []string{"mod", "edit", "-replace", "google/provider/old=/mock/dir/tpgbold"}, []string(nil)},
+			{"/mock/dir/magic-modules/tools/missing-test-detector", "go", []string{"mod", "tidy"}, []string(nil)},
+			{"/mock/dir/magic-modules/tools/missing-test-detector", "go", []string{"run", ".", "-services-dir=/mock/dir/tpgb/google-beta/services"}, []string(nil)},
+			{"/mock/dir/magic-modules", "git", []string{"diff", "HEAD", "origin/main", "tools/missing-test-detector"}, []string(nil)}},
+	} {
+		if actualCalls, ok := mr.calledMethods[method]; !ok {
+			t.Fatalf("Found no calls for %s", method)
+		} else if len(actualCalls) != len(expectedCalls) {
+			t.Fatalf("Unexpected number of calls for %s, got %d, expected %d", method, len(actualCalls), len(expectedCalls))
+		} else {
+			for i, actualParams := range actualCalls {
+				if expectedParams := expectedCalls[i]; !reflect.DeepEqual(actualParams, expectedParams) {
+					t.Fatalf("Wrong params for call %d to %s, got %v, expected %v", i, method, actualParams, expectedParams)
+				}
+			}
+		}
+	}
+
+	for method, expectedCalls := range map[string][][]any{
+		"PostBuildStatus": {{"pr1", "terraform-provider-breaking-change-test", "success", "https://console.cloud.google.com/cloud-build/builds;region=global/build1;step=17?project=project1", "sha1"}},
+		"PostComment":     {{"pr1", "Hi there, I'm the Modular magician. I've detected the following information about your changes:\n\n## Diff report\nYour PR generated some diffs in downstreams - here they are.\n\nTerraform GA: [Diff](https://github.com/modular-magician/terraform-provider-google/compare/auto-pr-pr1-old..auto-pr-pr1) ( 2 files changed, 40 insertions(+))\nTerraform Beta: [Diff](https://github.com/modular-magician/terraform-provider-google-beta/compare/auto-pr-pr1-old..auto-pr-pr1) ( 2 files changed, 40 insertions(+))\nTF Conversion: [Diff](https://github.com/modular-magician/terraform-google-conversion/compare/auto-pr-pr1-old..auto-pr-pr1) ( 1 file changed, 10 insertions(+))\n\n## Missing test report\nYour PR includes resource fields which are not covered by any test.\n\nResource: `google_folder_access_approval_settings` (3 total tests)\nPlease add an acceptance test which includes these fields. The test should include the following:\n\n```hcl\nresource \"google_folder_access_approval_settings\" \"primary\" {\n  uncovered_field = # value needed\n}\n\n```\n\n"}},
+	} {
+		if actualCalls, ok := gh.calledMethods[method]; !ok {
+			t.Fatalf("Found no calls for %s", method)
+		} else if len(actualCalls) != len(expectedCalls) {
+			t.Fatalf("Unexpected number of calls for %s, got %d, expected %d", method, len(actualCalls), len(expectedCalls))
+		} else {
+			for i, actualParams := range actualCalls {
+				if expectedParams := expectedCalls[i]; !reflect.DeepEqual(actualParams, expectedParams) {
+					t.Fatalf("Wrong params for call %d to %s, got %v, expected %v", i, method, actualParams, expectedParams)
+				}
+			}
+		}
+	}
+}
diff --git a/.ci/magician/cmd/membership_checker.go b/.ci/magician/cmd/membership_checker.go
new file mode 100644
index 000000000000..df837ff81e33
--- /dev/null
+++ b/.ci/magician/cmd/membership_checker.go
@@ -0,0 +1,176 @@
+/*
+Copyright © 2023 NAME HERE <EMAIL ADDRESS>
+*/
+package cmd
+
+import (
+	"fmt"
+	"magician/cloudbuild"
+	"magician/github"
+	"os"
+
+	"github.com/spf13/cobra"
+)
+
+type mcGithub interface {
+	GetPullRequestAuthor(prNumber string) (string, error)
+	GetUserType(user string) github.UserType
+	GetPullRequestRequestedReviewer(prNumber string) (string, error)
+	GetPullRequestPreviousAssignedReviewers(prNumber string) ([]string, error)
+	RequestPullRequestReviewer(prNumber string, reviewer string) error
+	PostComment(prNumber string, comment string) error
+	AddLabel(prNumber string, label string) error
+	PostBuildStatus(prNumber string, title string, state string, targetUrl string, commitSha string) error
+}
+
+type mcCloudbuild interface {
+	ApproveCommunityChecker(prNumber, commitSha string) error
+	GetAwaitingApprovalBuildLink(prNumber, commitSha string) (string, error)
+	TriggerMMPresubmitRuns(commitSha string, substitutions map[string]string) error
+}
+
+// membershipCheckerCmd represents the membershipChecker command
+var membershipCheckerCmd = &cobra.Command{
+	Use:   "membership-checker",
+	Short: "Assigns reviewers and manages pull request processing based on the author's trust level.",
+	Long: `This command conducts a series of validations and actions based on the details and authorship of a provided pull request.
+
+	The command expects the following pull request details as arguments:
+	1. PR Number
+	2. Commit SHA
+	3. Branch Name
+	4. Head Repo URL
+	5. Head Branch
+	6. Base Branch
+
+	It then performs the following operations:
+	1. Extracts and displays the pull request details.
+	2. Fetches the author of the pull request and determines their contribution type.
+	3. If the author is not a core contributor:
+			a. Identifies the initially requested reviewer and those who previously reviewed this PR.
+			b. Determines and requests reviewers based on the above.
+			c. Posts comments tailored to the contribution type, the trust level of the contributor, and the primary reviewer.
+	4. For trusted authors (Core Contributors and Googlers):
+			a. Triggers generate-diffs using the provided PR details.
+			b. Automatically approves the community-checker run.
+	5. For external or untrusted contributors:
+			a. Adds the 'awaiting-approval' label.
+			b. Posts a link prompting approval for the build.
+	`,
+	Args: cobra.ExactArgs(6),
+	Run: func(cmd *cobra.Command, args []string) {
+		prNumber := args[0]
+		fmt.Println("PR Number: ", prNumber)
+
+		commitSha := args[1]
+		fmt.Println("Commit SHA: ", commitSha)
+
+		branchName := args[2]
+		fmt.Println("Branch Name: ", branchName)
+
+		headRepoUrl := args[3]
+		fmt.Println("Head Repo URL: ", headRepoUrl)
+
+		headBranch := args[4]
+		fmt.Println("Head Branch: ", headBranch)
+
+		baseBranch := args[5]
+		fmt.Println("Base Branch: ", baseBranch)
+
+		gh := github.NewGithubService()
+		cb := cloudbuild.NewCloudBuildService()
+		execMembershipChecker(prNumber, commitSha, branchName, headRepoUrl, headBranch, baseBranch, gh, cb)
+	},
+}
+
+func execMembershipChecker(prNumber, commitSha, branchName, headRepoUrl, headBranch, baseBranch string, gh mcGithub, cb mcCloudbuild) {
+	substitutions := map[string]string{
+		"BRANCH_NAME":    branchName,
+		"_PR_NUMBER":     prNumber,
+		"_HEAD_REPO_URL": headRepoUrl,
+		"_HEAD_BRANCH":   headBranch,
+		"_BASE_BRANCH":   baseBranch,
+	}
+
+	author, err := gh.GetPullRequestAuthor(prNumber)
+	if err != nil {
+		fmt.Println(err)
+		os.Exit(1)
+	}
+
+	authorUserType := gh.GetUserType(author)
+	trusted := authorUserType == github.CoreContributorUserType || authorUserType == github.GooglerUserType
+
+	if authorUserType != github.CoreContributorUserType {
+		fmt.Println("Not core contributor - assigning reviewer")
+
+		firstRequestedReviewer, err := gh.GetPullRequestRequestedReviewer(prNumber)
+		if err != nil {
+			fmt.Println(err)
+			os.Exit(1)
+		}
+
+		previouslyInvolvedReviewers, err := gh.GetPullRequestPreviousAssignedReviewers(prNumber)
+		if err != nil {
+			fmt.Println(err)
+			os.Exit(1)
+		}
+
+		reviewersToRequest, newPrimaryReviewer := github.ChooseReviewers(firstRequestedReviewer, previouslyInvolvedReviewers)
+
+		for _, reviewer := range reviewersToRequest {
+			err = gh.RequestPullRequestReviewer(prNumber, reviewer)
+			if err != nil {
+				fmt.Println(err)
+				os.Exit(1)
+			}
+		}
+
+		if newPrimaryReviewer != "" {
+			comment := github.FormatReviewerComment(newPrimaryReviewer, authorUserType, trusted)
+			err = gh.PostComment(prNumber, comment)
+			if err != nil {
+				fmt.Println(err)
+				os.Exit(1)
+			}
+		}
+	}
+
+	// auto_run(contributor-membership-checker) will be run on every commit or /gcbrun:
+	// only triggers builds for trusted users
+	if trusted {
+		err = cb.TriggerMMPresubmitRuns(commitSha, substitutions)
+		if err != nil {
+			fmt.Println(err)
+			os.Exit(1)
+		}
+	}
+
+	// in contributor-membership-checker job:
+	// 1. auto approve community-checker run for trusted users
+	// 2. add awaiting-approval label to external contributor PRs
+	if trusted {
+		err = cb.ApproveCommunityChecker(prNumber, commitSha)
+		if err != nil {
+			fmt.Println(err)
+			os.Exit(1)
+		}
+	} else {
+		gh.AddLabel(prNumber, "awaiting-approval")
+		targetUrl, err := cb.GetAwaitingApprovalBuildLink(prNumber, commitSha)
+		if err != nil {
+			fmt.Println(err)
+			os.Exit(1)
+		}
+
+		err = gh.PostBuildStatus(prNumber, "Approve Build", "success", targetUrl, commitSha)
+		if err != nil {
+			fmt.Println(err)
+			os.Exit(1)
+		}
+	}
+}
+
+func init() {
+	rootCmd.AddCommand(membershipCheckerCmd)
+}
diff --git a/.ci/magician/cmd/membership_checker_test.go b/.ci/magician/cmd/membership_checker_test.go
new file mode 100644
index 000000000000..b79f3fd13699
--- /dev/null
+++ b/.ci/magician/cmd/membership_checker_test.go
@@ -0,0 +1,182 @@
+package cmd
+
+import (
+	"magician/github"
+	"reflect"
+	"regexp"
+	"testing"
+)
+
+func TestExecMembershipChecker_CoreContributorFlow(t *testing.T) {
+	gh := &mockGithub{
+		author:        "core_author",
+		userType:      github.CoreContributorUserType,
+		calledMethods: make(map[string][][]any),
+	}
+	cb := &mockCloudBuild{
+		calledMethods: make(map[string][][]any),
+	}
+
+	execMembershipChecker("pr1", "sha1", "branch1", "url1", "head1", "base1", gh, cb)
+
+	if _, ok := gh.calledMethods["RequestPullRequestReviewer"]; ok {
+		t.Fatal("Incorrectly requested review for core contributor")
+	}
+
+	method := "TriggerMMPresubmitRuns"
+	expected := [][]any{{"sha1", map[string]string{"BRANCH_NAME": "branch1", "_BASE_BRANCH": "base1", "_HEAD_BRANCH": "head1", "_HEAD_REPO_URL": "url1", "_PR_NUMBER": "pr1"}}}
+	if calls, ok := cb.calledMethods[method]; !ok {
+		t.Fatal("Presubmit runs not triggered for core author")
+	} else if !reflect.DeepEqual(calls, expected) {
+		t.Fatalf("Wrong calls for %s, got %v, expected %v", method, calls, expected)
+	}
+
+	method = "ApproveCommunityChecker"
+	expected = [][]any{{"pr1", "sha1"}}
+	if calls, ok := cb.calledMethods[method]; !ok {
+		t.Fatal("Community checker not approved for core author")
+	} else if !reflect.DeepEqual(calls, expected) {
+		t.Fatalf("Wrong calls for %s, got %v, expected %v", method, calls, expected)
+	}
+
+}
+
+func TestExecMembershipChecker_GooglerFlow(t *testing.T) {
+	gh := &mockGithub{
+		author:            "googler_author",
+		userType:          github.GooglerUserType,
+		calledMethods:     make(map[string][][]any),
+		firstReviewer:     "reviewer1",
+		previousReviewers: []string{github.GetRandomReviewer(), "reviewer3"},
+	}
+	cb := &mockCloudBuild{
+		calledMethods: make(map[string][][]any),
+	}
+
+	execMembershipChecker("pr1", "sha1", "branch1", "url1", "head1", "base1", gh, cb)
+
+	method := "RequestPullRequestReviewer"
+	if calls, ok := gh.calledMethods[method]; !ok {
+		t.Fatal("Review wasn't requested for googler")
+	} else if len(calls) != 1 {
+		t.Fatalf("Wrong number of calls for %s, got %d, expected 1", method, len(calls))
+	} else if params := calls[0]; len(params) != 2 {
+		t.Fatalf("Wrong number of params for %s, got %d, expected 2", method, len(params))
+	} else if param := params[0]; param != "pr1" {
+		t.Fatalf("Wrong first param for %s, got %v, expected pr1", method, param)
+	} else if param := params[1]; !github.IsTeamReviewer(param.(string)) {
+		t.Fatalf("Wrong second param for %s, got %v, expected a team reviewer", method, param)
+	}
+
+	method = "TriggerMMPresubmitRuns"
+	expected := [][]any{{"sha1", map[string]string{"BRANCH_NAME": "branch1", "_BASE_BRANCH": "base1", "_HEAD_BRANCH": "head1", "_HEAD_REPO_URL": "url1", "_PR_NUMBER": "pr1"}}}
+	if calls, ok := cb.calledMethods[method]; !ok {
+		t.Fatal("Presubmit runs not triggered for googler")
+	} else if !reflect.DeepEqual(calls, expected) {
+		t.Fatalf("Wrong calls for %s, got %v, expected %v", method, calls, expected)
+	}
+
+	method = "ApproveCommunityChecker"
+	expected = [][]any{{"pr1", "sha1"}}
+	if calls, ok := cb.calledMethods[method]; !ok {
+		t.Fatal("Community checker not approved for googler")
+	} else if !reflect.DeepEqual(calls, expected) {
+		t.Fatalf("Wrong calls for %s, got %v, expected %v", method, calls, expected)
+	}
+}
+
+func TestExecMembershipChecker_AmbiguousUserFlow(t *testing.T) {
+	gh := &mockGithub{
+		author:            "ambiguous_author",
+		userType:          github.CommunityUserType,
+		calledMethods:     make(map[string][][]any),
+		firstReviewer:     github.GetRandomReviewer(),
+		previousReviewers: []string{github.GetRandomReviewer(), "reviewer3"},
+	}
+	cb := &mockCloudBuild{
+		calledMethods: make(map[string][][]any),
+	}
+
+	execMembershipChecker("pr1", "sha1", "branch1", "url1", "head1", "base1", gh, cb)
+
+	method := "RequestPullRequestReviewer"
+	if calls, ok := gh.calledMethods[method]; !ok {
+		t.Fatal("Review wasn't requested for ambiguous user")
+	} else if len(calls) != 1 {
+		t.Fatalf("Wrong number of calls for %s, got %d, expected 1", method, len(calls))
+	} else if params := calls[0]; len(params) != 2 {
+		t.Fatalf("Wrong number of params for %s, got %d, expected 2", method, len(params))
+	} else if param := params[0]; param != "pr1" {
+		t.Fatalf("Wrong first param for %s, got %v, expected pr1", method, param)
+	} else if param := params[1]; !github.IsTeamReviewer(param.(string)) {
+		t.Fatalf("Wrong second param for %s, got %v, expected a team reviewer", method, param)
+	}
+
+	method = "AddLabel"
+	expected := [][]any{{"pr1", "awaiting-approval"}}
+	if calls, ok := gh.calledMethods[method]; !ok {
+		t.Fatal("Label wasn't posted to pull request")
+	} else if !reflect.DeepEqual(calls, expected) {
+		t.Fatalf("Wrong calls for %s, got %v, expected %v", method, calls, expected)
+	}
+
+	method = "GetAwaitingApprovalBuildLink"
+	expected = [][]any{{"pr1", "sha1"}}
+	if calls, ok := cb.calledMethods[method]; !ok {
+		t.Fatal("Awaiting approval build link wasn't gotten from pull request")
+	} else if !reflect.DeepEqual(calls, expected) {
+		t.Fatalf("Wrong calls for %s, got %v, expected %v", method, calls, expected)
+	}
+
+	if _, ok := gh.calledMethods["ApproveCommunityChecker"]; ok {
+		t.Fatal("Incorrectly approved community checker for ambiguous user")
+	}
+
+	if _, ok := gh.calledMethods["TriggerMMPresubmitRuns"]; ok {
+		t.Fatal("Incorrectly triggered presubmit runs for ambiguous user")
+	}
+}
+
+func TestExecMembershipChecker_CommentForNewPrimaryReviewer(t *testing.T) {
+	gh := &mockGithub{
+		author:            "googler_author",
+		userType:          github.GooglerUserType,
+		calledMethods:     make(map[string][][]any),
+		firstReviewer:     "",
+		previousReviewers: []string{"reviewer3"},
+	}
+	cb := &mockCloudBuild{
+		calledMethods: make(map[string][][]any),
+	}
+
+	execMembershipChecker("pr1", "sha1", "branch1", "url1", "head1", "base1", gh, cb)
+
+	method := "RequestPullRequestReviewer"
+	if calls, ok := gh.calledMethods[method]; !ok {
+		t.Fatal("Review wasn't requested for googler")
+	} else if len(calls) != 1 {
+		t.Fatalf("Wrong number of calls for %s, got %d, expected 1", method, len(calls))
+	} else if params := calls[0]; len(params) != 2 {
+		t.Fatalf("Wrong number of params for %s, got %d, expected 2", method, len(params))
+	} else if param := params[0]; param != "pr1" {
+		t.Fatalf("Wrong first param for %s, got %v, expected pr1", method, param)
+	} else if param := params[1]; !github.IsTeamReviewer(param.(string)) {
+		t.Fatalf("Wrong second param for %s, got %v, expected a team reviewer", method, param)
+	}
+
+	method = "PostComment"
+	reviewerExp := regexp.MustCompile(`@(.*?),`)
+	if calls, ok := gh.calledMethods[method]; !ok {
+		t.Fatal("Comment wasn't posted stating user status")
+	} else if len(calls) != 1 {
+		t.Fatalf("Wrong number of calls for %s, got %d, expected 1", method, len(calls))
+	} else if params := calls[0]; len(params) != 2 {
+		t.Fatalf("Wrong number of params for %s, got %d, expected 2", method, len(params))
+	} else if param := params[0]; param != "pr1" {
+		t.Fatalf("Wrong first param for %s, got %v, expected pr1", method, param)
+	} else if param, ok := params[1].(string); !ok {
+		t.Fatalf("Got non-string second param for %s", method)
+	} else if submatches := reviewerExp.FindStringSubmatch(param); len(submatches) != 2 || !github.IsTeamReviewer(submatches[1]) {
+		t.Fatalf("%s called without a team reviewer (found %v) in the comment: %s", method, submatches, param)
+	}
+}
diff --git a/.ci/magician/cmd/mock_cloudbuild_test.go b/.ci/magician/cmd/mock_cloudbuild_test.go
new file mode 100644
index 000000000000..f4da97a06771
--- /dev/null
+++ b/.ci/magician/cmd/mock_cloudbuild_test.go
@@ -0,0 +1,20 @@
+package cmd
+
+type mockCloudBuild struct {
+	calledMethods map[string][][]any
+}
+
+func (m *mockCloudBuild) ApproveCommunityChecker(prNumber, commitSha string) error {
+	m.calledMethods["ApproveCommunityChecker"] = append(m.calledMethods["ApproveCommunityChecker"], []any{prNumber, commitSha})
+	return nil
+}
+
+func (m *mockCloudBuild) GetAwaitingApprovalBuildLink(prNumber, commitSha string) (string, error) {
+	m.calledMethods["GetAwaitingApprovalBuildLink"] = append(m.calledMethods["GetAwaitingApprovalBuildLink"], []any{prNumber, commitSha})
+	return "mocked_url", nil
+}
+
+func (m *mockCloudBuild) TriggerMMPresubmitRuns(commitSha string, substitutions map[string]string) error {
+	m.calledMethods["TriggerMMPresubmitRuns"] = append(m.calledMethods["TriggerMMPresubmitRuns"], []any{commitSha, substitutions})
+	return nil
+}
diff --git a/.ci/magician/cmd/mock_github_test.go b/.ci/magician/cmd/mock_github_test.go
new file mode 100644
index 000000000000..dbd20f582a32
--- /dev/null
+++ b/.ci/magician/cmd/mock_github_test.go
@@ -0,0 +1,66 @@
+package cmd
+
+import "magician/github"
+
+type mockGithub struct {
+	author            string
+	userType          github.UserType
+	firstReviewer     string
+	previousReviewers []string
+	calledMethods     map[string][][]any
+}
+
+func (m *mockGithub) GetPullRequestAuthor(prNumber string) (string, error) {
+	m.calledMethods["GetPullRequestAuthor"] = append(m.calledMethods["GetPullRequestAuthor"], []any{prNumber})
+	return m.author, nil
+}
+
+func (m *mockGithub) GetUserType(user string) github.UserType {
+	m.calledMethods["GetUserType"] = append(m.calledMethods["GetUserType"], []any{user})
+	return m.userType
+}
+
+func (m *mockGithub) GetPullRequestRequestedReviewer(prNumber string) (string, error) {
+	m.calledMethods["GetPullRequestRequestedReviewer"] = append(m.calledMethods["GetPullRequestRequestedReviewer"], []any{prNumber})
+	return m.firstReviewer, nil
+}
+
+func (m *mockGithub) GetPullRequestPreviousAssignedReviewers(prNumber string) ([]string, error) {
+	m.calledMethods["GetPullRequestPreviousAssignedReviewers"] = append(m.calledMethods["GetPullRequestPreviousAssignedReviewers"], []any{prNumber})
+	return m.previousReviewers, nil
+}
+
+func (m *mockGithub) RequestPullRequestReviewer(prNumber string, reviewer string) error {
+	m.calledMethods["RequestPullRequestReviewer"] = append(m.calledMethods["RequestPullRequestReviewer"], []any{prNumber, reviewer})
+	return nil
+}
+
+func (m *mockGithub) PostComment(prNumber string, comment string) error {
+	m.calledMethods["PostComment"] = append(m.calledMethods["PostComment"], []any{prNumber, comment})
+	return nil
+}
+
+func (m *mockGithub) AddLabel(prNumber string, label string) error {
+	m.calledMethods["AddLabel"] = append(m.calledMethods["AddLabel"], []any{prNumber, label})
+	return nil
+}
+
+func (m *mockGithub) RemoveLabel(prNumber string, label string) error {
+	m.calledMethods["RemoveLabel"] = append(m.calledMethods["RemoveLabel"], []any{prNumber, label})
+	return nil
+}
+
+func (m *mockGithub) PostBuildStatus(prNumber string, title string, state string, targetUrl string, commitSha string) error {
+	m.calledMethods["PostBuildStatus"] = append(m.calledMethods["PostBuildStatus"], []any{prNumber, title, state, targetUrl, commitSha})
+	return nil
+}
+
+func (m *mockGithub) CreateWorkflowDispatchEvent(workflowFileName string, inputs map[string]any) error {
+	m.calledMethods["CreateWorkflowDispatchEvent"] = append(m.calledMethods["CreateWorkflowDispatchEvent"], []any{workflowFileName, inputs})
+	return nil
+}
+
+func (m *mockGithub) GetPullRequestLabelIDs(prNumber string) (map[int]struct{}, error) {
+	m.calledMethods["GetPullRequestLabelIDs"] = append(m.calledMethods["GetPullRequestLabelIDs"], []any{prNumber})
+	return nil, nil
+}
diff --git a/.ci/magician/cmd/mock_runner_test.go b/.ci/magician/cmd/mock_runner_test.go
new file mode 100644
index 000000000000..16867dca123a
--- /dev/null
+++ b/.ci/magician/cmd/mock_runner_test.go
@@ -0,0 +1,105 @@
+package cmd
+
+import (
+	"container/list"
+	"errors"
+	"fmt"
+	"log"
+)
+
+type mockRunner struct {
+	calledMethods map[string][][]any
+	cmdResults    map[string]string
+	cwd           string
+	dirStack      *list.List
+}
+
+func NewMockRunner() *mockRunner {
+	return &mockRunner{
+		calledMethods: make(map[string][][]any),
+		cmdResults: map[string]string{
+			"/mock/dir/tfc git [clone -b auto-pr-pr1 https://modular-magician:*******@github.com/modular-magician/docs-examples /mock/dir/tfoics] []":                "",
+			"/mock/dir/tpgb git [clone -b auto-pr-pr1 https://modular-magician:*******@github.com/modular-magician/terraform-google-conversion /mock/dir/tfc] []":    "",
+			" git [clone -b auto-pr-pr1 https://modular-magician:*******@github.com/modular-magician/terraform-provider-google /mock/dir/tpg] []":                    "",
+			"/mock/dir/tpg git [clone -b auto-pr-pr1 https://modular-magician:*******@github.com/modular-magician/terraform-provider-google-beta /mock/dir/tpgb] []": "",
+			"/mock/dir/magic-modules git [diff HEAD origin/main tools/missing-test-detector] []":                                                                     "",
+			"/mock/dir/magic-modules/tools/diff-processor bin/diff-processor [breaking-changes] []":                                                                  "",
+			"/mock/dir/magic-modules/tools/diff-processor make [build] [OLD_REF=auto-pr-pr1-old NEW_REF=auto-pr-pr1]":                                                "",
+			"/mock/dir/magic-modules/tools/missing-test-detector go [mod edit -replace google/provider/new=/mock/dir/tpgb] []":                                       "",
+			"/mock/dir/magic-modules/tools/missing-test-detector go [mod edit -replace google/provider/old=/mock/dir/tpgbold] []":                                    "",
+			"/mock/dir/magic-modules/tools/missing-test-detector go [mod tidy] []":                                                                                   "",
+			"/mock/dir/magic-modules/tools/missing-test-detector go [run . -services-dir=/mock/dir/tpgb/google-beta/services] []":                                    "## Missing test report\nYour PR includes resource fields which are not covered by any test.\n\nResource: `google_folder_access_approval_settings` (3 total tests)\nPlease add an acceptance test which includes these fields. The test should include the following:\n\n```hcl\nresource \"google_folder_access_approval_settings\" \"primary\" {\n  uncovered_field = # value needed\n}\n\n```\n",
+			"/mock/dir/tfc git [diff origin/auto-pr-pr1-old origin/auto-pr-pr1 --shortstat] []":                                                                      " 1 file changed, 10 insertions(+)\n",
+			"/mock/dir/tfc git [fetch origin auto-pr-pr1-old] []":                                                                                                    "",
+			"/mock/dir/tfoics git [diff origin/auto-pr-pr1-old origin/auto-pr-pr1 --shortstat] []":                                                                   "",
+			"/mock/dir/tfoics git [fetch origin auto-pr-pr1-old] []":                                                                                                 "",
+			"/mock/dir/tpg git [diff origin/auto-pr-pr1-old origin/auto-pr-pr1 --shortstat] []":                                                                      " 2 files changed, 40 insertions(+)\n",
+			"/mock/dir/tpg git [fetch origin auto-pr-pr1-old] []":                                                                                                    "",
+			"/mock/dir/tpgb find [. -type f -name *.go -exec sed -i.bak s~github.com/hashicorp/terraform-provider-google-beta~google/provider/new~g {} +] []":        "",
+			"/mock/dir/tpgb git [diff origin/auto-pr-pr1-old origin/auto-pr-pr1 --shortstat] []":                                                                     " 2 files changed, 40 insertions(+)\n",
+			"/mock/dir/tpgb git [fetch origin auto-pr-pr1-old] []":                                                                                                   "",
+			"/mock/dir/tpgb sed [-i.bak s|github.com/hashicorp/terraform-provider-google-beta|google/provider/new|g go.mod] []":                                      "",
+			"/mock/dir/tpgb sed [-i.bak s|github.com/hashicorp/terraform-provider-google-beta|google/provider/new|g go.sum] []":                                      "",
+			"/mock/dir/tpgbold find [. -type f -name *.go -exec sed -i.bak s~github.com/hashicorp/terraform-provider-google-beta~google/provider/old~g {} +] []":     "",
+			"/mock/dir/tpgbold git [checkout origin/auto-pr-pr1-old] []":                                                                                             "",
+			"/mock/dir/tpgbold sed [-i.bak s|github.com/hashicorp/terraform-provider-google-beta|google/provider/old|g go.mod] []":                                   "",
+			"/mock/dir/tpgbold sed [-i.bak s|github.com/hashicorp/terraform-provider-google-beta|google/provider/old|g go.sum] []":                                   "",
+		},
+		cwd:      "/mock/dir/magic-modules/.ci/magician",
+		dirStack: list.New(),
+	}
+}
+
+func (mr *mockRunner) GetCWD() string {
+	return mr.cwd
+}
+
+func (mr *mockRunner) Copy(src, dest string) error {
+	mr.calledMethods["Copy"] = append(mr.calledMethods["Copy"], []any{src, dest})
+	return nil
+}
+
+func (mr *mockRunner) RemoveAll(path string) error {
+	mr.calledMethods["RemoveAll"] = append(mr.calledMethods["RemoveAll"], []any{path})
+	return nil
+}
+
+func (mr *mockRunner) PushDir(path string) error {
+	if mr.dirStack == nil {
+		mr.dirStack = list.New()
+	}
+	mr.dirStack.PushBack(mr.cwd)
+	mr.cwd = path
+	return nil
+}
+
+func (mr *mockRunner) PopDir() error {
+	if mr.dirStack == nil {
+		return errors.New("tried to pop an empty dir stack")
+	}
+	backVal := mr.dirStack.Remove(mr.dirStack.Back())
+	dir, ok := backVal.(string)
+	if !ok {
+		return fmt.Errorf("back value of dir stack was a %T, expected string", backVal)
+	}
+	mr.cwd = dir
+	return nil
+}
+
+func (mr *mockRunner) Run(name string, args, env []string) (string, error) {
+	mr.calledMethods["Run"] = append(mr.calledMethods["Run"], []any{mr.cwd, name, args, env})
+	cmd := fmt.Sprintf("%s %s %v %v", mr.cwd, name, args, env)
+	if result, ok := mr.cmdResults[cmd]; ok {
+		return result, nil
+	}
+	fmt.Printf("unknown command %s\n", cmd)
+	return "", nil
+}
+
+func (mr *mockRunner) MustRun(name string, args, env []string) string {
+	out, err := mr.Run(name, args, env)
+	if err != nil {
+		log.Fatal(err)
+	}
+	return out
+}
diff --git a/.ci/magician/cmd/root.go b/.ci/magician/cmd/root.go
new file mode 100644
index 000000000000..b19c57e6ea24
--- /dev/null
+++ b/.ci/magician/cmd/root.go
@@ -0,0 +1,45 @@
+/*
+Copyright © 2023 NAME HERE <EMAIL ADDRESS>
+*/
+package cmd
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+)
+
+// rootCmd represents the base command when called without any subcommands
+
+var rootCmd = &cobra.Command{
+	Use: "magician",
+	PersistentPreRun: func(cmd *cobra.Command, args []string) {
+		fmt.Printf("Inside rootCmd PersistentPreRun with args: %v\n", args)
+	},
+	Short: "A brief description of your application",
+	Long: `A longer description that spans multiple lines and likely contains
+examples and usage of using your application. For example:
+
+Cobra is a CLI library for Go that empowers applications.
+This application is a tool to generate the needed files
+to quickly create a Cobra application.`,
+	// Uncomment the following line if your bare application
+	// has an action associated with it:
+	// Run: func(cmd *cobra.Command, args []string) { },
+}
+
+// Execute adds all child commands to the root command and sets flags appropriately.
+// This is called by main.main(). It only needs to happen once to the rootCmd.
+func Execute() {
+	err := rootCmd.Execute()
+	if err != nil {
+		os.Exit(1)
+	}
+}
+
+func init() {
+	// Cobra also supports local flags, which will only run
+	// when this action is called directly.
+	rootCmd.Flags().BoolP("toggle", "t", false, "Help message for toggle")
+}
diff --git a/.ci/magician/cmd/test_tgc.go b/.ci/magician/cmd/test_tgc.go
new file mode 100644
index 000000000000..109cd1fea32b
--- /dev/null
+++ b/.ci/magician/cmd/test_tgc.go
@@ -0,0 +1,44 @@
+package cmd
+
+import (
+	"fmt"
+	"magician/github"
+	"os"
+
+	"github.com/spf13/cobra"
+)
+
+var testTGCCmd = &cobra.Command{
+	Use:   "test-tgc",
+	Short: "Run tgc unit tests via workflow dispatch",
+	Long: `This command runs tgc unit tests via workflow dispatch
+
+	The following PR details are expected as environment variables:
+        1. COMMIT_SHA
+        2. PR_NUMBER
+	`,
+	Run: func(cmd *cobra.Command, args []string) {
+		commit := os.Getenv("COMMIT_SHA")
+		pr := os.Getenv("PR_NUMBER")
+
+		gh := github.NewGithubService()
+
+		execTestTGC(commit, pr, gh)
+	},
+}
+
+func execTestTGC(commit, pr string, gh ttGithub) {
+	if err := gh.CreateWorkflowDispatchEvent("test-tgc.yml", map[string]any{
+		"owner":  "modular-magician",
+		"repo":   "terraform-google-conversion",
+		"branch": "auto-pr-" + pr,
+		"sha":    commit,
+	}); err != nil {
+		fmt.Printf("Error creating workflow dispatch event: %v\n", err)
+		os.Exit(1)
+	}
+}
+
+func init() {
+	rootCmd.AddCommand(testTGCCmd)
+}
diff --git a/.ci/magician/cmd/test_tgc_test.go b/.ci/magician/cmd/test_tgc_test.go
new file mode 100644
index 000000000000..f9004ddf0e8a
--- /dev/null
+++ b/.ci/magician/cmd/test_tgc_test.go
@@ -0,0 +1,22 @@
+package cmd
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestExecTestTGC(t *testing.T) {
+	gh := &mockGithub{
+		calledMethods: make(map[string][][]any),
+	}
+
+	execTestTGC("sha1", "pr1", gh)
+
+	method := "CreateWorkflowDispatchEvent"
+	expected := [][]any{{"test-tgc.yml", map[string]any{"branch": "auto-pr-pr1", "owner": "modular-magician", "repo": "terraform-google-conversion", "sha": "sha1"}}}
+	if calls, ok := gh.calledMethods[method]; !ok {
+		t.Fatal("Workflow dispatch event not created")
+	} else if !reflect.DeepEqual(calls, expected) {
+		t.Fatalf("Wrong calls for %s, got %v, expected %v", method, calls, expected)
+	}
+}
diff --git a/.ci/magician/cmd/test_tpg.go b/.ci/magician/cmd/test_tpg.go
new file mode 100644
index 000000000000..b5543d18899a
--- /dev/null
+++ b/.ci/magician/cmd/test_tpg.go
@@ -0,0 +1,60 @@
+package cmd
+
+import (
+	"fmt"
+	"magician/github"
+	"os"
+
+	"github.com/spf13/cobra"
+)
+
+type ttGithub interface {
+	CreateWorkflowDispatchEvent(string, map[string]any) error
+}
+
+var testTPGCmd = &cobra.Command{
+	Use:   "test-tpg",
+	Short: "Run provider unit tests via workflow dispatch",
+	Long: `This command runs provider unit tests via workflow dispatch
+
+	The following PR details are expected as environment variables:
+        1. VERSION (beta or ga)
+        2. COMMIT_SHA
+        3. PR_NUMBER
+	`,
+	Run: func(cmd *cobra.Command, args []string) {
+		version := os.Getenv("VERSION")
+		commit := os.Getenv("COMMIT_SHA")
+		pr := os.Getenv("PR_NUMBER")
+
+		gh := github.NewGithubService()
+
+		execTestTPG(version, commit, pr, gh)
+	},
+}
+
+func execTestTPG(version, commit, pr string, gh ttGithub) {
+	var repo string
+	if version == "ga" {
+		repo = "terraform-provider-google"
+	} else if version == "beta" {
+		repo = "terraform-provider-google-beta"
+	} else {
+		fmt.Println("invalid version specified")
+		os.Exit(1)
+	}
+
+	if err := gh.CreateWorkflowDispatchEvent("test-tpg.yml", map[string]any{
+		"owner":  "modular-magician",
+		"repo":   repo,
+		"branch": "auto-pr-" + pr,
+		"sha":    commit,
+	}); err != nil {
+		fmt.Printf("Error creating workflow dispatch event: %v\n", err)
+		os.Exit(1)
+	}
+}
+
+func init() {
+	rootCmd.AddCommand(testTPGCmd)
+}
diff --git a/.ci/magician/cmd/test_tpg_test.go b/.ci/magician/cmd/test_tpg_test.go
new file mode 100644
index 000000000000..ad77c7596f21
--- /dev/null
+++ b/.ci/magician/cmd/test_tpg_test.go
@@ -0,0 +1,34 @@
+package cmd
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestExecTestTPG(t *testing.T) {
+	gh := &mockGithub{
+		calledMethods: make(map[string][][]any),
+	}
+
+	execTestTPG("beta", "sha1", "pr1", gh)
+
+	method := "CreateWorkflowDispatchEvent"
+	expected := [][]any{{"test-tpg.yml", map[string]any{"branch": "auto-pr-pr1", "owner": "modular-magician", "repo": "terraform-provider-google-beta", "sha": "sha1"}}}
+	if calls, ok := gh.calledMethods[method]; !ok {
+		t.Fatal("Workflow dispatch event not created")
+	} else if !reflect.DeepEqual(calls, expected) {
+		t.Fatalf("Wrong calls for %s, got %v, expected %v", method, calls, expected)
+	}
+
+	gh.calledMethods = make(map[string][][]any)
+
+	execTestTPG("ga", "sha1", "pr1", gh)
+
+	method = "CreateWorkflowDispatchEvent"
+	expected = [][]any{{"test-tpg.yml", map[string]any{"branch": "auto-pr-pr1", "owner": "modular-magician", "repo": "terraform-provider-google", "sha": "sha1"}}}
+	if calls, ok := gh.calledMethods[method]; !ok {
+		t.Fatal("Workflow dispatch event not created")
+	} else if !reflect.DeepEqual(calls, expected) {
+		t.Fatalf("Wrong calls for %s, got %v, expected %v", method, calls, expected)
+	}
+}
diff --git a/.ci/magician/exec/runner.go b/.ci/magician/exec/runner.go
new file mode 100644
index 000000000000..c9423237b285
--- /dev/null
+++ b/.ci/magician/exec/runner.go
@@ -0,0 +1,107 @@
+package exec
+
+import (
+	"container/list"
+	"errors"
+	"fmt"
+	"log"
+	"os"
+	"os/exec"
+	"path/filepath"
+
+	cp "github.com/otiai10/copy"
+)
+
+type actualRunner struct {
+	cwd      string
+	dirStack *list.List
+}
+
+type Runner interface {
+	GetCWD() string
+	Copy(src, dest string) error
+	RemoveAll(path string) error
+	PushDir(path string) error
+	PopDir() error
+	WriteFile(name, data string) error
+	Run(name string, args, env []string) (string, error)
+	MustRun(name string, args, env []string) string
+}
+
+func NewRunner() (Runner, error) {
+	wd, err := os.Getwd()
+	if err != nil {
+		return nil, err
+	}
+	return &actualRunner{
+		cwd:      wd,
+		dirStack: list.New(),
+	}, nil
+}
+
+func (ar *actualRunner) GetCWD() string {
+	return ar.cwd
+}
+
+func (ar *actualRunner) Copy(src, dest string) error {
+	return cp.Copy(ar.abs(src), ar.abs(dest))
+}
+
+func (ar *actualRunner) RemoveAll(path string) error {
+	return os.RemoveAll(ar.abs(path))
+}
+
+// PushDir changes the directory for the runner to the desired path and saves the previous directory in the stack.
+func (ar *actualRunner) PushDir(path string) error {
+	if ar.dirStack == nil {
+		return errors.New("attempted to push dir, but stack was nil")
+	}
+	ar.dirStack.PushFront(ar.cwd)
+	ar.cwd = ar.abs(path)
+	return nil
+}
+
+// PopDir removes the most recently added directory from the stack and changes front to it.
+func (ar *actualRunner) PopDir() error {
+	if ar.dirStack == nil || ar.dirStack.Len() == 0 {
+		return errors.New("attempted to pop dir, but stack was nil or empty")
+	}
+	frontVal := ar.dirStack.Remove(ar.dirStack.Front())
+	dir, ok := frontVal.(string)
+	if !ok {
+		return fmt.Errorf("last element in dir stack was a %T, expected string", frontVal)
+	}
+	ar.cwd = dir
+	return nil
+}
+
+func (ar *actualRunner) WriteFile(name, data string) error {
+	return os.WriteFile(ar.abs(name), []byte(data), 0644)
+}
+
+func (ar *actualRunner) Run(name string, args, env []string) (string, error) {
+	cmd := exec.Command(name, args...)
+	cmd.Dir = ar.cwd
+	cmd.Env = append(os.Environ(), env...)
+	out, err := cmd.Output()
+	if err != nil {
+		exitErr := err.(*exec.ExitError)
+		return string(out), fmt.Errorf("error running %s: %v\nstdout:\n%sstderr:\n%s", name, err, out, exitErr.Stderr)
+	}
+	return string(out), nil
+}
+
+func (ar *actualRunner) MustRun(name string, args, env []string) string {
+	out, err := ar.Run(name, args, env)
+	if err != nil {
+		log.Fatal(err)
+	}
+	return out
+}
+
+func (ar *actualRunner) abs(path string) string {
+	if !filepath.IsAbs(path) {
+		return filepath.Join(ar.cwd, path)
+	}
+	return path
+}
diff --git a/.ci/containers/membership-checker/REVIEWER_ASSIGNMENT_COMMENT.md b/.ci/magician/github/REVIEWER_ASSIGNMENT_COMMENT.md
similarity index 100%
rename from .ci/containers/membership-checker/REVIEWER_ASSIGNMENT_COMMENT.md
rename to .ci/magician/github/REVIEWER_ASSIGNMENT_COMMENT.md
diff --git a/.ci/magician/github/get.go b/.ci/magician/github/get.go
new file mode 100644
index 000000000000..48f3cdab1a3e
--- /dev/null
+++ b/.ci/magician/github/get.go
@@ -0,0 +1,92 @@
+package github
+
+import (
+	"fmt"
+	utils "magician/utility"
+)
+
+func (gh *github) GetPullRequestAuthor(prNumber string) (string, error) {
+	url := fmt.Sprintf("https://api.github.com/repos/GoogleCloudPlatform/magic-modules/issues/%s", prNumber)
+
+	var pullRequest struct {
+		User struct {
+			Login string `json:"login"`
+		} `json:"user"`
+	}
+
+	_, err := utils.RequestCall(url, "GET", gh.token, &pullRequest, nil)
+	if err != nil {
+		return "", err
+	}
+
+	return pullRequest.User.Login, nil
+}
+
+func (gh *github) GetPullRequestRequestedReviewer(prNumber string) (string, error) {
+	url := fmt.Sprintf("https://api.github.com/repos/GoogleCloudPlatform/magic-modules/pulls/%s/requested_reviewers", prNumber)
+
+	var requestedReviewers struct {
+		Users []struct {
+			Login string `json:"login"`
+		} `json:"users"`
+	}
+
+	_, err := utils.RequestCall(url, "GET", gh.token, &requestedReviewers, nil)
+	if err != nil {
+		return "", err
+	}
+
+	if requestedReviewers.Users == nil || len(requestedReviewers.Users) == 0 {
+		return "", nil
+	}
+
+	return requestedReviewers.Users[0].Login, nil
+}
+
+func (gh *github) GetPullRequestPreviousAssignedReviewers(prNumber string) ([]string, error) {
+	url := fmt.Sprintf("https://api.github.com/repos/GoogleCloudPlatform/magic-modules/pulls/%s/reviews", prNumber)
+
+	var reviews []struct {
+		User struct {
+			Login string `json:"login"`
+		} `json:"user"`
+	}
+
+	_, err := utils.RequestCall(url, "GET", gh.token, &reviews, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	previousAssignedReviewers := map[string]struct{}{}
+	for _, review := range reviews {
+		previousAssignedReviewers[review.User.Login] = struct{}{}
+	}
+
+	result := []string{}
+	for key := range previousAssignedReviewers {
+		result = append(result, key)
+	}
+
+	return result, nil
+}
+
+func (gh *github) GetPullRequestLabelIDs(prNumber string) (map[int]struct{}, error) {
+	url := fmt.Sprintf("https://api.github.com/repos/GoogleCloudPlatform/magic-modules/pulls/%s/reviews", prNumber)
+
+	var labels []struct {
+		Label struct {
+			ID int `json:"id"`
+		} `json:"label"`
+	}
+
+	if _, err := utils.RequestCall(url, "GET", gh.token, &labels, nil); err != nil {
+		return nil, err
+	}
+
+	var result map[int]struct{}
+	for _, label := range labels {
+		result[label.Label.ID] = struct{}{}
+	}
+
+	return result, nil
+}
diff --git a/.ci/magician/github/init.go b/.ci/magician/github/init.go
new file mode 100644
index 000000000000..3822a0274c5f
--- /dev/null
+++ b/.ci/magician/github/init.go
@@ -0,0 +1,35 @@
+package github
+
+import (
+	"fmt"
+	"os"
+)
+
+// GithubService represents the service for GitHub interactions.
+type github struct {
+	token string
+}
+
+type GithubService interface {
+	GetPullRequestAuthor(prNumber string) (string, error)
+	GetPullRequestRequestedReviewer(prNumber string) (string, error)
+	GetPullRequestPreviousAssignedReviewers(prNumber string) ([]string, error)
+	GetPullRequestLabelIDs(prNumber string) (map[int]struct{}, error)
+	GetUserType(user string) UserType
+	PostBuildStatus(prNumber, title, state, targetURL, commitSha string) error
+	PostComment(prNumber, comment string) error
+	RequestPullRequestReviewer(prNumber, assignee string) error
+	AddLabel(prNumber, label string) error
+	RemoveLabel(prNumber, label string) error
+	CreateWorkflowDispatchEvent(workflowFileName string, inputs map[string]any) error
+}
+
+func NewGithubService() GithubService {
+	githubToken, ok := os.LookupEnv("GITHUB_TOKEN")
+	if !ok {
+		fmt.Println("Did not provide GITHUB_TOKEN environment variable")
+		os.Exit(1)
+	}
+
+	return &github{token: githubToken}
+}
diff --git a/.ci/containers/membership-checker/membership.go b/.ci/magician/github/membership.go
similarity index 57%
rename from .ci/containers/membership-checker/membership.go
rename to .ci/magician/github/membership.go
index 26768ddd30ec..460769bae63c 100644
--- a/.ci/containers/membership-checker/membership.go
+++ b/.ci/magician/github/membership.go
@@ -1,7 +1,8 @@
-package main
+package github
 
 import (
 	"fmt"
+	utils "magician/utility"
 	"math/rand"
 	"time"
 
@@ -26,70 +27,73 @@ var (
 	}
 
 	// This is for new team members who are onboarding
-	trustedContributors = []string{}
+	trustedContributors = []string{
+		"BBBmau",
+	}
 
 	// This is for reviewers who are "on vacation": will not receive new review assignments but will still receive re-requests for assigned PRs.
 	onVacationReviewers = []string{
-		"slevenick",
+		"hao-nan-li",
+		"roaks3",
 	}
 )
 
-type userType int64
+type UserType int64
 
 const (
-	communityUserType userType = iota
-	googlerUserType
-	coreContributorUserType
+	CommunityUserType UserType = iota
+	GooglerUserType
+	CoreContributorUserType
 )
 
-func (ut userType) String() string {
+func (ut UserType) String() string {
 	switch ut {
-	case googlerUserType:
+	case GooglerUserType:
 		return "Googler"
-	case coreContributorUserType:
+	case CoreContributorUserType:
 		return "Core Contributor"
 	default:
 		return "Community Contributor"
 	}
 }
 
-// Check if a user is team member to not request a random reviewer
-func isTeamMember(author string) bool {
-	return slices.Contains(reviewerRotation, author) || slices.Contains(trustedContributors, author)
-}
-
-func isTeamReviewer(reviewer string) bool {
-	return slices.Contains(reviewerRotation, reviewer)
-}
-
-func getUserType(user, GITHUB_TOKEN string) userType {
-	if isTeamMember(user) {
+func (gh *github) GetUserType(user string) UserType {
+	if isTeamMember(user, gh.token) {
 		fmt.Println("User is a team member")
-		return coreContributorUserType
+		return CoreContributorUserType
 	}
 
-	if isOrgMember(user, "GoogleCloudPlatform", GITHUB_TOKEN) {
+	if isOrgMember(user, "GoogleCloudPlatform", gh.token) {
 		fmt.Println("User is a GCP org member")
-		return googlerUserType
+		return GooglerUserType
 	}
 
-	if isOrgMember(user, "googlers", GITHUB_TOKEN) {
+	if isOrgMember(user, "googlers", gh.token) {
 		fmt.Println("User is a googlers org member")
-		return googlerUserType
+		return GooglerUserType
 	}
 
-	return communityUserType
+	return CommunityUserType
+}
+
+// Check if a user is team member to not request a random reviewer
+func isTeamMember(author, githubToken string) bool {
+	return slices.Contains(reviewerRotation, author) || slices.Contains(trustedContributors, author)
+}
+
+func IsTeamReviewer(reviewer string) bool {
+	return slices.Contains(reviewerRotation, reviewer)
 }
 
-func isOrgMember(author, org, GITHUB_TOKEN string) bool {
+func isOrgMember(author, org, githubToken string) bool {
 	url := fmt.Sprintf("https://api.github.com/orgs/%s/members/%s", org, author)
-	res, _ := requestCall(url, "GET", GITHUB_TOKEN, nil, nil)
+	res, _ := utils.RequestCall(url, "GET", githubToken, nil, nil)
 
 	return res != 404
 }
 
-func getRandomReviewer() string {
-	availableReviewers := removes(reviewerRotation, onVacationReviewers)
+func GetRandomReviewer() string {
+	availableReviewers := utils.Removes(reviewerRotation, onVacationReviewers)
 	rand.Seed(time.Now().UnixNano())
 	reviewer := availableReviewers[rand.Intn(len(availableReviewers))]
 	return reviewer
diff --git a/.ci/containers/membership-checker/membership_test.go b/.ci/magician/github/membership_test.go
similarity index 96%
rename from .ci/containers/membership-checker/membership_test.go
rename to .ci/magician/github/membership_test.go
index 3e3e2b2989dd..1f2264bdf3c2 100644
--- a/.ci/containers/membership-checker/membership_test.go
+++ b/.ci/magician/github/membership_test.go
@@ -1,4 +1,4 @@
-package main
+package github
 
 import (
 	"testing"
diff --git a/.ci/magician/github/reviewer_assignment.go b/.ci/magician/github/reviewer_assignment.go
new file mode 100644
index 000000000000..b3e968145d9f
--- /dev/null
+++ b/.ci/magician/github/reviewer_assignment.go
@@ -0,0 +1,52 @@
+package github
+
+import (
+	"fmt"
+	"strings"
+	"text/template"
+
+	_ "embed"
+)
+
+var (
+	//go:embed REVIEWER_ASSIGNMENT_COMMENT.md
+	reviewerAssignmentComment string
+)
+
+// Returns a list of users to request review from, as well as a new primary reviewer if this is the first run.
+func ChooseReviewers(firstRequestedReviewer string, previouslyInvolvedReviewers []string) (reviewersToRequest []string, newPrimaryReviewer string) {
+	hasPrimaryReviewer := false
+	newPrimaryReviewer = ""
+
+	if firstRequestedReviewer != "" {
+		hasPrimaryReviewer = true
+	}
+
+	for _, reviewer := range previouslyInvolvedReviewers {
+		if IsTeamReviewer(reviewer) {
+			hasPrimaryReviewer = true
+			reviewersToRequest = append(reviewersToRequest, reviewer)
+		}
+	}
+
+	if !hasPrimaryReviewer {
+		newPrimaryReviewer = GetRandomReviewer()
+		reviewersToRequest = append(reviewersToRequest, newPrimaryReviewer)
+	}
+
+	return reviewersToRequest, newPrimaryReviewer
+}
+
+func FormatReviewerComment(newPrimaryReviewer string, authorUserType UserType, trusted bool) string {
+	tmpl, err := template.New("REVIEWER_ASSIGNMENT_COMMENT.md").Parse(reviewerAssignmentComment)
+	if err != nil {
+		panic(fmt.Sprintf("Unable to parse REVIEWER_ASSIGNMENT_COMMENT.md: %s", err))
+	}
+	sb := new(strings.Builder)
+	tmpl.Execute(sb, map[string]any{
+		"reviewer":       newPrimaryReviewer,
+		"authorUserType": authorUserType.String(),
+		"trusted":        trusted,
+	})
+	return sb.String()
+}
diff --git a/.ci/containers/membership-checker/reviewer_assignment_test.go b/.ci/magician/github/reviewer_assignment_test.go
similarity index 88%
rename from .ci/containers/membership-checker/reviewer_assignment_test.go
rename to .ci/magician/github/reviewer_assignment_test.go
index 4763b650ee1b..b96ac59a7389 100644
--- a/.ci/containers/membership-checker/reviewer_assignment_test.go
+++ b/.ci/magician/github/reviewer_assignment_test.go
@@ -1,7 +1,8 @@
-package main
+package github
 
 import (
 	"fmt"
+	utils "magician/utility"
 	"strings"
 	"testing"
 
@@ -18,7 +19,7 @@ func TestChooseReviewers(t *testing.T) {
 		"no previous review requests assigns new reviewer from team": {
 			FirstRequestedReviewer:      "",
 			PreviouslyInvolvedReviewers: []string{},
-			ExpectReviewersFromList:     removes(reviewerRotation, onVacationReviewers),
+			ExpectReviewersFromList:     utils.Removes(reviewerRotation, onVacationReviewers),
 			ExpectPrimaryReviewer:       true,
 		},
 		"first requested reviewer means that primary reviewer was already selected": {
@@ -35,7 +36,7 @@ func TestChooseReviewers(t *testing.T) {
 		"previously involved reviewers that are not team members are ignored": {
 			FirstRequestedReviewer:      "",
 			PreviouslyInvolvedReviewers: []string{"foobar"},
-			ExpectReviewersFromList:     removes(reviewerRotation, onVacationReviewers),
+			ExpectReviewersFromList:     utils.Removes(reviewerRotation, onVacationReviewers),
 			ExpectPrimaryReviewer:       true,
 		},
 		"only previously involved team member reviewers will have review requested": {
@@ -56,7 +57,7 @@ func TestChooseReviewers(t *testing.T) {
 		tc := tc
 		t.Run(tn, func(t *testing.T) {
 			t.Parallel()
-			reviewers, primaryReviewer := chooseReviewers(tc.FirstRequestedReviewer, tc.PreviouslyInvolvedReviewers)
+			reviewers, primaryReviewer := ChooseReviewers(tc.FirstRequestedReviewer, tc.PreviouslyInvolvedReviewers)
 			if tc.ExpectPrimaryReviewer && primaryReviewer == "" {
 				t.Error("wanted primary reviewer to be returned; got none")
 			}
@@ -82,22 +83,22 @@ func TestChooseReviewers(t *testing.T) {
 func TestFormatReviewerComment(t *testing.T) {
 	cases := map[string]struct {
 		Reviewer       string
-		AuthorUserType userType
+		AuthorUserType UserType
 		Trusted        bool
 	}{
 		"community contributor": {
 			Reviewer:       "foobar",
-			AuthorUserType: communityUserType,
+			AuthorUserType: CommunityUserType,
 			Trusted:        false,
 		},
 		"googler": {
 			Reviewer:       "foobar",
-			AuthorUserType: googlerUserType,
+			AuthorUserType: GooglerUserType,
 			Trusted:        true,
 		},
 		"core contributor": {
 			Reviewer:       "foobar",
-			AuthorUserType: coreContributorUserType,
+			AuthorUserType: CoreContributorUserType,
 			Trusted:        true,
 		},
 	}
@@ -106,7 +107,7 @@ func TestFormatReviewerComment(t *testing.T) {
 		tc := tc
 		t.Run(tn, func(t *testing.T) {
 			t.Parallel()
-			comment := formatReviewerComment(tc.Reviewer, tc.AuthorUserType, tc.Trusted)
+			comment := FormatReviewerComment(tc.Reviewer, tc.AuthorUserType, tc.Trusted)
 			t.Log(comment)
 			if !strings.Contains(comment, fmt.Sprintf("@%s", tc.Reviewer)) {
 				t.Errorf("wanted comment to contain @%s; does not.", tc.Reviewer)
@@ -117,7 +118,7 @@ func TestFormatReviewerComment(t *testing.T) {
 			if strings.Contains(comment, fmt.Sprintf("~%s~", tc.AuthorUserType.String())) {
 				t.Errorf("wanted user type (%s) in comment to not be crossed out, but it is", tc.AuthorUserType.String())
 			}
-			for _, ut := range []userType{communityUserType, googlerUserType, coreContributorUserType} {
+			for _, ut := range []UserType{CommunityUserType, GooglerUserType, CoreContributorUserType} {
 				if ut != tc.AuthorUserType && !strings.Contains(comment, fmt.Sprintf("~%s~", ut.String())) {
 					t.Errorf("wanted other user type (%s) in comment to be crossed out, but it is not", ut)
 				}
diff --git a/.ci/magician/github/set.go b/.ci/magician/github/set.go
new file mode 100644
index 000000000000..90f116f673fb
--- /dev/null
+++ b/.ci/magician/github/set.go
@@ -0,0 +1,116 @@
+package github
+
+import (
+	"fmt"
+	utils "magician/utility"
+	"net/http"
+)
+
+func (gh *github) PostBuildStatus(prNumber, title, state, targetURL, commitSha string) error {
+	url := fmt.Sprintf("https://api.github.com/repos/GoogleCloudPlatform/magic-modules/statuses/%s", commitSha)
+
+	postBody := map[string]string{
+		"context":    title,
+		"state":      state,
+		"target_url": targetURL,
+	}
+
+	_, err := utils.RequestCall(url, "POST", gh.token, nil, postBody)
+	if err != nil {
+		return err
+	}
+
+	fmt.Printf("Successfully posted build status to pull request %s\n", prNumber)
+
+	return nil
+}
+
+func (gh *github) PostComment(prNumber, comment string) error {
+	url := fmt.Sprintf("https://api.github.com/repos/GoogleCloudPlatform/magic-modules/issues/%s/comments", prNumber)
+
+	body := map[string]string{
+		"body": comment,
+	}
+
+	reqStatusCode, err := utils.RequestCall(url, "POST", gh.token, nil, body)
+	if err != nil {
+		return err
+	}
+
+	if reqStatusCode != http.StatusCreated {
+		return fmt.Errorf("error posting comment for PR %s", prNumber)
+	}
+
+	fmt.Printf("Successfully posted comment to pull request %s\n", prNumber)
+
+	return nil
+}
+
+func (gh *github) RequestPullRequestReviewer(prNumber, assignee string) error {
+	url := fmt.Sprintf("https://api.github.com/repos/GoogleCloudPlatform/magic-modules/pulls/%s/requested_reviewers", prNumber)
+
+	body := map[string][]string{
+		"reviewers":      {assignee},
+		"team_reviewers": {},
+	}
+
+	reqStatusCode, err := utils.RequestCall(url, "POST", gh.token, nil, body)
+	if err != nil {
+		return err
+	}
+
+	if reqStatusCode != http.StatusCreated {
+		return fmt.Errorf("error adding reviewer for PR %s", prNumber)
+	}
+
+	fmt.Printf("Successfully added reviewer %s to pull request %s\n", assignee, prNumber)
+
+	return nil
+}
+
+func (gh *github) AddLabel(prNumber, label string) error {
+	url := fmt.Sprintf("https://api.github.com/repos/GoogleCloudPlatform/magic-modules/issues/%s/labels", prNumber)
+
+	body := map[string][]string{
+		"labels": {label},
+	}
+	_, err := utils.RequestCall(url, "POST", gh.token, nil, body)
+
+	if err != nil {
+		return fmt.Errorf("failed to add %s label: %s", label, err)
+	}
+
+	return nil
+
+}
+
+func (gh *github) RemoveLabel(prNumber, label string) error {
+	url := fmt.Sprintf("https://api.github.com/repos/GoogleCloudPlatform/magic-modules/issues/%s/labels/%s", prNumber, label)
+	_, err := utils.RequestCall(url, "DELETE", gh.token, nil, nil)
+
+	if err != nil {
+		return fmt.Errorf("failed to remove %s label: %s", label, err)
+	}
+
+	return nil
+}
+
+func (gh *github) CreateWorkflowDispatchEvent(workflowFileName string, inputs map[string]any) error {
+	url := fmt.Sprintf("https://api.github.com/repos/GoogleCloudPlatform/magic-modules/actions/workflows/%s/dispatches", workflowFileName)
+	resp, err := utils.RequestCall(url, "POST", gh.token, nil, map[string]any{
+		"ref":    "main",
+		"inputs": inputs,
+	})
+
+	if resp != 200 && resp != 204 {
+		return fmt.Errorf("server returned %d creating workflow dispatch event", resp)
+	}
+
+	if err != nil {
+		return fmt.Errorf("failed to create workflow dispatch event: %s", err)
+	}
+
+	fmt.Printf("Successfully created workflow dispatch event for %s with inputs %v", workflowFileName, inputs)
+
+	return nil
+}
diff --git a/.ci/containers/membership-checker/go.mod b/.ci/magician/go.mod
similarity index 66%
rename from .ci/containers/membership-checker/go.mod
rename to .ci/magician/go.mod
index 903d7b9a2c54..4ebd7498dd30 100644
--- a/.ci/containers/membership-checker/go.mod
+++ b/.ci/magician/go.mod
@@ -1,25 +1,30 @@
-module membership-checker
+module magician
 
-go 1.20
+go 1.19
 
 require (
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/spf13/cobra v1.7.0
+	github.com/spf13/pflag v1.0.5 // indirect
 	golang.org/x/exp v0.0.0-20230314191032-db074128a8ec
 	google.golang.org/api v0.112.0
 )
 
+require github.com/otiai10/copy v1.12.0
+
 require (
 	cloud.google.com/go/compute v1.18.0 // indirect
 	cloud.google.com/go/compute/metadata v0.2.3 // indirect
-	github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/google/uuid v1.3.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.2.3 // indirect
 	github.com/googleapis/gax-go/v2 v2.7.0 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	golang.org/x/net v0.8.0 // indirect
+	golang.org/x/net v0.15.0 // indirect
 	golang.org/x/oauth2 v0.6.0 // indirect
-	golang.org/x/sys v0.6.0 // indirect
-	golang.org/x/text v0.8.0 // indirect
+	golang.org/x/sys v0.12.0 // indirect
+	golang.org/x/text v0.13.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20230303212802-e74f57abe488 // indirect
 	google.golang.org/grpc v1.53.0 // indirect
diff --git a/.ci/containers/membership-checker/go.sum b/.ci/magician/go.sum
similarity index 88%
rename from .ci/containers/membership-checker/go.sum
rename to .ci/magician/go.sum
index da929d371259..a7ac8b6878b0 100644
--- a/.ci/containers/membership-checker/go.sum
+++ b/.ci/magician/go.sum
@@ -9,6 +9,7 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
+github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
@@ -16,8 +17,9 @@ github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.m
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e h1:1r7pUrabqp18hOBcwBwiTsbnFeTZHV9eER/QT5JVZxY=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -47,8 +49,18 @@ github.com/googleapis/enterprise-certificate-proxy v0.2.3 h1:yk9/cqRKtT9wXZSsRH9
 github.com/googleapis/enterprise-certificate-proxy v0.2.3/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k=
 github.com/googleapis/gax-go/v2 v2.7.0 h1:IcsPKeInNvYi7eqSaDjiZqDDKu5rsmunY0Y1YupQSSQ=
 github.com/googleapis/gax-go/v2 v2.7.0/go.mod h1:TEop28CZZQ2y+c0VxMUmu1lV+fQx57QpBWsYpwqHJx8=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/otiai10/copy v1.12.0 h1:cLMgSQnXBs1eehF0Wy/FAGsgDTDmAqFR7rQylBb1nDY=
+github.com/otiai10/copy v1.12.0/go.mod h1:rSaLseMUsZFFbsFGc7wCJnnkTAvdc5L6VWxPE4308Ww=
+github.com/otiai10/mint v1.5.1 h1:XaPLeE+9vGbuyEHem1JNk3bYc7KKqyI/na0/mLd/Kks=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/spf13/cobra v1.7.0 h1:hyqWnYt1ZQShIddO5kBpj3vu05/++x6tJ6dg8EC572I=
+github.com/spf13/cobra v1.7.0/go.mod h1:uLxZILRyS/50WlhOIKD7W6V5bgeIt+4sICxh6uRMrb0=
+github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
@@ -72,8 +84,8 @@ golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.8.0 h1:Zrh2ngAOFYneWTAIAPethzeaQLuHwhuBkuV6ZiRnUaQ=
-golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
+golang.org/x/net v0.15.0 h1:ugBLEUaxABaB5AJqW9enI0ACdci2RUd4eP51NTBvuJ8=
+golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.6.0 h1:Lh8GPgSKBfWSwFvtuWOfeI3aAAnbXTSutYxJiOJFgIw=
 golang.org/x/oauth2 v0.6.0/go.mod h1:ycmewcwgD4Rpr3eZJLSB4Kyyljb3qDh40vJ8STE5HKw=
@@ -84,13 +96,13 @@ golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5h
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.8.0 h1:57P1ETyNKtuIjB4SRd15iJxuhj8Gc416Y78H3qgMh68=
-golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
diff --git a/.ci/magician/main.go b/.ci/magician/main.go
new file mode 100644
index 000000000000..7cf107ae4fbc
--- /dev/null
+++ b/.ci/magician/main.go
@@ -0,0 +1,11 @@
+/*
+Copyright © 2023 NAME HERE <EMAIL ADDRESS>
+
+*/
+package main
+
+import "magician/cmd"
+
+func main() {
+	cmd.Execute()
+}
diff --git a/.ci/magician/utility/utils.go b/.ci/magician/utility/utils.go
new file mode 100644
index 000000000000..6bc778f97e3f
--- /dev/null
+++ b/.ci/magician/utility/utils.go
@@ -0,0 +1,64 @@
+package utility
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+
+	"golang.org/x/exp/slices"
+)
+
+func RequestCall(url, method, credentials string, result any, body any) (int, error) {
+	client := &http.Client{}
+	jsonBody, err := json.Marshal(body)
+	if err != nil {
+		return 1, fmt.Errorf("error marshaling JSON: %s", err)
+	}
+	req, err := http.NewRequest(method, url, bytes.NewBuffer(jsonBody))
+	if err != nil {
+		return 2, fmt.Errorf("error creating request: %s", err)
+	}
+	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", credentials))
+	req.Header.Set("Content-Type", "application/json")
+	fmt.Println("")
+	fmt.Println("request url: ", url)
+	fmt.Println("request body: ", string(jsonBody)) // Convert to string
+	fmt.Println("")
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return 3, err
+	}
+	defer resp.Body.Close()
+
+	respBodyBytes, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return 5, err
+	}
+
+	fmt.Println("response status-code: ", resp.StatusCode)
+	fmt.Println("response body: ", string(respBodyBytes)) // Convert to string
+	fmt.Println("")
+
+	// Decode the response, if needed
+	if result != nil {
+		if err = json.Unmarshal(respBodyBytes, &result); err != nil {
+			return 4, err
+		}
+	}
+
+	return resp.StatusCode, nil
+}
+
+func Removes(s1 []string, s2 []string) []string {
+	result := make([]string, 0, len(s1))
+
+	for _, v := range s1 {
+		if !slices.Contains(s2, v) {
+			result = append(result, v)
+		}
+	}
+	return result
+}
diff --git a/.ci/containers/membership-checker/utils_test.go b/.ci/magician/utility/utils_test.go
similarity index 95%
rename from .ci/containers/membership-checker/utils_test.go
rename to .ci/magician/utility/utils_test.go
index adea48f933cb..2f82538ab7c1 100644
--- a/.ci/containers/membership-checker/utils_test.go
+++ b/.ci/magician/utility/utils_test.go
@@ -1,4 +1,4 @@
-package main
+package utility
 
 import (
 	"reflect"
@@ -41,7 +41,7 @@ func TestRemovesList(t *testing.T) {
 		},
 	}
 	for tn, tc := range cases {
-		result := removes(tc.Original, tc.Removal)
+		result := Removes(tc.Original, tc.Removal)
 		if !reflect.DeepEqual(result, tc.Expected) {
 			t.Errorf("bad: %s, '%s' removes '%s' expect result: %s, but got: %s", tn, tc.Original, tc.Removal, tc.Expected, result)
 		}
diff --git a/.ci/scripts/bash-plus/downstream-waiter/wait_for_commit.sh b/.ci/scripts/bash-plus/downstream-waiter/wait_for_commit.sh
index f9e8315760cd..81baf6e724b2 100755
--- a/.ci/scripts/bash-plus/downstream-waiter/wait_for_commit.sh
+++ b/.ci/scripts/bash-plus/downstream-waiter/wait_for_commit.sh
@@ -26,9 +26,13 @@ fi
 while true; do
     if [ "$BASE_BRANCH" != "main" ]; then
         SYNC_HEAD="$(git rev-parse --short origin/$SYNC_BRANCH)"
-        BASE_PARENT="$(git rev-parse --short origin/$BASE_BRANCH~)"
+        BASE_PARENT="$(git rev-parse --short $SHA~)"
         if [ "$SYNC_HEAD" == "$BASE_PARENT" ]; then
             break;
+        else
+            echo "sync branch is at: $SYNC_HEAD"
+            echo "current commit is $SHA"
+            git fetch origin $SYNC_BRANCH
         fi
     else 
         commits="$(git log --pretty=%H origin/$SYNC_BRANCH..origin/$BASE_BRANCH | tail -n 1)"
diff --git a/.ci/scripts/bash-plus/pre-build-validator/validate.sh b/.ci/scripts/bash-plus/pre-build-validator/validate.sh
deleted file mode 100755
index 2b9463ba4c00..000000000000
--- a/.ci/scripts/bash-plus/pre-build-validator/validate.sh
+++ /dev/null
@@ -1,27 +0,0 @@
-#!/bin/bash
-
-# remove after 9/2023
-
-set -e
-
-gh_repo=magic-modules
-
-post_body=$(jq -n \
-  --arg owner "GoogleCloudPlatform" \
-  --arg repo "$gh_repo" \
-  --arg sha "$COMMIT_SHA" \
-  '{
-    ref: "main",
-    inputs: {
-      owner: $owner,
-      repo: $repo,
-      sha: $sha,
-    }
-  }')
-
-curl \
-  -X POST \
-  -u "modular-magician:$GITHUB_TOKEN" \
-  -H "Accept: application/vnd.github.v3+json" \
-  "https://api.github.com/repos/GoogleCloudPlatform/magic-modules/actions/workflows/pre-build-validation.yml/dispatches" \
-  -d "$post_body"
diff --git a/.ci/scripts/build-environment/downstream-builder/generate_downstream.sh b/.ci/scripts/build-environment/downstream-builder/generate_downstream.sh
index f1e054aa2558..88ac64f5be87 100755
--- a/.ci/scripts/build-environment/downstream-builder/generate_downstream.sh
+++ b/.ci/scripts/build-environment/downstream-builder/generate_downstream.sh
@@ -1,6 +1,7 @@
 #! /bin/bash
 
 set -e
+NEWLINE=$'\n'
 
 function clone_repo() {
     SCRATCH_OWNER=modular-magician
@@ -96,17 +97,19 @@ elif [ "$COMMAND" == "base" ]; then
     COMMIT_MESSAGE="Old generated code for MM PR $REFERENCE."
 elif [ "$COMMAND" == "downstream" ]; then
     BRANCH=downstream-pr-$REFERENCE
-    COMMIT_MESSAGE="$(git log -1 --pretty=%B "$REFERENCE")"
+    ORIGINAL_MESSAGE="$(git log -1 --pretty=%B "$REFERENCE")"
+    COMMIT_MESSAGE="$ORIGINAL_MESSAGE$NEWLINE[upstream:$REFERENCE]"
 fi
 
 if [ "$REPO" == "terraform" ]; then
     pushd $LOCAL_PATH
     go mod download
-    find . -type f -not -wholename "./.git*" -not -wholename "./.changelog*" -not -name ".travis.yml" -not -name ".golangci.yml" -not -name "CHANGELOG.md" -not -name "GNUmakefile" -not -name "docscheck.sh" -not -name "LICENSE" -not -name "README.md" -not -wholename "./examples*" -not -name ".go-version" -not -name ".hashibot.hcl" -print0 | xargs -0 git rm
+    find . -type f -not -wholename "./.git*" -not -wholename "./.changelog*" -not -name ".travis.yml" -not -name ".golangci.yml" -not -name "CHANGELOG.md" -not -name "CHANGELOG_v*.md" -not -name "GNUmakefile" -not -name "docscheck.sh" -not -name "LICENSE" -not -name "README.md" -not -wholename "./examples*" -not -name ".go-version" -not -name ".hashibot.hcl" -print0 | xargs -0 git rm
     popd
 fi
 
 if [ "$REPO" == "terraform-google-conversion" ]; then
+    # Generate tfplan2cai
     pushd $LOCAL_PATH
     # clear out the templates as they are copied during
     # generation from mmv1/third_party/validator/tests/data
@@ -119,6 +122,13 @@ if [ "$REPO" == "terraform-google-conversion" ]; then
 
     bundle exec compiler.rb -a -e terraform -f validator -o $LOCAL_PATH/tfplan2cai -v $VERSION
 
+    # Generate cai2hcl
+    pushd $LOCAL_PATH
+    rm -rf ./cai2hcl/*
+    popd
+
+    bundle exec compiler.rb -a -e terraform -f tgc_cai2hcl -o $LOCAL_PATH/cai2hcl -v $VERSION
+
     if [ "$COMMAND" == "downstream" ]; then
       pushd $LOCAL_PATH
       go get -d github.com/hashicorp/terraform-provider-google-beta@$BASE_BRANCH
diff --git a/.ci/scripts/go-plus/gcb-terraform-vcr-tester/test_terraform_vcr.sh b/.ci/scripts/go-plus/gcb-terraform-vcr-tester/test_terraform_vcr.sh
index 1cfa480e6409..23975f99c82e 100755
--- a/.ci/scripts/go-plus/gcb-terraform-vcr-tester/test_terraform_vcr.sh
+++ b/.ci/scripts/go-plus/gcb-terraform-vcr-tester/test_terraform_vcr.sh
@@ -13,6 +13,7 @@ gh_repo=terraform-provider-google-beta
 NEWLINE=$'\n'
 
 new_branch="auto-pr-$pr_number"
+old_branch="auto-pr-$pr_number-old"
 git_remote=https://github.com/$github_username/$gh_repo
 local_path=$GOPATH/src/github.com/hashicorp/$gh_repo
 mkdir -p "$(dirname $local_path)"
@@ -21,9 +22,13 @@ pushd $local_path
 
 # Only skip tests if we can tell for sure that no go files were changed
 echo "Checking for modified go files"
+# Fetch the latest commit in the old branch, associating them locally
+# This will let us compare the old and new branch by name on the next line
+git fetch origin $old_branch:$old_branch --depth 1
 # get the names of changed files and look for go files
 # (ignoring "no matches found" errors from grep)
-gofiles=$(git diff --name-only HEAD~1 | { grep -e "\.go$" -e "go.mod$" -e "go.sum$" || test $? = 1; })
+# If there was no code generated, this will always return nothing (because there's no diff)
+gofiles=$(git diff $new_branch $old_branch --name-only | { grep -e "\.go$" -e "go.mod$" -e "go.sum$" || test $? = 1; })
 if [[ -z $gofiles ]]; then
   echo "Skipping tests: No go files changed"
   exit 0
@@ -324,4 +329,4 @@ fi
 
 set -e
 
-update_status ${test_state}
+update_status ${test_state}
\ No newline at end of file
diff --git a/.ci/scripts/go-plus/github-differ/generate_comment.sh b/.ci/scripts/go-plus/github-differ/generate_comment.sh
index 455d6fa63aa6..191dde497fb4 100755
--- a/.ci/scripts/go-plus/github-differ/generate_comment.sh
+++ b/.ci/scripts/go-plus/github-differ/generate_comment.sh
@@ -57,12 +57,14 @@ if ! git diff --exit-code origin/$OLD_BRANCH origin/$NEW_BRANCH; then
 fi
 popd
 
-## Breaking change setup and execution
+## Diff processor - TPG
 set +e
 pushd $MM_LOCAL_PATH/tools/diff-processor
 cp -r $TPG_LOCAL_PATH old/
 cp -r $TPG_LOCAL_PATH new/
 make build OLD_REF=$OLD_BRANCH NEW_REF=$NEW_BRANCH
+
+### Breaking changes
 TPG_BREAKING="$(bin/diff-processor breaking-changes)"
 retVal=$?
 if [ $retVal -ne 0 ]; then
@@ -70,16 +72,35 @@ if [ $retVal -ne 0 ]; then
     BREAKING_CHANGE_BUILD_FAILURE=1
 fi
 
+### Add labels
+GITHUB_TOKEN=$GITHUB_TOKEN $MM_LOCAL_PATH/tools/diff-processor/bin/diff-processor add-labels $PR_NUMBER
 rm -rf ./old/ ./new/ ./bin/
+popd
+set -e
+
+## Diff processor - TPGB
+set +e
+pushd $MM_LOCAL_PATH/tools/diff-processor
 cp -r $TPGB_LOCAL_PATH old/
 cp -r $TPGB_LOCAL_PATH new/
 make build OLD_REF=$OLD_BRANCH NEW_REF=$NEW_BRANCH
+
+### Breaking changes
 TPGB_BREAKING="$(bin/diff-processor breaking-changes)"
 retVal=$?
 if [ $retVal -ne 0 ]; then
     TPGB_BREAKING=""
     BREAKING_CHANGE_BUILD_FAILURE=1
 fi
+
+### Add labels
+GITHUB_TOKEN=$GITHUB_TOKEN $MM_LOCAL_PATH/tools/diff-processor/bin/diff-processor add-labels $PR_NUMBER
+rm -rf ./old/ ./new/ ./bin/
+popd
+set -e
+
+## Report breaking change failures
+set +e
 if [ $BREAKING_CHANGE_BUILD_FAILURE -eq 0 ]; then
     echo "Breaking changes succeeded"
     # Export variables here so that they can be used in compare_breaking_changes
@@ -91,7 +112,6 @@ else
     echo "Breaking changes failed"
     BREAKINGCHANGES="## Breaking Change Detection Failed${NEWLINE}The breaking change detector crashed during execution. This is usually due to the downstream provider(s) failing to compile. Please investigate or follow up with your reviewer."
 fi
-popd
 set -e
 
 ## Missing test setup and execution
diff --git a/.ci/scripts/go-plus/magician/exec.sh b/.ci/scripts/go-plus/magician/exec.sh
new file mode 100755
index 000000000000..acd9714f09bd
--- /dev/null
+++ b/.ci/scripts/go-plus/magician/exec.sh
@@ -0,0 +1,28 @@
+#!/bin/bash
+
+# Get the directory of the current script
+DIR="$(dirname $(realpath $0))"
+
+# Construct the path to the Go program directory and binary
+GO_PROGRAM_DIR="$DIR/../../../magician/"
+GO_BINARY="$GO_PROGRAM_DIR/magician_binary"
+
+pushd $GO_PROGRAM_DIR
+
+set -x
+# Check if the binary exists
+if [ ! -f "$GO_BINARY" ]; then
+    # If it doesn't exist, compile the binary
+    echo "Building the magician binary at $GO_BINARY"
+    go build -o "$GO_BINARY"
+fi
+
+# If there are no arguments only compile the binary
+if [ "$#" -eq 0 ]; then
+    echo "No arguments provided"
+    exit 0
+fi
+
+# Run the binary and pass all arguments
+$GO_BINARY "$@"
+set +x
diff --git a/.ci/scripts/go-plus/tgc-tester/test_tgc.sh b/.ci/scripts/go-plus/tgc-tester/test_tgc.sh
index d4023a2d79d4..10a7dcebe01f 100755
--- a/.ci/scripts/go-plus/tgc-tester/test_tgc.sh
+++ b/.ci/scripts/go-plus/tgc-tester/test_tgc.sh
@@ -2,71 +2,30 @@
 
 set -e
 
-pr_number=$1
-mm_commit_sha=$2
-build_id=$3
-project_id=$4
-build_step=$5
-gh_repo=$6
+pr_number=${PR_NUMBER:-$1}
+mm_commit_sha=${COMMIT_SHA:-$2}
+gh_repo=terraform-google-conversion
 github_username=modular-magician
-
 new_branch="auto-pr-$pr_number"
-git_remote=https://$github_username:$GITHUB_TOKEN@github.com/$github_username/$gh_repo
-local_path=$GOPATH/src/github.com/GoogleCloudPlatform/$gh_repo
-mkdir -p "$(dirname $local_path)"
-git clone $git_remote $local_path --branch $new_branch --depth 2
-pushd $local_path
-
-# Only skip tests if we can tell for sure that no go files were changed
-echo "Checking for modified go files"
-# get the names of changed files and look for go files
-# (ignoring "no matches found" errors from grep)
-gofiles=$(git diff --name-only HEAD~1 | { grep "\.go$" || test $? = 1; })
-if [[ -z $gofiles ]]; then
-    echo "Skipping tests: No go files changed"
-    exit 0
-else
-    echo "Running tests: Go files changed"
-fi
-
-post_body=$( jq -n \
-  --arg context "${gh_repo}-test" \
-  --arg target_url "https://console.cloud.google.com/cloud-build/builds;region=global/${build_id};step=${build_step}?project=${project_id}" \
-  --arg state "pending" \
-  '{context: $context, target_url: $target_url, state: $state}')
-
-curl \
-  -X POST \
-  -u "$github_username:$GITHUB_TOKEN" \
-  -H "Accept: application/vnd.github.v3+json" \
-  "https://api.github.com/repos/GoogleCloudPlatform/magic-modules/statuses/$mm_commit_sha" \
-  -d "$post_body"
-
-set +e
-
-go mod edit -replace github.com/hashicorp/terraform-provider-google-beta=github.com/$github_username/terraform-provider-google-beta@$new_branch
-go mod tidy
-
-make test
-exit_code=$?
-
-set -e
-
-if [ $exit_code -ne 0 ]; then
-	state="failure"
-else
-	state="success"
-fi
 
-post_body=$( jq -n \
-  --arg context "${gh_repo}-test" \
-  --arg target_url "https://console.cloud.google.com/cloud-build/builds;region=global/${build_id};step=${build_step}?project=${project_id}" \
-  --arg state "${state}" \
-  '{context: $context, target_url: $target_url, state: $state}')
+post_body=$(jq -n \
+  --arg owner "$github_username" \
+  --arg branch "$new_branch" \
+  --arg repo "$gh_repo" \
+  --arg sha "$mm_commit_sha" \
+  '{
+    ref: "tgc-units",
+    inputs: {
+      owner: $owner,
+      repo: $repo,
+      branch: $branch,
+      sha: $sha
+    }
+  }')
 
 curl \
   -X POST \
   -u "$github_username:$GITHUB_TOKEN" \
   -H "Accept: application/vnd.github.v3+json" \
-  "https://api.github.com/repos/GoogleCloudPlatform/magic-modules/statuses/$mm_commit_sha" \
+  "https://api.github.com/repos/GoogleCloudPlatform/magic-modules/actions/workflows/test-tgc.yml/dispatches" \
   -d "$post_body"
diff --git a/.github/workflows/magic-modules.yml b/.github/workflows/magic-modules.yml
index a6596c6ce5c1..1a2c88510fa2 100644
--- a/.github/workflows/magic-modules.yml
+++ b/.github/workflows/magic-modules.yml
@@ -39,6 +39,15 @@ jobs:
         uses: actions/checkout@v3
         with:
           path: repo
+          fetch-depth: 2
+      - name: Merge base branch
+        id: pull_request
+        run: |
+          cd repo
+          git config user.name "modular-magician"
+          git config user.email "magic-modules@google.com"
+          git fetch origin ${{ github.base_ref }} # Fetch the base branch
+          git merge --no-ff origin/${{ github.base_ref }} # Merge with the base branch
       - name: Set up Ruby
         uses: ruby/setup-ruby@ec02537da5712d66d4d50a0f33b7eb52773b5ed1
         with:
diff --git a/.github/workflows/membership-checker.yml b/.github/workflows/membership-checker.yml
index a0c9b392599a..fbc1d10bba62 100644
--- a/.github/workflows/membership-checker.yml
+++ b/.github/workflows/membership-checker.yml
@@ -5,7 +5,7 @@ permissions: read-all
 on:
   pull_request:
     paths:
-      - '.ci/containers/membership-checker/**'
+      - '.ci/magician/**'
 
 jobs:
   build-and-unit-tests:
@@ -18,5 +18,5 @@ jobs:
           go-version: '^1.19.1'
       - name: Run membership checker unit tests
         run: |
-          cd .ci/containers/membership-checker
-          go test -v
+          cd .ci/magician
+          go test ./... -v
diff --git a/.github/workflows/pre-build-validation.yml b/.github/workflows/pre-build-validation.yml
deleted file mode 100644
index 2ce026431ea6..000000000000
--- a/.github/workflows/pre-build-validation.yml
+++ /dev/null
@@ -1,71 +0,0 @@
-name: Pre-Build Validation
-
-permissions:
-  actions: read
-  contents: read
-  statuses: write
-
-env:
-  status_suffix: "-pre-build-validation"
-
-on:
-  workflow_dispatch:
-    inputs:
-      owner:
-        description: 'The owner of the fork'
-        required: false
-        default: 'modular-magician'
-      repo:
-        description: 'The Base Repository to pull from'
-        required: false
-        default: 'magic-modules'
-      sha:
-        description: "The commit SHA in magic-modules repository to execute against and where the status result will be posted"
-        required: true
-
-jobs:
-  pre-build-validation:
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout Repository
-      uses: actions/checkout@v3
-      with:
-        repository: ${{ github.event.inputs.owner }}/${{ github.event.inputs.repo }}
-        ref: ${{ github.event.inputs.sha }}
-        path: repo
-        fetch-depth: 0
-    - name: Check for mmv1 product file changes
-      id: pull_request
-      run: |
-        cd repo
-        git config user.name "modular-magician"
-        git config user.email "magic-modules@google.com"
-        git merge --no-ff origin/main
-        yamlfiles=$(git diff --name-only origin/main -- mmv1/products)
-        if [ ! -z "$yamlfiles" ]; then
-          echo "yamlfiles=repo/${yamlfiles//$'\n'/ repo/}" >> $GITHUB_OUTPUT
-        fi
-    - name: Get Job URL
-      if: ${{ !failure() && steps.pull_request.outputs.yamlfiles != '' }}
-      id: get_job
-      run: |
-        response=$(curl --get -Ss -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -H "Accept: application/vnd.github.v3+json" "https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/attempts/${{ github.run_attempt }}/jobs")
-        html_url=$(echo "$response" | jq -r --arg job_name "${{ github.job }}" '.jobs | map(select(.name == $job_name)) | .[0].html_url')
-        echo "url=${html_url}" >> $GITHUB_OUTPUT
-    - name: Install yamllint
-      if: ${{ !failure() && steps.pull_request.outputs.yamlfiles != '' }}
-      run: pip install yamllint
-    - name: Lint YAML files
-      if: ${{ !failure() && steps.pull_request.outputs.yamlfiles != '' }}
-      run: yamllint -c repo/.yamllint ${{steps.pull_request.outputs.yamlfiles}}
-    - name: Post Result Status to Pull Request
-      if: ${{ !cancelled() && steps.pull_request.outputs.yamlfiles != '' }}
-      run: |
-        curl -X POST -H "Authorization: token ${{secrets.GITHUB_TOKEN}}" \
-        -H "Accept: application/vnd.github.v3+json" \
-        "https://api.github.com/repos/GoogleCloudPlatform/magic-modules/statuses/${{github.event.inputs.sha}}" \
-        -d '{
-        "context": "${{ github.event.inputs.repo }}${{ env.status_suffix }}",
-        "target_url": "${{ steps.get_job.outputs.url }}",
-        "state": "${{ job.status }}"
-        }'
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
new file mode 100644
index 000000000000..cd6776998c7c
--- /dev/null
+++ b/.github/workflows/scorecard.yml
@@ -0,0 +1,72 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '33 3 * * 0'
+  push:
+    branches: [ "main" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      # Uncomment the permissions below if installing in a private repository.
+      # contents: read
+      # actions: read
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@e38b1902ae4f44df626f11ba0734b14fb91f8f86 # v2.1.2
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecard on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@17573ee1cc1b9d061760f3a006fc4aac4f944fd5 # v2.2.4
+        with:
+          sarif_file: results.sarif
diff --git a/.github/workflows/test-tgc.yml b/.github/workflows/test-tgc.yml
index 7c8c8f7376de..e1654f092c1e 100644
--- a/.github/workflows/test-tgc.yml
+++ b/.github/workflows/test-tgc.yml
@@ -40,12 +40,19 @@ jobs:
       with:
         repository: ${{ github.event.inputs.owner }}/${{ github.event.inputs.repo }}
         ref: ${{ github.event.inputs.branch }}
-        path: tgc
         fetch-depth: 2
+    - name: Cache Go modules and build cache
+      uses: actions/cache@v3
+      with:
+        path: |
+          ~/go/pkg/mod
+        key: ${{ runner.os }}-test-${{ github.event.inputs.repo }}-${{ hashFiles('go.sum') }}
+        restore-keys: |
+          ${{ runner.os }}-test-${{ github.event.inputs.repo }}-${{ hashFiles('go.sum') }}
+          ${{ runner.os }}-test-${{ github.event.inputs.repo }}-
     - name: Check for Code Changes
       id: pull_request
       run: |
-        cd tgc
         gofiles=$(git diff --name-only HEAD~1 | { grep -e "\.go$" -e "go.mod$" -e "go.sum$" || test $? = 1; })
         if [ -z "$gofiles" ]; then
           echo "has_changes=false" >> $GITHUB_OUTPUT
@@ -72,18 +79,18 @@ jobs:
         }'
     - name: Set up Go
       if: ${{ !failure() && steps.pull_request.outputs.has_changes == 'true' }}
-      uses: actions/setup-go@v4
+      uses: actions/setup-go@v3
       with:
-        go-version: '^1.19.9'
+        go-version: '^1.19'
     - name: Build Terraform Google Conversion
       if: ${{ !failure() && steps.pull_request.outputs.has_changes == 'true' }}
       run: |
-        cd tgc
-        go build
+        go mod edit -replace github.com/hashicorp/terraform-provider-google-beta=github.com/${{ github.event.inputs.owner }}/terraform-provider-google-beta@${{ github.event.inputs.branch }}
+        go mod tidy
+        make build
     - name: Run Unit Tests
       if: ${{ !failure() && steps.pull_request.outputs.has_changes == 'true' }}
       run: |
-        cd tgc
         make test
     - name: Post Result Status to Pull Request
       if: ${{ !cancelled() }}
diff --git a/.github/workflows/test-tpg.yml b/.github/workflows/test-tpg.yml
index 698785a415d2..de61efccb631 100644
--- a/.github/workflows/test-tpg.yml
+++ b/.github/workflows/test-tpg.yml
@@ -40,12 +40,20 @@ jobs:
       with:
         repository: ${{ github.event.inputs.owner }}/${{ github.event.inputs.repo }}
         ref: ${{ github.event.inputs.branch }}
-        path: provider
         fetch-depth: 2
+    - name: Cache Go modules and build cache
+      uses: actions/cache@v3
+      with:
+        path: |
+          ~/go/pkg/mod
+          ~/.cache/go-build
+        key: ${{ runner.os }}-test-${{ github.event.inputs.repo }}-${{hashFiles('go.sum','google-*/transport/**','google-*/tpgresource/**','google-*/acctest/**','google-*/envvar/**','google-*/sweeper/**','google-*/verify/**') }}
+        restore-keys: |
+          ${{ runner.os }}-test-${{ github.event.inputs.repo }}-${{ hashFiles('go.sum') }}
+          ${{ runner.os }}-test-${{ github.event.inputs.repo }}-
     - name: Check for Code Changes
       id: pull_request
       run: |
-        cd provider
         gofiles=$(git diff --name-only HEAD~1 | { grep -e "\.go$" -e "go.mod$" -e "go.sum$" || test $? = 1; })
         if [ -z "$gofiles" ]; then
           echo "has_changes=false" >> $GITHUB_OUTPUT
@@ -72,28 +80,24 @@ jobs:
         }'
     - name: Set up Go
       if: ${{ !failure() && steps.pull_request.outputs.has_changes == 'true' }}
-      uses: actions/setup-go@v4
+      uses: actions/setup-go@v3
       with:
-        go-version: '^1.19.1'
+        go-version: '^1.19'
     - name: Build Provider
       if: ${{ !failure() && steps.pull_request.outputs.has_changes == 'true' }}
       run: |
-        cd provider
         go build
     - name: Run Unit Tests
       if: ${{ !failure() && steps.pull_request.outputs.has_changes == 'true' }}
       run: |
-        cd provider
-        make test
+        make testnolint TESTARGS="-p 4"
     - name: Lint Check
       if: ${{ !cancelled() && steps.pull_request.outputs.has_changes == 'true' }}
       run: |
-        cd provider
         make lint
     - name: Documentation Check
       if: ${{ !cancelled() && steps.pull_request.outputs.has_changes == 'true' }}
       run: |
-        cd provider
         make docscheck
     - name: Post Result Status to Pull Request
       if: ${{ !cancelled() }}
diff --git a/README.md b/README.md
index 7004dbf67973..1035baf6e4a7 100644
--- a/README.md
+++ b/README.md
@@ -3,7 +3,7 @@
 # Magic Modules
 
 Magic Modules is a code generator and CI system that's used to develop the Terraform providers
-for Google Platform, [`google`](https://github.com/hashicorp/terraform-provider-google) (or TPG) and
+for Google Cloud Platform, [`google`](https://github.com/hashicorp/terraform-provider-google) (or TPG) and
 [`google-beta`](https://github.com/hashicorp/terraform-provider-google-beta) (or TPGB).
 
 Magic Modules allows contributors to make changes against a single codebase and develop both
diff --git a/docs/content/best-practices/_index.md b/docs/content/best-practices/_index.md
index 192af1b155a4..81eebff07ebb 100644
--- a/docs/content/best-practices/_index.md
+++ b/docs/content/best-practices/_index.md
@@ -23,9 +23,10 @@ In complex cases, it is better to mark the field `ForceNew` to ensure that users
 
 Some resources, such as databases, have a significant risk of unrecoverable data loss if the resource is accidentally deleted due to a change to a ForceNew field. For these resources, the best practice is to add a `deletion_protection` field that defaults to `true`, which prevents the resource from being deleted if enabled. Although it is a small breaking change, for users, the benefits of `deletion_protection` defaulting to `true` outweigh the cost.
 
-APIs also sometimes add `deletion_protection` fields, which will generally default to `false` for backwards-compatibility reasons. Any `deletion_protection` API field added to an existing Terraform resource must match the API default initially. The default may be set to `true` in the next major release. For new Terraform resources, any `deletion_protection` field should default to `true` in Terraform regardless of the API default.
+APIs also sometimes add `deletion_protection` fields, which will generally default to `false` for backwards-compatibility reasons. Any `deletion_protection` API field added to an existing Terraform resource must match the API default initially. The default may be set to `true` in the next major release. For new Terraform resources, any `deletion_protection` field should default to `true` in Terraform regardless of the API default. When creating the corresponding Terraform field, the name
+should match the API field name (i.e. it need not literally be named `deletion_protection` if the API uses something different) and should be the same field type (example: if the API field is an enum, so should the Terraform field).
 
-A resource can have up to two `deletion_protection` fields (with different names): one that represents a field in the API, and one that is only in Terraform. This could happen because the API added its field after `deletion_protection` already existed in Terraform; it could also happen because a separate field was added in Terraform to make sure that `deletion_protection` is enabled by default. In either case, they should be reconciled into a single field (that defaults to `true`) in the next major release.
+A resource can have up to two `deletion_protection` fields (with different names): one that represents a field in the API, and one that is only in Terraform. This could happen because the API added its field after `deletion_protection` already existed in Terraform; it could also happen because a separate field was added in Terraform to make sure that `deletion_protection` is enabled by default. In either case, they should be reconciled into a single field (that defaults to enabled and whose name matches the API field) in the next major release.
 
 Resources that do not have a significant risk of unrecoverable data loss or similar critical concern will not be given `deletion_protection` fields.
 
@@ -40,3 +41,152 @@ Some resources need to let users control the actions taken add deletion time. Fo
 One common example is `ABANDON`, which is useful if the resource is safe to delete from Terraform but could cause problems if deleted from the API - for example, `google_bigtable_gc_policy` deletion can fail in replicated instances. `ABANDON` indicates that attempts to delete the resource should remove it from state without actually deleting it.
 
 See [magic-modules#13107](https://github.com/hashicorp/terraform-provider-google/pull/13107) for an example of adding a `deletion_policy` field to an existing resource.
+
+## Add labels and annotations support
+
+The new labels model and the new annotations model are introduced in [Terraform Google Provider 5.0.0](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/version_5_upgrade#provider).
+
+There are now three label-related fields with the new labels model:
+* The `labels` field is now non-authoritative and only manages the label keys defined in your configuration for the resource.
+* The `terraform_labels` cannot be specified directly by the user. It merges the labels defined in the resource's configuration and the default labels configured in the provider block. If the same label key exists on both the resource level and provider level, the value on the resource will override the provider-level default.
+* The output-only `effective_labels` will list all the labels present on the resource in GCP, including the labels configured through Terraform, the system, and other clients.
+
+There are now two annotation-related fields with the new annotations model:
+* The `annotations` field is now non-authoritative and only manages the annotation keys defined in your configuration for the resource.
+* The output-only `effective_annotations` will list all the annotations present on the resource in GCP, including the annotations configured through Terraform, the system, and other clients.
+
+This document describes how to add `labels` and `annotations` field to resources to support the new models.
+
+### Labels support
+When adding a new `labels` field, please make the changes below to support the new labels model. Otherwise, it has to wait for the next major release to make the changes.
+
+#### MMv1 resources
+
+1. Use the type `KeyValueLabels` for the standard resource `labels` field. The standard resource `labels` field could be the top level `labels` field or the nested `labels` field inside the top level `metadata` field. Don't add `default_from_api: true` to this field or don't use this type for other `labels` fields in the resource. `KeyValueLabels` will add all of changes required for the new model automatically.
+
+```yaml
+- !ruby/object:Api::Type::KeyValueLabels
+   name: 'labels'
+   description: |
+   The labels associated with this dataset. You can use these to
+   organize and group your datasets.
+```
+2. In the handwritten acceptance tests, add `labels` and `terraform_labels` to `ImportStateVerifyIgnore` if `labels` field is in the configuration.
+
+```go
+ImportStateVerifyIgnore: []string{"labels", "terraform_labels"}, 
+```
+3. In the corresponding data source, after the resource read method, call the function `tpgresource.SetDataSourceLabels(d)` to make `labels` and `terraform_labels` have all of the labels on the resource.
+
+```go
+err = resourceArtifactRegistryRepositoryRead(d, meta)
+if err != nil {
+   return err
+}
+
+if err := tpgresource.SetDataSourceLabels(d); err != nil {
+   return err
+}
+```
+
+#### Handwritten resources
+
+1. Add `tpgresource.SetLabelsDiff`  to `CustomizeDiff` of the resource.
+```go
+CustomizeDiff: customdiff.All(
+   tpgresource.SetLabelsDiff,
+),
+```
+2. Add `labels` field and add more attributes (such as `ForceNew: true,`, `Set: schema.HashString,`) to this field if necessary.
+```go
+"labels": {
+   Type:     schema.TypeMap,
+   Optional: true,
+   Elem:     &schema.Schema{Type: schema.TypeString},
+   Description: `A set of key/value label pairs to assign to the project.
+   
+   **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+   Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+},
+```
+3. Add output only field `terraform_labels` and add more attributes (such as `Set: schema.HashString,`) to this field if necessary. Don't add `ForceNew:true,` to this field.
+```go
+"terraform_labels": {
+   Type:        schema.TypeMap,
+   Computed:    true,
+   Description: `The combination of labels configured directly on the resource and default labels configured on the provider.`,
+   Elem:        &schema.Schema{Type: schema.TypeString},
+},
+```
+4. Add output only field `effective_labels` and add more attributes (such as `ForceNew: true,`, `Set: schema.HashString,`) to this field if necessary.
+```go
+"effective_labels": {
+   Type:        schema.TypeMap,
+   Computed:    true,
+   Description: `All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.`,
+   Elem:        &schema.Schema{Type: schema.TypeString},
+},
+```
+5. In the create method, use the value of `effective_labels` in API request.
+6. In the update method, use the value of `effective_labels` in API request.
+7. In the read mehtod, set `labels`, `terraform_labels` and `effective_labels` to state.
+```go
+if err := tpgresource.SetLabels(res.Labels, d, "labels"); err != nil {
+   return fmt.Errorf("Error setting labels: %s", err)
+}
+if err := tpgresource.SetLabels(res.Labels, d, "terraform_labels"); err != nil {
+   return fmt.Errorf("Error setting terraform_labels: %s", err)
+}
+if err := d.Set("effective_labels", res.Labels); err != nil {
+   return fmt.Errorf("Error setting effective_labels: %s", err)
+}
+```
+8. In the handwritten acceptance tests, add `labels` and `terraform_labels` to `ImportStateVerifyIgnore`.
+9. In the corresponding data source, after the resource read method, call the function `tpgresource.SetDataSourceLabels(d)` to make `labels` and `terraform_labels` have all of the labels on the resource.
+10. Add the documentation for these label-related fields.
+
+### Annotations support
+When adding a new `annotations` field, please make the changes below below to support the new annotations model. Otherwise, it has to wait for the next major release to make the breaking changes.
+
+#### MMv1 resources
+
+1. Use the type `KeyValueAnnotations` for the standard resource `annotations` field. The standard resource `annotations` field could be the top level `annotations` field or the nested `annotations` field inside the top level `metadata` field. Don't add `default_from_api: true` to this field or don't use this type for other `annotations` fields in the resource. `KeyValueAnnotations` will add all of changes required for the new model automatically.
+
+```yaml
+- !ruby/object:Api::Type::KeyValueAnnotations
+   name: 'annotations'
+   description: 'Client-specified annotations. This is distinct from labels.'
+```
+2. In the handwritten acceptance tests, add `annotations` to `ImportStateVerifyIgnore` if `annotations` field is in the configuration.
+
+```go
+ImportStateVerifyIgnore: []string{"annotations"},
+```
+3. In the corresponding data source, after the resource read method, call the function `tpgresource.SetDataSourceAnnotations(d)` to make `annotations` have all of the annotations on the resource.
+
+```go
+err = resourceSecretManagerSecretRead(d, meta)
+if err != nil {
+   return err
+}
+
+if err := tpgresource.SetDataSourceLabels(d); err != nil {
+   return err
+}
+
+if err := tpgresource.SetDataSourceAnnotations(d); err != nil {
+   return err
+}
+```
+
+#### Handwritten resources
+
+1. Add `tpgresource.SetAnnotationsDiff`  to `CustomizeDiff` of the resource.
+2. Add `annotations` field and add more attributes (such as `ForceNew: true,`, `Set: schema.HashString,`) to this field if necessary.
+3. Add output only field `effective_annotations` and add more attributes (such as `ForceNew: true,`, `Set: schema.HashString,`) to this field if necessary.
+4. In the create method, use the value of `effective_annotations` in API request.
+5. In the update method, use the value of `effective_annotations` in API request.
+6. In the read mehtod, set `annotations`, and `effective_annotations` to state.
+7. In the handwritten acceptance tests, add `annotations` to `ImportStateVerifyIgnore`.
+8. In the corresponding data source, after the resource read method, call the function `tpgresource.SetDataSourceAnnotations(d)` to make `annotations` have all of the labels on the resource.
+9. Add the documentation for these annotation-related fields.
\ No newline at end of file
diff --git a/docs/content/contribute/create-pr.md b/docs/content/contribute/create-pr.md
index 1711e8207206..5530537fa4e5 100644
--- a/docs/content/contribute/create-pr.md
+++ b/docs/content/contribute/create-pr.md
@@ -18,13 +18,16 @@ weight: 10
 
 1. A reviewer will automatically be assigned to your PR.
 1. Creating a new pull request or pushing a new commit automatically triggers our CI pipelines and workflows. After CI starts, downstream diff generation takes about 10 minutes; VCR tests can take up to 2 hours. If you are a community contributor, some tests will only run after approval from a reviewer.
+   - While convenient, relying on CI to test iterative changes to PRs often adds extreme latency to reviews if there are errors in test configurations or at runtime. We **strongly** recommend you [test your changes locally before pushing]({{< ref "/develop/run-tests" >}}) even after the initial change.
 1. If your assigned reviewer does not respond to changes on a pull request within two US business days, ping them on the pull request.
 
 {{< hint info >}}
 **TIP:** Speeding up review:
+1. [Test your changes locally before pushing]({{< ref "/develop/run-tests" >}}) to iterate faster.
+   - You can push them and test in parallel as well. New CI runs will preempt old ones where possible.
 1. Resolve failed [status checks](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/about-status-checks) quickly
-   - Ask your reviewer for help if you get stuck.
-1. [Self-review your PR]({{< ref "/contribute/review-pr" >}}") or ask someone you know to review
+   - Directly ask your reviewer for help if you don't know how to proceed. If there are failed checks they may only check in if there's no progress after a couple days.
+1. [Self-review your PR]({{< ref "/contribute/review-pr" >}}) or ask someone else familiar with Terraform to review
 {{< /hint >}}
 
 
diff --git a/docs/content/contribute/review-pr.md b/docs/content/contribute/review-pr.md
index 57cec1fcaf0c..28cf589838e3 100644
--- a/docs/content/contribute/review-pr.md
+++ b/docs/content/contribute/review-pr.md
@@ -18,19 +18,21 @@ This page provides guidelines for reviewing a Magic Modules pull request (PR).
       * features only available in beta are not included in the GA google provider.
       * features added to the GA provider are also included in the beta provider -- beta should be a strict superset of GA.
    1. no [breaking changes]({{< ref "/develop/make-a-breaking-change" >}}) are introduced without a valid justification. Add the `override-breaking-change` label if there is a valid justification.
-   1. verify the change actually resolves the linked issues, if any.
+      * remember to check for changes in default behaviour like changing the flags on delete! 
+   1. verify the change **fully** resolves the linked issues, if any. If it does not, change the "Fixes" message to "Part of".
 1. Check the tests added/modified to ensure that:
    1. all fields added/updated in the PR appear in at least one test.
       * It is advisable to test updating from a non-zero value to a zero value if feasible.
    1. all mutable fields are tested in at least one update test.
    1. all resources in the acceptance tests have a `tf-test` or `tf_test` prefix in their primary id field.
+   1. all handwritten test Config steps include import steps following them
    1. all related tests pass in GA for features promoted from beta to GA.
       {{< hint info >}}Note:
       Presubmit VCR tests do not run in GA. Manual testing is required for promoted GA features.
       {{< /hint >}}
    1. newly added or modified diff suppress functions are tested in at least one unit test.
    1. the linked issue (if any) is covered by at least one test that reproduces the issue
-      * for example - a bugfix should test the bug (or explain why it's not feasible to do so in the description) and an enhancement should test the new behaviour(s).
+      * for example - a bugfix should test the bug (or explain why it's not feasible to do so in the description, including manual results when possible) and an enhancement should test the new behaviour(s).
    1. all related PR presubmit tests have been completed successfully, including:
       * terraform-provider-breaking-change-test
       * presubmit-rake-tests
@@ -40,6 +42,7 @@ This page provides guidelines for reviewing a Magic Modules pull request (PR).
       {{< hint info >}}Note:
       Some acceptance tests may be skipped in VCR and manual testing is required.
       {{< /hint >}}
+   1. a significant number of preexisting tests have not been modified. Changing old tests often indicates a change is backwards incompatible.
 1. Check documentation to ensure
    1. resouce-level and field-level documentation are generated correctly for MMv1-based resource
    1. documentation is added manually for handwritten resources.   
diff --git a/docs/content/develop/add-handwritten-datasource.md b/docs/content/develop/add-handwritten-datasource.md
index 9c4038c3da44..76d75c1ffb9f 100644
--- a/docs/content/develop/add-handwritten-datasource.md
+++ b/docs/content/develop/add-handwritten-datasource.md
@@ -22,6 +22,8 @@ a new datasource there are 5 steps to doing so.
 
 1. Create a new datasource declaration file and a corresponding test file
 1. Add Schema and Read operation implementation
+   - If there is `labels` field with type `KeyValueLabels` in the corresponding resource, in the datasource Read operation implementation, after the resource read method, call the function `tpgresource.SetDataSourceLabels(d)` to make `labels` and `terraform_labels` have all of the labels on the resource.
+   - If there is `annotations` field with type `KeyValueAnnotations` in the corresponding resource, in the datasource Read operation implementation, after the resource read method, call the function `tpgresource.SetDataSourceAnnotations(d)` to make `annotations` have all of the annotations on the resource.
 1. Add the datasource to the `provider.go.erb` index
 1. Implement a test which will create and resources and read the corresponding
   datasource
diff --git a/docs/content/develop/breaking-changes.md b/docs/content/develop/breaking-changes.md
index 3afa8006093c..76bd2ba39a99 100644
--- a/docs/content/develop/breaking-changes.md
+++ b/docs/content/develop/breaking-changes.md
@@ -42,8 +42,13 @@ For more information, see
     the ID format will break the ability to parse the IDs from any deployments.
 * <a name="resource-import-format"></a> Removing or altering resource import ID formats
   * Automation written by end users may rely on specific import formats.
-* Major changes to default resource behavior
-  * For example, changing the default implementation of resource deletion
+* Changes to default resource behavior
+  *  Changing resource deletion behavior
+    * In limited cases changes may be permissible if the prior behavior could **never** succeed.
+    * Changing resource deletion to skip deleting the resource by default if delete was previously called
+    * Changing resource deletion to specify a force flag
+  * Adding a new field with a default different from the API default
+    * If an API default is expected to change- a breaking change for the API- use `default_from_api` which will avoid sending a value and safely take the server default in Terraform
 
 ## Field-level breaking changes
 
diff --git a/docs/content/develop/custom-code.md b/docs/content/develop/custom-code.md
index 81166d49b25d..df36e14142b1 100644
--- a/docs/content/develop/custom-code.md
+++ b/docs/content/develop/custom-code.md
@@ -1,6 +1,6 @@
 ---
 title: "Add custom resource code"
-weight: 31
+weight: 32
 ---
 
 # Add custom resource code
diff --git a/docs/content/develop/field-reference.md b/docs/content/develop/field-reference.md
new file mode 100644
index 000000000000..0e4786459a71
--- /dev/null
+++ b/docs/content/develop/field-reference.md
@@ -0,0 +1,257 @@
+---
+title: "MMv1 field reference"
+weight: 31
+aliases:
+  - /reference/field-reference
+---
+
+# MMv1 field reference
+
+This page documents commonly-used properties for fields. For a full list of
+available properties, see [type.rb ↗](https://github.com/GoogleCloudPlatform/magic-modules/blob/main/mmv1/api/type.rb).
+
+## Shared properties
+
+### `min_version: beta`
+Marks the field (and any subfields) as beta-only. Ensure a beta version block
+is present in provider.yaml. Do not use if an ancestor field (or the overall
+resource) is already marked as beta-only.
+
+### `immutable`
+If true, the field (and any subfields) are considered immutable - that is,
+only settable on create. If unset or false, the field is still considered
+immutable if any ancestor field (or the overall resource) is immutable,
+unless `update_url` is set.
+
+Example:
+
+```yaml
+immutable: true
+```
+
+### `update_url`
+If set, changes to the field's value trigger a separate call to a specific
+API method for updating the field's value. The field is not considered
+immutable even if an ancestor field (or the overall resource) is immutable.
+Terraform field names enclosed in double curly braces are replaced with the
+field values from the resource at runtime.
+
+Example:
+
+```yaml
+update_url: 'projects/{{project}}/locations/{{location}}/resourcenames/{{name}}/setFieldName'
+```
+
+### `update_verb`
+If update_url is also set, overrides the verb used to update this specific
+field. Allowed values: :POST, :PUT, :PATCH. Default: Resource's update_verb
+(which defaults to :PUT if unset).
+
+Example:
+
+```yaml
+update_verb: :POST
+```
+
+### `required`
+If true, the field is required. If unset or false, the field is optional.
+
+Example:
+
+```yaml
+required: true
+```
+
+### `output`
+If true, the field is output-only - that is, it cannot be configured by the
+user. If unset or false, the field is configurable.
+
+Example:
+
+```yaml
+output: true
+```
+
+### `sensitive`
+If true, the field is considered "sensitive", which means that its value will
+be obscured in Terraform output such as plans. If false, the value will not be
+obscured. Either way, the value will still be stored in plaintext in Terraform
+state. See
+[Handling Sensitive Values in State](https://developer.hashicorp.com/terraform/plugin/best-practices/sensitive-state)
+for more information.
+
+Sensitive fields are often not returned by the API (because they are sensitive).
+In this case, the field will also need to use [`ignore_read` or a `custom_flatten` function]({{< ref "/develop/field-reference#ignore_read" >}}).
+
+Example:
+
+```yaml
+sensitive: true
+```
+
+### `ignore_read`
+If true, the provider sets the field's value in the resource state based only
+on the user's configuration. If false or unset, the provider sets the field's
+value in the resource state based on the API response. Only use this attribute
+if the field cannot be read from GCP due to either API or provider constraints.
+
+Nested fields currently
+[do not support `ignore_read`](https://github.com/hashicorp/terraform-provider-google/issues/12410)
+but can replicate the behavior by implementing a
+[`custom_flatten`]({{< ref "/develop/custom-code#custom_flatten" >}})
+that always ignores the value returned by the API.
+](https://github.com/GoogleCloudPlatform/magic-modules/blob/5923d4cb878396a04bed9beaf22a8478e8b1e6a5/mmv1/templates/terraform/custom_flatten/source_representation_instance_configuration_password.go.erb).
+Any fields using a custom flatten also need to be added to `ignore_read_extra`
+for any examples where the field is set.
+
+Example: YAML
+
+```yaml
+ignore_read: true
+```
+
+Example: Custom flatten
+
+```go
+func flatten<%= prefix -%><%= titlelize_property(property) -%>(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+  return d.Get("password")
+}
+```
+
+### `default_value`
+Sets a client-side default value for the field. This should be used if the
+API has a default value that applies in all cases and is stable. Removing
+or changing a default value is a breaking change. If unset, the field defaults
+to an "empty" value (such as zero, false, or an empty string).
+
+Example:
+
+```yaml
+default_value: DEFAULT_VALUE
+```
+
+### `default_from_api`
+If true, and the field is either not set or set to an "empty" value (such as
+zero, false, or empty strings), the provider accepts any value returned from
+the API as the value for the field. If false, and the field is either not set
+or set to an "empty" value, the provider treats the field's `default_value`
+as the value for the field and shows a diff if the API returns any other
+value for the field. This attribute is useful for complex or
+frequently-changed API-side defaults, but provides less useful information at
+plan time than `default_value` and causes the provider to ignore user
+configurations that explicitly set the field to an "empty" value.
+`default_from_api` and `send_empty_value` cannot both be true on the same field.
+
+Example:
+
+```yaml
+default_from_api: true
+```
+
+### `send_empty_value`
+If true, the provider sends "empty" values (such as zero, false, or empty
+strings) to the API if set explicitly in the user's configuration. If false,
+"empty" values cause the field to be omitted entirely from the API request.
+This attribute is useful for fields where the API would behave differently
+for an "empty" value vs no value for a particular field - for example,
+boolean fields that have an API-side default of true.
+`send_empty_value` and `default_from_api` cannot both be true on the same field.
+
+Example:
+
+```yaml
+send_empty_value: true
+```
+
+### `conflicts`
+Specifies a list of fields (excluding the current field) that cannot be
+specified at the same time as the current field. Must be set separately on
+all listed fields.
+
+Example:
+
+```yaml
+conflicts:
+  - field_one
+  - nested_object.0.nested_field
+```
+
+### `exactly_one_of`
+Specifies a list of fields (including the current field) that cannot be
+specified at the same time (but at least one of which must be set). Must be
+set separately on all listed fields.
+
+Example:
+
+```yaml
+exactly_one_of:
+  - field_one
+  - nested_object.0.nested_field
+```
+
+## `Enum` properties
+
+### `values`
+Enum only. Sets allowed values as ruby "literal constants" (prefixed with a
+colon). If the allowed values change frequently, use a String field instead
+to allow better forwards-compatibility, and link to API documentation
+stating the current allowed values in the String field's description. Do not
+include UNSPECIFIED values in this list.
+
+Example:
+
+```yaml
+values:
+  - :VALUE_ONE
+  - :VALUE_TWO
+```
+
+## `Array` properties
+
+### `item_type`
+Array only. Sets the expected type of the items in the array. Primitives
+should use the name of the primitive class as a string; other types should
+define the attributes of the nested type.
+
+Example: Primitive value
+
+```yaml
+item_type: Api::Type::String
+```
+
+Example: Enum value
+
+```yaml
+item_type: !ruby/object:Api::Type::Enum
+  name: 'required but unused'
+  description: 'required but unused'
+  values:
+    - :VALUE_ONE
+    - :VALUE_TWO
+```
+
+Example: Nested object
+
+```yaml
+item_type: !ruby/object:Api::Type::NestedObject
+  properties:
+    - !ruby/object:Api::Type::String
+      name: 'FIELD_NAME'
+      description: |
+        MULTI_LINE_FIELD_DESCRIPTION
+```
+
+## `NestedObject` properties
+
+### `properties`
+NestedObject only. Defines fields nested inside the current field.
+
+Example:
+
+```yaml
+properties:
+  - !ruby/object:Api::Type::String
+    name: 'FIELD_NAME'
+    description: |
+      MULTI_LINE_FIELD_DESCRIPTION
+```
diff --git a/docs/content/develop/resource.md b/docs/content/develop/resource.md
index a2e605c71dad..2e0cd6afc1ec 100644
--- a/docs/content/develop/resource.md
+++ b/docs/content/develop/resource.md
@@ -220,122 +220,133 @@ For more information about types of resources and the generation process overall
 {{< tab "MMv1" >}}
 1. For each API field, copy the following template into the resource's `properties` attribute. Be sure to indent appropriately.
 
+{{< tabs "MMv1 types" >}}
+{{< tab "Simple" >}}
 ```yaml
-# Supported types: String, Integer, Boolean, Double, Enum,
-# ResourceRef (link to a GCP resource), KeyValuePairs (string -> string map),
-# Array, and NestedObject
 - !ruby/object:Api::Type::String
   name: 'API_FIELD_NAME'
   description: |
     MULTILINE_FIELD_DESCRIPTION
-  # Marks the field (and any subfields) as beta-only. Ensure a beta version block
-  # is present in provider.yaml. Do not use if an ancestor field (or the overall
-  # resource) is already marked as beta-only.
-  # min_version: beta
+  min_version: beta
+  immutable: true
+  required: true
+  output: true
+  conflicts:
+    - field_one
+    - nested_object.0.nested_field
+  exactly_one_of:
+    - field_one
+    - nested_object.0.nested_field
+
+```
+
+Replace `String` in the field type with one of the following options:
 
-  # If true, the field (and any subfields) are considered immutable - that is,
-  # only settable on create. If unset or false, the field is still considered
-  # immutable if any ancestor field (or the overall resource) is immutable,
-  # unless `update_url` is set.
-  # immutable: true
-
-  # If set, changes to the field's value trigger a separate call to a specific
-  # API method for updating the field's value. The field is not considered
-  # immutable even if an ancestor field (or the overall resource) is immutable.
-  # Terraform field names enclosed in double curly braces are replaced with the
-  # field values from the resource at runtime.
-  # update_url: 'projects/{{project}}/locations/{{location}}/resourcenames/{{name}}/setFieldName'
-
-  # If update_url is also set, overrides the verb used to update this specific
-  # field. Allowed values: :POST, :PUT, :PATCH. Default: Resource's update_verb
-  # (which defaults to :PUT if unset).
-  # update_verb: :POST
-
-  # If true, the field is required. If unset or false, the field is optional.
-  # required: true
-
-  # If true, the field is output-only - that is, it cannot be configured by the
-  # user. If unset or false, the field is configurable.
-  # output: true
-
-  # If true, the provider sets the field's value in the resource state based only
-  # on the user's configuration. If false or unset, the provider sets the field's
-  # value in the resource state based on the API response. Only use this attribute
-  # if the field cannot be read from GCP due to either API or provider constraints.
-  # ignore_read: true
-
-  # Sets a client-side default value for the field. This should be used if the
-  # API has a default value that applies in all cases and is stable. Removing
-  # or changing a default value is a breaking change. If unset, the field defaults
-  # to an "empty" value (such as zero, false, or an empty string).
-  # default_value: DEFAULT_VALUE
-
-  # If true, and the field is either not set or set to an "empty" value (such as
-  # zero, false, or empty strings), the provider accepts any value returned from
-  # the API as the value for the field. If false, and the field is either not set
-  # or set to an "empty" value, the provider treats the field's `default_value`
-  # as the value for the field and shows a diff if the API returns any other
-  # value for the field. This attribute is useful for complex or
-  # frequently-changed API-side defaults, but provides less useful information at
-  # plan time than `default_value` and causes the provider to ignore user
-  # configurations that explicitly set the field to an "empty" value.
-  # `default_from_api` and `send_empty_value` cannot both be true on the same field.
-  # default_from_api: true
-
-  # If true, the provider sends "empty" values (such as zero, false, or empty
-  # strings) to the API if set explicitly in the user's configuration. If false,
-  # "empty" values cause the field to be omitted entirely from the API request.
-  # This attribute is useful for fields where the API would behave differently
-  # for an "empty" value vs no value for a particular field - for example,
-  # boolean fields that have an API-side default of true.
-  # `send_empty_value` and `default_from_api` cannot both be true on the same field.
-  # send_empty_value: true
-
-  # Specifies a list of fields (excluding the current field) that cannot be
-  # specified at the same time as the current field. Must be set separately on
-  # all listed fields.
-  # conflicts:
-  #   - field_one
-  #   - nested_object.0.nested_field
-
-  # Specifies a list of fields (including the current field) that cannot be
-  # specified at the same time (but at least one of which must be set). Must be
-  # set separately on all listed fields.
-  # exactly_one_of:
-  #   - field_one
-  #   - nested_object.0.nested_field
-
-  # Enum only. Sets allowed values as ruby "literal constants" (prefixed with a
-  # colon). If the allowed values change frequently, use a String field instead
-  # to allow better forwards-compatibility, and link to API documentation
-  # stating the current allowed values in the String field's description. Do not
-  # include UNSPECIFIED values in this list.
-  # values:
-  #   - :VALUE_ONE
-  #   - :VALUE_TWO
-
-  # Array only. Sets the expected type of the items in the array. Primitives
-  # should use the name of the primitive class as a string; other types should
-  # define the attributes of the nested type.
-  # item_type: Api::Type::String
-  # item_type: !ruby/object:Api::Type::Enum
-  #   name: 'required but unused'
-  #   description: 'required but unused'
-  #   values:
-  #     - :VALUE_ONE
-  #     - :VALUE_TWO
-
-  # NestedObject only. Defines fields nested inside the current field.
-  # properties:
-  #   - !ruby/object:Api::Type::String
-  #     name: 'FIELD_NAME'
-  #     description: |
-  #       MULTI_LINE_FIELD_DESCRIPTION
+- `String`
+- `Integer`
+- `Boolean`
+- `Double`
+- `KeyValuePairs` (string -> string map)
+- `KeyValueLabels` (for standard resource 'labels' field)
+- `KeyValueAnnotations` (for standard resource 'annotations' field)
+{{< /tab >}}
+{{< tab "Enum" >}}
+```yaml
+- !ruby/object:Api::Type::Enum
+  name: 'API_FIELD_NAME'
+  description: |
+    MULTILINE_FIELD_DESCRIPTION
+  min_version: beta
+  immutable: true
+  required: true
+  output: true
+  conflicts:
+    - field_one
+    - nested_object.0.nested_field
+  exactly_one_of:
+    - field_one
+    - nested_object.0.nested_field
+  values:
+    - :VALUE_ONE
+    - :VALUE_TWO
+```
+{{< /tab >}}
+{{< tab "ResourceRef" >}}
+```yaml
+- !ruby/object:Api::Type::ResourceRef
+  name: 'API_FIELD_NAME'
+  description: |
+    MULTILINE_FIELD_DESCRIPTION
+  min_version: beta
+  immutable: true
+  required: true
+  output: true
+  conflicts:
+    - field_one
+    - nested_object.0.nested_field
+  exactly_one_of:
+    - field_one
+    - nested_object.0.nested_field
+  resource: 'ResourceName'
+  imports: 'name'
 ```
+{{< /tab >}}
+{{< tab "Array" >}}
+```yaml
+- !ruby/object:Api::Type::Array
+  name: 'API_FIELD_NAME'
+  description: |
+    MULTILINE_FIELD_DESCRIPTION
+  min_version: beta
+  immutable: true
+  required: true
+  output: true
+  conflicts:
+    - field_one
+    - nested_object.0.nested_field
+  exactly_one_of:
+    - field_one
+    - nested_object.0.nested_field
+  # Array of primitives
+  item_type: Api::Type::String
+
+  # Array of nested objects
+  item_type: !ruby/object:Api::Type::NestedObject
+    properties:
+      - !ruby/object:Api::Type::String
+        name: 'FIELD_NAME'
+        description: |
+          MULTI_LINE_FIELD_DESCRIPTION
+```
+{{< /tab >}}
+{{< tab "NestedObject" >}}
+```yaml
+- !ruby/object:Api::Type::Array
+  name: 'API_FIELD_NAME'
+  description: |
+    MULTILINE_FIELD_DESCRIPTION
+  min_version: beta
+  immutable: true
+  required: true
+  output: true
+  conflicts:
+    - field_one
+    - nested_object.0.nested_field
+  exactly_one_of:
+    - field_one
+    - nested_object.0.nested_field
+  properties:
+    - !ruby/object:Api::Type::String
+      name: 'FIELD_NAME'
+      description: |
+        MULTI_LINE_FIELD_DESCRIPTION
+```
+{{< /tab >}}
+{{< /tabs >}}
+
 2. Modify the field configuration according to the API documentation and behavior.
-3. Delete all remaining comments in the field configuration (including attribute descriptions) that were copied from the above template.
 
-> **Note:** The template includes the most commonly-used fields. For a comprehensive reference, see [Field reference ↗]({{<ref "/reference/field-reference.md" >}}).
+> **Note:** The templates in this section only include the most commonly-used fields. For a comprehensive reference, see [MMv1 field reference]({{<ref "/develop/field-reference.md" >}}). For information about modifying the values sent and received for a field, see [Modify the API request or response]({{<ref "/develop/custom-code#modify-the-api-request-or-response" >}}).
 {{< /tab >}}
 {{< tab "Handwritten" >}}
 1. Add the field to the handwritten resource's schema.
diff --git a/docs/content/develop/run-tests.md b/docs/content/develop/run-tests.md
index afdc7fcf4c10..5c6b655991a2 100644
--- a/docs/content/develop/run-tests.md
+++ b/docs/content/develop/run-tests.md
@@ -92,7 +92,7 @@ aliases:
 1. Run acceptance tests for only modified resources. (Full test runs can take over 9 hours.) See [Go's documentation](https://pkg.go.dev/cmd/go#hdr-Testing_flags) for more information about `-run` and other flags.
 
     ```bash
-    make testacc TEST=./google-beta TESTARGS='-run=TestAccContainerNodePool'
+    make testacc TEST=./google-beta/services/container TESTARGS='-run=TestAccContainerNodePool'
     ```
 
 
@@ -100,7 +100,7 @@ aliases:
 1. Optional: Save verbose test output to a file for analysis.
 
     ```bash
-    TF_LOG=DEBUG make testacc TEST=./google-beta TESTARGS='-run=TestAccContainerNodePool_basic' > output.log
+    TF_LOG=DEBUG make testacc TEST=./google-beta/services/container TESTARGS='-run=TestAccContainerNodePool_basic' > output.log
     ```
 
 1. Optional: Debug tests with [Delve](https://github.com/go-delve/delve). See [`dlv test` documentation](https://github.com/go-delve/delve/blob/master/Documentation/usage/dlv_test.md) for information about available flags.
diff --git a/docs/content/reference/field-reference.md b/docs/content/reference/field-reference.md
deleted file mode 100644
index 5e75b08687d5..000000000000
--- a/docs/content/reference/field-reference.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: "Field YAML reference ↗"
-weight: 30
-bookHref: "https://github.com/GoogleCloudPlatform/magic-modules/blob/main/mmv1/api/type.rb"
----
-FORCE MENU RENDER
\ No newline at end of file
diff --git a/mmv1/api/resource.rb b/mmv1/api/resource.rb
index 3b975c2bd0c0..4ccec699fb8d 100644
--- a/mmv1/api/resource.rb
+++ b/mmv1/api/resource.rb
@@ -201,6 +201,10 @@ module Properties
       # mmv1/templates/terraform/state_migrations/
       # used for maintaining state stability with resources first provisioned on older api versions.
       attr_reader :schema_version
+      # From this schema version on, state_upgrader code is generated for the resource.
+      # When unset, state_upgrade_base_schema_version defauts to 0.
+      # Normally, it is not needed to be set.
+      attr_reader :state_upgrade_base_schema_version
       attr_reader :state_upgraders
       # This block inserts the named function and its attribute into the
       # resource schema -- the code for the migrate_state function must
@@ -217,6 +221,10 @@ module Properties
       # public ca external account keys
       attr_reader :skip_read
 
+      # Set to true for resources that wish to disable automatic generation of default provider
+      # value customdiff functions
+      attr_reader :skip_default_cdiff
+
       # This enables resources that get their project via a reference to a different resource
       # instead of a project field to use User Project Overrides
       attr_reader :supports_indirect_user_project_override
@@ -318,10 +326,12 @@ def validate
       check :error_retry_predicates, type: Array, item_type: String
       check :error_abort_predicates, type: Array, item_type: String
       check :schema_version, type: Integer
+      check :state_upgrade_base_schema_version, type: Integer, default: 0
       check :state_upgraders, type: :boolean, default: false
       check :migrate_state, type: String
       check :skip_delete, type: :boolean, default: false
       check :skip_read, type: :boolean, default: false
+      check :skip_default_cdiff, type: :boolean, default: false
       check :supports_indirect_user_project_override, type: :boolean, default: false
       check :legacy_long_form_project, type: :boolean, default: false
       check :read_error_transform, type: String
@@ -342,6 +352,10 @@ def all_properties
       ((@properties || []) + (@parameters || []))
     end
 
+    def properties_with_excluded
+      @properties || []
+    end
+
     def properties
       (@properties || []).reject(&:exclude)
     end
@@ -385,8 +399,13 @@ def all_resourcerefs
     # At Create, they have no value but they can just be read in anyways, and after a Read
     # they will need to be set in every Update.
     def settable_properties
-      all_user_properties.reject { |v| v.output && !v.is_a?(Api::Type::Fingerprint) }
-                         .reject(&:url_param_only)
+      props = all_user_properties.reject do |v|
+        v.output && !v.is_a?(Api::Type::Fingerprint) && !v.is_a?(Api::Type::KeyValueEffectiveLabels)
+      end
+      props = props.reject(&:url_param_only)
+      props.reject do |v|
+        v.is_a?(Api::Type::KeyValueLabels) || v.is_a?(Api::Type::KeyValueAnnotations)
+      end
     end
 
     # Properties that will be returned in the API body
@@ -439,6 +458,106 @@ def decoder?
       !@transport&.decoder.nil?
     end
 
+    def add_labels_related_fields(props, parent)
+      props.each do |p|
+        if p.is_a? Api::Type::KeyValueLabels
+          add_labels_fields(props, parent, p)
+        elsif p.is_a? Api::Type::KeyValueAnnotations
+          add_annotations_fields(props, parent, p)
+        elsif (p.is_a? Api::Type::NestedObject) && !p.all_properties.nil?
+          p.properties = add_labels_related_fields(p.all_properties, p)
+        end
+      end
+      props
+    end
+
+    def add_labels_fields(props, parent, labels)
+      # The effective_labels field is used to write to API, instead of the labels field.
+      labels.ignore_write = true
+      labels.description = "#{labels.description}\n\n#{get_labels_field_note(labels.name)}"
+
+      @custom_diff ||= []
+      if parent.nil? || parent.flatten_object
+        @custom_diff.append('tpgresource.SetLabelsDiff')
+      elsif parent.name == 'metadata'
+        @custom_diff.append('tpgresource.SetMetadataLabelsDiff')
+      end
+
+      props << build_terraform_labels_field('labels', labels)
+      props << build_effective_labels_field('labels', labels)
+    end
+
+    def add_annotations_fields(props, parent, annotations)
+      # The effective_annotations field is used to write to API,
+      # instead of the annotations field.
+      annotations.ignore_write = true
+      note = get_labels_field_note(annotations.name)
+      annotations.description = "#{annotations.description}\n\n#{note}"
+
+      @custom_diff ||= []
+      if parent.nil?
+        @custom_diff.append('tpgresource.SetAnnotationsDiff')
+      elsif parent.name == 'metadata'
+        @custom_diff.append('tpgresource.SetMetadataAnnotationsDiff')
+      end
+
+      props << build_effective_labels_field('annotations', annotations)
+    end
+
+    def build_effective_labels_field(name, labels)
+      description = "All of #{name} (key/value pairs)\
+ present on the resource in GCP, including the #{name} configured through Terraform,\
+ other clients and services."
+
+      Api::Type::KeyValueEffectiveLabels.new(
+        name: "effective#{name.capitalize}",
+        output: true,
+        api_name: name,
+        description:,
+        min_version: labels.field_min_version,
+        update_verb: labels.update_verb,
+        update_url: labels.update_url,
+        immutable: labels.immutable
+      )
+    end
+
+    def build_terraform_labels_field(name, labels)
+      description = "The combination of #{name} configured directly on the resource
+ and default #{name} configured on the provider."
+
+      Api::Type::KeyValueTerraformLabels.new(
+        name: "terraform#{name.capitalize}",
+        output: true,
+        api_name: name,
+        description:,
+        min_version: labels.field_min_version,
+        ignore_write: true,
+        update_url: labels.update_url,
+        immutable: labels.immutable
+      )
+    end
+
+    # Return labels fields that should be added to ImportStateVerifyIgnore
+    def ignore_read_labels_fields(props)
+      fields = []
+      props.each do |p|
+        if (p.is_a? Api::Type::KeyValueLabels) ||
+           (p.is_a? Api::Type::KeyValueTerraformLabels) ||
+           (p.is_a? Api::Type::KeyValueAnnotations)
+          fields << p.terraform_lineage
+        elsif (p.is_a? Api::Type::NestedObject) && !p.all_properties.nil?
+          fields.concat(ignore_read_labels_fields(p.all_properties))
+        end
+      end
+      fields
+    end
+
+    def get_labels_field_note(title)
+      "**Note**: This field is non-authoritative, and will only manage the #{title} present " \
+"in your configuration.
+Please refer to the field `effective_#{title}` for all of the #{title} present on the resource."
+    end
+
     # ====================
     # Version-related methods
     # ====================
diff --git a/mmv1/api/type.rb b/mmv1/api/type.rb
index 2d0900b1fd7d..f050ead7652a 100644
--- a/mmv1/api/type.rb
+++ b/mmv1/api/type.rb
@@ -23,7 +23,7 @@ module Fields
       include Api::Object::Named::Properties
 
       attr_reader :default_value
-      attr_reader :description
+      attr_accessor :description
       attr_reader :exclude
 
       # Add a deprecation message for a field that's been deprecated in the API
@@ -36,13 +36,25 @@ module Fields
       # a different version.
       attr_reader :removed_message
 
-      attr_reader :output # If set value will not be sent to server on sync
-      attr_reader :immutable # If set to true value is used only on creation
+      # If set value will not be sent to server on sync.
+      # For nested fields, this also needs to be set on each descendant (ie. self,
+      # child, etc.).
+      attr_reader :output
+
+      # If set to true, changes in the field's value require recreating the
+      # resource.
+      # For nested fields, this only applies at the current level. This means
+      # it should be explicitly added to each field that needs the ForceNew
+      # behavior.
+      attr_reader :immutable
 
       # url_param_only will not send the field in the resource body and will
       # not attempt to read the field from the API response.
       # NOTE - this doesn't work for nested fields
       attr_reader :url_param_only
+
+      # For nested fields, this only applies within the parent.
+      # For example, an optional parent can contain a required child.
       attr_reader :required
 
       # [Additional query Parameters to append to GET calls.
@@ -121,6 +133,9 @@ module Fields
       # if true, then we get the default value from the Google API if no value
       # is set in the terraform configuration for this field.
       # It translates to setting the field to Computed & Optional in the schema.
+      # For nested fields, this only applies at the current level. This means
+      # it should be explicitly added to each field that needs the defaulting
+      # behavior.
       attr_reader :default_from_api
 
       # https://github.com/hashicorp/terraform/pull/20837
@@ -266,6 +281,14 @@ def lineage
       "#{__parent.lineage}.#{name&.underscore}"
     end
 
+    # Prints the access path of the field in the configration eg: metadata.0.labels
+    # The only intended purpose is to get the value of the labes field by calling d.Get().
+    def terraform_lineage
+      return name&.underscore if __parent.nil? || __parent.flatten_object
+
+      "#{__parent.terraform_lineage}.0.#{name&.underscore}"
+    end
+
     def to_json(opts = nil)
       # ignore fields that will contain references to parent resources and
       # those which will be added later
@@ -728,6 +751,8 @@ def properties
         @properties.reject(&:exclude)
       end
 
+      attr_writer :properties
+
       def nested_properties
         properties
       end
@@ -755,6 +780,109 @@ def exclude_if_not_in_version!(version)
     # simpler property to generate and means we can avoid conditional logic
     # in Map.
     class KeyValuePairs < Composite
+      # Ignore writing the "effective_labels" and "effective_annotations" fields to API.
+      attr_accessor :ignore_write
+
+      def initialize(name: nil, output: nil, api_name: nil, description: nil, min_version: nil,
+                     ignore_write: nil, update_verb: nil, update_url: nil, immutable: nil)
+        super()
+
+        @name = name
+        @output = output
+        @api_name = api_name
+        @description = description
+        @min_version = min_version
+        @ignore_write = ignore_write
+        @update_verb = update_verb
+        @update_url = update_url
+        @immutable = immutable
+      end
+
+      def validate
+        super
+        check :ignore_write, type: :boolean, default: false
+
+        return if @__resource.__product.nil?
+
+        product_name = @__resource.__product.name
+        resource_name = @__resource.name
+
+        if lineage == 'labels' || lineage == 'metadata.labels' ||
+           lineage == 'configuration.labels'
+          if !(is_a? Api::Type::KeyValueLabels) &&
+             # The label value must be empty string, so skip this resource
+             !(product_name == 'CloudIdentity' && resource_name == 'Group') &&
+
+             # The "labels" field has type Array, so skip this resource
+             !(product_name == 'DeploymentManager' && resource_name == 'Deployment') &&
+
+             # https://github.com/hashicorp/terraform-provider-google/issues/16219
+             !(product_name == 'Edgenetwork' && resource_name == 'Network') &&
+
+             # https://github.com/hashicorp/terraform-provider-google/issues/16219
+             !(product_name == 'Edgenetwork' && resource_name == 'Subnet') &&
+
+             # "userLabels" is the resource labels field
+             !(product_name == 'Monitoring' && resource_name == 'NotificationChannel') &&
+
+             # The "labels" field has type Array, so skip this resource
+             !(product_name == 'Monitoring' && resource_name == 'MetricDescriptor')
+            raise "Please use type KeyValueLabels for field #{lineage} " \
+                  "in resource #{product_name}/#{resource_name}"
+          end
+        elsif is_a? Api::Type::KeyValueLabels
+          raise "Please don't use type KeyValueLabels for field #{lineage} " \
+                "in resource #{product_name}/#{resource_name}"
+        end
+
+        if lineage == 'annotations' || lineage == 'metadata.annotations'
+          if !(is_a? Api::Type::KeyValueAnnotations) &&
+             # The "annotations" field has "ouput: true", so skip this eap resource
+             !(product_name == 'Gkeonprem' && resource_name == 'BareMetalAdminClusterEnrollment')
+            raise "Please use type KeyValueAnnotations for field #{lineage} " \
+                  "in resource #{product_name}/#{resource_name}"
+          end
+        elsif is_a? Api::Type::KeyValueAnnotations
+          raise "Please don't use type KeyValueAnnotations for field #{lineage} " \
+                "in resource #{product_name}/#{resource_name}"
+        end
+      end
+
+      def field_min_version
+        @min_version
+      end
+    end
+
+    # An array of string -> string key -> value pairs used specifically for the "labels" field.
+    # The field name with this type should be "labels" literally.
+    class KeyValueLabels < KeyValuePairs
+      def validate
+        super
+        return unless @name != 'labels'
+
+        raise "The field #{name} has the type KeyValueLabels, but the field name is not 'labels'!"
+      end
+    end
+
+    # An array of string -> string key -> value pairs used for the "terraform_labels" field.
+    class KeyValueTerraformLabels < KeyValuePairs
+    end
+
+    # An array of string -> string key -> value pairs used for the "effective_labels"
+    # and "effective_annotations" fields.
+    class KeyValueEffectiveLabels < KeyValuePairs
+    end
+
+    # An array of string -> string key -> value pairs used specifically for the "annotations" field.
+    # The field name with this type should be "annotations" literally.
+    class KeyValueAnnotations < KeyValuePairs
+      def validate
+        super
+        return unless @name != 'annotations'
+
+        raise "The field #{name} has the type KeyValueAnnotations,\
+ but the field name is not 'annotations'!"
+      end
     end
 
     # Map from string keys -> nested object entries
diff --git a/mmv1/compiler.rb b/mmv1/compiler.rb
index 33ec546c4ad8..bb5e4c405a68 100755
--- a/mmv1/compiler.rb
+++ b/mmv1/compiler.rb
@@ -32,6 +32,7 @@
 require 'provider/terraform_kcc'
 require 'provider/terraform_oics'
 require 'provider/terraform_tgc'
+require 'provider/terraform_tgc_cai2hcl'
 require 'provider/tflint'
 
 products_to_generate = nil
@@ -224,6 +225,9 @@
       end
       res_yaml = File.read(file_path)
       resource = Api::Compiler.new(res_yaml).run
+      resource.properties = resource.add_labels_related_fields(
+        resource.properties_with_excluded, nil
+      )
       resource.validate
       resources.push(resource)
     end
@@ -250,6 +254,9 @@
           res_yaml = res_yaml.gsub('{{override_path}}', override_dir)
         end
         resource = Api::Compiler.new(res_yaml).run
+        resource.properties = resource.add_labels_related_fields(
+          resource.properties_with_excluded, nil
+        )
         resource.validate
         resources.push(resource)
       end
@@ -278,6 +285,7 @@
       'oics' => Provider::TerraformOiCS,
       'validator' => Provider::TerraformGoogleConversion,
       'tgc' => Provider::TerraformGoogleConversion,
+      'tgc_cai2hcl' => Provider::CaiToTerraformConversion,
       'kcc' => Provider::TerraformKCC,
       'tflint' => Provider::TFLint
     }
diff --git a/mmv1/products/accesscontextmanager/AccessLevel.yaml b/mmv1/products/accesscontextmanager/AccessLevel.yaml
index 471c23829f69..e569f44574f4 100644
--- a/mmv1/products/accesscontextmanager/AccessLevel.yaml
+++ b/mmv1/products/accesscontextmanager/AccessLevel.yaml
@@ -243,6 +243,23 @@ properties:
                 countries/regions.
                 Format: A valid ISO 3166-1 alpha-2 code.
               item_type: Api::Type::String
+            - !ruby/object:Api::Type::Array
+              name: 'vpcNetworkSources'
+              description: 'The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with `ip_subnetworks`.'
+              item_type: !ruby/object:Api::Type::NestedObject
+                properties:
+                  - !ruby/object:Api::Type::NestedObject
+                    name: 'vpcSubnetwork'
+                    description: 'Sub networks within a VPC network.'
+                    properties:
+                      - !ruby/object:Api::Type::String
+                        name: 'network'
+                        required: true
+                        description: 'Required. Network name to be allowed by this Access Level. Networks of foreign organizations requires `compute.network.get` permission to be granted to caller.'
+                      - !ruby/object:Api::Type::Array
+                        name: 'vpcIpSubnetworks'
+                        description: 'CIDR block IP subnetwork specification. Must be IPv4.'
+                        item_type: Api::Type::String
   - !ruby/object:Api::Type::NestedObject
     name: 'custom'
     description: |
diff --git a/mmv1/products/accesscontextmanager/AccessLevelCondition.yaml b/mmv1/products/accesscontextmanager/AccessLevelCondition.yaml
index e8fcca417b03..13106afd628a 100644
--- a/mmv1/products/accesscontextmanager/AccessLevelCondition.yaml
+++ b/mmv1/products/accesscontextmanager/AccessLevelCondition.yaml
@@ -212,3 +212,20 @@ properties:
       countries/regions.
       Format: A valid ISO 3166-1 alpha-2 code.
     item_type: Api::Type::String
+  - !ruby/object:Api::Type::Array
+    name: 'vpcNetworkSources'
+    description: 'The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with `ip_subnetworks`.'
+    item_type: !ruby/object:Api::Type::NestedObject
+      properties:
+        - !ruby/object:Api::Type::NestedObject
+          name: 'vpcSubnetwork'
+          description: 'Sub networks within a VPC network.'
+          properties:
+            - !ruby/object:Api::Type::String
+              name: 'network'
+              required: true
+              description: 'Required. Network name to be allowed by this Access Level. Networks of foreign organizations requires `compute.network.get` permission to be granted to caller.'
+            - !ruby/object:Api::Type::Array
+              name: 'vpcIpSubnetworks'
+              description: 'CIDR block IP subnetwork specification. Must be IPv4.'
+              item_type: Api::Type::String
diff --git a/mmv1/products/accesscontextmanager/AccessLevels.yaml b/mmv1/products/accesscontextmanager/AccessLevels.yaml
index 2a45c3cc0563..ab2c88492f72 100644
--- a/mmv1/products/accesscontextmanager/AccessLevels.yaml
+++ b/mmv1/products/accesscontextmanager/AccessLevels.yaml
@@ -234,6 +234,23 @@ properties:
                       countries/regions.
                       Format: A valid ISO 3166-1 alpha-2 code.
                     item_type: Api::Type::String
+                  - !ruby/object:Api::Type::Array
+                    name: 'vpcNetworkSources'
+                    description: 'The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with `ip_subnetworks`.'
+                    item_type: !ruby/object:Api::Type::NestedObject
+                      properties:
+                        - !ruby/object:Api::Type::NestedObject
+                          name: 'vpcSubnetwork'
+                          description: 'Sub networks within a VPC network.'
+                          properties:
+                            - !ruby/object:Api::Type::String
+                              name: 'network'
+                              required: true
+                              description: 'Required. Network name to be allowed by this Access Level. Networks of foreign organizations requires `compute.network.get` permission to be granted to caller.'
+                            - !ruby/object:Api::Type::Array
+                              name: 'vpcIpSubnetworks'
+                              description: 'CIDR block IP subnetwork specification. Must be IPv4.'
+                              item_type: Api::Type::String
         - !ruby/object:Api::Type::NestedObject
           name: 'custom'
           description: |
diff --git a/mmv1/products/accesscontextmanager/ServicePerimeter.yaml b/mmv1/products/accesscontextmanager/ServicePerimeter.yaml
index 96c2bf0b5b86..b79c83c666cf 100644
--- a/mmv1/products/accesscontextmanager/ServicePerimeter.yaml
+++ b/mmv1/products/accesscontextmanager/ServicePerimeter.yaml
@@ -157,6 +157,7 @@ properties:
           - status.0.access_levels
           - status.0.restricted_services
         item_type: Api::Type::String
+        is_set: true
       - !ruby/object:Api::Type::Array
         name: 'accessLevels'
         description: |
@@ -175,6 +176,7 @@ properties:
           - status.0.access_levels
           - status.0.restricted_services
         item_type: Api::Type::String
+        is_set: true
       - !ruby/object:Api::Type::Array
         name: 'restrictedServices'
         description: |
@@ -236,6 +238,7 @@ properties:
                 - !ruby/object:Api::Type::Array
                   name: 'identities'
                   item_type: Api::Type::String
+                  is_set: true
                   description: |
                     A list of identities that are allowed access through this ingress policy.
                     Should be in the format of email address. The email address should represent
@@ -275,6 +278,7 @@ properties:
                 - !ruby/object:Api::Type::Array
                   name: 'resources'
                   item_type: Api::Type::String
+                  is_set: true
                   description: |
                     A list of resources, currently only projects in the form
                     `projects/<projectnumber>`, protected by this `ServicePerimeter`
@@ -342,12 +346,28 @@ properties:
                     - :ANY_IDENTITY
                     - :ANY_USER_ACCOUNT
                     - :ANY_SERVICE_ACCOUNT
+                - !ruby/object:Api::Type::Array
+                  name: 'sources'
+                  description: 'Sources that this EgressPolicy authorizes access from.'
+                  item_type: !ruby/object:Api::Type::NestedObject
+                    properties:
+                      - !ruby/object:Api::Type::String
+                        name: 'accessLevel'
+                        description: 'An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside.'
+                - !ruby/object:Api::Type::Enum
+                  name: 'sourceRestriction'
+                  description: 'Whether to enforce traffic restrictions based on `sources` field. If the `sources` field is non-empty, then this field must be set to `SOURCE_RESTRICTION_ENABLED`.'
+                  values:
+                    - :SOURCE_RESTRICTION_UNSPECIFIED
+                    - :SOURCE_RESTRICTION_ENABLED
+                    - :SOURCE_RESTRICTION_DISABLED
                 - !ruby/object:Api::Type::Array
                   name: 'identities'
                   description: |
                     A list of identities that are allowed access through this `EgressPolicy`.
                     Should be in the format of email address. The email address should
                     represent individual user or service account only.
+                  is_set: true
                   item_type: Api::Type::String
             - !ruby/object:Api::Type::NestedObject
               name: 'egressTo'
@@ -357,6 +377,7 @@ properties:
               properties:
                 - !ruby/object:Api::Type::Array
                   name: 'resources'
+                  is_set: true
                   item_type: Api::Type::String
                   description: |
                     A list of resources, currently only projects in the form
@@ -366,6 +387,7 @@ properties:
                     the perimeter.
                 - !ruby/object:Api::Type::Array
                   name: 'externalResources'
+                  is_set: true
                   item_type: Api::Type::String
                   description: |
                     A list of external resources that are allowed to be accessed. A request
@@ -423,6 +445,7 @@ properties:
           - spec.0.access_levels
           - spec.0.restricted_services
         item_type: Api::Type::String
+        is_set: true
       - !ruby/object:Api::Type::Array
         name: 'accessLevels'
         description: |
@@ -441,6 +464,7 @@ properties:
           - spec.0.access_levels
           - spec.0.restricted_services
         item_type: Api::Type::String
+        is_set: true
       - !ruby/object:Api::Type::Array
         name: 'restrictedServices'
         description: |
@@ -454,6 +478,7 @@ properties:
           - spec.0.access_levels
           - spec.0.restricted_services
         item_type: Api::Type::String
+        is_set: true
       - !ruby/object:Api::Type::NestedObject
         name: 'vpcAccessibleServices'
         description: |
@@ -471,6 +496,7 @@ properties:
               The list of APIs usable within the Service Perimeter.
               Must be empty unless `enableRestriction` is True.
             item_type: Api::Type::String
+            is_set: true
       - !ruby/object:Api::Type::Array
         name: 'ingressPolicies'
         description: |
@@ -500,6 +526,7 @@ properties:
                 - !ruby/object:Api::Type::Array
                   name: 'identities'
                   item_type: Api::Type::String
+                  is_set: true
                   description: |
                     A list of identities that are allowed access through this ingress policy.
                     Should be in the format of email address. The email address should represent
@@ -539,6 +566,7 @@ properties:
                 - !ruby/object:Api::Type::Array
                   name: 'resources'
                   item_type: Api::Type::String
+                  is_set: true
                   description: |
                     A list of resources, currently only projects in the form
                     `projects/<projectnumber>`, protected by this `ServicePerimeter`
@@ -606,6 +634,21 @@ properties:
                     - :ANY_IDENTITY
                     - :ANY_USER_ACCOUNT
                     - :ANY_SERVICE_ACCOUNT
+                - !ruby/object:Api::Type::Array
+                  name: 'sources'
+                  description: 'Sources that this EgressPolicy authorizes access from.'
+                  item_type: !ruby/object:Api::Type::NestedObject
+                    properties:
+                      - !ruby/object:Api::Type::String
+                        name: 'accessLevel'
+                        description: 'An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside.'
+                - !ruby/object:Api::Type::Enum
+                  name: 'sourceRestriction'
+                  description: 'Whether to enforce traffic restrictions based on `sources` field. If the `sources` field is non-empty, then this field must be set to `SOURCE_RESTRICTION_ENABLED`.'
+                  values:
+                    - :SOURCE_RESTRICTION_UNSPECIFIED
+                    - :SOURCE_RESTRICTION_ENABLED
+                    - :SOURCE_RESTRICTION_DISABLED
                 - !ruby/object:Api::Type::Array
                   name: 'identities'
                   description: |
@@ -613,6 +656,7 @@ properties:
                     Should be in the format of email address. The email address should
                     represent individual user or service account only.
                   item_type: Api::Type::String
+                  is_set: true
             - !ruby/object:Api::Type::NestedObject
               name: 'egressTo'
               description: |
@@ -622,6 +666,7 @@ properties:
                 - !ruby/object:Api::Type::Array
                   name: 'resources'
                   item_type: Api::Type::String
+                  is_set: true
                   description: |
                     A list of resources, currently only projects in the form
                     `projects/<projectnumber>`, that match this to stanza. A request matches
@@ -631,6 +676,7 @@ properties:
                 - !ruby/object:Api::Type::Array
                   name: 'externalResources'
                   item_type: Api::Type::String
+                  is_set: true
                   description: |
                     A list of external resources that are allowed to be accessed. A request
                     matches if it contains an external resource in this list (Example:
diff --git a/mmv1/products/accesscontextmanager/ServicePerimeterEgressPolicy.yaml b/mmv1/products/accesscontextmanager/ServicePerimeterEgressPolicy.yaml
index 8ff821cb691b..5e46e6770c0d 100644
--- a/mmv1/products/accesscontextmanager/ServicePerimeterEgressPolicy.yaml
+++ b/mmv1/products/accesscontextmanager/ServicePerimeterEgressPolicy.yaml
@@ -79,6 +79,21 @@ properties:
           Should be in the format of email address. The email address should
           represent individual user or service account only.
         item_type: Api::Type::String
+      - !ruby/object:Api::Type::Array
+        name: 'sources'
+        description: 'Sources that this EgressPolicy authorizes access from.'
+        item_type: !ruby/object:Api::Type::NestedObject
+          properties:
+            - !ruby/object:Api::Type::String
+              name: 'accessLevel'
+              description: 'An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside.'
+      - !ruby/object:Api::Type::Enum
+        name: 'sourceRestriction'
+        description: 'Whether to enforce traffic restrictions based on `sources` field. If the `sources` field is non-empty, then this field must be set to `SOURCE_RESTRICTION_ENABLED`.'
+        values:
+          - :SOURCE_RESTRICTION_UNSPECIFIED
+          - :SOURCE_RESTRICTION_ENABLED
+          - :SOURCE_RESTRICTION_DISABLED
   - !ruby/object:Api::Type::NestedObject
     name: 'egressTo'
     description: |
diff --git a/mmv1/products/accesscontextmanager/ServicePerimeters.yaml b/mmv1/products/accesscontextmanager/ServicePerimeters.yaml
index 72a41e289a0d..2b941289d41a 100644
--- a/mmv1/products/accesscontextmanager/ServicePerimeters.yaml
+++ b/mmv1/products/accesscontextmanager/ServicePerimeters.yaml
@@ -57,7 +57,6 @@ properties:
     name: 'servicePerimeters'
     description: |
       The desired Service Perimeters that should replace all existing Service Perimeters in the Access Policy.
-    is_set: true
     item_type: !ruby/object:Api::Type::NestedObject
       properties:
         - !ruby/object:Api::Type::String
@@ -133,6 +132,7 @@ properties:
               #   - status.0.access_levels
               #   - status.0.restricted_services
               item_type: Api::Type::String
+              is_set: true
             - !ruby/object:Api::Type::Array
               name: 'accessLevels'
               description: |
@@ -153,6 +153,7 @@ properties:
               #   - status.0.access_levels
               #   - status.0.restricted_services
               item_type: Api::Type::String
+              is_set: true
             - !ruby/object:Api::Type::Array
               name: 'restrictedServices'
               description: |
@@ -194,6 +195,7 @@ properties:
                 have multiple `IngressPolicies`, each of which is evaluated
                 separately. Access is granted if any `Ingress Policy` grants it.
                 Must be empty for a perimeter bridge.
+              is_set: true
               item_type: !ruby/object:Api::Type::NestedObject
                 properties:
                   - !ruby/object:Api::Type::NestedObject
@@ -215,6 +217,7 @@ properties:
                           - :ANY_SERVICE_ACCOUNT
                       - !ruby/object:Api::Type::Array
                         name: 'identities'
+                        is_set: true
                         item_type: Api::Type::String
                         description: |
                           A list of identities that are allowed access through this ingress policy.
@@ -255,6 +258,7 @@ properties:
                       - !ruby/object:Api::Type::Array
                         name: 'resources'
                         item_type: Api::Type::String
+                        is_set: true
                         description: |
                           A list of resources, currently only projects in the form
                           `projects/<projectnumber>`, protected by this `ServicePerimeter`
@@ -328,7 +332,23 @@ properties:
                           A list of identities that are allowed access through this `EgressPolicy`.
                           Should be in the format of email address. The email address should
                           represent individual user or service account only.
+                        is_set: true
                         item_type: Api::Type::String
+                      - !ruby/object:Api::Type::Array
+                        name: 'sources'
+                        description: 'Sources that this EgressPolicy authorizes access from.'
+                        item_type: !ruby/object:Api::Type::NestedObject
+                          properties:
+                            - !ruby/object:Api::Type::String
+                              name: 'accessLevel'
+                              description: 'An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside.'
+                      - !ruby/object:Api::Type::Enum
+                        name: 'sourceRestriction'
+                        description: 'Whether to enforce traffic restrictions based on `sources` field. If the `sources` field is non-empty, then this field must be set to `SOURCE_RESTRICTION_ENABLED`.'
+                        values:
+                          - :SOURCE_RESTRICTION_UNSPECIFIED
+                          - :SOURCE_RESTRICTION_ENABLED
+                          - :SOURCE_RESTRICTION_DISABLED
                   - !ruby/object:Api::Type::NestedObject
                     name: 'egressTo'
                     description: |
@@ -338,6 +358,7 @@ properties:
                       - !ruby/object:Api::Type::Array
                         name: 'resources'
                         item_type: Api::Type::String
+                        is_set: true
                         description: |
                           A list of resources, currently only projects in the form
                           `projects/<projectnumber>`, that match this to stanza. A request matches
@@ -347,6 +368,7 @@ properties:
                       - !ruby/object:Api::Type::Array
                         name: 'externalResources'
                         item_type: Api::Type::String
+                        is_set: true
                         description: |
                           A list of external resources that are allowed to be accessed. A request
                           matches if it contains an external resource in this list (Example:
@@ -404,9 +426,11 @@ properties:
               #   - spec.0.resources
               #   - spec.0.access_levels
               #   - spec.0.restricted_services
+              is_set: true
               item_type: Api::Type::String
             - !ruby/object:Api::Type::Array
               name: 'accessLevels'
+              is_set: true
               description: |
                 A list of AccessLevel resource names that allow resources within
                 the ServicePerimeter to be accessed from the internet.
@@ -440,6 +464,7 @@ properties:
               #   - spec.0.access_levels
               #   - spec.0.restricted_services
               item_type: Api::Type::String
+              is_set: true
             - !ruby/object:Api::Type::NestedObject
               name: 'vpcAccessibleServices'
               description: |
@@ -457,6 +482,7 @@ properties:
                     The list of APIs usable within the Service Perimeter.
                     Must be empty unless `enableRestriction` is True.
                   item_type: Api::Type::String
+                  is_set: true
             - !ruby/object:Api::Type::Array
               name: 'ingressPolicies'
               description: |
@@ -485,6 +511,7 @@ properties:
                           - :ANY_SERVICE_ACCOUNT
                       - !ruby/object:Api::Type::Array
                         name: 'identities'
+                        is_set: true
                         item_type: Api::Type::String
                         description: |
                           A list of identities that are allowed access through this ingress policy.
@@ -525,6 +552,7 @@ properties:
                       - !ruby/object:Api::Type::Array
                         name: 'resources'
                         item_type: Api::Type::String
+                        is_set: true
                         description: |
                           A list of resources, currently only projects in the form
                           `projects/<projectnumber>`, protected by this `ServicePerimeter`
@@ -599,6 +627,22 @@ properties:
                           Should be in the format of email address. The email address should
                           represent individual user or service account only.
                         item_type: Api::Type::String
+                        is_set: true
+                      - !ruby/object:Api::Type::Array
+                        name: 'sources'
+                        description: 'Sources that this EgressPolicy authorizes access from.'
+                        item_type: !ruby/object:Api::Type::NestedObject
+                          properties:
+                            - !ruby/object:Api::Type::String
+                              name: 'accessLevel'
+                              description: 'An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside.'
+                      - !ruby/object:Api::Type::Enum
+                        name: 'sourceRestriction'
+                        description: 'Whether to enforce traffic restrictions based on `sources` field. If the `sources` field is non-empty, then this field must be set to `SOURCE_RESTRICTION_ENABLED`.'
+                        values:
+                          - :SOURCE_RESTRICTION_UNSPECIFIED
+                          - :SOURCE_RESTRICTION_ENABLED
+                          - :SOURCE_RESTRICTION_DISABLED
                   - !ruby/object:Api::Type::NestedObject
                     name: 'egressTo'
                     description: |
@@ -608,6 +652,7 @@ properties:
                       - !ruby/object:Api::Type::Array
                         name: 'resources'
                         item_type: Api::Type::String
+                        is_set: true
                         description: |
                           A list of resources, currently only projects in the form
                           `projects/<projectnumber>`, that match this to stanza. A request matches
@@ -617,6 +662,7 @@ properties:
                       - !ruby/object:Api::Type::Array
                         name: 'externalResources'
                         item_type: Api::Type::String
+                        is_set: true
                         description: |
                           A list of external resources that are allowed to be accessed. A request
                           matches if it contains an external resource in this list (Example:
diff --git a/mmv1/products/activedirectory/Domain.yaml b/mmv1/products/activedirectory/Domain.yaml
index 8b0cc3e78b33..7ca646ef3565 100644
--- a/mmv1/products/activedirectory/Domain.yaml
+++ b/mmv1/products/activedirectory/Domain.yaml
@@ -85,7 +85,7 @@ properties:
     description:
       'The unique name of the domain using the format:
       `projects/{project}/locations/global/domains/{domainName}`.'
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: 'Resource labels that can contain user-provided metadata'
   - !ruby/object:Api::Type::Array
diff --git a/mmv1/products/activedirectory/Peering.yaml b/mmv1/products/activedirectory/Peering.yaml
index b98c94b7ac59..b760bb8ef788 100644
--- a/mmv1/products/activedirectory/Peering.yaml
+++ b/mmv1/products/activedirectory/Peering.yaml
@@ -73,7 +73,7 @@ properties:
     output: true
     description: |
       Unique name of the peering in this scope including projects and location using the form: projects/{projectId}/locations/global/peerings/{peeringId}.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: 'Resource labels that can contain user-provided metadata'
   - !ruby/object:Api::Type::String
diff --git a/mmv1/products/alloydb/Backup.yaml b/mmv1/products/alloydb/Backup.yaml
index 3d4ac4cbf1c8..a81dbc2d1387 100644
--- a/mmv1/products/alloydb/Backup.yaml
+++ b/mmv1/products/alloydb/Backup.yaml
@@ -37,29 +37,57 @@ examples:
   - !ruby/object:Provider::Terraform::Examples
     name: 'alloydb_backup_basic'
     primary_resource_id: 'default'
+    vars:
+      alloydb_backup_id: 'alloydb-backup'
+      alloydb_cluster_name: 'alloydb-cluster'
+      alloydb_instance_name: 'alloydb-instance'
+      network_name: 'alloydb-network'
+    ignore_read_extra:
+      - 'reconciling'
+      - 'update_time'
+    skip_test: true
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'alloydb_backup_basic_test'
+    primary_resource_id: 'default'
     vars:
       alloydb_backup_id: 'alloydb-backup'
       alloydb_cluster_name: 'alloydb-cluster'
       alloydb_instance_name: 'alloydb-instance'
       network_name: 'alloydb-network'
     test_vars_overrides:
-      network_name: 'acctest.BootstrapSharedTestNetwork(t, "alloydb-backup-basic")'
+      network_name: 'acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1")'
     ignore_read_extra:
       - 'reconciling'
       - 'update_time'
+    skip_docs: true
   - !ruby/object:Provider::Terraform::Examples
     name: 'alloydb_backup_full'
     primary_resource_id: 'default'
+    vars:
+      alloydb_backup_id: 'alloydb-backup'
+      alloydb_cluster_name: 'alloydb-cluster'
+      alloydb_instance_name: 'alloydb-instance'
+      network_name: 'alloydb-network'
+    ignore_read_extra:
+      - 'reconciling'
+      - 'update_time'
+    skip_test: true
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'alloydb_backup_full_test'
+    primary_resource_id: 'default'
     vars:
       alloydb_backup_id: 'alloydb-backup'
       alloydb_cluster_name: 'alloydb-cluster'
       alloydb_instance_name: 'alloydb-instance'
       network_name: 'alloydb-network'
     test_vars_overrides:
-      network_name: 'acctest.BootstrapSharedTestNetwork(t, "alloydb-backup-full")'
+      network_name: 'acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1")'
     ignore_read_extra:
       - 'reconciling'
       - 'update_time'
+    # https://github.com/hashicorp/terraform-provider-google/issues/16231
+    skip_vcr: true
+    skip_docs: true
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   encoder: templates/terraform/encoders/alloydb_backup.erb
 parameters:
@@ -83,52 +111,71 @@ properties:
     output: true
     description: |
       Output only. The name of the backup resource with the format: * projects/{project}/locations/{region}/backups/{backupId}
+  - !ruby/object:Api::Type::String
+    name: 'displayName'
+    description: |
+      User-settable and human-readable display name for the Backup.
   - !ruby/object:Api::Type::String
     name: 'uid'
     output: true
     description: |
       Output only. The system-generated UID of the resource. The UID is assigned when the resource is created, and it is retained until it is deleted.
-  - !ruby/object:Api::Type::String
-    name: 'clusterName'
-    description:
-      'The full resource name of the backup source cluster (e.g.,
-      projects/{project}/locations/{location}/clusters/{clusterId}).'
-    required: true
-    immutable: true
-    diff_suppress_func: 'tpgresource.ProjectNumberDiffSuppress'
-  - !ruby/object:Api::Type::KeyValuePairs
-    name: 'labels'
-    description: 'User-defined labels for the alloydb backup.'
   - !ruby/object:Api::Type::Time
     name: 'createTime'
-    description: |
-      Time the Backup was created in UTC.
     output: true
+    description: |
+      Output only. Create time stamp. A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
+      Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
   - !ruby/object:Api::Type::Time
     name: 'updateTime'
+    output: true
     description: |
-      Time the Backup was updated in UTC.
+      Output only. Update time stamp. A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
+      Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
+  - !ruby/object:Api::Type::Time
+    name: 'deleteTime'
     output: true
+    description: |
+      Output only. Delete time stamp. A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
+      Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
+  - !ruby/object:Api::Type::KeyValueLabels
+    name: 'labels'
+    description: |
+      User-defined labels for the alloydb backup. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
   - !ruby/object:Api::Type::String
     name: 'state'
     output: true
-    description: |
-      The current state of the backup.
+    description: Output only. The current state of the backup.
+  - !ruby/object:Api::Type::Enum
+    name: 'type'
+    default_from_api: true
+    description: 'The backup type, which suggests the trigger for the backup.'
+    values:
+      - :TYPE_UNSPECIFIED
+      - :ON_DEMAND
+      - :AUTOMATED
+      - :CONTINUOUS
   - !ruby/object:Api::Type::String
     name: 'description'
-    description: |
-      User-provided description of the backup.
+    description: 'User-provided description of the backup.'
+  - !ruby/object:Api::Type::String
+    name: 'clusterUid'
+    output: true
+    description: 'Output only. The system-generated UID of the cluster which was used to create this resource.'
+  - !ruby/object:Api::Type::String
+    name: 'clusterName'
+    required: true
     immutable: true
+    diff_suppress_func: 'tpgresource.ProjectNumberDiffSuppress'
+    description:
+      'The full resource name of the backup source cluster (e.g.,
+      projects/{project}/locations/{location}/clusters/{clusterId}).'
   - !ruby/object:Api::Type::Boolean
     name: 'reconciling'
     output: true
     description: |
-      If true, indicates that the service is actively updating the resource. This can happen due to user-triggered updates or system actions like failover or maintenance.
-  - !ruby/object:Api::Type::String
-    name: 'etag'
-    description: |
-      A hash of the resource.
-    output: true
+      Output only. Reconciling (https://google.aip.dev/128#reconciliation), if true, indicates that the service is actively updating the resource.
+      This can happen due to user-triggered updates or system actions like failover or maintenance.
   - !ruby/object:Api::Type::NestedObject
     name: 'encryptionConfig'
     description: |
@@ -136,26 +183,62 @@ properties:
     properties:
       - !ruby/object:Api::Type::String
         name: 'kmsKeyName'
+        immutable: true
         description: |
           The fully-qualified resource name of the KMS key. Each Cloud KMS key is regionalized and has the following format: projects/[PROJECT]/locations/[REGION]/keyRings/[RING]/cryptoKeys/[KEY_NAME].
-        immutable: true
   - !ruby/object:Api::Type::NestedObject
     name: 'encryptionInfo'
+    output: true
     description: |
       EncryptionInfo describes the encryption information of a cluster or a backup.
-    output: true
     properties:
       - !ruby/object:Api::Type::Enum
         name: 'encryptionType'
+        output: true
         description: 'Output only. Type of encryption.'
         values:
           - :TYPE_UNSPECIFIED
           - :GOOGLE_DEFAULT_ENCRYPTION
           - :CUSTOMER_MANAGED_ENCRYPTION
-        output: true
       - !ruby/object:Api::Type::Array
         name: kmsKeyVersions
         item_type: Api::Type::String
+        output: true
         description: |
           Output only. Cloud KMS key versions that are being used to protect the database or the backup.
+  - !ruby/object:Api::Type::String
+    name: 'etag'
+    output: true
+    description: 'For Resource freshness validation (https://google.aip.dev/154)'
+  - !ruby/object:Api::Type::KeyValueAnnotations
+    name: 'annotations'
+    description: |
+      Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. https://google.aip.dev/128
+      An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+  - !ruby/object:Api::Type::String
+    name: 'sizeBytes'
+    output: true
+    description: 'Output only. The size of the backup in bytes.'
+  - !ruby/object:Api::Type::String
+    name: 'expiryTime'
+    output: true
+    description: |
+      Output only. The time at which after the backup is eligible to be garbage collected.
+      It is the duration specified by the backup's retention policy, added to the backup's createTime.
+  - !ruby/object:Api::Type::NestedObject
+    name: 'expiryQuantity'
+    output: true
+    description: |
+      Output only. The QuantityBasedExpiry of the backup, specified by the backup's retention policy.
+      Once the expiry quantity is over retention, the backup is eligible to be garbage collected.
+    properties:
+      - !ruby/object:Api::Type::Integer
+        name: 'retentionCount'
+        output: true
+        description: |
+          Output only. The backup's position among its backups with the same source cluster and type, by descending chronological order create time (i.e. newest first).
+      - !ruby/object:Api::Type::Integer
+        name: 'totalRetentionCount'
         output: true
+        description: |
+          Output only. The length of the quantity-based queue, specified by the backup's retention policy.
diff --git a/mmv1/products/alloydb/Cluster.yaml b/mmv1/products/alloydb/Cluster.yaml
index cf597bad4d43..63c7a537893f 100644
--- a/mmv1/products/alloydb/Cluster.yaml
+++ b/mmv1/products/alloydb/Cluster.yaml
@@ -29,9 +29,9 @@ async: !ruby/object:Api::OpAsync
     base_url: '{{op_id}}'
     wait_ms: 1000
     timeouts: !ruby/object:Api::Timeouts
-      insert_minutes: 10
-      update_minutes: 10
-      delete_minutes: 10
+      insert_minutes: 30
+      update_minutes: 30
+      delete_minutes: 30
   result: !ruby/object:Api::OpAsync::Result
     path: 'response'
   status: !ruby/object:Api::OpAsync::Status
@@ -78,8 +78,29 @@ examples:
     ignore_read_extra:
       - 'reconciling'
       - 'update_time'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'alloydb_secondary_cluster_basic'
+    primary_resource_id: 'secondary'
+    vars:
+      alloydb_primary_cluster_name: 'alloydb-primary-cluster'
+      alloydb_primary_instance_name: 'alloydb-primary-instance'
+      alloydb_secondary_cluster_name: 'alloydb-secondary-cluster'
+    skip_test: true
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'alloydb_secondary_cluster_basic_test'
+    primary_resource_id: 'secondary'
+    vars:
+      alloydb_primary_cluster_name: 'alloydb-primary-cluster'
+      alloydb_primary_instance_name: 'alloydb-primary-instance'
+      alloydb_secondary_cluster_name: 'alloydb-secondary-cluster'
+      network_name: 'alloydb-network'
+    test_vars_overrides:
+      network_name: 'acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1")'
+    skip_docs: true
 custom_code: !ruby/object:Provider::Terraform::CustomCode
-  pre_create: templates/terraform/pre_create/alloydb_restore_cluster.go.erb
+  pre_create: templates/terraform/pre_create/alloydb_cluster.go.erb
+  pre_update: templates/terraform/pre_update/alloydb_cluster.go.erb
+  pre_delete: templates/terraform/pre_delete/alloydb_cluster.go.erb
 parameters:
   - !ruby/object:Api::Type::String
     name: 'clusterId'
@@ -106,7 +127,7 @@ properties:
     output: true
     description: |
       The system-generated UID of the resource.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: 'User-defined labels for the alloydb cluster.'
   - !ruby/object:Api::Type::NestedObject
@@ -179,16 +200,60 @@ properties:
             output: true
   - !ruby/object:Api::Type::String
     name: 'network'
-    required: true
+    exactly_one_of:
+      - network
+      - network_config.0.network
+    default_from_api: true
+    deprecation_message: >-
+      `network` is deprecated and will be removed in a future major release. Instead, use `network_config` to define the network configuration.
     description: |
       The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:
 
       "projects/{projectNumber}/global/networks/{network_id}".
     diff_suppress_func: 'tpgresource.ProjectNumberDiffSuppress'
+  - !ruby/object:Api::Type::NestedObject
+    name: 'networkConfig'
+    description: |
+      Metadata related to network configuration.
+    default_from_api: true
+    properties:
+      - !ruby/object:Api::Type::String
+        name: network
+        exactly_one_of:
+          - network
+          - network_config.0.network
+        description: |
+          The resource link for the VPC network in which cluster resources are created and from which they are accessible via Private IP. The network must belong to the same project as the cluster.
+          It is specified in the form: "projects/{projectNumber}/global/networks/{network_id}".
+        diff_suppress_func: 'tpgresource.ProjectNumberDiffSuppress'
+      - !ruby/object:Api::Type::String
+        name: allocatedIpRange
+        description: |
+          The name of the allocated IP range for the private IP AlloyDB cluster. For example: "google-managed-services-default".
+          If set, the instance IPs for this cluster will be created in the allocated range.
   - !ruby/object:Api::Type::String
     name: 'displayName'
     description: |
       User-settable and human-readable display name for the Cluster.
+  - !ruby/object:Api::Type::String
+    name: 'etag'
+    description: 'For Resource freshness validation (https://google.aip.dev/154)'
+  - !ruby/object:Api::Type::Boolean
+    name: 'reconciling'
+    output: true
+    description: |
+      Output only. Reconciling (https://google.aip.dev/128#reconciliation).
+      Set to true if the current state of Cluster does not match the user's intended state, and the service is actively updating the resource to reconcile them.
+      This can happen due to user-triggered updates or system actions like failover or maintenance.
+  - !ruby/object:Api::Type::String
+    name: 'state'
+    output: true
+    description: 'Output only. The current serving state of the cluster.'
+  - !ruby/object:Api::Type::KeyValueAnnotations
+    name: 'annotations'
+    description: |
+      Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. https://google.aip.dev/128
+      An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
   - !ruby/object:Api::Type::String
     name: 'databaseVersion'
     output: true
@@ -318,13 +383,11 @@ properties:
           - !ruby/object:Api::Type::Array
             name: 'daysOfWeek'
             min_size: 1
-            description: |
-              The days of the week to perform a backup. At least one day of the week must be provided.
+            description: 'The days of the week to perform a backup. At least one day of the week must be provided.'
             item_type: !ruby/object:Api::Type::Enum
               name: 'daysOfWeek'
               required: true
-              description: |
-                The days of the week to perform a backup. At least one day of the week must be provided.
+              description: 'The days of the week to perform a backup. At least one day of the week must be provided.'
               values:
                 - :MONDAY
                 - :TUESDAY
@@ -410,3 +473,33 @@ properties:
       - !ruby/object:Api::Type::String
         name: 'sourceType'
         description: 'Type of migration source.'
+  - !ruby/object:Api::Type::Enum
+    name: clusterType
+    values:
+      - :PRIMARY
+      - :SECONDARY
+    default_value: :PRIMARY
+    description: |
+      The type of cluster. If not set, defaults to PRIMARY.
+  - !ruby/object:Api::Type::NestedObject
+    name: "secondaryConfig"
+    description: |
+      Configuration of the secondary cluster for Cross Region Replication. This should be set if and only if the cluster is of type SECONDARY.
+    properties:
+      - !ruby/object:Api::Type::String
+        name: "primaryClusterName"
+        required: true
+        description: |
+          Name of the primary cluster must be in the format
+          'projects/{project}/locations/{location}/clusters/{cluster_id}'
+virtual_fields:
+  - !ruby/object:Api::Type::Enum
+    name: 'deletion_policy'
+    description: |
+      Policy to determine if the cluster should be deleted forcefully.
+      Deleting a cluster forcefully, deletes the cluster and all its associated instances within the cluster.
+      Deleting a Secondary cluster with a secondary instance REQUIRES setting deletion_policy = "FORCE" otherwise an error is returned. This is needed as there is no support to delete just the secondary instance, and the only way to delete secondary instance is to delete the associated secondary cluster forcefully which also deletes the secondary instance.
+    values:
+      - :DEFAULT
+      - :FORCE
+    default_value: :DEFAULT
diff --git a/mmv1/products/alloydb/Instance.yaml b/mmv1/products/alloydb/Instance.yaml
index a8929b3965c7..9f71e922bb9e 100644
--- a/mmv1/products/alloydb/Instance.yaml
+++ b/mmv1/products/alloydb/Instance.yaml
@@ -13,6 +13,11 @@
 
 --- !ruby/object:Api::Resource
 name: 'Instance'
+docs: !ruby/object:Provider::Terraform::Docs
+  warning: |
+    Deleting an instance with instanceType = SECONDARY does not delete the secondary instance, and abandons it instead.
+    Use deletion_policy = "FORCE" in the associated secondary cluster and delete the cluster forcefully to delete the secondary cluster as well its associated secondary instance.
+    Users can undo the delete secondary instance action by importing the deleted secondary instance by calling terraform import.
 self_link: '{{cluster}}/instances/{{instance_id}}'
 base_url: '{{cluster}}/instances?instanceId={{instance_id}}'
 update_verb: :PATCH
@@ -28,9 +33,9 @@ async: !ruby/object:Api::OpAsync
     base_url: '{{op_id}}'
     wait_ms: 1000
     timeouts: !ruby/object:Api::Timeouts
-      insert_minutes: 40
-      update_minutes: 40
-      delete_minutes: 40
+      insert_minutes: 120
+      update_minutes: 120
+      delete_minutes: 120
   result: !ruby/object:Api::OpAsync::Result
     path: 'response'
   status: !ruby/object:Api::OpAsync::Status
@@ -49,6 +54,8 @@ skip_sweeper: true
 autogen_async: true
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   custom_import: templates/terraform/custom_import/alloydb_instance.go.erb
+  pre_create: templates/terraform/pre_create/alloydb_instance.go.erb
+  pre_delete: templates/terraform/pre_delete/alloydb_instance.go.erb
 examples:
   - !ruby/object:Provider::Terraform::Examples
     name: 'alloydb_instance_basic'
@@ -57,11 +64,51 @@ examples:
       alloydb_cluster_name: 'alloydb-cluster'
       alloydb_instance_name: 'alloydb-instance'
       network_name: 'alloydb-network'
+    ignore_read_extra:
+      - 'reconciling'
+      - 'update_time'
+    skip_test: true
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'alloydb_secondary_instance_basic'
+    primary_resource_id: 'secondary'
+    vars:
+      alloydb_primary_cluster_name: 'alloydb-primary-cluster'
+      alloydb_primary_instance_name: 'alloydb-primary-instance'
+      alloydb_secondary_cluster_name: 'alloydb-secondary-cluster'
+      alloydb_secondary_instance_name: 'alloydb-secondary-instance'
+      network_name: 'alloydb-secondary-network'
+    ignore_read_extra:
+      - 'reconciling'
+      - 'update_time'
+    skip_test: true
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'alloydb_instance_basic_test'
+    primary_resource_id: 'default'
+    vars:
+      alloydb_cluster_name: 'alloydb-cluster'
+      alloydb_instance_name: 'alloydb-instance'
+      network_name: 'alloydb-network'
+    test_vars_overrides:
+      network_name: 'acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1")'
+    ignore_read_extra:
+      - 'reconciling'
+      - 'update_time'
+    skip_docs: true
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'alloydb_secondary_instance_basic_test'
+    primary_resource_id: 'secondary'
+    vars:
+      alloydb_primary_cluster_name: 'alloydb-primary-cluster'
+      alloydb_primary_instance_name: 'alloydb-primary-instance'
+      alloydb_secondary_cluster_name: 'alloydb-secondary-cluster'
+      alloydb_secondary_instance_name: 'alloydb-secondary-instance'
+      network_name: 'alloydb-secondary-network'
     test_vars_overrides:
-      network_name: 'acctest.BootstrapSharedTestNetwork(t, "alloydb-instance-basic")'
+      network_name: 'acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1")'
     ignore_read_extra:
       - 'reconciling'
       - 'update_time'
+    skip_docs: true
 parameters:
   - !ruby/object:Api::Type::ResourceRef
     name: 'cluster'
@@ -101,10 +148,10 @@ properties:
     output: true
     description: |
       The system-generated UID of the resource.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: 'User-defined labels for the alloydb instance.'
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueAnnotations
     name: 'annotations'
     description:
       'Annotations to allow client tools to store small amount of arbitrary
@@ -155,15 +202,39 @@ properties:
     required: true
     immutable: true
     description: |
-      The type of the instance. If the instance type is READ_POOL, provide the associated PRIMARY instance in the `depends_on` meta-data attribute.
+      The type of the instance.
+      If the instance type is READ_POOL, provide the associated PRIMARY/SECONDARY instance in the `depends_on` meta-data attribute.
+      If the instance type is SECONDARY, point to the cluster_type of the associated secondary cluster instead of mentioning SECONDARY.
+      Example: {instance_type = google_alloydb_cluster.<secondary_cluster_name>.cluster_type} instead of {instance_type = SECONDARY}
+      If the instance type is SECONDARY, the terraform delete instance operation does not delete the secondary instance but abandons it instead.
+      Use deletion_policy = "FORCE" in the associated secondary cluster and delete the cluster forcefully to delete the secondary cluster as well its associated secondary instance.
+      Users can undo the delete secondary instance action by importing the deleted secondary instance by calling terraform import.
     values:
       - :PRIMARY
       - :READ_POOL
+      - :SECONDARY
   - !ruby/object:Api::Type::String
     name: 'ipAddress'
     output: true
     description: |
       The IP address for the Instance. This is the connection endpoint for an end-user application.
+  - !ruby/object:Api::Type::NestedObject
+    name: 'queryInsightsConfig'
+    default_from_api: true
+    description: 'Configuration for query insights.'
+    properties:
+      - !ruby/object:Api::Type::Integer
+        name: 'queryStringLength'
+        description: 'Query string length. The default value is 1024. Any integer between 256 and 4500 is considered valid.'
+      - !ruby/object:Api::Type::Boolean
+        name: 'recordApplicationTags'
+        description: 'Record application tags for an instance. This flag is turned "on" by default.'
+      - !ruby/object:Api::Type::Boolean
+        name: 'recordClientAddress'
+        description: 'Record client address for an instance. Client address is PII information. This flag is turned "on" by default.'
+      - !ruby/object:Api::Type::Integer
+        name: 'queryPlansPerMinute'
+        description: 'Number of query execution plans captured by Insights per minute for all queries combined. The default value is 5. Any integer between 0 and 20 is considered valid.'
   - !ruby/object:Api::Type::NestedObject
     name: 'readPoolConfig'
     description: 'Read pool specific config. If the instance type is READ_POOL, this configuration must be provided.'
@@ -183,3 +254,26 @@ properties:
         description: "The number of CPU's in the VM instance."
 
         default_from_api: true
+  - !ruby/object:Api::Type::NestedObject
+    name: 'clientConnectionConfig'
+    default_from_api: true
+    description: |
+      Client connection specific configurations.
+    properties:
+      - !ruby/object:Api::Type::Boolean
+        name: requireConnectors
+        description: |
+          Configuration to enforce connectors only (ex: AuthProxy) connections to the database.
+      - !ruby/object:Api::Type::NestedObject
+        name: 'sslConfig'
+        default_from_api: true
+        description: |
+          SSL config option for this instance.
+        properties:
+          - !ruby/object:Api::Type::Enum
+            name: 'sslMode'
+            default_from_api: true
+            description: 'SSL mode. Specifies client-server SSL/TLS connection behavior.'
+            values:
+              - :ENCRYPTED_ONLY
+              - :ALLOW_UNENCRYPTED_AND_ENCRYPTED
diff --git a/mmv1/products/alloydb/User.yaml b/mmv1/products/alloydb/User.yaml
new file mode 100644
index 000000000000..1f3ad0f76698
--- /dev/null
+++ b/mmv1/products/alloydb/User.yaml
@@ -0,0 +1,124 @@
+# Copyright 2023 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+--- !ruby/object:Api::Resource
+name: 'User'
+self_link: '{{cluster}}/users/{{user_id}}'
+base_url: '{{cluster}}/users'
+create_url: '{{cluster}}/users?userId={{user_id}}'
+update_url: '{{cluster}}/users?userId={{user_id}}'
+update_verb: :POST
+description: 'A database user in an AlloyDB cluster.'
+references: !ruby/object:Api::Resource::ReferenceLinks
+  guides:
+    'AlloyDB': 'https://cloud.google.com/alloydb/docs/'
+  api: 'https://cloud.google.com/alloydb/docs/reference/rest/v1/projects.locations.clusters.users/create'
+import_format: ['projects/{{project}}/locations/{{location}}/clusters/{{cluster}}/users/{{user_id}}']
+skip_sweeper: true
+autogen_async: true
+custom_code: !ruby/object:Provider::Terraform::CustomCode
+  custom_import: templates/terraform/custom_import/alloydb_user.go.erb
+examples:
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'alloydb_user_builtin'
+    primary_resource_id: 'user1'
+    vars:
+      alloydb_cluster_name: 'alloydb-cluster'
+      alloydb_cluster_pass: 'cluster_secret'
+      alloydb_instance_name: 'alloydb-instance'
+      alloydb_user_name: 'user1'
+      alloydb_user_pass: 'user_secret'
+      network_name: 'alloydb-network'
+    ignore_read_extra:
+      - 'password'
+    skip_test: true
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'alloydb_user_builtin_test'
+    primary_resource_id: 'user1'
+    vars:
+      alloydb_cluster_name: 'alloydb-cluster'
+      alloydb_cluster_pass: 'cluster_secret'
+      alloydb_instance_name: 'alloydb-instance'
+      alloydb_user_name: 'user1'
+      alloydb_user_pass: 'user_secret'
+      network_name: 'alloydb-network'
+    test_vars_overrides:
+      network_name: 'acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1")'
+    ignore_read_extra:
+      - 'password'
+    skip_docs: true
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'alloydb_user_iam'
+    primary_resource_id: 'user2'
+    vars:
+      alloydb_cluster_name: 'alloydb-cluster'
+      alloydb_instance_name: 'alloydb-instance'
+      alloydb_cluster_pass: 'cluster_secret'
+      alloydb_user_name: 'user2@foo.com'
+      network_name: 'alloydb-network'
+    skip_test: true
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'alloydb_user_iam_test'
+    primary_resource_id: 'user2'
+    vars:
+      alloydb_cluster_name: 'alloydb-cluster'
+      alloydb_instance_name: 'alloydb-instance'
+      alloydb_cluster_pass: 'cluster_secret'
+      alloydb_user_name: 'user2@foo.com'
+      network_name: 'alloydb-network'
+    test_vars_overrides:
+      network_name: 'acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1")'
+    skip_docs: true
+parameters:
+  - !ruby/object:Api::Type::ResourceRef
+    name: 'cluster'
+    description: |
+      Identifies the alloydb cluster. Must be in the format
+      'projects/{project}/locations/{location}/clusters/{cluster_id}'
+    required: true
+    immutable: true
+    resource: 'Cluster'
+    imports: 'name'
+    url_param_only: true
+  - !ruby/object:Api::Type::String
+    name: 'userId'
+    required: true
+    immutable: true
+    url_param_only: true
+    description: |
+      The database role name of the user.
+  - !ruby/object:Api::Type::Enum
+    name: 'userType'
+    required: true
+    immutable: true
+    description: |
+      The type of this user.
+    values:
+      - :ALLOYDB_BUILT_IN
+      - :ALLOYDB_IAM_USER
+properties:
+  - !ruby/object:Api::Type::String
+    name: 'name'
+    output: true
+    description: |
+      Name of the resource in the form of projects/{project}/locations/{location}/clusters/{cluster}/users/{user}.
+  - !ruby/object:Api::Type::String
+    name: 'password'
+    ignore_read: true
+    description: |
+      Password for this database user.
+  - !ruby/object:Api::Type::Array
+    name: 'databaseRoles'
+    item_type: Api::Type::String
+    description: |
+      List of database roles this database user has.
diff --git a/mmv1/products/apigateway/ApiConfig.yaml b/mmv1/products/apigateway/ApiConfig.yaml
index 2c795186cbed..da35b85703d9 100644
--- a/mmv1/products/apigateway/ApiConfig.yaml
+++ b/mmv1/products/apigateway/ApiConfig.yaml
@@ -120,7 +120,7 @@ properties:
     output: true
     description: |
       The ID of the associated Service Config (https://cloud.google.com/service-infrastructure/docs/glossary#config).
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Resource labels to represent user-provided metadata.
diff --git a/mmv1/products/apigateway/ApiResource.yaml b/mmv1/products/apigateway/ApiResource.yaml
index f295dd636fee..93ae56e5e75b 100644
--- a/mmv1/products/apigateway/ApiResource.yaml
+++ b/mmv1/products/apigateway/ApiResource.yaml
@@ -87,7 +87,7 @@ properties:
     name: 'createTime'
     description: Creation timestamp in RFC3339 text format.
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Resource labels to represent user-provided metadata.
diff --git a/mmv1/products/apigateway/Gateway.yaml b/mmv1/products/apigateway/Gateway.yaml
index 5ce68c7f3315..9dc7b3b17b02 100644
--- a/mmv1/products/apigateway/Gateway.yaml
+++ b/mmv1/products/apigateway/Gateway.yaml
@@ -102,7 +102,7 @@ properties:
     description:
       The default API Gateway host name of the form
       {gatewayId}-{hash}.{region_code}.gateway.dev.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Resource labels to represent user-provided metadata.
diff --git a/mmv1/products/apigee/Environment.yaml b/mmv1/products/apigee/Environment.yaml
index 83ca01541f8f..c9b343dc4a7b 100644
--- a/mmv1/products/apigee/Environment.yaml
+++ b/mmv1/products/apigee/Environment.yaml
@@ -87,7 +87,7 @@ examples:
       # Resource creation race
     skip_vcr: true
   - !ruby/object:Provider::Terraform::Examples
-    name: 'apigee_environment_nodeconfig_test'
+    name: 'apigee_environment_type_test'
     primary_resource_id: 'apigee_environment'
     primary_resource_name: "fmt.Sprintf(\"organizations/tf-test%s\",
       context[\"random_suffix\"\
@@ -184,3 +184,16 @@ properties:
           The current total number of gateway nodes that each environment currently has across
           all instances.
         output: true
+  - !ruby/object:Api::Type::Enum
+    name: 'type'
+    description: |
+      Types that can be selected for an Environment. Each of the types are
+      limited by capability and capacity. Refer to Apigee's public documentation
+      to understand about each of these types in details.
+      An Apigee org can support heterogeneous Environments.
+    default_from_api: true
+    values:
+      - 'ENVIRONMENT_TYPE_UNSPECIFIED'
+      - 'BASE'
+      - 'INTERMEDIATE'
+      - 'COMPREHENSIVE'
diff --git a/mmv1/products/apigee/Organization.yaml b/mmv1/products/apigee/Organization.yaml
index e6c0d808b8ad..912d95511a39 100644
--- a/mmv1/products/apigee/Organization.yaml
+++ b/mmv1/products/apigee/Organization.yaml
@@ -60,6 +60,8 @@ examples:
     test_env_vars:
       org_id: :ORG_ID
       billing_account: :BILLING_ACCT
+    ignore_read_extra:
+      - properties
     skip_docs:
       true
       # Resource creation race
@@ -76,6 +78,8 @@ examples:
     test_env_vars:
       org_id: :ORG_ID
       billing_account: :BILLING_ACCT
+    ignore_read_extra:
+      - properties
     skip_docs:
       true
       # Resource creation race
diff --git a/mmv1/products/artifactregistry/Repository.yaml b/mmv1/products/artifactregistry/Repository.yaml
index 4a7e32d73a1c..8eda7c11a07f 100644
--- a/mmv1/products/artifactregistry/Repository.yaml
+++ b/mmv1/products/artifactregistry/Repository.yaml
@@ -82,6 +82,18 @@ examples:
     vars:
       repository_id: 'my-repository'
       description: 'example remote docker repository'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'artifact_registry_repository_remote_apt'
+    primary_resource_id: 'my-repo'
+    vars:
+      repository_id: 'debian-buster'
+      description: 'example remote apt repository'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'artifact_registry_repository_remote_yum'
+    primary_resource_id: 'my-repo'
+    vars:
+      repository_id: 'centos-8'
+      description: 'example remote yum repository'
   - !ruby/object:Provider::Terraform::Examples
     name: 'artifact_registry_repository_cleanup'
     min_version: beta
@@ -131,7 +143,7 @@ properties:
     name: description
     description: |-
       The user-provided description of the repository.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Labels with user-defined metadata.
@@ -328,13 +340,49 @@ properties:
         description: |-
           The description of the remote source.
         immutable: true
+      - !ruby/object:Api::Type::NestedObject
+        name: 'aptRepository'
+        exactly_one_of:
+          - remoteRepositoryConfig.0.apt_repository
+          - remoteRepositoryConfig.0.docker_repository
+          - remoteRepositoryConfig.0.maven_repository
+          - remoteRepositoryConfig.0.npm_repository
+          - remoteRepositoryConfig.0.python_repository
+          - remoteRepositoryConfig.0.yum_repository
+        description: |-
+          Specific settings for an Apt remote repository.
+        immutable: true
+        properties:
+          - !ruby/object:Api::Type::NestedObject
+            name: 'publicRepository'
+            description: |-
+              One of the publicly available Apt repositories supported by Artifact Registry.
+            immutable: true
+            properties:
+              - !ruby/object:Api::Type::Enum
+                name: 'repositoryBase'
+                required: true
+                description: |-
+                  A common public repository base for Apt, e.g. `"debian/dists/buster"`
+                immutable: true
+                values:
+                  - :DEBIAN
+                  - :UBUNTU
+              - !ruby/object:Api::Type::String
+                name: 'repositoryPath'
+                required: true
+                description: |-
+                  Specific repository from the base.
+                immutable: true
       - !ruby/object:Api::Type::NestedObject
         name: 'dockerRepository'
         exactly_one_of:
+          - remoteRepositoryConfig.0.apt_repository
           - remoteRepositoryConfig.0.docker_repository
           - remoteRepositoryConfig.0.maven_repository
           - remoteRepositoryConfig.0.npm_repository
           - remoteRepositoryConfig.0.python_repository
+          - remoteRepositoryConfig.0.yum_repository
         description: |-
           Specific settings for a Docker remote repository.
         immutable: true
@@ -352,10 +400,12 @@ properties:
       - !ruby/object:Api::Type::NestedObject
         name: 'mavenRepository'
         exactly_one_of:
+          - remoteRepositoryConfig.0.apt_repository
           - remoteRepositoryConfig.0.docker_repository
           - remoteRepositoryConfig.0.maven_repository
           - remoteRepositoryConfig.0.npm_repository
           - remoteRepositoryConfig.0.python_repository
+          - remoteRepositoryConfig.0.yum_repository
         description: |-
           Specific settings for a Maven remote repository.
         immutable: true
@@ -373,10 +423,12 @@ properties:
       - !ruby/object:Api::Type::NestedObject
         name: 'npmRepository'
         exactly_one_of:
+          - remoteRepositoryConfig.0.apt_repository
           - remoteRepositoryConfig.0.docker_repository
           - remoteRepositoryConfig.0.maven_repository
           - remoteRepositoryConfig.0.npm_repository
           - remoteRepositoryConfig.0.python_repository
+          - remoteRepositoryConfig.0.yum_repository
         description: |-
           Specific settings for an Npm remote repository.
         immutable: true
@@ -394,10 +446,12 @@ properties:
       - !ruby/object:Api::Type::NestedObject
         name: 'pythonRepository'
         exactly_one_of:
+          - remoteRepositoryConfig.0.apt_repository
           - remoteRepositoryConfig.0.docker_repository
           - remoteRepositoryConfig.0.maven_repository
           - remoteRepositoryConfig.0.npm_repository
           - remoteRepositoryConfig.0.python_repository
+          - remoteRepositoryConfig.0.yum_repository
         description: |-
           Specific settings for a Python remote repository.
         immutable: true
@@ -412,6 +466,45 @@ properties:
             values:
               - :PYPI
             default_value: :PYPI
+      - !ruby/object:Api::Type::NestedObject
+        name: 'yumRepository'
+        exactly_one_of:
+          - remoteRepositoryConfig.0.apt_repository
+          - remoteRepositoryConfig.0.docker_repository
+          - remoteRepositoryConfig.0.maven_repository
+          - remoteRepositoryConfig.0.npm_repository
+          - remoteRepositoryConfig.0.python_repository
+          - remoteRepositoryConfig.0.yum_repository
+        description: |-
+          Specific settings for an Yum remote repository.
+        immutable: true
+        properties:
+          - !ruby/object:Api::Type::NestedObject
+            name: 'publicRepository'
+            description: |-
+              One of the publicly available Yum repositories supported by Artifact Registry.
+            immutable: true
+            properties:
+              - !ruby/object:Api::Type::Enum
+                name: 'repositoryBase'
+                required: true
+                description: |-
+                  A common public repository base for Yum.
+                immutable: true
+                values:
+                  - :CENTOS
+                  - :CENTOS_DEBUG
+                  - :CENTOS_VAULT
+                  - :CENTOS_STREAM
+                  - :ROCKY
+                  - :EPEL
+              - !ruby/object:Api::Type::String
+                name: 'repositoryPath'
+                required: true
+                description: |-
+                  Specific repository from the base, e.g. `"centos/8-stream/BaseOS/x86_64/os"`
+                immutable: true
+
   - !ruby/object:Api::Type::Boolean
     name: 'cleanupPolicyDryRun'
     min_version: beta
diff --git a/mmv1/products/artifactregistry/VPCSCConfig.yaml b/mmv1/products/artifactregistry/VPCSCConfig.yaml
new file mode 100644
index 000000000000..6751669c1bb3
--- /dev/null
+++ b/mmv1/products/artifactregistry/VPCSCConfig.yaml
@@ -0,0 +1,70 @@
+# Copyright 2023 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+--- !ruby/object:Api::Resource
+name: 'VPCSCConfig'
+description: |-
+  The Artifact Registry VPC SC config that applies to a Project.
+references: !ruby/object:Api::Resource::ReferenceLinks
+  api: 'https://cloud.google.com/artifact-registry/docs/reference/rest/v1/VPCSCConfig'
+min_version: beta
+docs: !ruby/object:Provider::Terraform::Docs
+  note: |-
+    VPC SC configs are automatically created for a given location. Creating a
+    resource of this type will acquire and update the resource that already
+    exists at the location. Deleting this resource will remove the config from
+    your Terraform state but leave the resource as is.
+base_url: 'projects/{{project}}/locations/{{location}}/vpcscConfig'
+self_link: 'projects/{{project}}/locations/{{location}}/vpcscConfig'
+create_url: 'projects/{{project}}/locations/{{location}}/vpcscConfig'
+create_verb: :PATCH
+update_verb: :PATCH
+skip_delete: true
+examples:
+  - !ruby/object:Provider::Terraform::Examples
+    # Requires VPC SC Policy configured on organization
+    skip_test: true
+    name: 'artifact_registry_vpcsc_config'
+    primary_resource_id: 'my-config'
+autogen_async: false
+async: !ruby/object:Api::OpAsync
+  actions: []
+  # necessary to compile
+  operation: !ruby/object:Api::OpAsync::Operation
+    base_url: '{{op_id}}'
+custom_code: !ruby/object:Provider::Terraform::CustomCode
+  encoder: templates/terraform/encoders/location_from_region.go.erb
+parameters:
+  - !ruby/object:Api::Type::String
+    name: location
+    required: false
+    immutable: true
+    url_param_only: true
+    default_from_api: true
+    description: |
+      The name of the location this config is located in.
+  - !ruby/object:Api::Type::String
+    name: name
+    output: true
+    description: |-
+      The name of the project's VPC SC Config.
+      Always of the form: projects/{project}/location/{location}/vpcscConfig
+properties:
+  - !ruby/object:Api::Type::Enum
+    name: vpcscPolicy
+    min_version: beta
+    description: |-
+      The VPC SC policy for project and location.
+    values:
+      - :DENY
+      - :ALLOW
diff --git a/mmv1/products/backupdr/ManagementServer.yaml b/mmv1/products/backupdr/ManagementServer.yaml
index 74457a21310e..fc70378dae56 100644
--- a/mmv1/products/backupdr/ManagementServer.yaml
+++ b/mmv1/products/backupdr/ManagementServer.yaml
@@ -39,6 +39,19 @@ examples:
       managementserver_name: 'ms-console'
     test_env_vars:
       project: :PROJECT_NAME
+    skip_test: true
+  - !ruby/object:Provider::Terraform::Examples
+    min_version: beta
+    name: 'backup_dr_management_server_test'
+    primary_resource_id: 'ms-console'
+    vars:
+      network_name: 'vpc-network'
+      managementserver_name: 'ms-console'
+    test_env_vars:
+      project: :PROJECT_NAME
+    test_vars_overrides:
+      network_name: 'acctest.BootstrapSharedServiceNetworkingConnection(t, "vpc-network-1")'
+    skip_docs: true
 parameters:
   - !ruby/object:Api::Type::String
     name: 'location'
diff --git a/mmv1/products/beyondcorp/AppConnection.yaml b/mmv1/products/beyondcorp/AppConnection.yaml
index 215bac419709..1ebf2c7368fb 100644
--- a/mmv1/products/beyondcorp/AppConnection.yaml
+++ b/mmv1/products/beyondcorp/AppConnection.yaml
@@ -88,7 +88,7 @@ properties:
     name: 'displayName'
     description: |
       An arbitrary user-provided name for the AppConnection.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Resource labels to represent user provided metadata.
diff --git a/mmv1/products/beyondcorp/AppConnector.yaml b/mmv1/products/beyondcorp/AppConnector.yaml
index 20a6b3a11bcc..fb8e23bedbf6 100644
--- a/mmv1/products/beyondcorp/AppConnector.yaml
+++ b/mmv1/products/beyondcorp/AppConnector.yaml
@@ -82,7 +82,7 @@ properties:
     name: 'displayName'
     description: |
       An arbitrary user-provided name for the AppConnector.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Resource labels to represent user provided metadata.
diff --git a/mmv1/products/beyondcorp/AppGateway.yaml b/mmv1/products/beyondcorp/AppGateway.yaml
index 1eda5d9eeefe..7d6fc2fc42fe 100644
--- a/mmv1/products/beyondcorp/AppGateway.yaml
+++ b/mmv1/products/beyondcorp/AppGateway.yaml
@@ -98,7 +98,7 @@ properties:
     name: 'displayName'
     description: |
       An arbitrary user-provided name for the AppGateway.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Resource labels to represent user provided metadata.
diff --git a/mmv1/products/bigquery/Dataset.yaml b/mmv1/products/bigquery/Dataset.yaml
index 7cd95a4eb7f1..4e8540977f17 100644
--- a/mmv1/products/bigquery/Dataset.yaml
+++ b/mmv1/products/bigquery/Dataset.yaml
@@ -140,6 +140,11 @@ properties:
 
 
             * `allAuthenticatedUsers`: All authenticated BigQuery users.
+        - !ruby/object:Api::Type::String
+          name: 'iamMember'
+          description: |
+            Some other type of member that appears in the IAM Policy but isn't a user,
+            group, domain, or special group. For example: `allUsers`
         - !ruby/object:Api::Type::String
           name: 'userByEmail'
           description: |
@@ -290,12 +295,11 @@ properties:
     name: 'friendlyName'
     description: A descriptive name for the dataset
     send_empty_value: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       The labels associated with this dataset. You can use these to
-      organize and group your datasets
-    default_from_api: true
+      organize and group your datasets.
   - !ruby/object:Api::Type::Integer
     name: 'lastModifiedTime'
     description: |
diff --git a/mmv1/products/bigquery/Job.yaml b/mmv1/products/bigquery/Job.yaml
index cf12ae9fdf3d..016f76d03a72 100644
--- a/mmv1/products/bigquery/Job.yaml
+++ b/mmv1/products/bigquery/Job.yaml
@@ -168,7 +168,7 @@ properties:
         name: 'jobTimeoutMs'
         description: |
           Job timeout in milliseconds. If this time limit is exceeded, BigQuery may attempt to terminate the job.
-      - !ruby/object:Api::Type::KeyValuePairs
+      - !ruby/object:Api::Type::KeyValueLabels
         name: 'labels'
         description: |
           The labels associated with this job. You can use these to organize and group your jobs.
diff --git a/mmv1/products/bigquery/Routine.yaml b/mmv1/products/bigquery/Routine.yaml
index 054100c13ee9..7e57fd7dd1fb 100644
--- a/mmv1/products/bigquery/Routine.yaml
+++ b/mmv1/products/bigquery/Routine.yaml
@@ -76,6 +76,7 @@ properties:
   - !ruby/object:Api::Type::Enum
     name: 'routineType'
     immutable: true
+    required: true
     description: The type of routine.
     values:
       - :SCALAR_FUNCTION
diff --git a/mmv1/products/bigquery/Table.yaml b/mmv1/products/bigquery/Table.yaml
index ae9c5bb81666..6913bf4f2dbc 100644
--- a/mmv1/products/bigquery/Table.yaml
+++ b/mmv1/products/bigquery/Table.yaml
@@ -88,7 +88,7 @@ properties:
     name: 'id'
     description: 'An opaque ID uniquely identifying the table.'
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       The labels associated with this dataset. You can use these to
@@ -175,7 +175,10 @@ properties:
         name: 'expirationMs'
         description: |
           Number of milliseconds for which to keep the storage for a
-          partition.
+          partition. If unspecified when the table is created in a dataset
+          that has `defaultPartitionExpirationMs`, it will inherit
+          the value of `defaultPartitionExpirationMs` from the dataset.
+          To specify a unlimited expiration, set the value to 0.
       - !ruby/object:Api::Type::String
         name: 'field'
         description: |
diff --git a/mmv1/products/bigqueryconnection/Connection.yaml b/mmv1/products/bigqueryconnection/Connection.yaml
index dd483bbcb432..253e6299b96e 100644
--- a/mmv1/products/bigqueryconnection/Connection.yaml
+++ b/mmv1/products/bigqueryconnection/Connection.yaml
@@ -111,10 +111,10 @@ examples:
     vars:
       connection_id: 'my-connection'
       database: 'projects/project/instances/instance/databases/database'
+      database_role: 'database_role'
   - !ruby/object:Provider::Terraform::Examples
-    name: 'bigquery_connection_cloudspanner_analytics'
+    name: 'bigquery_connection_cloudspanner_databoost'
     pull_external: true
-    skip_docs: true
     primary_resource_id: 'connection'
     vars:
       connection_id: 'my-connection'
@@ -299,18 +299,48 @@ properties:
       - !ruby/object:Api::Type::String
         name: 'database'
         description:
-          Cloud Spanner database in the form `project/instance/database'
+          Cloud Spanner database in the form `project/instance/database'.
         required: true
       - !ruby/object:Api::Type::Boolean
         name: 'useParallelism'
         description:
-          If parallelism should be used when reading from Cloud Spanner
+          If parallelism should be used when reading from Cloud Spanner.
+      - !ruby/object:Api::Type::Integer
+        name: 'maxParallelism'
+        description:
+          Allows setting max parallelism per query when executing on Spanner independent compute
+          resources. If unspecified, default values of parallelism are chosen that are dependent on
+          the Cloud Spanner instance configuration. `useParallelism` and `useDataBoost` must be set
+          when setting max parallelism.
+        required_with:
+          - cloudSpanner.0.useDataBoost
+          - cloudSpanner.0.useParallelism
+      - !ruby/object:Api::Type::Boolean
+        name: 'useDataBoost'
+        description:
+          If set, the request will be executed via Spanner independent compute resources.
+          `use_parallelism` must be set when using data boost.
+        required_with:
+          - cloudSpanner.0.useParallelism
+      - !ruby/object:Api::Type::String
+        name: 'databaseRole'
+        description:
+          Cloud Spanner database role for fine-grained access control. The Cloud Spanner admin
+          should have provisioned the database role with appropriate permissions, such as `SELECT`
+          and `INSERT`. Other users should only use roles provided by their Cloud Spanner admins.
+          The database role name must start with a letter, and can only contain letters, numbers,
+          and underscores. For more details, see https://cloud.google.com/spanner/docs/fgac-about.
+        validation: !ruby/object:Provider::Terraform::Validation
+          regex: '^[a-zA-Z][a-zA-Z0-9_]*$'
       - !ruby/object:Api::Type::Boolean
         name: 'useServerlessAnalytics'
         description:
           If the serverless analytics service should be used to read data from
-          Cloud Spanner. useParallelism must be set when using serverless
-          analytics
+          Cloud Spanner. `useParallelism` must be set when using serverless
+          analytics.
+        deprecation_message: >-
+          `useServerlessAnalytics` is deprecated and will be removed in a future major release. Use
+          `useDataBoost` instead.
   - !ruby/object:Api::Type::NestedObject
     name: cloudResource
     description:
diff --git a/mmv1/products/bigquerydatatransfer/Config.yaml b/mmv1/products/bigquerydatatransfer/Config.yaml
index aa6c92c8e02c..0a6e540b46c8 100644
--- a/mmv1/products/bigquerydatatransfer/Config.yaml
+++ b/mmv1/products/bigquerydatatransfer/Config.yaml
@@ -15,7 +15,7 @@
 name: 'Config'
 base_url: projects/{{project}}/locations/{{location}}/transferConfigs?serviceAccountName={{service_account_name}}
 self_link: '{{name}}'
-update_url: "{{name}}?serviceAccountName={{service_account_name}}&updateMask=serviceAccountName,displayName,destinationDatasetId,schedule,scheduleOptions,emailPreferences,notificationPubsubTopic,dataRefreshWindowDays,disabled,params"
+update_url: "{{name}}?serviceAccountName={{service_account_name}}"
 update_verb: :PATCH
 description: |
   Represents a data transfer configuration. A transfer configuration
@@ -33,6 +33,7 @@ custom_code: !ruby/object:Provider::Terraform::CustomCode
   encoder: templates/terraform/encoders/bigquery_data_transfer.go.erb
   custom_import: templates/terraform/custom_import/bigquery_data_transfer_self_link_as_name_set_location.go.erb
   post_create: templates/terraform/post_create/set_computed_name.erb
+  pre_update: templates/terraform/pre_update/bigquerydatatransfer_config.erb
 custom_diff: [
   'sensitiveParamCustomizeDiff',
   'paramsCustomizeDiff',
diff --git a/mmv1/products/bigqueryreservation/CapacityCommitment.yaml b/mmv1/products/bigqueryreservation/CapacityCommitment.yaml
index bd51ff262e37..cc66888d7749 100644
--- a/mmv1/products/bigqueryreservation/CapacityCommitment.yaml
+++ b/mmv1/products/bigqueryreservation/CapacityCommitment.yaml
@@ -15,7 +15,7 @@
 name: 'CapacityCommitment'
 base_url: projects/{{project}}/locations/{{location}}/capacityCommitments
 create_url: projects/{{project}}/locations/{{location}}/capacityCommitments?capacityCommitmentId={{capacity_commitment_id}}
-self_link: 'projects/{{project}}/locations/{{location}}/capacityCommitments/{{capacity_commitment_id}}'
+self_link: '{{name}}'
 update_verb: :PATCH
 update_mask: true
 description: |
@@ -26,19 +26,25 @@ references: !ruby/object:Api::Resource::ReferenceLinks
   guides:
     'Introduction to Reservations': 'https://cloud.google.com/bigquery/docs/reservations-intro'
   api: 'https://cloud.google.com/bigquery/docs/reference/reservations/rest/v1/projects.locations.capacityCommitments'
-id_format: 'projects/{{project}}/locations/{{location}}/capacityCommitments/{{capacity_commitment_id}}'
+id_format: '{{name}}'
 import_format:
   [
     'projects/{{project}}/locations/{{location}}/capacityCommitments/{{capacity_commitment_id}}',
   ]
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   constants: templates/terraform/constants/bigquery_reservation_capacity_commitment.go.erb
+  custom_import: templates/terraform/custom_import/bigquery_reservation_capacity_commitment_set_id.go.erb
 examples:
   - !ruby/object:Provider::Terraform::Examples
     name: 'bigquery_reservation_capacity_commitment_basic'
     pull_external: true
     skip_docs: true
     primary_resource_id: 'commitment'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'bigquery_reservation_capacity_commitment_no_id'
+    pull_external: true
+    skip_docs: true
+    primary_resource_id: 'commitment'
   - !ruby/object:Provider::Terraform::Examples
     name: 'bigquery_reservation_capacity_commitment_docs'
     skip_test: true
@@ -102,7 +108,7 @@ properties:
   - !ruby/object:Api::Type::String
     name: 'renewalPlan'
     description: |
-      The plan this capacity commitment is converted to after commitmentEndTime passes. Once the plan is changed, committed period is extended according to commitment plan. Only applicable some commitment plans.
+      The plan this capacity commitment is converted to after commitmentEndTime passes. Once the plan is changed, committed period is extended according to commitment plan. Only applicable for some commitment plans.
   - !ruby/object:Api::Type::String
     name: 'edition'
     immutable: true
diff --git a/mmv1/products/bigtable/AppProfile.yaml b/mmv1/products/bigtable/AppProfile.yaml
index 4100ae507fa8..cfe4f4e10512 100644
--- a/mmv1/products/bigtable/AppProfile.yaml
+++ b/mmv1/products/bigtable/AppProfile.yaml
@@ -43,6 +43,8 @@ examples:
       deletion_protection: 'false'
     ignore_read_extra:
       - 'ignore_warnings'
+    # bigtable instance does not use the shared HTTP client, this test creates an instance
+    skip_vcr: true
   - !ruby/object:Provider::Terraform::Examples
     name: 'bigtable_app_profile_singlecluster'
     primary_resource_id: 'ap'
@@ -56,6 +58,8 @@ examples:
       deletion_protection: 'false'
     ignore_read_extra:
       - 'ignore_warnings'
+    # bigtable instance does not use the shared HTTP client, this test creates an instance
+    skip_vcr: true
   - !ruby/object:Provider::Terraform::Examples
     name: 'bigtable_app_profile_multicluster'
     primary_resource_id: 'ap'
@@ -69,6 +73,23 @@ examples:
       deletion_protection: 'false'
     ignore_read_extra:
       - 'ignore_warnings'
+    # bigtable instance does not use the shared HTTP client, this test creates an instance
+    skip_vcr: true
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'bigtable_app_profile_priority'
+    primary_resource_id: 'ap'
+    vars:
+      instance_name: 'bt-instance'
+      app_profile_name: 'bt-profile'
+      deletion_protection: 'true'
+    test_vars_overrides:
+      deletion_protection: 'false'
+    oics_vars_overrides:
+      deletion_protection: 'false'
+    ignore_read_extra:
+      - 'ignore_warnings'
+    # bigtable instance does not use the shared HTTP client, this test creates an instance
+    skip_vcr: true
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   encoder: templates/terraform/encoders/bigtable_app_profile.go.erb
   extra_schema_entry: templates/terraform/extra_schema_entry/bigtable_app_profile.go.erb
@@ -135,3 +156,18 @@ properties:
         description: |
           If true, CheckAndMutateRow and ReadModifyWriteRow requests are allowed by this app profile.
           It is unsafe to send these requests to the same table/row/column in multiple clusters.
+  - !ruby/object:Api::Type::NestedObject
+    name: 'standardIsolation'
+    default_from_api: true
+    description: |
+      The standard options used for isolating this app profile's traffic from other use cases.
+    properties:
+      - !ruby/object:Api::Type::Enum
+        name: 'priority'
+        required: true
+        description: |
+          The priority of requests sent using this app profile.
+        values:
+          - :PRIORITY_LOW
+          - :PRIORITY_MEDIUM
+          - :PRIORITY_HIGH
diff --git a/mmv1/products/billing/ProjectInfo.yaml b/mmv1/products/billing/ProjectInfo.yaml
index b55634709d98..e941f6aaaee7 100644
--- a/mmv1/products/billing/ProjectInfo.yaml
+++ b/mmv1/products/billing/ProjectInfo.yaml
@@ -28,11 +28,12 @@ custom_code: !ruby/object:Provider::Terraform::CustomCode
   encoder: templates/terraform/encoders/billing_project_info.go.erb
   test_check_destroy: templates/terraform/custom_check_destroy/billing_project_info.go.erb
 import_format:
-  ['projects/{{project}}', '{{project}}']
+  ['projects/{{%project}}', '{{%project}}']
 examples:
   - !ruby/object:Provider::Terraform::Examples
     name: 'billing_project_info_basic'
     primary_resource_id: 'default'
+    skip_import_test: true
     test_env_vars:
       billing_account: :BILLING_ACCT
       org_id: :ORG_ID
diff --git a/mmv1/products/certificatemanager/Certificate.yaml b/mmv1/products/certificatemanager/Certificate.yaml
index 552364c08bba..d6cc703156cb 100644
--- a/mmv1/products/certificatemanager/Certificate.yaml
+++ b/mmv1/products/certificatemanager/Certificate.yaml
@@ -71,6 +71,23 @@ examples:
     primary_resource_id: 'default'
     vars:
       cert_name: 'self-managed-cert'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'certificate_manager_google_managed_certificate_issuance_config_all_regions'
+    primary_resource_id: 'default'
+    vars:
+      cert_name: 'issuance-config-cert'
+      ca_name: 'ca-authority'
+      pool_name: 'ca-pool'
+      issuance_config_name: 'issuance-config'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'certificate_manager_google_managed_certificate_dns_all_regions'
+    primary_resource_id: 'default'
+    vars:
+      dns_auth_name: 'dns-auth'
+      dns_auth_subdomain: 'subdomain'
+      dns_auth_name2: 'dns-auth2'
+      dns_auth_subdomain2: 'subdomain2'
+      cert_name: 'dns-cert'
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   constants: templates/terraform/constants/cert_manager.erb
 parameters:
@@ -95,7 +112,7 @@ properties:
     name: 'description'
     description: |
       A human-readable description of the resource.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: 'Set of label tags associated with the Certificate resource.'
   - !ruby/object:Api::Type::String
@@ -107,11 +124,11 @@ properties:
       DEFAULT: Certificates with default scope are served from core Google data centers.
       If unsure, choose this option.
 
-      EDGE_CACHE: Certificates with scope EDGE_CACHE are special-purposed certificates,
-      served from non-core Google data centers.
+      EDGE_CACHE: Certificates with scope EDGE_CACHE are special-purposed certificates, served from Edge Points of Presence.
+      See https://cloud.google.com/vpc/docs/edge-locations.
 
       ALL_REGIONS: Certificates with ALL_REGIONS scope are served from all GCP regions (You can only use ALL_REGIONS with global certs).
-      see https://cloud.google.com/compute/docs/regions-zones
+      See https://cloud.google.com/compute/docs/regions-zones
     default_value: DEFAULT
     diff_suppress_func: 'certManagerDefaultScopeDiffSuppress'
   - !ruby/object:Api::Type::NestedObject
diff --git a/mmv1/products/certificatemanager/CertificateIssuanceConfig.yaml b/mmv1/products/certificatemanager/CertificateIssuanceConfig.yaml
index 6a994704207a..fa4cec9f21ac 100644
--- a/mmv1/products/certificatemanager/CertificateIssuanceConfig.yaml
+++ b/mmv1/products/certificatemanager/CertificateIssuanceConfig.yaml
@@ -109,7 +109,7 @@ properties:
       accurate to nanoseconds with up to nine fractional digits.
       Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       'Set of label tags associated with the CertificateIssuanceConfig resource.
diff --git a/mmv1/products/certificatemanager/CertificateMap.yaml b/mmv1/products/certificatemanager/CertificateMap.yaml
index 1342e8344e46..96df010f7666 100644
--- a/mmv1/products/certificatemanager/CertificateMap.yaml
+++ b/mmv1/products/certificatemanager/CertificateMap.yaml
@@ -76,11 +76,10 @@ properties:
       accurate to nanoseconds with up to nine fractional digits.
       Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Set of labels associated with a Certificate Map resource.
-    default_from_api: true
   - !ruby/object:Api::Type::Array
     name: 'gclbTargets'
     description: |
diff --git a/mmv1/products/certificatemanager/CertificateMapEntry.yaml b/mmv1/products/certificatemanager/CertificateMapEntry.yaml
index 296e342a6920..aa1ac5d57570 100644
--- a/mmv1/products/certificatemanager/CertificateMapEntry.yaml
+++ b/mmv1/products/certificatemanager/CertificateMapEntry.yaml
@@ -92,13 +92,12 @@ properties:
       with nanosecond resolution and up to nine fractional digits.
       Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Set of labels associated with a Certificate Map Entry.
       An object containing a list of "key": value pairs.
       Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
-    default_from_api: true
   - !ruby/object:Api::Type::Array
     name: 'certificates'
     required: true
diff --git a/mmv1/products/certificatemanager/DnsAuthorization.yaml b/mmv1/products/certificatemanager/DnsAuthorization.yaml
index fa6e636e7691..bcb50c60c329 100644
--- a/mmv1/products/certificatemanager/DnsAuthorization.yaml
+++ b/mmv1/products/certificatemanager/DnsAuthorization.yaml
@@ -63,7 +63,7 @@ properties:
     name: 'description'
     description: |
       A human-readable description of the resource.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description:
       'Set of label tags associated with the DNS Authorization resource.'
diff --git a/mmv1/products/certificatemanager/TrustConfig.yaml b/mmv1/products/certificatemanager/TrustConfig.yaml
index d4ff25e5256c..d7395fa22948 100644
--- a/mmv1/products/certificatemanager/TrustConfig.yaml
+++ b/mmv1/products/certificatemanager/TrustConfig.yaml
@@ -84,7 +84,7 @@ properties:
       A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
       Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: 'Set of label tags associated with the trust config.'
     immutable: true
diff --git a/mmv1/products/cloudbuild/BitbucketServerConfig.yaml b/mmv1/products/cloudbuild/BitbucketServerConfig.yaml
index d8b2f2763209..bd8bdd316f70 100644
--- a/mmv1/products/cloudbuild/BitbucketServerConfig.yaml
+++ b/mmv1/products/cloudbuild/BitbucketServerConfig.yaml
@@ -64,8 +64,6 @@ examples:
       config_id: 'bbs-config'
       network_name: 'vpc-network'
       global_address_name: 'private-ip-alloc'
-    test_vars_overrides:
-      network_name: 'acctest.BootstrapSharedTestNetwork(t, "peered-network")'
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   encoder: templates/terraform/encoders/cloudbuild_bitbucketserver_config.go.erb
   post_create: templates/terraform/post_create/cloudbuild_bitbucketserver_config.go.erb
diff --git a/mmv1/products/cloudfunctions/CloudFunction.yaml b/mmv1/products/cloudfunctions/CloudFunction.yaml
index ad310f7293ab..6ac2766e6ffe 100644
--- a/mmv1/products/cloudfunctions/CloudFunction.yaml
+++ b/mmv1/products/cloudfunctions/CloudFunction.yaml
@@ -129,7 +129,7 @@ properties:
     description: |
       The version identifier of the Cloud Function. Each deployment attempt
       results in a new version of a function being created.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       A set of key/value label pairs associated with this Cloud Function.
diff --git a/mmv1/products/cloudfunctions2/Function.yaml b/mmv1/products/cloudfunctions2/Function.yaml
index 69d5e04907b7..5b0a0ff36b0a 100644
--- a/mmv1/products/cloudfunctions2/Function.yaml
+++ b/mmv1/products/cloudfunctions2/Function.yaml
@@ -251,6 +251,7 @@ parameters:
   - !ruby/object:Api::Type::String
     name: 'location'
     immutable: true
+    required: true
     url_param_only: true
     description: The location of this cloud function.
 properties:
@@ -629,7 +630,7 @@ properties:
     name: 'updateTime'
     output: true
     description: 'The last update timestamp of a Cloud Function.'
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       A set of key/value label pairs associated with this Cloud Function.
diff --git a/mmv1/products/cloudidentity/Group.yaml b/mmv1/products/cloudidentity/Group.yaml
index a27a53223689..0fe37e0e21aa 100644
--- a/mmv1/products/cloudidentity/Group.yaml
+++ b/mmv1/products/cloudidentity/Group.yaml
@@ -128,6 +128,37 @@ properties:
     description: |
       An extended description to help users determine the purpose of a Group.
       Must not be longer than 4,096 characters.
+  - !ruby/object:Api::Type::Array
+    name: 'additionalGroupKeys'
+    output: true
+    description: 'Additional group keys associated with the Group'
+    item_type: !ruby/object:Api::Type::NestedObject
+      properties:
+        - !ruby/object:Api::Type::String
+          name: 'id'
+          output: true
+          description: |
+            The ID of the entity.
+
+            For Google-managed entities, the id must be the email address of an existing
+            group or user.
+
+            For external-identity-mapped entities, the id must be a string conforming
+            to the Identity Source's requirements.
+
+            Must be unique within a namespace.
+        - !ruby/object:Api::Type::String
+          name: 'namespace'
+          output: true
+          description: |
+            The namespace in which the entity exists.
+
+            If not specified, the EntityKey represents a Google-managed entity
+            such as a Google user or a Google Group.
+
+            If specified, the EntityKey represents an external-identity-mapped group.
+            The namespace must correspond to an identity source created in Admin Console
+            and must be in the form of `identitysources/{identity_source_id}`.
   - !ruby/object:Api::Type::String
     name: 'createTime'
     output: true
diff --git a/mmv1/products/cloudiot/Device.yaml b/mmv1/products/cloudiot/Device.yaml
deleted file mode 100644
index 6e893b5c3651..000000000000
--- a/mmv1/products/cloudiot/Device.yaml
+++ /dev/null
@@ -1,243 +0,0 @@
-# Copyright 2023 Google Inc.
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
---- !ruby/object:Api::Resource
-name: 'Device'
-base_url: '{{registry}}/devices'
-self_link: '{{registry}}/devices/{{name}}'
-update_verb: :PATCH
-update_mask: true
-description: |
-  A Google Cloud IoT Core device.
-references: !ruby/object:Api::Resource::ReferenceLinks
-  guides:
-    'Official Documentation': 'https://cloud.google.com/iot/docs/'
-  api: 'https://cloud.google.com/iot/docs/reference/cloudiot/rest/'
-import_format: ['{{%registry}}/devices/{{name}}']
-deprecation_message: >-
-  `google_cloudiot_device` is deprecated in the API. This resource will be removed in the next major release of the provider.
-examples:
-  - !ruby/object:Provider::Terraform::Examples
-    name: 'cloudiot_device_basic'
-    primary_resource_id: 'test-device'
-    vars:
-      cloudiot_device_name: 'cloudiot-device'
-      cloudiot_device_registry_name: 'cloudiot-device-registry'
-    test_env_vars:
-      project: :PROJECT_NAME
-      region: :REGION
-  - !ruby/object:Provider::Terraform::Examples
-    name: 'cloudiot_device_full'
-    primary_resource_id: 'test-device'
-    vars:
-      cloudiot_device_name: 'cloudiot-device'
-      cloudiot_device_registry_name: 'cloudiot-device-registry'
-    test_env_vars:
-      project: :PROJECT_NAME
-      region: :REGION
-parameters:
-  - !ruby/object:Api::Type::String
-    name: registry
-    immutable: true
-    url_param_only: true
-    required: true
-    description: |
-      The name of the device registry where this device should be created.
-properties:
-  - !ruby/object:Api::Type::String
-    name: 'name'
-    immutable: true
-    required: true
-    description: |
-      A unique name for the resource.
-    api_name: 'id'
-  - !ruby/object:Api::Type::String
-    name: 'numId'
-    output: true
-    description: |
-      A server-defined unique numeric ID for the device.
-      This is a more compact way to identify devices, and it is globally unique.
-  - !ruby/object:Api::Type::Array
-    name: 'credentials'
-    description: |
-      The credentials used to authenticate this device.
-    max_size: 3
-    item_type: !ruby/object:Api::Type::NestedObject
-      properties:
-        - !ruby/object:Api::Type::Time
-          name: 'expirationTime'
-          description: |
-            The time at which this credential becomes invalid.
-          default_from_api: true
-        - !ruby/object:Api::Type::NestedObject
-          name: 'publicKey'
-          required: true
-          description: |
-            A public key used to verify the signature of JSON Web Tokens (JWTs).
-          properties:
-            - !ruby/object:Api::Type::Enum
-              name: 'format'
-              required: true
-              description: |
-                The format of the key.
-              values:
-                - :RSA_PEM
-                - :RSA_X509_PEM
-                - :ES256_PEM
-                - :ES256_X509_PEM
-            - !ruby/object:Api::Type::String
-              name: 'key'
-              required: true
-              description: |
-                The key data.
-  - !ruby/object:Api::Type::Time
-    name: 'lastHeartbeatTime'
-    output: true
-    description: |
-      The last time an MQTT PINGREQ was received.
-  - !ruby/object:Api::Type::Time
-    name: 'lastEventTime'
-    output: true
-    description: |
-      The last time a telemetry event was received.
-  - !ruby/object:Api::Type::Time
-    name: 'lastStateTime'
-    output: true
-    description: |
-      The last time a state event was received.
-  - !ruby/object:Api::Type::Time
-    name: 'lastConfigAckTime'
-    output: true
-    description: |
-      The last time a cloud-to-device config version acknowledgment was received from the device.
-  - !ruby/object:Api::Type::Time
-    name: 'lastConfigSendTime'
-    output: true
-    description: |
-      The last time a cloud-to-device config version was sent to the device.
-  - !ruby/object:Api::Type::Boolean
-    name: 'blocked'
-    description: |
-      If a device is blocked, connections or requests from this device will fail.
-  - !ruby/object:Api::Type::Time
-    name: 'lastErrorTime'
-    output: true
-    description: |
-      The time the most recent error occurred, such as a failure to publish to Cloud Pub/Sub.
-  - !ruby/object:Api::Type::NestedObject
-    name: 'lastErrorStatus'
-    output: true
-    description: |
-      The error message of the most recent error, such as a failure to publish to Cloud Pub/Sub.
-    properties:
-      - !ruby/object:Api::Type::Integer
-        name: 'number'
-        description: |
-          The status code, which should be an enum value of google.rpc.Code.
-      - !ruby/object:Api::Type::String
-        name: 'message'
-        description: |
-          A developer-facing error message, which should be in English.
-      - !ruby/object:Api::Type::Array
-        name: 'details'
-        description: |
-          A list of messages that carry the error details.
-        item_type: Api::Type::KeyValuePairs
-  - !ruby/object:Api::Type::NestedObject
-    name: 'config'
-    output: true
-    description: |
-      The most recent device configuration, which is eventually sent from Cloud IoT Core to the device.
-    properties:
-      - !ruby/object:Api::Type::String
-        name: 'version'
-        output: true
-        description: |
-          The version of this update.
-      - !ruby/object:Api::Type::String
-        name: 'cloudUpdateTime'
-        output: true
-        description: |
-          The time at which this configuration version was updated in Cloud IoT Core.
-      - !ruby/object:Api::Type::String
-        name: 'deviceAckTime'
-        output: true
-        description: |
-          The time at which Cloud IoT Core received the acknowledgment from the device,
-          indicating that the device has received this configuration version.
-      - !ruby/object:Api::Type::String
-        name: 'binaryData'
-        description: |
-          The device configuration data.
-  - !ruby/object:Api::Type::NestedObject
-    name: 'state'
-    output: true
-    description: |
-      The state most recently received from the device.
-    properties:
-      - !ruby/object:Api::Type::Time
-        name: 'updateTime'
-        description: |
-          The time at which this state version was updated in Cloud IoT Core.
-      - !ruby/object:Api::Type::String
-        name: 'binaryData'
-        description: |
-          The device state data.
-  - !ruby/object:Api::Type::Enum
-    name: 'logLevel'
-    allow_empty_object: true
-    description: |
-      The logging verbosity for device activity.
-    values:
-      - :NONE
-      - :ERROR
-      - :INFO
-      - :DEBUG
-  - !ruby/object:Api::Type::KeyValuePairs
-    name: 'metadata'
-    description: |
-      The metadata key-value pairs assigned to the device.
-  - !ruby/object:Api::Type::NestedObject
-    name: 'gatewayConfig'
-    description: |
-      Gateway-related configuration and state.
-    update_mask_fields:
-      - 'gateway_config.gateway_auth_method'
-    properties:
-      - !ruby/object:Api::Type::Enum
-        name: 'gatewayType'
-        default_value: :NON_GATEWAY
-        immutable: true
-        description: |
-          Indicates whether the device is a gateway.
-        values:
-          - :GATEWAY
-          - :NON_GATEWAY
-      - !ruby/object:Api::Type::Enum
-        name: 'gatewayAuthMethod'
-        description: |
-          Indicates whether the device is a gateway.
-        values:
-          - :ASSOCIATION_ONLY
-          - :DEVICE_AUTH_TOKEN_ONLY
-          - :ASSOCIATION_AND_DEVICE_AUTH_TOKEN
-      - !ruby/object:Api::Type::String
-        name: 'lastAccessedGatewayId'
-        output: true
-        description: |
-          The ID of the gateway the device accessed most recently.
-      - !ruby/object:Api::Type::Time
-        name: 'lastAccessedGatewayTime'
-        output: true
-        description: |
-          The most recent time at which the device accessed the gateway specified in last_accessed_gateway.
diff --git a/mmv1/products/cloudiot/DeviceRegistry.yaml b/mmv1/products/cloudiot/DeviceRegistry.yaml
deleted file mode 100644
index d879e925304d..000000000000
--- a/mmv1/products/cloudiot/DeviceRegistry.yaml
+++ /dev/null
@@ -1,174 +0,0 @@
-# Copyright 2023 Google Inc.
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
---- !ruby/object:Api::Resource
-name: 'DeviceRegistry'
-base_url: 'projects/{{project}}/locations/{{region}}/registries'
-self_link: 'projects/{{project}}/locations/{{region}}/registries/{{name}}'
-update_verb: :PATCH
-update_mask: true
-description: |
-  A Google Cloud IoT Core device registry.
-references: !ruby/object:Api::Resource::ReferenceLinks
-  guides:
-    'Official Documentation': 'https://cloud.google.com/iot/docs/'
-  api: 'https://cloud.google.com/iot/docs/reference/cloudiot/rest/'
-iam_policy: !ruby/object:Api::Resource::IamPolicy
-  method_name_separator: ':'
-  fetch_iam_policy_verb: :POST
-  parent_resource_attribute: 'name'
-  import_format:
-    [
-      'projects/{{project}}/locations/{{location}}/registries/{{name}}',
-      '{{name}}',
-    ]
-legacy_name: 'google_cloudiot_registry'
-import_format: ['{{project}}/locations/{{region}}/registries/{{name}}']
-id_format: 'projects/{{project}}/locations/{{region}}/registries/{{name}}'
-custom_code: !ruby/object:Provider::Terraform::CustomCode
-  constants: templates/terraform/constants/cloudiot.go.erb
-  decoder: templates/terraform/decoders/cloudiot_device_registry.go.erb
-  encoder: templates/terraform/encoders/cloudiot_device_registry.go.erb
-  extra_schema_entry: templates/terraform/extra_schema_entry/cloudiot_device_registry.go.erb
-  pre_update: templates/terraform/pre_update/cloudiot_device_registry.go.erb
-deprecation_message: >-
-  `google_cloudiot_registry` is deprecated in the API. This resource will be removed in the next major release of the provider.
-docs: !ruby/object:Provider::Terraform::Docs
-  optional_properties: |
-    * `state_notification_config` - A PubSub topic to publish device state updates.
-      The structure is documented below.
-
-    * `mqtt_config` - Activate or deactivate MQTT.
-      The structure is documented below.
-
-    * `http_config` - Activate or deactivate HTTP.
-      The structure is documented below.
-
-    * `credentials` - List of public key certificates to authenticate devices.
-      The structure is documented below.
-
-    The `state_notification_config` block supports:
-
-    * `pubsub_topic_name` - PubSub topic name to publish device state updates.
-
-    The `mqtt_config` block supports:
-
-    * `mqtt_enabled_state` - The field allows `MQTT_ENABLED` or `MQTT_DISABLED`.
-
-    The `http_config` block supports:
-
-    * `http_enabled_state` - The field allows `HTTP_ENABLED` or `HTTP_DISABLED`.
-
-    The `credentials` block supports:
-
-    * `public_key_certificate` - A public key certificate format and data.
-
-    The `public_key_certificate` block supports:
-
-    * `format` - The field allows only `X509_CERTIFICATE_PEM`.
-
-    * `certificate` - The certificate data.
-examples:
-  - !ruby/object:Provider::Terraform::Examples
-    name: 'cloudiot_device_registry_basic'
-    primary_resource_id: 'test-registry'
-    primary_resource_name: "fmt.Sprintf(\"tf-test-cloudiot-registry%s\",
-      context[\"\
-      random_suffix\"])"
-    vars:
-      cloudiot_registry_name: 'cloudiot-registry'
-    test_env_vars:
-      project: :PROJECT_NAME
-      region: :REGION
-  - !ruby/object:Provider::Terraform::Examples
-    name: 'cloudiot_device_registry_single_event_notification_configs'
-    primary_resource_id: 'test-registry'
-    vars:
-      cloudiot_registry_name: 'cloudiot-registry'
-      cloudiot_device_telemetry_topic_name: 'default-telemetry'
-    test_env_vars:
-      project: :PROJECT_NAME
-      region: :REGION
-  - !ruby/object:Provider::Terraform::Examples
-    name: 'cloudiot_device_registry_full'
-    primary_resource_id: 'test-registry'
-    vars:
-      cloudiot_registry_name: 'cloudiot-registry'
-      cloudiot_device_status_topic_name: 'default-devicestatus'
-      cloudiot_device_telemetry_topic_name: 'default-telemetry'
-      cloudiot_additional_device_telemetry_topic_name: 'additional-telemetry'
-      cloudiot_subfolder_matches_additional_device_telemetry_topic: 'test/path'
-    test_env_vars:
-      project: :PROJECT_NAME
-      region: :REGION
-parameters:
-  - !ruby/object:Api::Type::String
-    name: region
-    immutable: true
-    url_param_only: true
-    required: false
-    description: |
-      The region in which the created registry should reside.
-      If it is not provided, the provider region is used.
-    ignore_read: true
-    default_from_api: true
-properties:
-  - !ruby/object:Api::Type::String
-    name: 'name'
-    immutable: true
-    required: true
-    description: |
-      A unique name for the resource, required by device registry.
-    api_name: 'id'
-    validation: !ruby/object:Provider::Terraform::Validation
-      function: 'ValidateCloudIotDeviceRegistryID'
-  - !ruby/object:Api::Type::Array
-    name: 'eventNotificationConfigs'
-    description: |
-      List of configurations for event notifications, such as PubSub topics
-      to publish device events to.
-    max_size: 10
-    default_from_api: true
-    item_type: !ruby/object:Api::Type::NestedObject
-      properties:
-        - !ruby/object:Api::Type::String
-          name: 'subfolderMatches'
-          description: |
-            If the subfolder name matches this string exactly, this
-            configuration will be used. The string must not include the
-            leading '/' character. If empty, all strings are matched. Empty
-            value can only be used for the last `event_notification_configs`
-            item.
-          validation: !ruby/object:Provider::Terraform::Validation
-            function: 'validateCloudIotDeviceRegistrySubfolderMatch'
-        - !ruby/object:Api::Type::String
-          name: 'pubsubTopicName'
-          required: true
-          description: |
-            PubSub topic name to publish device events.
-          diff_suppress_func: 'tpgresource.CompareSelfLinkOrResourceName'
-  - !ruby/object:Api::Type::Enum
-    name: 'logLevel'
-    default_value: :NONE
-    description: |
-      The default logging verbosity for activity from devices in this
-      registry. Specifies which events should be written to logs. For
-      example, if the LogLevel is ERROR, only events that terminate in
-      errors will be logged. LogLevel is inclusive; enabling INFO logging
-      will also enable ERROR logging.
-    values:
-      - :NONE
-      - :ERROR
-      - :INFO
-      - :DEBUG
-    diff_suppress_func: 'tpgresource.EmptyOrDefaultStringSuppress("NONE")'
diff --git a/mmv1/products/cloudrun/DomainMapping.yaml b/mmv1/products/cloudrun/DomainMapping.yaml
index 8eb9730a654c..82aa8c386dd3 100644
--- a/mmv1/products/cloudrun/DomainMapping.yaml
+++ b/mmv1/products/cloudrun/DomainMapping.yaml
@@ -42,6 +42,11 @@ custom_code: !ruby/object:Provider::Terraform::CustomCode
   encoder: 'templates/terraform/encoders/cloud_run_domain_mapping.go.erb'
   decoder: 'templates/terraform/decoders/cloud_run.go.erb'
   constants: templates/terraform/constants/cloud_run_domain_mapping.go.erb
+custom_diff: [
+  'hasMetadata',
+]
+state_upgraders: true
+schema_version: 1
 parameters:
   - !ruby/object:Api::Type::String
     name: location
@@ -154,18 +159,16 @@ properties:
         default_value: :AUTOMATIC
   - !ruby/object:Api::Type::NestedObject
     name: metadata
-    required: true
+    default_from_api: true
     description: Metadata associated with this DomainMapping.
     properties:
-      - !ruby/object:Api::Type::KeyValuePairs
-        name: labels
+      - !ruby/object:Api::Type::KeyValueLabels
+        name: 'labels'
         description: |-
           Map of string keys and values that can be used to organize and categorize
           (scope and select) objects. May match selectors of replication controllers
           and routes.
           More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
-        default_from_api: true
-        diff_suppress_func: 'DomainMappingLabelDiffSuppress'
       - !ruby/object:Api::Type::Integer
         name: generation
         description: |-
@@ -203,8 +206,8 @@ properties:
           In Cloud Run the namespace must be equal to either the
           project ID or project number.
         custom_flatten: templates/terraform/custom_flatten/set_to_project.go.erb
-      - !ruby/object:Api::Type::KeyValuePairs
-        name: annotations
+      - !ruby/object:Api::Type::KeyValueAnnotations
+        name: 'annotations'
         description: |-
           Annotations is a key value map stored with a resource that
           may be set by external tools to store and retrieve arbitrary metadata. More
@@ -213,5 +216,3 @@ properties:
           **Note**: The Cloud Run API may add additional annotations that were not provided in your config.
           If terraform plan shows a diff where a server-side annotation is added, you can add it to your config
           or apply the lifecycle.ignore_changes rule to the metadata.0.annotations field.
-        default_from_api: true
-        diff_suppress_func: 'cloudrunAnnotationDiffSuppress'
diff --git a/mmv1/products/cloudrun/Service.yaml b/mmv1/products/cloudrun/Service.yaml
index 1160362ab594..99dd210064f2 100644
--- a/mmv1/products/cloudrun/Service.yaml
+++ b/mmv1/products/cloudrun/Service.yaml
@@ -152,7 +152,9 @@ custom_code: !ruby/object:Provider::Terraform::CustomCode
 custom_diff: [
   'revisionNameCustomizeDiff',
 ]
-schema_version: 1
+state_upgraders: true
+state_upgrade_base_schema_version: 1
+schema_version: 2
 parameters:
   - !ruby/object:Api::Type::String
     name: location
@@ -240,7 +242,7 @@ properties:
             default_from_api: true
             properties:
               - !ruby/object:Api::Type::KeyValuePairs
-                name: labels
+                name: 'labels'
                 description: |-
                   Map of string keys and values that can be used to organize and categorize
                   (scope and select) objects.
@@ -279,7 +281,7 @@ properties:
                 default_from_api: true
                 custom_expand: 'templates/terraform/custom_expand/default_to_project.go.erb'
               - !ruby/object:Api::Type::KeyValuePairs
-                name: annotations
+                name: 'annotations'
                 description: |-
                   Annotations is a key value map stored with a resource that
                   may be set by external tools to store and retrieve arbitrary metadata. More
@@ -970,14 +972,12 @@ properties:
       and annotations.
     default_from_api: true
     properties:
-      - !ruby/object:Api::Type::KeyValuePairs
-        name: labels
+      - !ruby/object:Api::Type::KeyValueLabels
+        name: 'labels'
         description: |-
           Map of string keys and values that can be used to organize and categorize
           (scope and select) objects. May match selectors of replication controllers
           and routes.
-        default_from_api: true
-        diff_suppress_func: 'cloudrunLabelDiffSuppress'
       - !ruby/object:Api::Type::Integer
         name: generation
         description: |-
@@ -1012,8 +1012,8 @@ properties:
         default_from_api: true
         custom_flatten: templates/terraform/custom_flatten/set_to_project.go.erb
         custom_expand: 'templates/terraform/custom_expand/default_to_project.go.erb'
-      - !ruby/object:Api::Type::KeyValuePairs
-        name: annotations
+      - !ruby/object:Api::Type::KeyValueAnnotations
+        name: 'annotations'
         description: |-
           Annotations is a key value map stored with a resource that
           may be set by external tools to store and retrieve arbitrary metadata. More
@@ -1036,5 +1036,3 @@ properties:
             for the Service. For example, `"run.googleapis.com/ingress" = "all"`.
           - `run.googleapis.com/launch-stage` sets the [launch stage](https://cloud.google.com/run/docs/troubleshooting#launch-stage-validation)
             when a preview feature is used. For example, `"run.googleapis.com/launch-stage": "BETA"`
-        default_from_api: true
-        diff_suppress_func: 'cloudrunAnnotationDiffSuppress'
diff --git a/mmv1/products/cloudrunv2/Job.yaml b/mmv1/products/cloudrunv2/Job.yaml
index d484d5e717c6..fe8509b65791 100644
--- a/mmv1/products/cloudrunv2/Job.yaml
+++ b/mmv1/products/cloudrunv2/Job.yaml
@@ -84,6 +84,13 @@ examples:
       vpc_access_connector_name: 'run-vpc'
       vpc_compute_subnetwork_name: 'run-subnetwork'
       compute_network_name: 'run-network'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'cloudrunv2_job_directvpc'
+    primary_resource_id: 'default'
+    primary_resource_name: "fmt.Sprintf(\"tf-test-cloudrun-job%s\", context[\"random_suffix\"\
+      ])"
+    vars:
+      cloud_run_job_name: 'cloudrun-job'
   - !ruby/object:Provider::Terraform::Examples
     name: 'cloudrunv2_job_secret'
     primary_resource_id: 'default'
@@ -104,6 +111,7 @@ examples:
 parameters:
   - !ruby/object:Api::Type::String
     name: 'location'
+    required: true
     immutable: true
     url_param_only: true
     description: The location of the cloud run job
@@ -129,7 +137,7 @@ properties:
     output: true
     description: |
       A number that monotonically increases every time the user modifies the desired state.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |-
       Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google's billing system, so they can be used to filter, or break down billing charges by team, component,
@@ -137,8 +145,8 @@ properties:
 
       Cloud Run API v2 does not support labels with `run.googleapis.com`, `cloud.googleapis.com`, `serving.knative.dev`, or `autoscaling.knative.dev` namespaces, and they will be rejected.
       All system labels in v1 now have a corresponding field in v2 Job.
-  - !ruby/object:Api::Type::KeyValuePairs
-    name: "annotations"
+  - !ruby/object:Api::Type::KeyValueAnnotations
+    name: 'annotations'
     description: |-
       Unstructured key value map that may be set by external tools to store and arbitrary metadata. They are not queryable and should be preserved when modifying objects.
 
@@ -229,7 +237,7 @@ properties:
           Cloud Run API v2 does not support labels with `run.googleapis.com`, `cloud.googleapis.com`, `serving.knative.dev`, or `autoscaling.knative.dev` namespaces, and they will be rejected.
           All system labels in v1 now have a corresponding field in v2 ExecutionTemplate.
       - !ruby/object:Api::Type::KeyValuePairs
-        name: "annotations"
+        name: 'annotations'
         description: |-
           Unstructured key value map that may be set by external tools to store and arbitrary metadata. They are not queryable and should be preserved when modifying objects.
 
@@ -367,160 +375,6 @@ properties:
                   name: 'workingDir'
                   description: |-
                     Container's working directory. If not specified, the container runtime's default will be used, which might be configured in the container image.
-                - !ruby/object:Api::Type::NestedObject
-                  name: 'livenessProbe'
-                  description: |-
-                    Periodic probe of container liveness. Container will be restarted if the probe fails. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
-                    This field is not supported in Cloud Run Job currently.
-                  deprecation_message: >-
-                    `liveness_probe` is deprecated and will be removed in a future major release. This field is not supported by the Cloud Run API.
-                  properties:
-                    - !ruby/object:Api::Type::Integer
-                      name: 'initialDelaySeconds'
-                      description: |-
-                        Number of seconds after the container has started before the probe is initiated. Defaults to 0 seconds. Minimum value is 0. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
-                      default_value: 0
-                    - !ruby/object:Api::Type::Integer
-                      name: 'timeoutSeconds'
-                      description: |-
-                        Number of seconds after which the probe times out. Defaults to 1 second. Minimum value is 1. Maximum value is 3600. Must be smaller than periodSeconds. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
-                      default_value: 1
-                    - !ruby/object:Api::Type::Integer
-                      name: 'periodSeconds'
-                      description: |-
-                        How often (in seconds) to perform the probe. Default to 10 seconds. Minimum value is 1. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. Must be greater or equal than timeoutSeconds
-                      default_value: 10
-                    - !ruby/object:Api::Type::Integer
-                      name: 'failureThreshold'
-                      description: |-
-                        Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3. Minimum value is 1.
-                      default_value: 3
-                    - !ruby/object:Api::Type::NestedObject
-                      name: 'httpGet'
-                      description: |-
-                        HTTPGet specifies the http request to perform. Exactly one of HTTPGet or TCPSocket must be specified.
-                      send_empty_value: true
-                      allow_empty_object:
-                        true
-                        # exactly_one_of:
-                        #   - template.0.template.0.containers.0.livenessProbe.0.httpGet
-                        #   - template.0.template.0.containers.0.livenessProbe.0.tcpSocket
-                      properties:
-                        - !ruby/object:Api::Type::String
-                          name: 'path'
-                          default_value: '/'
-                          description: |-
-                            Path to access on the HTTP server. Defaults to '/'.
-                        - !ruby/object:Api::Type::Array
-                          name: httpHeaders
-                          description: |-
-                            Custom headers to set in the request. HTTP allows repeated headers.
-                          item_type: !ruby/object:Api::Type::NestedObject
-                            properties:
-                              - !ruby/object:Api::Type::String
-                                name: name
-                                required: true
-                                description: |-
-                                  The header field name
-                              - !ruby/object:Api::Type::String
-                                name: value
-                                description: |-
-                                  The header field value
-                                default_value: ''
-                                send_empty_value: true
-                    - !ruby/object:Api::Type::NestedObject
-                      name: 'tcpSocket'
-                      description: |-
-                        TCPSocket specifies an action involving a TCP port. Exactly one of HTTPGet or TCPSocket must be specified.
-                      send_empty_value: true
-                      allow_empty_object:
-                        true
-                        # exactly_one_of:
-                        #   - template.0.template.0.containers.0.livenessProbe.0.httpGet
-                        #   - template.0.template.0.containers.0.livenessProbe.0.tcpSocket
-                      properties:
-                        - !ruby/object:Api::Type::Integer
-                          name: port
-                          description: |-
-                            Port number to access on the container. Must be in the range 1 to 65535. If not specified, defaults to 8080.
-                - !ruby/object:Api::Type::NestedObject
-                  name: 'startupProbe'
-                  description: |-
-                    Startup probe of application within the container. All other probes are disabled if a startup probe is provided, until it succeeds. Container will not be added to service endpoints if the probe fails. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
-                    This field is not supported in Cloud Run Job currently.
-                  deprecation_message: >-
-                    `startup_probe` is deprecated and will be removed in a future major release. This field is not supported by the Cloud Run API.
-                  default_from_api: true
-                  properties:
-                    - !ruby/object:Api::Type::Integer
-                      name: 'initialDelaySeconds'
-                      description: |-
-                        Number of seconds after the container has started before the probe is initiated. Defaults to 0 seconds. Minimum value is 0. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
-                      default_value: 0
-                    - !ruby/object:Api::Type::Integer
-                      name: 'timeoutSeconds'
-                      description: |-
-                        Number of seconds after which the probe times out. Defaults to 1 second. Minimum value is 1. Maximum value is 3600. Must be smaller than periodSeconds. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
-                      default_value: 1
-                    - !ruby/object:Api::Type::Integer
-                      name: 'periodSeconds'
-                      description: |-
-                        How often (in seconds) to perform the probe. Default to 10 seconds. Minimum value is 1. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. Must be greater or equal than timeoutSeconds
-                      default_value: 10
-                    - !ruby/object:Api::Type::Integer
-                      name: 'failureThreshold'
-                      description: |-
-                        Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3. Minimum value is 1.
-                      default_value: 3
-                    - !ruby/object:Api::Type::NestedObject
-                      name: 'httpGet'
-                      description: |-
-                        HTTPGet specifies the http request to perform. Exactly one of HTTPGet or TCPSocket must be specified.
-                      send_empty_value: true
-                      allow_empty_object:
-                        true
-                        # exactly_one_of:
-                        #   - template.0.template.0.containers.startupProbe.0.httpGet
-                        #   - template.0.template.0.containers.startupProbe.0.tcpSocket
-                      properties:
-                        - !ruby/object:Api::Type::String
-                          name: 'path'
-                          default_value: '/'
-                          description: |-
-                            Path to access on the HTTP server. Defaults to '/'.
-                        - !ruby/object:Api::Type::Array
-                          name: 'httpHeaders'
-                          description: |-
-                            Custom headers to set in the request. HTTP allows repeated headers.
-                          item_type: !ruby/object:Api::Type::NestedObject
-                            properties:
-                              - !ruby/object:Api::Type::String
-                                name: name
-                                required: true
-                                description: |-
-                                  The header field name
-                              - !ruby/object:Api::Type::String
-                                name: value
-                                description: |-
-                                  The header field value
-                                default_value: ''
-                                send_empty_value: true
-                    - !ruby/object:Api::Type::NestedObject
-                      name: 'tcpSocket'
-                      description: |-
-                        TCPSocket specifies an action involving a TCP port. Exactly one of HTTPGet or TCPSocket must be specified.
-                      send_empty_value: true
-                      allow_empty_object:
-                        true
-                        # exactly_one_of:
-                        #   - template.0.template.0.containers.startupProbe.0.httpGet
-                        #   - template.0.template.0.containers.startupProbe.0.tcpSocket
-                      properties:
-                        - !ruby/object:Api::Type::Integer
-                          name: port
-                          description: |-
-                            Port number to access on the container. Must be in the range 1 to 65535. If not specified, defaults to 8080.
-                          default_from_api: true
           - !ruby/object:Api::Type::Array
             name: 'volumes'
             description: |-
@@ -645,6 +499,32 @@ properties:
                 values:
                   - :ALL_TRAFFIC
                   - :PRIVATE_RANGES_ONLY
+                default_from_api: true
+              - !ruby/object:Api::Type::Array
+                name: 'networkInterfaces'
+                description: |-
+                  Direct VPC egress settings. Currently only single network interface is supported.
+                item_type: !ruby/object:Api::Type::NestedObject
+                  properties:
+                    - !ruby/object:Api::Type::String
+                      name: 'network'
+                      description: |-
+                        The VPC network that the Cloud Run resource will be able to send traffic to. At least one of network or subnetwork must be specified. If both
+                        network and subnetwork are specified, the given VPC subnetwork must belong to the given VPC network. If network is not specified, it will be
+                        looked up from the subnetwork.
+                      default_from_api: true
+                    - !ruby/object:Api::Type::String
+                      name: 'subnetwork'
+                      description: |-
+                        The VPC subnetwork that the Cloud Run resource will get IPs from. At least one of network or subnetwork must be specified. If both
+                        network and subnetwork are specified, the given VPC subnetwork must belong to the given VPC network. If subnetwork is not specified, the
+                        subnetwork with the same name with the network will be used.
+                      default_from_api: true
+                    - !ruby/object:Api::Type::Array
+                      name: 'tags'
+                      description: |-
+                        Network tags applied to this Cloud Run job.
+                      item_type: Api::Type::String
           - !ruby/object:Api::Type::Integer
             name: 'maxRetries'
             description: |-
diff --git a/mmv1/products/cloudrunv2/Service.yaml b/mmv1/products/cloudrunv2/Service.yaml
index ae586f92dabe..a96911958bae 100644
--- a/mmv1/products/cloudrunv2/Service.yaml
+++ b/mmv1/products/cloudrunv2/Service.yaml
@@ -87,6 +87,14 @@ examples:
       vpc_access_connector_name: 'run-vpc'
       vpc_compute_subnetwork_name: 'run-subnetwork'
       compute_network_name: 'run-network'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'cloudrunv2_service_directvpc'
+    primary_resource_id: 'default'
+    primary_resource_name: "fmt.Sprintf(\"tf-test-cloudrun-srv%s\",
+      context[\"random_suffix\"\
+      ])"
+    vars:
+      cloud_run_service_name: 'cloudrun-service'
   - !ruby/object:Provider::Terraform::Examples
     name: 'cloudrunv2_service_probes'
     primary_resource_id: 'default'
@@ -115,6 +123,7 @@ examples:
 parameters:
   - !ruby/object:Api::Type::String
     name: 'location'
+    required: true
     immutable: true
     url_param_only: true
     description: The location of the cloud run service
@@ -144,7 +153,7 @@ properties:
     output: true
     description: |
       A number that monotonically increases every time the user modifies the desired state. Please note that unlike v1, this is an int64 value. As with most Google APIs, its JSON representation will be a string instead of an integer.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |-
       Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google's billing system, so they can be used to filter, or break down billing charges by team, component,
@@ -152,7 +161,7 @@ properties:
 
       Cloud Run API v2 does not support labels with  `run.googleapis.com`, `cloud.googleapis.com`, `serving.knative.dev`, or `autoscaling.knative.dev` namespaces, and they will be rejected.
       All system labels in v1 now have a corresponding field in v2 Service.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueAnnotations
     name: 'annotations'
     description: |-
       Unstructured key value map that may be set by external tools to store and arbitrary metadata. They are not queryable and should be preserved when modifying objects.
@@ -238,7 +247,7 @@ properties:
         description: |
           If True, indicates to use the default project's binary authorization policy. If False, binary authorization will be disabled.
   - !ruby/object:Api::Type::Array
-    name: 'custom_audiences'
+    name: 'customAudiences'
     min_version: beta
     description: |
       One or more custom audiences that you want this service to support. Specify each custom audience as the full URL in a string. The custom audiences are encoded in the token and used to authenticate requests.
@@ -301,6 +310,32 @@ properties:
             values:
               - :ALL_TRAFFIC
               - :PRIVATE_RANGES_ONLY
+            default_from_api: true
+          - !ruby/object:Api::Type::Array
+            name: 'networkInterfaces'
+            description: |-
+              Direct VPC egress settings. Currently only single network interface is supported.
+            item_type: !ruby/object:Api::Type::NestedObject
+              properties:
+                - !ruby/object:Api::Type::String
+                  name: 'network'
+                  description: |-
+                    The VPC network that the Cloud Run resource will be able to send traffic to. At least one of network or subnetwork must be specified. If both
+                    network and subnetwork are specified, the given VPC subnetwork must belong to the given VPC network. If network is not specified, it will be
+                    looked up from the subnetwork.
+                  default_from_api: true
+                - !ruby/object:Api::Type::String
+                  name: 'subnetwork'
+                  description: |-
+                    The VPC subnetwork that the Cloud Run resource will get IPs from. At least one of network or subnetwork must be specified. If both
+                    network and subnetwork are specified, the given VPC subnetwork must belong to the given VPC network. If subnetwork is not specified, the
+                    subnetwork with the same name with the network will be used.
+                  default_from_api: true
+                - !ruby/object:Api::Type::Array
+                  name: 'tags'
+                  description: |-
+                    Network tags applied to this Cloud Run service.
+                  item_type: Api::Type::String
       - !ruby/object:Api::Type::String
         name: 'timeout'
         description: |-
@@ -496,19 +531,6 @@ properties:
                               The header field value
                             default_value: ''
                             send_empty_value: true
-                - !ruby/object:Api::Type::NestedObject
-                  name: 'tcpSocket'
-                  description: |-
-                    TCPSocket specifies an action involving a TCP port. This field is not supported in liveness probe currently.
-                  deprecation_message: >-
-                    `tcp_socket` is deprecated and will be removed in a future major release. This field is not supported by the Cloud Run API.
-                  send_empty_value: true
-                  allow_empty_object: true
-                  properties:
-                    - !ruby/object:Api::Type::Integer
-                      name: port
-                      description: |-
-                        Port number to access on the container. Must be in the range 1 to 65535. If not specified, defaults to 8080.
                 - !ruby/object:Api::Type::NestedObject
                   name: grpc
                   description: |-
@@ -703,6 +725,7 @@ properties:
                   description: |-
                     The Cloud SQL instance connection names, as can be found in https://console.cloud.google.com/sql/instances. Visit https://cloud.google.com/sql/docs/mysql/connect-run for more information on how to connect Cloud SQL and Cloud Run. Format: {project}:{location}:{instance}
                   item_type: Api::Type::String
+                  is_set: true
             - !ruby/object:Api::Type::NestedObject
               name: 'emptyDir'
               description: |-
diff --git a/mmv1/products/compute/Address.yaml b/mmv1/products/compute/Address.yaml
index e013503a7882..e137f2286548 100644
--- a/mmv1/products/compute/Address.yaml
+++ b/mmv1/products/compute/Address.yaml
@@ -194,13 +194,12 @@ properties:
     description: 'The URLs of the resources that are using this address.'
     item_type: Api::Type::String
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Labels to apply to this address.  A list of key->value pairs.
     update_verb: :POST
     update_url: 'projects/{{project}}/regions/{{region}}/addresses/{{name}}/setLabels'
-    min_version: beta
   - !ruby/object:Api::Type::Fingerprint
     name: 'labelFingerprint'
     description: |
@@ -208,7 +207,6 @@ properties:
       internally during updates.
     update_url: 'projects/{{project}}/regions/{{region}}/addresses/{{name}}/setLabels'
     update_verb: :POST
-    min_version: beta
   - !ruby/object:Api::Type::ResourceRef
     name: 'network'
     resource: 'Network'
diff --git a/mmv1/products/compute/Autoscaler.yaml b/mmv1/products/compute/Autoscaler.yaml
index e10212ef636b..f62d4f9a1b99 100644
--- a/mmv1/products/compute/Autoscaler.yaml
+++ b/mmv1/products/compute/Autoscaler.yaml
@@ -84,6 +84,7 @@ parameters:
       URL of the zone where the instance group resides.
     required: false
     immutable: true
+    ignore_read: true
     default_from_api: true
     custom_expand: 'templates/terraform/custom_expand/resourceref_with_validation.go.erb'
 properties:
@@ -152,15 +153,11 @@ properties:
           instance may take to initialize. To do this, create an instance
           and time the startup process.
         default_value: 60
-      - !ruby/object:Api::Type::Enum
+      - !ruby/object:Api::Type::String
         name: 'mode'
-        default_value: :ON
+        default_value: 'ON'
         description: |
           Defines operating mode for this policy.
-        values:
-          - :OFF
-          - :ONLY_UP
-          - :ON
       - !ruby/object:Api::Type::NestedObject
         name: 'scaleDownControl'
         min_version: beta
@@ -367,6 +364,7 @@ properties:
                 TimeSeries are returned upon the query execution, the autoscaler
                 will sum their respective values to obtain its scaling value.
               min_version: beta
+              default_value: 'resource.type = gce_instance'
       - !ruby/object:Api::Type::NestedObject
         name: 'loadBalancingUtilization'
         description: |
diff --git a/mmv1/products/compute/BackendService.yaml b/mmv1/products/compute/BackendService.yaml
index de689673f7d8..cc9837062cba 100644
--- a/mmv1/products/compute/BackendService.yaml
+++ b/mmv1/products/compute/BackendService.yaml
@@ -958,8 +958,8 @@ properties:
     name: 'outlierDetection'
     description: |
       Settings controlling eviction of unhealthy hosts from the load balancing pool.
-      This field is applicable only when the load_balancing_scheme is set
-      to INTERNAL_SELF_MANAGED.
+      Applicable backend service types can be a global backend service with the
+      loadBalancingScheme set to INTERNAL_SELF_MANAGED or EXTERNAL_MANAGED.
     properties:
       - !ruby/object:Api::Type::NestedObject
         name: 'baseEjectionTime'
diff --git a/mmv1/products/compute/Disk.yaml b/mmv1/products/compute/Disk.yaml
index 58935e9fa227..1a9893cd2d20 100644
--- a/mmv1/products/compute/Disk.yaml
+++ b/mmv1/products/compute/Disk.yaml
@@ -290,7 +290,7 @@ properties:
     name: 'lastDetachTimestamp'
     description: 'Last detach timestamp in RFC3339 text format.'
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Labels to apply to this disk.  A list of key->value pairs.
diff --git a/mmv1/products/compute/DiskResourcePolicyAttachment.yaml b/mmv1/products/compute/DiskResourcePolicyAttachment.yaml
index c2cbb0524deb..0926037d8e30 100644
--- a/mmv1/products/compute/DiskResourcePolicyAttachment.yaml
+++ b/mmv1/products/compute/DiskResourcePolicyAttachment.yaml
@@ -77,6 +77,7 @@ parameters:
     description: 'A reference to the zone where the disk resides.'
     required: false
     url_param_only: true
+    ignore_read: true
     default_from_api: true
 properties:
   - !ruby/object:Api::Type::String
diff --git a/mmv1/products/compute/ExternalVpnGateway.yaml b/mmv1/products/compute/ExternalVpnGateway.yaml
index 7fd92d7952f3..271b0f23daee 100644
--- a/mmv1/products/compute/ExternalVpnGateway.yaml
+++ b/mmv1/products/compute/ExternalVpnGateway.yaml
@@ -63,7 +63,7 @@ properties:
   - !ruby/object:Api::Type::String
     name: 'description'
     description: 'An optional description of this resource.'
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: 'Labels for the external VPN gateway resource.'
     update_verb: :POST
diff --git a/mmv1/products/compute/ForwardingRule.yaml b/mmv1/products/compute/ForwardingRule.yaml
index 138294268651..d0258cfdf70a 100644
--- a/mmv1/products/compute/ForwardingRule.yaml
+++ b/mmv1/products/compute/ForwardingRule.yaml
@@ -216,6 +216,10 @@ examples:
       - "target"
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   post_create: templates/terraform/post_create/labels.erb
+  constants: 'templates/terraform/constants/compute_forwarding_rule.go.erb'
+custom_diff: [
+  'forwardingRuleCustomizeDiff',
+]
 parameters:
   - !ruby/object:Api::Type::ResourceRef
     name: 'region'
@@ -398,56 +402,58 @@ properties:
   - !ruby/object:Api::Type::String
     name: 'portRange'
     description: |
-      This field can only be used:
-
-      * If `IPProtocol` is one of TCP, UDP, or SCTP.
-      * By backend service-based network load balancers, target pool-based
-      network load balancers, internal proxy load balancers, external proxy load
-      balancers, Traffic Director, external protocol forwarding, and Classic VPN.
-      Some products have restrictions on what ports can be used. See
+      The `ports`, `portRange`, and `allPorts` fields are mutually exclusive.
+      Only packets addressed to ports in the specified range will be forwarded
+      to the backends configured with this forwarding rule.
+
+      The `portRange` field has the following limitations:
+      * It requires that the forwarding rule `IPProtocol` be TCP, UDP, or SCTP,
+      and
+      * It's applicable only to the following products: external passthrough
+      Network Load Balancers, internal and external proxy Network Load
+      Balancers, internal and external Application Load Balancers, external
+      protocol forwarding, and Classic VPN.
+      * Some products have restrictions on what ports can be used. See
       [port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)
       for details.
 
-
-      Only packets addressed to ports in the specified range will be forwarded to
-      the backends configured with this forwarding rule.
-
-      The `ports` and `port_range` fields are mutually exclusive.
-
       For external forwarding rules, two or more forwarding rules cannot use the
-      same `[IPAddress, IPProtocol]` pair, and cannot have
-      overlapping `portRange`s.
+      same `[IPAddress, IPProtocol]` pair, and cannot have overlapping
+      `portRange`s.
 
       For internal forwarding rules within the same VPC network, two or more
-      forwarding rules cannot use the same `[IPAddress, IPProtocol]`
-      pair, and cannot have overlapping `portRange`s.
+      forwarding rules cannot use the same `[IPAddress, IPProtocol]` pair, and
+      cannot have overlapping `portRange`s.
+
+      @pattern: \d+(?:-\d+)?
     diff_suppress_func: 'tpgresource.PortRangeDiffSuppress'
     default_from_api: true
   - !ruby/object:Api::Type::Array
     name: 'ports'
     max_size: 5
     description: |
-      This field can only be used:
-
-      * If `IPProtocol` is one of TCP, UDP, or SCTP.
-      * By internal TCP/UDP load balancers, backend service-based network load
-      balancers, internal protocol forwarding and when protocol is not L3_DEFAULT.
-
-
-      You can specify a list of up to five ports by number, separated by commas.
-      The ports can be contiguous or discontiguous. Only packets addressed to
-      these ports will be forwarded to the backends configured with this
-      forwarding rule.
+      The `ports`, `portRange`, and `allPorts` fields are mutually exclusive.
+      Only packets addressed to ports in the specified range will be forwarded
+      to the backends configured with this forwarding rule.
+
+      The `ports` field has the following limitations:
+      * It requires that the forwarding rule `IPProtocol` be TCP, UDP, or SCTP,
+      and
+      * It's applicable only to the following products: internal passthrough
+      Network Load Balancers, backend service-based external passthrough Network
+      Load Balancers, and internal protocol forwarding.
+      * You can specify a list of up to five ports by number, separated by
+      commas. The ports can be contiguous or discontiguous.
 
       For external forwarding rules, two or more forwarding rules cannot use the
-      same `[IPAddress, IPProtocol]` pair, and cannot share any values
-      defined in `ports`.
+      same `[IPAddress, IPProtocol]` pair if they share at least one port
+      number.
 
       For internal forwarding rules within the same VPC network, two or more
-      forwarding rules cannot use the same `[IPAddress, IPProtocol]`
-      pair, and cannot share any values defined in `ports`.
+      forwarding rules cannot use the same `[IPAddress, IPProtocol]` pair if
+      they share at least one port number.
 
-      The `ports` and `port_range` fields are mutually exclusive.
+      @pattern: \d+(?:-\d+)?
     is_set: true
     custom_expand: 'templates/terraform/custom_expand/set_to_list.erb'
     item_type: Api::Type::String
@@ -503,7 +509,7 @@ properties:
     send_empty_value: true
     update_verb: :PATCH
     update_url: projects/{{project}}/regions/{{region}}/forwardingRules/{{name}}
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Labels to apply to this forwarding rule.  A list of key->value pairs.
@@ -519,21 +525,21 @@ properties:
   - !ruby/object:Api::Type::Boolean
     name: 'allPorts'
     description: |
-      This field can only be used:
-      * If `IPProtocol` is one of TCP, UDP, or SCTP.
-      * By internal TCP/UDP load balancers, backend service-based network load
-      balancers, and internal and external protocol forwarding.
-
-      This option should be set to TRUE when the Forwarding Rule
-      IPProtocol is set to L3_DEFAULT.
-
-      Set this field to true to allow packets addressed to any port or packets
+      The `ports`, `portRange`, and `allPorts` fields are mutually exclusive.
+      Only packets addressed to ports in the specified range will be forwarded
+      to the backends configured with this forwarding rule.
+
+      The `allPorts` field has the following limitations:
+      * It requires that the forwarding rule `IPProtocol` be TCP, UDP, SCTP, or
+      L3_DEFAULT.
+      * It's applicable only to the following products: internal passthrough
+      Network Load Balancers, backend service-based external passthrough Network
+      Load Balancers, and internal and external protocol forwarding.
+      * Set this field to true to allow packets addressed to any port or packets
       lacking destination port information (for example, UDP fragments after the
       first fragment) to be forwarded to the backends configured with this
-      forwarding rule.
-
-      The `ports`, `port_range`, and
-      `allPorts` fields are mutually exclusive.
+      forwarding rule. The L3_DEFAULT protocol requires `allPorts` be set to
+      true.
   - !ruby/object:Api::Type::Enum
     name: 'networkTier'
     description: |
@@ -650,3 +656,9 @@ properties:
       - :IPV6
     immutable: true
     default_from_api: true
+virtual_fields:
+  - !ruby/object:Api::Type::Boolean
+    name: recreate_closed_psc
+    description:
+      This is used in PSC consumer ForwardingRule to make terraform recreate the ForwardingRule when the status is closed
+    default_value: false
diff --git a/mmv1/products/compute/GlobalAddress.yaml b/mmv1/products/compute/GlobalAddress.yaml
index b5cd3bd89ca5..de7ef1a6bd01 100644
--- a/mmv1/products/compute/GlobalAddress.yaml
+++ b/mmv1/products/compute/GlobalAddress.yaml
@@ -58,6 +58,7 @@ examples:
       network_name: 'my-network-name'
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   post_create: templates/terraform/post_create/labels.erb
+  pre_create: templates/terraform/pre_create/compute_global_address.go.erb
 properties:
   - !ruby/object:Api::Type::String
     name: 'address'
@@ -86,7 +87,7 @@ properties:
       characters must be a dash, lowercase letter, or digit, except the last
       character, which cannot be a dash.
     required: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Labels to apply to this address.  A list of key->value pairs.
diff --git a/mmv1/products/compute/GlobalForwardingRule.yaml b/mmv1/products/compute/GlobalForwardingRule.yaml
index ee6df3585dfd..f3b30c449c44 100644
--- a/mmv1/products/compute/GlobalForwardingRule.yaml
+++ b/mmv1/products/compute/GlobalForwardingRule.yaml
@@ -296,7 +296,7 @@ properties:
     values:
       - :IPV4
       - :IPV6
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Labels to apply to this forwarding rule.  A list of key->value pairs.
@@ -423,24 +423,26 @@ properties:
   - !ruby/object:Api::Type::String
     name: 'portRange'
     description: |
-      This field can only be used:
-
-      * If `IPProtocol` is one of TCP, UDP, or SCTP.
-      * By backend service-based network load balancers, target pool-based
-      network load balancers, internal proxy load balancers, external proxy load
-      balancers, Traffic Director, external protocol forwarding, and Classic VPN.
-      Some products have restrictions on what ports can be used. See
+      The `portRange` field has the following limitations:
+      * It requires that the forwarding rule `IPProtocol` be TCP, UDP, or SCTP,
+      and
+      * It's applicable only to the following products: external passthrough
+      Network Load Balancers, internal and external proxy Network Load
+      Balancers, internal and external Application Load Balancers, external
+      protocol forwarding, and Classic VPN.
+      * Some products have restrictions on what ports can be used. See
       [port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)
       for details.
 
+      For external forwarding rules, two or more forwarding rules cannot use the
+      same `[IPAddress, IPProtocol]` pair, and cannot have overlapping
+      `portRange`s.
+
+      For internal forwarding rules within the same VPC network, two or more
+      forwarding rules cannot use the same `[IPAddress, IPProtocol]` pair, and
+      cannot have overlapping `portRange`s.
 
-      * TargetHttpProxy: 80, 8080
-      * TargetHttpsProxy: 443
-      * TargetTcpProxy: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995,
-                        1883, 5222
-      * TargetSslProxy: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995,
-                        1883, 5222
-      * TargetVpnGateway: 500, 4500
+      @pattern: \d+(?:-\d+)?
     diff_suppress_func: 'tpgresource.PortRangeDiffSuppress'
     # This is a multi-resource resource reference (TargetHttp(s)Proxy,
     # TargetSslProxy, TargetTcpProxy, TargetVpnGateway, TargetPool,
diff --git a/mmv1/products/compute/GlobalNetworkEndpoint.yaml b/mmv1/products/compute/GlobalNetworkEndpoint.yaml
index 116b70b41d37..e00f9b6f13ce 100644
--- a/mmv1/products/compute/GlobalNetworkEndpoint.yaml
+++ b/mmv1/products/compute/GlobalNetworkEndpoint.yaml
@@ -93,6 +93,8 @@ properties:
       Port number of the external endpoint.
     required: true
     custom_flatten: templates/terraform/custom_flatten/float64_to_int.go.erb
+    validation: !ruby/object:Provider::Terraform::Validation
+      function: 'validation.IntAtLeast(1)'
   - !ruby/object:Api::Type::String
     name: 'ipAddress'
     description: |
diff --git a/mmv1/products/compute/Image.yaml b/mmv1/products/compute/Image.yaml
index 2c428d454187..97894c4910c1 100644
--- a/mmv1/products/compute/Image.yaml
+++ b/mmv1/products/compute/Image.yaml
@@ -147,6 +147,7 @@ properties:
             - :SEV_SNP_CAPABLE
             - :SUSPEND_RESUME_COMPATIBLE
             - :TDX_CAPABLE
+            - :SEV_LIVE_MIGRATABLE_V2
   - !ruby/object:Api::Type::NestedObject
     name: 'imageEncryptionKey'
     description: |
@@ -170,7 +171,7 @@ properties:
           The service account being used for the encryption request for the
           given KMS key. If absent, the Compute Engine default service
           account is used.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: Labels to apply to this Image.
     update_verb: :POST
diff --git a/mmv1/products/compute/Instance.yaml b/mmv1/products/compute/Instance.yaml
index 4d8111c04eae..2c8b0c2671fd 100644
--- a/mmv1/products/compute/Instance.yaml
+++ b/mmv1/products/compute/Instance.yaml
@@ -295,7 +295,7 @@ properties:
       internally during updates.
     update_url: 'projects/{{project}}/zones/{{zone}}/instances/{{name}}/setLabels'
     update_verb: :POST
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Labels to apply to this instance.  A list of key->value pairs.
@@ -497,6 +497,14 @@ properties:
             should be specified.
           # networkInterfaces.kind is not necessary for convergence.
           custom_expand: 'templates/terraform/custom_expand/resourceref_with_validation.go.erb'
+        - !ruby/object:Api::Type::ResourceRef
+          name: 'networkAttachment'
+          resource: 'networkAttachment'
+          min_version: beta
+          imports: 'selfLink'
+          description: |
+            The URL of the network attachment that this interface should connect to in the following format:
+            projects/{projectNumber}/regions/{region_name}/networkAttachments/{network_attachment_name}.
   - !ruby/object:Api::Type::NestedObject
     name: 'scheduling'
     description: Sets the scheduling options for this instance.
diff --git a/mmv1/products/compute/InstanceGroupNamedPort.yaml b/mmv1/products/compute/InstanceGroupNamedPort.yaml
index 2cc5e2a69e49..be2ae5f63aa8 100644
--- a/mmv1/products/compute/InstanceGroupNamedPort.yaml
+++ b/mmv1/products/compute/InstanceGroupNamedPort.yaml
@@ -71,6 +71,11 @@ examples:
       network_name: 'container-network'
       subnetwork_name: 'container-subnetwork'
       gke_cluster_name: 'my-cluster'
+      deletion_protection: 'true'
+    test_vars_overrides:
+      deletion_protection: 'false'
+    oics_vars_overrides:
+      deletion_protection: 'false'
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   encoder: 'templates/terraform/encoders/normalize_group.go.erb'
 parameters:
diff --git a/mmv1/products/compute/InstanceSettings.yaml b/mmv1/products/compute/InstanceSettings.yaml
new file mode 100644
index 000000000000..0f3e43f97567
--- /dev/null
+++ b/mmv1/products/compute/InstanceSettings.yaml
@@ -0,0 +1,80 @@
+# Copyright 2023 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+--- !ruby/object:Api::Resource
+name: 'InstanceSettings'
+kind: 'compute#instanceSettings'
+base_url: projects/{{project}}/zones/{{zone}}/instanceSettings
+self_link: projects/{{project}}/zones/{{zone}}/instanceSettings
+description: |
+  Represents an Instance Settings resource. Instance settings are centralized configuration parameters that allow users to configure the default values for specific VM parameters that are normally set using GCE instance API methods.
+references: !ruby/object:Api::Resource::ReferenceLinks
+  guides:
+    'Update Instance Settings': 'https://cloud.google.com/compute/docs/metadata/setting-custom-metadata#set-custom-project-zonal-metadata'
+  api: 'https://cloud.google.com/compute/docs/reference/rest/beta/instanceSettings'
+create_verb: :PATCH
+create_url: 'projects/{{project}}/zones/{{zone}}/instanceSettings?update_mask=*'
+update_verb: :PATCH
+update_url: 'projects/{{project}}/zones/{{zone}}/instanceSettings?update_mask=*'
+import_format: ['projects/{{project}}/zones/{{zone}}/instanceSettings']
+min_version: beta
+async: !ruby/object:Api::OpAsync
+  operation: !ruby/object:Api::OpAsync::Operation
+    kind: 'compute#operation'
+    path: 'name'
+    base_url: 'projects/{{project}}/zones/{{zone}}/operations/{{op_id}}'
+    wait_ms: 1000
+  result: !ruby/object:Api::OpAsync::Result
+    path: 'targetLink'
+  status: !ruby/object:Api::OpAsync::Status
+    path: 'status'
+    complete: 'DONE'
+    allowed:
+      - 'PENDING'
+      - 'RUNNING'
+      - 'DONE'
+  error: !ruby/object:Api::OpAsync::Error
+    path: 'error/errors'
+    message: 'message'
+examples:
+  - !ruby/object:Provider::Terraform::Examples
+    min_version: beta
+    name: 'instance_settings_basic'
+    primary_resource_id: 'gce_instance_settings'
+custom_code: !ruby/object:Provider::Terraform::CustomCode
+  custom_delete: templates/terraform/custom_delete/clear_instance_settings.go.erb
+  test_check_destroy: templates/terraform/custom_check_destroy/skip_delete_during_test.go.erb
+parameters:
+  - !ruby/object:Api::Type::ResourceRef
+    name: 'zone'
+    resource: 'Zone'
+    imports: 'name'
+    description: 'A reference to the zone where the machine resides.'
+    required: true
+    custom_expand: 'templates/terraform/custom_expand/resourceref_with_validation.go.erb'
+properties:
+  - !ruby/object:Api::Type::Fingerprint
+    name: 'fingerprint'
+    description: |
+        The fingerprint used for optimistic locking of this resource.  Used
+        internally during updates.
+    custom_expand: 'templates/terraform/custom_expand/compute_instance_settings_fingerprint.erb'
+  - !ruby/object:Api::Type::NestedObject
+    name: 'metadata'
+    description: |
+        The metadata key/value pairs assigned to all the instances in the corresponding scope.
+    properties:
+      - !ruby/object:Api::Type::KeyValuePairs
+        name: 'items'
+        description: |
+          A metadata key/value items map. The total size of all keys and values must be less than 512KB
diff --git a/mmv1/products/compute/NetworkAttachment.yaml b/mmv1/products/compute/NetworkAttachment.yaml
index 4b90478d792e..95eb9d46418a 100644
--- a/mmv1/products/compute/NetworkAttachment.yaml
+++ b/mmv1/products/compute/NetworkAttachment.yaml
@@ -50,18 +50,19 @@ examples:
       resource_name: 'basic-network-attachment'
       network_name: 'basic-network'
       subnetwork_name: 'basic-subnetwork'
+      accepted_producer_project_name: 'prj-accepted'
+      rejected_producer_project_name: 'prj-rejected'
     test_env_vars:
       org_id: :ORG_ID
       billing_account: :BILLING_ACCT
-# TODO uncomment once this resource is available at google_compute_instance resource
-#   - !ruby/object:Provider::Terraform::Examples
-#     name: 'network_attachment_instance_usage'
-#     primary_resource_id: 'default'
-#     vars:
-#       resource_name: 'basic-network-attachment'
-#       network_name: 'basic-network'
-#       subnetwork_name: 'basic-subnetwork'
-#       instance_name: 'basic-instance'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'network_attachment_instance_usage'
+    primary_resource_id: 'default'
+    vars:
+      resource_name: 'basic-network-attachment'
+      network_name: 'basic-network'
+      subnetwork_name: 'basic-subnetwork'
+      instance_name: 'basic-instance'
 parameters:
   - !ruby/object:Api::Type::String
     name: 'name'
diff --git a/mmv1/products/compute/NetworkEndpointGroup.yaml b/mmv1/products/compute/NetworkEndpointGroup.yaml
index 9e849d2b3f76..f37a3365d013 100644
--- a/mmv1/products/compute/NetworkEndpointGroup.yaml
+++ b/mmv1/products/compute/NetworkEndpointGroup.yaml
@@ -78,6 +78,7 @@ parameters:
       Zone where the network endpoint group is located.
     required: false
     default_from_api: true
+    ignore_read: true
     custom_expand: 'templates/terraform/custom_expand/resourceref_with_validation.go.erb'
 properties:
   - !ruby/object:Api::Type::String
@@ -109,11 +110,15 @@ properties:
       INTERNAL_MANAGED, and INTERNAL_SELF_MANAGED and 2) support the RATE or
       CONNECTION balancing modes.
 
-      Possible values include: GCE_VM_IP, GCE_VM_IP_PORT, and NON_GCP_PRIVATE_IP_PORT.
+      Possible values include: GCE_VM_IP, GCE_VM_IP_PORT, NON_GCP_PRIVATE_IP_PORT, INTERNET_IP_PORT, INTERNET_FQDN_PORT, SERVERLESS, and PRIVATE_SERVICE_CONNECT.
     values:
       - :GCE_VM_IP
       - :GCE_VM_IP_PORT
       - :NON_GCP_PRIVATE_IP_PORT
+      - :INTERNET_IP_PORT
+      - :INTERNET_FQDN_PORT
+      - :SERVERLESS
+      - :PRIVATE_SERVICE_CONNECT
     default_value: :GCE_VM_IP_PORT
   - !ruby/object:Api::Type::Integer
     name: 'size'
diff --git a/mmv1/products/compute/NetworkPeeringRoutesConfig.yaml b/mmv1/products/compute/NetworkPeeringRoutesConfig.yaml
index b939c63a33c8..bece6c506399 100644
--- a/mmv1/products/compute/NetworkPeeringRoutesConfig.yaml
+++ b/mmv1/products/compute/NetworkPeeringRoutesConfig.yaml
@@ -74,6 +74,11 @@ examples:
       network_name: 'container-network'
       subnetwork_name: 'container-subnetwork'
       gke_cluster_name: 'private-cluster'
+      deletion_protection: 'true'
+    test_vars_overrides:
+      deletion_protection: 'false'
+    oics_vars_overrides:
+      deletion_protection: 'false'
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   encoder: 'templates/terraform/encoders/network_peering_routes_config.go.erb'
 parameters:
diff --git a/mmv1/products/compute/NodeGroup.yaml b/mmv1/products/compute/NodeGroup.yaml
index 63e3ab1a8f8d..c8ba31a1074a 100644
--- a/mmv1/products/compute/NodeGroup.yaml
+++ b/mmv1/products/compute/NodeGroup.yaml
@@ -16,10 +16,11 @@ name: 'NodeGroup'
 kind: 'compute#NodeGroup'
 base_url: projects/{{project}}/zones/{{zone}}/nodeGroups
 create_url: projects/{{project}}/zones/{{zone}}/nodeGroups?initialNodeCount=PRE_CREATE_REPLACE_ME
+update_verb: :PATCH
+update_mask: true
 has_self_link: true
 description: |
   Represents a NodeGroup resource to manage a group of sole-tenant nodes.
-immutable: true
 references: !ruby/object:Api::Resource::ReferenceLinks
   guides:
     'Sole-Tenant Nodes': 'https://cloud.google.com/compute/docs/nodes/'
@@ -43,12 +44,6 @@ async: !ruby/object:Api::OpAsync
   error: !ruby/object:Api::OpAsync::Error
     path: 'error/errors'
     message: 'message'
-docs: !ruby/object:Provider::Terraform::Docs
-  warning: |
-    Due to limitations of the API, Terraform cannot update the
-    number of nodes in a node group and changes to node group size either
-    through Terraform config or through external changes will cause
-    Terraform to delete and recreate the node group.
 examples:
   - !ruby/object:Provider::Terraform::Examples
     name: 'node_group_basic'
@@ -56,6 +51,13 @@ examples:
     vars:
       group_name: 'soletenant-group'
       template_name: 'soletenant-tmpl'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'node_group_maintenance_interval'
+    min_version: beta
+    primary_resource_id: 'nodes'
+    vars:
+      group_name: 'soletenant-group'
+      template_name: 'soletenant-tmpl'
   - !ruby/object:Provider::Terraform::Examples
     name: 'node_group_autoscaling_policy'
     primary_resource_id: 'nodes'
@@ -112,21 +114,13 @@ properties:
   - !ruby/object:Api::Type::Integer
     name: 'size'
     description: |
-      The total number of nodes in the node group. One of `initial_size` or `size` must be specified.
-    immutable: true
-    send_empty_value: true
-    default_from_api: true
-    exactly_one_of:
-      - size
-      - initial_size
+      The total number of nodes in the node group.
+    output: true
   - !ruby/object:Api::Type::Integer
     name: 'initialSize'
     description: |
-      The initial number of nodes in the node group. One of `initial_size` or `size` must be specified.
+      The initial number of nodes in the node group. One of `initial_size` or `autoscaling_policy` must be configured on resource creation.
     url_param_only: true
-    exactly_one_of:
-      - size
-      - initial_size
   - !ruby/object:Api::Type::String
     name: 'maintenancePolicy'
     description: |
@@ -147,6 +141,8 @@ properties:
     description: |
       If you use sole-tenant nodes for your workloads, you can use the node
       group autoscaler to automatically manage the sizes of your node groups.
+
+      One of `initial_size` or `autoscaling_policy` must be configured on resource creation.
     default_from_api: true
     properties:
       - !ruby/object:Api::Type::Enum
@@ -207,3 +203,14 @@ properties:
               required: true
               description: |
                 The project id/number should be the same as the key of this project config in the project map.
+  - !ruby/object:Api::Type::Enum
+    name: 'maintenanceInterval'
+    min_version: beta
+    description: |
+      Specifies the frequency of planned maintenance events. Set to one of the following:
+        - AS_NEEDED: Hosts are eligible to receive infrastructure and hypervisor updates as they become available.
+        - RECURRENT: Hosts receive planned infrastructure and hypervisor updates on a periodic basis, but not more frequently than every 28 days. This minimizes the number of planned maintenance operations on individual hosts and reduces the frequency of disruptions, both live migrations and terminations, on individual VMs.
+    values:
+      - :AS_NEEDED
+      - :RECURRENT
+    default_from_api: true
diff --git a/mmv1/products/compute/PerInstanceConfig.yaml b/mmv1/products/compute/PerInstanceConfig.yaml
index 57c1b8bc3300..2c5d8e494298 100644
--- a/mmv1/products/compute/PerInstanceConfig.yaml
+++ b/mmv1/products/compute/PerInstanceConfig.yaml
@@ -124,6 +124,7 @@ parameters:
     url_param_only: true
     immutable: true
     ignore_read: true
+    default_from_api: true
   - !ruby/object:Api::Type::ResourceRef
     name: 'instanceGroupManager'
     resource: 'InstanceGroupManager'
@@ -192,7 +193,6 @@ properties:
       - !ruby/object:Api::Type::Map
         name: 'internalIp'
         api_name: internalIPs
-        min_version: beta
         key_name: 'interface_name'
         description: |
           Preserved internal IPs defined for this instance. This map is keyed with the name of the network interface.
@@ -220,7 +220,6 @@ properties:
                   custom_expand: 'templates/terraform/custom_expand/resourceref_with_validation.go.erb'
       - !ruby/object:Api::Type::Map
         name: 'externalIp'
-        min_version: beta
         api_name: externalIPs
         key_name: 'interface_name'
         description: |
diff --git a/mmv1/products/compute/RegionAutoscaler.yaml b/mmv1/products/compute/RegionAutoscaler.yaml
index e68955cf3728..931e07443408 100644
--- a/mmv1/products/compute/RegionAutoscaler.yaml
+++ b/mmv1/products/compute/RegionAutoscaler.yaml
@@ -65,6 +65,7 @@ parameters:
     required: false
     immutable: true
     default_from_api: true
+    ignore_read: true
     custom_expand: 'templates/terraform/custom_expand/resourceref_with_validation.go.erb'
 properties:
   - !ruby/object:Api::Type::Time
@@ -132,15 +133,11 @@ properties:
           instance may take to initialize. To do this, create an instance
           and time the startup process.
         default_value: 60
-      - !ruby/object:Api::Type::Enum
+      - !ruby/object:Api::Type::String
         name: 'mode'
-        default_value: :ON
+        default_value: 'ON'
         description: |
           Defines operating mode for this policy.
-        values:
-          - :OFF
-          - :ONLY_UP
-          - :ON
       - !ruby/object:Api::Type::NestedObject
         name: 'scaleDownControl'
         min_version: beta
diff --git a/mmv1/products/compute/RegionDisk.yaml b/mmv1/products/compute/RegionDisk.yaml
index 94424537f21b..d421a950923f 100644
--- a/mmv1/products/compute/RegionDisk.yaml
+++ b/mmv1/products/compute/RegionDisk.yaml
@@ -218,7 +218,7 @@ properties:
     name: 'lastDetachTimestamp'
     description: 'Last detach timestamp in RFC3339 text format.'
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Labels to apply to this disk.  A list of key->value pairs.
diff --git a/mmv1/products/compute/RegionPerInstanceConfig.yaml b/mmv1/products/compute/RegionPerInstanceConfig.yaml
index 86d4e45c6f7a..710864fcdaed 100644
--- a/mmv1/products/compute/RegionPerInstanceConfig.yaml
+++ b/mmv1/products/compute/RegionPerInstanceConfig.yaml
@@ -195,7 +195,6 @@ properties:
       - !ruby/object:Api::Type::Map
         name: 'internalIp'
         api_name: internalIPs
-        min_version: beta
         key_name: 'interface_name'
         description: |
           Preserved internal IPs defined for this instance. This map is keyed with the name of the network interface.
@@ -223,7 +222,6 @@ properties:
                   custom_expand: 'templates/terraform/custom_expand/resourceref_with_validation.go.erb'
       - !ruby/object:Api::Type::Map
         name: 'externalIp'
-        min_version: beta
         api_name: externalIPs
         key_name: 'interface_name'
         description: |
diff --git a/mmv1/products/compute/RegionSecurityPolicyRule.yaml b/mmv1/products/compute/RegionSecurityPolicyRule.yaml
index 8580b3281d90..fecb3ca06c05 100644
--- a/mmv1/products/compute/RegionSecurityPolicyRule.yaml
+++ b/mmv1/products/compute/RegionSecurityPolicyRule.yaml
@@ -65,7 +65,7 @@ examples:
   - !ruby/object:Provider::Terraform::Examples
     name: 'region_security_policy_rule_with_network_match'
     # it needs to run synchronously because a region can have only one google_compute_network_edge_security_service.
-    # there is a robust handwritten test which covers this scenario. 
+    # there is a robust handwritten test which covers this scenario.
     skip_test: true
     primary_resource_id: 'policy_rule_network_match'
     min_version: 'beta'
diff --git a/mmv1/products/compute/ResourcePolicy.yaml b/mmv1/products/compute/ResourcePolicy.yaml
index 2fc5f561273e..8e645187a41e 100644
--- a/mmv1/products/compute/ResourcePolicy.yaml
+++ b/mmv1/products/compute/ResourcePolicy.yaml
@@ -85,6 +85,7 @@ parameters:
     description: Region where resource policy resides.
     immutable: true
     required: false
+    ignore_read: true
     default_from_api: true
     custom_expand: 'templates/terraform/custom_expand/resourceref_with_validation.go.erb'
 properties:
diff --git a/mmv1/products/compute/RouterNat.yaml b/mmv1/products/compute/RouterNat.yaml
index cb8831fdd386..9b0d414391a1 100644
--- a/mmv1/products/compute/RouterNat.yaml
+++ b/mmv1/products/compute/RouterNat.yaml
@@ -91,8 +91,22 @@ examples:
       address_name1: 'nat-address1'
       address_name2: 'nat-address2'
       address_name3: 'nat-address3'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'router_nat_private'
+    primary_resource_id: 'nat_type'
+    skip_test: true
+    min_version: beta
+    vars:
+      router_name: 'my-router'
+      nat_name: 'my-router-nat'
+      network_name: 'my-network'
+      subnet_name: 'my-subnetwork'
+      hub_name: 'my-hub'
+      spoke_name: 'my-spoke'
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   constants: 'templates/terraform/constants/router_nat.go.erb'
+  pre_create: 'templates/terraform/constants/router_nat_validate_action_active_range.go.erb'
+  pre_update: 'templates/terraform/constants/router_nat_validate_action_active_range.go.erb'
 custom_diff: [
   'resourceComputeRouterNatDrainNatIpsCustomDiff',
 ]
@@ -128,7 +142,7 @@ properties:
       function: 'verify.ValidateRFC1035Name(2, 63)'
   - !ruby/object:Api::Type::Enum
     name: 'natIpAllocateOption'
-    required: true
+    required: false
     description: |
       How external IPs should be allocated for this NAT. Valid values are
       `AUTO_ONLY` for only allowing NAT IPs allocated by Google Cloud
@@ -368,10 +382,57 @@ properties:
                 description:
                   'A reference to an address associated with this NAT'
               custom_expand: 'templates/terraform/custom_expand/array_resourceref_with_validation.go.erb'
+            - !ruby/object:Api::Type::Array
+              name: 'sourceNatActiveRanges'
+              min_version: beta
+              description: |
+                  A list of URLs of the subnetworks used as source ranges for this NAT Rule.
+                  These subnetworks must have purpose set to PRIVATE_NAT.
+                  This field is used for private NAT.
+              is_set: true
+              set_hash_func: computeRouterNatRulesSubnetHash
+              custom_flatten: 'templates/terraform/custom_flatten/nat_rules_subnets_set.erb'
+              item_type: !ruby/object:Api::Type::ResourceRef
+                name: 'subnet'
+                resource: 'Subnetwork'
+                imports: 'selfLink'
+                description:
+                  'A reference to a subnetwork address associated with this NAT'
+              custom_expand: 'templates/terraform/custom_expand/array_resourceref_with_validation.go.erb'
+            - !ruby/object:Api::Type::Array
+              name: 'sourceNatDrainRanges'
+              min_version: beta
+              description: |
+                A list of URLs of subnetworks representing source ranges to be drained.
+                This is only supported on patch/update, and these subnetworks must have previously been used as active ranges in this NAT Rule.
+                This field is used for private NAT.
+              is_set: true
+              set_hash_func: computeRouterNatRulesSubnetHash
+              custom_flatten: 'templates/terraform/custom_flatten/nat_rules_subnets_set.erb'
+              item_type: !ruby/object:Api::Type::ResourceRef
+                name: 'subnet'
+                resource: 'Subnetwork'
+                imports: 'selfLink'
+                description:
+                  'A reference to a subnetwork address associated with this NAT'
+              custom_expand: 'templates/terraform/custom_expand/array_resourceref_with_validation.go.erb'
   - !ruby/object:Api::Type::Boolean
     name: enableEndpointIndependentMapping
     description: |
-      Specifies if endpoint independent mapping is enabled. This is enabled by default. For more information
-      see the [official documentation](https://cloud.google.com/nat/docs/overview#specs-rfcs).
-    default_value: true
+      Enable endpoint independent mapping.
+      For more information see the [official documentation](https://cloud.google.com/nat/docs/overview#specs-rfcs).
+    default_from_api: true
     send_empty_value: true
+  - !ruby/object:Api::Type::Enum
+    name: 'type'
+    immutable: true
+    min_version: beta
+    description: |
+      Indicates whether this NAT is used for public or private IP translation.
+      If unspecified, it defaults to PUBLIC.
+      If `PUBLIC` NAT used for public IP translation.
+      If `PRIVATE` NAT used for private IP translation.
+    values:
+      - :PUBLIC
+      - :PRIVATE
+    default_value: :PUBLIC
diff --git a/mmv1/products/compute/ServiceAttachment.yaml b/mmv1/products/compute/ServiceAttachment.yaml
index 8531c9ad02d1..f913840817a1 100644
--- a/mmv1/products/compute/ServiceAttachment.yaml
+++ b/mmv1/products/compute/ServiceAttachment.yaml
@@ -93,6 +93,7 @@ parameters:
     required: false
     immutable: true
     default_from_api: true
+    ignore_read: true
     custom_expand: 'templates/terraform/custom_expand/resourceref_with_validation.go.erb'
 properties:
   - !ruby/object:Api::Type::String
@@ -192,6 +193,7 @@ properties:
       An array of projects that are allowed to connect to this service
       attachment.
     send_empty_value: true
+    is_set: true
     item_type: !ruby/object:Api::Type::NestedObject
       properties:
         - !ruby/object:Api::Type::String
@@ -207,12 +209,10 @@ properties:
             create.
   - !ruby/object:Api::Type::Boolean
     name: reconcileConnections
-    default_value: true
+    default_from_api: true
     send_empty_value: true
     description: |
       This flag determines whether a consumer accept/reject list change can reconcile the statuses of existing ACCEPTED or REJECTED PSC endpoints.
 
       If false, connection policy update will only affect existing PENDING PSC endpoints. Existing ACCEPTED/REJECTED endpoints will remain untouched regardless how the connection policy is modified .
       If true, update will affect both PENDING and ACCEPTED/REJECTED PSC endpoints. For example, an ACCEPTED PSC endpoint will be moved to REJECTED if its project is added to the reject list.
-
-      For newly created service attachment, this boolean defaults to true.
diff --git a/mmv1/products/compute/Snapshot.yaml b/mmv1/products/compute/Snapshot.yaml
index 2f04ab0fb2a1..9d7ad7ffe598 100644
--- a/mmv1/products/compute/Snapshot.yaml
+++ b/mmv1/products/compute/Snapshot.yaml
@@ -236,7 +236,7 @@ properties:
       imports: 'selfLink'
       description: 'A reference to a license associated with this snapshot'
     custom_expand: 'templates/terraform/custom_expand/array_resourceref_with_validation.go.erb'
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: Labels to apply to this Snapshot.
     update_verb: :POST
diff --git a/mmv1/products/compute/Subnetwork.yaml b/mmv1/products/compute/Subnetwork.yaml
index 1c48d02c2f40..c15b6e3ca304 100644
--- a/mmv1/products/compute/Subnetwork.yaml
+++ b/mmv1/products/compute/Subnetwork.yaml
@@ -109,6 +109,20 @@ examples:
     vars:
       subnetwork_name: 'internal-ipv6-test-subnetwork'
       network_name: 'internal-ipv6-test-network'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'subnetwork_purpose_private_nat'
+    min_version: beta
+    primary_resource_id: 'subnetwork-purpose-private-nat'
+    vars:
+      subnetwork_name: 'subnet-purpose-test-subnetwork'
+      network_name: 'subnet-purpose-test-network'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'subnetwork_cidr_overlap'
+    min_version: beta
+    primary_resource_id: 'subnetwork-cidr-overlap'
+    vars:
+      subnetwork_name: 'subnet-cidr-overlap'
+      network_name: 'net-cidr-overlap'
 properties:
   - !ruby/object:Api::Type::Time
     name: 'creationTimestamp'
@@ -165,10 +179,11 @@ properties:
     name: 'purpose'
     immutable: true
     description: |
-      The purpose of the resource. This field can be either `PRIVATE_RFC_1918`, `REGIONAL_MANAGED_PROXY`, `GLOBAL_MANAGED_PROXY`, or `PRIVATE_SERVICE_CONNECT`.
+      The purpose of the resource. This field can be either `PRIVATE_RFC_1918`, `REGIONAL_MANAGED_PROXY`, `GLOBAL_MANAGED_PROXY`, `PRIVATE_SERVICE_CONNECT` or `PRIVATE_NAT`([Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)).
       A subnet with purpose set to `REGIONAL_MANAGED_PROXY` is a user-created subnetwork that is reserved for regional Envoy-based load balancers.
       A subnetwork in a given region with purpose set to `GLOBAL_MANAGED_PROXY` is a proxy-only subnet and is shared between all the cross-regional Envoy-based load balancers.
       A subnetwork with purpose set to `PRIVATE_SERVICE_CONNECT` reserves the subnet for hosting a Private Service Connect published service.
+      A subnetwork with purpose set to `PRIVATE_NAT` is used as source range for Private NAT gateways.
       Note that `REGIONAL_MANAGED_PROXY` is the preferred setting for all regional Envoy load balancers.
       If unspecified, the purpose defaults to `PRIVATE_RFC_1918`.
     default_from_api: true
@@ -371,7 +386,25 @@ properties:
     description: |
       The range of internal IPv6 addresses that are owned by this subnetwork.
   - !ruby/object:Api::Type::String
-    name: 'externalIpv6Prefix'
+    name: 'internalIpv6Prefix'
     output: true
+    description: |
+      The internal IPv6 address range that is assigned to this subnetwork.
+  - !ruby/object:Api::Type::String
+    name: 'externalIpv6Prefix'
+    default_from_api: true
     description: |
       The range of external IPv6 addresses that are owned by this subnetwork.
+  - !ruby/object:Api::Type::Boolean
+    name: 'allowSubnetCidrRoutesOverlap'
+    default_from_api: true
+    update_verb: :PATCH
+    update_url: projects/{{project}}/regions/{{region}}/subnetworks/{{name}}
+    fingerprint_name: 'fingerprint'
+    send_empty_value: true
+    min_version: beta
+    description: |
+      Typically packets destined to IPs within the subnetwork range that do not match
+      existing resources are dropped and prevented from leaving the VPC.
+      Setting this field to true will allow these packets to match dynamic routes injected
+      via BGP even if their destinations match existing subnet ranges.
diff --git a/mmv1/products/compute/TargetHttpsProxy.yaml b/mmv1/products/compute/TargetHttpsProxy.yaml
index aa255fe48128..b5fb90870efe 100644
--- a/mmv1/products/compute/TargetHttpsProxy.yaml
+++ b/mmv1/products/compute/TargetHttpsProxy.yaml
@@ -43,6 +43,9 @@ async: !ruby/object:Api::OpAsync
   error: !ruby/object:Api::OpAsync::Error
     path: 'error/errors'
     message: 'message'
+custom_code: !ruby/object:Provider::Terraform::CustomCode
+  encoder: templates/terraform/encoders/compute_target_https_proxy.go.erb
+  decoder: templates/terraform/decoders/compute_target_https_proxy.go.erb
 examples:
   - !ruby/object:Provider::Terraform::Examples
     name: 'target_https_proxy_basic'
@@ -62,6 +65,26 @@ examples:
       url_map_name: 'url-map'
       backend_service_name: 'backend-service'
       http_health_check_name: 'http-health-check'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'target_https_proxy_mtls'
+    primary_resource_id: 'default'
+    min_version: 'beta'
+    vars:
+      target_https_proxy_name: 'test-mtls-proxy'
+      ssl_certificate_name: 'my-certificate'
+      url_map_name: 'url-map'
+      backend_service_name: 'backend-service'
+      http_health_check_name: 'http-health-check'
+      server_tls_policy_name: 'my-tls-policy'
+      trust_config_name: 'my-trust-config'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'target_https_proxy_certificate_manager_certificate'
+    primary_resource_id: 'default'
+    vars:
+      target_https_proxy_name: 'target-http-proxy'
+      certificate_manager_certificate_name: 'my-certificate'
+      url_map_name: 'url-map'
+      backend_service_name: 'backend-service'
 properties:
   - !ruby/object:Api::Type::Time
     name: 'creationTimestamp'
@@ -103,19 +126,36 @@ properties:
     update_url: 'projects/{{project}}/global/targetHttpsProxies/{{name}}/setQuicOverride'
     default_value: :NONE
     custom_flatten: 'templates/terraform/custom_flatten/default_if_empty.erb'
+  - !ruby/object:Api::Type::Array
+    name: 'certificateManagerCertificates'
+    description: |
+      URLs to certificate manager certificate resources that are used to authenticate connections between users and the load balancer.
+      Currently, you may specify up to 15 certificates. Certificate manager certificates do not apply when the load balancing scheme is set to INTERNAL_SELF_MANAGED.
+      sslCertificates and certificateManagerCertificates fields can not be defined together.
+      Accepted format is `//certificatemanager.googleapis.com/projects/{project}/locations/{location}/certificates/{resourceName}` or just the self_link `projects/{project}/locations/{location}/certificates/{resourceName}`
+    update_verb: :POST
+    update_url: 'projects/{{project}}/targetHttpsProxies/{{name}}/setSslCertificates'
+    item_type: Api::Type::String
+    custom_expand: 'templates/terraform/custom_expand/certificate_manager_certificate_construct_full_url.go.erb'
+    diff_suppress_func: 'tpgresource.CompareResourceNames'
+    conflicts:
+      - ssl_certificates
   - !ruby/object:Api::Type::Array
     name: 'sslCertificates'
     description: |
-      A list of SslCertificate resource URLs or Certificate Manager certificate URLs that are used to authenticate
-      connections between users and the load balancer. At least one resource must be specified.
+      URLs to SslCertificate resources that are used to authenticate connections between users and the load balancer.
+      Currently, you may specify up to 15 SSL certificates. sslCertificates do not apply when the load balancing scheme is set to INTERNAL_SELF_MANAGED.
+      sslCertificates and certificateManagerCertificates can not be defined together.
     update_verb: :POST
     update_url: 'projects/{{project}}/targetHttpsProxies/{{name}}/setSslCertificates'
     item_type: !ruby/object:Api::Type::ResourceRef
       name: 'sslCertificate'
       resource: 'SslCertificate'
       imports: 'selfLink'
-      description: 'The SSL certificate URL or Certificate Manager certificate resource URL used by this TargetHttpsProxy'
+      description: 'The SSL certificate URL used by this TargetHttpsProxy'
     custom_expand: 'templates/terraform/custom_expand/array_resourceref_with_validation.go.erb'
+    conflicts:
+      - certificate_manager_certificates
   - !ruby/object:Api::Type::String
     name: 'certificateMap'
     description: |
@@ -161,3 +201,17 @@ properties:
       external HTTP(S) load balancer, the minimum allowed value is 5 seconds and
       the maximum allowed value is 1200 seconds. For Global external HTTP(S)
       load balancer (classic), this option is not available publicly.
+  - !ruby/object:Api::Type::ResourceRef
+    name: 'serverTlsPolicy'
+    resource: 'SslPolicy'
+    imports: 'selfLink'
+    description: |
+      A URL referring to a networksecurity.ServerTlsPolicy
+      resource that describes how the proxy should authenticate inbound
+      traffic. serverTlsPolicy only applies to a global TargetHttpsProxy
+      attached to globalForwardingRules with the loadBalancingScheme
+      set to INTERNAL_SELF_MANAGED or EXTERNAL or EXTERNAL_MANAGED.
+      For details which ServerTlsPolicy resources are accepted with
+      INTERNAL_SELF_MANAGED and which with EXTERNAL, EXTERNAL_MANAGED
+      loadBalancingScheme consult ServerTlsPolicy documentation.
+      If left blank, communications are not encrypted.
diff --git a/mmv1/products/compute/VpnTunnel.yaml b/mmv1/products/compute/VpnTunnel.yaml
index 3020328720d5..f1724d01ef68 100644
--- a/mmv1/products/compute/VpnTunnel.yaml
+++ b/mmv1/products/compute/VpnTunnel.yaml
@@ -230,7 +230,7 @@ properties:
     is_set: true
     default_from_api: true
     item_type: Api::Type::String
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: Labels to apply to this VpnTunnel.
     update_verb: :POST
diff --git a/mmv1/products/containerattached/Cluster.yaml b/mmv1/products/containerattached/Cluster.yaml
index 3d64fa3485b5..126fb11001e0 100644
--- a/mmv1/products/containerattached/Cluster.yaml
+++ b/mmv1/products/containerattached/Cluster.yaml
@@ -202,8 +202,8 @@ properties:
     description: |
       The Kubernetes version of the cluster.
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
-    name: annotations
+  - !ruby/object:Api::Type::KeyValueAnnotations
+    name: 'annotations'
     description: |
       Optional. Annotations on the cluster. This field has the same
       restrictions as Kubernetes annotations. The total size of all keys and
@@ -293,6 +293,16 @@ properties:
           ClusterRoleBinding will be created to grant the `cluster-admin` ClusterRole
           to the users. Up to ten admin users can be provided.
 
+          For more info on RBAC, see
+          https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles
+        item_type: Api::Type::String
+      - !ruby/object:Api::Type::Array
+        name: adminGroups
+        description: |
+          Groups that can perform operations as a cluster admin. A managed
+          ClusterRoleBinding will be created to grant the `cluster-admin` ClusterRole
+          to the groups. Up to ten admin groups can be provided.
+
           For more info on RBAC, see
           https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles
         item_type: Api::Type::String
@@ -313,3 +323,17 @@ properties:
             name: enabled
             description: |
               Enable Managed Collection.
+  - !ruby/object:Api::Type::NestedObject
+    name: binaryAuthorization
+    description: |
+      Binary Authorization configuration.
+    allow_empty_object: true
+    default_from_api: true
+    properties:
+      - !ruby/object:Api::Type::Enum
+        name: evaluationMode
+        description: |
+          Configure Binary Authorization evaluation mode.
+        values:
+          - :DISABLED
+          - :PROJECT_SINGLETON_POLICY_ENFORCE
diff --git a/mmv1/products/databasemigrationservice/connectionprofile.yaml b/mmv1/products/databasemigrationservice/ConnectionProfile.yaml
similarity index 77%
rename from mmv1/products/databasemigrationservice/connectionprofile.yaml
rename to mmv1/products/databasemigrationservice/ConnectionProfile.yaml
index 3396127ae17b..cf484fe4addc 100644
--- a/mmv1/products/databasemigrationservice/connectionprofile.yaml
+++ b/mmv1/products/databasemigrationservice/ConnectionProfile.yaml
@@ -78,6 +78,14 @@ examples:
       sqldb_user: 'my-username'
       sqldb_pass: 'my-password'
       profile: 'my-profileid'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'database_migration_service_connection_profile_oracle'
+    primary_resource_id: 'oracleprofile'
+    ignore_read_extra:
+      - 'oracle.0.password'
+    vars:
+      profile: 'my-profileid'
+    skip_test: true
   - !ruby/object:Provider::Terraform::Examples
     name: 'database_migration_service_connection_profile_alloydb'
     primary_resource_id: 'alloydbprofile'
@@ -87,8 +95,7 @@ examples:
       profile: 'my-profileid'
       global_address_name: 'private-ip-alloc'
       network_name: 'vpc-network'
-    test_vars_overrides:
-      network_name: 'acctest.BootstrapSharedTestNetwork(t, "profile-alloydb")'
+    skip_test: true
 parameters:
   - !ruby/object:Api::Type::String
     name: 'connectionProfileId'
@@ -118,7 +125,7 @@ properties:
     output: true
     description: |
       Output only. The timestamp when the resource was created. A timestamp in RFC3339 UTC 'Zulu' format, accurate to nanoseconds. Example: '2014-10-02T15:01:23.045123456Z'.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       The resource labels for connection profile to use to annotate any related underlying resources such as Compute Engine VMs.
@@ -171,6 +178,7 @@ properties:
     exactly_one_of:
       - mysql
       - postgresql
+      - oracle
       - cloudsql
       - alloydb
     properties:
@@ -252,6 +260,7 @@ properties:
     exactly_one_of:
       - mysql
       - postgresql
+      - oracle
       - cloudsql
       - alloydb
     properties:
@@ -337,8 +346,165 @@ properties:
           Output only. If the source is a Cloud SQL database, this field indicates the network architecture it's associated with.
         values:
           - :NETWORK_ARCHITECTURE_OLD_CSQL_PRODUCER
-          - :NETWORK_ARCHITECTURE_NEW_CSQL_PRODUCER -
-            !ruby/object:Api::Type::NestedObject
+          - :NETWORK_ARCHITECTURE_NEW_CSQL_PRODUCER
+  - !ruby/object:Api::Type::NestedObject
+    name: 'oracle'
+    description: |
+      Specifies connection parameters required specifically for Oracle databases.
+    exactly_one_of:
+      - mysql
+      - postgresql
+      - oracle
+      - cloudsql
+      - alloydb
+    properties:
+      - !ruby/object:Api::Type::String
+        name: 'host'
+        required: true
+        description: |
+          Required. The IP or hostname of the source Oracle database.
+      - !ruby/object:Api::Type::Integer
+        name: 'port'
+        required: true
+        description: |
+          Required. The network port of the source Oracle database.
+      - !ruby/object:Api::Type::String
+        name: 'username'
+        required: true
+        description: |
+          Required. The username that Database Migration Service will use to connect to the database. The value is encrypted when stored in Database Migration Service.
+      - !ruby/object:Api::Type::String
+        name: 'password'
+        required: true
+        immutable: true
+        description: |
+          Required. Input only. The password for the user that Database Migration Service will be using to connect to the database.
+          This field is not returned on request, and the value is encrypted when stored in Database Migration Service.
+        sensitive: true
+        custom_flatten: templates/terraform/custom_flatten/database_migration_service_connection_profile_oracle_password.go.erb
+      - !ruby/object:Api::Type::Boolean
+        name: 'passwordSet'
+        output: true
+        description: |
+          Output only. Indicates If this connection profile password is stored.
+      - !ruby/object:Api::Type::String
+        name: 'databaseService'
+        required: true
+        description: |
+          Required. Database service for the Oracle connection.
+      - !ruby/object:Api::Type::NestedObject
+        name: 'ssl'
+        description: |
+          SSL configuration for the destination to connect to the source database.
+        properties:
+          - !ruby/object:Api::Type::Enum
+            name: 'type'
+            output: true
+            description: |
+              The current connection profile state.
+            values:
+              - :SERVER_ONLY
+              - :SERVER_CLIENT
+          - !ruby/object:Api::Type::String
+            name: 'clientKey'
+            immutable: true
+            required_with:
+              - client_certificate
+            description: |
+              Input only. The unencrypted PKCS#1 or PKCS#8 PEM-encoded private key associated with the Client Certificate.
+              If this field is used then the 'clientCertificate' field is mandatory.
+            sensitive: true
+            custom_flatten: templates/terraform/custom_flatten/database_migration_service_connection_profile_oracle_ssl_client_key.go.erb
+          - !ruby/object:Api::Type::String
+            name: 'clientCertificate'
+            immutable: true
+            required_with:
+              - client_key
+            description: |
+              Input only. The x509 PEM-encoded certificate that will be used by the replica to authenticate against the source database server.
+              If this field is used then the 'clientKey' field is mandatory
+            sensitive: true
+            custom_flatten: templates/terraform/custom_flatten/database_migration_service_connection_profile_oracle_ssl_client_certificate.go.erb
+          - !ruby/object:Api::Type::String
+            name: 'caCertificate'
+            immutable: true
+            required: true
+            sensitive: true
+            custom_flatten: templates/terraform/custom_flatten/database_migration_service_connection_profile_oracle_ssl_ca_certificate.go.erb
+            description: |
+              Required. Input only. The x509 PEM-encoded certificate of the CA that signed the source database server's certificate.
+              The replica will use this certificate to verify it's connecting to the right host.
+      - !ruby/object:Api::Type::NestedObject
+        name: 'staticServiceIpConnectivity'
+        send_empty_value: true
+        allow_empty_object: true
+        description: |
+          This object has no nested fields.
+
+          Static IP address connectivity configured on service project.
+        properties: []
+        exactly_one_of:
+          - static_service_ip_connectivity
+          - forward_ssh_connectivity
+          - private_connectivity
+      - !ruby/object:Api::Type::NestedObject
+        name: 'forwardSshConnectivity'
+        description: |
+          SSL configuration for the destination to connect to the source database.
+        exactly_one_of:
+          - static_service_ip_connectivity
+          - forward_ssh_connectivity
+          - private_connectivity
+        properties:
+          - !ruby/object:Api::Type::String
+            name: 'hostname'
+            required: true
+            description: |
+              Required. Hostname for the SSH tunnel.
+          - !ruby/object:Api::Type::String
+            name: 'username'
+            required: true
+            description: |
+              Required. Username for the SSH tunnel.
+          - !ruby/object:Api::Type::Integer
+            name: 'port'
+            required: true
+            description: |
+              Port for the SSH tunnel, default value is 22.
+          - !ruby/object:Api::Type::String
+            name: 'password'
+            immutable: true
+            sensitive: true
+            description: |
+              Input only. SSH password. Only one of `password` and `private_key` can be configured.
+            exactly_one_of:
+              - forward_ssh_connectivity.0.password
+              - forward_ssh_connectivity.0.private_key
+            custom_flatten: templates/terraform/custom_flatten/database_migration_service_connection_profile_oracle_forward_ssh_password.go.erb
+          - !ruby/object:Api::Type::String
+            name: 'privateKey'
+            immutable: true
+            sensitive: true
+            description: |
+              Input only. SSH private key. Only one of `password` and `private_key` can be configured.
+            exactly_one_of:
+              - oracle.0.forward_ssh_connectivity.0.password
+              - oracle.0.forward_ssh_connectivity.0.private_key
+            custom_flatten: templates/terraform/custom_flatten/database_migration_service_connection_profile_oracle_forward_ssh_private_key.go.erb
+      - !ruby/object:Api::Type::NestedObject
+        name: 'privateConnectivity'
+        description: |
+          Configuration for using a private network to communicate with the source database
+        exactly_one_of:
+          - oracle.0.static_service_ip_connectivity
+          - oracle.0.forward_ssh_connectivity
+          - oracle.0.private_connectivity
+        properties:
+          - !ruby/object:Api::Type::String
+            name: 'privateConnection'
+            required: true
+            description: |
+              Required. The resource name (URI) of the private connection.
   - !ruby/object:Api::Type::NestedObject
     name: 'cloudsql'
     description: |
@@ -346,6 +512,7 @@ properties:
     exactly_one_of:
       - mysql
       - postgresql
+      - oracle
       - cloudsql
       - alloydb
     properties:
@@ -503,6 +670,7 @@ properties:
     exactly_one_of:
       - mysql
       - postgresql
+      - oracle
       - cloudsql
       - alloydb
     properties:
diff --git a/mmv1/products/databasemigrationservice/PrivateConnection.yaml b/mmv1/products/databasemigrationservice/PrivateConnection.yaml
new file mode 100644
index 000000000000..fc0564b32d6d
--- /dev/null
+++ b/mmv1/products/databasemigrationservice/PrivateConnection.yaml
@@ -0,0 +1,112 @@
+# Copyright 2023 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+--- !ruby/object:Api::Resource
+name: 'PrivateConnection'
+base_url: 'projects/{{project}}/locations/{{location}}/privateConnections'
+create_url: 'projects/{{project}}/locations/{{location}}/privateConnections?privateConnectionId={{private_connection_id}}'
+self_link: 'projects/{{project}}/locations/{{location}}/privateConnections/{{private_connection_id}}'
+references: !ruby/object:Api::Resource::ReferenceLinks
+  guides:
+    'Official Documentation': 'https://cloud.google.com/database-migration/docs/oracle-to-postgresql/create-private-connectivity-configuration'
+  api: 'https://cloud.google.com/database-migration/docs/reference/rest/v1/projects.locations.privateConnections'
+async: !ruby/object:Api::OpAsync
+  operation: !ruby/object:Api::OpAsync::Operation
+    path: 'name'
+    base_url: '{{op_id}}'
+    wait_ms: 1000
+timeouts: !ruby/object:Api::Timeouts
+  insert_minutes: 60
+  delete_minutes: 60
+autogen_async: true
+description: |
+  The PrivateConnection resource is used to establish private connectivity between Database Migration Service and a customer's network.
+immutable: true
+id_format: projects/{{project}}/locations/{{location}}/privateConnections/{{private_connection_id}}
+import_format:
+  [
+    'projects/{{project}}/locations/{{location}}/privateConnections/{{private_connection_id}}',
+  ]
+examples:
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'database_migration_service_private_connection'
+    primary_resource_id: 'default'
+    vars:
+      private_connection_id: 'my-connection'
+      network_name: 'my-network'
+    test_vars_overrides:
+      network_name: 'acctest.BootstrapSharedTestNetwork(t, "dbms-privateconnection")'
+parameters:
+  - !ruby/object:Api::Type::String
+    name: privateConnectionId
+    description: |
+      The private connectivity identifier.
+    required: true
+    immutable: true
+    url_param_only: true
+  - !ruby/object:Api::Type::String
+    name: 'location'
+    description: |
+      The name of the location this private connection is located in.
+    required: true
+    immutable: true
+    url_param_only: true
+properties:
+  - !ruby/object:Api::Type::String
+    name: 'name'
+    output: true
+    description: The resource's name.
+  - !ruby/object:Api::Type::KeyValueLabels
+    name: 'labels'
+    description: Labels.
+  - !ruby/object:Api::Type::String
+    name: 'displayName'
+    description: Display name.
+    default_from_api: true
+  - !ruby/object:Api::Type::String
+    name: 'state'
+    description: |
+      State of the PrivateConnection.
+    output: true
+  - !ruby/object:Api::Type::NestedObject
+    name: 'error'
+    output: true
+    description: |
+      The PrivateConnection error in case of failure.
+    properties:
+      - !ruby/object:Api::Type::String
+        name: 'message'
+        description: |
+          A message containing more information about the error that occurred.
+      - !ruby/object:Api::Type::KeyValuePairs
+        name: 'details'
+        description: |
+          A list of messages that carry the error details.
+  - !ruby/object:Api::Type::NestedObject
+    name: 'vpcPeeringConfig'
+    required: true
+    description: |
+      The VPC Peering configuration is used to create VPC peering
+      between databasemigrationservice and the consumer's VPC.
+    properties:
+      - !ruby/object:Api::Type::String
+        name: 'vpcName'
+        required: true
+        description: |
+          Fully qualified name of the VPC that Database Migration Service will peer to.
+          Format: projects/{project}/global/{networks}/{name}
+      - !ruby/object:Api::Type::String
+        name: 'subnet'
+        required: true
+        description: |
+          A free subnet for peering. (CIDR of /29)
diff --git a/mmv1/products/dataform/Repository.yaml b/mmv1/products/dataform/Repository.yaml
index 10d3596fd1d1..27de65183388 100644
--- a/mmv1/products/dataform/Repository.yaml
+++ b/mmv1/products/dataform/Repository.yaml
@@ -36,6 +36,14 @@ examples:
       git_repository_name: 'my/repository'
       dataform_repository_name: 'dataform_repository'
       data: secret-data
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'dataform_repository_ssh'
+    primary_resource_id: dataform_respository
+    min_version: beta
+    vars:
+      git_repository_name: 'my/repository'
+      dataform_repository_name: 'dataform_repository'
+      data: secret-data
 parameters:
   - !ruby/object:Api::Type::String
     name: 'region'
@@ -64,11 +72,28 @@ properties:
         description: The Git remote's default branch name.
       - !ruby/object:Api::Type::String
         name: 'authenticationTokenSecretVersion'
-        required: true
+        exactly_one_of:
+          - gitRemoteSettings.0.authenticationTokenSecretVersion
+          - gitRemoteSettings.0.sshAuthenticationConfig
         description:
           The name of the Secret Manager secret version to use as an
-          authentication token for Git operations. Must be in the format
+          authentication token for Git operations. This secret is for assigning with HTTPS only(for SSH use `ssh_authentication_config`). Must be in the format
           projects/*/secrets/*/versions/*.
+      - !ruby/object:Api::Type::NestedObject
+        name: 'sshAuthenticationConfig'
+        exactly_one_of:
+          - gitRemoteSettings.0.authenticationTokenSecretVersion
+          - gitRemoteSettings.0.sshAuthenticationConfig
+        description: Authentication fields for remote uris using SSH protocol.
+        properties:
+          - !ruby/object:Api::Type::String
+            name: userPrivateKeySecretVersion
+            required: true
+            description: The name of the Secret Manager secret version to use as a ssh private key for Git operations. Must be in the format projects/*/secrets/*/versions/*.
+          - !ruby/object:Api::Type::String
+            name: hostPublicKey
+            required: true
+            description: Content of a public SSH key to verify an identity of a remote Git host.
       - !ruby/object:Api::Type::String
         name: 'tokenStatus'
         output: true
@@ -76,14 +101,17 @@ properties:
           Indicates the status of the Git access token. https://cloud.google.com/dataform/reference/rest/v1beta1/projects.locations.repositories#TokenStatus
   - !ruby/object:Api::Type::NestedObject
     name: 'workspaceCompilationOverrides'
-    description: Optional. If set, fields of workspaceCompilationOverrides override the default compilation settings that are specified in dataform.json when creating workspace-scoped compilation results.
+    description: If set, fields of workspaceCompilationOverrides override the default compilation settings that are specified in dataform.json when creating workspace-scoped compilation results.
     properties:
       - !ruby/object:Api::Type::String
         name: defaultDatabase
-        description: Optional. The default database (Google Cloud project ID).
+        description: The default database (Google Cloud project ID).
       - !ruby/object:Api::Type::String
         name: 'schemaSuffix'
-        description: Optional. The suffix that should be appended to all schema (BigQuery dataset ID) names.
+        description: The suffix that should be appended to all schema (BigQuery dataset ID) names.
       - !ruby/object:Api::Type::String
         name: 'tablePrefix'
-        description: Optional. The prefix that should be prepended to all table names.
+        description: The prefix that should be prepended to all table names.
+  - !ruby/object:Api::Type::String
+    name: 'serviceAccount'
+    description: The service account to run workflow invocations under.
diff --git a/mmv1/products/dataform/WorkflowConfig.yaml b/mmv1/products/dataform/WorkflowConfig.yaml
index 36dcdefe0b54..c45d563d7744 100644
--- a/mmv1/products/dataform/WorkflowConfig.yaml
+++ b/mmv1/products/dataform/WorkflowConfig.yaml
@@ -35,6 +35,7 @@ examples:
     vars:
       workflow_name: 'my_workflow'
       release_name: 'my_release'
+      service_account_name: 'dataform-sa'
       git_repository_name: 'my/repository'
       dataform_repository_name: 'dataform_repository'
       data: secret-data
diff --git a/mmv1/products/datafusion/Instance.yaml b/mmv1/products/datafusion/Instance.yaml
index 17f0333f65d8..ccd0efd1c762 100644
--- a/mmv1/products/datafusion/Instance.yaml
+++ b/mmv1/products/datafusion/Instance.yaml
@@ -141,7 +141,7 @@ properties:
     name: 'enableRbac'
     description: |
       Option to enable granular role-based access control.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       The resource labels for instance to use to annotate any related underlying resources,
diff --git a/mmv1/products/dataplex/Datascan.yaml b/mmv1/products/dataplex/Datascan.yaml
index ee861ea31b5c..c3900509e163 100644
--- a/mmv1/products/dataplex/Datascan.yaml
+++ b/mmv1/products/dataplex/Datascan.yaml
@@ -126,7 +126,7 @@ properties:
     name: 'displayName'
     description: |
       User friendly display name.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       User-defined labels for the scan. A list of key->value pairs.
@@ -489,387 +489,3 @@ properties:
               Only top-level field names for nested fields are supported.
               For instance, if 'x' is of nested field type, listing 'x' is supported but 'x.y.z' is not supported. Here 'y' and 'y.z' are nested fields of 'x'.
             item_type: Api::Type::String
-  - !ruby/object:Api::Type::NestedObject
-    name: 'dataQualityResult'
-    output: true
-    deprecation_message: "`data_quality_result` is deprecated and will be removed in a future major release."
-    description: |
-      The result of the data quality scan.
-    properties:
-      - !ruby/object:Api::Type::Boolean
-        name: 'passed'
-        output: true
-        description: |
-          Overall data quality result -- true if all rules passed.
-      - !ruby/object:Api::Type::Array
-        name: 'dimensions'
-        description: |
-          A list of results at the dimension level.
-        item_type: !ruby/object:Api::Type::NestedObject
-          properties:
-            - !ruby/object:Api::Type::Boolean
-              name: 'passed'
-              description: |
-                Whether the dimension passed or failed.
-      - !ruby/object:Api::Type::Array
-        name: 'rules'
-        output: true
-        description: |
-          A list of all the rules in a job, and their results.
-        item_type: !ruby/object:Api::Type::NestedObject
-          properties:
-            - !ruby/object:Api::Type::NestedObject
-              name: 'rule'
-              output: true
-              description: |
-                The rule specified in the DataQualitySpec, as is.
-              properties:
-                - !ruby/object:Api::Type::String
-                  name: 'column'
-                  description: |
-                    The unnested column which this rule is evaluated against.
-                - !ruby/object:Api::Type::Boolean
-                  name: 'ignoreNull'
-                  description: |
-                    Rows with null values will automatically fail a rule, unless ignoreNull is true. In that case, such null rows are trivially considered passing. Only applicable to ColumnMap rules.
-                - !ruby/object:Api::Type::String
-                  name: 'dimension'
-                  description: |
-                    The dimension a rule belongs to. Results are also aggregated at the dimension level. Supported dimensions are ["COMPLETENESS", "ACCURACY", "CONSISTENCY", "VALIDITY", "UNIQUENESS", "INTEGRITY"]
-                - !ruby/object:Api::Type::Integer
-                  name: 'threshold'
-                  description: |
-                    The minimum ratio of passing_rows / total_rows required to pass this rule, with a range of [0.0, 1.0]. 0 indicates default value (i.e. 1.0).
-                - !ruby/object:Api::Type::NestedObject
-                  name: 'rangeExpectation'
-                  output: true
-                  description: |
-                    ColumnMap rule which evaluates whether each column value lies between a specified range.
-                  properties:
-                    - !ruby/object:Api::Type::String
-                      name: 'minValue'
-                      description: |
-                        The minimum column value allowed for a row to pass this validation. At least one of minValue and maxValue need to be provided.
-                    - !ruby/object:Api::Type::String
-                      name: maxValue
-                      description: |
-                        The maximum column value allowed for a row to pass this validation. At least one of minValue and maxValue need to be provided.
-                    - !ruby/object:Api::Type::Boolean
-                      name: 'strictMinEnabled'
-                      default_value: false
-                      description: |
-                        Whether each value needs to be strictly greater than ('>') the minimum, or if equality is allowed.
-                        Only relevant if a minValue has been defined. Default = false.
-                    - !ruby/object:Api::Type::Boolean
-                      name: 'strictMaxEnabled'
-                      default_value: false
-                      description: |
-                        Whether each value needs to be strictly lesser than ('<') the maximum, or if equality is allowed.
-                        Only relevant if a maxValue has been defined. Default = false.
-                - !ruby/object:Api::Type::NestedObject
-                  name: 'nonNullExpectation'
-                  output: true
-                  allow_empty_object: true
-                  description: |
-                    ColumnMap rule which evaluates whether each column value is null.
-                  properties: []
-                - !ruby/object:Api::Type::NestedObject
-                  name: 'setExpectation'
-                  output: true
-                  description: |
-                    ColumnMap rule which evaluates whether each column value is contained by a specified set.
-                  properties:
-                    - !ruby/object:Api::Type::Array
-                      name: 'values'
-                      description: |
-                        Expected values for the column value.
-                      item_type: Api::Type::String
-                - !ruby/object:Api::Type::NestedObject
-                  name: 'regexExpectation'
-                  output: true
-                  description: |
-                    ColumnMap rule which evaluates whether each column value matches a specified regex.
-                  properties:
-                    - !ruby/object:Api::Type::String
-                      name: 'regex'
-                      description: |
-                        A regular expression the column value is expected to match.
-                - !ruby/object:Api::Type::NestedObject
-                  name: 'uniquenessExpectation'
-                  output: true
-                  allow_empty_object: true
-                  description: |
-                    ColumnAggregate rule which evaluates whether the column has duplicates.
-                  properties: []
-                - !ruby/object:Api::Type::NestedObject
-                  name: 'statisticRangeExpectation'
-                  output: true
-                  description: |
-                    ColumnAggregate rule which evaluates whether the column aggregate statistic lies between a specified range.
-                  properties:
-                    - !ruby/object:Api::Type::Enum
-                      name: 'statistic'
-                      description: |
-                        column statistics.
-                      values:
-                        - :STATISTIC_UNDEFINED
-                        - :MEAN
-                        - :MIN
-                        - :MAX
-                    - !ruby/object:Api::Type::String
-                      name: 'minValue'
-                      description: |
-                        The minimum column statistic value allowed for a row to pass this validation.
-                        At least one of minValue and maxValue need to be provided.
-                    - !ruby/object:Api::Type::String
-                      name: 'maxValue'
-                      description: |
-                        The maximum column statistic value allowed for a row to pass this validation.
-                        At least one of minValue and maxValue need to be provided.
-                    - !ruby/object:Api::Type::Boolean
-                      name: 'strictMinEnabled'
-                      description: |
-                        Whether column statistic needs to be strictly greater than ('>') the minimum, or if equality is allowed.
-                        Only relevant if a minValue has been defined. Default = false.
-                    - !ruby/object:Api::Type::Boolean
-                      name: 'strictMaxEnabled'
-                      description: |
-                        Whether column statistic needs to be strictly lesser than ('<') the maximum, or if equality is allowed.
-                        Only relevant if a maxValue has been defined. Default = false.
-                - !ruby/object:Api::Type::NestedObject
-                  name: 'rowConditionExpectation'
-                  output: true
-                  description: |
-                    Table rule which evaluates whether each row passes the specified condition.
-                  properties:
-                    - !ruby/object:Api::Type::String
-                      name: 'sqlExpression'
-                      description: |
-                        The SQL expression.
-                - !ruby/object:Api::Type::NestedObject
-                  name: 'tableConditionExpectation'
-                  output: true
-                  description: |
-                    Table rule which evaluates whether the provided expression is true.
-                  properties:
-                    - !ruby/object:Api::Type::String
-                      name: 'sqlExpression'
-                      description: |
-                        The SQL expression.
-            - !ruby/object:Api::Type::Boolean
-              name: 'passed'
-              output: true
-              description: |
-                Whether the rule passed or failed.
-            - !ruby/object:Api::Type::String
-              name: 'evaluatedCount'
-              output: true
-              description: |
-                The number of rows a rule was evaluated against. This field is only valid for ColumnMap type rules.
-                Evaluated count can be configured to either
-                1. include all rows (default) - with null rows automatically failing rule evaluation, or
-                2. exclude null rows from the evaluatedCount, by setting ignore_nulls = true.
-            - !ruby/object:Api::Type::String
-              name: 'passedCount'
-              output: true
-              description: |
-                The number of rows which passed a rule evaluation. This field is only valid for ColumnMap type rules.
-            - !ruby/object:Api::Type::String
-              name: 'nullCount'
-              output: true
-              description: |
-                The number of rows with null values in the specified column.
-            - !ruby/object:Api::Type::Integer
-              name: 'passRatio'
-              output: true
-              description: |
-                The ratio of passedCount / evaluatedCount. This field is only valid for ColumnMap type rules.
-            - !ruby/object:Api::Type::String
-              name: 'failingRowsQuery'
-              output: true
-              description: |
-                The query to find rows that did not pass this rule. Only applies to ColumnMap and RowCondition rules.
-      - !ruby/object:Api::Type::String
-        name: 'rowCount'
-        output: true
-        description: |
-          The count of rows processed.
-      - !ruby/object:Api::Type::NestedObject
-        name: 'scannedData'
-        output: true
-        description: |
-          The data scanned for this result.
-        properties:
-          - !ruby/object:Api::Type::NestedObject
-            name: 'incrementalField'
-            description: |
-              The range denoted by values of an incremental field
-            properties:
-              - !ruby/object:Api::Type::String
-                name: 'field'
-                description: |
-                  The field that contains values which monotonically increases over time (e.g. a timestamp column).
-              - !ruby/object:Api::Type::String
-                name: 'start'
-                description: |
-                  Value that marks the start of the range.
-              - !ruby/object:Api::Type::String
-                name: 'end'
-                description: Value that marks the end of the range.
-  - !ruby/object:Api::Type::NestedObject
-    name: 'dataProfileResult'
-    output: true
-    deprecation_message: "`data_profile_result` is deprecated and will be removed in a future major release."
-    custom_flatten: templates/terraform/custom_flatten/dataplex_datascan_ignore_profile_result.go.erb
-    description: |
-      The result of the data profile scan.
-    properties:
-      - !ruby/object:Api::Type::String
-        name: 'rowCount'
-        description: |
-          The count of rows scanned.
-      - !ruby/object:Api::Type::NestedObject
-        name: 'profile'
-        output: true
-        description: |
-          The profile information per field.
-        properties:
-          - !ruby/object:Api::Type::Array
-            name: 'fields'
-            description: |
-              List of fields with structural and profile information for each field.
-            item_type: !ruby/object:Api::Type::NestedObject
-              properties:
-                - !ruby/object:Api::Type::String
-                  name: 'name'
-                  description: |
-                    The name of the field.
-                - !ruby/object:Api::Type::String
-                  name: 'type'
-                  description: |
-                    The field data type.
-                - !ruby/object:Api::Type::String
-                  name: 'mode'
-                  description: |
-                    The mode of the field. Possible values include:
-                    1. REQUIRED, if it is a required field.
-                    2. NULLABLE, if it is an optional field.
-                    3. REPEATED, if it is a repeated field.
-                - !ruby/object:Api::Type::NestedObject
-                  name: 'profile'
-                  description: |
-                    Profile information for the corresponding field.
-                  properties:
-                    - !ruby/object:Api::Type::Integer
-                      name: 'nullRatio'
-                      output: true
-                      description: |
-                        Ratio of rows with null value against total scanned rows.
-                    - !ruby/object:Api::Type::Integer
-                      name: 'distinctRatio'
-                      description: |
-                        Ratio of rows with distinct values against total scanned rows. Not available for complex non-groupable field type RECORD and fields with REPEATABLE mode.
-                    - !ruby/object:Api::Type::NestedObject
-                      name: 'topNValues'
-                      description: |
-                        The list of top N non-null values and number of times they occur in the scanned data. N is 10 or equal to the number of distinct values in the field, whichever is smaller. Not available for complex non-groupable field type RECORD and fields with REPEATABLE mode.
-                      properties:
-                        - !ruby/object:Api::Type::String
-                          name: 'value'
-                          description: |
-                            String value of a top N non-null value.
-                        - !ruby/object:Api::Type::String
-                          name: 'count'
-                          description: |
-                            Count of the corresponding value in the scanned data.
-                    - !ruby/object:Api::Type::NestedObject
-                      name: 'stringProfile'
-                      output: true
-                      description: |
-                        String type field information.
-                      properties:
-                        - !ruby/object:Api::Type::String
-                          name: 'minLength'
-                          description: |
-                            Minimum length of non-null values in the scanned data.
-                        - !ruby/object:Api::Type::String
-                          name: 'maxLength'
-                          description: |
-                            Maximum length of non-null values in the scanned data.
-                        - !ruby/object:Api::Type::Integer
-                          name: 'averageLength'
-                          description: |
-                            Average length of non-null values in the scanned data.
-                    - !ruby/object:Api::Type::NestedObject
-                      name: 'integerProfile'
-                      output: true
-                      description: |
-                        Integer type field information.
-                      properties:
-                        - !ruby/object:Api::Type::Integer
-                          name: 'average'
-                          description: |
-                            Average of non-null values in the scanned data. NaN, if the field has a NaN.
-                        - !ruby/object:Api::Type::Integer
-                          name: 'standardDeviation'
-                          description: |
-                            Standard deviation of non-null values in the scanned data. NaN, if the field has a NaN.
-                        - !ruby/object:Api::Type::String
-                          name: 'min'
-                          description: |
-                            Minimum of non-null values in the scanned data. NaN, if the field has a NaN.
-                        - !ruby/object:Api::Type::String
-                          name: 'quartiles'
-                          description: |
-                            A quartile divides the number of data points into four parts, or quarters, of more-or-less equal size. Three main quartiles used are: The first quartile (Q1) splits off the lowest 25% of data from the highest 75%. It is also known as the lower or 25th empirical quartile, as 25% of the data is below this point. The second quartile (Q2) is the median of a data set. So, 50% of the data lies below this point. The third quartile (Q3) splits off the highest 25% of data from the lowest 75%. It is known as the upper or 75th empirical quartile, as 75% of the data lies below this point. Here, the quartiles is provided as an ordered list of quartile values for the scanned data, occurring in order Q1, median, Q3.
-                        - !ruby/object:Api::Type::String
-                          name: 'max'
-                          description: |
-                            Maximum of non-null values in the scanned data. NaN, if the field has a NaN.
-                    - !ruby/object:Api::Type::NestedObject
-                      name: 'doubleProfile'
-                      output: true
-                      description: |
-                        Double type field information.
-                      properties:
-                        - !ruby/object:Api::Type::Integer
-                          name: 'average'
-                          description: |
-                            Average of non-null values in the scanned data. NaN, if the field has a NaN.
-                        - !ruby/object:Api::Type::Integer
-                          name: 'standardDeviation'
-                          description: |
-                            Standard deviation of non-null values in the scanned data. NaN, if the field has a NaN.
-                        - !ruby/object:Api::Type::String
-                          name: 'min'
-                          description: |
-                            Minimum of non-null values in the scanned data. NaN, if the field has a NaN.
-                        - !ruby/object:Api::Type::String
-                          name: 'quartiles'
-                          description: |
-                            A quartile divides the number of data points into four parts, or quarters, of more-or-less equal size. Three main quartiles used are: The first quartile (Q1) splits off the lowest 25% of data from the highest 75%. It is also known as the lower or 25th empirical quartile, as 25% of the data is below this point. The second quartile (Q2) is the median of a data set. So, 50% of the data lies below this point. The third quartile (Q3) splits off the highest 25% of data from the lowest 75%. It is known as the upper or 75th empirical quartile, as 75% of the data lies below this point. Here, the quartiles is provided as an ordered list of quartile values for the scanned data, occurring in order Q1, median, Q3.
-                        - !ruby/object:Api::Type::String
-                          name: 'max'
-                          description: |
-                            Maximum of non-null values in the scanned data. NaN, if the field has a NaN.
-      - !ruby/object:Api::Type::NestedObject
-        name: 'scannedData'
-        output: true
-        description: The data scanned for this result.
-        properties:
-          - !ruby/object:Api::Type::NestedObject
-            name: 'incrementalField'
-            description: |
-              The range denoted by values of an incremental field
-            properties:
-              - !ruby/object:Api::Type::String
-                name: 'field'
-                description: |
-                  The field that contains values which monotonically increases over time (e.g. a timestamp column).
-              - !ruby/object:Api::Type::String
-                name: 'start'
-                description: |
-                  Value that marks the start of the range.
-              - !ruby/object:Api::Type::String
-                name: 'end'
-                description: Value that marks the end of the range.
diff --git a/mmv1/products/dataplex/Task.yaml b/mmv1/products/dataplex/Task.yaml
index 3a4095794264..66ed12c16dbb 100644
--- a/mmv1/products/dataplex/Task.yaml
+++ b/mmv1/products/dataplex/Task.yaml
@@ -116,7 +116,7 @@ properties:
       - :CREATING
       - :DELETING
       - :ACTION_REQUIRED
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       User-defined labels for the task.
diff --git a/mmv1/products/datastream/ConnectionProfile.yaml b/mmv1/products/datastream/ConnectionProfile.yaml
index 5e5258e765b6..3a8a4d94879f 100644
--- a/mmv1/products/datastream/ConnectionProfile.yaml
+++ b/mmv1/products/datastream/ConnectionProfile.yaml
@@ -81,7 +81,7 @@ properties:
     name: 'name'
     output: true
     description: The resource's name.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: Labels.
   - !ruby/object:Api::Type::String
diff --git a/mmv1/products/datastream/PrivateConnection.yaml b/mmv1/products/datastream/PrivateConnection.yaml
index dcd9a6da8d71..c2a10d6c8bce 100644
--- a/mmv1/products/datastream/PrivateConnection.yaml
+++ b/mmv1/products/datastream/PrivateConnection.yaml
@@ -59,7 +59,7 @@ properties:
     name: 'name'
     output: true
     description: The resource's name.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: Labels.
   - !ruby/object:Api::Type::String
diff --git a/mmv1/products/datastream/Stream.yaml b/mmv1/products/datastream/Stream.yaml
index 039b51a75457..a88ed1eeb73c 100644
--- a/mmv1/products/datastream/Stream.yaml
+++ b/mmv1/products/datastream/Stream.yaml
@@ -157,7 +157,7 @@ properties:
     name: 'name'
     output: true
     description: The stream's name.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: Labels.
   - !ruby/object:Api::Type::String
diff --git a/mmv1/products/dialogflowcx/Agent.yaml b/mmv1/products/dialogflowcx/Agent.yaml
index 1d9580af5d6e..086400417dda 100644
--- a/mmv1/products/dialogflowcx/Agent.yaml
+++ b/mmv1/products/dialogflowcx/Agent.yaml
@@ -31,6 +31,9 @@ examples:
     primary_resource_id: 'full_agent'
     vars:
       agent_name: 'dialogflowcx-agent'
+      bucket_name: 'dialogflowcx-bucket'
+    ignore_read_extra:
+      - git_integration_settings.0.github_settings.0.access_token
 id_format: 'projects/{{project}}/locations/{{location}}/agents/{{name}}'
 import_format: ['projects/{{project}}/locations/{{location}}/agents/{{name}}']
 skip_sweeper: true
@@ -111,3 +114,99 @@ properties:
     name: 'enableSpellCorrection'
     description: |
       Indicates if automatic spell correction is enabled in detect intent requests.
+  - !ruby/object:Api::Type::NestedObject
+    name: 'advancedSettings'
+    description: |
+      Hierarchical advanced settings for this agent. The settings exposed at the lower level overrides the settings exposed at the higher level.
+      Hierarchy: Agent->Flow->Page->Fulfillment/Parameter.
+    default_from_api: true
+    properties:
+      - !ruby/object:Api::Type::NestedObject
+        name: 'audioExportGcsDestination'
+        description: |
+          If present, incoming audio is exported by Dialogflow to the configured Google Cloud Storage destination. Exposed at the following levels:
+          * Agent level
+          * Flow level
+        properties:
+          - !ruby/object:Api::Type::String
+            name: 'uri'
+            description: |
+              The Google Cloud Storage URI for the exported objects. Whether a full object name, or just a prefix, its usage depends on the Dialogflow operation.
+              Format: gs://bucket/object-name-or-prefix
+      - !ruby/object:Api::Type::NestedObject
+        name: 'dtmfSettings'
+        description: |
+          Define behaviors for DTMF (dual tone multi frequency). DTMF settings does not override each other. DTMF settings set at different levels define DTMF detections running in parallel. Exposed at the following levels:
+          * Agent level
+          * Flow level
+          * Page level
+          * Parameter level
+        properties:
+          - !ruby/object:Api::Type::Boolean
+            name: 'enabled'
+            description: |
+              If true, incoming audio is processed for DTMF (dual tone multi frequency) events. For example, if the caller presses a button on their telephone keypad and DTMF processing is enabled, Dialogflow will detect the event (e.g. a "3" was pressed) in the incoming audio and pass the event to the bot to drive business logic (e.g. when 3 is pressed, return the account balance).
+          - !ruby/object:Api::Type::Integer
+            name: 'maxDigits'
+            description: |
+              Max length of DTMF digits.
+          - !ruby/object:Api::Type::String
+            name: 'finishDigit'
+            description: |
+              The digit that terminates a DTMF digit sequence.
+  - !ruby/object:Api::Type::NestedObject
+    name: 'gitIntegrationSettings'
+    description: |
+      Git integration settings for this agent.
+    allow_empty_object: true
+    properties:
+      - !ruby/object:Api::Type::NestedObject
+        name: 'githubSettings'
+        description: |
+          Settings of integration with GitHub.
+        properties:
+          - !ruby/object:Api::Type::String
+            name: 'displayName'
+            description: |
+              The unique repository display name for the GitHub repository.
+          - !ruby/object:Api::Type::String
+            name: 'repositoryUri'
+            description: |
+              The GitHub repository URI related to the agent.
+          - !ruby/object:Api::Type::String
+            name: 'trackingBranch'
+            description: |
+              The branch of the GitHub repository tracked for this agent.
+          - !ruby/object:Api::Type::String
+            name: 'accessToken'
+            description: |
+              The access token used to authenticate the access to the GitHub repository.
+            sensitive: true
+            ignore_read: true
+            custom_flatten: 'templates/terraform/custom_flatten/dialogflowcx_agent_git_integration_settings_github_settings_access_token.go.erb'
+          - !ruby/object:Api::Type::Array
+            name: 'branches'
+            description: |
+              A list of branches configured to be used from Dialogflow.
+            item_type: Api::Type::String
+  - !ruby/object:Api::Type::NestedObject
+    name: 'textToSpeechSettings'
+    description: |
+      Settings related to speech synthesizing.
+    allow_empty_object: true
+    properties:
+      # This is a map of language -> some settings. List of languages is large and constantly expanding so we use a string instead of a NestedObject with 100 properties.
+      - !ruby/object:Api::Type::String
+        name: 'synthesizeSpeechConfigs'
+        description: |
+          Configuration of how speech should be synthesized, mapping from [language](https://cloud.google.com/dialogflow/cx/docs/reference/language) to [SynthesizeSpeechConfig](https://cloud.google.com/dialogflow/cx/docs/reference/rest/v3/projects.locations.agents#synthesizespeechconfig).
+          These settings affect:
+          * The phone gateway synthesize configuration set via Agent.text_to_speech_settings.
+          * How speech is synthesized when invoking session APIs. `Agent.text_to_speech_settings` only applies if `OutputAudioConfig.synthesize_speech_config` is not specified.
+        custom_expand: 'templates/terraform/custom_expand/json_schema.erb'
+        custom_flatten: 'templates/terraform/custom_flatten/json_schema.erb'
+        state_func:
+          'func(v interface{}) string { s, _ := structure.NormalizeJsonString(v);
+          return s }'
+        validation: !ruby/object:Provider::Terraform::Validation
+          function: 'validation.StringIsJSON'
diff --git a/mmv1/products/dialogflowcx/Environment.yaml b/mmv1/products/dialogflowcx/Environment.yaml
index fa0b087649ac..b8ad55a4b8ae 100644
--- a/mmv1/products/dialogflowcx/Environment.yaml
+++ b/mmv1/products/dialogflowcx/Environment.yaml
@@ -25,6 +25,7 @@ references: !ruby/object:Api::Resource::ReferenceLinks
     'Official Documentation': 'https://cloud.google.com/dialogflow/cx/docs'
   api: 'https://cloud.google.com/dialogflow/cx/docs/reference/rest/v3/projects.locations.agents.environments'
 async: !ruby/object:Api::OpAsync
+  actions: ['create', 'update']
   operation: !ruby/object:Api::OpAsync::Operation
     path: 'name'
     full_url: 'https://{{location}}-dialogflow.googleapis.com/v3/{{op_id}}'
@@ -32,7 +33,6 @@ async: !ruby/object:Api::OpAsync
     timeouts: !ruby/object:Api::Timeouts
       insert_minutes: 60
       update_minutes: 60
-      delete_minutes: 60
   result: !ruby/object:Api::OpAsync::Result
     path: 'response'
     resource_inside_response: true
@@ -45,7 +45,6 @@ async: !ruby/object:Api::OpAsync
   error: !ruby/object:Api::OpAsync::Error
     path: 'error'
     message: 'message'
-exclude_resource: true
 timeouts: !ruby/object:Api::Timeouts
   insert_minutes: 40
   update_minutes: 40
@@ -55,12 +54,20 @@ custom_code: !ruby/object:Provider::Terraform::CustomCode
   pre_update: templates/terraform/pre_create/dialogflow_set_location.go.erb
   pre_delete: templates/terraform/pre_create/dialogflow_set_location.go.erb
   pre_read: templates/terraform/pre_create/dialogflow_set_location.go.erb
+custom_diff:
+  - 'tpgresource.DefaultProviderProject'
 examples:
   - !ruby/object:Provider::Terraform::Examples
     name: 'dialogflowcx_environment_full'
     primary_resource_id: 'development'
     vars:
       agent_name: 'dialogflowcx-agent'
+  - !ruby/object:Provider::Terraform::Examples
+    skip_docs: true
+    name: 'dialogflowcx_environment_regional'
+    primary_resource_id: 'development'
+    vars:
+      agent_name: 'issue-12880'
 skip_sweeper: true
 id_format: '{{parent}}/environments/{{name}}'
 import_format: ['{{parent}}/environments/{{name}}']
diff --git a/mmv1/products/dialogflowcx/Flow.yaml b/mmv1/products/dialogflowcx/Flow.yaml
index 883a76e67d36..061b2e2b222f 100644
--- a/mmv1/products/dialogflowcx/Flow.yaml
+++ b/mmv1/products/dialogflowcx/Flow.yaml
@@ -27,16 +27,37 @@ timeouts: !ruby/object:Api::Timeouts
   update_minutes: 40
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   custom_import: templates/terraform/custom_import/dialogflowcx_flow.go.erb
-  pre_create: templates/terraform/pre_create/dialogflow_set_location.go.erb
+  pre_create: templates/terraform/pre_create/dialogflowcx_set_location_skip_default_obj.go.erb
   pre_update: templates/terraform/pre_create/dialogflow_set_location.go.erb
-  pre_delete: templates/terraform/pre_create/dialogflow_set_location.go.erb
+  pre_delete: templates/terraform/pre_delete/dialogflowcx_set_location_skip_default_obj.go.erb
   pre_read: templates/terraform/pre_create/dialogflow_set_location.go.erb
+virtual_fields:
+  - !ruby/object:Api::Type::Boolean
+    name: is_default_start_flow
+    immutable: true
+    description: |
+      Marks this as the [Default Start Flow](https://cloud.google.com/dialogflow/cx/docs/concept/flow#start) for an agent. When you create an agent, the Default Start Flow is created automatically.
+      The Default Start Flow cannot be deleted; deleting the `google_dialogflow_cx_flow` resource does nothing to the underlying GCP resources.
+
+      ~> Avoid having multiple `google_dialogflow_cx_flow` resources linked to the same agent with `is_default_start_flow = true` because they will compete to control a single Default Start Flow resource in GCP.
 examples:
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'dialogflowcx_flow_basic'
+    primary_resource_id: 'basic_flow'
+    vars:
+      agent_name: 'dialogflowcx-agent'
   - !ruby/object:Provider::Terraform::Examples
     name: 'dialogflowcx_flow_full'
     primary_resource_id: 'basic_flow'
     vars:
       agent_name: 'dialogflowcx-agent'
+      bucket_name: 'dialogflowcx-bucket'
+  - !ruby/object:Provider::Terraform::Examples
+    skip_docs: true
+    name: 'dialogflowcx_flow_default_start_flow'
+    primary_resource_id: 'default_start_flow'
+    vars:
+      agent_name: 'dialogflowcx-agent'
 skip_sweeper: true
 id_format: '{{parent}}/flows/{{name}}'
 import_format: ['{{parent}}/flows/{{name}}']
@@ -538,3 +559,42 @@ properties:
         values:
           - :MODEL_TRAINING_MODE_AUTOMATIC
           - :MODEL_TRAINING_MODE_MANUAL
+  - !ruby/object:Api::Type::NestedObject
+    name: 'advancedSettings'
+    description: |
+      Hierarchical advanced settings for this flow. The settings exposed at the lower level overrides the settings exposed at the higher level.
+      Hierarchy: Agent->Flow->Page->Fulfillment/Parameter.
+    properties:
+      - !ruby/object:Api::Type::NestedObject
+        name: 'audioExportGcsDestination'
+        description: |
+          If present, incoming audio is exported by Dialogflow to the configured Google Cloud Storage destination. Exposed at the following levels:
+          * Agent level
+          * Flow level
+        properties:
+          - !ruby/object:Api::Type::String
+            name: 'uri'
+            description: |
+              The Google Cloud Storage URI for the exported objects. Whether a full object name, or just a prefix, its usage depends on the Dialogflow operation.
+              Format: gs://bucket/object-name-or-prefix
+      - !ruby/object:Api::Type::NestedObject
+        name: 'dtmfSettings'
+        description: |
+          Define behaviors for DTMF (dual tone multi frequency). DTMF settings does not override each other. DTMF settings set at different levels define DTMF detections running in parallel. Exposed at the following levels:
+          * Agent level
+          * Flow level
+          * Page level
+          * Parameter level
+        properties:
+          - !ruby/object:Api::Type::Boolean
+            name: 'enabled'
+            description: |
+              If true, incoming audio is processed for DTMF (dual tone multi frequency) events. For example, if the caller presses a button on their telephone keypad and DTMF processing is enabled, Dialogflow will detect the event (e.g. a "3" was pressed) in the incoming audio and pass the event to the bot to drive business logic (e.g. when 3 is pressed, return the account balance).
+          - !ruby/object:Api::Type::Integer
+            name: 'maxDigits'
+            description: |
+              Max length of DTMF digits.
+          - !ruby/object:Api::Type::String
+            name: 'finishDigit'
+            description: |
+              The digit that terminates a DTMF digit sequence.
diff --git a/mmv1/products/dialogflowcx/Intent.yaml b/mmv1/products/dialogflowcx/Intent.yaml
index caf8c2dd32d7..3a287a4f5b07 100644
--- a/mmv1/products/dialogflowcx/Intent.yaml
+++ b/mmv1/products/dialogflowcx/Intent.yaml
@@ -27,16 +27,45 @@ timeouts: !ruby/object:Api::Timeouts
   update_minutes: 40
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   custom_import: templates/terraform/custom_import/dialogflowcx_intent.go.erb
-  pre_create: templates/terraform/pre_create/dialogflow_set_location.go.erb
+  pre_create: templates/terraform/pre_create/dialogflowcx_set_location_skip_default_obj.go.erb
   pre_update: templates/terraform/pre_create/dialogflow_set_location.go.erb
-  pre_delete: templates/terraform/pre_create/dialogflow_set_location.go.erb
+  pre_delete: templates/terraform/pre_delete/dialogflowcx_set_location_skip_default_obj.go.erb
   pre_read: templates/terraform/pre_create/dialogflow_set_location.go.erb
+virtual_fields:
+  - !ruby/object:Api::Type::Boolean
+    name: is_default_welcome_intent
+    immutable: true
+    description: |
+      Marks this as the [Default Welcome Intent](https://cloud.google.com/dialogflow/cx/docs/concept/intent#welcome) for an agent. When you create an agent, a Default Welcome Intent is created automatically.
+      The Default Welcome Intent cannot be deleted; deleting the `google_dialogflow_cx_intent` resource does nothing to the underlying GCP resources.
+
+      ~> Avoid having multiple `google_dialogflow_cx_intent` resources linked to the same agent with `is_default_welcome_intent = true` because they will compete to control a single Default Welcome Intent resource in GCP.
+  - !ruby/object:Api::Type::Boolean
+    name: is_default_negative_intent
+    immutable: true
+    description: |
+      Marks this as the [Default Negative Intent](https://cloud.google.com/dialogflow/cx/docs/concept/intent#negative) for an agent. When you create an agent, a Default Negative Intent is created automatically.
+      The Default Negative Intent cannot be deleted; deleting the `google_dialogflow_cx_intent` resource does nothing to the underlying GCP resources.
+
+      ~> Avoid having multiple `google_dialogflow_cx_intent` resources linked to the same agent with `is_default_negative_intent = true` because they will compete to control a single Default Negative Intent resource in GCP.
 examples:
   - !ruby/object:Provider::Terraform::Examples
     name: 'dialogflowcx_intent_full'
     primary_resource_id: 'basic_intent'
     vars:
       agent_name: 'dialogflowcx-agent'
+  - !ruby/object:Provider::Terraform::Examples
+    skip_docs: true
+    name: 'dialogflowcx_intent_default_negative_intent'
+    primary_resource_id: 'default_negative_intent'
+    vars:
+      agent_name: 'dialogflowcx-agent'
+  - !ruby/object:Provider::Terraform::Examples
+    skip_docs: true
+    name: 'dialogflowcx_intent_default_welcome_intent'
+    primary_resource_id: 'default_welcome_intent'
+    vars:
+      agent_name: 'dialogflowcx-agent'
 skip_sweeper: true
 id_format: '{{parent}}/intents/{{name}}'
 import_format: ['{{parent}}/intents/{{name}}']
@@ -144,7 +173,8 @@ properties:
     description: |
       Indicates whether this is a fallback intent. Currently only default fallback intent is allowed in the agent, which is added upon agent creation.
       Adding training phrases to fallback intent is useful in the case of requests that are mistakenly matched, since training phrases assigned to fallback intents act as negative examples that triggers no-match event.
-  - !ruby/object:Api::Type::KeyValuePairs
+      To manage the fallback intent, set `is_default_negative_intent = true`
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       The key/value metadata to label an intent. Labels can contain lowercase letters, digits and the symbols '-' and '_'. International characters are allowed, including letters from unicase alphabets. Keys must start with a letter. Keys and values can be no longer than 63 characters and no more than 128 bytes.
diff --git a/mmv1/products/dialogflowcx/Page.yaml b/mmv1/products/dialogflowcx/Page.yaml
index 3ce813fad091..8081fc155667 100644
--- a/mmv1/products/dialogflowcx/Page.yaml
+++ b/mmv1/products/dialogflowcx/Page.yaml
@@ -703,6 +703,33 @@ properties:
               description: |
                 Indicates whether the parameter content should be redacted in log.
                 If redaction is enabled, the parameter content will be replaced by parameter name during logging. Note: the parameter content is subject to redaction if either parameter level redaction or entity type level redaction is enabled.
+            - !ruby/object:Api::Type::NestedObject
+              name: 'advancedSettings'
+              description: |
+                Hierarchical advanced settings for this parameter. The settings exposed at the lower level overrides the settings exposed at the higher level.
+                Hierarchy: Agent->Flow->Page->Fulfillment/Parameter.
+              properties:
+                - !ruby/object:Api::Type::NestedObject
+                  name: 'dtmfSettings'
+                  description: |
+                    Define behaviors for DTMF (dual tone multi frequency). DTMF settings does not override each other. DTMF settings set at different levels define DTMF detections running in parallel. Exposed at the following levels:
+                    * Agent level
+                    * Flow level
+                    * Page level
+                    * Parameter level
+                  properties:
+                    - !ruby/object:Api::Type::Boolean
+                      name: 'enabled'
+                      description: |
+                        If true, incoming audio is processed for DTMF (dual tone multi frequency) events. For example, if the caller presses a button on their telephone keypad and DTMF processing is enabled, Dialogflow will detect the event (e.g. a "3" was pressed) in the incoming audio and pass the event to the bot to drive business logic (e.g. when 3 is pressed, return the account balance).
+                    - !ruby/object:Api::Type::Integer
+                      name: 'maxDigits'
+                      description: |
+                        Max length of DTMF digits.
+                    - !ruby/object:Api::Type::String
+                      name: 'finishDigit'
+                      description: |
+                        The digit that terminates a DTMF digit sequence.
   - !ruby/object:Api::Type::Array
     name: 'transitionRouteGroups'
     description: |
@@ -1132,3 +1159,30 @@ properties:
           description: |
             The target flow to transition to.
             Format: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>.
+  - !ruby/object:Api::Type::NestedObject
+    name: 'advancedSettings'
+    description: |
+      Hierarchical advanced settings for this page. The settings exposed at the lower level overrides the settings exposed at the higher level.
+      Hierarchy: Agent->Flow->Page->Fulfillment/Parameter.
+    properties:
+      - !ruby/object:Api::Type::NestedObject
+        name: 'dtmfSettings'
+        description: |
+          Define behaviors for DTMF (dual tone multi frequency). DTMF settings does not override each other. DTMF settings set at different levels define DTMF detections running in parallel. Exposed at the following levels:
+          * Agent level
+          * Flow level
+          * Page level
+          * Parameter level
+        properties:
+          - !ruby/object:Api::Type::Boolean
+            name: 'enabled'
+            description: |
+              If true, incoming audio is processed for DTMF (dual tone multi frequency) events. For example, if the caller presses a button on their telephone keypad and DTMF processing is enabled, Dialogflow will detect the event (e.g. a "3" was pressed) in the incoming audio and pass the event to the bot to drive business logic (e.g. when 3 is pressed, return the account balance).
+          - !ruby/object:Api::Type::Integer
+            name: 'maxDigits'
+            description: |
+              Max length of DTMF digits.
+          - !ruby/object:Api::Type::String
+            name: 'finishDigit'
+            description: |
+              The digit that terminates a DTMF digit sequence.
diff --git a/mmv1/products/dialogflowcx/SecuritySettings.yaml b/mmv1/products/dialogflowcx/SecuritySettings.yaml
new file mode 100644
index 000000000000..1c4103c725d4
--- /dev/null
+++ b/mmv1/products/dialogflowcx/SecuritySettings.yaml
@@ -0,0 +1,162 @@
+# Copyright 2023 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+--- !ruby/object:Api::Resource
+name: 'SecuritySettings'
+base_url: 'projects/{{project}}/locations/{{location}}/securitySettings'
+update_verb: :PATCH
+update_mask: true
+description: |
+  Represents the settings related to security issues, such as data redaction and data retention. It may take hours for updates on the settings to propagate to all the related components and take effect.
+  Multiple security settings can be configured in each location. Each agent can specify the security settings to apply, and each setting can be applied to multiple agents in the same project and location.
+references: !ruby/object:Api::Resource::ReferenceLinks
+  guides:
+    'Official Documentation': 'https://cloud.google.com/dialogflow/cx/docs'
+  api: 'https://cloud.google.com/dialogflow/cx/docs/reference/rest/v3/projects.locations.securitySettings'
+timeouts: !ruby/object:Api::Timeouts
+  insert_minutes: 40
+  update_minutes: 40
+examples:
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'dialogflowcx_security_settings_basic'
+    primary_resource_id: 'basic_security_settings'
+    vars:
+      settings_name: 'dialogflowcx-security-settings'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'dialogflowcx_security_settings_full'
+    primary_resource_id: 'basic_security_settings'
+    vars:
+      inspect_name: 'dialogflowcx-inspect-template'
+      deidentify_name: 'dialogflowcx-deidentify-template'
+      settings_name: 'dialogflowcx-security-settings'
+      bucket_name: 'dialogflowcx-bucket'
+    test_env_vars:
+      project: :PROJECT_NAME
+id_format: 'projects/{{project}}/locations/{{location}}/securitySettings/{{name}}'
+import_format: ['projects/{{project}}/locations/{{location}}/securitySettings/{{name}}']
+properties:
+  - !ruby/object:Api::Type::String
+    name: 'name'
+    output: true
+    description: |
+      The unique identifier of the settings.
+      Format: projects/<Project ID>/locations/<Location ID>/securitySettings/<Security Settings ID>.
+    custom_flatten: templates/terraform/custom_flatten/name_from_self_link.erb
+  - !ruby/object:Api::Type::String
+    name: 'location'
+    description: |
+      The location these settings are located in. Settings can only be applied to an agent in the same location.
+      See [Available Regions](https://cloud.google.com/dialogflow/cx/docs/concept/region#avail) for a list of supported locations.
+    required: true
+    immutable: true
+    url_param_only: true
+  - !ruby/object:Api::Type::String
+    name: 'displayName'
+    description: |
+      The human-readable name of the security settings, unique within the location.
+    required: true
+  - !ruby/object:Api::Type::Enum
+    name: 'redactionStrategy'
+    description: |
+      Defines how we redact data. If not set, defaults to not redacting.
+      * REDACT_WITH_SERVICE: Call redaction service to clean up the data to be persisted.
+    values:
+      - :REDACT_WITH_SERVICE
+  - !ruby/object:Api::Type::Enum
+    name: 'redactionScope'
+    description: |
+      Defines what types of data to redact. If not set, defaults to not redacting any kind of data.
+      * REDACT_DISK_STORAGE: On data to be written to disk or similar devices that are capable of holding data even if power is disconnected. This includes data that are temporarily saved on disk.
+    values:
+      - :REDACT_DISK_STORAGE
+  - !ruby/object:Api::Type::String
+    name: 'inspectTemplate'
+    description: |
+      [DLP](https://cloud.google.com/dlp/docs) inspect template name. Use this template to define inspect base settings. If empty, we use the default DLP inspect config.
+      Note: inspectTemplate must be located in the same region as the SecuritySettings.
+      Format: projects/<Project ID>/locations/<Location ID>/inspectTemplates/<Template ID> OR organizations/<Organization ID>/locations/<Location ID>/inspectTemplates/<Template ID>
+  - !ruby/object:Api::Type::String
+    name: 'deidentifyTemplate'
+    description: |
+      [DLP](https://cloud.google.com/dlp/docs) deidentify template name. Use this template to define de-identification configuration for the content. If empty, Dialogflow replaces sensitive info with [redacted] text.
+      Note: deidentifyTemplate must be located in the same region as the SecuritySettings.
+      Format: projects/<Project ID>/locations/<Location ID>/deidentifyTemplates/<Template ID> OR organizations/<Organization ID>/locations/<Location ID>/deidentifyTemplates/<Template ID>
+  - !ruby/object:Api::Type::Array
+    name: 'purgeDataTypes'
+    description: |
+      List of types of data to remove when retention settings triggers purge.
+    item_type: !ruby/object:Api::Type::Enum
+      name: 'purgeDataType'
+      description: |
+        Type of data we purge after retention settings triggers purge.
+        * DIALOGFLOW_HISTORY: Dialogflow history. This does not include Cloud logging, which is owned by the user - not Dialogflow.
+      values:
+        - :DIALOGFLOW_HISTORY
+  - !ruby/object:Api::Type::NestedObject
+    name: 'audioExportSettings'
+    description: |
+      Controls audio export settings for post-conversation analytics when ingesting audio to conversations.
+      If retention_strategy is set to REMOVE_AFTER_CONVERSATION or gcs_bucket is empty, audio export is disabled.
+      If audio export is enabled, audio is recorded and saved to gcs_bucket, subject to retention policy of gcs_bucket.
+      This setting won't effect audio input for implicit sessions via [Sessions.DetectIntent](https://cloud.google.com/dialogflow/cx/docs/reference/rest/v3/projects.locations.agents.sessions/detectIntent#google.cloud.dialogflow.cx.v3.Sessions.DetectIntent).
+    properties:
+      - !ruby/object:Api::Type::String
+        name: 'gcsBucket'
+        description: |
+          Cloud Storage bucket to export audio record to. Setting this field would grant the Storage Object Creator role to the Dialogflow Service Agent. API caller that tries to modify this field should have the permission of storage.buckets.setIamPolicy.
+      - !ruby/object:Api::Type::String
+        name: 'audioExportPattern'
+        description: |
+          Filename pattern for exported audio.
+      - !ruby/object:Api::Type::Boolean
+        name: 'enableAudioRedaction'
+        description: |
+          Enable audio redaction if it is true.
+      - !ruby/object:Api::Type::Enum
+        name: 'audioFormat'
+        description: |
+          File format for exported audio file. Currently only in telephony recordings.
+          * MULAW: G.711 mu-law PCM with 8kHz sample rate.
+          * MP3: MP3 file format.
+          * OGG: OGG Vorbis.
+        values:
+          - :MULAW
+          - :MP3
+          - :OGG
+  - !ruby/object:Api::Type::NestedObject
+    name: 'insightsExportSettings'
+    description: |
+      Controls conversation exporting settings to Insights after conversation is completed.
+      If retentionStrategy is set to REMOVE_AFTER_CONVERSATION, Insights export is disabled no matter what you configure here.
+    properties:
+      - !ruby/object:Api::Type::Boolean
+        name: 'enableInsightsExport'
+        description: |
+          If enabled, we will automatically exports conversations to Insights and Insights runs its analyzers.
+        required: true
+  - !ruby/object:Api::Type::Integer
+    name: 'retentionWindowDays'
+    conflicts:
+      - retentionStrategy
+    description: |
+      Retains the data for the specified number of days. User must set a value lower than Dialogflow's default 365d TTL (30 days for Agent Assist traffic), higher value will be ignored and use default. Setting a value higher than that has no effect. A missing value or setting to 0 also means we use default TTL.
+      Only one of `retention_window_days` and `retention_strategy` may be set.
+  - !ruby/object:Api::Type::Enum
+    name: 'retentionStrategy'
+    conflicts:
+      - retentionWindowDays
+    description: |
+      Defines how long we retain persisted data that contains sensitive info. Only one of `retention_window_days` and `retention_strategy` may be set.
+      * REMOVE_AFTER_CONVERSATION: Removes data when the conversation ends. If there is no conversation explicitly established, a default conversation ends when the corresponding Dialogflow session ends.
+    values:
+      - :REMOVE_AFTER_CONVERSATION
diff --git a/mmv1/products/dialogflowcx/TestCase.yaml b/mmv1/products/dialogflowcx/TestCase.yaml
new file mode 100644
index 000000000000..e6b02c24d167
--- /dev/null
+++ b/mmv1/products/dialogflowcx/TestCase.yaml
@@ -0,0 +1,451 @@
+# Copyright 2023 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+--- !ruby/object:Api::Resource
+name: 'TestCase'
+base_url: '{{parent}}/testCases'
+update_verb: :PATCH
+update_mask: true
+description: |
+  You can use the built-in test feature to uncover bugs and prevent regressions. A test execution verifies that agent responses have not changed for end-user inputs defined in the test case.
+references: !ruby/object:Api::Resource::ReferenceLinks
+  guides:
+    'Official Documentation': 'https://cloud.google.com/dialogflow/cx/docs'
+  api: 'https://cloud.google.com/dialogflow/cx/docs/reference/rest/v3/projects.locations.agents.testCases'
+timeouts: !ruby/object:Api::Timeouts
+  insert_minutes: 40
+  update_minutes: 40
+custom_code: !ruby/object:Provider::Terraform::CustomCode
+  pre_create: templates/terraform/pre_create/dialogflow_set_location.go.erb
+  pre_update: templates/terraform/pre_create/dialogflow_set_location.go.erb
+  pre_delete: templates/terraform/pre_create/dialogflow_set_location.go.erb
+  pre_read: templates/terraform/pre_create/dialogflow_set_location.go.erb
+examples:
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'dialogflowcx_test_case_full'
+    primary_resource_id: 'basic_test_case'
+    vars:
+      agent_name: 'dialogflowcx-agent'
+skip_sweeper: true
+id_format: '{{parent}}/testCases/{{name}}'
+import_format: ['{{%parent}}/testCases/{{name}}']
+parameters:
+  - !ruby/object:Api::Type::String
+    name: parent
+    url_param_only: true
+    immutable: true
+    description: |
+      The agent to create the test case for.
+      Format: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>.
+properties:
+  - !ruby/object:Api::Type::String
+    name: 'name'
+    output: true
+    description: |
+      The unique identifier of the test case.
+      Format: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/testCases/<TestCase ID>.
+    custom_flatten: templates/terraform/custom_flatten/name_from_self_link.erb
+  - !ruby/object:Api::Type::Array
+    name: 'tags'
+    description: |
+      Tags are short descriptions that users may apply to test cases for organizational and filtering purposes.
+      Each tag should start with "#" and has a limit of 30 characters
+    item_type: Api::Type::String
+  - !ruby/object:Api::Type::String
+    name: 'displayName'
+    required: true
+    description: |
+      The human-readable name of the test case, unique within the agent. Limit of 200 characters.
+    validation: !ruby/object:Provider::Terraform::Validation
+      function: 'validation.StringLenBetween(0, 200)'
+  - !ruby/object:Api::Type::String
+    name: 'notes'
+    description: |
+      Additional freeform notes about the test case. Limit of 400 characters.
+    validation: !ruby/object:Provider::Terraform::Validation
+      function: 'validation.StringLenBetween(0, 400)'
+  - !ruby/object:Api::Type::NestedObject
+    name: 'testConfig'
+    description: |
+      Config for the test case.
+    properties:
+      - !ruby/object:Api::Type::Array
+        name: 'trackingParameters'
+        description: |
+          Session parameters to be compared when calculating differences.
+        item_type: Api::Type::String
+      - !ruby/object:Api::Type::String
+        name: 'flow'
+        description: |
+          Flow name to start the test case with.
+          Format: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>.
+          Only one of flow and page should be set to indicate the starting point of the test case. If neither is set, the test case will start with start page on the default start flow.
+        conflicts:
+          - test_config.0.page
+      - !ruby/object:Api::Type::String
+        name: 'page'
+        description: |
+          The page to start the test case with.
+          Format: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>/pages/<Page ID>.
+          Only one of flow and page should be set to indicate the starting point of the test case. If neither is set, the test case will start with start page on the default start flow.
+        conflicts:
+          - test_config.0.flow
+  - !ruby/object:Api::Type::Array
+    name: 'testCaseConversationTurns'
+    description: |
+      The conversation turns uttered when the test case was created, in chronological order. These include the canonical set of agent utterances that should occur when the agent is working properly.
+    item_type: !ruby/object:Api::Type::NestedObject
+      properties:
+        - !ruby/object:Api::Type::NestedObject
+          name: 'userInput'
+          description: |
+            The user input.
+          properties:
+            - !ruby/object:Api::Type::NestedObject
+              name: 'input'
+              description: |
+                User input. Supports text input, event input, dtmf input in the test case.
+              properties:
+                # Does not support intent or audio as of this writing. https://cloud.google.com/dialogflow/cx/docs/reference/rest/v3/ConversationTurn#userinput
+                - !ruby/object:Api::Type::String
+                  name: 'languageCode'
+                  description: |
+                    The language of the input. See [Language Support](https://cloud.google.com/dialogflow/cx/docs/reference/language) for a list of the currently supported language codes.
+                    Note that queries in the same session do not necessarily need to specify the same language.
+                - !ruby/object:Api::Type::NestedObject
+                  name: 'text'
+                  description: |
+                    The natural language text to be processed.
+                  properties:
+                    - !ruby/object:Api::Type::String
+                      name: 'text'
+                      required: true
+                      description: |
+                        The natural language text to be processed. Text length must not exceed 256 characters.
+                      validation: !ruby/object:Provider::Terraform::Validation
+                        function: 'validation.StringLenBetween(0, 256)'
+                - !ruby/object:Api::Type::NestedObject
+                  name: 'event'
+                  description: |
+                    The event to be triggered.
+                  properties:
+                    - !ruby/object:Api::Type::String
+                      name: 'event'
+                      required: true
+                      description: |
+                        Name of the event.
+                - !ruby/object:Api::Type::NestedObject
+                  name: 'dtmf'
+                  description: |
+                    The DTMF event to be handled.
+                  properties:
+                    - !ruby/object:Api::Type::String
+                      name: 'digits'
+                      description: |
+                        The dtmf digits.
+                    - !ruby/object:Api::Type::String
+                      name: 'finishDigit'
+                      description: |
+                        The finish digit (if any).
+            # This can be an arbitrary json blob, so we use a string instead of a NestedObject.
+            - !ruby/object:Api::Type::String
+              name: 'injectedParameters'
+              description: |
+                Parameters that need to be injected into the conversation during intent detection.
+              custom_expand: 'templates/terraform/custom_expand/json_schema.erb'
+              custom_flatten: 'templates/terraform/custom_flatten/json_schema.erb'
+              state_func:
+                'func(v interface{}) string { s, _ := structure.NormalizeJsonString(v);
+                return s }'
+              validation: !ruby/object:Provider::Terraform::Validation
+                function: 'validation.StringIsJSON'
+            - !ruby/object:Api::Type::Boolean
+              name: 'isWebhookEnabled'
+              description: |
+                If webhooks should be allowed to trigger in response to the user utterance. Often if parameters are injected, webhooks should not be enabled.
+            - !ruby/object:Api::Type::Boolean
+              name: 'enableSentimentAnalysis'
+              description: |
+                Whether sentiment analysis is enabled.
+        - !ruby/object:Api::Type::NestedObject
+          name: 'virtualAgentOutput'
+          description: |
+            The virtual agent output.
+          properties:
+            # This can be an arbitrary json blob, so we use a string instead of a NestedObject.
+            - !ruby/object:Api::Type::String
+              name: 'sessionParameters'
+              description: |
+                The session parameters available to the bot at this point.
+              custom_expand: 'templates/terraform/custom_expand/json_schema.erb'
+              custom_flatten: 'templates/terraform/custom_flatten/json_schema.erb'
+              state_func:
+                'func(v interface{}) string { s, _ := structure.NormalizeJsonString(v);
+                return s }'
+              validation: !ruby/object:Provider::Terraform::Validation
+                function: 'validation.StringIsJSON'
+            - !ruby/object:Api::Type::NestedObject
+              name: 'triggeredIntent'
+              description: |
+                The [Intent](https://cloud.google.com/dialogflow/cx/docs/reference/rest/v3/projects.locations.agents.intents#Intent) that triggered the response.
+              properties:
+                - !ruby/object:Api::Type::String
+                  name: 'name'
+                  description: |
+                    The unique identifier of the intent.
+                    Format: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/intents/<Intent ID>.
+                - !ruby/object:Api::Type::String
+                  name: 'displayName'
+                  # Output only because you can't set it independently of name; if they don't match, displayName is ignored and may lead to spurious changes
+                  output: true
+                  description: |
+                    The human-readable name of the intent, unique within the agent.
+            - !ruby/object:Api::Type::NestedObject
+              name: 'currentPage'
+              description: |
+                The [Page](https://cloud.google.com/dialogflow/cx/docs/reference/rest/v3/projects.locations.agents.flows.pages#Page) on which the utterance was spoken.
+              properties:
+                - !ruby/object:Api::Type::String
+                  name: 'name'
+                  description: |
+                    The unique identifier of the page.
+                    Format: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>/pages/<Page ID>.
+                - !ruby/object:Api::Type::String
+                  name: 'displayName'
+                  # Output only because you can't set it independently of name; if they don't match, displayName is ignored and may lead to spurious changes
+                  output: true
+                  description: |
+                    The human-readable name of the page, unique within the flow.
+            - !ruby/object:Api::Type::Array
+              name: 'textResponses'
+              description: |
+                The text responses from the agent for the turn.
+              item_type: !ruby/object:Api::Type::NestedObject
+                properties:
+                  - !ruby/object:Api::Type::Array
+                    name: 'text'
+                    description: |
+                      A collection of text responses.
+                    item_type: Api::Type::String
+  - !ruby/object:Api::Type::Time
+    name: 'creationTime'
+    description: 'When the test was created. A timestamp in RFC3339 text format.'
+    output: true
+  - !ruby/object:Api::Type::NestedObject
+    name: 'lastTestResult'
+    description: |
+      The latest test result.
+    output: true
+    properties:
+      - !ruby/object:Api::Type::String
+        name: 'name'
+        description: |
+          The resource name for the test case result.
+          Format: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/testCases/<TestCase ID>/results/<TestCaseResult ID>.
+      - !ruby/object:Api::Type::String
+        name: 'environment'
+        description: |
+          Environment where the test was run. If not set, it indicates the draft environment.
+      - !ruby/object:Api::Type::Array
+        name: 'conversationTurns'
+        description: |
+          The conversation turns uttered during the test case replay in chronological order.
+        item_type: !ruby/object:Api::Type::NestedObject
+          properties:
+            - !ruby/object:Api::Type::NestedObject
+              name: 'userInput'
+              description: |
+                The user input.
+              properties:
+                - !ruby/object:Api::Type::NestedObject
+                  name: 'input'
+                  description: |
+                    User input. Supports text input, event input, dtmf input in the test case.
+                  properties:
+                    - !ruby/object:Api::Type::String
+                      name: 'languageCode'
+                      description: |
+                        The language of the input. See [Language Support](https://cloud.google.com/dialogflow/cx/docs/reference/language) for a list of the currently supported language codes.
+                        Note that queries in the same session do not necessarily need to specify the same language.
+                    - !ruby/object:Api::Type::NestedObject
+                      name: 'text'
+                      description: |
+                        The natural language text to be processed.
+                      properties:
+                        - !ruby/object:Api::Type::String
+                          name: 'text'
+                          required: true
+                          description: |
+                            The natural language text to be processed. Text length must not exceed 256 characters.
+                          validation: !ruby/object:Provider::Terraform::Validation
+                            function: 'validation.StringLenBetween(0, 256)'
+                    - !ruby/object:Api::Type::NestedObject
+                      name: 'event'
+                      description: |
+                        The event to be triggered.
+                      properties:
+                        - !ruby/object:Api::Type::String
+                          name: 'event'
+                          required: true
+                          description: |
+                            Name of the event.
+                    - !ruby/object:Api::Type::NestedObject
+                      name: 'dtmf'
+                      description: |
+                        The DTMF event to be handled.
+                      properties:
+                        - !ruby/object:Api::Type::String
+                          name: 'digits'
+                          description: |
+                            The dtmf digits.
+                        - !ruby/object:Api::Type::String
+                          name: 'finishDigit'
+                          description: |
+                            The finish digit (if any).
+                # This can be an arbitrary json blob, so we use a string instead of a NestedObject.
+                - !ruby/object:Api::Type::String
+                  name: 'injectedParameters'
+                  description: |
+                    Parameters that need to be injected into the conversation during intent detection.
+                  custom_expand: 'templates/terraform/custom_expand/json_schema.erb'
+                  custom_flatten: 'templates/terraform/custom_flatten/json_schema.erb'
+                  state_func:
+                    'func(v interface{}) string { s, _ := structure.NormalizeJsonString(v);
+                    return s }'
+                  validation: !ruby/object:Provider::Terraform::Validation
+                    function: 'validation.StringIsJSON'
+                - !ruby/object:Api::Type::Boolean
+                  name: 'isWebhookEnabled'
+                  description: |
+                    If webhooks should be allowed to trigger in response to the user utterance. Often if parameters are injected, webhooks should not be enabled.
+                - !ruby/object:Api::Type::Boolean
+                  name: 'enableSentimentAnalysis'
+                  description: |
+                    Whether sentiment analysis is enabled.
+            - !ruby/object:Api::Type::NestedObject
+              name: 'virtualAgentOutput'
+              description: |
+                The virtual agent output.
+              properties:
+                # This can be an arbitrary json blob, so we use a string instead of a NestedObject.
+                - !ruby/object:Api::Type::String
+                  name: 'sessionParameters'
+                  description: |
+                    The session parameters available to the bot at this point.
+                  custom_expand: 'templates/terraform/custom_expand/json_schema.erb'
+                  custom_flatten: 'templates/terraform/custom_flatten/json_schema.erb'
+                  state_func:
+                    'func(v interface{}) string { s, _ := structure.NormalizeJsonString(v);
+                    return s }'
+                  validation: !ruby/object:Provider::Terraform::Validation
+                    function: 'validation.StringIsJSON'
+                - !ruby/object:Api::Type::Array
+                  name: 'differences'
+                  description: |
+                    The list of differences between the original run and the replay for this output, if any.
+                  item_type: !ruby/object:Api::Type::NestedObject
+                    properties:
+                      - !ruby/object:Api::Type::Enum
+                        name: 'type'
+                        description: |
+                          The type of diff.
+                          * INTENT: The intent.
+                          * PAGE: The page.
+                          * PARAMETERS: The parameters.
+                          * UTTERANCE: The message utterance.
+                          * FLOW: The flow.
+                        values:
+                          - :INTENT
+                          - :PAGE
+                          - :PARAMETERS
+                          - :UTTERANCE
+                          - :FLOW
+                      - !ruby/object:Api::Type::String
+                        name: 'description'
+                        description: |
+                          A human readable description of the diff, showing the actual output vs expected output.
+                - !ruby/object:Api::Type::NestedObject
+                  name: 'triggeredIntent'
+                  description: |
+                    The [Intent](https://cloud.google.com/dialogflow/cx/docs/reference/rest/v3/projects.locations.agents.intents#Intent) that triggered the response.
+                  properties:
+                    - !ruby/object:Api::Type::String
+                      name: 'name'
+                      description: |
+                        The unique identifier of the intent.
+                        Format: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/intents/<Intent ID>.
+                    - !ruby/object:Api::Type::String
+                      name: 'displayName'
+                      description: |
+                        The human-readable name of the intent, unique within the agent.
+                - !ruby/object:Api::Type::NestedObject
+                  name: 'currentPage'
+                  description: |
+                    The [Page](https://cloud.google.com/dialogflow/cx/docs/reference/rest/v3/projects.locations.agents.flows.pages#Page) on which the utterance was spoken.
+                  properties:
+                    - !ruby/object:Api::Type::String
+                      name: 'name'
+                      description: |
+                        The unique identifier of the page.
+                        Format: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>/pages/<Page ID>.
+                    - !ruby/object:Api::Type::String
+                      name: 'displayName'
+                      description: |
+                        The human-readable name of the page, unique within the flow.
+                - !ruby/object:Api::Type::Array
+                  name: 'textResponses'
+                  description: |
+                    The text responses from the agent for the turn.
+                  item_type: !ruby/object:Api::Type::NestedObject
+                    properties:
+                      - !ruby/object:Api::Type::Array
+                        name: 'text'
+                        description: |
+                          A collection of text responses.
+                        item_type: Api::Type::String
+                - !ruby/object:Api::Type::NestedObject
+                  name: 'status'
+                  description: |
+                    Response error from the agent in the test result. If set, other output is empty.
+                  properties:
+                    - !ruby/object:Api::Type::Integer
+                      name: 'code'
+                      description: |
+                        The status code, which should be an enum value of google.rpc.Code.
+                    - !ruby/object:Api::Type::String
+                      name: 'message'
+                      description: |
+                        A developer-facing error message.
+                    - !ruby/object:Api::Type::String
+                      name: 'details'
+                      description: |
+                        A JSON encoded list of messages that carry the error details.
+                      custom_expand: 'templates/terraform/custom_expand/json_value.erb'
+                      custom_flatten: 'templates/terraform/custom_flatten/json_schema.erb'
+                      state_func:
+                        'func(v interface{}) string { s, _ := structure.NormalizeJsonString(v);
+                        return s }'
+                      validation: !ruby/object:Provider::Terraform::Validation
+                        function: 'validation.StringIsJSON'
+      - !ruby/object:Api::Type::Enum
+        name: 'testResult'
+        description: |
+          Whether the test case passed in the agent environment.
+          * PASSED: The test passed.
+          * FAILED: The test did not pass.
+        values:
+          - :PASSED
+          - :FAILED
+      - !ruby/object:Api::Type::Time
+        name: 'testTime'
+        description: 'The time that the test was run. A timestamp in RFC3339 text format.'
diff --git a/mmv1/products/dialogflowcx/Version.yaml b/mmv1/products/dialogflowcx/Version.yaml
index 001f3608cf0b..612d7ff6b012 100644
--- a/mmv1/products/dialogflowcx/Version.yaml
+++ b/mmv1/products/dialogflowcx/Version.yaml
@@ -24,14 +24,13 @@ references: !ruby/object:Api::Resource::ReferenceLinks
     'Official Documentation': 'https://cloud.google.com/dialogflow/cx/docs'
   api: 'https://cloud.google.com/dialogflow/cx/docs/reference/rest/v3/projects.locations.agents.flows.versions'
 async: !ruby/object:Api::OpAsync
+  actions: ['create']
   operation: !ruby/object:Api::OpAsync::Operation
     path: 'name'
-    full_url: 'https://dialogflow.googleapis.com/v3/{{op_id}}'
+    full_url: 'https://{{location}}-dialogflow.googleapis.com/v3/{{op_id}}'
     wait_ms: 1000
     timeouts: !ruby/object:Api::Timeouts
       insert_minutes: 60
-      update_minutes: 60
-      delete_minutes: 60
   result: !ruby/object:Api::OpAsync::Result
     path: 'response'
     resource_inside_response: true
@@ -44,7 +43,6 @@ async: !ruby/object:Api::OpAsync
   error: !ruby/object:Api::OpAsync::Error
     path: 'error'
     message: 'message'
-exclude_resource: true
 timeouts: !ruby/object:Api::Timeouts
   insert_minutes: 40
   update_minutes: 40
@@ -54,12 +52,20 @@ custom_code: !ruby/object:Provider::Terraform::CustomCode
   pre_update: templates/terraform/pre_create/dialogflow_set_location.go.erb
   pre_delete: templates/terraform/pre_create/dialogflow_set_location.go.erb
   pre_read: templates/terraform/pre_create/dialogflow_set_location.go.erb
+custom_diff:
+  - 'tpgresource.DefaultProviderProject'
 examples:
   - !ruby/object:Provider::Terraform::Examples
     name: 'dialogflowcx_version_full'
     primary_resource_id: 'version_1'
     vars:
       agent_name: 'dialogflowcx-agent'
+  - !ruby/object:Provider::Terraform::Examples
+    skip_docs: true
+    name: 'dialogflowcx_version_regional'
+    primary_resource_id: 'version_1'
+    vars:
+      agent_name: 'issue-12880'
 skip_sweeper: true
 id_format: '{{parent}}/versions/{{name}}'
 import_format: ['{{parent}}/versions/{{name}}']
diff --git a/mmv1/products/dns/ManagedZone.yaml b/mmv1/products/dns/ManagedZone.yaml
index 62565124dfad..8da5d6285514 100644
--- a/mmv1/products/dns/ManagedZone.yaml
+++ b/mmv1/products/dns/ManagedZone.yaml
@@ -47,6 +47,9 @@ examples:
       dns_compute_instance: 'dns-compute-instance'
       allow_http_traffic: 'allow-http-traffic'
       example_zone_googlecloudexample: 'example-zone-googlecloudexample'
+      dns_name: "googlecloudexample.net."
+    test_vars_overrides:
+      dns_name: '"mz.gcp.tfacc.hashicorptest.com."'
     ignore_read_extra:
       - 'force_destroy'
   - !ruby/object:Provider::Terraform::Examples
@@ -97,6 +100,11 @@ examples:
       zone_name: 'private-zone'
       network_1_name: 'network-1'
       cluster_1_name: 'cluster-1'
+      deletion_protection: 'true'
+    test_vars_overrides:
+      deletion_protection: 'false'
+    oics_vars_overrides:
+      deletion_protection: 'false'
   - !ruby/object:Provider::Terraform::Examples
     name: 'dns_managed_zone_private_peering'
     primary_resource_id: 'peering-zone'
@@ -247,7 +255,7 @@ properties:
       The time that this resource was created on the server.
       This is in RFC3339 text format.
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       A set of key/value label pairs to assign to this ManagedZone.
diff --git a/mmv1/products/dns/ResponsePolicy.yaml b/mmv1/products/dns/ResponsePolicy.yaml
index cf2d2a7681fb..9f14ffdd65e3 100644
--- a/mmv1/products/dns/ResponsePolicy.yaml
+++ b/mmv1/products/dns/ResponsePolicy.yaml
@@ -31,6 +31,11 @@ examples:
       network_1_name: 'network-1'
       network_2_name: 'network-2'
       cluster_1_name: 'cluster-1'
+      deletion_protection: 'true'
+    test_vars_overrides:
+      deletion_protection: 'false'
+    oics_vars_overrides:
+      deletion_protection: 'false'
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   pre_delete: templates/terraform/pre_delete/response_policy_detach_network_gke.erb
 properties:
diff --git a/mmv1/products/edgecontainer/Cluster.yaml b/mmv1/products/edgecontainer/Cluster.yaml
new file mode 100644
index 000000000000..ae7cfb0fd3dd
--- /dev/null
+++ b/mmv1/products/edgecontainer/Cluster.yaml
@@ -0,0 +1,492 @@
+# Copyright 2023 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+--- !ruby/object:Api::Resource
+name: 'Cluster'
+description: |
+  Cluster contains information about a Google Distributed Cloud Edge Kubernetes cluster.
+references: !ruby/object:Api::Resource::ReferenceLinks
+  guides:
+    'Create and manage clusters': 'https://cloud.google.com/distributed-cloud/edge/latest/docs/clusters'
+  api: 'https://cloud.google.com/distributed-cloud/edge/latest/docs/reference/container/rest/v1/projects.locations.clusters'
+base_url: 'projects/{{project}}/locations/{{location}}/clusters'
+self_link: 'projects/{{project}}/locations/{{location}}/clusters/{{name}}'
+create_url: 'projects/{{project}}/locations/{{location}}/clusters?cluster_id={{name}}'
+update_url: 'projects/{{project}}/locations/{{location}}/clusters/{{name}}'
+update_verb: :PATCH
+update_mask: true
+autogen_async: true
+async: !ruby/object:Api::OpAsync
+  operation: !ruby/object:Api::OpAsync::Operation
+    path: 'name'
+    base_url: '{{op_id}}'
+    wait_ms: 1000
+    timeouts: !ruby/object:Api::Timeouts
+      insert_minutes: 60
+      update_minutes: 60
+      delete_minutes: 60
+  result: !ruby/object:Api::OpAsync::Result
+    path: 'response'
+  status: !ruby/object:Api::OpAsync::Status
+    path: 'done'
+    complete: true
+    allowed:
+      - true
+      - false
+  error: !ruby/object:Api::OpAsync::Error
+    path: 'error'
+    message: 'message'
+
+parameters:
+  - !ruby/object:Api::Type::String
+    name: 'location'
+    required: true
+    immutable: true
+    url_param_only: true
+    description: |
+      The location of the resource.
+  - !ruby/object:Api::Type::String
+    name: 'name'
+    required: true
+    immutable: true
+    url_param_only: true
+    description: |
+      The GDCE cluster name.
+import_format: ["projects/{{project}}/locations/{{location}}/clusters/{{name}}"]
+examples:
+  - !ruby/object:Provider::Terraform::Examples
+    name: "edgecontainer_cluster"
+    primary_resource_id: "default"
+    vars:
+      edgecontainer_cluster_name: "basic-cluster"
+  - !ruby/object:Provider::Terraform::Examples
+    name: "edgecontainer_cluster_with_maintenance_window"
+    primary_resource_id: "default"
+    vars:
+      edgecontainer_cluster_name: "cluster-with-maintenance"
+  # Skip the local control plane cluster test as we only have limited machine resources.
+  # Instead the local control plane cluster test will be tested in the node pool test.
+  - !ruby/object:Provider::Terraform::Examples
+    name: "edgecontainer_local_control_plane_cluster"
+    primary_resource_id: "default"
+    skip_test: true
+    vars:
+      edgecontainer_cluster_name: "local-control-plane-cluster"
+properties:
+  - !ruby/object:Api::Type::Time
+    name: "createTime"
+    description: |
+      The time the cluster was created, in RFC3339 text format.
+    output: true
+  - !ruby/object:Api::Type::Time
+    name: "updateTime"
+    description: |
+      The time the cluster was last updated, in RFC3339 text format.
+    output: true
+  - !ruby/object:Api::Type::KeyValueLabels
+    name: "labels"
+    description: "User-defined labels for the edgecloud cluster."
+  - !ruby/object:Api::Type::NestedObject
+    name: "fleet"
+    required: true
+    immutable: true
+    description: |
+      Fleet related configuration.
+      Fleets are a Google Cloud concept for logically organizing clusters,
+      letting you use and manage multi-cluster capabilities and apply
+      consistent policies across your systems.
+    properties:
+      - !ruby/object:Api::Type::String
+        name: "project"
+        immutable: true
+        description: |
+          The name of the Fleet host project where this cluster will be registered.
+          Project names are formatted as
+          `projects/<project-number>`.
+        required: true
+      - !ruby/object:Api::Type::String
+        name: "membership"
+        output: true
+        description: |
+          The name of the managed Hub Membership resource associated to this cluster.
+          Membership names are formatted as
+          `projects/<project-number>/locations/global/membership/<cluster-id>`.
+  - !ruby/object:Api::Type::NestedObject
+    name: "networking"
+    required: true
+    description: |
+      Fleet related configuration.
+      Fleets are a Google Cloud concept for logically organizing clusters,
+      letting you use and manage multi-cluster capabilities and apply
+      consistent policies across your systems.
+    properties:
+      - !ruby/object:Api::Type::Array
+        name: "clusterIpv4CidrBlocks"
+        item_type: Api::Type::String
+        immutable: true
+        required: true
+        description: |
+          All pods in the cluster are assigned an RFC1918 IPv4 address from these
+          blocks. Only a single block is supported. This field cannot be changed
+          after creation.
+      - !ruby/object:Api::Type::Array
+        name: "servicesIpv4CidrBlocks"
+        item_type: Api::Type::String
+        immutable: true
+        required: true
+        description: |
+          All services in the cluster are assigned an RFC1918 IPv4 address from these
+          blocks. Only a single block is supported. This field cannot be changed
+          after creation.
+      - !ruby/object:Api::Type::Array
+        name: "clusterIpv6CidrBlocks"
+        item_type: Api::Type::String
+        immutable: true
+        description: |
+          If specified, dual stack mode is enabled and all pods in the cluster are
+          assigned an IPv6 address from these blocks alongside from an IPv4
+          address. Only a single block is supported. This field cannot be changed
+          after creation.
+      - !ruby/object:Api::Type::Array
+        name: "servicesIpv6CidrBlocks"
+        item_type: Api::Type::String
+        immutable: true
+        description: |
+          If specified, dual stack mode is enabled and all services in the cluster are
+          assigned an IPv6 address from these blocks alongside from an IPv4
+          address. Only a single block is supported. This field cannot be changed
+          after creation.
+      - !ruby/object:Api::Type::String
+        name: "networkType"
+        output: true
+        description: |
+          IP addressing type of this cluster i.e. SINGLESTACK_V4 vs DUALSTACK_V4_V6.
+  - !ruby/object:Api::Type::NestedObject
+    name: "authorization"
+    required: true
+    immutable: true
+    description: |
+      RBAC policy that will be applied and managed by GEC.
+    properties:
+      - !ruby/object:Api::Type::NestedObject
+        name: "adminUsers"
+        required: true
+        description: |
+          User that will be granted the cluster-admin role on the cluster, providing
+          full access to the cluster. Currently, this is a singular field, but will
+          be expanded to allow multiple admins in the future.
+        properties:
+          - !ruby/object:Api::Type::String
+            name: "username"
+            description: |
+              An active Google username.
+            required: true
+  - !ruby/object:Api::Type::Integer
+    name: "defaultMaxPodsPerNode"
+    default_from_api: true
+    description: |
+      The default maximum number of pods per node used if a maximum value is not
+      specified explicitly for a node pool in this cluster. If unspecified, the
+      Kubernetes default value will be used.
+  - !ruby/object:Api::Type::String
+    name: "endpoint"
+    description: |
+      The IP address of the Kubernetes API server.
+    output: true
+  - !ruby/object:Api::Type::Integer
+    name: "port"
+    description: |
+      The port number of the Kubernetes API server.
+    output: true
+  - !ruby/object:Api::Type::String
+    name: "clusterCaCertificate"
+    description: |
+      The PEM-encoded public certificate of the cluster's CA.
+    output: true
+    sensitive: true
+  - !ruby/object:Api::Type::NestedObject
+    name: "maintenancePolicy"
+    description: |
+      Cluster-wide maintenance policy configuration.
+    default_from_api: true
+    properties:
+      - !ruby/object:Api::Type::NestedObject
+        name: "window"
+        required: true
+        description: |
+          Specifies the maintenance window in which maintenance may be performed.
+        properties:
+          - !ruby/object:Api::Type::NestedObject
+            name: "recurringWindow"
+            required: true
+            description: |
+              Represents an arbitrary window of time that recurs.
+            properties:
+              - !ruby/object:Api::Type::NestedObject
+                name: "window"
+                default_from_api: true
+                description: |
+                  Represents an arbitrary window of time.
+                properties:
+                  - !ruby/object:Api::Type::Time
+                    name: "startTime"
+                    description: |
+                      The time that the window first starts.
+                    default_from_api: true
+                  - !ruby/object:Api::Type::Time
+                    name: "endTime"
+                    description: |
+                      The time that the window ends. The end time must take place after the
+                      start time.
+                    default_from_api: true
+              - !ruby/object:Api::Type::String
+                name: "recurrence"
+                default_from_api: true
+                description: |
+                  An RRULE (https://tools.ietf.org/html/rfc5545#section-3.8.5.3) for how
+                  this window recurs. They go on for the span of time between the start and
+                  end time.
+  - !ruby/object:Api::Type::String
+    name: "controlPlaneVersion"
+    description: |
+      The control plane release version.
+    output: true
+  - !ruby/object:Api::Type::String
+    name: "nodeVersion"
+    description: |
+      The lowest release version among all worker nodes. This field can be empty
+      if the cluster does not have any worker nodes.
+    output: true
+  - !ruby/object:Api::Type::NestedObject
+    name: "controlPlane"
+    description: |
+      The configuration of the cluster control plane.
+    properties:
+      - !ruby/object:Api::Type::NestedObject
+        name: "remote"
+        immutable: true
+        exactly_one_of:
+          - control_plane.0.remote
+          - control_plane.0.local
+        description: |
+          Remote control plane configuration.
+        default_from_api: true
+        properties:
+          - !ruby/object:Api::Type::String
+            name: "nodeLocation"
+            immutable: true
+            default_from_api: true
+            description: |
+              Name of the Google Distributed Cloud Edge zones where this node pool
+              will be created. For example: `us-central1-edge-customer-a`.
+      - !ruby/object:Api::Type::NestedObject
+        name: "local"
+        immutable: true
+        exactly_one_of:
+          - control_plane.0.remote
+          - control_plane.0.local
+        description: |
+          Local control plane configuration.
+        default_from_api: true
+        properties:
+          - !ruby/object:Api::Type::String
+            name: "nodeLocation"
+            default_from_api: true
+            immutable: true
+            description: |
+              Name of the Google Distributed Cloud Edge zones where this node pool
+              will be created. For example: `us-central1-edge-customer-a`.
+          - !ruby/object:Api::Type::Integer
+            name: "nodeCount"
+            description: |
+              The number of nodes to serve as replicas of the Control Plane.
+              Only 1 and 3 are supported.
+            default_from_api: true
+          - !ruby/object:Api::Type::String
+            name: "machineFilter"
+            description: |
+              Only machines matching this filter will be allowed to host control
+              plane nodes. The filtering language accepts strings like "name=<name>",
+              and is documented here: [AIP-160](https://google.aip.dev/160).
+          - !ruby/object:Api::Type::Enum
+            name: "sharedDeploymentPolicy"
+            default_from_api: true
+            description: |
+              Policy configuration about how user applications are deployed.
+            values:
+              - :SHARED_DEPLOYMENT_POLICY_UNSPECIFIED
+              - :ALLOWED
+              - :DISALLOWED
+  - !ruby/object:Api::Type::NestedObject
+    name: "systemAddonsConfig"
+    default_from_api: true
+    description: |
+      Config that customers are allowed to define for GDCE system add-ons.
+    properties:
+      - !ruby/object:Api::Type::NestedObject
+        name: "ingress"
+        default_from_api: true
+        description: |
+          Config for the Ingress add-on which allows customers to create an Ingress
+          object to manage external access to the servers in a cluster. The add-on
+          consists of istiod and istio-ingress.
+        properties:
+          - !ruby/object:Api::Type::Boolean
+            name: "disabled"
+            default_from_api: true
+            description: |
+              Whether Ingress is disabled.
+          - !ruby/object:Api::Type::String
+            name: "ipv4Vip"
+            default_from_api: true
+            description: |
+              Ingress VIP.
+  - !ruby/object:Api::Type::Array
+    item_type: Api::Type::String
+    name: "externalLoadBalancerIpv4AddressPools"
+    default_from_api: true
+    description: |
+      Address pools for cluster data plane external load balancing.
+  - !ruby/object:Api::Type::NestedObject
+    name: "controlPlaneEncryption"
+    default_from_api: true
+    description: |
+      Remote control plane disk encryption options. This field is only used when
+      enabling CMEK support.
+    properties:
+      - !ruby/object:Api::Type::String
+        name: "kmsKey"
+        immutable: true
+        default_from_api: true
+        description: |
+          The Cloud KMS CryptoKey e.g.
+          projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey}
+          to use for protecting control plane disks. If not specified, a
+          Google-managed key will be used instead.
+      - !ruby/object:Api::Type::String
+        name: "kmsKeyActiveVersion"
+        output: true
+        description: |
+          The Cloud KMS CryptoKeyVersion currently in use for protecting control
+          plane disks. Only applicable if kms_key is set.
+      - !ruby/object:Api::Type::String
+        name: "kmsKeyState"
+        output: true
+        description: |
+          Availability of the Cloud KMS CryptoKey. If not `KEY_AVAILABLE`, then
+          nodes may go offline as they cannot access their local data. This can be
+          caused by a lack of permissions to use the key, or if the key is disabled
+          or deleted.
+      - !ruby/object:Api::Type::NestedObject
+        name: "kmsStatus"
+        output: true
+        description: |
+          Error status returned by Cloud KMS when using this key. This field may be
+          populated only if `kms_key_state` is not `KMS_KEY_STATE_KEY_AVAILABLE`.
+          If populated, this field contains the error status reported by Cloud KMS.
+        properties:
+          - !ruby/object:Api::Type::Integer
+            name: 'code'
+            output: true
+            description: The status code, which should be an enum value of google.rpc.Code.
+          - !ruby/object:Api::Type::String
+            name: 'message'
+            output: true
+            description:
+              A developer-facing error message, which should be in English.
+              Any user-facing error message should be localized and sent in
+              the google.rpc.Status.details field, or localized by the client.
+  - !ruby/object:Api::Type::String
+    name: "status"
+    output: true
+    description: |
+      Indicates the status of the cluster.
+  - !ruby/object:Api::Type::Array
+    name: maintenanceEvents
+    output: true
+    description: |
+      All the maintenance events scheduled for the cluster, including the ones
+      ongoing, planned for the future and done in the past (up to 90 days).
+    item_type: !ruby/object:Api::Type::NestedObject
+      properties:
+        - !ruby/object:Api::Type::String
+          name: 'uuid'
+          description: |
+            UUID of the maintenance event.
+          output: true
+        - !ruby/object:Api::Type::String
+          name: 'targetVersion'
+          description: |
+            The target version of the cluster.
+          output: true
+        - !ruby/object:Api::Type::String
+          name: 'operation'
+          description: |
+            The operation for running the maintenance event. Specified in the format
+            projects/*/locations/*/operations/*. If the maintenance event is split
+            into multiple operations (e.g. due to maintenance windows), the latest
+            one is recorded.
+          output: true
+        - !ruby/object:Api::Type::String
+          name: "type"
+          output: true
+          description: |
+            Indicates the maintenance event type.
+        - !ruby/object:Api::Type::String
+          name: schedule
+          output: true
+          description: |
+            The schedule of the maintenance event.
+        - !ruby/object:Api::Type::String
+          name: "state"
+          output: true
+          description: |
+            Indicates the maintenance event state.
+        - !ruby/object:Api::Type::Time
+          name: "createTime"
+          output: true
+          description: |
+            The time when the maintenance event request was created.
+        - !ruby/object:Api::Type::Time
+          name: "startTime"
+          output: true
+          description: |
+            The time when the maintenance event started.
+        - !ruby/object:Api::Type::Time
+          name: "endTime"
+          output: true
+          description: |
+            The time when the maintenance event ended, either successfully or not. If
+            the maintenance event is split into multiple maintenance windows,
+            end_time is only updated when the whole flow ends.
+        - !ruby/object:Api::Type::Time
+          name: "updateTime"
+          output: true
+          description: |
+            The time when the maintenance event message was updated.
+  - !ruby/object:Api::Type::String
+    name: targetVersion
+    default_from_api: true
+    description: |
+      The target cluster version. For example: "1.5.0".
+    update_url: 'projects/{{project}}/locations/{{location}}/clusters/{{name}}:upgrade'
+    update_verb: :POST
+  - !ruby/object:Api::Type::Enum
+    name: "releaseChannel"
+    default_from_api: true
+    description: |
+      The release channel a cluster is subscribed to.
+    values:
+      - :RELEASE_CHANNEL_UNSPECIFIED
+      - :NONE
+      - :REGULAR
diff --git a/mmv1/products/edgecontainer/NodePool.yaml b/mmv1/products/edgecontainer/NodePool.yaml
new file mode 100644
index 000000000000..455856423905
--- /dev/null
+++ b/mmv1/products/edgecontainer/NodePool.yaml
@@ -0,0 +1,166 @@
+# Copyright 2023 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+--- !ruby/object:Api::Resource
+name: "NodePool"
+description: |
+  "A set of Kubernetes nodes in a cluster with common configuration and specification."
+references: !ruby/object:Api::Resource::ReferenceLinks
+  guides:
+    "Google Distributed Cloud Edge": "https://cloud.google.com/distributed-cloud/edge/latest/docs"
+  api: "https://cloud.google.com/distributed-cloud/edge/latest/docs/reference/container/rest/v1/projects.locations.clusters.nodePools"
+base_url: "projects/{{project}}/locations/{{location}}/clusters/{{cluster}}/nodePools"
+self_link: 'projects/{{project}}/locations/{{location}}/clusters/{{cluster}}/nodePools/{{name}}'
+create_url: "projects/{{project}}/locations/{{location}}/clusters/{{cluster}}/nodePools?nodePoolId={{name}}"
+update_url: 'projects/{{project}}/locations/{{location}}/clusters/{{cluster}}/nodePools/{{name}}'
+update_verb: :PATCH
+update_mask: true
+autogen_async: true
+async: !ruby/object:Api::OpAsync
+  operation: !ruby/object:Api::OpAsync::Operation
+    path: "name"
+    base_url: "{{op_id}}"
+    wait_ms: 1000
+    timeouts: !ruby/object:Api::Timeouts
+      insert_minutes: 60
+      update_minutes: 60
+      delete_minutes: 60
+  result: !ruby/object:Api::OpAsync::Result
+    path: "response"
+  status: !ruby/object:Api::OpAsync::Status
+    path: "done"
+    complete: true
+    allowed:
+      - true
+      - false
+  error: !ruby/object:Api::OpAsync::Error
+    path: "error"
+    message: "message"
+import_format: ["projects/{{project}}/locations/{{location}}/clusters/{{cluster}}/nodePools/{{name}}"]
+examples:
+  # Skip the node-pool test as we only have limited machine resources
+  # The node-pool creation is tested in edgecontainer_local_control_plane_node_pool_internal
+  # in order to avoid exposing the node location and machine name to public.
+  - !ruby/object:Provider::Terraform::Examples
+    name: "edgecontainer_node_pool"
+    primary_resource_id: "default"
+    skip_test: true
+  - !ruby/object:Provider::Terraform::Examples
+    name: "edgecontainer_node_pool_with_cmek"
+    primary_resource_id: "default"
+    skip_test: true
+  - !ruby/object:Provider::Terraform::Examples
+    name: "edgecontainer_local_control_plane_node_pool"
+    primary_resource_id: "default"
+    skip_test: true
+  # Skip the docs generation for the edgecontainer_local_control_plane_node_pool_internal test
+  # to avoid leaking the machine name, and node location to public.
+  # Skip the vcr test because as we only have limited machine resources and we don't want it run
+  # in github presubmit test.
+  - !ruby/object:Provider::Terraform::Examples
+    name: "edgecontainer_local_control_plane_node_pool_internal"
+    primary_resource_id: "default"
+    skip_docs: true
+    skip_vcr: true
+parameters:
+  - !ruby/object:Api::Type::String
+    name: "name"
+    required: true
+    immutable: true
+    url_param_only: true
+    description: |
+      The resource name of the node pool.
+  - !ruby/object:Api::Type::String
+    name: "location"
+    required: true
+    immutable: true
+    url_param_only: true
+    description: |
+      The location of the resource.
+  - !ruby/object:Api::Type::String
+    name: "cluster"
+    required: true
+    immutable: true
+    url_param_only: true
+    description: |
+      The name of the target Distributed Cloud Edge Cluster.
+properties:
+  - !ruby/object:Api::Type::Time
+    name: createTime
+    description: |
+      The time when the node pool was created.
+    output: true
+  - !ruby/object:Api::Type::Time
+    name: updateTime
+    description: |
+      The time when the node pool was last updated.
+    output: true
+  - !ruby/object:Api::Type::KeyValueLabels
+    name: "labels"
+    description: "Labels associated with this resource."
+  - !ruby/object:Api::Type::String
+    name: "nodeLocation"
+    required: true
+    immutable: true
+    description: |
+      Name of the Google Distributed Cloud Edge zone where this node pool will be created. For example: `us-central1-edge-customer-a`.
+  - !ruby/object:Api::Type::Integer
+    name: "nodeCount"
+    required: true
+    description: |
+      The number of nodes in the pool.
+  - !ruby/object:Api::Type::String
+    name: "machineFilter"
+    default_from_api: true
+    description: |
+      Only machines matching this filter will be allowed to join the node pool.
+      The filtering language accepts strings like "name=<name>", and is
+      documented in more detail in [AIP-160](https://google.aip.dev/160).
+  - !ruby/object:Api::Type::NestedObject
+    name: localDiskEncryption
+    description: |
+      Local disk encryption options. This field is only used when enabling CMEK support.
+    properties:
+      - !ruby/object:Api::Type::String
+        name: "kmsKey"
+        immutable: true
+        description: |
+          The Cloud KMS CryptoKey e.g. projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey} to use for protecting node local disks.
+          If not specified, a Google-managed key will be used instead.
+      - !ruby/object:Api::Type::String
+        name: "kmsKeyActiveVersion"
+        output: true
+        description: |
+          The Cloud KMS CryptoKeyVersion currently in use for protecting node local disks. Only applicable if kmsKey is set.
+      - !ruby/object:Api::Type::String
+        name: kmsKeyState
+        description: |
+          Availability of the Cloud KMS CryptoKey. If not KEY_AVAILABLE, then nodes may go offline as they cannot access their local data.
+          This can be caused by a lack of permissions to use the key, or if the key is disabled or deleted.
+        output: true
+  - !ruby/object:Api::Type::String
+    name: "nodeVersion"
+    output: true
+    description: |
+      The lowest release version among all worker nodes.
+  - !ruby/object:Api::Type::NestedObject
+    name: nodeConfig
+    default_from_api: true
+    description: |
+      Configuration for each node in the NodePool
+    properties:
+      - !ruby/object:Api::Type::KeyValuePairs
+        name: "labels"
+        default_from_api: true
+        description: |
+          "The Kubernetes node labels"
diff --git a/mmv1/products/edgecontainer/VpnConnection.yaml b/mmv1/products/edgecontainer/VpnConnection.yaml
new file mode 100644
index 000000000000..ac5aead0eeef
--- /dev/null
+++ b/mmv1/products/edgecontainer/VpnConnection.yaml
@@ -0,0 +1,152 @@
+# Copyright 2023 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+--- !ruby/object:Api::Resource
+name: "VpnConnection"
+base_url: "projects/{{project}}/locations/{{location}}/vpnConnections"
+create_url: "projects/{{project}}/locations/{{location}}/vpnConnections?vpnConnectionId={{name}}"
+description: "A VPN connection"
+references: !ruby/object:Api::Resource::ReferenceLinks
+  guides:
+    "Google Distributed Cloud Edge": "https://cloud.google.com/distributed-cloud/edge/latest/docs"
+  api: "https://cloud.google.com/distributed-cloud/edge/latest/docs/reference/container/rest/v1/projects.locations.vpnConnections"
+async: !ruby/object:Api::OpAsync
+  operation: !ruby/object:Api::OpAsync::Operation
+    path: "name"
+    base_url: "{{op_id}}"
+    wait_ms: 1000
+    timeouts: !ruby/object:Api::Timeouts
+      insert_minutes: 30
+      update_minutes: 30
+      delete_minutes: 30
+  result: !ruby/object:Api::OpAsync::Result
+    path: "response"
+  status: !ruby/object:Api::OpAsync::Status
+    path: "done"
+    complete: true
+    allowed:
+      - true
+      - false
+  error: !ruby/object:Api::OpAsync::Error
+    path: "error"
+    message: "message"
+import_format: ["projects/{{project}}/locations/{{location}}/vpnConnections"]
+autogen_async: true
+examples:
+  # Skip the vpnconnection test as we only have limited machine resources, and the vpn connection is not a critical feature.
+  - !ruby/object:Provider::Terraform::Examples
+    name: "edgecontainer_vpn_connection"
+    primary_resource_id: "default"
+    skip_test: true
+parameters:
+  - !ruby/object:Api::Type::String
+    name: "name"
+    required: true
+    immutable: true
+    url_param_only: true
+    description: |
+      The resource name of VPN connection
+  - !ruby/object:Api::Type::String
+    name: "location"
+    required: true
+    immutable: true
+    url_param_only: true
+    description: |
+      Google Cloud Platform location.
+properties:
+  - !ruby/object:Api::Type::Time
+    name: createTime
+    description: |
+      The time when the VPN connection was created.
+    output: true
+  - !ruby/object:Api::Type::Time
+    name: updateTime
+    description: |
+      The time when the VPN connection was last updated.
+    output: true
+  - !ruby/object:Api::Type::KeyValueLabels
+    name: "labels"
+    description: "Labels associated with this resource."
+    immutable: true
+  - !ruby/object:Api::Type::String
+    name: "natGatewayIp"
+    immutable: true
+    description: |
+      NAT gateway IP, or WAN IP address. If a customer has multiple NAT IPs, the customer needs to configure NAT such that only one external IP maps to the GMEC Anthos cluster.
+      This is empty if NAT is not used.
+  - !ruby/object:Api::Type::String
+    name: "cluster"
+    required: true
+    immutable: true
+    description: |
+      The canonical Cluster name to connect to. It is in the form of projects/{project}/locations/{location}/clusters/{cluster}.
+  - !ruby/object:Api::Type::String
+    name: "vpc"
+    immutable: true
+    description: |
+      The network ID of VPC to connect to.
+  - !ruby/object:Api::Type::NestedObject
+    name: vpcProject
+    description: Project detail of the VPC network. Required if VPC is in a different project than the cluster project.
+    properties:
+      - !ruby/object:Api::Type::String
+        name: "projectId"
+        immutable: true
+        description: |
+          The project of the VPC to connect to. If not specified, it is the same as the cluster project.
+  - !ruby/object:Api::Type::Boolean
+    name: "enableHighAvailability"
+    default_from_api: true
+    immutable: true
+    description: |
+      Whether this VPN connection has HA enabled on cluster side. If enabled, when creating VPN connection we will attempt to use 2 ANG floating IPs.
+  - !ruby/object:Api::Type::String
+    name: "router"
+    description: |
+      The VPN connection Cloud Router name.
+  - !ruby/object:Api::Type::NestedObject
+    name: "details"
+    output: true
+    properties:
+      - !ruby/object:Api::Type::String
+        name: "state"
+        output: true
+        description: |
+          The current connection state.
+      - !ruby/object:Api::Type::String
+        name: "error"
+        output: true
+        description: |
+          The error message. This is only populated when state=ERROR.
+      - !ruby/object:Api::Type::NestedObject
+        name: "cloudRouter"
+        output: true
+        description: |
+          The Cloud Router info.
+        properties:
+          - !ruby/object:Api::Type::String
+            output: true
+            name: "name"
+            description: |
+              The associated Cloud Router name.
+      - !ruby/object:Api::Type::NestedObject
+        name: "cloudVpns"
+        output: true
+        description: |
+          Each connection has multiple Cloud VPN gateways.
+        properties:
+          - !ruby/object:Api::Type::String
+            output: true
+            name: "gateway"
+            description: |
+              The created Cloud VPN gateway name.
diff --git a/mmv1/products/gameservices/product.yaml b/mmv1/products/edgecontainer/product.yaml
similarity index 63%
rename from mmv1/products/gameservices/product.yaml
rename to mmv1/products/edgecontainer/product.yaml
index 45ddaf0b3d6d..2a2c7d1cecfb 100644
--- a/mmv1/products/gameservices/product.yaml
+++ b/mmv1/products/edgecontainer/product.yaml
@@ -1,4 +1,4 @@
-# Copyright 2019 Google Inc.
+# Copyright 2023 Google Inc.
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -12,14 +12,15 @@
 # limitations under the License.
 
 --- !ruby/object:Api::Product
-name: GameServices
-display_name: Game Servers
-scopes:
-  - https://www.googleapis.com/auth/compute
+name: Edgecontainer
+display_name: Google Distributed Cloud Edge
 versions:
   - !ruby/object:Api::Product::Version
     name: ga
-    base_url: https://gameservices.googleapis.com/v1/
-  - !ruby/object:Api::Product::Version
-    name: beta
-    base_url: https://gameservices.googleapis.com/v1beta/
+    base_url: https://edgecontainer.googleapis.com/v1/
+scopes:
+  - https://www.googleapis.com/auth/cloud-platform
+apis_required:
+  - !ruby/object:Api::Product::ApiReference
+    name: Edgecontainer API
+    url: https://console.cloud.google.com/apis/library/edgecontainer.googleapis.com
diff --git a/mmv1/products/edgenetwork/Network.yaml b/mmv1/products/edgenetwork/Network.yaml
new file mode 100644
index 000000000000..6044713555d0
--- /dev/null
+++ b/mmv1/products/edgenetwork/Network.yaml
@@ -0,0 +1,97 @@
+# Copyright 2023 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+--- !ruby/object:Api::Resource
+name: 'Network'
+description: |
+  A Distributed Cloud Edge network, which provides L3 isolation within a zone.
+references: !ruby/object:Api::Resource::ReferenceLinks
+  api: 'https://cloud.google.com/distributed-cloud/edge/latest/docs/reference/network/rest/v1/projects.locations.zones.networks'
+  guides:
+    'Create and manage networks': 'https://cloud.google.com/distributed-cloud/edge/latest/docs/networks#api'
+base_url: 'projects/{{project}}/locations/{{location}}/zones/{{zone}}/networks'
+self_link: 'projects/{{project}}/locations/{{location}}/zones/{{zone}}/networks/{{network_id}}'
+create_url: 'projects/{{project}}/locations/{{location}}/zones/{{zone}}/networks?networkId={{network_id}}'
+immutable: true
+autogen_async: true
+timeouts: !ruby/object:Api::Timeouts
+  delete_minutes: 30
+import_format: ['projects/{{project}}/locations/{{location}}/zones/{{zone}}/networks/{{network_id}}', '{{name}}']
+examples:
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'edgenetwork_network'
+    primary_resource_id: 'example_network'
+    skip_test: true
+    vars:
+      edgenetwork_network_id: 'example-network'
+    test_env_vars:
+      location: :REGION
+      zone: :ZONE
+parameters:
+  - !ruby/object:Api::Type::String
+    name: 'location'
+    required: true
+    immutable: true
+    url_param_only: true
+    description: |
+      The Google Cloud region to which the target Distributed Cloud Edge zone belongs.
+  - !ruby/object:Api::Type::String
+    name: 'zone'
+    required: true
+    immutable: true
+    url_param_only: true
+    description: |
+      The name of the target Distributed Cloud Edge zone.
+  - !ruby/object:Api::Type::String
+    name: 'network_id'
+    required: true
+    immutable: true
+    url_param_only: true
+    description: |
+      A unique ID that identifies this network.
+properties:
+  - !ruby/object:Api::Type::String
+    name: 'name'
+    output: true
+    description: |
+      The canonical name of this resource, with format
+      `projects/{{project}}/locations/{{location}}/zones/{{zone}}/networks/{{network_id}}`
+  - !ruby/object:Api::Type::KeyValuePairs
+    name: 'labels'
+    required: false
+    description: |
+      Labels associated with this resource.
+  - !ruby/object:Api::Type::String
+    name: 'description'
+    required: false
+    description: |
+      A free-text description of the resource. Max length 1024 characters.
+  - !ruby/object:Api::Type::String
+    name: 'createTime'
+    output: true
+    description: |
+      The time when the subnet was created.
+      A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine
+      fractional digits. Examples: `2014-10-02T15:01:23Z` and `2014-10-02T15:01:23.045123456Z`.
+  - !ruby/object:Api::Type::String
+    name: 'updateTime'
+    output: true
+    description: |
+      The time when the subnet was last updated.
+      A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine
+      fractional digits. Examples: `2014-10-02T15:01:23Z` and `2014-10-02T15:01:23.045123456Z`.
+  - !ruby/object:Api::Type::Integer
+    name: 'mtu'
+    default_value: 1500
+    description: |
+      IP (L3) MTU value of the network. Default value is `1500`. Possible values are: `1500`, `9000`.
diff --git a/mmv1/products/edgenetwork/Subnet.yaml b/mmv1/products/edgenetwork/Subnet.yaml
new file mode 100644
index 000000000000..8c0a6cfe9872
--- /dev/null
+++ b/mmv1/products/edgenetwork/Subnet.yaml
@@ -0,0 +1,138 @@
+# Copyright 2023 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+--- !ruby/object:Api::Resource
+name: 'Subnet'
+description: |
+  A Distributed Cloud Edge subnet, which provides L2 isolation within a network.
+references: !ruby/object:Api::Resource::ReferenceLinks
+  api: 'https://cloud.google.com/distributed-cloud/edge/latest/docs/reference/network/rest/v1/projects.locations.zones.subnets'
+  guides:
+    'Create and manage subnetworks': 'https://cloud.google.com/distributed-cloud/edge/latest/docs/subnetworks#api'
+base_url: 'projects/{{project}}/locations/{{location}}/zones/{{zone}}/subnets'
+self_link: 'projects/{{project}}/locations/{{location}}/zones/{{zone}}/subnets/{{subnet_id}}'
+create_url: 'projects/{{project}}/locations/{{location}}/zones/{{zone}}/subnets?subnetId={{subnet_id}}'
+immutable: true
+autogen_async: true
+timeouts: !ruby/object:Api::Timeouts
+  delete_minutes: 30
+import_format: ['projects/{{project}}/locations/{{location}}/zones/{{zone}}/subnets/{{subnet_id}}', '{{name}}']
+examples:
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'edgenetwork_subnet'
+    primary_resource_id: 'example_subnet'
+    skip_test: true
+    vars:
+      edgenetwork_subnet_id: 'example-subnet'
+      edgenetwork_network_id: 'example-network'
+    test_env_vars:
+      location: :REGION
+      zone: :ZONE
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'edgenetwork_subnet_with_vlan_id'
+    primary_resource_id: 'example_subnet_with_vlan_id'
+    skip_test: true
+    vars:
+      edgenetwork_subnet_id: 'example-subnet-with-vlan-id'
+      edgenetwork_network_id: 'example-network'
+    test_env_vars:
+      location: :REGION
+      zone: :ZONE
+parameters:
+  - !ruby/object:Api::Type::String
+    name: 'location'
+    required: true
+    immutable: true
+    url_param_only: true
+    description: |
+      The Google Cloud region to which the target Distributed Cloud Edge zone belongs.
+  - !ruby/object:Api::Type::String
+    name: 'zone'
+    required: true
+    immutable: true
+    url_param_only: true
+    description: |
+      The name of the target Distributed Cloud Edge zone.
+  - !ruby/object:Api::Type::String
+    name: 'subnet_id'
+    required: true
+    immutable: true
+    url_param_only: true
+    description: |
+      A unique ID that identifies this subnet.
+properties:
+  - !ruby/object:Api::Type::String
+    name: 'name'
+    output: true
+    description: |
+      The canonical name of this resource, with format
+      `projects/{{project}}/locations/{{location}}/zones/{{zone}}/subnets/{{subnet_id}}`
+  - !ruby/object:Api::Type::KeyValuePairs
+    name: 'labels'
+    required: false
+    description: |
+      Labels associated with this resource.
+  - !ruby/object:Api::Type::String
+    name: 'description'
+    required: false
+    description: |
+      A free-text description of the resource. Max length 1024 characters.
+  - !ruby/object:Api::Type::String
+    name: 'createTime'
+    output: true
+    description: |
+      The time when the subnet was created.
+      A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine
+      fractional digits. Examples: `2014-10-02T15:01:23Z` and `2014-10-02T15:01:23.045123456Z`.
+  - !ruby/object:Api::Type::String
+    name: 'updateTime'
+    output: true
+    description: |
+      The time when the subnet was last updated.
+      A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine
+      fractional digits. Examples: `2014-10-02T15:01:23Z` and `2014-10-02T15:01:23.045123456Z`.
+  - !ruby/object:Api::Type::ResourceRef
+    name: 'network'
+    resource: 'Network'
+    imports: 'name'
+    required: true
+    custom_expand: 'templates/terraform/custom_expand/resourceref_with_validation.go.erb'
+    description: |
+      The ID of the network to which this router belongs.
+      Must be of the form: `projects/{{project}}/locations/{{location}}/zones/{{zone}}/networks/{{network_id}}`
+  - !ruby/object:Api::Type::Array
+    name: 'ipv4Cidr'
+    item_type: Api::Type::String
+    description: |
+      The ranges of ipv4 addresses that are owned by this subnetwork, in CIDR format.
+  - !ruby/object:Api::Type::Array
+    name: 'ipv6Cidr'
+    item_type: Api::Type::String
+    description: |
+      The ranges of ipv6 addresses that are owned by this subnetwork, in CIDR format.
+  - !ruby/object:Api::Type::Integer
+    name: 'vlanId'
+    default_from_api: true
+    description: |
+      VLAN ID for this subnetwork. If not specified, one is assigned automatically.
+  - !ruby/object:Api::Type::Enum
+    name: 'state'
+    output: true
+    values:
+      - :STATE_PENDING
+      - :STATE_PROVISIONING
+      - :STATE_RUNNING
+      - :STATE_SUSPENDED
+      - :STATE_DELETING
+    description: |
+      Current stage of the resource to the device by config push.
diff --git a/mmv1/products/edgenetwork/product.yaml b/mmv1/products/edgenetwork/product.yaml
new file mode 100644
index 000000000000..29be977b4df3
--- /dev/null
+++ b/mmv1/products/edgenetwork/product.yaml
@@ -0,0 +1,42 @@
+# Copyright 2023 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+--- !ruby/object:Api::Product
+name: Edgenetwork
+display_name: Distributed Cloud Edge Network
+versions:
+  - !ruby/object:Api::Product::Version
+    name: ga
+    base_url: https://edgenetwork.googleapis.com/v1/
+scopes:
+  - https://www.googleapis.com/auth/cloud-platform
+apis_required:
+  - !ruby/object:Api::Product::ApiReference
+    name: Distributed Cloud Edge Network API
+    url: https://console.cloud.google.com/apis/library/edgenetwork.googleapis.com
+async: !ruby/object:Api::OpAsync
+  operation: !ruby/object:Api::OpAsync::Operation
+    path: 'name'
+    base_url: '{{op_id}}'
+    wait_ms: 1000
+  result: !ruby/object:Api::OpAsync::Result
+    path: 'response'
+  status: !ruby/object:Api::OpAsync::Status
+    path: 'done'
+    complete: true
+    allowed:
+      - true
+      - false
+  error: !ruby/object:Api::OpAsync::Error
+    path: 'error'
+    message: 'message'
diff --git a/mmv1/products/filestore/Backup.yaml b/mmv1/products/filestore/Backup.yaml
index 134f6f46e49c..aaa18af7ecf4 100644
--- a/mmv1/products/filestore/Backup.yaml
+++ b/mmv1/products/filestore/Backup.yaml
@@ -78,7 +78,7 @@ properties:
     description: |
       The time when the snapshot was created in RFC3339 text format.
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Resource labels to represent user-provided metadata.
@@ -113,6 +113,7 @@ properties:
       - :BASIC_HDD
       - :BASIC_SSD
       - :HIGH_SCALE_SSD
+      - :ZONAL
       - :ENTERPRISE
     output: true
   - !ruby/object:Api::Type::String
diff --git a/mmv1/products/filestore/Instance.yaml b/mmv1/products/filestore/Instance.yaml
index 64bc35e5274e..5292b7a197db 100644
--- a/mmv1/products/filestore/Instance.yaml
+++ b/mmv1/products/filestore/Instance.yaml
@@ -44,7 +44,8 @@ examples:
   - !ruby/object:Provider::Terraform::Examples
     name: 'filestore_instance_enterprise'
     primary_resource_id: 'instance'
-    skip_test: true # https://github.com/GoogleCloudPlatform/magic-modules/pull/5875#discussion_r844285335
+    # https://github.com/GoogleCloudPlatform/magic-modules/pull/5875#discussion_r844285335
+    skip_test: true
     vars:
       instance_name: 'test-instance'
 custom_code: !ruby/object:Provider::Terraform::CustomCode
@@ -95,10 +96,10 @@ properties:
     name: 'tier'
     description: |
       The service tier of the instance.
-      Possible values include: STANDARD, PREMIUM, BASIC_HDD, BASIC_SSD, HIGH_SCALE_SSD and ENTERPRISE
+      Possible values include: STANDARD, PREMIUM, BASIC_HDD, BASIC_SSD, HIGH_SCALE_SSD, ZONAL and ENTERPRISE
     required: true
     immutable: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Resource labels to represent user-provided metadata.
diff --git a/mmv1/products/filestore/Snapshot.yaml b/mmv1/products/filestore/Snapshot.yaml
index e5390f5445ae..1ce5ea76bb50 100644
--- a/mmv1/products/filestore/Snapshot.yaml
+++ b/mmv1/products/filestore/Snapshot.yaml
@@ -89,7 +89,7 @@ properties:
     description: |
       The time when the snapshot was created in RFC3339 text format.
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Resource labels to represent user-provided metadata.
diff --git a/mmv1/products/firebase/AndroidApp.yaml b/mmv1/products/firebase/AndroidApp.yaml
index 5a0bb9027a22..8cd21b2db2ba 100644
--- a/mmv1/products/firebase/AndroidApp.yaml
+++ b/mmv1/products/firebase/AndroidApp.yaml
@@ -89,14 +89,16 @@ examples:
       - project
       - deletion_policy
 virtual_fields:
-  # TODO: make this an enum in a future major version. If using this field as a reference, look at PerInstanceConfig's minimal_action field for enum configuration.
-  - !ruby/object:Api::Type::String
+  - !ruby/object:Api::Type::Enum
     name: 'deletion_policy'
     description: |
       (Optional) Set to `ABANDON` to allow the AndroidApp to be untracked from terraform state
       rather than deleted upon `terraform destroy`. This is useful because the AndroidApp may be
       serving traffic. Set to `DELETE` to delete the AndroidApp. Defaults to `DELETE`.
-    default_value: DELETE
+    default_value: :DELETE
+    values:
+      - :DELETE
+      - :ABANDON
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   custom_delete: templates/terraform/custom_delete/firebase_app_deletion_policy.erb
 properties:
diff --git a/mmv1/products/firebase/AppleApp.yaml b/mmv1/products/firebase/AppleApp.yaml
index ac62a91975ee..7c9ab93c8258 100644
--- a/mmv1/products/firebase/AppleApp.yaml
+++ b/mmv1/products/firebase/AppleApp.yaml
@@ -65,7 +65,6 @@ examples:
       display_name: 'Display Name Basic'
       bundle_id: 'apple.app.12345'
     test_env_vars:
-      org_id: :ORG_ID
       project_id: :PROJECT_NAME
     test_vars_overrides:
       display_name: '"tf-test Display Name Basic"'
@@ -80,7 +79,6 @@ examples:
       team_id: '9987654321'  # Has to be a 10-digit number.
       api_key_name: 'api-key'
     test_env_vars:
-      org_id: :ORG_ID
       project_id: :PROJECT_NAME
     test_vars_overrides:
       app_store_id: '12345'
@@ -90,14 +88,16 @@ examples:
       - project
       - deletion_policy
 virtual_fields:
-  # TODO: make this an enum in a future major version. If using this field as a reference, look at PerInstanceConfig's minimal_action field for enum configuration.
-  - !ruby/object:Api::Type::String
+  - !ruby/object:Api::Type::Enum
     name: 'deletion_policy'
     description: |
       (Optional) Set to `ABANDON` to allow the Apple to be untracked from terraform state
       rather than deleted upon `terraform destroy`. This is useful because the Apple may be
       serving traffic. Set to `DELETE` to delete the Apple. Defaults to `DELETE`.
-    default_value: DELETE
+    default_value: :DELETE
+    values:
+      - :DELETE
+      - :ABANDON
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   custom_delete: templates/terraform/custom_delete/firebase_app_deletion_policy.erb
 properties:
diff --git a/mmv1/products/firebase/ProjectLocation.yaml b/mmv1/products/firebase/ProjectLocation.yaml
deleted file mode 100644
index e1957694e954..000000000000
--- a/mmv1/products/firebase/ProjectLocation.yaml
+++ /dev/null
@@ -1,58 +0,0 @@
-# Copyright 2023 Google Inc.
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
---- !ruby/object:Api::Resource
-name: 'ProjectLocation'
-min_version: beta
-base_url: projects/{{project}}
-self_link: projects/{{project}}
-create_url: projects/{{project}}/defaultLocation:finalize
-nested_query: !ruby/object:Api::Resource::NestedQuery
-  keys:
-    - resources
-immutable: true
-description: |
-  Sets the default Google Cloud Platform (GCP) resource location for the specified FirebaseProject.
-  This method creates an App Engine application with a default Cloud Storage bucket, located in the specified
-  locationId. This location must be one of the available GCP resource locations.
-  After the default GCP resource location is finalized, or if it was already set, it cannot be changed.
-  The default GCP resource location for the specified FirebaseProject might already be set because either the
-  GCP Project already has an App Engine application or defaultLocation.finalize was previously called with a
-  specified locationId. Any new calls to defaultLocation.finalize with a different specified locationId will
-  return a 409 error.
-references: !ruby/object:Api::Resource::ReferenceLinks
-  guides:
-    'Official Documentation': 'https://firebase.google.com/'
-  api: 'https://firebase.google.com/docs/reference/firebase-management/rest/v1beta1/projects.defaultLocation/finalize'
-import_format: ['projects/{{project}}', '{{project}}']
-skip_delete: true
-skip_sweeper: true
-deprecation_message: >-
-  `google_firebase_project_location` is deprecated in favor of explicitly configuring `google_app_engine_application`
-  and `google_firestore_database`. This resource will be removed in the next major release of the provider.
-examples:
-  - !ruby/object:Provider::Terraform::Examples
-    name: 'firebase_project_location_basic'
-    min_version: 'beta'
-    primary_resource_id: 'basic'
-    test_env_vars:
-      org_id: :ORG_ID
-    vars:
-      project_name: "my-project"
-properties:
-  - !ruby/object:Api::Type::String
-    name: locationId
-    required: true
-    description: |
-      The ID of the default GCP resource location for the Project. The location must be one of the available GCP
-      resource locations.
diff --git a/mmv1/products/firebase/WebApp.yaml b/mmv1/products/firebase/WebApp.yaml
index 6c7a9eb5ba57..e6682fdb76df 100644
--- a/mmv1/products/firebase/WebApp.yaml
+++ b/mmv1/products/firebase/WebApp.yaml
@@ -65,9 +65,8 @@ examples:
     vars:
       display_name: 'Display Name Basic'
       bucket_name: 'fb-webapp-'
-      project_name: "my-project"
     test_env_vars:
-      org_id: :ORG_ID
+      project_id: :PROJECT_NAME
     test_vars_overrides:
       display_name: '"tf-test Display Name Basic"'
     ignore_read_extra:
@@ -86,14 +85,16 @@ examples:
       - project
       - deletion_policy
 virtual_fields:
-  # TODO: make this an enum in a future major version. If using this field as a reference, look at PerInstanceConfig's minimal_action field for enum configuration.
-  - !ruby/object:Api::Type::String
+  - !ruby/object:Api::Type::Enum
     name: 'deletion_policy'
     description: |
       Set to `ABANDON` to allow the WebApp to be untracked from terraform state
       rather than deleted upon `terraform destroy`. This is useful becaue the WebApp may be
-      serving traffic. Set to `DELETE` to delete the WebApp. Default to `ABANDON`
-    default_value: ABANDON
+      serving traffic. Set to `DELETE` to delete the WebApp. Default to `DELETE`
+    default_value: :DELETE
+    values:
+      - :DELETE
+      - :ABANDON
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   custom_delete: templates/terraform/custom_delete/firebase_app_deletion_policy.erb
 properties:
diff --git a/mmv1/products/firebasehosting/Channel.yaml b/mmv1/products/firebasehosting/Channel.yaml
index d94e4bef481b..5a1cc9648230 100644
--- a/mmv1/products/firebasehosting/Channel.yaml
+++ b/mmv1/products/firebasehosting/Channel.yaml
@@ -76,8 +76,8 @@ properties:
       The number of previous releases to retain on the channel for rollback or other
       purposes. Must be a number between 1-100. Defaults to 10 for new channels.
     default_from_api: true
-  - !ruby/object:Api::Type::KeyValuePairs
-    name: labels
+  - !ruby/object:Api::Type::KeyValueLabels
+    name: 'labels'
     description: Text labels used for extra metadata and/or filtering
   - !ruby/object:Api::Type::Time
     name: expireTime
diff --git a/mmv1/products/firebasehosting/CustomDomain.yaml b/mmv1/products/firebasehosting/CustomDomain.yaml
new file mode 100644
index 000000000000..f6b14ab762d6
--- /dev/null
+++ b/mmv1/products/firebasehosting/CustomDomain.yaml
@@ -0,0 +1,504 @@
+# Copyright 2023 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+---
+!ruby/object:Api::Resource
+name: "CustomDomain"
+min_version: beta
+base_url: projects/{{project}}/sites/{{site_id}}/customDomains
+self_link: projects/{{project}}/sites/{{site_id}}/customDomains/{{custom_domain}}
+create_url: projects/{{project}}/sites/{{site_id}}/customDomains?customDomainId={{custom_domain}}
+update_verb: :PATCH
+update_mask: true
+description: |
+  Manages Custom Domains for Firebase Hosting. Custom Domains link your
+  domain names with Firebase Hosting sites, allowing Hosting to serve content
+  on those domain names.
+references: !ruby/object:Api::Resource::ReferenceLinks
+  guides:
+    "Official Documentation": "https://firebase.google.com/docs/hosting"
+  api: "https://firebase.google.com/docs/reference/hosting/rest/v1beta1/projects.sites.customDomains"
+import_format:
+  [
+    "projects/{{project}}/sites/{{site_id}}/customDomains/{{custom_domain}}",
+    "{{project}}/{{site_id}}/{{custom_domain}}",
+    "sites/{{site_id}}/customDomains/{{custom_domain}}",
+    "{{site_id}}/{{custom_domain}}",
+  ]
+autogen_async: true
+async: !ruby/object:Api::OpAsync
+  actions: ["update", "delete"]
+  operation: !ruby/object:Api::OpAsync::Operation
+    path: "name"
+    base_url: "{{op_id}}"
+    wait_ms: 1000
+  result: !ruby/object:Api::OpAsync::Result
+    path: "response"
+    resource_inside_response: true
+  status: !ruby/object:Api::OpAsync::Status
+    path: "done"
+    complete: true
+    allowed:
+      - true
+      - false
+  error: !ruby/object:Api::OpAsync::Error
+    path: "error"
+    message: "message"
+custom_code: !ruby/object:Provider::Terraform::CustomCode
+  post_create: templates/terraform/post_create/firebasehosting_custom_domain_wait_dns_verification.erb
+  test_check_destroy: templates/terraform/custom_check_destroy/firebasehosting_custom_domain_soft_delete.go.erb
+examples:
+  - !ruby/object:Provider::Terraform::Examples
+    name: "firebasehosting_customdomain_basic"
+    min_version: "beta"
+    primary_resource_id: "default"
+    vars:
+      site_id: site-id
+      custom_domain: custom.domain.com
+    test_env_vars:
+      project_id: :PROJECT_NAME
+    test_vars_overrides:
+      # Use the default hosting site for the project in tests
+      site_id: envvar.GetTestProjectFromEnv()
+      # Don't add random suffix
+      custom_domain: '"basic.custom.domain.com"'
+  - !ruby/object:Provider::Terraform::Examples
+    name: "firebasehosting_customdomain_full"
+    min_version: "beta"
+    primary_resource_id: "default"
+    vars:
+      site_id: site-id-full
+      custom_domain: source.domain.com
+      redirect_target: destination.domain.com
+    test_env_vars:
+      project_id: :PROJECT_NAME
+    test_vars_overrides:
+      # Don't add random suffix
+      custom_domain: '"full.source.domain.com"'
+      redirect_target: '"destination.domain.com"'
+  - !ruby/object:Provider::Terraform::Examples
+    name: "firebasehosting_customdomain_cloud_run"
+    min_version: "beta"
+    primary_resource_id: "default"
+    vars:
+      site_id: site-id
+      custom_domain: run.custom.domain.com
+      cloud_run_service_id: cloud-run-service-via-hosting
+    test_env_vars:
+      project_id: :PROJECT_NAME
+    test_vars_overrides:
+      # Don't add random suffix
+      custom_domain: '"run.custom.domain.com"'
+parameters:
+  - !ruby/object:Api::Type::String
+    name: site_id
+    description: |
+      The ID of the site in which to create this custom domain association.
+    immutable: true
+    required: true
+    url_param_only: true
+  - !ruby/object:Api::Type::String
+    name: custom_domain
+    description: |
+      The ID of the `CustomDomain`, which is the domain name you'd like to use with Firebase Hosting.
+    immutable: true
+    required: true
+    url_param_only: true
+virtual_fields:
+  - !ruby/object:Api::Type::Boolean
+    name: wait_dns_verification
+    description: |
+      If true, Terraform will wait for DNS records to be fully resolved on the `CustomDomain`.
+      If false, Terraform will not wait for DNS records on the `CustomDomain`. Any issues in
+      the `CustomDomain` will be returned and stored in the Terraform state.
+    immutable: true
+    default_value: false
+properties:
+  - !ruby/object:Api::Type::String
+    name: name
+    pattern: projects/{{project}}/sites/{{site_id}}/customDomains/{{custom_domain}}
+    description: |
+      The fully-qualified name of the `CustomDomain`.
+    output: true
+  - !ruby/object:Api::Type::Time
+    name: createTime
+    output: true
+    description: The `CustomDomain`'s create time.
+  - !ruby/object:Api::Type::Time
+    name: updateTime
+    output: true
+    description: The last time the `CustomDomain` was updated.
+  - !ruby/object:Api::Type::Time
+    name: deleteTime
+    output: true
+    description: |
+      The time the `CustomDomain` was deleted; null for `CustomDomains` that
+      haven't been deleted. Deleted `CustomDomains` persist for approximately 30
+      days, after which time Hosting removes them completely.
+  - !ruby/object:Api::Type::Time
+    name: expireTime
+    output: true
+    description: |
+      The minimum time before a soft-deleted `CustomDomain` is completely removed
+      from Hosting; null for `CustomDomains` that haven't been deleted.
+  - !ruby/object:Api::Type::Fingerprint
+    name: etag
+    output: true
+    description: |
+      A string that represents the current state of the `CustomDomain` and
+      allows you to confirm its initial state in requests that would modify it.
+  - !ruby/object:Api::Type::String
+    name: hostState
+    output: true
+    description: |
+      The host state of your domain name. Host state is determined by checking each
+      IP address associated with your domain name to see if it's serving
+      Hosting content.
+        HOST_UNHOSTED:
+          Your `CustomDomain`'s domain name isn't associated with any IP addresses.
+
+        HOST_UNREACHABLE:
+          Your `CustomDomain`'s domain name can't be reached. Hosting services' DNS
+          queries to find your domain name's IP addresses resulted in errors. See
+          your `CustomDomain`'s `issues` field for more details.
+
+        HOST_MISMATCH:
+          Your `CustomDomain`'s domain name has IP addresses that don't ultimately
+          resolve to Hosting.
+
+        HOST_CONFLICT:
+          Your `CustomDomain`'s domain name has IP addresses that resolve to both
+          Hosting and other services. To ensure consistent results, remove `A` and
+          `AAAA` records related to non-Hosting services.
+
+        HOST_ACTIVE:
+          All requests against your `CustomDomain`'s domain name are served by
+          Hosting. If the `CustomDomain`'s `OwnershipState` is also `ACTIVE`, Hosting
+          serves your Hosting Site's content on the domain name.
+  - !ruby/object:Api::Type::Enum
+    name: ownershipState
+    output: true
+    description: |
+      The ownership state of your domain name. Ownership is determined at a
+      Firebase project level, and established by adding `TXT` records to your
+      domain name's DNS records.
+
+      Ownership cascades to subdomains. Granting a project ownership of `foo.com`
+      also grants that project ownership over `bar.foo.com`, unless you add
+      specific `TXT` records to `bar.foo.com` that grant a different project
+      ownership.
+
+      If your `CustomDomain` is in an `OwnershipState` other than
+      `OWNERSHIP_ACTIVE` for more than 30 days and it hasn't been updated in at
+      least 30 days, Hosting's ownership systems delete the `CustomDomain`.
+
+      OWNERSHIP_MISSING:
+        Your `CustomDomain`'s domain name has no Hosting-related ownership records;
+        no Firebase project has permission to act on the domain name's behalf.
+
+      OWNERSHIP_UNREACHABLE:
+        Your `CustomDomain`'s domain name can't be reached. Hosting services' DNS
+        queries to find your domain name's ownership records resulted in errors.
+        See your `CustomDomain`'s `issues` field for more details.
+
+      OWNERSHIP_MISMATCH:
+        Your `CustomDomain`'s domain name is owned by another Firebase project.
+        Remove the conflicting `TXT` records and replace them with project-specific
+        records for your current Firebase project.
+
+      OWNERSHIP_CONFLICT:
+        Your `CustomDomain`'s domain name has conflicting `TXT` records that
+        indicate ownership by both your current Firebase project and another
+        project. Remove the other project's ownership records to grant the current
+        project ownership.
+
+      OWNERSHIP_PENDING:
+        Your `CustomDomain`'s DNS records are configured correctly. Hosting will
+        transfer ownership of your domain to this `CustomDomain` within 24 hours.
+
+      OWNERSHIP_ACTIVE:
+        Your `CustomDomain`'s domain name has `TXT` records that grant its project
+        permission to act on its behalf.
+    values:
+      - :OWNERSHIP_MISSING
+      - :OWNERSHIP_UNREACHABLE
+      - :OWNERSHIP_MISMATCH
+      - :OWNERSHIP_CONFLICT
+      - :OWNERSHIP_PENDING
+      - :ACTIVE
+  - !ruby/object:Api::Type::Enum
+    name: certPreference
+    default_from_api: true
+    description: |
+      A field that lets you specify which SSL certificate type Hosting creates
+      for your domain name. Spark plan `CustomDomain`s only have access to the
+      `GROUPED` cert type, while Blaze plan can select any option.
+    values:
+      - :GROUPED
+      - :PROJECT_GROUPED
+      - :DEDICATED
+  - !ruby/object:Api::Type::String
+    name: redirectTarget
+    description: |
+      A domain name that this CustomDomain should direct traffic towards. If
+      specified, Hosting will respond to requests against this CustomDomain
+      with an HTTP 301 code, and route traffic to the specified `redirect_target`
+      instead.
+  - !ruby/object:Api::Type::NestedObject
+    name: requiredDnsUpdates
+    output: true
+    description: |
+      A set of updates you should make to the domain name's DNS records to
+      let Hosting serve secure content on its behalf.
+    properties:
+      - !ruby/object:Api::Type::Time
+        name: checkTime
+        output: true
+        description: |
+          The last time Hosting checked your CustomDomain's DNS records.
+      - !ruby/object:Api::Type::Array
+        name: discovered
+        description: |
+          The set of DNS records Hosting discovered when inspecting a domain
+        item_type: !ruby/object:Api::Type::NestedObject
+          name: DnsRecordSet
+          properties:
+            - !ruby/object:Api::Type::String
+              name: domainName
+              description: The domain name the record set pertains to.
+            - !ruby/object:Api::Type::Array
+              name: records
+              description: Records on the domain
+              item_type: !ruby/object:Api::Type::NestedObject
+                properties:
+                  - !ruby/object:Api::Type::String
+                    name: domainName
+                    description: The domain name the record pertains to, e.g. `foo.bar.com.`.
+                  - !ruby/object:Api::Type::String
+                    name: type
+                    description: |
+                      The record's type, which determines what data the record contains.
+                  - !ruby/object:Api::Type::String
+                    name: rdata
+                    description: |
+                      The data of the record. The meaning of the value depends on record type:
+                         - A and AAAA: IP addresses for the domain name.
+                         - CNAME: Another domain to check for records.
+                         - TXT: Arbitrary text strings associated with the domain name. Hosting
+                           uses TXT records to determine a which Firebase Projects have
+                           permission to act on the domain name's behalf.
+                         - CAA: The record's flags, tag, and value, e.g. `0 issue "pki.goog"`.
+                  - !ruby/object:Api::Type::String
+                    name: requiredAction
+                    description: |
+                      Indicates the a required action for this record.
+      - !ruby/object:Api::Type::Array
+        name: desired
+        description: |
+          The set of DNS records Hosting needs to serve secure content on the domain.
+        item_type: !ruby/object:Api::Type::NestedObject
+          name: DnsRecordSet
+          properties:
+            - !ruby/object:Api::Type::String
+              name: domainName
+              description: The domain name the record set pertains to.
+            - !ruby/object:Api::Type::Array
+              name: records
+              description: Records on the domain
+              item_type: !ruby/object:Api::Type::NestedObject
+                properties:
+                  - !ruby/object:Api::Type::String
+                    name: domainName
+                    description: The domain name the record pertains to, e.g. `foo.bar.com.`.
+                  - !ruby/object:Api::Type::String
+                    name: type
+                    description: |
+                      The record's type, which determines what data the record contains.
+                  - !ruby/object:Api::Type::String
+                    name: rdata
+                    description: |
+                      The data of the record. The meaning of the value depends on record type:
+                         - A and AAAA: IP addresses for the domain name.
+                         - CNAME: Another domain to check for records.
+                         - TXT: Arbitrary text strings associated with the domain name. Hosting
+                           uses TXT records to determine a which Firebase Projects have
+                           permission to act on the domain name's behalf.
+                         - CAA: The record's flags, tag, and value, e.g. `0 issue "pki.goog"`.
+                  - !ruby/object:Api::Type::String
+                    name: requiredAction
+                    description: |
+                      Indicates the a required action for this record.
+  - !ruby/object:Api::Type::Array
+    name: issues
+    output: true
+    description: |
+      A set of errors Hosting systems encountered when trying to establish
+      Hosting's ability to serve secure content for your domain name. Resolve
+      these issues to ensure your `CustomDomain` behaves properly.
+    item_type: !ruby/object:Api::Type::NestedObject
+      name: issue
+      description: A `google.rpc.Status`
+      properties:
+        - !ruby/object:Api::Type::Integer
+          name: code
+          description: The status code, which should be an enum value of `google.rpc.Code`
+        - !ruby/object:Api::Type::String
+          name: message
+          description: Error message
+        - !ruby/object:Api::Type::Array
+          name: 'details'
+          description: |
+            A list of messages that carry the error details.
+          item_type: Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::NestedObject
+    name: cert
+    output: true
+    description: |
+      The SSL certificate Hosting has for this `CustomDomain`'s domain name.
+      For new `CustomDomain`s, this often represents Hosting's intent to create
+      a certificate, rather than an actual cert. Check the `state` field for
+      more.
+    properties:
+      - !ruby/object:Api::Type::String
+        name: type
+        description: The certificate's type.
+      - !ruby/object:Api::Type::String
+        name: state
+        description: |
+          The state of the certificate. Only the `CERT_ACTIVE` and
+          `CERT_EXPIRING_SOON` states provide SSL coverage for a domain name. If the
+          state is `PROPAGATING` and Hosting had an active cert for the domain name
+          before, that formerly-active cert provides SSL coverage for the domain name
+          until the current cert propagates.
+      - !ruby/object:Api::Type::NestedObject
+        name: verification
+        description: |
+          A set of ACME challenges you can add to your DNS records or existing,
+          non-Hosting hosting provider to allow Hosting to create an SSL certificate
+          for your domain name before you point traffic toward hosting. You can use
+          thse challenges as part of a zero downtime transition from your old
+          provider to Hosting.
+        properties:
+          - !ruby/object:Api::Type::NestedObject
+            name: dns
+            description: |
+              A `TXT` record to add to your DNS records that confirms your intent to
+              let Hosting create an SSL cert for your domain name.
+            properties:
+              - !ruby/object:Api::Type::Time
+                name: checkTime
+                output: true
+                description: |
+                  The last time Hosting checked your CustomDomain's DNS records.
+              - !ruby/object:Api::Type::Array
+                name: discovered
+                description: |
+                  The set of DNS records Hosting discovered when inspecting a domain
+                item_type: !ruby/object:Api::Type::NestedObject
+                  name: DnsRecordSet
+                  properties:
+                    - !ruby/object:Api::Type::String
+                      name: domainName
+                      description: The domain name the record set pertains to.
+                    - !ruby/object:Api::Type::Array
+                      name: records
+                      description: Records on the domain
+                      item_type: !ruby/object:Api::Type::NestedObject
+                        properties:
+                          - !ruby/object:Api::Type::String
+                            name: domainName
+                            description: The domain name the record pertains to, e.g. `foo.bar.com.`.
+                          - !ruby/object:Api::Type::String
+                            name: type
+                            description: |
+                              The record's type, which determines what data the record contains.
+                          - !ruby/object:Api::Type::String
+                            name: rdata
+                            description: |
+                              The data of the record. The meaning of the value depends on record type:
+                                - A and AAAA: IP addresses for the domain name.
+                                - CNAME: Another domain to check for records.
+                                - TXT: Arbitrary text strings associated with the domain name. Hosting
+                                  uses TXT records to determine a which Firebase Projects have
+                                  permission to act on the domain name's behalf.
+                                - CAA: The record's flags, tag, and value, e.g. `0 issue "pki.goog"`.
+                          - !ruby/object:Api::Type::String
+                            name: requiredAction
+                            description: |
+                              Indicates the a required action for this record.
+              - !ruby/object:Api::Type::Array
+                name: desired
+                description: |
+                  The set of DNS records Hosting needs to serve secure content on the domain.
+                item_type: !ruby/object:Api::Type::NestedObject
+                  name: DnsRecordSet
+                  properties:
+                    - !ruby/object:Api::Type::String
+                      name: domainName
+                      description: The domain name the record set pertains to.
+                    - !ruby/object:Api::Type::Array
+                      name: records
+                      description: Records on the domain
+                      item_type: !ruby/object:Api::Type::NestedObject
+                        properties:
+                          - !ruby/object:Api::Type::String
+                            name: domainName
+                            description: The domain name the record pertains to, e.g. `foo.bar.com.`.
+                          - !ruby/object:Api::Type::String
+                            name: type
+                            description: |
+                              The record's type, which determines what data the record contains.
+                          - !ruby/object:Api::Type::String
+                            name: rdata
+                            description: |
+                              The data of the record. The meaning of the value depends on record type:
+                                - A and AAAA: IP addresses for the domain name.
+                                - CNAME: Another domain to check for records.
+                                - TXT: Arbitrary text strings associated with the domain name. Hosting
+                                  uses TXT records to determine a which Firebase Projects have
+                                  permission to act on the domain name's behalf.
+                                - CAA: The record's flags, tag, and value, e.g. `0 issue "pki.goog"`.
+                          - !ruby/object:Api::Type::String
+                            name: requiredAction
+                            description: |
+                              Indicates the a required action for this record.
+          - !ruby/object:Api::Type::NestedObject
+            name: http
+            description: |
+              A file to add to your existing, non-Hosting hosting service that confirms
+              your intent to let Hosting create an SSL cert for your domain name.
+            properties:
+              - !ruby/object:Api::Type::String
+                name: path
+                description: The path to the file.
+              - !ruby/object:Api::Type::String
+                name: desired
+                description: A text string to serve at the path.
+              - !ruby/object:Api::Type::String
+                name: discovered
+                description: |
+                  Whether Hosting was able to find the required file contents on the
+                  specified path during its last check.
+              - !ruby/object:Api::Type::Time
+                name: lastCheckTime
+                output: true
+                description: |
+                  The last time Hosting systems checked for the file contents.
+  - !ruby/object:Api::Type::Boolean
+    name: reconciling
+    output: true
+    description: |
+      if true, indicates that Hosting's systems are attmepting to
+      make the `CustomDomain`'s state match your preferred state. This is most
+      frequently `true` when initially provisioning a `CustomDomain` or when creating
+      a new SSL certificate to match an updated `cert_preference`
diff --git a/mmv1/products/firestore/BackupSchedule.yaml b/mmv1/products/firestore/BackupSchedule.yaml
new file mode 100644
index 000000000000..c43443f4007a
--- /dev/null
+++ b/mmv1/products/firestore/BackupSchedule.yaml
@@ -0,0 +1,110 @@
+# Copyright 2023 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+--- !ruby/object:Api::Resource
+name: 'BackupSchedule'
+base_url: projects/{{project}}/databases/{{database}}/backupSchedules
+self_link: 'projects/{{project}}/databases/{{database}}/backupSchedules/{{name}}'
+update_verb: :PATCH
+update_mask: true
+description: |
+  A backup schedule for a Cloud Firestore Database.
+  This resource is owned by the database it is backing up, and is deleted along with the database.
+  The actual backups are not though.
+references: !ruby/object:Api::Resource::ReferenceLinks
+  guides:
+    'Official Documentation': 'https://cloud.google.com/firestore/docs/backups'
+  api: 'https://cloud.google.com/firestore/docs/reference/rest/v1/projects.databases.backupSchedules'
+skip_sweeper: true
+id_format: 'projects/{{project}}/databases/{{database}}/backupSchedules/{{name}}'
+import_format:
+  - 'projects/{{project}}/databases/{{database}}/backupSchedules/{{name}}'
+  - '{{project}}/{{database}}/{{name}}'
+  - '{{database}}/{{name}}'
+docs: !ruby/object:Provider::Terraform::Docs
+  warning: |
+    This resource creates a Firestore Backup Schedule on a project that already has
+    a Firestore database.
+    This resource is owned by the database it is backing up, and is deleted along
+    with the database. The actual backups are not though.
+examples:
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'firestore_backup_schedule_daily'
+    primary_resource_id:
+      'daily-backup'
+    test_env_vars:
+      project_id: :FIRESTORE_PROJECT_NAME
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'firestore_backup_schedule_weekly'
+    primary_resource_id:
+      'weekly-backup'
+    test_env_vars:
+      project_id: :FIRESTORE_PROJECT_NAME
+parameters:
+  - !ruby/object:Api::Type::String
+    name: database
+    description: |
+      The Firestore database id. Defaults to `"(default)"`.
+    default_value: '(default)'
+    immutable: true
+    url_param_only: true
+properties:
+  - !ruby/object:Api::Type::String
+    name: name
+    output: true
+    description: |
+      The unique backup schedule identifier across all locations and databases for the given project. Format:
+      `projects/{{project}}/databases/{{database}}/backupSchedules/{{backupSchedule}}
+    immutable: true
+    custom_flatten: templates/terraform/custom_flatten/name_from_self_link.erb
+  - !ruby/object:Api::Type::String
+    name: retention
+    required: true
+    description: |
+      At what relative time in the future, compared to its creation time, the backup should be deleted, e.g. keep backups for 7 days.
+      A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
+
+      For a daily backup recurrence, set this to a value up to 7 days. If you set a weekly backup recurrence, set this to a value up to 14 weeks.
+  - !ruby/object:Api::Type::NestedObject
+    name: dailyRecurrence
+    description: |
+      For a schedule that runs daily at a specified time.
+    exactly_one_of:
+      - daily_recurrence
+      - weekly_recurrence
+    send_empty_value: true
+    allow_empty_object: true
+    immutable: true
+    properties: []
+  - !ruby/object:Api::Type::NestedObject
+    name: weeklyRecurrence
+    description: |
+      For a schedule that runs weekly on a specific day and time.
+    immutable: true
+    exactly_one_of:
+      - weekly_recurrence
+      - daily_recurrence
+    properties:
+      - !ruby/object:Api::Type::Enum
+        name: day
+        description: |
+          The day of week to run.
+        values:
+          - :DAY_OF_WEEK_UNSPECIFIED
+          - :MONDAY
+          - :TUESDAY
+          - :WEDNESDAY
+          - :THURSDAY
+          - :FRIDAY
+          - :SATURDAY
+          - :SUNDAY
diff --git a/mmv1/products/firestore/Database.yaml b/mmv1/products/firestore/Database.yaml
index 5fa7e8ba5290..26f8371bdf8f 100644
--- a/mmv1/products/firestore/Database.yaml
+++ b/mmv1/products/firestore/Database.yaml
@@ -22,7 +22,9 @@ description: |
 
   If you wish to use Firestore with App Engine, use the
   [`google_app_engine_application`](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/app_engine_application)
-  resource instead.
+  resource instead. If you were previously using the `google_app_engine_application` resource exclusively for managing a Firestore database
+  and would like to use the `google_firestore_database` resource instead, please follow the instructions
+  [here](https://cloud.google.com/firestore/docs/app-engine-requirement).
 references: !ruby/object:Api::Resource::ReferenceLinks
   guides:
     'Official Documentation': 'https://cloud.google.com/firestore/docs/'
@@ -67,15 +69,13 @@ examples:
   - !ruby/object:Provider::Terraform::Examples
     name: 'firestore_database'
     primary_resource_id: 'database'
-    pull_external: true
+    vars:
+      name: "example-database-id"
     test_env_vars:
-      org_id: :ORG_ID
-      billing_account: :BILLING_ACCT
+      project_id: :PROJECT_NAME
     ignore_read_extra:
       - project
       - etag
-    vars:
-      project_id: 'my-project'
   - !ruby/object:Provider::Terraform::Examples
     name: 'firestore_default_database_in_datastore_mode'
     primary_resource_id: 'datastore_mode_database'
@@ -89,16 +89,22 @@ examples:
       project_id: 'my-project'
   - !ruby/object:Provider::Terraform::Examples
     name: 'firestore_database_in_datastore_mode'
-    primary_resource_id: 'database'
-    pull_external: true
+    primary_resource_id: 'datastore_mode_database'
+    vars:
+      name: "example-database-id"
     test_env_vars:
-      org_id: :ORG_ID
-      billing_account: :BILLING_ACCT
+      project_id: :PROJECT_NAME
     ignore_read_extra:
       - project
       - etag
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'firestore_database_with_delete_protection'
+    primary_resource_id: 'database'
     vars:
-      project_id: 'my-project'
+      name: "example-database-id"
+    test_env_vars:
+      project_id: :PROJECT_NAME
+    skip_test: true
 properties:
   - !ruby/object:Api::Type::String
     name: name
@@ -117,7 +123,7 @@ properties:
     name: locationId
     required: true
     description: |
-      The location of the database. Available databases are listed at
+      The location of the database. Available locations are listed at
       https://cloud.google.com/firestore/docs/locations.
     immutable: true
   - !ruby/object:Api::Type::Enum
@@ -147,6 +153,18 @@ properties:
       - :ENABLED
       - :DISABLED
     default_from_api: true
+  - !ruby/object:Api::Type::Enum
+    name: pointInTimeRecoveryEnablement
+    description: |
+      Whether to enable the PITR feature on this database.
+      If `POINT_IN_TIME_RECOVERY_ENABLED` is selected, reads are supported on selected versions of the data from within the past 7 days.
+      versionRetentionPeriod and earliestVersionTime can be used to determine the supported versions. These include reads against any timestamp within the past hour
+      and reads against 1-minute snapshots beyond 1 hour and within 7 days.
+      If `POINT_IN_TIME_RECOVERY_DISABLED` is selected, reads are supported on any version of the data from within the past 1 hour.
+    values:
+      - :POINT_IN_TIME_RECOVERY_ENABLED
+      - :POINT_IN_TIME_RECOVERY_DISABLED
+    default_value: :POINT_IN_TIME_RECOVERY_DISABLED
   - !ruby/object:Api::Type::String
     name: key_prefix
     description: |
@@ -155,15 +173,49 @@ properties:
       that is returned from the Cloud Datastore APIs in Google App Engine first generation runtimes.
       This value may be empty in which case the appid to use for URL-encoded keys is the project_id (eg: foo instead of v~foo).
     output: true
+  - !ruby/object:Api::Type::Enum
+    name: deleteProtectionState
+    description: |
+      State of delete protection for the database.
+    values:
+      - :DELETE_PROTECTION_STATE_UNSPECIFIED
+      - :DELETE_PROTECTION_ENABLED
+      - :DELETE_PROTECTION_DISABLED
+    default_from_api: true
   - !ruby/object:Api::Type::Fingerprint
     name: etag
     description: |
-      This checksum is computed by the server based on the value of other fields,
+      Output only. This checksum is computed by the server based on the value of other fields,
       and may be sent on update and delete requests to ensure the client has an
       up-to-date value before proceeding.
     output: true
   - !ruby/object:Api::Type::String
     name: create_time
     description: |
-      The timestamp at which this database was created.
+      Output only. The timestamp at which this database was created.
+    output: true
+  - !ruby/object:Api::Type::String
+    name: update_time
+    description: |
+      Output only. The timestamp at which this database was most recently updated.
+    output: true
+  - !ruby/object:Api::Type::String
+    name: uid
+    description: |
+      Output only. The system-generated UUID4 for this Database.
+    output: true
+  - !ruby/object:Api::Type::String
+    name: versionRetentionPeriod
+    description: |
+      Output only. The period during which past versions of data are retained in the database.
+      Any read or query can specify a readTime within this window, and will read the state of the database at that time.
+      If the PITR feature is enabled, the retention period is 7 days. Otherwise, the retention period is 1 hour.
+      A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
+    output: true
+  - !ruby/object:Api::Type::String
+    name: earliestVersionTime
+    description: |
+      Output only. The earliest timestamp at which older versions of the data can be read from the database. See versionRetentionPeriod above; this field is populated with now - versionRetentionPeriod.
+      This value is continuously updated, and becomes stale the moment it is queried. If you are using this value to recover data, make sure to account for the time from the moment when the value is queried to the moment when you initiate the recovery.
+      A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
     output: true
diff --git a/mmv1/products/firestore/Document.yaml b/mmv1/products/firestore/Document.yaml
index 3461f7eea9ab..95b67a7053f6 100644
--- a/mmv1/products/firestore/Document.yaml
+++ b/mmv1/products/firestore/Document.yaml
@@ -36,6 +36,8 @@ docs: !ruby/object:Provider::Terraform::Docs
     `google_app_engine_application` resource with `database_type` set to
     `"CLOUD_FIRESTORE"`. Your Firestore location will be the same as
     the App Engine location specified.
+    Note: The surface does not support configurable database id. Only `(default)`
+    is allowed for the database parameter.
 examples:
   - !ruby/object:Provider::Terraform::Examples
     name: 'firestore_document_basic'
diff --git a/mmv1/products/firestore/Field.yaml b/mmv1/products/firestore/Field.yaml
index f7491fa07f29..bd67a668a598 100644
--- a/mmv1/products/firestore/Field.yaml
+++ b/mmv1/products/firestore/Field.yaml
@@ -20,6 +20,8 @@ immutable: false
 update_verb: :PATCH
 update_mask: true
 create_verb: :PATCH
+error_retry_predicates:
+  ["transport_tpg.FirestoreField409RetryUnderlyingDataChanged"]
 description: |
   Represents a single field in the database.
   Fields are grouped by their "Collection Group", which represent all collections
@@ -154,13 +156,13 @@ properties:
     name: ttlConfig
     custom_expand: templates/terraform/custom_expand/empty_object_if_set.go.erb
     description: |
-      If set, this field is configured for TTL deletion.
+       The TTL configuration for this Field. If set to an empty block (i.e. `ttl_config {}`), a TTL policy is configured based on the field. If unset, a TTL policy is not configured (or will be disabled upon updating the resource).
     send_empty_value: true
     properties:
       - !ruby/object:Api::Type::Enum
         name: state
         description: |
-          The state of the TTL configuration.
+          The state of TTL (time-to-live) configuration for documents that have this Field set.
         output: true
         values:
           - :CREATING
diff --git a/mmv1/products/firestore/Index.yaml b/mmv1/products/firestore/Index.yaml
index 658f0e03b4fa..1b9ec7323130 100644
--- a/mmv1/products/firestore/Index.yaml
+++ b/mmv1/products/firestore/Index.yaml
@@ -42,18 +42,16 @@ async: !ruby/object:Api::OpAsync
     path: 'error'
     message: 'message'
 autogen_async: true
-skip_sweeper: true
 import_format: ['{{name}}']
 docs: !ruby/object:Provider::Terraform::Docs
   warning: |
     This resource creates a Firestore Index on a project that already has
     a Firestore database. If you haven't already created it, you may
-    create a `google_firestore_database` resource with `type` set to
-    `"FIRESTORE_NATIVE"` and `location_id` set to your chosen location.
-    If you wish to use App Engine, you may instead create a
-    `google_app_engine_application` resource with `database_type` set to
-    `"CLOUD_FIRESTORE"`. Your Firestore location will be the same as
-    the App Engine location specified.
+    create a `google_firestore_database` resource and `location_id` set
+    to your chosen location. If you wish to use App Engine, you may
+    instead create a `google_app_engine_application` resource with
+    `database_type` set to `"CLOUD_FIRESTORE"`. Your Firestore location
+    will be the same as the App Engine location specified.
 examples:
   - !ruby/object:Provider::Terraform::Examples
     name: 'firestore_index_basic'
@@ -64,6 +62,15 @@ examples:
       # so we need a pre-created project.
     test_env_vars:
       project_id: :FIRESTORE_PROJECT_NAME
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'firestore_index_datastore_mode'
+    primary_resource_id:
+      'my-datastore-mode-index'
+      # This example relies on a well-known collection having been created and
+      # Firestore being enabled on the project. We can't do that automatically
+      # so we need a pre-created project.
+    test_env_vars:
+      project_id: :FIRESTORE_PROJECT_NAME
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   custom_import: templates/terraform/custom_import/index_self_link_as_name_set_project.go.erb
   encoder: templates/terraform/encoders/index.go.erb
@@ -96,6 +103,16 @@ properties:
     values:
       - :COLLECTION
       - :COLLECTION_GROUP
+      - :COLLECTION_RECURSIVE
+  - !ruby/object:Api::Type::Enum
+    name: apiScope
+    description: |
+      The API scope at which a query is run.
+    default_value: :ANY_API
+    values:
+      - :ANY_API
+      - :DATASTORE_MODE_API
+    custom_flatten: 'templates/terraform/custom_flatten/default_if_empty.erb'
   - !ruby/object:Api::Type::Array
     name: fields
     description: |
diff --git a/mmv1/products/gameservices/GameServerCluster.yaml b/mmv1/products/gameservices/GameServerCluster.yaml
deleted file mode 100644
index 8f768c02bfa6..000000000000
--- a/mmv1/products/gameservices/GameServerCluster.yaml
+++ /dev/null
@@ -1,137 +0,0 @@
-# Copyright 2023 Google Inc.
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
---- !ruby/object:Api::Resource
-name: GameServerCluster
-references: !ruby/object:Api::Resource::ReferenceLinks
-  guides:
-    'Official Documentation': 'https://cloud.google.com/game-servers/docs'
-  api: 'https://cloud.google.com/game-servers/docs/reference/rest/v1beta/projects.locations.realms.gameServerClusters'
-update_verb: :PATCH
-update_mask: true
-base_url: projects/{{project}}/locations/{{location}}/realms/{{realm_id}}/gameServerClusters
-create_url: projects/{{project}}/locations/{{location}}/realms/{{realm_id}}/gameServerClusters?gameServerClusterId={{cluster_id}}
-self_link: projects/{{project}}/locations/{{location}}/realms/{{realm_id}}/gameServerClusters/{{cluster_id}}
-description: A game server cluster resource.
-async: !ruby/object:Api::OpAsync
-  operation: !ruby/object:Api::OpAsync::Operation
-    path: 'name'
-    base_url: '{{op_id}}'
-    wait_ms: 1000
-  result: !ruby/object:Api::OpAsync::Result
-    path: 'response'
-    resource_inside_response: true
-  status: !ruby/object:Api::OpAsync::Status
-    path: 'done'
-    complete: true
-    allowed:
-      - true
-      - false
-  error: !ruby/object:Api::OpAsync::Error
-    path: 'error/errors'
-    message: 'message'
-import_format:
-  [
-    'projects/{{project}}/locations/{{location}}/realms/{{realm_id}}/gameServerClusters/{{cluster_id}}',
-  ]
-# Skipping the sweeper due to the non-standard base_url
-skip_sweeper: true
-examples:
-  - !ruby/object:Provider::Terraform::Examples
-    name: 'game_service_cluster_basic'
-    primary_resource_id:
-      'default'
-    skip_test: true
-    vars:
-      realm_id: 'realm'
-    test_vars_overrides:
-      agones_cluster: '"bootstrapped-agones-cluster"'
-custom_code: !ruby/object:Provider::Terraform::CustomCode
-  constants: 'templates/terraform/constants/gameserver_cluster_custom_diff.go'
-properties:
-  - !ruby/object:Api::Type::String
-    immutable: true
-    name: clusterId
-    required: true
-    url_param_only: true
-    description: |-
-      Required. The resource name of the game server cluster
-  - !ruby/object:Api::Type::String
-    name: name
-    output: true
-    description: |-
-      The resource id of the game server cluster, eg:
-
-      `projects/{project_id}/locations/{location}/realms/{realm_id}/gameServerClusters/{cluster_id}`.
-      For example,
-
-      `projects/my-project/locations/{location}/realms/zanzibar/gameServerClusters/my-onprem-cluster`.
-  - !ruby/object:Api::Type::ResourceRef
-    name: realmId
-    url_param_only: true
-    resource: Realm
-    imports: name
-    required: true
-    description: |-
-      The realm id of the game server realm.
-  - !ruby/object:Api::Type::String
-    name: location
-    url_param_only: true
-    default_value: global
-    description: Location of the Cluster.
-  - !ruby/object:Api::Type::KeyValuePairs
-    name: labels
-    description: |-
-      The labels associated with this game server cluster. Each label is a
-      key-value pair.
-  - !ruby/object:Api::Type::NestedObject
-    name: connectionInfo
-    required: true
-    immutable: true
-    description: |-
-      Game server cluster connection information. This information is used to
-      manage game server clusters.
-    properties:
-      - !ruby/object:Api::Type::NestedObject
-        name: gkeClusterReference
-        required: true
-        immutable: true
-        description:
-          Reference of the GKE cluster where the game servers are installed.
-        properties:
-          - !ruby/object:Api::Type::String
-            name: cluster
-            required: true
-            immutable: true
-            description: |-
-              The full or partial name of a GKE cluster, using one of the following
-              forms:
-
-              * `projects/{project_id}/locations/{location}/clusters/{cluster_id}`
-              * `locations/{location}/clusters/{cluster_id}`
-              * `{cluster_id}`
-
-              If project and location are not specified, the project and location of the
-              GameServerCluster resource are used to generate the full name of the
-              GKE cluster.
-            diff_suppress_func: suppressSuffixDiff
-      - !ruby/object:Api::Type::String
-        name: namespace
-        required: true
-        description: |-
-          Namespace designated on the game server cluster where the game server
-          instances will be created. The namespace existence will be validated
-          during creation.
-  - !ruby/object:Api::Type::String
-    name: description
-    description: Human readable description of the cluster.
diff --git a/mmv1/products/gameservices/GameServerConfig.yaml b/mmv1/products/gameservices/GameServerConfig.yaml
deleted file mode 100644
index 75de43ab2eb0..000000000000
--- a/mmv1/products/gameservices/GameServerConfig.yaml
+++ /dev/null
@@ -1,176 +0,0 @@
-# Copyright 2023 Google Inc.
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
---- !ruby/object:Api::Resource
-name: GameServerConfig
-references: !ruby/object:Api::Resource::ReferenceLinks
-  guides:
-    'Official Documentation': 'https://cloud.google.com/game-servers/docs'
-  api: 'https://cloud.google.com/game-servers/docs/reference/rest/v1beta/projects.locations.gameServerDeployments.configs'
-create_url: projects/{{project}}/locations/{{location}}/gameServerDeployments/{{deployment_id}}/configs?configId={{config_id}}
-base_url: projects/{{project}}/locations/{{location}}/gameServerDeployments/{{deployment_id}}/configs
-self_link: projects/{{project}}/locations/{{location}}/gameServerDeployments/{{deployment_id}}/configs/{{config_id}}
-immutable: true
-async: !ruby/object:Api::OpAsync
-  operation: !ruby/object:Api::OpAsync::Operation
-    path: 'name'
-    base_url: '{{op_id}}'
-    wait_ms: 1000
-  result: !ruby/object:Api::OpAsync::Result
-    path: 'response'
-    resource_inside_response: true
-  status: !ruby/object:Api::OpAsync::Status
-    path: 'done'
-    complete: true
-    allowed:
-      - true
-      - false
-  error: !ruby/object:Api::OpAsync::Error
-    path: 'error/errors'
-    message: 'message'
-description: A game server config resource. Configs are global and immutable.
-autogen_async: true
-import_format:
-  [
-    'projects/{{project}}/locations/{{location}}/gameServerDeployments/{{deployment_id}}/configs/{{config_id}}',
-  ]
-examples:
-  - !ruby/object:Provider::Terraform::Examples
-    name: 'game_service_config_basic'
-    primary_resource_id: 'default'
-    skip_test: true
-    vars:
-      deployment_id: 'tf-test-deployment'
-      config_id: 'tf-test-config'
-properties:
-  - !ruby/object:Api::Type::String
-    name: name
-    output: true
-    description: |-
-      The resource name of the game server config, in the form:
-
-      `projects/{project_id}/locations/{location}/gameServerDeployments/{deployment_id}/configs/{config_id}`.
-  - !ruby/object:Api::Type::String
-    name: configId
-    immutable: true
-    required: true
-    url_param_only: true
-    description: |
-      A unique id for the deployment config.
-  - !ruby/object:Api::Type::String
-    name: location
-    # The only acceptable location currently is 'global'
-    # TODO - either hard code or set as computed
-    url_param_only: true
-    default_value: global
-    description: Location of the Deployment.
-  - !ruby/object:Api::Type::ResourceRef
-    name: deploymentId
-    resource: 'GameServerDeployment'
-    imports: 'deploymentId'
-    immutable: true
-    required: true
-    url_param_only: true
-    description: |
-      A unique id for the deployment.
-  - !ruby/object:Api::Type::String
-    name: description
-    description: The description of the game server config.
-  - !ruby/object:Api::Type::KeyValuePairs
-    name: labels
-    description: |-
-      The labels associated with this game server config. Each label is a
-      key-value pair.
-  - !ruby/object:Api::Type::Array
-    name: fleetConfigs
-    required: true
-    description: |-
-      The fleet config contains list of fleet specs. In the Single Cloud, there
-      will be only one.
-    item_type: !ruby/object:Api::Type::NestedObject
-      properties:
-        - !ruby/object:Api::Type::String
-          required: true
-          name: fleetSpec
-          description: |
-            The fleet spec, which is sent to Agones to configure fleet.
-            The spec can be passed as inline json but it is recommended to use a file reference
-            instead. File references can contain the json or yaml format of the fleet spec. Eg:
-
-            * fleet_spec = jsonencode(yamldecode(file("fleet_configs.yaml")))
-            * fleet_spec = file("fleet_configs.json")
-
-            The format of the spec can be found :
-            `https://agones.dev/site/docs/reference/fleet/`.
-        - !ruby/object:Api::Type::String
-          name: name
-          required: true
-          description: The name of the FleetConfig.
-          default_from_api: true
-  - !ruby/object:Api::Type::Array
-    name: scalingConfigs
-    description: Optional. This contains the autoscaling settings.
-    item_type: !ruby/object:Api::Type::NestedObject
-      properties:
-        - !ruby/object:Api::Type::String
-          name: name
-          required: true
-          description: The name of the ScalingConfig
-        - !ruby/object:Api::Type::String
-          required: true
-          name: fleetAutoscalerSpec
-          description: |-
-            Fleet autoscaler spec, which is sent to Agones.
-            Example spec can be found :
-            https://agones.dev/site/docs/reference/fleetautoscaler/
-        - !ruby/object:Api::Type::Array
-          name: selectors
-          description: |-
-            Labels used to identify the clusters to which this scaling config
-            applies. A cluster is subject to this scaling config if its labels match
-            any of the selector entries.
-          item_type: !ruby/object:Api::Type::NestedObject
-            properties:
-              - !ruby/object:Api::Type::KeyValuePairs
-                name: labels
-                description: Set of labels to group by.
-        - !ruby/object:Api::Type::Array
-          name: schedules
-          description: The schedules to which this scaling config applies.
-          item_type: !ruby/object:Api::Type::NestedObject
-            properties:
-              - !ruby/object:Api::Type::String
-                name: startTime
-                description: |-
-                  The start time of the event.
-
-                  A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".
-              - !ruby/object:Api::Type::String
-                name: endTime
-                description: |-
-                  The end time of the event.
-
-                  A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".
-              - !ruby/object:Api::Type::String
-                name: cronJobDuration
-                description: |-
-                  The duration for the cron job event. The duration of the event is effective
-                  after the cron job's start time.
-
-                  A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s".
-              - !ruby/object:Api::Type::String
-                name: cronSpec
-                description: |-
-                  The cron definition of the scheduled event. See
-                  https://en.wikipedia.org/wiki/Cron. Cron spec specifies the local time as
-                  defined by the realm.
diff --git a/mmv1/products/gameservices/GameServerDeployment.yaml b/mmv1/products/gameservices/GameServerDeployment.yaml
deleted file mode 100644
index 041d44def02e..000000000000
--- a/mmv1/products/gameservices/GameServerDeployment.yaml
+++ /dev/null
@@ -1,87 +0,0 @@
-# Copyright 2023 Google Inc.
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
---- !ruby/object:Api::Resource
-name: GameServerDeployment
-references: !ruby/object:Api::Resource::ReferenceLinks
-  guides:
-    'Official Documentation': 'https://cloud.google.com/game-servers/docs'
-  api: 'https://cloud.google.com/game-servers/docs/reference/rest/v1beta/projects.locations.gameServerDeployments'
-base_url: projects/{{project}}/locations/{{location}}/gameServerDeployments
-create_url: projects/{{project}}/locations/{{location}}/gameServerDeployments?deploymentId={{deployment_id}}
-self_link: projects/{{project}}/locations/{{location}}/gameServerDeployments/{{deployment_id}}
-update_mask: true
-update_verb: :PATCH
-description: A game server deployment resource.
-async: !ruby/object:Api::OpAsync
-  operation: !ruby/object:Api::OpAsync::Operation
-    path: 'name'
-    base_url: '{{op_id}}'
-    wait_ms: 1000
-  result: !ruby/object:Api::OpAsync::Result
-    path: 'response'
-    resource_inside_response: true
-  status: !ruby/object:Api::OpAsync::Status
-    path: 'done'
-    complete: true
-    allowed:
-      - true
-      - false
-  error: !ruby/object:Api::OpAsync::Error
-    path: 'error/errors'
-    message: 'message'
-autogen_async: true
-import_format:
-  [
-    'projects/{{project}}/locations/{{location}}/gameServerDeployments/{{deployment_id}}',
-  ]
-examples:
-  - !ruby/object:Provider::Terraform::Examples
-    name: 'game_service_deployment_basic'
-    primary_resource_id: 'default'
-    skip_test: true
-    vars:
-      deployment_id: 'tf-test-deployment'
-properties:
-  - !ruby/object:Api::Type::String
-    name: name
-    output: true
-    description: |-
-      The resource id of the game server deployment, eg:
-
-      `projects/{project_id}/locations/{location}/gameServerDeployments/{deployment_id}`.
-      For example,
-
-      `projects/my-project/locations/{location}/gameServerDeployments/my-deployment`.
-  - !ruby/object:Api::Type::String
-    name: description
-    description: Human readable description of the game server deployment.
-  - !ruby/object:Api::Type::String
-    name: deploymentId
-    immutable: true
-    required: true
-    url_param_only: true
-    description: |
-      A unique id for the deployment.
-  - !ruby/object:Api::Type::String
-    name: location
-    # The only acceptable location currently is 'global'
-    # TODO - either hard code or set as computed
-    url_param_only: true
-    default_value: global
-    description: Location of the Deployment.
-  - !ruby/object:Api::Type::KeyValuePairs
-    name: labels
-    description: |-
-      The labels associated with this game server deployment. Each label is a
-      key-value pair.
diff --git a/mmv1/products/gameservices/GameServerDeploymentRollout.yaml b/mmv1/products/gameservices/GameServerDeploymentRollout.yaml
deleted file mode 100644
index 3b9cad5296de..000000000000
--- a/mmv1/products/gameservices/GameServerDeploymentRollout.yaml
+++ /dev/null
@@ -1,106 +0,0 @@
-# Copyright 2023 Google Inc.
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
---- !ruby/object:Api::Resource
-name: GameServerDeploymentRollout
-references: !ruby/object:Api::Resource::ReferenceLinks
-  guides:
-    'Official Documentation': 'https://cloud.google.com/game-servers/docs'
-  api: 'https://cloud.google.com/game-servers/docs/reference/rest/v1beta/GameServerDeploymentRollout'
-create_url: projects/{{project}}/locations/global/gameServerDeployments/{{deployment_id}}/rollout
-base_url: projects/{{project}}/locations/global/gameServerDeployments/{{deployment_id}}/rollout
-update_url: projects/{{project}}/locations/global/gameServerDeployments/{{deployment_id}}/rollout
-# Deleting a rollout is synonymous with removing the default game server config
-delete_url: projects/{{project}}/locations/global/gameServerDeployments/{{deployment_id}}/rollout?updateMask=defaultGameServerConfig
-update_verb: :PATCH
-delete_verb: :PATCH
-update_mask: true
-self_link: projects/{{project}}/locations/global/gameServerDeployments/{{deployment_id}}/rollout
-async: !ruby/object:Api::OpAsync
-  operation: !ruby/object:Api::OpAsync::Operation
-    path: 'name'
-    base_url: '{{op_id}}'
-    wait_ms: 1000
-  result: !ruby/object:Api::OpAsync::Result
-    path: 'response'
-    resource_inside_response: true
-  status: !ruby/object:Api::OpAsync::Status
-    path: 'done'
-    complete: true
-    allowed:
-      - true
-      - false
-  error: !ruby/object:Api::OpAsync::Error
-    path: 'error/errors'
-    message: 'message'
-description: |-
-  This represents the rollout state. This is part of the game server
-  deployment.
-import_format:
-  [
-    'projects/{{project}}/locations/global/gameServerDeployments/{{deployment_id}}/rollout',
-  ]
-examples:
-  - !ruby/object:Provider::Terraform::Examples
-    name: 'game_service_deployment_rollout_basic'
-    primary_resource_id: 'default'
-    skip_test: true
-    vars:
-      deployment_id: 'tf-test-deployment'
-      config_id: 'tf-test-config'
-custom_code: !ruby/object:Provider::Terraform::CustomCode
-  custom_create: 'templates/terraform/custom_create/gameservice_rollout_create.go'
-properties:
-  - !ruby/object:Api::Type::String
-    name: name
-    output: true
-    description: |-
-      The resource id of the game server deployment
-
-      eg: `projects/my-project/locations/global/gameServerDeployments/my-deployment/rollout`.
-  - !ruby/object:Api::Type::ResourceRef
-    name: deploymentId
-    resource: GameServerDeployment
-    url_param_only: true
-    required: true
-    imports: name
-    description: |
-      The deployment to rollout the new config to. Only 1 rollout must be associated with each deployment.
-  - !ruby/object:Api::Type::String
-    name: defaultGameServerConfig
-    required: true
-    description: |-
-      This field points to the game server config that is
-      applied by default to all realms and clusters. For example,
-
-      `projects/my-project/locations/global/gameServerDeployments/my-game/configs/my-config`.
-  - !ruby/object:Api::Type::Array
-    name: gameServerConfigOverrides
-    description: |-
-      The game_server_config_overrides contains the per game server config
-      overrides. The overrides are processed in the order they are listed. As
-      soon as a match is found for a cluster, the rest of the list is not
-      processed.
-    item_type: !ruby/object:Api::Type::NestedObject
-      properties:
-        - !ruby/object:Api::Type::NestedObject
-          name: realmsSelector
-          description: Selection by realms.
-          properties:
-            - !ruby/object:Api::Type::Array
-              name: realms
-              description: List of realms to match against.
-              item_type: Api::Type::String
-        - !ruby/object:Api::Type::String
-          name: configVersion
-          description: Version of the configuration.
diff --git a/mmv1/products/gameservices/Realm.yaml b/mmv1/products/gameservices/Realm.yaml
deleted file mode 100644
index 07a0f6f2c650..000000000000
--- a/mmv1/products/gameservices/Realm.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# Copyright 2023 Google Inc.
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
---- !ruby/object:Api::Resource
-name: Realm
-references: !ruby/object:Api::Resource::ReferenceLinks
-  guides:
-    'Official Documentation': 'https://cloud.google.com/game-servers/docs'
-  api: 'https://cloud.google.com/game-servers/docs/reference/rest/v1beta/projects.locations.realms'
-create_url: projects/{{project}}/locations/{{location}}/realms?realmId={{realm_id}}
-base_url: projects/{{project}}/locations/{{location}}/realms
-self_link: projects/{{project}}/locations/{{location}}/realms/{{realm_id}}
-update_verb: :PATCH
-update_mask: true
-description: A Realm resource.
-async: !ruby/object:Api::OpAsync
-  operation: !ruby/object:Api::OpAsync::Operation
-    path: 'name'
-    base_url: '{{op_id}}'
-    wait_ms: 1000
-  result: !ruby/object:Api::OpAsync::Result
-    path: 'response'
-    resource_inside_response: true
-  status: !ruby/object:Api::OpAsync::Status
-    path: 'done'
-    complete: true
-    allowed:
-      - true
-      - false
-  error: !ruby/object:Api::OpAsync::Error
-    path: 'error/errors'
-    message: 'message'
-autogen_async: true
-import_format:
-  ['projects/{{project}}/locations/{{location}}/realms/{{realm_id}}']
-examples:
-  - !ruby/object:Provider::Terraform::Examples
-    name: 'game_service_realm_basic'
-    primary_resource_id: 'default'
-    skip_test: true
-    vars:
-      realm_id: 'tf-test-realm'
-parameters:
-  - !ruby/object:Api::Type::String
-    name: location
-    url_param_only: true
-    default_value: global
-    description: Location of the Realm.
-  - !ruby/object:Api::Type::String
-    name: realmId
-    immutable: true
-    url_param_only: true
-    required: true
-    description: GCP region of the Realm.
-properties:
-  - !ruby/object:Api::Type::String
-    name: name
-    output: true
-    description: |-
-      The resource id of the realm, of the form:
-      `projects/{project_id}/locations/{location}/realms/{realm_id}`. For
-      example, `projects/my-project/locations/{location}/realms/my-realm`.
-  - !ruby/object:Api::Type::KeyValuePairs
-    name: labels
-    description:
-      The labels associated with this realm. Each label is a key-value pair.
-  - !ruby/object:Api::Type::String
-    name: timeZone
-    required: true
-    description: |-
-      Required. Time zone where all realm-specific policies are evaluated. The value of
-      this field must be from the IANA time zone database:
-      https://www.iana.org/time-zones.
-  - !ruby/object:Api::Type::String
-    name: etag
-    output: true
-    description: ETag of the resource.
-  - !ruby/object:Api::Type::String
-    name: description
-    description: Human readable description of the realm.
diff --git a/mmv1/products/gkebackup/BackupPlan.yaml b/mmv1/products/gkebackup/BackupPlan.yaml
index 28172b41460f..0f66592368ff 100644
--- a/mmv1/products/gkebackup/BackupPlan.yaml
+++ b/mmv1/products/gkebackup/BackupPlan.yaml
@@ -44,6 +44,11 @@ examples:
     vars:
       name: 'basic-plan'
       cluster_name: 'basic-cluster'
+      deletion_protection: 'true'
+    test_vars_overrides:
+      deletion_protection: 'false'
+    oics_vars_overrides:
+      deletion_protection: 'false'
     test_env_vars:
       project: :PROJECT_NAME
   - !ruby/object:Provider::Terraform::Examples
@@ -52,6 +57,11 @@ examples:
     vars:
       name: 'autopilot-plan'
       cluster_name: 'autopilot-cluster'
+      deletion_protection: 'true'
+    test_vars_overrides:
+      deletion_protection: 'false'
+    oics_vars_overrides:
+      deletion_protection: 'false'
   - !ruby/object:Provider::Terraform::Examples
     name: 'gkebackup_backupplan_cmek'
     primary_resource_id: 'cmek'
@@ -59,6 +69,11 @@ examples:
       name: 'cmek-plan'
       cluster_name: 'cmek-cluster'
       key_name: 'backup-key'
+      deletion_protection: 'true'
+    test_vars_overrides:
+      deletion_protection: 'false'
+    oics_vars_overrides:
+      deletion_protection: 'false'
     test_env_vars:
       project: :PROJECT_NAME
   - !ruby/object:Provider::Terraform::Examples
@@ -67,6 +82,11 @@ examples:
     vars:
       name: 'full-plan'
       cluster_name: 'full-cluster'
+      deletion_protection: 'true'
+    test_vars_overrides:
+      deletion_protection: 'false'
+    oics_vars_overrides:
+      deletion_protection: 'false'
     test_env_vars:
       project: :PROJECT_NAME
 skip_sweeper: true
@@ -138,8 +158,8 @@ properties:
           If set to True, no further update is allowed on this policy, including
           the locked field itself.
         default_from_api: true
-  - !ruby/object:Api::Type::KeyValuePairs
-    name: labels
+  - !ruby/object:Api::Type::KeyValueLabels
+    name: 'labels'
     description: |
       Description: A set of custom labels supplied by the user.
       A list of key->value pairs.
diff --git a/mmv1/products/gkebackup/RestorePlan.yaml b/mmv1/products/gkebackup/RestorePlan.yaml
new file mode 100644
index 000000000000..c70bda73c22d
--- /dev/null
+++ b/mmv1/products/gkebackup/RestorePlan.yaml
@@ -0,0 +1,485 @@
+# Copyright 2023 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+--- !ruby/object:Api::Resource
+name: 'RestorePlan'
+base_url: 'projects/{{project}}/locations/{{location}}/restorePlans'
+create_url: projects/{{project}}/locations/{{location}}/restorePlans?restorePlanId={{name}}
+update_verb: :PATCH
+update_mask: true
+description: |
+  Represents a Restore Plan instance.
+references: !ruby/object:Api::Resource::ReferenceLinks
+  guides:
+    'Official Documentation': 'https://cloud.google.com/kubernetes-engine/docs/add-on/backup-for-gke'
+  api: 'https://cloud.google.com/kubernetes-engine/docs/add-on/backup-for-gke/reference/rest/v1/projects.locations.restorePlans'
+iam_policy: !ruby/object:Api::Resource::IamPolicy
+  method_name_separator: ':'
+  parent_resource_attribute: 'name'
+  base_url: projects/{{project}}/locations/{{location}}/restorePlans/{{name}}
+  import_format:
+    [
+      'projects/{{project}}/locations/{{location}}/restorePlans/{{name}}',
+      '{{name}}',
+    ]
+timeouts: !ruby/object:Api::Timeouts
+autogen_async: true
+examples:
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'gkebackup_restoreplan_all_namespaces'
+    primary_resource_id: 'all_ns'
+    primary_resource_name: "fmt.Sprintf(\"tf-test-restore-all-ns%s\",
+      context[\"random_suffix\"\
+      ])"
+    vars:
+      name: 'restore-all-ns'
+    test_env_vars:
+      project: :PROJECT_NAME
+      deletion_protection: 'true'
+    test_vars_overrides:
+      deletion_protection: 'false'
+    oics_vars_overrides:
+      deletion_protection: 'false'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'gkebackup_restoreplan_rollback_namespace'
+    primary_resource_id: 'rollback_ns'
+    vars:
+      name: 'rollback-ns'
+    test_env_vars:
+      project: :PROJECT_NAME
+      deletion_protection: 'true'
+    test_vars_overrides:
+      deletion_protection: 'false'
+    oics_vars_overrides:
+      deletion_protection: 'false'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'gkebackup_restoreplan_protected_application'
+    primary_resource_id: 'rollback_app'
+    vars:
+      name: 'rollback-app'
+    test_env_vars:
+      project: :PROJECT_NAME
+      deletion_protection: 'true'
+    test_vars_overrides:
+      deletion_protection: 'false'
+    oics_vars_overrides:
+      deletion_protection: 'false'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'gkebackup_restoreplan_all_cluster_resources'
+    primary_resource_id: 'all_cluster_resources'
+    vars:
+      name: 'all-groupkinds'
+    test_env_vars:
+      project: :PROJECT_NAME
+      deletion_protection: 'true'
+    test_vars_overrides:
+      deletion_protection: 'false'
+    oics_vars_overrides:
+      deletion_protection: 'false'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'gkebackup_restoreplan_rename_namespace'
+    primary_resource_id: 'rename_ns'
+    vars:
+      name: 'rename-ns'
+    test_env_vars:
+      project: :PROJECT_NAME
+      deletion_protection: 'true'
+    test_vars_overrides:
+      deletion_protection: 'false'
+    oics_vars_overrides:
+      deletion_protection: 'false'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'gkebackup_restoreplan_second_transformation'
+    primary_resource_id: 'transform_rule'
+    vars:
+      name: 'transform-rule'
+    test_env_vars:
+      project: :PROJECT_NAME
+      deletion_protection: 'true'
+    test_vars_overrides:
+      deletion_protection: 'false'
+    oics_vars_overrides:
+      deletion_protection: 'false'
+skip_sweeper: true
+parameters:
+  - !ruby/object:Api::Type::String
+    name: 'location'
+    url_param_only: true
+    required: true
+    immutable: true
+    description: |
+      The region of the Restore Plan.
+properties:
+  - !ruby/object:Api::Type::String
+    name: name
+    required: true
+    immutable: true
+    description: |
+      The full name of the BackupPlan Resource.
+    custom_expand: 'templates/terraform/custom_expand/shortname_to_url.go.erb'
+    custom_flatten: 'templates/terraform/custom_flatten/name_from_self_link.erb'
+  - !ruby/object:Api::Type::String
+    name: uid
+    output: true
+    description: |
+      Server generated, unique identifier of UUID format.
+  - !ruby/object:Api::Type::String
+    name: description
+    description: |
+      User specified descriptive string for this RestorePlan.
+  - !ruby/object:Api::Type::KeyValueLabels
+    name: labels
+    description: |
+      Description: A set of custom labels supplied by the user.
+      A list of key->value pairs.
+      Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+  - !ruby/object:Api::Type::String
+    name: 'backupPlan'
+    required: true
+    immutable: true
+    description: |
+      A reference to the BackupPlan from which Backups may be used
+      as the source for Restores created via this RestorePlan.
+  - !ruby/object:Api::Type::String
+    name: 'cluster'
+    required: true
+    immutable: true
+    description: |
+      The source cluster from which Restores will be created via this RestorePlan.
+  - !ruby/object:Api::Type::NestedObject
+    name: restoreConfig
+    required: true
+    description: |
+      Defines the configuration of Restores created via this RestorePlan.
+    properties:
+      - !ruby/object:Api::Type::Boolean
+        name: allNamespaces
+        description: |
+          If True, restore all namespaced resources in the Backup.
+          Setting this field to False will result in an error.
+        exactly_one_of:
+          - restoreConfig.0.allNamespaces
+          - restoreConfig.0.excludedNamespaces
+          - restoreConfig.0.selectedNamespaces
+          - restoreConfig.0.selectedApplications
+          - restoreConfig.0.noNamespaces
+      - !ruby/object:Api::Type::NestedObject
+        name: excludedNamespaces
+        description: |
+          A list of selected namespaces excluded from restoration.
+          All namespaces except those in this list will be restored.
+        exactly_one_of:
+          - restoreConfig.0.allNamespaces
+          - restoreConfig.0.excludedNamespaces
+          - restoreConfig.0.selectedNamespaces
+          - restoreConfig.0.selectedApplications
+          - restoreConfig.0.noNamespaces
+        properties:
+          - !ruby/object:Api::Type::Array
+            name: namespaces
+            required: true
+            description: |
+              A list of Kubernetes Namespaces.
+            item_type: Api::Type::String
+      - !ruby/object:Api::Type::NestedObject
+        name: selectedNamespaces
+        description: |
+          A list of selected namespaces to restore from the Backup.
+          The listed Namespaces and all resources contained in them will be restored.
+        exactly_one_of:
+          - restoreConfig.0.allNamespaces
+          - restoreConfig.0.excludedNamespaces
+          - restoreConfig.0.selectedNamespaces
+          - restoreConfig.0.selectedApplications
+          - restoreConfig.0.noNamespaces
+        properties:
+          - !ruby/object:Api::Type::Array
+            name: namespaces
+            required: true
+            description: |
+              A list of Kubernetes Namespaces.
+            item_type: Api::Type::String
+      - !ruby/object:Api::Type::NestedObject
+        name: selectedApplications
+        description: |
+          A list of selected ProtectedApplications to restore.
+          The listed ProtectedApplications and all the resources
+          to which they refer will be restored.
+        exactly_one_of:
+          - restoreConfig.0.allNamespaces
+          - restoreConfig.0.excludedNamespaces
+          - restoreConfig.0.selectedNamespaces
+          - restoreConfig.0.selectedApplications
+          - restoreConfig.0.noNamespaces
+        properties:
+          - !ruby/object:Api::Type::Array
+            name: namespacedNames
+            required: true
+            description: |
+              A list of namespaced Kubernetes resources.
+            item_type: !ruby/object:Api::Type::NestedObject
+              properties:
+                - !ruby/object:Api::Type::String
+                  name: namespace
+                  required: true
+                  description: |
+                    The namespace of a Kubernetes Resource.
+                - !ruby/object:Api::Type::String
+                  name: name
+                  required: true
+                  description: |
+                    The name of a Kubernetes Resource.
+      - !ruby/object:Api::Type::Boolean
+        name: noNamespaces
+        description: |
+          Do not restore any namespaced resources if set to "True".
+          Specifying this field to "False" is not allowed.
+        exactly_one_of:
+          - restoreConfig.0.allNamespaces
+          - restoreConfig.0.excludedNamespaces
+          - restoreConfig.0.selectedNamespaces
+          - restoreConfig.0.selectedApplications
+          - restoreConfig.0.noNamespaces
+      - !ruby/object:Api::Type::Enum
+        name: namespacedResourceRestoreMode
+        description: |
+          Defines the behavior for handling the situation where sets of namespaced resources
+          being restored already exist in the target cluster.
+          This MUST be set to a value other than `NAMESPACED_RESOURCE_RESTORE_MODE_UNSPECIFIED`
+          if the `namespacedResourceRestoreScope` is anything other than `noNamespaces`.
+          See https://cloud.google.com/kubernetes-engine/docs/add-on/backup-for-gke/reference/rest/v1/RestoreConfig#namespacedresourcerestoremode
+          for more information on each mode.
+        values:
+          - :DELETE_AND_RESTORE
+          - :FAIL_ON_CONFLICT
+      - !ruby/object:Api::Type::Enum
+        name: volumeDataRestorePolicy
+        description: |
+          Specifies the mechanism to be used to restore volume data.
+          This should be set to a value other than `NAMESPACED_RESOURCE_RESTORE_MODE_UNSPECIFIED`
+          if the `namespacedResourceRestoreScope` is anything other than `noNamespaces`.
+          If not specified, it will be treated as `NO_VOLUME_DATA_RESTORATION`.
+          See https://cloud.google.com/kubernetes-engine/docs/add-on/backup-for-gke/reference/rest/v1/RestoreConfig#VolumeDataRestorePolicy
+          for more information on each policy option.
+        values:
+          - :RESTORE_VOLUME_DATA_FROM_BACKUP
+          - :REUSE_VOLUME_HANDLE_FROM_BACKUP
+          - :NO_VOLUME_DATA_RESTORATION
+      - !ruby/object:Api::Type::NestedObject
+        name: clusterResourceRestoreScope
+        description: |
+          Identifies the cluster-scoped resources to restore from the Backup.
+        properties:
+          - !ruby/object:Api::Type::Boolean
+            name: allGroupKinds
+            description: |
+              If True, all valid cluster-scoped resources will be restored.
+              Mutually exclusive to any other field in `clusterResourceRestoreScope`.
+            exactly_one_of:
+              - restoreConfig.0.clusterResourceRestoreScope.0.allGroupKinds
+              - restoreConfig.0.clusterResourceRestoreScope.0.excludedGroupKinds
+              - restoreConfig.0.clusterResourceRestoreScope.0.selectedGroupKinds
+              - restoreConfig.0.clusterResourceRestoreScope.0.noGroupKinds
+          - !ruby/object:Api::Type::Array
+            name: excludedGroupKinds
+            description: |
+              A list of cluster-scoped resource group kinds to NOT restore from the backup.
+              If specified, all valid cluster-scoped resources will be restored except
+              for those specified in the list.
+              Mutually exclusive to any other field in `clusterResourceRestoreScope`.
+            exactly_one_of:
+              - restoreConfig.0.clusterResourceRestoreScope.0.allGroupKinds
+              - restoreConfig.0.clusterResourceRestoreScope.0.excludedGroupKinds
+              - restoreConfig.0.clusterResourceRestoreScope.0.selectedGroupKinds
+              - restoreConfig.0.clusterResourceRestoreScope.0.noGroupKinds
+            item_type: !ruby/object:Api::Type::NestedObject
+              required: true
+              properties:
+                - !ruby/object:Api::Type::String
+                  name: resourceGroup
+                  description: |
+                    API Group string of a Kubernetes resource, e.g.
+                    "apiextensions.k8s.io", "storage.k8s.io", etc.
+                    Use empty string for core group.
+                - !ruby/object:Api::Type::String
+                  name: resourceKind
+                  description: |
+                    Kind of a Kubernetes resource, e.g.
+                    "CustomResourceDefinition", "StorageClass", etc.
+          - !ruby/object:Api::Type::Array
+            name: selectedGroupKinds
+            description: |
+              A list of cluster-scoped resource group kinds to restore from the backup.
+              If specified, only the selected resources will be restored.
+              Mutually exclusive to any other field in the `clusterResourceRestoreScope`.
+            exactly_one_of:
+              - restoreConfig.0.clusterResourceRestoreScope.0.allGroupKinds
+              - restoreConfig.0.clusterResourceRestoreScope.0.excludedGroupKinds
+              - restoreConfig.0.clusterResourceRestoreScope.0.selectedGroupKinds
+              - restoreConfig.0.clusterResourceRestoreScope.0.noGroupKinds
+            item_type: !ruby/object:Api::Type::NestedObject
+              required: true
+              properties:
+                - !ruby/object:Api::Type::String
+                  name: resourceGroup
+                  description: |
+                    API Group string of a Kubernetes resource, e.g.
+                    "apiextensions.k8s.io", "storage.k8s.io", etc.
+                    Use empty string for core group.
+                - !ruby/object:Api::Type::String
+                  name: resourceKind
+                  description: |
+                    Kind of a Kubernetes resource, e.g.
+                    "CustomResourceDefinition", "StorageClass", etc.
+          - !ruby/object:Api::Type::Boolean
+            name: noGroupKinds
+            description: |
+              If True, no cluster-scoped resources will be restored.
+              Mutually exclusive to any other field in `clusterResourceRestoreScope`.
+            exactly_one_of:
+              - restoreConfig.0.clusterResourceRestoreScope.0.allGroupKinds
+              - restoreConfig.0.clusterResourceRestoreScope.0.excludedGroupKinds
+              - restoreConfig.0.clusterResourceRestoreScope.0.selectedGroupKinds
+              - restoreConfig.0.clusterResourceRestoreScope.0.noGroupKinds
+      - !ruby/object:Api::Type::Enum
+        name: clusterResourceConflictPolicy
+        description: |
+          Defines the behavior for handling the situation where cluster-scoped resources
+          being restored already exist in the target cluster.
+          This MUST be set to a value other than `CLUSTER_RESOURCE_CONFLICT_POLICY_UNSPECIFIED`
+          if `clusterResourceRestoreScope` is anyting other than `noGroupKinds`.
+          See https://cloud.google.com/kubernetes-engine/docs/add-on/backup-for-gke/reference/rest/v1/RestoreConfig#clusterresourceconflictpolicy
+          for more information on each policy option.
+        values:
+          - :USE_EXISTING_VERSION
+          - :USE_BACKUP_VERSION
+      - !ruby/object:Api::Type::Array
+        name: transformationRules
+        description: |
+          A list of transformation rules to be applied against Kubernetes
+          resources as they are selected for restoration from a Backup.
+          Rules are executed in order defined - this order matters,
+          as changes made by a rule may impact the filtering logic of subsequent
+          rules. An empty list means no transformation will occur.
+        item_type: !ruby/object:Api::Type::NestedObject
+          required: true
+          description: |
+            A transformation rule to be applied against Kubernetes resources
+            as they are selected for restoration from a Backup.
+            A rule contains both filtering logic
+            (which resources are subject to transform) and transformation logic.
+          properties:
+            - !ruby/object:Api::Type::String
+              name: description
+              description: |
+                The description is a user specified string description
+                of the transformation rule.
+            - !ruby/object:Api::Type::NestedObject
+              name: resourceFilter
+              description: |
+                This field is used to specify a set of fields that should be used to
+                determine which resources in backup should be acted upon by the
+                supplied transformation rule actions, and this will ensure that only
+                specific resources are affected by transformation rule actions.
+              properties:
+                - !ruby/object:Api::Type::Array
+                  name: namespaces
+                  description: |
+                    (Filtering parameter) Any resource subject to transformation must
+                    be contained within one of the listed Kubernetes Namespace in the
+                    Backup. If this field is not provided, no namespace filtering will
+                    be performed (all resources in all Namespaces, including all
+                    cluster-scoped resources, will be candidates for transformation).
+                    To mix cluster-scoped and namespaced resources in the same rule,
+                    use an empty string ("") as one of the target namespaces.
+                  item_type: Api::Type::String
+                - !ruby/object:Api::Type::Array
+                  name: groupKinds
+                  description: |
+                    (Filtering parameter) Any resource subject to transformation must
+                    belong to one of the listed "types". If this field is not provided,
+                    no type filtering will be performed
+                    (all resources of all types matching previous filtering parameters
+                    will be candidates for transformation).
+                  item_type: !ruby/object:Api::Type::NestedObject
+                    required: true
+                    properties:
+                      - !ruby/object:Api::Type::String
+                        name: resourceGroup
+                        description: |
+                          API Group string of a Kubernetes resource, e.g.
+                          "apiextensions.k8s.io", "storage.k8s.io", etc.
+                          Use empty string for core group.
+                      - !ruby/object:Api::Type::String
+                        name: resourceKind
+                        description: |
+                          Kind of a Kubernetes resource, e.g.
+                          "CustomResourceDefinition", "StorageClass", etc.
+                - !ruby/object:Api::Type::String
+                  name: jsonPath
+                  description: |
+                    This is a JSONPath expression that matches specific fields of
+                    candidate resources and it operates as a filtering parameter
+                    (resources that are not matched with this expression will not
+                    be candidates for transformation).
+            - !ruby/object:Api::Type::Array
+              name: fieldActions
+              required: true
+              description: |
+                A list of transformation rule actions to take against candidate
+                resources. Actions are executed in order defined - this order
+                matters, as they could potentially interfere with each other and
+                the first operation could affect the outcome of the second operation.
+              item_type: !ruby/object:Api::Type::NestedObject
+                required: true
+                description: |
+                  TransformationRuleAction defines a TransformationRule action
+                  based on the JSON Patch RFC (https://www.rfc-editor.org/rfc/rfc6902)
+                properties:
+                  - !ruby/object:Api::Type::Enum
+                    name: op
+                    required: true
+                    description: |
+                      Specifies the operation to perform.
+                    values:
+                      - :REMOVE
+                      - :MOVE
+                      - :COPY
+                      - :ADD
+                      - :TEST
+                      - :REPLACE
+                  - !ruby/object:Api::Type::String
+                    name: fromPath
+                    description: |
+                      A string containing a JSON Pointer value that references the
+                      location in the target document to move the value from.
+                  - !ruby/object:Api::Type::String
+                    name: path
+                    description: |
+                      A string containing a JSON-Pointer value that references a
+                      location within the target document where the operation is performed.
+                  - !ruby/object:Api::Type::String
+                    name: value
+                    description: |
+                      A string that specifies the desired value in string format
+                      to use for transformation.
+  - !ruby/object:Api::Type::String
+    name: state
+    output: true
+    description: |
+      The State of the RestorePlan.
+  - !ruby/object:Api::Type::String
+    name: stateReason
+    output: true
+    description: |
+      Detailed description of why RestorePlan is in its current state.
diff --git a/mmv1/products/gkehub/Membership.yaml b/mmv1/products/gkehub/Membership.yaml
index a73d65715fd6..9549ba0f13ba 100644
--- a/mmv1/products/gkehub/Membership.yaml
+++ b/mmv1/products/gkehub/Membership.yaml
@@ -13,10 +13,10 @@
 
 --- !ruby/object:Api::Resource
 name: 'Membership'
-base_url: 'projects/{{project}}/locations/global/memberships'
-create_url: 'projects/{{project}}/locations/global/memberships?membershipId={{membership_id}}'
-update_url: 'projects/{{project}}/locations/global/memberships/{{membership_id}}'
-self_link: 'projects/{{project}}/locations/global/memberships/{{membership_id}}'
+base_url: 'projects/{{project}}/locations/{{location}}/memberships'
+create_url: 'projects/{{project}}/locations/{{location}}/memberships?membershipId={{membership_id}}'
+update_url: 'projects/{{project}}/locations/{{location}}/memberships/{{membership_id}}'
+self_link: 'projects/{{project}}/locations/{{location}}/memberships/{{membership_id}}'
 update_verb: :PATCH
 update_mask: true
 description: |
@@ -52,7 +52,19 @@ iam_policy: !ruby/object:Api::Resource::IamPolicy
       '{{membership_id}}',
     ]
 autogen_async: true
+schema_version: 1
+state_upgraders: true
 examples:
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'gkehub_membership_regional'
+    primary_resource_name: 'fmt.Sprintf("basic%s", context["random_suffix"])'
+    primary_resource_id: 'membership'
+    vars:
+      name: 'basic'
+      cluster_name: 'basiccluster'
+    test_env_vars:
+      project: :PROJECT_NAME
+      location: :REGION
   - !ruby/object:Provider::Terraform::Examples
     name: 'gkehub_membership_basic'
     primary_resource_name: 'fmt.Sprintf("basic%s", context["random_suffix"])'
@@ -60,21 +72,40 @@ examples:
     vars:
       name: 'basic'
       cluster_name: 'basiccluster'
+      deletion_protection: 'true'
+    test_vars_overrides:
+      deletion_protection: 'false'
+    oics_vars_overrides:
+      deletion_protection: 'false'
   - !ruby/object:Provider::Terraform::Examples
     name: 'gkehub_membership_issuer'
     primary_resource_id: 'membership'
     vars:
       name: 'basic'
       cluster_name: 'basiccluster'
+      deletion_protection: 'true'
+    test_vars_overrides:
+      deletion_protection: 'false'
+    oics_vars_overrides:
+      deletion_protection: 'false'
     test_env_vars:
       project: :PROJECT_NAME
 # Skip sweeper gen since this is a child resource.
 skip_sweeper: true
-id_format: 'projects/{{project}}/locations/global/memberships/{{membership_id}}'
+id_format: 'projects/{{project}}/locations/{{location}}/memberships/{{membership_id}}'
 import_format:
-  ['projects/{{project}}/locations/global/memberships/{{membership_id}}']
+  ['projects/{{project}}/locations/{{location}}/memberships/{{membership_id}}']
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   constants: templates/terraform/constants/gke_hub_membership_diff.go
+parameters:
+  - !ruby/object:Api::Type::String
+    name: 'location'
+    immutable: true
+    default_value: global
+    url_param_only: true
+    description: |
+      Location of the membership.
+      The default value is `global`.
 properties:
   - !ruby/object:Api::Type::String
     name: 'membershipId'
@@ -95,7 +126,7 @@ properties:
     min_version: beta
     description: |
       The name of this entity type to be displayed on the console. This field is unavailable in v1 of the API.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Labels to apply to this membership.
diff --git a/mmv1/products/gkehub2/Feature.yaml b/mmv1/products/gkehub2/Feature.yaml
index e2621d30a24c..32d917f0b708 100644
--- a/mmv1/products/gkehub2/Feature.yaml
+++ b/mmv1/products/gkehub2/Feature.yaml
@@ -83,6 +83,16 @@ examples:
     skip_test: true
     primary_resource_name: 'fmt.Sprint("fleetobservability")'
     primary_resource_id: 'feature'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'enable_fleet_default_member_config_service_mesh'
+    skip_test: true
+    primary_resource_name: 'fmt.Sprintf("servicemesh")'
+    primary_resource_id: 'feature'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'enable_fleet_default_member_config_configmanagement'
+    skip_test: true
+    primary_resource_name: 'fmt.Sprintf("configmanagement")'
+    primary_resource_id: 'feature'
 autogen_async: true
 # Skip sweeper gen since this is a child resource.
 skip_sweeper: true
@@ -105,8 +115,8 @@ properties:
     diff_suppress_func: 'tpgresource.CompareSelfLinkOrResourceName'
     custom_expand: templates/terraform/custom_expand/resource_from_self_link.go.erb
     custom_flatten: templates/terraform/custom_flatten/name_from_self_link.erb
-  - !ruby/object:Api::Type::KeyValuePairs
-    name: labels
+  - !ruby/object:Api::Type::KeyValueLabels
+    name: 'labels'
     description: GCP labels for this Feature.
   - !ruby/object:Api::Type::NestedObject
     name: resourceState
@@ -170,6 +180,85 @@ properties:
                       - :MODE_UNSPECIFIED
                       - :COPY
                       - :MOVE
+  - !ruby/object:Api::Type::NestedObject
+    name: fleetDefaultMemberConfig
+    description: Optional. Fleet Default Membership Configuration.
+    properties:
+      - !ruby/object:Api::Type::NestedObject
+        name: mesh
+        description: Service Mesh spec
+        properties:
+          - !ruby/object:Api::Type::Enum
+            name: management
+            description: 'Whether to automatically manage Service Mesh'
+            values:
+              - :MANAGEMENT_UNSPECIFIED
+              - :MANAGEMENT_AUTOMATIC
+              - :MANAGEMENT_MANUAL
+            required: true
+      - !ruby/object:Api::Type::NestedObject
+        name: configmanagement
+        description: Config Management spec
+        properties:
+          - !ruby/object:Api::Type::NestedObject
+            name: configSync
+            description: 'ConfigSync configuration for the cluster'
+            properties:
+              - !ruby/object:Api::Type::String
+                name: sourceFormat
+                description: 'Specifies whether the Config Sync Repo is in hierarchical or unstructured mode'
+              - !ruby/object:Api::Type::NestedObject
+                name: git
+                description: 'Git repo configuration for the cluster'
+                properties:
+                  - !ruby/object:Api::Type::String
+                    name: syncRepo
+                    description: 'The URL of the Git repository to use as the source of truth'
+                  - !ruby/object:Api::Type::String
+                    name: syncBranch
+                    description: 'The branch of the repository to sync from. Default: master'
+                  - !ruby/object:Api::Type::String
+                    name: policyDir
+                    description: 'The path within the Git repository that represents the top level of the repo to sync'
+                  - !ruby/object:Api::Type::String
+                    name: syncRev
+                    description: 'Git revision (tag or hash) to check out. Default HEAD'
+                  - !ruby/object:Api::Type::String
+                    name: secretType
+                    description: 'Type of secret configured for access to the Git repo'
+                    required: true
+                  - !ruby/object:Api::Type::String
+                    name: httpsProxy
+                    description: 'URL for the HTTPS Proxy to be used when communicating with the Git repo'
+                  - !ruby/object:Api::Type::String
+                    name: gcpServiceAccountEmail
+                    description: 'The Google Cloud Service Account Email used for auth when secretType is gcpServiceAccount'
+                  - !ruby/object:Api::Type::String
+                    name: syncWaitSecs
+                    description: 'Period in seconds between consecutive syncs. Default: 15'
+              - !ruby/object:Api::Type::NestedObject
+                name: oci
+                description: 'OCI repo configuration for the cluster'
+                properties:
+                  - !ruby/object:Api::Type::String
+                    name: syncRepo
+                    description: 'The OCI image repository URL for the package to sync from'
+                  - !ruby/object:Api::Type::String
+                    name: policyDir
+                    description: 'The absolute path of the directory that contains the local resources. Default: the root directory of the image'
+                  - !ruby/object:Api::Type::String
+                    name: secretType
+                    description: 'Type of secret configured for access to the Git repo'
+                    required: true
+                  - !ruby/object:Api::Type::String
+                    name: gcpServiceAccountEmail
+                    description: 'The Google Cloud Service Account Email used for auth when secretType is gcpServiceAccount'
+                  - !ruby/object:Api::Type::String
+                    name: syncWaitSecs
+                    description: 'Period in seconds between consecutive syncs. Default: 15'
+                  - !ruby/object:Api::Type::String
+                    name: version
+                    description: 'Version of ACM installed'
   - !ruby/object:Api::Type::NestedObject
     name: state
     description: Output only. The Hub-wide Feature state
diff --git a/mmv1/products/gkehub2/Fleet.yaml b/mmv1/products/gkehub2/Fleet.yaml
new file mode 100644
index 000000000000..9a03d3b8fb48
--- /dev/null
+++ b/mmv1/products/gkehub2/Fleet.yaml
@@ -0,0 +1,97 @@
+# Copyright 2023 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+---
+!ruby/object:Api::Resource
+name: "Fleet"
+base_url: "projects/{{project}}/locations/global/fleets"
+create_url: "projects/{{project}}/locations/global/fleets"
+update_url: "projects/{{project}}/locations/global/fleets/default"
+self_link: "projects/{{project}}/locations/global/fleets/default"
+update_verb: :PATCH
+update_mask: true
+description: |
+  Fleet contains information about a group of clusters.
+references: !ruby/object:Api::Resource::ReferenceLinks
+  guides:
+    "Registering a Cluster to a Fleet": "https://cloud.google.com/anthos/multicluster-management/connect/registering-a-cluster#register_cluster"
+  api: "https://cloud.google.com/anthos/multicluster-management/reference/rest/v1/projects.locations.fleets"
+async: !ruby/object:Api::OpAsync
+  operation: !ruby/object:Api::OpAsync::Operation
+    kind: "gkehub#operation"
+    path: "name"
+    base_url: "{{op_id}}"
+    wait_ms: 1000
+  result: !ruby/object:Api::OpAsync::Result
+    path: "response"
+    resource_inside_response: true
+  status: !ruby/object:Api::OpAsync::Status
+    path: "done"
+    complete: "true"
+    allowed:
+      - "true"
+      - "false"
+  error: !ruby/object:Api::OpAsync::Error
+    path: "error/errors"
+    message: "message"
+autogen_async: true
+examples:
+  - !ruby/object:Provider::Terraform::Examples
+    name: "gkehub_fleet_basic"
+    skip_test: true
+    primary_resource_id: 'default'
+id_format: "projects/{{project}}/locations/global/fleets/default"
+import_format: ["projects/{{project}}/locations/global/fleets/default"]
+properties:
+  - !ruby/object:Api::Type::String
+    name: "displayName"
+    description: |
+      A user-assigned display name of the Fleet. When present, it must be between 4 to 30 characters.
+      Allowed characters are: lowercase and uppercase letters, numbers, hyphen, single-quote, double-quote, space, and exclamation point.
+  - !ruby/object:Api::Type::Time
+    name: "createTime"
+    description: |
+      The time the fleet was created, in RFC3339 text format.
+    output: true
+  - !ruby/object:Api::Type::Time
+    name: "updateTime"
+    description: |
+      The time the fleet was last updated, in RFC3339 text format.
+    output: true
+  - !ruby/object:Api::Type::Time
+    name: "deleteTime"
+    description: |
+      The time the fleet was deleted, in RFC3339 text format.
+    output: true
+  - !ruby/object:Api::Type::String
+    name: "uid"
+    output: true
+    description: |
+      Google-generated UUID for this resource. This is unique across all
+      Fleet resources. If a Fleet resource is deleted and another
+      resource with the same name is created, it gets a different uid.
+  - !ruby/object:Api::Type::NestedObject
+    name: "state"
+    description: The state of the fleet resource.
+    output: true
+    properties:
+      - !ruby/object:Api::Type::Enum
+        name: "code"
+        description: Describes the state of a Fleet resource.
+        output: true
+        values:
+          - CODE_UNSPECIFIED
+          - CREATING
+          - READY
+          - DELETING
+          - UPDATING
diff --git a/mmv1/products/gkehub2/MembershipBinding.yaml b/mmv1/products/gkehub2/MembershipBinding.yaml
index b3ff846f787f..ec9d61a0d72a 100644
--- a/mmv1/products/gkehub2/MembershipBinding.yaml
+++ b/mmv1/products/gkehub2/MembershipBinding.yaml
@@ -48,9 +48,14 @@ examples:
   - !ruby/object:Provider::Terraform::Examples
     name: "gkehub_membership_binding_basic"
     primary_resource_name: "fmt.Sprintf(\"tf-test-membership%s\", context[\"random_suffix\"]), fmt.Sprintf(\"tf-test-membership-binding%s\", context[\"random_suffix\"])"
-    primary_resource_id: "example"
+    primary_resource_id: "membership_binding"
     vars:
       cluster_name: "basiccluster"
+      deletion_protection: 'true'
+    test_vars_overrides:
+      deletion_protection: 'false'
+    oics_vars_overrides:
+      deletion_protection: 'false'
     test_env_vars:
       project: :PROJECT_NAME
       location: :REGION
@@ -132,7 +137,7 @@ properties:
           - :READY
           - :DELETING
           - :UPDATING
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Labels for this Membership binding.
diff --git a/mmv1/products/gkehub2/MembershipRBACRoleBinding.yaml b/mmv1/products/gkehub2/MembershipRBACRoleBinding.yaml
index 53d8d3d52c5b..da7ac25800f5 100644
--- a/mmv1/products/gkehub2/MembershipRBACRoleBinding.yaml
+++ b/mmv1/products/gkehub2/MembershipRBACRoleBinding.yaml
@@ -47,10 +47,15 @@ examples:
   - !ruby/object:Provider::Terraform::Examples
     name: 'gkehub_membership_rbac_role_binding_basic'
     primary_resource_name: 'fmt.Sprintf(\"tf-test-membership%s\", context[\"random_suffix\"]), fmt.Sprintf(\"tf-test-rbac-role-binding%s\", context[\"random_suffix\"])'
-    primary_resource_id: 'membershiprbacrolebinding'
+    primary_resource_id: 'membership_rbac_role_binding'
     min_version: beta
     vars:
       cluster_name: "basiccluster"
+      deletion_protection: 'true'
+    test_vars_overrides:
+      deletion_protection: 'false'
+    oics_vars_overrides:
+      deletion_protection: 'false'
     test_env_vars:
       project: :PROJECT_NAME
       location: 'global'
diff --git a/mmv1/products/gkehub2/Namespace.yaml b/mmv1/products/gkehub2/Namespace.yaml
index 8b1901bbbe5e..b96e5e4e65e8 100644
--- a/mmv1/products/gkehub2/Namespace.yaml
+++ b/mmv1/products/gkehub2/Namespace.yaml
@@ -133,7 +133,7 @@ properties:
       Scope. Scope-level labels (`namespace_labels` in the Fleet Scope
       resource) take precedence over Namespace-level labels if they share
       a key. Keys and values must be Kubernetes-conformant.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Labels for this Namespace.
diff --git a/mmv1/products/gkehub2/Scope.yaml b/mmv1/products/gkehub2/Scope.yaml
index 3c9dd36ae6ef..70ffbabfdaac 100644
--- a/mmv1/products/gkehub2/Scope.yaml
+++ b/mmv1/products/gkehub2/Scope.yaml
@@ -15,8 +15,10 @@
 name: 'Scope'
 base_url: 'projects/{{project}}/locations/global/scopes'
 create_url: 'projects/{{project}}/locations/global/scopes?scopeId={{scope_id}}'
+update_url: 'projects/{{project}}/locations/global/scopes/{{scope_id}}'
 self_link: 'projects/{{project}}/locations/global/scopes/{{scope_id}}'
-immutable: true
+update_verb: :PATCH
+update_mask: true
 description: |
   Scope represents a Scope in a Fleet.
 references: !ruby/object:Api::Resource::ReferenceLinks
@@ -113,3 +115,7 @@ properties:
           - :READY
           - :DELETING
           - :UPDATING
+  - !ruby/object:Api::Type::KeyValueLabels
+    name: 'labels'
+    description: |
+      Labels for this Scope.
diff --git a/mmv1/products/gkehub2/ScopeRBACRoleBinding.yaml b/mmv1/products/gkehub2/ScopeRBACRoleBinding.yaml
index 850df3f36c3e..66e412c4f9af 100644
--- a/mmv1/products/gkehub2/ScopeRBACRoleBinding.yaml
+++ b/mmv1/products/gkehub2/ScopeRBACRoleBinding.yaml
@@ -48,7 +48,7 @@ examples:
   - !ruby/object:Provider::Terraform::Examples
     name: 'gkehub_scope_rbac_role_binding_basic'
     primary_resource_name: 'fmt.Sprintf(\"tf-test-scope%s\", context[\"random_suffix\"]), fmt.Sprintf(\"tf-test-rbac-role-binding%s\", context[\"random_suffix\"])'
-    primary_resource_id: 'scoperbacrolebinding'
+    primary_resource_id: 'scope_rbac_role_binding'
     test_env_vars:
       project: :PROJECT_NAME
 # Skip sweeper gen since this is a child resource.
@@ -148,7 +148,7 @@ properties:
           - :ADMIN
           - :EDIT
           - :VIEW
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Labels for this ScopeRBACRoleBinding.
diff --git a/mmv1/products/gkeonprem/BareMetalAdminCluster.yaml b/mmv1/products/gkeonprem/BareMetalAdminCluster.yaml
index e14dcc81ce9d..72f749d29ce2 100644
--- a/mmv1/products/gkeonprem/BareMetalAdminCluster.yaml
+++ b/mmv1/products/gkeonprem/BareMetalAdminCluster.yaml
@@ -12,27 +12,24 @@
 # limitations under the License.
 --- !ruby/object:Api::Resource
 name: "BareMetalAdminCluster"
-min_version: beta
 base_url: "projects/{{project}}/locations/{{location}}/bareMetalAdminClusters"
 create_url: "projects/{{project}}/locations/{{location}}/bareMetalAdminClusters?bare_metal_admin_cluster_id={{name}}"
 update_url: "projects/{{project}}/locations/{{location}}/bareMetalAdminClusters/{{name}}"
-delete_url: "projects/{{project}}/locations/{{location}}/bareMetalAdminClusters/{{name}}:unenroll?ignore_errors=true"
 self_link: "projects/{{project}}/locations/{{location}}/bareMetalAdminClusters/{{name}}"
 update_verb: :PATCH
 update_mask: true
 autogen_async: false
 id_format: "projects/{{project}}/locations/{{location}}/bareMetalAdminClusters/{{name}}"
 import_format: ["projects/{{project}}/locations/{{location}}/bareMetalAdminClusters/{{name}}"]
+skip_delete: true
 taint_resource_on_failed_create: true
 timeouts: !ruby/object:Api::Timeouts
   insert_minutes: 60
-  delete_minutes: 60
   update_minutes: 60
 description: "A Google Bare Metal Admin Cluster."
 examples:
   - !ruby/object:Provider::Terraform::Examples
     name: "gkeonprem_bare_metal_admin_cluster_basic"
-    min_version: beta
     primary_resource_id: "admin-cluster-basic"
     vars:
       name: "my-cluster"
@@ -40,7 +37,6 @@ examples:
       project: "fake-backend-360322"
   - !ruby/object:Provider::Terraform::Examples
     name: "gkeonprem_bare_metal_admin_cluster_full"
-    min_version: beta
     primary_resource_id: "admin-cluster-basic"
     vars:
       name: "my-cluster"
@@ -133,8 +129,8 @@ properties:
       Allows clients to perform consistent read-modify-writes
       through optimistic concurrency control.
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
-    name: "annotations"
+  - !ruby/object:Api::Type::KeyValueAnnotations
+    name: 'annotations'
     description: |
       Annotations on the Bare Metal Admin Cluster.
       This field has the same restrictions as Kubernetes annotations.
@@ -194,7 +190,7 @@ properties:
                         The default IPv4 address for SSH access and Kubernetes node.
                         Example: 192.168.0.1
                     - !ruby/object:Api::Type::KeyValuePairs
-                      name: "labels"
+                      name: 'labels'
                       description: |
                         The map of Kubernetes labels (key/value pairs) to be applied to
                         each node. These will added in addition to any default label(s)
@@ -233,7 +229,7 @@ properties:
                         - PREFER_NO_SCHEDULE
                         - NO_EXECUTE
               - !ruby/object:Api::Type::KeyValuePairs
-                name: "labels"
+                name: 'labels'
                 description: |
                   The map of Kubernetes labels (key/value pairs) to be applied to
                   each node. These will added in addition to any default label(s)
diff --git a/mmv1/products/gkeonprem/BareMetalCluster.yaml b/mmv1/products/gkeonprem/BareMetalCluster.yaml
index 0f4bf81e2bf4..e1d537f7ca2e 100644
--- a/mmv1/products/gkeonprem/BareMetalCluster.yaml
+++ b/mmv1/products/gkeonprem/BareMetalCluster.yaml
@@ -12,7 +12,6 @@
 # limitations under the License.
 --- !ruby/object:Api::Resource
 name: "BareMetalCluster"
-min_version: beta
 base_url: "projects/{{project}}/locations/{{location}}/bareMetalClusters"
 create_url: "projects/{{project}}/locations/{{location}}/bareMetalClusters?bare_metal_cluster_id={{name}}"
 update_url: "projects/{{project}}/locations/{{location}}/bareMetalClusters/{{name}}"
@@ -32,7 +31,6 @@ timeouts: !ruby/object:Api::Timeouts
 examples:
   - !ruby/object:Provider::Terraform::Examples
     name: "gkeonprem_bare_metal_cluster_basic"
-    min_version: beta
     primary_resource_id: "cluster-basic"
     vars:
       name: "my-cluster"
@@ -40,7 +38,6 @@ examples:
       project: "fake-backend-360322"
   - !ruby/object:Provider::Terraform::Examples
     name: "gkeonprem_bare_metal_cluster_manuallb"
-    min_version: beta
     primary_resource_id: "cluster-manuallb"
     vars:
       name: "cluster-manuallb"
@@ -48,7 +45,6 @@ examples:
       project: "fake-backend-360322"
   - !ruby/object:Provider::Terraform::Examples
     name: "gkeonprem_bare_metal_cluster_bgplb"
-    min_version: beta
     primary_resource_id: "cluster-bgplb"
     vars:
       name: "cluster-bgplb"
@@ -85,8 +81,8 @@ properties:
     required: true
     description: |
       A human readable description of this Bare Metal User Cluster.
-  - !ruby/object:Api::Type::KeyValuePairs
-    name: "annotations"
+  - !ruby/object:Api::Type::KeyValueAnnotations
+    name: 'annotations'
     description: |
       Annotations on the Bare Metal User Cluster.
       This field has the same restrictions as Kubernetes annotations.
@@ -96,7 +92,6 @@ properties:
       Prefix must be a DNS subdomain.
       Name must be 63 characters or less, begin and end with alphanumerics,
       with dashes (-), underscores (_), dots (.), and alphanumerics between.
-    default_from_api: true
   - !ruby/object:Api::Type::NestedObject
     name: "networkConfig"
     description: |
@@ -177,7 +172,7 @@ properties:
                         The default IPv4 address for SSH access and Kubernetes node.
                         Example: 192.168.0.1
                     - !ruby/object:Api::Type::KeyValuePairs
-                      name: "labels"
+                      name: 'labels'
                       description: |
                         The map of Kubernetes labels (key/value pairs) to be applied to
                         each node. These will added in addition to any default label(s)
@@ -218,7 +213,7 @@ properties:
                         - PREFER_NO_SCHEDULE
                         - NO_EXECUTE
               - !ruby/object:Api::Type::KeyValuePairs
-                name: "labels"
+                name: 'labels'
                 description: |
                   The map of Kubernetes labels (key/value pairs) to be applied to
                   each node. These will added in addition to any default label(s)
@@ -341,7 +336,7 @@ properties:
                             The default IPv4 address for SSH access and Kubernetes node.
                             Example: 192.168.0.1
                         - !ruby/object:Api::Type::KeyValuePairs
-                          name: "labels"
+                          name: 'labels'
                           description: |
                             The map of Kubernetes labels (key/value pairs) to be applied to
                             each node. These will added in addition to any default label(s)
@@ -382,7 +377,7 @@ properties:
                             - PREFER_NO_SCHEDULE
                             - NO_EXECUTE
                   - !ruby/object:Api::Type::KeyValuePairs
-                    name: "labels"
+                    name: 'labels'
                     description: |
                       The map of Kubernetes labels (key/value pairs) to be applied to
                       each node. These will added in addition to any default label(s)
@@ -505,7 +500,7 @@ properties:
                             The default IPv4 address for SSH access and Kubernetes node.
                             Example: 192.168.0.1
                         - !ruby/object:Api::Type::KeyValuePairs
-                          name: "labels"
+                          name: 'labels'
                           description: |
                             The map of Kubernetes labels (key/value pairs) to be applied to
                             each node. These will added in addition to any default label(s)
@@ -544,7 +539,7 @@ properties:
                             - PREFER_NO_SCHEDULE
                             - NO_EXECUTE
                   - !ruby/object:Api::Type::KeyValuePairs
-                    name: "labels"
+                    name: 'labels'
                     description: |
                       The map of Kubernetes labels (key/value pairs) to be applied to
                       each node. These will added in addition to any default label(s)
diff --git a/mmv1/products/gkeonprem/BareMetalNodePool.yaml b/mmv1/products/gkeonprem/BareMetalNodePool.yaml
index 42d8ac17f5d1..ca7ae82cd732 100644
--- a/mmv1/products/gkeonprem/BareMetalNodePool.yaml
+++ b/mmv1/products/gkeonprem/BareMetalNodePool.yaml
@@ -13,7 +13,6 @@
 
 --- !ruby/object:Api::Resource
 name: 'BareMetalNodePool'
-min_version: beta
 base_url: 'projects/{{project}}/locations/{{location}}/bareMetalClusters/{{bare_metal_cluster}}/bareMetalNodePools'
 create_url: 'projects/{{project}}/locations/{{location}}/bareMetalClusters/{{bare_metal_cluster}}/bareMetalNodePools?bare_metal_node_pool_id={{name}}'
 update_url: 'projects/{{project}}/locations/{{location}}/bareMetalClusters/{{bare_metal_cluster}}/bareMetalNodePools/{{name}}'
@@ -32,7 +31,6 @@ examples:
   - !ruby/object:Provider::Terraform::Examples
     name: 'gkeonprem_bare_metal_node_pool_basic'
     primary_resource_id: 'nodepool-basic'
-    min_version: beta
     vars:
       name: 'my-nodepool'
       cluster: 'my-cluster'
@@ -41,7 +39,6 @@ examples:
   - !ruby/object:Provider::Terraform::Examples
     name: 'gkeonprem_bare_metal_node_pool_full'
     primary_resource_id: 'nodepool-full'
-    min_version: beta
     vars:
       name: 'my-nodepool'
       cluster: 'my-cluster'
@@ -74,7 +71,7 @@ properties:
     name: 'displayName'
     description: |
       The display name for the Bare Metal Node Pool.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueAnnotations
     name: 'annotations'
     description: |
       Annotations on the Bare Metal Node Pool.
@@ -85,7 +82,6 @@ properties:
       Prefix must be a DNS subdomain.
       Name must be 63 characters or less, begin and end with alphanumerics,
       with dashes (-), underscores (_), dots (.), and alphanumerics between.
-    default_from_api: true
   - !ruby/object:Api::Type::NestedObject
     name: 'nodePoolConfig'
     required: true
diff --git a/mmv1/products/gkeonprem/VmwareCluster.yaml b/mmv1/products/gkeonprem/VmwareCluster.yaml
index f460b42f42bd..26a32312ce27 100644
--- a/mmv1/products/gkeonprem/VmwareCluster.yaml
+++ b/mmv1/products/gkeonprem/VmwareCluster.yaml
@@ -13,7 +13,6 @@
 
 --- !ruby/object:Api::Resource
 name: 'VmwareCluster'
-min_version: beta
 base_url: 'projects/{{project}}/locations/{{location}}/vmwareClusters'
 create_url: 'projects/{{project}}/locations/{{location}}/vmwareClusters?vmware_cluster_id={{name}}'
 update_url: 'projects/{{project}}/locations/{{location}}/vmwareClusters/{{name}}'
@@ -34,7 +33,6 @@ timeouts: !ruby/object:Api::Timeouts
 examples:
   - !ruby/object:Provider::Terraform::Examples
     name: 'gkeonprem_vmware_cluster_basic'
-    min_version: beta
     primary_resource_id: 'cluster-basic'
     vars:
       name: 'cluster-basic'
@@ -42,7 +40,6 @@ examples:
       project: 'fake-backend-360322'
   - !ruby/object:Provider::Terraform::Examples
     name: 'gkeonprem_vmware_cluster_f5lb'
-    min_version: beta
     primary_resource_id: 'cluster-f5lb'
     vars:
       name: 'cluster-f5lb'
@@ -50,7 +47,6 @@ examples:
       project: 'fake-backend-360322'
   - !ruby/object:Provider::Terraform::Examples
     name: 'gkeonprem_vmware_cluster_manuallb'
-    min_version: beta
     primary_resource_id: 'cluster-manuallb'
     vars:
       name: 'cluster-manuallb'
@@ -89,7 +85,7 @@ properties:
     required: true
     description: |
       The Anthos clusters on the VMware version for your user cluster.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueAnnotations
     name: 'annotations'
     description: |
       Annotations on the VMware User Cluster.
@@ -100,7 +96,6 @@ properties:
       Prefix must be a DNS subdomain.
       Name must be 63 characters or less, begin and end with alphanumerics,
       with dashes (-), underscores (_), dots (.), and alphanumerics between.
-    default_from_api: true
   - !ruby/object:Api::Type::NestedObject
     name: 'controlPlaneNode'
     description: |
@@ -629,33 +624,26 @@ properties:
     description: |
       VmwareVCenterConfig specifies vCenter config for the user cluster.
       Inherited from the admin cluster.
-    output: true
     properties:
       - !ruby/object:Api::Type::String
         name: 'resourcePool'
         description: The name of the vCenter resource pool for the user cluster.
-        output: true
       - !ruby/object:Api::Type::String
         name: 'datastore'
         description: The name of the vCenter datastore for the user cluster.
-        output: true
       - !ruby/object:Api::Type::String
         name: 'datacenter'
         description: The name of the vCenter datacenter for the user cluster.
-        output: true
       - !ruby/object:Api::Type::String
         name: 'cluster'
         description: The name of the vCenter cluster for the user cluster.
-        output: true
       - !ruby/object:Api::Type::String
         name: 'folder'
         description: The name of the vCenter folder for the user cluster.
-        output: true
       - !ruby/object:Api::Type::String
         name: 'caCertData'
         description:
           Contains the vCenter CA certificate public key for SSL verification.
-        output: true
       - !ruby/object:Api::Type::String
         name: 'address'
         description: The vCenter IP address.
@@ -663,7 +651,6 @@ properties:
       - !ruby/object:Api::Type::String
         name: 'storagePolicyName'
         description: The name of the vCenter storage policy for the user cluster.
-        output: true
   - !ruby/object:Api::Type::NestedObject
     name: status
     description: ResourceStatus representing detailed cluster state.
diff --git a/mmv1/products/gkeonprem/VmwareNodePool.yaml b/mmv1/products/gkeonprem/VmwareNodePool.yaml
index bfaf50cdb0ee..d8fd1edda36a 100644
--- a/mmv1/products/gkeonprem/VmwareNodePool.yaml
+++ b/mmv1/products/gkeonprem/VmwareNodePool.yaml
@@ -12,7 +12,6 @@
 # limitations under the License.
 --- !ruby/object:Api::Resource
 name: "VmwareNodePool"
-min_version: beta
 base_url: "projects/{{project}}/locations/{{location}}/vmwareClusters/{{vmware_cluster}}/vmwareNodePools"
 create_url: "projects/{{project}}/locations/{{location}}/vmwareClusters/{{vmware_cluster}}/vmwareNodePools?vmware_node_pool_id={{name}}"
 update_url: "projects/{{project}}/locations/{{location}}/vmwareClusters/{{vmware_cluster}}/vmwareNodePools/{{name}}"
@@ -31,7 +30,6 @@ timeouts: !ruby/object:Api::Timeouts
 examples:
   - !ruby/object:Provider::Terraform::Examples
     name: "gkeonprem_vmware_node_pool_basic"
-    min_version: beta
     primary_resource_id: "nodepool-basic"
     vars:
       name: "my-nodepool"
@@ -40,7 +38,6 @@ examples:
       project: "fake-backend-360322"
   - !ruby/object:Provider::Terraform::Examples
     name: "gkeonprem_vmware_node_pool_full"
-    min_version: beta
     primary_resource_id: "nodepool-full"
     vars:
       name: "my-nodepool"
@@ -71,8 +68,8 @@ properties:
   - !ruby/object:Api::Type::String
     name: "displayName"
     description: The display name for the node pool.
-  - !ruby/object:Api::Type::KeyValuePairs
-    name: "annotations"
+  - !ruby/object:Api::Type::KeyValueAnnotations
+    name: 'annotations'
     description: |
       Annotations on the node Pool.
       This field has the same restrictions as Kubernetes annotations.
@@ -82,7 +79,6 @@ properties:
       Prefix must be a DNS subdomain.
       Name must be 63 characters or less, begin and end with alphanumerics,
       with dashes (-), underscores (_), dots (.), and alphanumerics between.
-    default_from_api: true
   - !ruby/object:Api::Type::NestedObject
     name: "nodePoolAutoscaling"
     description: Node Pool autoscaling config for the node pool.
@@ -149,7 +145,7 @@ properties:
                 - PREFER_NO_SCHEDULE
                 - NO_EXECUTE
       - !ruby/object:Api::Type::KeyValuePairs
-        name: "labels"
+        name: 'labels'
         description: |
           The map of Kubernetes labels (key/value pairs) to be applied to each node.
           These will added in addition to any default label(s) that
diff --git a/mmv1/products/gkeonprem/product.yaml b/mmv1/products/gkeonprem/product.yaml
index 6027ecb665ec..a1272ba91c98 100644
--- a/mmv1/products/gkeonprem/product.yaml
+++ b/mmv1/products/gkeonprem/product.yaml
@@ -18,6 +18,9 @@ versions:
   - !ruby/object:Api::Product::Version
     name: beta
     base_url: https://gkeonprem.googleapis.com/v1/
+  - !ruby/object:Api::Product::Version
+    name: ga
+    base_url: https://gkeonprem.googleapis.com/v1/
 scopes:
   - https://www.googleapis.com/auth/cloud-platform
 apis_required:
diff --git a/mmv1/products/healthcare/ConsentStore.yaml b/mmv1/products/healthcare/ConsentStore.yaml
index 7db49d2bcf38..75a56824809b 100644
--- a/mmv1/products/healthcare/ConsentStore.yaml
+++ b/mmv1/products/healthcare/ConsentStore.yaml
@@ -93,8 +93,8 @@ properties:
     required: false
     description: |
       If true, [consents.patch] [google.cloud.healthcare.v1.consent.UpdateConsent] creates the consent if it does not already exist.
-  - !ruby/object:Api::Type::KeyValuePairs
-    name: labels
+  - !ruby/object:Api::Type::KeyValueLabels
+    name: 'labels'
     required: false
     description: |
       User-supplied key-value pairs used to organize Consent stores.
diff --git a/mmv1/products/healthcare/DicomStore.yaml b/mmv1/products/healthcare/DicomStore.yaml
index 90ab6b2cbd86..98378ff2998e 100644
--- a/mmv1/products/healthcare/DicomStore.yaml
+++ b/mmv1/products/healthcare/DicomStore.yaml
@@ -73,8 +73,8 @@ properties:
       ** Changing this property may recreate the Dicom store (removing all data) **
     required: true
     immutable: true
-  - !ruby/object:Api::Type::KeyValuePairs
-    name: labels
+  - !ruby/object:Api::Type::KeyValueLabels
+    name: 'labels'
     required: false
     description: |
       User-supplied key-value pairs used to organize DICOM stores.
diff --git a/mmv1/products/healthcare/FhirStore.yaml b/mmv1/products/healthcare/FhirStore.yaml
index d9bebcee2dbc..dc9100591bd7 100644
--- a/mmv1/products/healthcare/FhirStore.yaml
+++ b/mmv1/products/healthcare/FhirStore.yaml
@@ -166,8 +166,8 @@ properties:
       ** This property can be changed manually in the Google Cloud Healthcare admin console without recreating the FHIR store **
     required: false
     immutable: true
-  - !ruby/object:Api::Type::KeyValuePairs
-    name: labels
+  - !ruby/object:Api::Type::KeyValueLabels
+    name: 'labels'
     required: false
     description: |
       User-supplied key-value pairs used to organize FHIR stores.
diff --git a/mmv1/products/healthcare/Hl7V2Store.yaml b/mmv1/products/healthcare/Hl7V2Store.yaml
index 931730c5e672..2c395e9a1338 100644
--- a/mmv1/products/healthcare/Hl7V2Store.yaml
+++ b/mmv1/products/healthcare/Hl7V2Store.yaml
@@ -129,8 +129,8 @@ properties:
           - :V1
           - :V2
           - :V3
-  - !ruby/object:Api::Type::KeyValuePairs
-    name: labels
+  - !ruby/object:Api::Type::KeyValueLabels
+    name: 'labels'
     required: false
     description: |
       User-supplied key-value pairs used to organize HL7v2 stores.
diff --git a/mmv1/products/iamworkforcepool/WorkforcePoolProvider.yaml b/mmv1/products/iamworkforcepool/WorkforcePoolProvider.yaml
index 3c81f008d6cc..635b870247e5 100644
--- a/mmv1/products/iamworkforcepool/WorkforcePoolProvider.yaml
+++ b/mmv1/products/iamworkforcepool/WorkforcePoolProvider.yaml
@@ -72,7 +72,6 @@ examples:
       - 'oidc.0.client_secret.0.value.0.plain_text'
   - !ruby/object:Provider::Terraform::Examples
     name: 'iam_workforce_pool_provider_oidc_upload_key'
-    min_version: beta
     skip_docs: true
     primary_resource_id: 'example'
     vars:
@@ -333,7 +332,6 @@ properties:
             item_type: Api::Type::String
       - !ruby/object:Api::Type::String
         name: 'jwksJson'
-        min_version: beta
         description: |
           OIDC JWKs in JSON String format. For details on definition of a
           JWK, see https:tools.ietf.org/html/rfc7517. If not set, then we
diff --git a/mmv1/products/identityplatform/Config.yaml b/mmv1/products/identityplatform/Config.yaml
index 04c5f6fcf538..6a0487875fd2 100644
--- a/mmv1/products/identityplatform/Config.yaml
+++ b/mmv1/products/identityplatform/Config.yaml
@@ -59,7 +59,6 @@ examples:
       org_id: :ORG_ID
       billing_acct:
         :BILLING_ACCT
-    skip_vcr: true
     skip_docs: true
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   custom_create: 'templates/terraform/custom_create/identity_platform_config.go'
@@ -73,6 +72,89 @@ properties:
     name: 'autodeleteAnonymousUsers'
     description: |
       Whether anonymous users will be auto-deleted after a period of 30 days
+  - !ruby/object:Api::Type::NestedObject
+    name: 'signIn'
+    description: |
+      Configuration related to local sign in methods.
+    default_from_api: true
+    properties:
+      - !ruby/object:Api::Type::NestedObject
+        name: email
+        description: |
+          Configuration options related to authenticating a user by their email address.
+        properties:
+          - !ruby/object:Api::Type::Boolean
+            name: enabled
+            required: true
+            description: |
+              Whether email auth is enabled for the project or not.
+          - !ruby/object:Api::Type::Boolean
+            name: 'passwordRequired'
+            description: |
+              Whether a password is required for email auth or not. If true, both an email and
+              password must be provided to sign in. If false, a user may sign in via either
+              email/password or email link.
+      - !ruby/object:Api::Type::NestedObject
+        name: phoneNumber
+        description: |
+          Configuration options related to authenticated a user by their phone number.
+        properties:
+          - !ruby/object:Api::Type::Boolean
+            name: enabled
+            required: true
+            description: |
+              Whether phone number auth is enabled for the project or not.
+          - !ruby/object:Api::Type::KeyValuePairs
+            name: 'testPhoneNumbers'
+            description: |
+              A map of <test phone number, fake code> that can be used for phone auth testing.
+      - !ruby/object:Api::Type::NestedObject
+        name: anonymous
+        custom_flatten: 'templates/terraform/custom_flatten/identity_platform_config_anonymous.go'
+        description: |
+          Configuration options related to authenticating an anonymous user.
+        properties:
+          - !ruby/object:Api::Type::Boolean
+            name: enabled
+            required: true
+            send_empty_value: true
+            description: |
+              Whether anonymous user auth is enabled for the project or not.
+      - !ruby/object:Api::Type::Boolean
+        name: allowDuplicateEmails
+        description: |
+          Whether to allow more than one account to have the same email.
+      - !ruby/object:Api::Type::NestedObject
+        name: hashConfig
+        output: true
+        description: |
+          Output only. Hash config information.
+        properties:
+          - !ruby/object:Api::Type::String
+            name: algorithm
+            output: true
+            description: |
+              Different password hash algorithms used in Identity Toolkit.
+          - !ruby/object:Api::Type::String
+            name: 'signerKey'
+            output: true
+            description: |
+              Signer key in base64.
+          - !ruby/object:Api::Type::String
+            name: 'saltSeparator'
+            output: true
+            description: |
+              Non-printable character to be inserted between the salt and plain text password in base64.
+          - !ruby/object:Api::Type::Integer
+            name: rounds
+            output: true
+            description: |
+              How many rounds for hash calculation. Used by scrypt and other similar password derivation algorithms.
+          - !ruby/object:Api::Type::Integer
+            name: 'memoryCost'
+            output: true
+            description: |
+              Memory cost for hash calculation. Used by scrypt and other similar password derivation algorithms. See https://tools.ietf.org/html/rfc7914 for explanation of field.
   - !ruby/object:Api::Type::NestedObject
     name: 'blockingFunctions'
     description: |
@@ -141,3 +223,34 @@ properties:
       List of domains authorized for OAuth redirects.
     item_type: Api::Type::String
     default_from_api: true
+  - !ruby/object:Api::Type::NestedObject
+    name: 'smsRegionConfig'
+    description: |
+      Configures the regions where users are allowed to send verification SMS for the project or tenant. This is based on the calling code of the destination phone number.
+    properties:
+      - !ruby/object:Api::Type::NestedObject
+        name: 'allowByDefault'
+        exactly_one_of:
+          - sms_region_config.0.allow_by_default
+          - sms_region_config.0.allowlist_only
+        description: |
+          A policy of allowing SMS to every region by default and adding disallowed regions to a disallow list.
+        properties:
+          - !ruby/object:Api::Type::Array
+            name: disallowedRegions
+            description: |
+              Two letter unicode region codes to disallow as defined by https://cldr.unicode.org/ The full list of these region codes is here: https://github.com/unicode-cldr/cldr-localenames-full/blob/master/main/en/territories.json
+            item_type: Api::Type::String
+      - !ruby/object:Api::Type::NestedObject
+        name: 'allowlistOnly'
+        exactly_one_of:
+          - sms_region_config.0.allow_by_default
+          - sms_region_config.0.allowlist_only
+        description: |
+          A policy of only allowing regions by explicitly adding them to an allowlist.
+        properties:
+          - !ruby/object:Api::Type::Array
+            name: allowedRegions
+            description: |
+              Two letter unicode region codes to allow as defined by https://cldr.unicode.org/ The full list of these region codes is here: https://github.com/unicode-cldr/cldr-localenames-full/blob/master/main/en/territories.json
+            item_type: Api::Type::String
diff --git a/mmv1/products/identityplatform/ProjectDefaultConfig.yaml b/mmv1/products/identityplatform/ProjectDefaultConfig.yaml
index 738d8518ff03..908d324f94c7 100644
--- a/mmv1/products/identityplatform/ProjectDefaultConfig.yaml
+++ b/mmv1/products/identityplatform/ProjectDefaultConfig.yaml
@@ -23,6 +23,7 @@ create_verb: :PATCH
 delete_verb: :PATCH
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   test_check_destroy: templates/terraform/custom_check_destroy/identity_platform_project_default_config.go.erb
+  resource_definition: templates/terraform/resource_definition/identity_platform_project_default_config_deprecation.go.erb
 docs: !ruby/object:Provider::Terraform::Docs
   warning: |
     If you are using User ADCs (Application Default Credentials) with this resource,
diff --git a/mmv1/products/integrationconnectors/Connection.yaml b/mmv1/products/integrationconnectors/Connection.yaml
new file mode 100644
index 000000000000..51baae956ad3
--- /dev/null
+++ b/mmv1/products/integrationconnectors/Connection.yaml
@@ -0,0 +1,937 @@
+# Copyright 2023 Google Inc.
+
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+---
+!ruby/object:Api::Resource
+name: "Connection"
+description: |
+  An Integration connectors Connection.
+references: !ruby/object:Api::Resource::ReferenceLinks
+  guides:
+    "Official Documentation": "https://cloud.google.com/integration-connectors/docs/createconnection"
+  api: "https://cloud.google.com/integration-connectors/docs/reference/rest/v1/projects.locations.connections"
+base_url: projects/{{project}}/locations/{{location}}/connections
+self_link: projects/{{project}}/locations/{{location}}/connections/{{name}}
+timeouts: !ruby/object:Api::Timeouts
+  insert_minutes: 30
+  update_minutes: 30
+  delete_minutes: 30
+custom_code: !ruby/object:Provider::Terraform::CustomCode
+  constants: templates/terraform/constants/integration_connectors_connection.go.erb
+  post_create: templates/terraform/post_create/integration_connectors_connection.go.erb
+  post_update: templates/terraform/post_update/integration_connectors_connection.go.erb
+  post_import: templates/terraform/post_import/integration_connectors_connection.go.erb
+create_url: projects/{{project}}/locations/{{location}}/connections?connectionId={{name}}
+update_verb: :PATCH
+update_mask: true
+autogen_async: true
+examples:
+  - !ruby/object:Provider::Terraform::Examples
+    name: "integration_connectors_connection_basic"
+    primary_resource_id: "pubsubconnection"
+    vars:
+      connection_name: "test-pubsub"
+  - !ruby/object:Provider::Terraform::Examples
+    name: "integration_connectors_connection_advanced"
+    primary_resource_id: "zendeskconnection"
+    vars:
+      connection_name: "test-zendesk"
+      secret_id: "test-secret"
+  - !ruby/object:Provider::Terraform::Examples
+    name: "integration_connectors_connection_sa"
+    primary_resource_id: "zendeskconnection"
+    vars:
+      connection_name: "test-zendesk"
+      secret_id: "test-secret"
+    skip_docs: true
+  - !ruby/object:Provider::Terraform::Examples
+    name: "integration_connectors_connection_oauth"
+    primary_resource_id: "boxconnection"
+    vars:
+      connection_name: "test-box"
+      secret_id: "test-secret"
+    skip_docs: true
+  - !ruby/object:Provider::Terraform::Examples
+    name: "integration_connectors_connection_oauth_ssh"
+    primary_resource_id: "boxconnection"
+    vars:
+      connection_name: "test-box"
+      secret_id: "test-secret"
+    skip_docs: true
+  - !ruby/object:Provider::Terraform::Examples
+    name: "integration_connectors_connection_oauth_cc"
+    primary_resource_id: "boxconnection"
+    vars:
+      connection_name: "test-box"
+      secret_id: "test-secret"
+    skip_docs: true
+  - !ruby/object:Provider::Terraform::Examples
+    name: "integration_connectors_connection_oauth_jwt"
+    primary_resource_id: "boxconnection"
+    vars:
+      connection_name: "test-box"
+      secret_id: "test-secret"
+    skip_docs: true
+async: !ruby/object:Api::OpAsync
+  operation: !ruby/object:Api::OpAsync::Operation
+    path: "name"
+    base_url: "{{op_id}}"
+    wait_ms: 1000
+    timeouts: !ruby/object:Api::Timeouts
+      insert_minutes: 50
+      update_minutes: 30
+      delete_minutes: 30
+  result: !ruby/object:Api::OpAsync::Result
+    path: "response"
+    resource_inside_response: true
+  status: !ruby/object:Api::OpAsync::Status
+    path: "done"
+    complete: true
+    allowed:
+      - "true"
+      - "false"
+  error: !ruby/object:Api::OpAsync::Error
+    path: "error"
+    message: "message"
+
+parameters:
+  - !ruby/object:Api::Type::String
+    name: "location"
+    required: true
+    immutable: true
+    url_param_only: true
+    description: |
+      Location in which Connection needs to be created.
+  - !ruby/object:Api::Type::String
+    name: "name"
+    required: true
+    immutable: true
+    url_param_only: true
+    description: |
+      Name of Connection needs to be created.
+
+properties:
+  - !ruby/object:Api::Type::Time
+    name: "createTime"
+    description: |
+      Time the Namespace was created in UTC.
+    output: true
+  - !ruby/object:Api::Type::Time
+    name: "updateTime"
+    description: |
+      Time the Namespace was updated in UTC.
+    output: true
+  - !ruby/object:Api::Type::String
+    name: "description"
+    description: |
+      An arbitrary description for the Conection.
+  - !ruby/object:Api::Type::KeyValueLabels
+    name: "labels"
+    description: |
+      Resource labels to represent user provided metadata.
+  - !ruby/object:Api::Type::String
+    name: "connectorVersion"
+    required: true
+    description: |
+      connectorVersion of the Connector.
+  - !ruby/object:Api::Type::NestedObject
+    name: "status"
+    description: |
+      Status of the Integration Connector.
+    output: true
+    properties:
+      - !ruby/object:Api::Type::String
+        name: "state"
+        description: |
+          State of the Integration Connector
+        output: true
+      - !ruby/object:Api::Type::String
+        name: "description"
+        output: true
+        description: |
+          Description of Status of Connection.
+      - !ruby/object:Api::Type::String
+        name: "status"
+        output: true
+        description: |
+          Status of the Connection.
+
+  - !ruby/object:Api::Type::Array
+    name: "configVariable"
+    api_name: "configVariables"
+    description: |
+      Config Variables for the connection.
+    item_type: !ruby/object:Api::Type::NestedObject
+      properties:
+        - !ruby/object:Api::Type::String
+          name: "key"
+          description: |
+            Key for the configVariable
+          required: true
+        - !ruby/object:Api::Type::Integer
+          name: "integerValue"
+          api_name: "intValue"
+          description: |
+            Integer Value of configVariable
+        - !ruby/object:Api::Type::String
+          name: "stringValue"
+          description: |
+            String Value of configVariabley
+        - !ruby/object:Api::Type::Boolean
+          name: "booleanValue"
+          api_name: "boolValue"
+          description: |
+            Boolean Value of configVariable
+        - !ruby/object:Api::Type::NestedObject
+          name: "secretValue"
+          description: |
+            Secret value of configVariable.
+          properties:
+            - !ruby/object:Api::Type::String
+              name: "secretVersion"
+              required: true
+              description: |
+                Secret version of Secret Value for Config variable.
+        - !ruby/object:Api::Type::NestedObject
+          name: "encryptionKeyValue"
+          description: |
+            Encription key value of configVariable.
+          properties:
+            - !ruby/object:Api::Type::Enum
+              name: "type"
+              required: true
+              description: |
+                Type of Encription Key
+              values:
+                - GOOGLE_MANAGED
+                - CUSTOMER_MANAGED
+            - !ruby/object:Api::Type::String
+              name: "kmsKeyName"
+              description: |
+                The [KMS key name] with which the content of the Operation is encrypted. The expected
+                format: projects/*/locations/*/keyRings/*/cryptoKeys/*.
+                Will be empty string if google managed.
+  - !ruby/object:Api::Type::NestedObject
+    name: "authConfig"
+    description: |
+      authConfig for the connection.
+    properties:
+      - !ruby/object:Api::Type::Enum
+        name: "authType"
+        description: |
+          authType of the Connection
+        required: true
+        values:
+          - USER_PASSWORD
+          - OAUTH2_JWT_BEARER
+          - OAUTH2_CLIENT_CREDENTIALS
+          - SSH_PUBLIC_KEY
+          - OAUTH2_AUTH_CODE_FLOW
+      - !ruby/object:Api::Type::Array
+        name: "additionalVariable"
+        api_name: "additionalVariables"
+        description: |
+          List containing additional auth configs.
+        item_type: !ruby/object:Api::Type::NestedObject
+          properties:
+            - !ruby/object:Api::Type::String
+              name: "key"
+              description: |
+                Key for the configVariable
+              required: true
+            - !ruby/object:Api::Type::Integer
+              name: "integerValue"
+              api_name: "intValue"
+              description: |
+                Integer Value of configVariable.
+            - !ruby/object:Api::Type::String
+              name: "stringValue"
+              description: |
+                String Value of configVariabley.
+            - !ruby/object:Api::Type::Boolean
+              name: "booleanValue"
+              api_name: "boolValue"
+              description: |
+                Boolean Value of configVariable.
+            - !ruby/object:Api::Type::NestedObject
+              name: "secretValue"
+              description: |
+                Secret value of configVariable.
+              properties:
+                - !ruby/object:Api::Type::String
+                  name: "secretVersion"
+                  required: true
+                  description: |
+                    Secret version of Secret Value for Config variable.
+            - !ruby/object:Api::Type::NestedObject
+              name: "encryptionKeyValue"
+              description: |
+                Encription key value of configVariable.
+              properties:
+                - !ruby/object:Api::Type::Enum
+                  name: "type"
+                  required: true
+                  description: |
+                    Type of Encription Key
+                  values:
+                    - GOOGLE_MANAGED
+                    - CUSTOMER_MANAGED
+                - !ruby/object:Api::Type::String
+                  name: "kmsKeyName"
+                  description: |
+                    The [KMS key name] with which the content of the Operation is encrypted. The expected
+                    format: projects/*/locations/*/keyRings/*/cryptoKeys/*.
+                    Will be empty string if google managed.
+      - !ruby/object:Api::Type::String
+        name: "authKey"
+        description: |
+          The type of authentication configured.
+      - !ruby/object:Api::Type::NestedObject
+        name: "userPassword"
+        description: |
+          User password for Authentication.
+        properties:
+          - !ruby/object:Api::Type::String
+            name: "username"
+            required: true
+            description: |
+              Username for Authentication.
+          - !ruby/object:Api::Type::NestedObject
+            name: "password"
+            description: |
+              Password for Authentication.
+            properties:
+              - !ruby/object:Api::Type::String
+                name: "secretVersion"
+                required: true
+                description: |
+                  The resource name of the secret version in the format,
+                  format as: projects/*/secrets/*/versions/*.
+        exactly_one_of:
+          - auth_config.0.user_password
+          - auth_config.0.oauth2_jwt_bearer
+          - auth_config.0.oauth2_client_credentials
+          - auth_config.0.ssh_public_key
+          - auth_config.0.oauth2_auth_code_flow
+      - !ruby/object:Api::Type::NestedObject
+        name: "oauth2JwtBearer"
+        description: |
+          OAuth2 JWT Bearer for Authentication.
+        properties:
+          - !ruby/object:Api::Type::NestedObject
+            name: "clientKey"
+            description: |
+              Secret version reference containing a PKCS#8 PEM-encoded private key associated with the Client Certificate.
+              This private key will be used to sign JWTs used for the jwt-bearer authorization grant.
+              Specified in the form as: projects/*/secrets/*/versions/*.
+            properties:
+              - !ruby/object:Api::Type::String
+                name: "secretVersion"
+                required: true
+                description: |
+                  The resource name of the secret version in the format,
+                  format as: projects/*/secrets/*/versions/*.
+          - !ruby/object:Api::Type::NestedObject
+            name: "jwtClaims"
+            description: |
+              JwtClaims providers fields to generate the token.
+            properties:
+              - !ruby/object:Api::Type::String
+                name: "issuer"
+                description: |
+                  Value for the "iss" claim.
+              - !ruby/object:Api::Type::String
+                name: "subject"
+                description: |
+                  Value for the "sub" claim.
+              - !ruby/object:Api::Type::String
+                name: "audience"
+                description: |
+                  Value for the "aud" claim.
+        exactly_one_of:
+          - auth_config.0.user_password
+          - auth_config.0.oauth2_jwt_bearer
+          - auth_config.0.oauth2_client_credentials
+          - auth_config.0.ssh_public_key
+          - auth_config.0.oauth2_auth_code_flow
+      - !ruby/object:Api::Type::NestedObject
+        name: "oauth2ClientCredentials"
+        description: |
+          OAuth3 Client Credentials for Authentication.
+        properties:
+          - !ruby/object:Api::Type::String
+            name: "clientId"
+            required: true
+            description: |
+              Secret version of Password for Authentication.
+          - !ruby/object:Api::Type::NestedObject
+            name: "clientSecret"
+            description: |
+              Secret version reference containing the client secret.
+            properties:
+              - !ruby/object:Api::Type::String
+                name: "secretVersion"
+                required: true
+                description: |
+                  The resource name of the secret version in the format,
+                  format as: projects/*/secrets/*/versions/*.
+        exactly_one_of:
+          - auth_config.0.user_password
+          - auth_config.0.oauth2_jwt_bearer
+          - auth_config.0.oauth2_client_credentials
+          - auth_config.0.ssh_public_key
+          - auth_config.0.oauth2_auth_code_flow
+      - !ruby/object:Api::Type::NestedObject
+        name: "sshPublicKey"
+        description: |
+          SSH Public Key for Authentication.
+        properties:
+          - !ruby/object:Api::Type::String
+            name: "username"
+            required: true
+            description: |
+              The user account used to authenticate.
+          - !ruby/object:Api::Type::NestedObject
+            name: "sshClientCert"
+            description: |
+              SSH Client Cert. It should contain both public and private key.
+            properties:
+              - !ruby/object:Api::Type::String
+                name: "secretVersion"
+                required: true
+                description: |
+                  The resource name of the secret version in the format,
+                  format as: projects/*/secrets/*/versions/*.
+          - !ruby/object:Api::Type::String
+            name: "certType"
+            description: |
+              Format of SSH Client cert.
+          - !ruby/object:Api::Type::NestedObject
+            name: "sshClientCertPass"
+            description: |
+              Password (passphrase) for ssh client certificate if it has one.
+            properties:
+              - !ruby/object:Api::Type::String
+                name: "secretVersion"
+                required: true
+                description: |
+                  The resource name of the secret version in the format,
+                  format as: projects/*/secrets/*/versions/*.
+        exactly_one_of:
+          - auth_config.0.user_password
+          - auth_config.0.oauth2_jwt_bearer
+          - auth_config.0.oauth2_client_credentials
+          - auth_config.0.ssh_public_key
+          - auth_config.0.oauth2_auth_code_flow
+      - !ruby/object:Api::Type::NestedObject
+        name: "oauth2AuthCodeFlow"
+        description: |
+          Parameters to support Oauth 2.0 Auth Code Grant Authentication.
+        properties:
+          - !ruby/object:Api::Type::String
+            name: "clientId"
+            description: |
+              Client ID for user-provided OAuth app.
+          - !ruby/object:Api::Type::NestedObject
+            name: "clientSecret"
+            description: |
+              Client secret for user-provided OAuth app.
+            properties:
+              - !ruby/object:Api::Type::String
+                name: "secretVersion"
+                required: true
+                description: |
+                  The resource name of the secret version in the format,
+                  format as: projects/*/secrets/*/versions/*.
+          - !ruby/object:Api::Type::Array
+            name: "scopes"
+            description: |
+              Scopes the connection will request when the user performs the auth code flow.
+            item_type: Api::Type::String
+          - !ruby/object:Api::Type::Boolean
+            name: "enablePkce"
+            description: |
+              Whether to enable PKCE when the user performs the auth code flow.
+          - !ruby/object:Api::Type::String
+            name: "authUri"
+            description: |
+              Auth URL for Authorization Code Flow.
+        exactly_one_of:
+          - auth_config.0.user_password
+          - auth_config.0.oauth2_jwt_bearer
+          - auth_config.0.oauth2_client_credentials
+          - auth_config.0.ssh_public_key
+          - auth_config.0.oauth2_auth_code_flow
+
+  - !ruby/object:Api::Type::NestedObject
+    name: "lockConfig"
+    description: |
+      Determines whether or no a connection is locked. If locked, a reason must be specified.
+    properties:
+      - !ruby/object:Api::Type::Boolean
+        name: "locked"
+        description: |
+          Indicates whether or not the connection is locked.
+        required: true
+      - !ruby/object:Api::Type::String
+        name: "reason"
+        description: |
+          Describes why a connection is locked.
+  - !ruby/object:Api::Type::Array
+    name: "destinationConfig"
+    api_name: "destinationConfigs"
+    description: |
+      Define the Connectors target endpoint.
+    item_type: !ruby/object:Api::Type::NestedObject
+      properties:
+        - !ruby/object:Api::Type::String
+          name: "key"
+          description: |
+            The key is the destination identifier that is supported by the Connector.
+          required: true
+        - !ruby/object:Api::Type::Array
+          name: "destination"
+          api_name: "destinations"
+          description: |
+            The destinations for the key.
+          item_type: !ruby/object:Api::Type::NestedObject
+            properties:
+              - !ruby/object:Api::Type::Integer
+                name: "port"
+                description: |
+                  The port is the target port number that is accepted by the destination.
+              - !ruby/object:Api::Type::String
+                name: "serviceAttachment"
+                description: |
+                  PSC service attachments. Format: projects/*/regions/*/serviceAttachments/*
+              - !ruby/object:Api::Type::String
+                name: "host"
+                description: |
+                  For publicly routable host.
+  - !ruby/object:Api::Type::String
+    name: "serviceAccount"
+    description: |
+      Service account needed for runtime plane to access Google Cloud resources.
+    default_from_api: true
+  - !ruby/object:Api::Type::String
+    name: "serviceDirectory"
+    description: |
+      The name of the Service Directory service name. Used for Private Harpoon to resolve the ILB address.
+      e.g. "projects/cloud-connectors-e2e-testing/locations/us-central1/namespaces/istio-system/services/istio-ingressgateway-connectors"
+    output: true
+  - !ruby/object:Api::Type::Boolean
+    name: "suspended"
+    description: |
+      Suspended indicates if a user has suspended a connection or not.
+  - !ruby/object:Api::Type::NestedObject
+    name: "nodeConfig"
+    description: |
+      Node configuration for the connection.
+    default_from_api: true
+    properties:
+      - !ruby/object:Api::Type::Integer
+        name: "minNodeCount"
+        required: true
+        default_from_api: true
+        description: |
+          Minimum number of nodes in the runtime nodes.
+      - !ruby/object:Api::Type::Integer
+        name: "maxNodeCount"
+        required: true
+        default_from_api: true
+        description: |
+          Minimum number of nodes in the runtime nodes.
+  - !ruby/object:Api::Type::NestedObject
+    name: "logConfig"
+    description: |
+      Log configuration for the connection.
+    properties:
+      - !ruby/object:Api::Type::Boolean
+        name: "enabled"
+        description: |
+          Enabled represents whether logging is enabled or not for a connection.
+        required: true
+  - !ruby/object:Api::Type::NestedObject
+    name: "sslConfig"
+    description: |
+      SSL Configuration of a connection
+    properties:
+      - !ruby/object:Api::Type::Enum
+        name: "type"
+        description: |
+          Enum for controlling the SSL Type (TLS/MTLS)
+        required: true
+        values:
+          - TLS
+          - MTLS
+      - !ruby/object:Api::Type::Enum
+        name: "trustModel"
+        description: |
+          Enum for Trust Model
+        values:
+          - PUBLIC
+          - PRIVATE
+          - INSECURE
+      - !ruby/object:Api::Type::NestedObject
+        name: "privateServerCertificate"
+        description: |
+          Private Server Certificate. Needs to be specified if trust model is PRIVATE.
+        properties:
+          - !ruby/object:Api::Type::String
+            name: "secretVersion"
+            required: true
+            description: |
+              Secret version of Secret Value for Config variable.
+      - !ruby/object:Api::Type::NestedObject
+        name: "clientCertificate"
+        description: |
+          Client Certificate
+        properties:
+          - !ruby/object:Api::Type::String
+            name: "secretVersion"
+            required: true
+            description: |
+              Secret version of Secret Value for Config variable.
+      - !ruby/object:Api::Type::NestedObject
+        name: "clientPrivateKey"
+        description: |
+          Client Private Key
+        properties:
+          - !ruby/object:Api::Type::String
+            name: "secretVersion"
+            required: true
+            description: |
+              Secret version of Secret Value for Config variable.
+      - !ruby/object:Api::Type::NestedObject
+        name: "clientPrivateKeyPass"
+        description: |
+          Secret containing the passphrase protecting the Client Private Key
+        properties:
+          - !ruby/object:Api::Type::String
+            name: "secretVersion"
+            required: true
+            description: |
+              Secret version of Secret Value for Config variable.
+      - !ruby/object:Api::Type::Enum
+        name: "serverCertType"
+        description: |
+          Type of Server Cert (PEM/JKS/.. etc.)
+        values:
+          - PEM
+      - !ruby/object:Api::Type::Enum
+        name: "clientCertType"
+        description: |
+          Type of Client Cert (PEM/JKS/.. etc.)
+        values:
+          - PEM
+      - !ruby/object:Api::Type::Boolean
+        name: "useSsl"
+        description: |
+          Bool for enabling SSL
+      - !ruby/object:Api::Type::Array
+        name: "additionalVariable"
+        api_name: "additionalVariables"
+        description: |
+          Additional SSL related field values.
+        item_type: !ruby/object:Api::Type::NestedObject
+          properties:
+            - !ruby/object:Api::Type::String
+              name: "key"
+              description: |
+                Key for the configVariable
+              required: true
+            - !ruby/object:Api::Type::Integer
+              name: "integerValue"
+              api_name: "intValue"
+              description: |
+                Integer Value of configVariable.
+            - !ruby/object:Api::Type::String
+              name: "stringValue"
+              description: |
+                String Value of configVariabley.
+            - !ruby/object:Api::Type::Boolean
+              name: "booleanValue"
+              api_name: "boolValue"
+              description: |
+                Boolean Value of configVariable.
+            - !ruby/object:Api::Type::NestedObject
+              name: "secretValue"
+              description: |
+                Secret value of configVariable
+              properties:
+                - !ruby/object:Api::Type::String
+                  name: "secretVersion"
+                  required: true
+                  description: |
+                    Secret version of Secret Value for Config variable.
+            - !ruby/object:Api::Type::NestedObject
+              name: "encryptionKeyValue"
+              description: |
+                Encription key value of configVariable
+              properties:
+                - !ruby/object:Api::Type::Enum
+                  name: "type"
+                  description: |
+                    Type of Encription Key
+                  values:
+                    - GOOGLE_MANAGED
+                    - CUSTOMER_MANAGED
+                - !ruby/object:Api::Type::String
+                  name: "kmsKeyName"
+                  description: |
+                    The [KMS key name] with which the content of the Operation is encrypted. The expected
+                    format: projects/*/locations/*/keyRings/*/cryptoKeys/*.
+                    Will be empty string if google managed.
+  - !ruby/object:Api::Type::String
+    name: "subscriptionType"
+    description: |
+      This subscription type enum states the subscription type of the project.
+    output: true
+  - !ruby/object:Api::Type::String
+    name: "connectionRevision"
+    description: |
+      Connection revision. This field is only updated when the connection is created or updated by User.
+    output: true
+  - !ruby/object:Api::Type::Enum
+    name: "eventingEnablementType"
+    description: |
+      Eventing enablement type. Will be nil if eventing is not enabled.
+    values:
+      - EVENTING_AND_CONNECTION
+      - ONLY_EVENTING
+  - !ruby/object:Api::Type::NestedObject
+    name: "eventingConfig"
+    description: |
+      Eventing Configuration of a connection
+    properties:
+      - !ruby/object:Api::Type::NestedObject
+        name: "registrationDestinationConfig"
+        required: true
+        description: |
+          registrationDestinationConfig
+        properties:
+          - !ruby/object:Api::Type::String
+            name: "key"
+            description: |
+              Key for the connection
+          - !ruby/object:Api::Type::Array
+            name: "destination"
+            api_name: "destinations"
+            description: |
+              destinations for the connection
+            item_type: !ruby/object:Api::Type::NestedObject
+              properties:
+                - !ruby/object:Api::Type::Integer
+                  name: "port"
+                  description: |
+                    port number
+                - !ruby/object:Api::Type::String
+                  name: "serviceAttachment"
+                  description: |
+                    Service Attachment
+                - !ruby/object:Api::Type::String
+                  name: "host"
+                  description: |
+                    Host
+      - !ruby/object:Api::Type::NestedObject
+        name: "authConfig"
+        description: |
+          authConfig for Eventing Configuration.
+        properties:
+          - !ruby/object:Api::Type::Enum
+            name: "authType"
+            required: true
+            description: |
+              authType of the Connection
+            values:
+              - USER_PASSWORD
+          - !ruby/object:Api::Type::Array
+            name: "additionalVariable"
+            api_name: "additionalVariables"
+            description: |
+              List containing additional auth configs.
+            item_type: !ruby/object:Api::Type::NestedObject
+              properties:
+                - !ruby/object:Api::Type::String
+                  name: "key"
+                  description: |
+                    Key for the configVariable
+                  required: true
+                - !ruby/object:Api::Type::Integer
+                  name: "integerValue"
+                  api_name: "intValue"
+                  description: |
+                    Integer Value of configVariable.
+                - !ruby/object:Api::Type::String
+                  name: "stringValue"
+                  description: |
+                    String Value of configVariabley.
+                - !ruby/object:Api::Type::Boolean
+                  name: "booleanValue"
+                  api_name: "boolValue"
+                  description: |
+                    Boolean Value of configVariable.
+                - !ruby/object:Api::Type::NestedObject
+                  name: "secretValue"
+                  description: |
+                    Secret value of configVariable
+                  properties:
+                    - !ruby/object:Api::Type::String
+                      name: "secretVersion"
+                      required: true
+                      description: |
+                        Secret version of Secret Value for Config variable.
+                - !ruby/object:Api::Type::NestedObject
+                  name: "encryptionKeyValue"
+                  description: |
+                    Encription key value of configVariable
+                  properties:
+                    - !ruby/object:Api::Type::Enum
+                      name: "type"
+                      description: |
+                        Type of Encription Key
+                      values:
+                        - GOOGLE_MANAGED
+                        - CUSTOMER_MANAGED
+                    - !ruby/object:Api::Type::String
+                      name: "kmsKeyName"
+                      description: |
+                        The [KMS key name] with which the content of the Operation is encrypted. The expected
+                        format: projects/*/locations/*/keyRings/*/cryptoKeys/*.
+                        Will be empty string if google managed.
+          - !ruby/object:Api::Type::String
+            name: "authKey"
+            description: |
+              The type of authentication configured.
+          - !ruby/object:Api::Type::NestedObject
+            name: "userPassword"
+            required: true
+            description: |
+              User password for Authentication.
+            properties:
+              - !ruby/object:Api::Type::String
+                name: "username"
+                description: |
+                  Username for Authentication.
+              - !ruby/object:Api::Type::NestedObject
+                name: "password"
+                description: |
+                  Password for Authentication.
+                properties:
+                  - !ruby/object:Api::Type::String
+                    name: "secretVersion"
+                    required: true
+                    description: |
+                      The resource name of the secret version in the format,
+                      format as: projects/*/secrets/*/versions/*.
+      - !ruby/object:Api::Type::Array
+        name: "additionalVariable"
+        api_name: "additionalVariables"
+        description: |
+          List containing additional auth configs.
+        item_type: !ruby/object:Api::Type::NestedObject
+          properties:
+            - !ruby/object:Api::Type::String
+              name: "key"
+              description: |
+                Key for the configVariable
+              required: true
+            - !ruby/object:Api::Type::Integer
+              name: "integerValue"
+              api_name: "intValue"
+              description: |
+                Integer Value of configVariable.
+            - !ruby/object:Api::Type::String
+              name: "stringValue"
+              description: |
+                String Value of configVariabley.
+            - !ruby/object:Api::Type::Boolean
+              name: "booleanValue"
+              api_name: "boolValue"
+              description: |
+                Boolean Value of configVariable.
+            - !ruby/object:Api::Type::NestedObject
+              name: "secretValue"
+              description: |
+                Secret value of configVariable
+              properties:
+                - !ruby/object:Api::Type::String
+                  name: "secretVersion"
+                  required: true
+                  description: |
+                    Secret version of Secret Value for Config variable.
+            - !ruby/object:Api::Type::NestedObject
+              name: "encryptionKeyValue"
+              description: |
+                Encription key value of configVariable.
+              properties:
+                - !ruby/object:Api::Type::Enum
+                  name: "type"
+                  description: |
+                    Type of Encryption Key
+                  values:
+                    - GOOGLE_MANAGED
+                    - CUSTOMER_MANAGED
+                - !ruby/object:Api::Type::String
+                  name: "kmsKeyName"
+                  description: |
+                    The [KMS key name] with which the content of the Operation is encrypted. The expected
+                    format: projects/*/locations/*/keyRings/*/cryptoKeys/*.
+                    Will be empty string if google managed.
+      - !ruby/object:Api::Type::Boolean
+        name: "enrichmentEnabled"
+        description: |
+          Enrichment Enabled.
+  - !ruby/object:Api::Type::String
+    name: "connectorVersionLaunchStage"
+    description: |
+      Flag to mark the version indicating the launch stage.
+    output: true
+  - !ruby/object:Api::Type::NestedObject
+    name: "eventingRuntimeData"
+    description: |
+      Eventing Runtime Data.
+    output: true
+    properties:
+      - !ruby/object:Api::Type::NestedObject
+        name: "status"
+        description: |
+          Current status of eventing.
+        output: true
+        properties:
+          - !ruby/object:Api::Type::String
+            name: "state"
+            description: |
+              State of the Eventing
+            output: true
+          - !ruby/object:Api::Type::String
+            name: "description"
+            description: |
+              Description of error if State is set to "ERROR".
+            output: true
+      - !ruby/object:Api::Type::String
+        name: "eventsListenerEndpoint"
+        description: |
+          Events listener endpoint. The value will populated after provisioning the events listener.
+  - !ruby/object:Api::Type::NestedObject
+    name: "connectorVersionInfraConfig"
+    description: |
+      This cofiguration provides infra configs like rate limit threshold which need to be configurable for every connector version.
+    output: true
+    properties:
+      - !ruby/object:Api::Type::String
+        name: "ratelimitThreshold"
+        output: true
+        description: |
+          Max QPS supported by the connector version before throttling of requests.
diff --git a/mmv1/products/integrationconnectors/product.yaml b/mmv1/products/integrationconnectors/product.yaml
new file mode 100644
index 000000000000..7d154bee8856
--- /dev/null
+++ b/mmv1/products/integrationconnectors/product.yaml
@@ -0,0 +1,33 @@
+# Copyright 2020 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+--- !ruby/object:Api::Product
+name: IntegrationConnectors
+display_name: Integration Connectors
+versions:
+  - !ruby/object:Api::Product::Version
+    name: ga
+    base_url: https://connectors.googleapis.com/v1/
+  # IntegrationConnectors has no beta API, but running the full Terraform
+  # acceptance tests depends on a beta-only resource and a bug in MM
+  # will generate beta tests against the GA provider in this case, so
+  # we fake a beta API with the same endpoint as the GA API.
+  - !ruby/object:Api::Product::Version
+    name: beta
+    base_url: https://connectors.googleapis.com/v1/
+scopes:
+  - https://www.googleapis.com/auth/cloud-platform
+apis_required:
+  - !ruby/object:Api::Product::ApiReference
+    name: Connectors API
+    url: https://console.cloud.google.com/apis/api/connectors.googleapis.com/
diff --git a/mmv1/products/kms/CryptoKey.yaml b/mmv1/products/kms/CryptoKey.yaml
index bbfc7551db90..efa270a82173 100644
--- a/mmv1/products/kms/CryptoKey.yaml
+++ b/mmv1/products/kms/CryptoKey.yaml
@@ -80,7 +80,7 @@ properties:
     immutable: true
     url_param_only: true
     ignore_read: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Labels with user-defined metadata to apply to this resource.
diff --git a/mmv1/products/logging/Metric.yaml b/mmv1/products/logging/Metric.yaml
index 030758a8465d..5bcf2eae51bb 100644
--- a/mmv1/products/logging/Metric.yaml
+++ b/mmv1/products/logging/Metric.yaml
@@ -132,7 +132,7 @@ properties:
           - :CUMULATIVE
         required: true
       - !ruby/object:Api::Type::Array
-        name: labels
+        name: 'labels'
         description: |
           The set of labels that can be used to describe a specific instance of this metric type. For
           example, the appengine.googleapis.com/http/server/response_latencies metric type has a label
@@ -206,28 +206,19 @@ properties:
         properties:
           - !ruby/object:Api::Type::Integer
             name: numFiniteBuckets
-            at_least_one_of:
-              - bucket_options.0.linear_buckets.0.num_finite_buckets
-              - bucket_options.0.linear_buckets.0.width
-              - bucket_options.0.linear_buckets.0.offset
             description: |
               Must be greater than 0.
+            required: true
           - !ruby/object:Api::Type::Double
             name: width
-            at_least_one_of:
-              - bucket_options.0.linear_buckets.0.num_finite_buckets
-              - bucket_options.0.linear_buckets.0.width
-              - bucket_options.0.linear_buckets.0.offset
             description: |
               Must be greater than 0.
+            required: true
           - !ruby/object:Api::Type::Double
             name: offset
-            at_least_one_of:
-              - bucket_options.0.linear_buckets.0.num_finite_buckets
-              - bucket_options.0.linear_buckets.0.width
-              - bucket_options.0.linear_buckets.0.offset
             description: |
               Lower bound of the first bucket.
+            required: true
       - !ruby/object:Api::Type::NestedObject
         name: exponentialBuckets
         at_least_one_of:
@@ -240,28 +231,19 @@ properties:
         properties:
           - !ruby/object:Api::Type::Integer
             name: numFiniteBuckets
-            at_least_one_of:
-              - bucket_options.0.exponential_buckets.0.num_finite_buckets
-              - bucket_options.0.exponential_buckets.0.growth_factor
-              - bucket_options.0.exponential_buckets.0.scale
             description: |
               Must be greater than 0.
+            required: true
           - !ruby/object:Api::Type::Double
             name: growthFactor
-            at_least_one_of:
-              - bucket_options.0.exponential_buckets.0.num_finite_buckets
-              - bucket_options.0.exponential_buckets.0.growth_factor
-              - bucket_options.0.exponential_buckets.0.scale
             description: |
               Must be greater than 1.
+            required: true
           - !ruby/object:Api::Type::Double
             name: scale
-            at_least_one_of:
-              - bucket_options.0.exponential_buckets.0.num_finite_buckets
-              - bucket_options.0.exponential_buckets.0.growth_factor
-              - bucket_options.0.exponential_buckets.0.scale
             description: |
               Must be greater than 0.
+            required: true
       - !ruby/object:Api::Type::NestedObject
         name: explicitBuckets
         at_least_one_of:
diff --git a/mmv1/products/looker/Instance.yaml b/mmv1/products/looker/Instance.yaml
index 7e645702f776..5af50943cc3b 100644
--- a/mmv1/products/looker/Instance.yaml
+++ b/mmv1/products/looker/Instance.yaml
@@ -48,6 +48,18 @@ examples:
   - !ruby/object:Provider::Terraform::Examples
     name: 'looker_instance_enterprise_full'
     primary_resource_id: 'looker-instance'
+    vars:
+      network_name: 'looker-network'
+      kms_key_ring_name: 'looker-kms-ring'
+      kms_key_name: 'looker-kms-key'
+      address_name: 'looker-range'
+      instance_name: 'my-instance'
+      client_id: 'my-client-id'
+      client_secret: 'my-client-secret'
+    skip_test: true
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'looker_instance_enterprise_full_test'
+    primary_resource_id: 'looker-instance'
     vars:
       network_name: 'looker-network'
       kms_key_ring_name: 'looker-kms-ring'
@@ -57,8 +69,10 @@ examples:
       client_id: 'my-client-id'
       client_secret: 'my-client-secret'
     test_vars_overrides:
-      network_name: 'acctest.BootstrapSharedTestNetwork(t, "looker-instance-enterprise")'
+      address_name: 'acctest.BootstrapSharedTestGlobalAddress(t, "looker-vpc-network-1", acctest.AddressWithPrefixLength(20))'
       kms_key_name: 'acctest.BootstrapKMSKeyInLocation(t, "us-central1").CryptoKey.Name'
+      network_name: 'acctest.BootstrapSharedServiceNetworkingConnection(t, "looker-vpc-network-1", acctest.AddressWithPrefixLength(20))'
+    skip_docs: true
 parameters:
   - !ruby/object:Api::Type::String
     name: 'region'
@@ -345,14 +359,12 @@ properties:
       - LOOKER_CORE_STANDARD_ANNUAL: subscription standard instance
       - LOOKER_CORE_ENTERPRISE_ANNUAL: subscription enterprise instance
       - LOOKER_CORE_EMBED_ANNUAL: subscription embed instance
-      - LOOKER_MODELER: standalone modeling service
     values:
       - :LOOKER_CORE_TRIAL
       - :LOOKER_CORE_STANDARD
       - :LOOKER_CORE_STANDARD_ANNUAL
       - :LOOKER_CORE_ENTERPRISE_ANNUAL
       - :LOOKER_CORE_EMBED_ANNUAL
-      - :LOOKER_MODELER
     default_value: :LOOKER_CORE_TRIAL
     immutable: true
   - !ruby/object:Api::Type::Boolean
diff --git a/mmv1/products/memcache/Instance.yaml b/mmv1/products/memcache/Instance.yaml
index 11637e7d1cd4..69b01c7aed55 100644
--- a/mmv1/products/memcache/Instance.yaml
+++ b/mmv1/products/memcache/Instance.yaml
@@ -33,12 +33,21 @@ examples:
   - !ruby/object:Provider::Terraform::Examples
     name: 'memcache_instance_basic'
     primary_resource_id: 'instance'
+    vars:
+      instance_name: 'test-instance'
+      network_name: 'test-network'
+      address_name: 'address'
+    skip_test: true
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'memcache_instance_basic_test'
+    primary_resource_id: 'instance'
     vars:
       instance_name: 'test-instance'
       network_name: 'test-network'
       address_name: 'address'
     test_vars_overrides:
-      network_name: 'acctest.BootstrapSharedTestNetwork(t, "memcache-instance-basic")'
+      network_name: 'acctest.BootstrapSharedServiceNetworkingConnection(t, "vpc-network-1")'
+    skip_docs: true
 parameters:
   - !ruby/object:Api::Type::String
     name: 'region'
@@ -101,7 +110,7 @@ properties:
     name: 'discoveryEndpoint'
     description: Endpoint for Discovery API
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Resource labels to represent user-provided metadata.
diff --git a/mmv1/products/metastore/Federation.yaml b/mmv1/products/metastore/Federation.yaml
index b4fadf816107..565f0d9f8077 100644
--- a/mmv1/products/metastore/Federation.yaml
+++ b/mmv1/products/metastore/Federation.yaml
@@ -92,7 +92,7 @@ properties:
     output: true
     description: |
       The relative resource name of the metastore federation.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: 'User-defined labels for the metastore federation.'
   - !ruby/object:Api::Type::String
diff --git a/mmv1/products/metastore/Service.yaml b/mmv1/products/metastore/Service.yaml
index b4097033db09..ec54fa3e782b 100644
--- a/mmv1/products/metastore/Service.yaml
+++ b/mmv1/products/metastore/Service.yaml
@@ -155,7 +155,7 @@ properties:
     output: true
     description: |
       The relative resource name of the metastore service.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: 'User-defined labels for the metastore service.'
   # This is an x-product resource reference.
diff --git a/mmv1/products/mlengine/Model.yaml b/mmv1/products/mlengine/Model.yaml
index 9ea33d2aa9f9..281cc3665f2e 100644
--- a/mmv1/products/mlengine/Model.yaml
+++ b/mmv1/products/mlengine/Model.yaml
@@ -96,6 +96,6 @@ properties:
     description:
       If true, online prediction nodes send stderr and stdout streams to
       Stackdriver Logging
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: One or more labels that you can add, to organize your models.
diff --git a/mmv1/products/monitoring/AlertPolicy.yaml b/mmv1/products/monitoring/AlertPolicy.yaml
index 6ec4e791e16f..92aa4f110ad8 100644
--- a/mmv1/products/monitoring/AlertPolicy.yaml
+++ b/mmv1/products/monitoring/AlertPolicy.yaml
@@ -52,6 +52,13 @@ examples:
     primary_resource_id: 'alert_policy'
     vars:
       alert_policy_display_name: 'My Alert Policy'
+  # skipping tests because the API is full of race conditions
+  - !ruby/object:Provider::Terraform::Examples
+    skip_test: true
+    name: 'monitoring_alert_policy_promql_condition'
+    primary_resource_id: 'alert_policy'
+    vars:
+      alert_policy_display_name: 'My Alert Policy'
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   constants: templates/terraform/constants/monitoring_alert_policy.go.erb
   custom_import: templates/terraform/custom_import/self_link_as_name.erb
@@ -828,8 +835,6 @@ properties:
         - !ruby/object:Api::Type::NestedObject
           name: conditionPrometheusQueryLanguage
           description: |
-            A Monitoring Query Language query that outputs a boolean stream
-
             A condition type that allows alert policies to be defined using
             Prometheus Query Language (PromQL).
 
@@ -859,7 +864,7 @@ properties:
                 alerting rule, then this value should be taken from the enclosing
                 rule group.
             - !ruby/object:Api::Type::KeyValuePairs
-              name: labels
+              name: 'labels'
               description: |
                 Labels to add to or overwrite in the PromQL query result. Label names
                 must be valid.
@@ -878,10 +883,7 @@ properties:
                 in order to refer to the original Prometheus configuration file.
                 The rule group name and the alert name are necessary to update the
                 relevant AlertPolicies in case the definition of the rule group changes
-                in the future.
-
-                This field is optional. If this field is not empty, then it must be a
-                valid Prometheus label name.
+                in the future. This field is optional.
             - !ruby/object:Api::Type::String
               name: alertRule
               description: |
@@ -969,6 +971,7 @@ properties:
         at_least_one_of:
           - documentation.0.content
           - documentation.0.mime_type
+          - documentation.0.subject
         description: |
           The text of the documentation, interpreted according to mimeType.
           The content may not exceed 8,192 Unicode characters and may not
@@ -979,7 +982,19 @@ properties:
         at_least_one_of:
           - documentation.0.content
           - documentation.0.mime_type
+          - documentation.0.subject
         default_value: text/markdown
         description: |
           The format of the content field. Presently, only the value
           "text/markdown" is supported.
+      - !ruby/object:Api::Type::String
+        name: subject
+        at_least_one_of:
+          - documentation.0.content
+          - documentation.0.mime_type
+          - documentation.0.subject
+        description: |
+          The subject line of the notification. The subject line may not
+          exceed 10,240 bytes. In notifications generated by this policy the contents
+          of the subject line after variable expansion will be truncated to 255 bytes
+          or shorter at the latest UTF-8 character boundary.
diff --git a/mmv1/products/monitoring/MetricDescriptor.yaml b/mmv1/products/monitoring/MetricDescriptor.yaml
index d83d04bc820b..721677e7eba7 100644
--- a/mmv1/products/monitoring/MetricDescriptor.yaml
+++ b/mmv1/products/monitoring/MetricDescriptor.yaml
@@ -69,11 +69,12 @@ properties:
       the DNS name custom.googleapis.com, external.googleapis.com, or
       logging.googleapis.com/user/.
   - !ruby/object:Api::Type::Array
-    name: labels
+    name: 'labels'
     description:
       The set of labels that can be used to describe a specific instance of this
       metric type. In order to delete a label, the entire resource must be
       deleted, then created with the desired labels.
+    immutable: true
     is_set: true
     item_type: !ruby/object:Api::Type::NestedObject
       properties:
@@ -161,7 +162,6 @@ properties:
       Use sentence case without an ending period, for example "Request count".
   - !ruby/object:Api::Type::NestedObject
     name: metadata
-    immutable: true
     description: Metadata which can be used to guide usage of the metric.
     ignore_read: true
     properties:
diff --git a/mmv1/products/monitoring/MonitoredProject.yaml b/mmv1/products/monitoring/MonitoredProject.yaml
index bc06bfa0b8cc..135065548d06 100644
--- a/mmv1/products/monitoring/MonitoredProject.yaml
+++ b/mmv1/products/monitoring/MonitoredProject.yaml
@@ -15,7 +15,7 @@
 name: MonitoredProject
 base_url: v1/locations/global/metricsScopes
 create_url: v1/locations/global/metricsScopes/{{metrics_scope}}/projects
-delete_url: v1/locations/global/metricsScopes/{{metrics_scope}}/projects/{{name}}
+delete_url: v1/{{name}}
 self_link: v1/locations/global/metricsScopes/{{metrics_scope}}
 id_format: locations/global/metricsScopes/{{metrics_scope}}/projects/{{name}}
 schema_version: 1
@@ -24,9 +24,6 @@ references: !ruby/object:Api::Resource::ReferenceLinks
   guides:
     'Official Documentation': 'https://cloud.google.com/monitoring/settings/manage-api'
   api: 'https://cloud.google.com/monitoring/api/ref_v3/rest/v1/locations.global.metricsScopes.projects'
-nested_query: !ruby/object:Api::Resource::NestedQuery
-  keys:
-    - monitoredProjects
 description: "A [project being monitored](https://cloud.google.com/monitoring/settings/multiple-projects#create-multi) by a Metrics Scope."
 immutable: true
 error_retry_predicates: ['transport_tpg.IsMonitoringPermissionError']
diff --git a/mmv1/products/monitoring/NotificationChannel.yaml b/mmv1/products/monitoring/NotificationChannel.yaml
index fe021aa1ff00..0efb110aef66 100644
--- a/mmv1/products/monitoring/NotificationChannel.yaml
+++ b/mmv1/products/monitoring/NotificationChannel.yaml
@@ -72,14 +72,14 @@ custom_code: !ruby/object:Provider::Terraform::CustomCode
   encoder: templates/terraform/encoders/monitoring_notification_channel.go.erb
   decoder: templates/terraform/decoders/monitoring_notification_channel.go.erb
   constants: templates/terraform/constants/monitoring_notification_channel.go.erb
-  custom_import: templates/terraform/custom_import/self_link_as_name.erb
+  custom_import: templates/terraform/custom_import/self_link_as_name_set_project.go.erb
   post_create: templates/terraform/post_create/set_computed_name.erb
 custom_diff: [
   'sensitiveLabelCustomizeDiff',
 ]
 properties:
   - !ruby/object:Api::Type::KeyValuePairs
-    name: labels
+    name: 'labels'
     description: |
       Configuration fields that define the channel and its behavior. The
       permissible and required labels are specified in the
diff --git a/mmv1/products/monitoring/Service.yaml b/mmv1/products/monitoring/Service.yaml
index a6d1255c8fcb..4624cafcd416 100644
--- a/mmv1/products/monitoring/Service.yaml
+++ b/mmv1/products/monitoring/Service.yaml
@@ -54,7 +54,7 @@ parameters:
     custom_flatten: templates/terraform/custom_flatten/name_from_self_link.erb
     default_from_api: true
     validation: !ruby/object:Provider::Terraform::Validation
-      regex: '^[a-z0-9\-]+$'
+      regex: '^[a-zA-Z0-9\-_:.]+$'
 properties:
   - !ruby/object:Api::Type::String
     name: name
diff --git a/mmv1/products/monitoring/Slo.yaml b/mmv1/products/monitoring/Slo.yaml
index 1f29828e282c..b29c5b7a1304 100644
--- a/mmv1/products/monitoring/Slo.yaml
+++ b/mmv1/products/monitoring/Slo.yaml
@@ -95,7 +95,7 @@ parameters:
     custom_flatten: templates/terraform/custom_flatten/name_from_self_link.erb
     default_from_api: true
     validation: !ruby/object:Provider::Terraform::Validation
-      regex: '^[a-z0-9\-]+$'
+      regex: '^[a-zA-Z0-9\-_:.]+$'
 properties:
   - !ruby/object:Api::Type::String
     name: name
diff --git a/mmv1/products/monitoring/UptimeCheckConfig.yaml b/mmv1/products/monitoring/UptimeCheckConfig.yaml
index b1d923680ebc..5da0d11df199 100644
--- a/mmv1/products/monitoring/UptimeCheckConfig.yaml
+++ b/mmv1/products/monitoring/UptimeCheckConfig.yaml
@@ -78,7 +78,7 @@ properties:
     output: true
     description:
       A unique resource name for this UptimeCheckConfig. The format is
-      projects/[PROJECT_ID]/uptimeCheckConfigs/[UPTIME_CHECK_ID].
+      `projects/[PROJECT_ID]/uptimeCheckConfigs/[UPTIME_CHECK_ID]`.
   - !ruby/object:Api::Type::String
     name: uptimeCheckId
     api_name: id
@@ -104,8 +104,8 @@ properties:
     required: true
     description:
       The maximum amount of time to wait for the request to complete (must be
-      between 1 and 60 seconds). Accepted formats
-      https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#google.protobuf.Duration
+      between 1 and 60 seconds). [See the accepted formats](
+      https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#google.protobuf.Duration)
   - !ruby/object:Api::Type::Array
     name: contentMatchers
     description:
@@ -167,11 +167,20 @@ properties:
     immutable: true
     description:
       The checker type to use for the check. If the monitored resource type is
-      servicedirectory_service, checkerType must be set to VPC_CHECKERS.
+      `servicedirectory_service`, `checker_type` must be set to `VPC_CHECKERS`.
     values:
       - :STATIC_IP_CHECKERS
       - :VPC_CHECKERS
     default_from_api: true
+  - !ruby/object:Api::Type::KeyValuePairs
+    name: userLabels
+    description:
+      User-supplied key/value data to be used for organizing and
+      identifying the `UptimeCheckConfig` objects.
+      The field can contain up to 64 entries. Each key and value is limited to
+      63 Unicode characters or 128 bytes, whichever is smaller. Labels and
+      values can contain only lowercase letters, numerals, underscores, and
+      dashes. Keys must begin with a letter.
   - !ruby/object:Api::Type::NestedObject
     name: httpCheck
     description: Contains information needed to make an HTTP or HTTPS check.
@@ -181,7 +190,7 @@ properties:
         immutable: true
         description:
           The HTTP request method to use for the check. If set to
-          METHOD_UNSPECIFIED then requestMethod defaults to GET.
+          `METHOD_UNSPECIFIED` then `request_method` defaults to `GET`.
         default_value: :GET
         values:
           - :METHOD_UNSPECIFIED
@@ -193,6 +202,16 @@ properties:
         values:
           - :TYPE_UNSPECIFIED
           - :URL_ENCODED
+          - :USER_PROVIDED
+      - !ruby/object:Api::Type::String
+        name: customContentType
+        description:
+          A user provided content type header to use for the check. The invalid
+          configurations outlined in the `content_type` field apply to
+          custom_content_type`, as well as the following
+            1. `content_type` is `URL_ENCODED` and `custom_content_type` is set.
+            2. `content_type` is `USER_PROVIDED` and `custom_content_type` is not
+            set.
       - !ruby/object:Api::Type::NestedObject
         name: authInfo
         at_least_one_of:
@@ -227,8 +246,9 @@ properties:
           - http_check.0.mask_headers
         description:
           The port to the page to run the check against. Will be combined with
-          host (specified within the MonitoredResource) and path to construct
-          the full URL. Optional (defaults to 80 without SSL, or 443 with SSL).
+          `host` (specified within the [`monitored_resource`](#nested_monitored_resource))
+          and path to construct the full URL. Optional (defaults to 80 without
+          SSL, or 443 with SSL).
         default_from_api: true
       - !ruby/object:Api::Type::KeyValuePairs
         name: headers
@@ -243,11 +263,11 @@ properties:
           The list of headers to send as part of the uptime check request. If
           two headers have the same key and different values, they should be
           entered as a single header, with the value being a comma-separated
-          list of all the desired values as described at
-          https://www.w3.org/Protocols/rfc2616/rfc2616.txt (page 31). Entering
-          two separate headers with the same key in a Create call will cause the
-          first to be overwritten by the second. The maximum number of headers
-          allowed is 100.
+          list of all the desired values as described in
+          [RFC 2616 (page 31)](https://www.w3.org/Protocols/rfc2616/rfc2616.txt).
+          Entering two separate headers with the same key in a Create call will
+          cause the first to be overwritten by the second. The maximum number
+          of headers allowed is 100.
         default_from_api: true
       - !ruby/object:Api::Type::String
         name: path
@@ -262,8 +282,8 @@ properties:
         description:
           The path to the page to run the check against. Will be combined with
           the host (specified within the MonitoredResource) and port to
-          construct the full URL. If the provided path does not begin with "/",
-          a "/" will be prepended automatically. Optional (defaults to "/").
+          construct the full URL. If the provided path does not begin with `/`,
+          a `/` will be prepended automatically. Optional (defaults to `/`).
         diff_suppress_func: resourceMonitoringUptimeCheckConfigHttpCheckPathDiffSuppress
       - !ruby/object:Api::Type::Boolean
         name: useSsl
@@ -280,8 +300,8 @@ properties:
         description:
           Boolean specifying whether to include SSL certificate validation as a
           part of the Uptime check. Only applies to checks where
-          monitoredResource is set to uptime_url. If useSsl is false, setting
-          validateSsl to true has no effect.
+          `monitored_resource` is set to `uptime_url`. If `use_ssl` is `false`, setting
+          `validate_ssl` to `true` has no effect.
       - !ruby/object:Api::Type::Boolean
         name: maskHeaders
         at_least_one_of:
@@ -296,19 +316,19 @@ properties:
           Encryption should be specified for any headers related to
           authentication that you do not wish to be seen when retrieving the
           configuration. The server will be responsible for encrypting the
-          headers. On Get/List calls, if mask_headers is set to True then the
-          headers will be obscured with ******.
+          headers. On Get/List calls, if `mask_headers` is set to `true` then the
+          headers will be obscured with `******`.
       - !ruby/object:Api::Type::String
         name: body
         description:
-          The request body associated with the HTTP POST request. If contentType
-          is URL_ENCODED, the body passed in must be URL-encoded. Users can
-          provide a Content-Length header via the headers field or the API will
-          do so. If the requestMethod is GET and body is not empty, the API will
+          The request body associated with the HTTP POST request. If `content_type`
+          is `URL_ENCODED`, the body passed in must be URL-encoded. Users can
+          provide a `Content-Length` header via the `headers` field or the API will
+          do so. If the `request_method` is `GET` and `body` is not empty, the API will
           return an error. The maximum byte size is 1 megabyte. Note - As with
           all bytes fields JSON representations are base64 encoded. e.g.
-          "foo=bar" in URL-encoded form is "foo%3Dbar" and in base64 encoding is
-          "Zm9vJTI1M0RiYXI=".
+          `foo=bar` in URL-encoded form is `foo%3Dbar` and in base64 encoding is
+          `Zm9vJTI1M0RiYXI=`.
       - !ruby/object:Api::Type::Array
         name: acceptedResponseStatusCodes
         description:
@@ -330,6 +350,16 @@ properties:
                 - :STATUS_CLASS_4XX
                 - :STATUS_CLASS_5XX
                 - :STATUS_CLASS_ANY
+      - !ruby/object:Api::Type::NestedObject
+        name: pingConfig
+        description:
+          Contains information needed to add pings to an HTTP check.
+        properties:
+          - !ruby/object:Api::Type::Integer
+            name: pingsCount
+            required: true
+            description:
+              Number of ICMP pings. A maximum of 3 ICMP pings is currently supported.
   - !ruby/object:Api::Type::NestedObject
     name: tcpCheck
     description: Contains information needed to make a TCP check.
@@ -339,8 +369,18 @@ properties:
         required: true
         description:
           The port to the page to run the check against. Will be combined with
-          host (specified within the MonitoredResource) to construct the full
+          host (specified within the `monitored_resource`) to construct the full
           URL.
+      - !ruby/object:Api::Type::NestedObject
+        name: pingConfig
+        description:
+          Contains information needed to add pings to a TCP check.
+        properties:
+          - !ruby/object:Api::Type::Integer
+            name: pingsCount
+            required: true
+            description:
+              Number of ICMP pings. A maximum of 3 ICMP pings is currently supported.
   - !ruby/object:Api::Type::NestedObject
     name: resourceGroup
     immutable: true
@@ -377,12 +417,18 @@ properties:
   - !ruby/object:Api::Type::NestedObject
     name: monitoredResource
     immutable: true
-    description:
-      'The monitored resource
+    description: |
+      The [monitored resource]
       (https://cloud.google.com/monitoring/api/resources) associated with the
       configuration. The following monitored resource types are supported for
-      uptime checks:  uptime_url  gce_instance  gae_app  aws_ec2_instance
-      aws_elb_load_balancer  k8s_service  servicedirectory_service'
+      uptime checks:
+      * `aws_ec2_instance`
+      * `aws_elb_load_balancer`
+      * `gae_app
+      * `gce_instance`
+      * `k8s_service`
+      * `servicedirectory_service`
+      * `uptime_url`
     exactly_one_of:
       - monitored_resource
       - resource_group
@@ -394,21 +440,18 @@ properties:
         required: true
         description:
           The monitored resource type. This field must match the type field of a
-          MonitoredResourceDescriptor
-          (https://cloud.google.com/monitoring/api/ref_v3/rest/v3/projects.monitoredResourceDescriptors#MonitoredResourceDescriptor)
+          [`MonitoredResourceDescriptor`](https://cloud.google.com/monitoring/api/ref_v3/rest/v3/projects.monitoredResourceDescriptors#MonitoredResourceDescriptor)
           object. For example, the type of a Compute Engine VM instance is
-          gce_instance. For a list of types, see Monitoring resource types
-          (https://cloud.google.com/monitoring/api/resources) and Logging
-          resource types
-          (https://cloud.google.com/logging/docs/api/v2/resource-list).
+          `gce_instance`. For a list of types, see [Monitoring resource types](https://cloud.google.com/monitoring/api/resources)
+          and [Logging resource types](https://cloud.google.com/logging/docs/api/v2/resource-list).
       - !ruby/object:Api::Type::KeyValuePairs
-        name: labels
+        name: 'labels'
         immutable: true
         required: true
         description:
           Values for all of the labels listed in the associated monitored
           resource descriptor. For example, Compute Engine VM instances use the
-          labels "project_id", "instance_id", and "zone".
+          labels `project_id`, `instance_id`, and `zone`.
   - !ruby/object:Api::Type::NestedObject
     name: syntheticMonitor
     immutable: true
diff --git a/mmv1/products/networkconnectivity/PolicyBasedRoute.yaml b/mmv1/products/networkconnectivity/PolicyBasedRoute.yaml
new file mode 100644
index 000000000000..f3fad5f660b2
--- /dev/null
+++ b/mmv1/products/networkconnectivity/PolicyBasedRoute.yaml
@@ -0,0 +1,192 @@
+# Copyright 2023 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the 'License');
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an 'AS IS' BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+--- !ruby/object:Api::Resource
+name: 'PolicyBasedRoute'
+base_url: 'projects/{{project}}/locations/global/policyBasedRoutes'
+create_url: 'projects/{{project}}/locations/global/policyBasedRoutes?policyBasedRouteId={{name}}'
+self_link: 'projects/{{project}}/locations/global/policyBasedRoutes/{{name}}'
+immutable: true
+description:
+  'Policy-based Routes are more powerful routes that route L4 network traffic based on not just destination IP, but also source IP, protocol and more. A Policy-based Route always take precedence when it conflicts with other types of routes.'
+references: !ruby/object:Api::Resource::ReferenceLinks
+  api: 'https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest/v1/projects.locations.global.policyBasedRoutes'
+  guides:
+    'Use policy-based routes': 'https://cloud.google.com/vpc/docs/use-policy-based-routes#api'
+async: !ruby/object:Api::OpAsync
+  operation: !ruby/object:Api::OpAsync::Operation
+    path: 'name'
+    base_url: '{{op_id}}'
+    wait_ms: 1000
+    timeouts: !ruby/object:Api::Timeouts
+      insert_minutes: 30
+      update_minutes: 30
+      delete_minutes: 30
+  result: !ruby/object:Api::OpAsync::Result
+    path: 'response'
+  status: !ruby/object:Api::OpAsync::Status
+    path: 'done'
+    complete: true
+    allowed:
+      - true
+      - false
+  error: !ruby/object:Api::OpAsync::Error
+    path: 'error'
+    message: 'message'
+autogen_async: true
+examples:
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'network_connectivity_policy_based_route_basic'
+    primary_resource_id: 'default'
+    vars:
+      pbr_name: 'my-pbr'
+      network_name: 'my-network'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'network_connectivity_policy_based_route_full'
+    primary_resource_id: 'default'
+    vars:
+      pbr_name: 'my-pbr'
+      network_name: 'my-network'
+      ilb_name: 'my-ilb'
+properties:
+  - !ruby/object:Api::Type::String
+    name: 'name'
+    required: true
+    url_param_only: true
+    description: |
+      The name of the policy based route.
+  - !ruby/object:Api::Type::String
+    name: 'description'
+    description: |
+      An optional description of this resource.
+  - !ruby/object:Api::Type::KeyValueLabels
+    name: 'labels'
+    description: |
+      User-defined labels.
+  - !ruby/object:Api::Type::String
+    name: 'network'
+    required: true
+    description: |
+      Fully-qualified URL of the network that this route applies to, for example: projects/my-project/global/networks/my-network.
+  - !ruby/object:Api::Type::NestedObject
+    name: 'filter'
+    required: true
+    description: |
+      The filter to match L4 traffic.
+    properties:
+      - !ruby/object:Api::Type::Enum
+        name: 'protocolVersion'
+        required: true
+        description: |
+          Internet protocol versions this policy-based route applies to.
+        values:
+          - :IPV4
+      - !ruby/object:Api::Type::String  # probably could have been an enum, but it's a string in the API
+        name: 'ipProtocol'
+        default_value: "ALL"
+        description: |
+          The IP protocol that this policy-based route applies to. Valid values are 'TCP', 'UDP', and 'ALL'. Default is 'ALL'.
+      - !ruby/object:Api::Type::String
+        name: 'srcRange'
+        default_value: "0.0.0.0/0"
+        description: |
+          The source IP range of outgoing packets that this policy-based route applies to. Default is "0.0.0.0/0" if protocol version is IPv4.
+      - !ruby/object:Api::Type::String
+        name: 'destRange'
+        default_value: "0.0.0.0/0"
+        description: |
+          The destination IP range of outgoing packets that this policy-based route applies to. Default is "0.0.0.0/0" if protocol version is IPv4.
+  - !ruby/object:Api::Type::Enum
+    name: 'nextHopOtherRoutes'
+    exactly_one_of:  # next_hop union
+      - next_hop_ilb_ip
+      - next_hop_other_routes
+    description: |
+      Other routes that will be referenced to determine the next hop of the packet.
+    values:
+      - :DEFAULT_ROUTING
+  - !ruby/object:Api::Type::String
+    name: 'nextHopIlbIp'
+    exactly_one_of:  # next_hop union
+      - next_hop_ilb_ip
+      - next_hop_other_routes
+    description: |
+      The IP address of a global-access-enabled L4 ILB that is the next hop for matching packets.
+  - !ruby/object:Api::Type::Integer
+    name: 'priority'
+    default_value: 1000
+    description: |
+      The priority of this policy-based route. Priority is used to break ties in cases where there are more than one matching policy-based routes found. In cases where multiple policy-based routes are matched, the one with the lowest-numbered priority value wins. The default value is 1000. The priority value must be from 1 to 65535, inclusive.
+  - !ruby/object:Api::Type::NestedObject
+    name: 'virtualMachine'
+    conflicts:  # target union
+      - interconnect_attachment
+    description: |
+      VM instances to which this policy-based route applies to.
+    properties:
+      - !ruby/object:Api::Type::Array
+        name: 'tags'
+        required: true  # optional in API docs, but that doesn't make sense here
+        description: |
+          A list of VM instance tags that this policy-based route applies to. VM instances that have ANY of tags specified here will install this PBR.
+        item_type: Api::Type::String
+  - !ruby/object:Api::Type::NestedObject
+    name: 'interconnectAttachment'
+    conflicts:  # target union
+      - virtual_machine
+    description: |
+      The interconnect attachments that this policy-based route applies to.
+    properties:
+      - !ruby/object:Api::Type::String
+        name: 'region'
+        required: true  # optional in API docs, but that doesn't make sense here
+        description: |
+          Cloud region to install this policy-based route on for Interconnect attachments. Use `all` to install it on all Interconnect attachments.
+  - !ruby/object:Api::Type::Time
+    name: 'createTime'
+    output: true
+    description: |
+      Time when the policy-based route was created.
+  - !ruby/object:Api::Type::Time
+    name: 'updateTime'
+    output: true
+    description: |
+      Time when the policy-based route was created.
+  - !ruby/object:Api::Type::Time
+    name: 'kind'
+    output: true
+    description: |
+      Type of this resource.
+  - !ruby/object:Api::Type::Array
+    name: 'warnings'
+    output: true
+    description: |
+       If potential misconfigurations are detected for this route, this field will be populated with warning messages.
+    item_type: !ruby/object:Api::Type::NestedObject
+      properties:
+        - !ruby/object:Api::Type::String  # technically enum, but doesn't matter for output fields
+          name: 'code'
+          output: true
+          description: |
+            A warning code, if applicable.
+        - !ruby/object:Api::Type::KeyValuePairs
+          name: 'data'
+          output: true
+          description: |
+            Metadata about this warning in key: value format. The key should provides more detail on the warning being returned. For example, for warnings where there are no results in a list request for a particular zone, this key might be scope and the key value might be the zone name. Other examples might be a key indicating a deprecated resource and a suggested replacement.
+        - !ruby/object:Api::Type::String
+          name: 'warningMessage'
+          output: true
+          description: |
+            A human-readable description of the warning code.
+# note: the API includes a "selfLink" output field that is not populated
diff --git a/mmv1/products/networkconnectivity/ServiceConnectionPolicies.yaml b/mmv1/products/networkconnectivity/ServiceConnectionPolicies.yaml
index 174943e84a94..89551984b665 100644
--- a/mmv1/products/networkconnectivity/ServiceConnectionPolicies.yaml
+++ b/mmv1/products/networkconnectivity/ServiceConnectionPolicies.yaml
@@ -205,7 +205,7 @@ properties:
     output: true
     description: |
       The type of underlying resources used to create the connection.
-  - !ruby/object:Api::Type::KeyValuePairs
-    name: "labels"
+  - !ruby/object:Api::Type::KeyValueLabels
+    name: 'labels'
     description: |
       User-defined labels.
diff --git a/mmv1/products/networkconnectivity/product.yaml b/mmv1/products/networkconnectivity/product.yaml
index 210044bd2cf8..05c5bc0c3b44 100644
--- a/mmv1/products/networkconnectivity/product.yaml
+++ b/mmv1/products/networkconnectivity/product.yaml
@@ -24,4 +24,3 @@ apis_required:
   - !ruby/object:Api::Product::ApiReference
     name: Network Connectivity API
     url: https://console.cloud.google.com/apis/library/networkconnectivity.googleapis.com/
-    
\ No newline at end of file
diff --git a/mmv1/products/networkmanagement/ConnectivityTest.yaml b/mmv1/products/networkmanagement/ConnectivityTest.yaml
index b68d0d350f43..35264ff07a99 100644
--- a/mmv1/products/networkmanagement/ConnectivityTest.yaml
+++ b/mmv1/products/networkmanagement/ConnectivityTest.yaml
@@ -204,7 +204,7 @@ properties:
       This is applicable to scenarios where a test can cross project
       boundaries.
     item_type: Api::Type::String
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Resource labels to represent user-provided metadata.
diff --git a/mmv1/products/networksecurity/AddressGroup.yaml b/mmv1/products/networksecurity/AddressGroup.yaml
index 09177a4a472b..9eb537c19f39 100644
--- a/mmv1/products/networksecurity/AddressGroup.yaml
+++ b/mmv1/products/networksecurity/AddressGroup.yaml
@@ -26,8 +26,28 @@ references:
   guides:
     "Use AddressGroups": "https://cloud.google.com/vpc/docs/use-address-groups-firewall-policies"
   api: "https://cloud.google.com/traffic-director/docs/reference/network-security/rest/v1beta1/organizations.locations.addressGroups"
-# Prevent the operation from being generated so we can call the custom one.
-autogen_async: false
+autogen_async: true
+async: !ruby/object:Api::OpAsync
+  operation: !ruby/object:Api::OpAsync::Operation
+    path: 'name'
+    base_url: '{{op_id}}'
+    wait_ms: 1000
+    timeouts: !ruby/object:Api::Timeouts
+      insert_minutes: 20
+      update_minutes: 20
+      delete_minutes: 20
+  result: !ruby/object:Api::OpAsync::Result
+    path: 'response'
+  status: !ruby/object:Api::OpAsync::Status
+    path: 'done'
+    complete: true
+    allowed:
+      - true
+      - false
+  error: !ruby/object:Api::OpAsync::Error
+    path: 'error'
+    message: 'message'
+  include_project: true
 import_format: ["{{%parent}}/locations/{{location}}/addressGroups/{{name}}"]
 examples:
   - !ruby/object:Provider::Terraform::Examples
@@ -53,9 +73,9 @@ examples:
       project: :PROJECT_NAME
 custom_code:
   !ruby/object:Provider::Terraform::CustomCode  # Calling custom operation that are different from other network security resources.
-  post_create: templates/terraform/post_create/network_security_address_group_operation.go.erb
-  post_update: templates/terraform/post_update/network_security_address_group_operation.go.erb
-  post_delete: templates/terraform/post_delete/network_security_address_group_operation.go.erb
+  pre_create: templates/terraform/pre_create/network_security_address_group_operation.go.erb
+  pre_update: templates/terraform/pre_update/network_security_address_group_operation.go.erb
+  pre_delete: templates/terraform/pre_delete/network_security_address_group_operation.go.erb
 parameters:
   - !ruby/object:Api::Type::String
     name: parent
@@ -95,8 +115,8 @@ properties:
       A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
       Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
-    name: "labels"
+  - !ruby/object:Api::Type::KeyValueLabels
+    name: 'labels'
     description: |
       Set of label tags associated with the AddressGroup resource.
       An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
diff --git a/mmv1/products/networksecurity/AuthorizationPolicy.yaml b/mmv1/products/networksecurity/AuthorizationPolicy.yaml
index f4af9f533eee..daa0dda1a7fe 100644
--- a/mmv1/products/networksecurity/AuthorizationPolicy.yaml
+++ b/mmv1/products/networksecurity/AuthorizationPolicy.yaml
@@ -84,7 +84,7 @@ properties:
     description: |
       Time the AuthorizationPolicy was updated in UTC.
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description:
       Set of label tags associated with the AuthorizationPolicy resource.
diff --git a/mmv1/products/networksecurity/ClientTlsPolicy.yaml b/mmv1/products/networksecurity/ClientTlsPolicy.yaml
index 7773d5354768..0f87404c7b78 100644
--- a/mmv1/products/networksecurity/ClientTlsPolicy.yaml
+++ b/mmv1/products/networksecurity/ClientTlsPolicy.yaml
@@ -86,7 +86,7 @@ properties:
     description: |
       Time the ClientTlsPolicy was updated in UTC.
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: Set of label tags associated with the ClientTlsPolicy resource.
   - !ruby/object:Api::Type::String
diff --git a/mmv1/products/networksecurity/ServerTlsPolicy.yaml b/mmv1/products/networksecurity/ServerTlsPolicy.yaml
index c300f03f5e12..1995fc0379b7 100644
--- a/mmv1/products/networksecurity/ServerTlsPolicy.yaml
+++ b/mmv1/products/networksecurity/ServerTlsPolicy.yaml
@@ -64,6 +64,13 @@ examples:
     primary_resource_id: 'default'
     vars:
       resource_name: 'my-server-tls-policy'
+  - !ruby/object:Provider::Terraform::Examples
+    min_version: beta
+    name: 'network_security_server_tls_policy_mtls'
+    primary_resource_id: 'default'
+    vars:
+      resource_name: 'my-server-tls-policy'
+      trust_config_name: 'my-trust-config'
 parameters:
   - !ruby/object:Api::Type::String
     name: 'name'
@@ -90,7 +97,7 @@ properties:
     description: |
       Time the ServerTlsPolicy was updated in UTC.
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: Set of label tags associated with the ServerTlsPolicy resource.
   - !ruby/object:Api::Type::String
diff --git a/mmv1/products/networkservices/EdgeCacheKeyset.yaml b/mmv1/products/networkservices/EdgeCacheKeyset.yaml
index d8b79ef24b28..b1ec5986023d 100644
--- a/mmv1/products/networkservices/EdgeCacheKeyset.yaml
+++ b/mmv1/products/networkservices/EdgeCacheKeyset.yaml
@@ -74,7 +74,7 @@ properties:
     name: 'description'
     description: |
       A human-readable description of the resource.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: 'Set of label tags associated with the EdgeCache resource.'
   - !ruby/object:Api::Type::Array
diff --git a/mmv1/products/networkservices/EdgeCacheOrigin.yaml b/mmv1/products/networkservices/EdgeCacheOrigin.yaml
index ddd14fe88e2c..4b97a7a51c82 100644
--- a/mmv1/products/networkservices/EdgeCacheOrigin.yaml
+++ b/mmv1/products/networkservices/EdgeCacheOrigin.yaml
@@ -20,15 +20,17 @@ update_verb: :PATCH
 update_mask: true
 description: |
   EdgeCacheOrigin represents a HTTP-reachable backend for an EdgeCacheService.
+references: !ruby/object:Api::Resource::ReferenceLinks
+  api: 'https://cloud.google.com/media-cdn/docs/reference/rest/v1/projects.locations.edgeCacheOrigins'
 async: !ruby/object:Api::OpAsync
   operation: !ruby/object:Api::OpAsync::Operation
     path: 'name'
     base_url: '{{op_id}}'
     wait_ms: 1000
     timeouts: !ruby/object:Api::Timeouts
-      insert_minutes: 60
-      update_minutes: 60
-      delete_minutes: 60
+      insert_minutes: 120
+      update_minutes: 120
+      delete_minutes: 120
   result: !ruby/object:Api::OpAsync::Result
     path: 'response'
   status: !ruby/object:Api::OpAsync::Status
@@ -82,7 +84,7 @@ properties:
     name: 'description'
     description: |
       A human-readable description of the resource.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: 'Set of label tags associated with the EdgeCache resource.'
   - !ruby/object:Api::Type::String
diff --git a/mmv1/products/networkservices/EdgeCacheService.yaml b/mmv1/products/networkservices/EdgeCacheService.yaml
index ff77b8df406e..c64160154345 100644
--- a/mmv1/products/networkservices/EdgeCacheService.yaml
+++ b/mmv1/products/networkservices/EdgeCacheService.yaml
@@ -26,9 +26,9 @@ async: !ruby/object:Api::OpAsync
     base_url: '{{op_id}}'
     wait_ms: 1000
     timeouts: !ruby/object:Api::Timeouts
-      insert_minutes: 30
-      update_minutes: 30
-      delete_minutes: 30
+      insert_minutes: 60
+      update_minutes: 60
+      delete_minutes: 60
   result: !ruby/object:Api::OpAsync::Result
     path: 'response'
   status: !ruby/object:Api::OpAsync::Status
@@ -85,7 +85,7 @@ properties:
     name: 'description'
     description: |
       A human-readable description of the resource.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: 'Set of label tags associated with the EdgeCache resource.'
   - !ruby/object:Api::Type::Boolean
diff --git a/mmv1/products/networkservices/EndpointPolicy.yaml b/mmv1/products/networkservices/EndpointPolicy.yaml
index ff3effffd4cf..8a2088f5a227 100644
--- a/mmv1/products/networkservices/EndpointPolicy.yaml
+++ b/mmv1/products/networkservices/EndpointPolicy.yaml
@@ -76,7 +76,7 @@ properties:
     description: |
       Time the TcpRoute was updated in UTC.
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: Set of label tags associated with the TcpRoute resource.
   - !ruby/object:Api::Type::String
diff --git a/mmv1/products/networkservices/Gateway.yaml b/mmv1/products/networkservices/Gateway.yaml
index 49843a39241c..c04a69be5f5e 100644
--- a/mmv1/products/networkservices/Gateway.yaml
+++ b/mmv1/products/networkservices/Gateway.yaml
@@ -128,7 +128,7 @@ properties:
     description: |
       Time the AccessPolicy was updated in UTC.
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: Set of label tags associated with the Gateway resource.
   - !ruby/object:Api::Type::String
diff --git a/mmv1/products/networkservices/GrpcRoute.yaml b/mmv1/products/networkservices/GrpcRoute.yaml
index c8bd32e506c9..14efbe9ecf17 100644
--- a/mmv1/products/networkservices/GrpcRoute.yaml
+++ b/mmv1/products/networkservices/GrpcRoute.yaml
@@ -88,7 +88,7 @@ properties:
     description: |
       Time the GrpcRoute was updated in UTC.
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: Set of label tags associated with the GrpcRoute resource.
   - !ruby/object:Api::Type::String
diff --git a/mmv1/products/networkservices/HttpRoute.yaml b/mmv1/products/networkservices/HttpRoute.yaml
index 77575f4dcb0f..cb60ad50e730 100644
--- a/mmv1/products/networkservices/HttpRoute.yaml
+++ b/mmv1/products/networkservices/HttpRoute.yaml
@@ -97,7 +97,7 @@ properties:
     description: |
       Time the HttpRoute was updated in UTC.
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: Set of label tags associated with the HttpRoute resource.
   - !ruby/object:Api::Type::String
diff --git a/mmv1/products/networkservices/Mesh.yaml b/mmv1/products/networkservices/Mesh.yaml
index cc61b1d1b7c5..deb7437b985a 100644
--- a/mmv1/products/networkservices/Mesh.yaml
+++ b/mmv1/products/networkservices/Mesh.yaml
@@ -83,7 +83,7 @@ properties:
     description: |
       Time the Mesh was updated in UTC.
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: Set of label tags associated with the Mesh resource.
   - !ruby/object:Api::Type::String
diff --git a/mmv1/products/networkservices/ServiceBinding.yaml b/mmv1/products/networkservices/ServiceBinding.yaml
index ffda6f36d650..c13d23a7c94c 100644
--- a/mmv1/products/networkservices/ServiceBinding.yaml
+++ b/mmv1/products/networkservices/ServiceBinding.yaml
@@ -72,7 +72,7 @@ properties:
     description: |
       Time the ServiceBinding was updated in UTC.
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: Set of label tags associated with the ServiceBinding resource.
   - !ruby/object:Api::Type::String
diff --git a/mmv1/products/networkservices/TcpRoute.yaml b/mmv1/products/networkservices/TcpRoute.yaml
index 27be31a1b54f..7fae44f3f0bc 100644
--- a/mmv1/products/networkservices/TcpRoute.yaml
+++ b/mmv1/products/networkservices/TcpRoute.yaml
@@ -104,7 +104,7 @@ properties:
     description: |
       Time the TcpRoute was updated in UTC.
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: Set of label tags associated with the TcpRoute resource.
   - !ruby/object:Api::Type::String
diff --git a/mmv1/products/notebooks/Instance.yaml b/mmv1/products/notebooks/Instance.yaml
index 6986b560e77e..c6fc8de89d4c 100644
--- a/mmv1/products/notebooks/Instance.yaml
+++ b/mmv1/products/notebooks/Instance.yaml
@@ -80,8 +80,9 @@ examples:
     test_env_vars:
       service_account: :SERVICE_ACCT
 custom_code: !ruby/object:Provider::Terraform::CustomCode
-  constants: templates/terraform/constants/notebooks_instance.go
   update_encoder: templates/terraform/update_encoder/notebooks_instance.go
+state_upgraders: true
+schema_version: 1
 parameters:
   - !ruby/object:Api::Type::ResourceRef
     name: 'location'
@@ -344,15 +345,13 @@ properties:
       Format: projects/{project_id}/regions/{region}/subnetworks/{subnetwork_id}
     diff_suppress_func: tpgresource.CompareSelfLinkOrResourceName
     default_from_api: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Labels to apply to this instance. These can be later modified by the setLabels method.
       An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
     update_verb: :PATCH
     update_url: 'projects/{{project}}/locations/{{location}}/instances/{{name}}:setLabels'
-    default_from_api: true
-    diff_suppress_func: NotebooksInstanceLabelDiffSuppress
   - !ruby/object:Api::Type::Array
     name: 'tags'
     description: |
diff --git a/mmv1/products/orgpolicy/CustomConstraint.yaml b/mmv1/products/orgpolicy/CustomConstraint.yaml
index 1e139bec4e53..e305db146275 100644
--- a/mmv1/products/orgpolicy/CustomConstraint.yaml
+++ b/mmv1/products/orgpolicy/CustomConstraint.yaml
@@ -16,7 +16,6 @@ name: 'CustomConstraint'
 self_link: '{{parent}}/customConstraints/{{name}}'
 base_url: '{{parent}}/customConstraints'
 update_verb: :PATCH
-min_version: beta
 references: !ruby/object:Api::Resource::ReferenceLinks
   guides:
     'Official Documentation': 'https://cloud.google.com/resource-manager/docs/organization-policy/creating-managing-custom-constraints'
@@ -30,15 +29,21 @@ custom_code: !ruby/object:Provider::Terraform::CustomCode
   update_encoder: 'templates/terraform/update_encoder/org_policy_custom_constraint.go.erb'
 examples:
   - !ruby/object:Provider::Terraform::Examples
-    min_version: beta
     name: 'org_policy_custom_constraint_basic'
     primary_resource_id: 'constraint'
+    vars:
+      policy_name: 'custom.disableGkeAutoUpgrade'
+    test_vars_overrides:
+      policy_name: '"custom.tfTestDisableGkeAutoUpgrade" + acctest.RandString(t, 10)'
     test_env_vars:
       org_id: :ORG_ID
   - !ruby/object:Provider::Terraform::Examples
-    min_version: beta
     name: 'org_policy_custom_constraint_full'
     primary_resource_id: 'constraint'
+    vars:
+      policy_name: 'custom.disableGkeAutoUpgrade'
+    test_vars_overrides:
+      policy_name: '"custom.tfTestDisableGkeAutoUpgrade" + acctest.RandString(t, 10)'
     test_env_vars:
       org_id: :ORG_TARGET
 parameters:
diff --git a/mmv1/products/orgpolicy/product.yaml b/mmv1/products/orgpolicy/product.yaml
index 993a7c05c26d..e24ab0ddb39b 100644
--- a/mmv1/products/orgpolicy/product.yaml
+++ b/mmv1/products/orgpolicy/product.yaml
@@ -15,6 +15,9 @@
 name: OrgPolicy
 display_name: Organization Policy
 versions:
+  - !ruby/object:Api::Product::Version
+    name: ga
+    base_url: https://orgpolicy.googleapis.com/v2/
   - !ruby/object:Api::Product::Version
     name: beta
     base_url: https://orgpolicy.googleapis.com/v2/
diff --git a/mmv1/products/osconfig/PatchDeployment.yaml b/mmv1/products/osconfig/PatchDeployment.yaml
index b2c994585e21..0b179e71e6da 100644
--- a/mmv1/products/osconfig/PatchDeployment.yaml
+++ b/mmv1/products/osconfig/PatchDeployment.yaml
@@ -396,10 +396,12 @@ properties:
         properties:
           - !ruby/object:Api::Type::Array
             name: 'classifications'
-            exactly_one_of:
+            at_least_one_of:
               - patch_config.0.windows_update.0.classifications
               - patch_config.0.windows_update.0.excludes
               - patch_config.0.windows_update.0.exclusive_patches
+            conflicts:
+              - patch_config.0.windows_update.0.exclusive_patches
             description: |
               Only apply updates of these windows update classifications. If empty, all updates are applied.
             item_type: !ruby/object:Api::Type::Enum
@@ -417,19 +419,24 @@ properties:
                 - :UPDATE
           - !ruby/object:Api::Type::Array
             name: 'excludes'
-            exactly_one_of:
+            at_least_one_of:
               - patch_config.0.windows_update.0.classifications
               - patch_config.0.windows_update.0.excludes
               - patch_config.0.windows_update.0.exclusive_patches
+            conflicts:
+              - patch_config.0.windows_update.0.exclusive_patches
             description: |
               List of KBs to exclude from update.
             item_type: Api::Type::String
           - !ruby/object:Api::Type::Array
             name: 'exclusivePatches'
-            exactly_one_of:
+            at_least_one_of:
               - patch_config.0.windows_update.0.classifications
               - patch_config.0.windows_update.0.excludes
               - patch_config.0.windows_update.0.exclusive_patches
+            conflicts:
+              - patch_config.0.windows_update.0.classifications
+              - patch_config.0.windows_update.0.excludes
             description: |
               An exclusive list of kbs to be updated. These are the only patches that will be updated.
               This field must not be used with other patch configurations.
@@ -853,6 +860,12 @@ properties:
                   - :FRIDAY
                   - :SATURDAY
                   - :SUNDAY
+              - !ruby/object:Api::Type::Integer
+                name: 'dayOffset'
+                description: |
+                  Represents the number of days before or after the given week day of month that the patch deployment is scheduled for.
+                validation: !ruby/object:Provider::Terraform::Validation
+                  function: 'validation.IntBetween(-30,30)'
           - !ruby/object:Api::Type::Integer
             name: 'monthDay'
             exactly_one_of:
diff --git a/mmv1/products/privateca/CaPool.yaml b/mmv1/products/privateca/CaPool.yaml
index 6886aef18c94..5ffda3b7cacc 100644
--- a/mmv1/products/privateca/CaPool.yaml
+++ b/mmv1/products/privateca/CaPool.yaml
@@ -480,8 +480,8 @@ properties:
         values:
           - :PEM
           - :DER
-  - !ruby/object:Api::Type::KeyValuePairs
-    name: labels
+  - !ruby/object:Api::Type::KeyValueLabels
+    name: 'labels'
     description: |
       Labels with user-defined metadata.
 
diff --git a/mmv1/products/privateca/Certificate.yaml b/mmv1/products/privateca/Certificate.yaml
index 86337ac8eb32..aed9215977fb 100644
--- a/mmv1/products/privateca/Certificate.yaml
+++ b/mmv1/products/privateca/Certificate.yaml
@@ -544,132 +544,6 @@ properties:
                   leading period (like `.example.com`)
                 output: true
                 item_type: Api::Type::String
-      - !ruby/object:Api::Type::NestedObject
-        name: 'configValues'
-        deprecation_message: >-
-          `config_values` is deprecated and will be removed in a future release. Use `x509_description` instead.
-        output: true
-        description: |
-          Describes some of the technical fields in a certificate.
-        properties:
-          - !ruby/object:Api::Type::NestedObject
-            name: 'keyUsage'
-            output: true
-            description: |
-              Indicates the intended use for keys that correspond to a certificate.
-            properties:
-              - !ruby/object:Api::Type::NestedObject
-                name: 'baseKeyUsage'
-                output: true
-                description: |
-                  Describes high-level ways in which a key may be used.
-                properties:
-                  - !ruby/object:Api::Type::NestedObject
-                    name: 'keyUsageOptions'
-                    output: true
-                    description: |
-                      Describes high-level ways in which a key may be used.
-                    properties:
-                      - !ruby/object:Api::Type::Boolean
-                        name: 'digitalSignature'
-                        output: true
-                        description: |
-                          The key may be used for digital signatures.
-                      - !ruby/object:Api::Type::Boolean
-                        name: 'contentCommitment'
-                        output: true
-                        description: |
-                          The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".
-                      - !ruby/object:Api::Type::Boolean
-                        name: 'keyEncipherment'
-                        output: true
-                        description: |
-                          The key may be used to encipher other keys.
-                      - !ruby/object:Api::Type::Boolean
-                        name: 'dataEncipherment'
-                        output: true
-                        description: |
-                          The key may be used to encipher data.
-                      - !ruby/object:Api::Type::Boolean
-                        name: 'keyAgreement'
-                        output: true
-                        description: |
-                          The key may be used in a key agreement protocol.
-                      - !ruby/object:Api::Type::Boolean
-                        name: 'certSign'
-                        output: true
-                        description: |
-                          The key may be used to sign certificates.
-                      - !ruby/object:Api::Type::Boolean
-                        name: 'crlSign'
-                        output: true
-                        description: |
-                          The key may be used sign certificate revocation lists.
-                      - !ruby/object:Api::Type::Boolean
-                        name: 'encipherOnly'
-                        output: true
-                        description: |
-                          The key may be used to encipher only.
-                      - !ruby/object:Api::Type::Boolean
-                        name: 'decipherOnly'
-                        output: true
-                        description: |
-                          The key may be used to decipher only.
-              - !ruby/object:Api::Type::NestedObject
-                name: 'extendedKeyUsage'
-                output: true
-                description: |
-                  Describes high-level ways in which a key may be used.
-                properties:
-                  - !ruby/object:Api::Type::Boolean
-                    name: 'serverAuth'
-                    output: true
-                    description: |
-                      Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.
-                  - !ruby/object:Api::Type::Boolean
-                    name: 'clientAuth'
-                    output: true
-                    description: |
-                      Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.
-                  - !ruby/object:Api::Type::Boolean
-                    name: 'codeSigning'
-                    output: true
-                    description: |
-                      Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".
-                  - !ruby/object:Api::Type::Boolean
-                    name: 'emailProtection'
-                    output: true
-                    description: |
-                      Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".
-                  - !ruby/object:Api::Type::Boolean
-                    name: 'timeStamping'
-                    output: true
-                    description: |
-                      Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".
-                  - !ruby/object:Api::Type::Boolean
-                    name: 'ocspSigning'
-                    output: true
-                    description: |
-                      Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".
-              - !ruby/object:Api::Type::Array
-                name: 'unknownExtendedKeyUsages'
-                output: true
-                description: |
-                  An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
-                item_type: !ruby/object:Api::Type::NestedObject
-                  properties:
-                    - !ruby/object:Api::Type::NestedObject
-                      name: 'obectId'
-                      output: true
-                      description: |
-                        Required. Describes how some of the technical fields in a certificate should be populated.
-                      properties:
-                        - !ruby/object:Api::Type::Array
-                          name: 'objectIdPath'
-                          output: true
-                          item_type: Api::Type::Integer
-                          description: |
-                            An ObjectId specifies an object identifier (OID). These provide context and describe types in ASN.1 messages.
       - !ruby/object:Api::Type::NestedObject
         name: 'publicKey'
         output: true
@@ -740,14 +614,6 @@ properties:
     description: |
       The chain that may be used to verify the X.509 certificate. Expected to be in issuer-to-root order according to RFC 5246.
     item_type: Api::Type::String
-  - !ruby/object:Api::Type::Array
-    name: 'pemCertificates'
-    deprecation_message: >-
-      `pem_certificates` is deprecated and will be removed in a future major release. Use `pem_certificate_chain` instead.
-    output: true
-    description: |
-      Required. Expected to be in leaf-to-root order according to RFC 5246.
-    item_type: Api::Type::String
   - !ruby/object:Api::Type::Time
     name: 'createTime'
     description: |
@@ -772,7 +638,7 @@ properties:
       omitted, no template will be used. This template must be in the same location
       as the Certificate.
     diff_suppress_func: 'tpgresource.CompareResourceNames'
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Labels with user-defined metadata to apply to this resource.
diff --git a/mmv1/products/privateca/CertificateAuthority.yaml b/mmv1/products/privateca/CertificateAuthority.yaml
index 99d9e118c14f..85e8d98598c2 100644
--- a/mmv1/products/privateca/CertificateAuthority.yaml
+++ b/mmv1/products/privateca/CertificateAuthority.yaml
@@ -735,8 +735,8 @@ properties:
       A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine
       fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
-    name: labels
+  - !ruby/object:Api::Type::KeyValueLabels
+    name: 'labels'
     description: |
       Labels with user-defined metadata.
 
diff --git a/mmv1/products/pubsub/Schema.yaml b/mmv1/products/pubsub/Schema.yaml
index e462cf80a1b6..b5faf6addc98 100644
--- a/mmv1/products/pubsub/Schema.yaml
+++ b/mmv1/products/pubsub/Schema.yaml
@@ -25,6 +25,9 @@ create_url: projects/{{project}}/schemas?schemaId={{name}}
 update_url: projects/{{project}}/schemas/{{name}}:commit
 update_verb: :POST
 update_mask: false
+iam_policy: !ruby/object:Api::Resource::IamPolicy
+  parent_resource_attribute: 'schema'
+  method_name_separator: ':'
 async: !ruby/object:Provider::Terraform::PollAsync
   check_response_func_existence: transport_tpg.PollCheckForExistence
   check_response_func_absence: transport_tpg.PollCheckForAbsence
@@ -34,8 +37,11 @@ examples:
   - !ruby/object:Provider::Terraform::Examples
     name: 'pubsub_schema_basic'
     primary_resource_id: 'example'
+    primary_resource_name: "fmt.Sprintf(\"tf-test-example-schema%s\",
+      context[\"random_suffix\"\
+      ])"
     vars:
-      schema_name: 'example'
+      schema_name: 'example-schema'
   - !ruby/object:Provider::Terraform::Examples
     name: 'pubsub_schema_protobuf'
     primary_resource_id: 'example'
@@ -70,4 +76,8 @@ properties:
     description: |
       The definition of the schema.
       This should contain a string representing the full definition of the schema
-      that is a valid schema definition of the type specified in type.
+      that is a valid schema definition of the type specified in type. Changes
+      to the definition commit new [schema revisions](https://cloud.google.com/pubsub/docs/commit-schema-revision).
+      A schema can only have up to 20 revisions, so updates that fail with an
+      error indicating that the limit has been reached require manually
+      [deleting old revisions](https://cloud.google.com/pubsub/docs/delete-schema-revision).
diff --git a/mmv1/products/pubsub/Subscription.yaml b/mmv1/products/pubsub/Subscription.yaml
index 2f40689d689c..1def915ef94c 100644
--- a/mmv1/products/pubsub/Subscription.yaml
+++ b/mmv1/products/pubsub/Subscription.yaml
@@ -107,7 +107,7 @@ properties:
     pattern: 'projects/{{project}}/topics/{{topic}}'
     diff_suppress_func: 'tpgresource.CompareSelfLinkOrResourceName'
     custom_expand: templates/terraform/custom_expand/computed_subscription_topic.erb
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       A set of key/value label pairs to assign to this Subscription.
diff --git a/mmv1/products/pubsub/Topic.yaml b/mmv1/products/pubsub/Topic.yaml
index 6bb9290a058f..95bb9563576f 100644
--- a/mmv1/products/pubsub/Topic.yaml
+++ b/mmv1/products/pubsub/Topic.yaml
@@ -93,7 +93,7 @@ properties:
       (`service-{{PROJECT_NUMBER}}@gcp-sa-pubsub.iam.gserviceaccount.com`) must have
       `roles/cloudkms.cryptoKeyEncrypterDecrypter` to use this feature.
       The expected format is `projects/*/locations/*/keyRings/*/cryptoKeys/*`
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       A set of key/value label pairs to assign to this Topic.
@@ -147,4 +147,5 @@ properties:
       For instance, it allows any attached subscription to seek to a timestamp
       that is up to messageRetentionDuration in the past. If this field is not
       set, message retention is controlled by settings on individual subscriptions.
-      Cannot be more than 31 days or less than 10 minutes.
+      The rotation period has the format of a decimal number, followed by the
+      letter `s` (seconds). Cannot be more than 31 days or less than 10 minutes.
diff --git a/mmv1/products/redis/Cluster.yaml b/mmv1/products/redis/Cluster.yaml
index a523584b5c5f..08751531ba2f 100644
--- a/mmv1/products/redis/Cluster.yaml
+++ b/mmv1/products/redis/Cluster.yaml
@@ -18,12 +18,11 @@ description: |
 references: !ruby/object:Api::Resource::ReferenceLinks
   guides:
     'Official Documentation': 'https://cloud.google.com/memorystore/docs/cluster/'
-  api: 'https://cloud.google.com/memorystore/docs/cluster/reference/rest/v1beta1/projects.locations.clusters'
+  api: 'https://cloud.google.com/memorystore/docs/cluster/reference/rest/v1/projects.locations.clusters'
 timeouts: !ruby/object:Api::Timeouts
   insert_minutes: 60
   update_minutes: 120
   delete_minutes: 30
-min_version: beta
 base_url: 'projects/{{project}}/locations/{{region}}/clusters'
 self_link: 'projects/{{project}}/locations/{{region}}/clusters/{{name}}'
 create_url: 'projects/{{project}}/locations/{{region}}/clusters?clusterId={{name}}'
@@ -52,13 +51,17 @@ parameters:
 examples:
   - !ruby/object:Provider::Terraform::Examples
     name: "redis_cluster_ha"
-    min_version: beta
     primary_resource_id: "cluster-ha"
     vars:
       cluster_name: "ha-cluster"
       policy_name: "mypolicy"
       subnet_name: "mysubnet"
       network_name: "mynetwork"
+      prevent_destroy: 'true'
+    test_vars_overrides:
+      prevent_destroy: 'false'
+    oics_vars_overrides:
+      prevent_destroy: 'false'
 properties:
   - !ruby/object:Api::Type::Time
     name: createTime
@@ -199,6 +202,7 @@ properties:
     description: |
       Optional. The number of replica nodes per shard.
     required: false
+    send_empty_value: true
   - !ruby/object:Api::Type::Integer
     name: sizeGb
     description: |
diff --git a/mmv1/products/redis/Instance.yaml b/mmv1/products/redis/Instance.yaml
index eaab27ffdb55..14c7b8e5ec85 100644
--- a/mmv1/products/redis/Instance.yaml
+++ b/mmv1/products/redis/Instance.yaml
@@ -28,6 +28,7 @@ timeouts: !ruby/object:Api::Timeouts
   update_minutes: 20
   delete_minutes: 20
 autogen_async: true
+skip_default_cdiff: true
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   encoder: templates/terraform/encoders/redis_location_id_for_fallback_zone.go.erb
   decoder: templates/terraform/decoders/redis_instance.go.erb
@@ -35,6 +36,7 @@ custom_code: !ruby/object:Provider::Terraform::CustomCode
   constants: templates/terraform/constants/redis_instance.go
 custom_diff: [
   'customdiff.ForceNewIfChange("redis_version", isRedisVersionDecreasing)',
+  'tpgresource.DefaultProviderProject',
 ]
 examples:
   - !ruby/object:Provider::Terraform::Examples
@@ -42,22 +44,35 @@ examples:
     primary_resource_id: 'cache'
     vars:
       instance_name: 'memory-cache'
+      prevent_destroy: 'true'
+    test_vars_overrides:
+      prevent_destroy: 'false'
+    oics_vars_overrides:
+      prevent_destroy: 'false'
   - !ruby/object:Provider::Terraform::Examples
     name: 'redis_instance_full'
     primary_resource_id: 'cache'
     vars:
       instance_name: 'ha-memory-cache'
       network_name: 'redis-test-network'
+      prevent_destroy: 'true'
     test_vars_overrides:
       network_name: 'acctest.BootstrapSharedTestNetwork(t, "redis-full")'
+      prevent_destroy: 'false'
+    oics_vars_overrides:
+      prevent_destroy: 'false'
   - !ruby/object:Provider::Terraform::Examples
     name: 'redis_instance_full_with_persistence_config'
     primary_resource_id: 'cache-persis'
     vars:
       instance_name: 'ha-memory-cache-persis'
       network_name: 'redis-test-network'
+      prevent_destroy: 'true'
     test_vars_overrides:
       network_name: 'acctest.BootstrapSharedTestNetwork(t, "redis-full-persis")'
+      prevent_destroy: 'false'
+    oics_vars_overrides:
+      prevent_destroy: 'false'
   - !ruby/object:Provider::Terraform::Examples
     name: 'redis_instance_private_service'
     primary_resource_id: 'cache'
@@ -65,16 +80,37 @@ examples:
       instance_name: 'private-cache'
       address_name: 'address'
       network_name: 'redis-test-network'
+      prevent_destroy: 'true'
     test_vars_overrides:
-      network_name: 'acctest.BootstrapSharedTestNetwork(t, "redis-private-service")'
+      prevent_destroy: 'false'
+    oics_vars_overrides:
+      prevent_destroy: 'false'
+    skip_test: true
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'redis_instance_private_service_test'
+    primary_resource_id: 'cache'
+    vars:
+      instance_name: 'private-cache'
+      network_name: 'redis-test-network'
+      prevent_destroy: 'true'
+    test_vars_overrides:
+      network_name: 'acctest.BootstrapSharedServiceNetworkingConnection(t, "vpc-network-1")'
+      prevent_destroy: 'false'
+    oics_vars_overrides:
+      prevent_destroy: 'false'
+    skip_docs: true
   - !ruby/object:Provider::Terraform::Examples
     name: 'redis_instance_mrr'
     primary_resource_id: 'cache'
     vars:
       instance_name: 'mrr-memory-cache'
       network_name: 'redis-test-network'
+      prevent_destroy: 'true'
     test_vars_overrides:
       network_name: 'acctest.BootstrapSharedTestNetwork(t, "redis-mrr")'
+      prevent_destroy: 'false'
+    oics_vars_overrides:
+      prevent_destroy: 'false'
   - !ruby/object:Provider::Terraform::Examples
     name: 'redis_instance_cmek'
     primary_resource_id: 'cache'
@@ -82,8 +118,12 @@ examples:
     vars:
       instance_name: 'cmek-memory-cache'
       network_name: 'redis-test-network'
+      prevent_destroy: 'true'
     test_vars_overrides:
       network_name: 'acctest.BootstrapSharedTestNetwork(t, "redis-cmek")'
+      prevent_destroy: 'false'
+    oics_vars_overrides:
+      prevent_destroy: 'false'
 parameters:
   # TODO: resourceref?
   - !ruby/object:Api::Type::String
@@ -156,7 +196,7 @@ properties:
       Hostname or IP address of the exposed Redis endpoint used by clients
       to connect to the service.
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: Resource labels to represent user provided metadata.
   - !ruby/object:Api::Type::KeyValuePairs
diff --git a/mmv1/products/secretmanager/Secret.yaml b/mmv1/products/secretmanager/Secret.yaml
index 3f5c56174be8..0dd019402543 100644
--- a/mmv1/products/secretmanager/Secret.yaml
+++ b/mmv1/products/secretmanager/Secret.yaml
@@ -38,9 +38,19 @@ examples:
     primary_resource_id: 'secret-with-annotations'
     vars:
       secret_id: 'secret'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'secret_with_automatic_cmek'
+    primary_resource_id: 'secret-with-automatic-cmek'
+    vars:
+      secret_id: 'secret'
+      kms_key_name: 'kms-key'
+    test_vars_overrides:
+      kms_key_name: 'acctest.BootstrapKMSKey(t).CryptoKey.Name'
 import_format: ['projects/{{project}}/secrets/{{secret_id}}']
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   pre_update: templates/terraform/pre_update/secret_manager_secret.go.erb
+  constants: templates/terraform/constants/secret_manager_secret.go
+custom_diff: ['secretManagerSecretAutoCustomizeDiff']
 parameters:
   - !ruby/object:Api::Type::String
     name: secretId
@@ -61,7 +71,7 @@ properties:
     output: true
     description: |
       The time at which the Secret was created.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: labels
     description: |
       The labels assigned to this Secret.
@@ -76,7 +86,7 @@ properties:
 
       An object containing a list of "key": value pairs. Example:
       { "name": "wrench", "mass": "1.3kg", "count": "3" }.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueAnnotations
     name: annotations
     description: |
       Custom metadata about the secret.
@@ -113,22 +123,36 @@ properties:
       The replication policy of the secret data attached to the Secret. It cannot be changed
       after the Secret has been created.
     properties:
-      - !ruby/object:Api::Type::Boolean
-        name: automatic
+      - !ruby/object:Api::Type::NestedObject
+        name: auto
+        api_name: automatic
         immutable: true
+        allow_empty_object: true
+        send_empty_value: true
         exactly_one_of:
-          - replication.0.automatic
           - replication.0.user_managed
+          - replication.0.auto
         description: |
           The Secret will automatically be replicated without any restrictions.
-        custom_flatten: templates/terraform/custom_flatten/object_to_bool.go.erb
-        custom_expand: templates/terraform/custom_expand/bool_to_object.go.erb
+        properties:
+          - !ruby/object:Api::Type::NestedObject
+            name: customerManagedEncryption
+            description: |
+              The customer-managed encryption configuration of the Secret.
+              If no configuration is provided, Google-managed default
+              encryption is used.
+            properties:
+              - !ruby/object:Api::Type::String
+                name: kmsKeyName
+                required: true
+                description: |
+                  The resource name of the Cloud KMS CryptoKey used to encrypt secret payloads.
       - !ruby/object:Api::Type::NestedObject
         name: userManaged
         immutable: true
         exactly_one_of:
-          - replication.0.automatic
           - replication.0.user_managed
+          - replication.0.auto
         description: |
           The Secret will be replicated to the regions specified by the user.
         properties:
@@ -174,13 +198,14 @@ properties:
     description: |
       Timestamp in UTC when the Secret is scheduled to expire. This is always provided on output, regardless of what was sent on input.
       A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
+      Only one of `expire_time` or `ttl` can be provided.
     default_from_api: true
   - !ruby/object:Api::Type::String
     name: ttl
-    immutable: true
     description: |
       The TTL for the Secret.
       A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s".
+      Only one of `ttl` or `expire_time` can be provided.
     ignore_read: true
   - !ruby/object:Api::Type::NestedObject
     name: rotation
@@ -198,7 +223,6 @@ properties:
           - rotation.0.rotation_period
       - !ruby/object:Api::Type::String
         name: rotationPeriod
-        immutable: true
         description: |
           The Duration between rotation notifications. Must be in seconds and at least 3600s (1h) and at most 3153600000s (100 years).
           If rotationPeriod is set, `next_rotation_time` must be set. `next_rotation_time` will be advanced by this period when the service automatically sends rotation notifications.
diff --git a/mmv1/products/secretmanager/SecretVersion.yaml b/mmv1/products/secretmanager/SecretVersion.yaml
index c87d5858324b..7170c3e426bc 100644
--- a/mmv1/products/secretmanager/SecretVersion.yaml
+++ b/mmv1/products/secretmanager/SecretVersion.yaml
@@ -29,6 +29,32 @@ examples:
     vars:
       secret_id: 'secret-version'
       data: 'secret-data'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'secret_version_deletion_policy_abandon'
+    primary_resource_id: 'secret-version-deletion-policy'
+    vars:
+      secret_id: 'secret-version'
+      data: 'secret-data'
+    ignore_read_extra:
+      - 'deletion_policy'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'secret_version_deletion_policy_disable'
+    primary_resource_id: 'secret-version-deletion-policy'
+    vars:
+      secret_id: 'secret-version'
+      data: 'secret-data'
+    ignore_read_extra:
+      - 'deletion_policy'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'secret_version_with_base64_string_secret_data'
+    primary_resource_id: 'secret-version-base64'
+    vars:
+      secret_id: 'secret-version'
+      data: 'secret-data.pfx'
+    test_vars_overrides:
+      data: '"./test-fixtures/binary-file.pfx"'
+    ignore_read_extra:
+      - 'is_secret_data_base64'
 import_format:
   ['projects/{{%project}}/secrets/{{%secret_id}}/versions/{{%version}}']
 custom_code: !ruby/object:Provider::Terraform::CustomCode
@@ -37,6 +63,27 @@ custom_code: !ruby/object:Provider::Terraform::CustomCode
   custom_import: templates/terraform/custom_import/secret_version.go.erb
   resource_definition: templates/terraform/resource_definition/secret_version.go.erb
   decoder: templates/terraform/decoders/treat_destroyed_state_as_gone.erb
+  pre_delete: templates/terraform/pre_delete/secret_version_deletion_policy.go.erb
+  pre_read: templates/terraform/pre_read/secret_version_is_secret_data_base64.go.erb
+  extra_schema_entry: templates/terraform/extra_schema_entry/secret_version_is_secret_data_base64.go.erb
+docs: !ruby/object:Provider::Terraform::Docs
+  optional_properties: |
+    * `is_secret_data_base64` - (Optional) If set to 'true', the secret data is expected to be base64-encoded string and would be sent as is.
+virtual_fields:
+  - !ruby/object:Api::Type::Enum
+    name: 'deletion_policy'
+    description: |
+      The deletion policy for the secret version. Setting `ABANDON` allows the resource
+      to be abandoned rather than deleted. Setting `DISABLE` allows the resource to be
+      disabled rather than deleted. Default is `DELETE`. Possible values are:
+        * DELETE
+        * DISABLE
+        * ABANDON
+    values:
+      - :DELETE
+      - :DISABLE
+      - :ABANDON
+    default_value: :DELETE
 parameters:
   - !ruby/object:Api::Type::ResourceRef
     name: secret
@@ -91,4 +138,4 @@ properties:
         required: true
         description: The secret data. Must be no larger than 64KiB.
         sensitive: true
-        custom_expand: templates/terraform/custom_expand/base64.go.erb
+        custom_expand: templates/terraform/custom_expand/secret_version_secret_data.go.erb
diff --git a/mmv1/products/securitycenter/FolderCustomModule.yaml b/mmv1/products/securitycenter/FolderCustomModule.yaml
new file mode 100644
index 000000000000..8fa1ab78ce34
--- /dev/null
+++ b/mmv1/products/securitycenter/FolderCustomModule.yaml
@@ -0,0 +1,226 @@
+# Copyright 2023 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+--- !ruby/object:Api::Resource
+name: 'FolderCustomModule'
+description: |
+  Represents an instance of a Security Health Analytics custom module, including
+  its full module name, display name, enablement state, and last updated time.
+  You can create a custom module at the organization, folder, or project level.
+  Custom modules that you create at the organization or folder level are inherited
+  by the child folders and projects.
+references: !ruby/object:Api::Resource::ReferenceLinks
+  guides:
+    'Overview of custom modules for Security Health Analytics': 'https://cloud.google.com/security-command-center/docs/custom-modules-sha-overview'
+  api: 'https://cloud.google.com/security-command-center/docs/reference/rest/v1/folders.securityHealthAnalyticsSettings.customModules'
+base_url: 'folders/{{folder}}/securityHealthAnalyticsSettings/customModules'
+self_link: 'folders/{{folder}}/securityHealthAnalyticsSettings/customModules/{{name}}'
+mutex: 'folders/{{folder}}/securityHealthAnalyticsSettings/customModules'
+update_verb: :PATCH
+update_mask: true
+examples:
+  - !ruby/object:Provider::Terraform::Examples
+    name: "scc_folder_custom_module_basic"
+    primary_resource_id: "example"
+    pull_external: true
+    skip_test: true
+    vars:
+      folder_display_name: "folder-name"
+      display_name: basic_custom_module
+      sleep: ""
+    test_env_vars:
+      org_id: :ORG_ID
+    test_vars_overrides:
+      sleep: "true"
+  - !ruby/object:Provider::Terraform::Examples
+    name: "scc_folder_custom_module_full"
+    primary_resource_id: "example"
+    pull_external: true
+    skip_test: true
+    vars:
+      folder_display_name: "folder-name"
+      display_name: full_custom_module
+      sleep: ""
+    test_env_vars:
+      org_id: :ORG_ID
+    test_vars_overrides:
+      sleep: "true"
+
+parameters:
+  - !ruby/object:Api::Type::String
+    name: 'folder'
+    immutable: true
+    required: true
+    url_param_only: true
+    description: |
+      Numerical ID of the parent folder.
+
+properties:
+  - !ruby/object:Api::Type::String
+    name: 'name'
+    output: true
+    custom_flatten: templates/terraform/custom_flatten/name_from_self_link.erb
+    description: |
+      The resource name of the custom module. Its format is "folders/{folder_id}/securityHealthAnalyticsSettings/customModules/{customModule}".
+      The id {customModule} is server-generated and is not user settable. It will be a numeric id containing 1-20 digits.
+  - !ruby/object:Api::Type::String
+    name: 'displayName'
+    immutable: true
+    required: true
+    # API error for invalid display names is just "INVALID_ARGUMENT" with no details
+    validation: !ruby/object:Provider::Terraform::Validation
+      function: 'verify.ValidateRegexp(`^[a-z][\w_]{0,127}$`)'
+    description: |
+      The display name of the Security Health Analytics custom module. This
+      display name becomes the finding category for all findings that are
+      returned by this custom module. The display name must be between 1 and
+      128 characters, start with a lowercase letter, and contain alphanumeric
+      characters or underscores only.
+  - !ruby/object:Api::Type::Enum
+    name: 'enablementState'
+    required: true
+    description: |
+      The enablement state of the custom module.
+    values:
+      - :ENABLED
+      - :DISABLED
+  - !ruby/object:Api::Type::String
+    name: 'updateTime'
+    output: true
+    description: |
+      The time at which the custom module was last updated.
+
+      A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and
+      up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
+  - !ruby/object:Api::Type::String
+    name: 'lastEditor'
+    output: true
+    description: |
+      The editor that last updated the custom module.
+  - !ruby/object:Api::Type::String
+    name: 'ancestorModule'
+    output: true
+    description: |
+      If empty, indicates that the custom module was created in the organization, folder,
+      or project in which you are viewing the custom module. Otherwise, ancestor_module
+      specifies the organization or folder from which the custom module is inherited.
+  - !ruby/object:Api::Type::NestedObject
+    name: 'customConfig'
+    required: true
+    description: |
+      The user specified custom configuration for the module.
+    properties:
+      - !ruby/object:Api::Type::NestedObject
+        name: 'predicate'
+        required: true
+        description: |
+          The CEL expression to evaluate to produce findings. When the expression evaluates
+          to true against a resource, a finding is generated.
+        properties:
+          - !ruby/object:Api::Type::String
+            name: 'expression'
+            required: true
+            description: |
+              Textual representation of an expression in Common Expression Language syntax.
+          - !ruby/object:Api::Type::String
+            name: 'title'
+            description: |
+              Title for the expression, i.e. a short string describing its purpose. This can
+              be used e.g. in UIs which allow to enter the expression.
+          - !ruby/object:Api::Type::String
+            name: 'description'
+            description: |
+              Description of the expression. This is a longer text which describes the
+              expression, e.g. when hovered over it in a UI.
+          - !ruby/object:Api::Type::String
+            name: 'location'
+            description: |
+              String indicating the location of the expression for error reporting, e.g. a
+              file name and a position in the file.
+      - !ruby/object:Api::Type::NestedObject
+        name: 'customOutput'
+        description: |
+          Custom output properties.
+        properties:
+          - !ruby/object:Api::Type::Array
+            name: 'properties'
+            description: |
+              A list of custom output properties to add to the finding.
+            item_type: !ruby/object:Api::Type::NestedObject
+              properties:
+                - !ruby/object:Api::Type::String
+                  name: 'name'
+                  description: |
+                    Name of the property for the custom output.
+                - !ruby/object:Api::Type::NestedObject
+                  name: 'valueExpression'
+                  description: |
+                    The CEL expression for the custom output. A resource property can be specified
+                    to return the value of the property or a text string enclosed in quotation marks.
+                  properties:
+                    - !ruby/object:Api::Type::String
+                      name: 'expression'
+                      required: true
+                      description: |
+                        Textual representation of an expression in Common Expression Language syntax.
+                    - !ruby/object:Api::Type::String
+                      name: 'title'
+                      description: |
+                        Title for the expression, i.e. a short string describing its purpose. This can
+                        be used e.g. in UIs which allow to enter the expression.
+                    - !ruby/object:Api::Type::String
+                      name: 'description'
+                      description: |
+                        Description of the expression. This is a longer text which describes the
+                        expression, e.g. when hovered over it in a UI.
+                    - !ruby/object:Api::Type::String
+                      name: 'location'
+                      description: |
+                        String indicating the location of the expression for error reporting, e.g. a
+                        file name and a position in the file.
+      - !ruby/object:Api::Type::NestedObject
+        name: 'resourceSelector'
+        required: true
+        description: |
+          The resource types that the custom module operates on. Each custom module
+          can specify up to 5 resource types.
+        properties:
+          - !ruby/object:Api::Type::Array
+            name: 'resourceTypes'
+            required: true
+            description: |
+              The resource types to run the detector on.
+            item_type: Api::Type::String
+      - !ruby/object:Api::Type::Enum
+        name: 'severity'
+        required: true
+        description: |
+          The severity to assign to findings generated by the module.
+        values:
+          - :CRITICAL
+          - :HIGH
+          - :MEDIUM
+          - :LOW
+      - !ruby/object:Api::Type::String
+        name: 'description'
+        description: |
+          Text that describes the vulnerability or misconfiguration that the custom
+          module detects. This explanation is returned with each finding instance to
+          help investigators understand the detected issue. The text must be enclosed in quotation marks.
+      - !ruby/object:Api::Type::String
+        name: 'recommendation'
+        required: true
+        description: |
+          An explanation of the recommended steps that security teams can take to resolve
+          the detected issue. This explanation is returned with each finding generated by
+          this module in the nextSteps property of the finding JSON.
diff --git a/mmv1/products/securitycenter/OrganizationCustomModule.yaml b/mmv1/products/securitycenter/OrganizationCustomModule.yaml
new file mode 100644
index 000000000000..34a02c80de9e
--- /dev/null
+++ b/mmv1/products/securitycenter/OrganizationCustomModule.yaml
@@ -0,0 +1,220 @@
+# Copyright 2023 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+--- !ruby/object:Api::Resource
+name: 'OrganizationCustomModule'
+description: |
+  Represents an instance of a Security Health Analytics custom module, including
+  its full module name, display name, enablement state, and last updated time.
+  You can create a custom module at the organization, folder, or project level.
+  Custom modules that you create at the organization or folder level are inherited
+  by the child folders and projects.
+references: !ruby/object:Api::Resource::ReferenceLinks
+  guides:
+    'Overview of custom modules for Security Health Analytics': 'https://cloud.google.com/security-command-center/docs/custom-modules-sha-overview'
+  api: 'https://cloud.google.com/security-command-center/docs/reference/rest/v1/organizations.securityHealthAnalyticsSettings.customModules'
+base_url: 'organizations/{{organization}}/securityHealthAnalyticsSettings/customModules'
+self_link: 'organizations/{{organization}}/securityHealthAnalyticsSettings/customModules/{{name}}'
+mutex: 'organizations/{{organization}}/securityHealthAnalyticsSettings/customModules'
+update_verb: :PATCH
+update_mask: true
+examples:
+  - !ruby/object:Provider::Terraform::Examples
+    name: "scc_organization_custom_module_basic"
+    primary_resource_id: "example"
+    skip_test: true
+    vars:
+      display_name: basic_custom_module
+    test_env_vars:
+      org_id: :ORG_ID
+    test_vars_overrides:
+      sleep: "true"
+  - !ruby/object:Provider::Terraform::Examples
+    name: "scc_organization_custom_module_full"
+    primary_resource_id: "example"
+    skip_test: true
+    vars:
+      display_name: full_custom_module
+    test_env_vars:
+      org_id: :ORG_ID
+    test_vars_overrides:
+      sleep: "true"
+
+parameters:
+  - !ruby/object:Api::Type::String
+    name: 'organization'
+    immutable: true
+    required: true
+    url_param_only: true
+    description: |
+      Numerical ID of the parent organization.
+
+properties:
+  - !ruby/object:Api::Type::String
+    name: 'name'
+    output: true
+    custom_flatten: templates/terraform/custom_flatten/name_from_self_link.erb
+    description: |
+      The resource name of the custom module. Its format is "organizations/{org_id}/securityHealthAnalyticsSettings/customModules/{customModule}".
+      The id {customModule} is server-generated and is not user settable. It will be a numeric id containing 1-20 digits.
+  - !ruby/object:Api::Type::String
+    name: 'displayName'
+    immutable: true
+    required: true
+    # API error for invalid display names is just "INVALID_ARGUMENT" with no details
+    validation: !ruby/object:Provider::Terraform::Validation
+      function: 'verify.ValidateRegexp(`^[a-z][\w_]{0,127}$`)'
+    description: |
+      The display name of the Security Health Analytics custom module. This
+      display name becomes the finding category for all findings that are
+      returned by this custom module. The display name must be between 1 and
+      128 characters, start with a lowercase letter, and contain alphanumeric
+      characters or underscores only.
+  - !ruby/object:Api::Type::Enum
+    name: 'enablementState'
+    required: true
+    description: |
+      The enablement state of the custom module.
+    values:
+      - :ENABLED
+      - :DISABLED
+  - !ruby/object:Api::Type::String
+    name: 'updateTime'
+    output: true
+    description: |
+      The time at which the custom module was last updated.
+
+      A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and
+      up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
+  - !ruby/object:Api::Type::String
+    name: 'lastEditor'
+    output: true
+    description: |
+      The editor that last updated the custom module.
+  - !ruby/object:Api::Type::String
+    name: 'ancestorModule'
+    output: true
+    description: |
+      If empty, indicates that the custom module was created in the organization, folder,
+      or project in which you are viewing the custom module. Otherwise, ancestor_module
+      specifies the organization or folder from which the custom module is inherited.
+  - !ruby/object:Api::Type::NestedObject
+    name: 'customConfig'
+    required: true
+    description: |
+      The user specified custom configuration for the module.
+    properties:
+      - !ruby/object:Api::Type::NestedObject
+        name: 'predicate'
+        required: true
+        description: |
+          The CEL expression to evaluate to produce findings. When the expression evaluates
+          to true against a resource, a finding is generated.
+        properties:
+          - !ruby/object:Api::Type::String
+            name: 'expression'
+            required: true
+            description: |
+              Textual representation of an expression in Common Expression Language syntax.
+          - !ruby/object:Api::Type::String
+            name: 'title'
+            description: |
+              Title for the expression, i.e. a short string describing its purpose. This can
+              be used e.g. in UIs which allow to enter the expression.
+          - !ruby/object:Api::Type::String
+            name: 'description'
+            description: |
+              Description of the expression. This is a longer text which describes the
+              expression, e.g. when hovered over it in a UI.
+          - !ruby/object:Api::Type::String
+            name: 'location'
+            description: |
+              String indicating the location of the expression for error reporting, e.g. a
+              file name and a position in the file.
+      - !ruby/object:Api::Type::NestedObject
+        name: 'customOutput'
+        description: |
+          Custom output properties.
+        properties:
+          - !ruby/object:Api::Type::Array
+            name: 'properties'
+            description: |
+              A list of custom output properties to add to the finding.
+            item_type: !ruby/object:Api::Type::NestedObject
+              properties:
+                - !ruby/object:Api::Type::String
+                  name: 'name'
+                  description: |
+                    Name of the property for the custom output.
+                - !ruby/object:Api::Type::NestedObject
+                  name: 'valueExpression'
+                  description: |
+                    The CEL expression for the custom output. A resource property can be specified
+                    to return the value of the property or a text string enclosed in quotation marks.
+                  properties:
+                    - !ruby/object:Api::Type::String
+                      name: 'expression'
+                      required: true
+                      description: |
+                        Textual representation of an expression in Common Expression Language syntax.
+                    - !ruby/object:Api::Type::String
+                      name: 'title'
+                      description: |
+                        Title for the expression, i.e. a short string describing its purpose. This can
+                        be used e.g. in UIs which allow to enter the expression.
+                    - !ruby/object:Api::Type::String
+                      name: 'description'
+                      description: |
+                        Description of the expression. This is a longer text which describes the
+                        expression, e.g. when hovered over it in a UI.
+                    - !ruby/object:Api::Type::String
+                      name: 'location'
+                      description: |
+                        String indicating the location of the expression for error reporting, e.g. a
+                        file name and a position in the file.
+      - !ruby/object:Api::Type::NestedObject
+        name: 'resourceSelector'
+        required: true
+        description: |
+          The resource types that the custom module operates on. Each custom module
+          can specify up to 5 resource types.
+        properties:
+          - !ruby/object:Api::Type::Array
+            name: 'resourceTypes'
+            required: true
+            description: |
+              The resource types to run the detector on.
+            item_type: Api::Type::String
+      - !ruby/object:Api::Type::Enum
+        name: 'severity'
+        required: true
+        description: |
+          The severity to assign to findings generated by the module.
+        values:
+          - :CRITICAL
+          - :HIGH
+          - :MEDIUM
+          - :LOW
+      - !ruby/object:Api::Type::String
+        name: 'description'
+        description: |
+          Text that describes the vulnerability or misconfiguration that the custom
+          module detects. This explanation is returned with each finding instance to
+          help investigators understand the detected issue. The text must be enclosed in quotation marks.
+      - !ruby/object:Api::Type::String
+        name: 'recommendation'
+        required: true
+        description: |
+          An explanation of the recommended steps that security teams can take to resolve
+          the detected issue. This explanation is returned with each finding generated by
+          this module in the nextSteps property of the finding JSON.
diff --git a/mmv1/products/securitycenter/ProjectCustomModule.yaml b/mmv1/products/securitycenter/ProjectCustomModule.yaml
new file mode 100644
index 000000000000..4eb5877ace61
--- /dev/null
+++ b/mmv1/products/securitycenter/ProjectCustomModule.yaml
@@ -0,0 +1,203 @@
+# Copyright 2023 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+--- !ruby/object:Api::Resource
+name: 'ProjectCustomModule'
+description: |
+  Represents an instance of a Security Health Analytics custom module, including
+  its full module name, display name, enablement state, and last updated time.
+  You can create a custom module at the organization, folder, or project level.
+  Custom modules that you create at the organization or folder level are inherited
+  by the child folders and projects.
+references: !ruby/object:Api::Resource::ReferenceLinks
+  guides:
+    'Overview of custom modules for Security Health Analytics': 'https://cloud.google.com/security-command-center/docs/custom-modules-sha-overview'
+  api: 'https://cloud.google.com/security-command-center/docs/reference/rest/v1/projects.securityHealthAnalyticsSettings.customModules'
+base_url: 'projects/{{project}}/securityHealthAnalyticsSettings/customModules'
+self_link: 'projects/{{project}}/securityHealthAnalyticsSettings/customModules/{{name}}'
+mutex: 'projects/{{project}}/securityHealthAnalyticsSettings/customModules'
+update_verb: :PATCH
+update_mask: true
+examples:
+  - !ruby/object:Provider::Terraform::Examples
+    name: "scc_project_custom_module_basic"
+    primary_resource_id: "example"
+    skip_test: true
+    vars:
+      display_name: basic_custom_module
+  - !ruby/object:Provider::Terraform::Examples
+    name: "scc_project_custom_module_full"
+    primary_resource_id: "example"
+    skip_test: true
+    vars:
+      display_name: full_custom_module
+
+properties:
+  - !ruby/object:Api::Type::String
+    name: 'name'
+    output: true
+    custom_flatten: templates/terraform/custom_flatten/name_from_self_link.erb
+    description: |
+      The resource name of the custom module. Its format is "projects/{project}/securityHealthAnalyticsSettings/customModules/{customModule}".
+      The id {customModule} is server-generated and is not user settable. It will be a numeric id containing 1-20 digits.
+  - !ruby/object:Api::Type::String
+    name: 'displayName'
+    immutable: true
+    required: true
+    # API error for invalid display names is just "INVALID_ARGUMENT" with no details
+    validation: !ruby/object:Provider::Terraform::Validation
+      function: 'verify.ValidateRegexp(`^[a-z][\w_]{0,127}$`)'
+    description: |
+      The display name of the Security Health Analytics custom module. This
+      display name becomes the finding category for all findings that are
+      returned by this custom module. The display name must be between 1 and
+      128 characters, start with a lowercase letter, and contain alphanumeric
+      characters or underscores only.
+  - !ruby/object:Api::Type::Enum
+    name: 'enablementState'
+    required: true
+    description: |
+      The enablement state of the custom module.
+    values:
+      - :ENABLED
+      - :DISABLED
+  - !ruby/object:Api::Type::String
+    name: 'updateTime'
+    output: true
+    description: |
+      The time at which the custom module was last updated.
+
+      A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and
+      up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
+  - !ruby/object:Api::Type::String
+    name: 'lastEditor'
+    output: true
+    description: |
+      The editor that last updated the custom module.
+  - !ruby/object:Api::Type::String
+    name: 'ancestorModule'
+    output: true
+    description: |
+      If empty, indicates that the custom module was created in the organization,folder,
+      or project in which you are viewing the custom module. Otherwise, ancestor_module
+      specifies the organization or folder from which the custom module is inherited.
+  - !ruby/object:Api::Type::NestedObject
+    name: 'customConfig'
+    required: true
+    description: |
+      The user specified custom configuration for the module.
+    properties:
+      - !ruby/object:Api::Type::NestedObject
+        name: 'predicate'
+        required: true
+        description: |
+          The CEL expression to evaluate to produce findings. When the expression evaluates
+          to true against a resource, a finding is generated.
+        properties:
+          - !ruby/object:Api::Type::String
+            name: 'expression'
+            required: true
+            description: |
+              Textual representation of an expression in Common Expression Language syntax.
+          - !ruby/object:Api::Type::String
+            name: 'title'
+            description: |
+              Title for the expression, i.e. a short string describing its purpose. This can
+              be used e.g. in UIs which allow to enter the expression.
+          - !ruby/object:Api::Type::String
+            name: 'description'
+            description: |
+              Description of the expression. This is a longer text which describes the
+              expression, e.g. when hovered over it in a UI.
+          - !ruby/object:Api::Type::String
+            name: 'location'
+            description: |
+              String indicating the location of the expression for error reporting, e.g. a
+              file name and a position in the file.
+      - !ruby/object:Api::Type::NestedObject
+        name: 'customOutput'
+        description: |
+          Custom output properties.
+        properties:
+          - !ruby/object:Api::Type::Array
+            name: 'properties'
+            description: |
+              A list of custom output properties to add to the finding.
+            item_type: !ruby/object:Api::Type::NestedObject
+              properties:
+                - !ruby/object:Api::Type::String
+                  name: 'name'
+                  description: |
+                    Name of the property for the custom output.
+                - !ruby/object:Api::Type::NestedObject
+                  name: 'valueExpression'
+                  description: |
+                    The CEL expression for the custom output. A resource property can be specified
+                    to return the value of the property or a text string enclosed in quotation marks.
+                  properties:
+                    - !ruby/object:Api::Type::String
+                      name: 'expression'
+                      required: true
+                      description: |
+                        Textual representation of an expression in Common Expression Language syntax.
+                    - !ruby/object:Api::Type::String
+                      name: 'title'
+                      description: |
+                        Title for the expression, i.e. a short string describing its purpose. This can
+                        be used e.g. in UIs which allow to enter the expression.
+                    - !ruby/object:Api::Type::String
+                      name: 'description'
+                      description: |
+                        Description of the expression. This is a longer text which describes the
+                        expression, e.g. when hovered over it in a UI.
+                    - !ruby/object:Api::Type::String
+                      name: 'location'
+                      description: |
+                        String indicating the location of the expression for error reporting, e.g. a
+                        file name and a position in the file.
+      - !ruby/object:Api::Type::NestedObject
+        name: 'resourceSelector'
+        required: true
+        description: |
+          The resource types that the custom module operates on. Each custom module
+          can specify up to 5 resource types.
+        properties:
+          - !ruby/object:Api::Type::Array
+            name: 'resourceTypes'
+            required: true
+            description: |
+              The resource types to run the detector on.
+            item_type: Api::Type::String
+      - !ruby/object:Api::Type::Enum
+        name: 'severity'
+        required: true
+        description: |
+          The severity to assign to findings generated by the module.
+        values:
+          - :CRITICAL
+          - :HIGH
+          - :MEDIUM
+          - :LOW
+      - !ruby/object:Api::Type::String
+        name: 'description'
+        description: |
+          Text that describes the vulnerability or misconfiguration that the custom
+          module detects. This explanation is returned with each finding instance to
+          help investigators understand the detected issue. The text must be enclosed in quotation marks.
+      - !ruby/object:Api::Type::String
+        name: 'recommendation'
+        required: true
+        description: |
+          An explanation of the recommended steps that security teams can take to resolve
+          the detected issue. This explanation is returned with each finding generated by
+          this module in the nextSteps property of the finding JSON.
diff --git a/mmv1/products/servicedirectory/Namespace.yaml b/mmv1/products/servicedirectory/Namespace.yaml
index 8224784f9dd1..8d76947730ef 100644
--- a/mmv1/products/servicedirectory/Namespace.yaml
+++ b/mmv1/products/servicedirectory/Namespace.yaml
@@ -72,7 +72,7 @@ properties:
       The resource name for the namespace
       in the format `projects/*/locations/*/namespaces/*`.
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Resource labels associated with this Namespace. No more than 64 user
diff --git a/mmv1/products/spanner/Instance.yaml b/mmv1/products/spanner/Instance.yaml
index bbc63c307ff6..7d2b8f595fc9 100644
--- a/mmv1/products/spanner/Instance.yaml
+++ b/mmv1/products/spanner/Instance.yaml
@@ -134,6 +134,7 @@ properties:
     exactly_one_of:
       - num_nodes
       - processing_units
+      - autoscaling_config
   - !ruby/object:Api::Type::Integer
     name: 'processingUnits'
     description: |
@@ -142,8 +143,9 @@ properties:
     exactly_one_of:
       - num_nodes
       - processing_units
+      - autoscaling_config
     default_from_api: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       An object containing a list of "key": value pairs.
@@ -156,3 +158,50 @@ properties:
     values:
       - :READY
       - :CREATING
+  - !ruby/object:Api::Type::NestedObject
+    name: 'autoscalingConfig'
+    description: |
+      The autoscaling configuration. Autoscaling is enabled if this field is set.
+      When autoscaling is enabled, num_nodes and processing_units are treated as,
+      OUTPUT_ONLY fields and reflect the current compute capacity allocated to
+      the instance.
+    exactly_one_of:
+      - num_nodes
+      - processing_units
+      - autoscaling_config
+    properties:
+      - !ruby/object:Api::Type::NestedObject
+        name: 'autoscalingLimits'
+        description: |
+          Defines scale in controls to reduce the risk of response latency
+          and outages due to abrupt scale-in events
+        properties:
+          - !ruby/object:Api::Type::Integer
+            name: 'minProcessingUnits'
+            description: |
+              Specifies minimum number of processing units allocated to the instance.
+              If set, this number should be multiples of 1000.
+          - !ruby/object:Api::Type::Integer
+            name: 'maxProcessingUnits'
+            description: |
+              Specifies maximum number of processing units allocated to the instance.
+              If set, this number should be multiples of 1000 and be greater than or equal to
+              min_processing_units.
+      - !ruby/object:Api::Type::NestedObject
+        name: 'autoscalingTargets'
+        description: |
+          Defines scale in controls to reduce the risk of response latency
+          and outages due to abrupt scale-in events
+        properties:
+          - !ruby/object:Api::Type::Integer
+            name: 'highPriorityCpuUtilizationPercent'
+            description: |
+              Specifies the target high priority cpu utilization percentage that the autoscaler
+              should be trying to achieve for the instance.
+              This number is on a scale from 0 (no utilization) to 100 (full utilization)..
+          - !ruby/object:Api::Type::Integer
+            name: 'storageUtilizationPercent'
+            description: |
+              Specifies the target storage utilization percentage that the autoscaler
+              should be trying to achieve for the instance.
+              This number is on a scale from 0 (no utilization) to 100 (full utilization).
diff --git a/mmv1/products/sql/SourceRepresentationInstance.yaml b/mmv1/products/sql/SourceRepresentationInstance.yaml
index 1434ee08923b..d0703727c025 100644
--- a/mmv1/products/sql/SourceRepresentationInstance.yaml
+++ b/mmv1/products/sql/SourceRepresentationInstance.yaml
@@ -78,10 +78,8 @@ properties:
       - !ruby/object:Api::Type::String
         name: 'host'
         description: |
-          The externally accessible IPv4 address for the source database server.
+          The IPv4 address and port for the external server, or the the DNS address for the external server. If the external server is hosted on Cloud SQL, the port is 5432.
         required: true
-        validation: !ruby/object:Provider::Terraform::Validation
-          function: 'verify.ValidateIpAddress'
       - !ruby/object:Api::Type::Integer
         name: 'port'
         default_value: 3306
diff --git a/mmv1/products/storage/Bucket.yaml b/mmv1/products/storage/Bucket.yaml
index bbf776e2f8df..979c5716bd58 100644
--- a/mmv1/products/storage/Bucket.yaml
+++ b/mmv1/products/storage/Bucket.yaml
@@ -464,7 +464,7 @@ properties:
           object is missing, if applicable, the service will return the
           named object from this bucket as the content for a 404 Not Found
           result.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       Labels applied to this bucket.  A list of key->value pairs.
diff --git a/mmv1/products/storageinsights/ReportConfig.yaml b/mmv1/products/storageinsights/ReportConfig.yaml
new file mode 100644
index 000000000000..e8bc5f36bca8
--- /dev/null
+++ b/mmv1/products/storageinsights/ReportConfig.yaml
@@ -0,0 +1,158 @@
+# Copyright 2023 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the License);
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+--- !ruby/object:Api::Resource
+name: 'ReportConfig'
+base_url: projects/{{project}}/locations/{{location}}/reportConfigs
+create_url: projects/{{project}}/locations/{{location}}/reportConfigs
+self_link: projects/{{project}}/locations/{{location}}/reportConfigs/{{name}}
+update_verb: :PATCH
+update_mask: true
+references: !ruby/object:Api::Resource::ReferenceLinks
+  guides:
+    'Official Documentation': 'https://cloud.google.com/storage/docs/insights/using-storage-insights'
+  api: 'https://cloud.google.com/storage/docs/json_api/v1/reportConfig'
+description: |
+  Represents an inventory report configuration.
+examples:
+  - !ruby/object:Provider::Terraform::Examples
+    name: "storage_insights_report_config"
+    primary_resource_id: "config"
+    vars:
+      bucket_name: "my-bucket"
+    config_path: "templates/terraform/examples/storage_insights_report_config.tf.erb"
+parameters:
+  - !ruby/object:Api::Type::String
+    name: 'location'
+    description: |
+      The location of the ReportConfig. The source and destination buckets specified in the ReportConfig
+      must be in the same location.
+    immutable: true
+    required: true
+    url_param_only: true
+properties:
+  - !ruby/object:Api::Type::String
+    name: 'name'
+    output: true
+    description: |
+      The UUID of the inventory report configuration.
+    custom_flatten: templates/terraform/custom_flatten/name_from_self_link.erb
+  - !ruby/object:Api::Type::NestedObject
+    name: 'frequencyOptions'
+    description: |
+      Options for configuring how inventory reports are generated.
+    properties:
+      - !ruby/object:Api::Type::Enum
+        name: 'frequency'
+        description: |
+          The frequency in which inventory reports are generated. Values are DAILY or WEEKLY.
+        required: true
+        values:
+          - :DAILY
+          - :WEEKLY
+      - !ruby/object:Api::Type::NestedObject
+        name: 'startDate'
+        description: |
+          The date to start generating inventory reports. For example, {"day": 15, "month": 8, "year": 2022}.
+        required: true
+        properties:
+          - !ruby/object:Api::Type::Integer
+            name: 'day'
+            description: 'The day of the month to start generating inventory reports.'
+            required: true
+          - !ruby/object:Api::Type::Integer
+            name: 'month'
+            description: 'The month to start generating inventory reports.'
+            required: true
+          - !ruby/object:Api::Type::Integer
+            name: 'year'
+            description: 'The year to start generating inventory reports'
+            required: true
+      - !ruby/object:Api::Type::NestedObject
+        name: 'endDate'
+        description: |
+          The date to stop generating inventory reports. For example, {"day": 15, "month": 9, "year": 2022}.
+        required: true
+        properties:
+          - !ruby/object:Api::Type::Integer
+            name: 'day'
+            description: 'The day of the month to stop generating inventory reports.'
+            required: true
+          - !ruby/object:Api::Type::Integer
+            name: 'month'
+            description: 'The month to stop generating inventory reports.'
+            required: true
+          - !ruby/object:Api::Type::Integer
+            name: 'year'
+            description: 'The year to stop generating inventory reports'
+            required: true
+  - !ruby/object:Api::Type::NestedObject
+    name: 'csvOptions'
+    description: |
+      Options for configuring the format of the inventory report CSV file.
+    required: true
+    properties:
+      - !ruby/object:Api::Type::String
+        name: 'recordSeparator'
+        description: |
+          The character used to separate the records in the inventory report CSV file.
+      - !ruby/object:Api::Type::String
+        name: 'delimiter'
+        description: |
+          The delimiter used to separate the fields in the inventory report CSV file.
+      - !ruby/object:Api::Type::Boolean
+        name: 'headerRequired'
+        description: |
+          The boolean that indicates whether or not headers are included in the inventory report CSV file.
+  - !ruby/object:Api::Type::NestedObject
+    name: 'objectMetadataReportOptions'
+    description: |
+      Options for including metadata in an inventory report.
+    update_mask_fields:
+      - 'objectMetadataReportOptions.metadataFields'
+      - 'objectMetadataReportOptions.storageDestinationOptions.bucket'
+      - 'objectMetadataReportOptions.storageDestinationOptions.destinationPath'
+    properties:
+      - !ruby/object:Api::Type::Array
+        name: 'metadataFields'
+        description: |
+          The metadata fields included in an inventory report.
+        required: true
+        item_type: Api::Type::String
+      - !ruby/object:Api::Type::NestedObject
+        name: 'storageFilters'
+        properties:
+          - !ruby/object:Api::Type::String
+            name: 'bucket'
+            description: |
+              The filter to use when specifying which bucket to generate inventory reports for.
+            immutable: true
+      - !ruby/object:Api::Type::NestedObject
+        name: 'storageDestinationOptions'
+        description: |
+          Options for where the inventory reports are stored.
+        required: true
+        properties:
+          - !ruby/object:Api::Type::String
+            name: 'bucket'
+            description: |
+              The destination bucket that stores the generated inventory reports.
+            required: true
+          - !ruby/object:Api::Type::String
+            name: 'destinationPath'
+            description: |
+              The path within the destination bucket to store generated inventory reports.
+  - !ruby/object:Api::Type::String
+    name: 'displayName'
+    description: |
+      The editable display name of the inventory report configuration. Has a limit of 256 characters. Can be empty.
diff --git a/mmv1/products/storageinsights/product.yaml b/mmv1/products/storageinsights/product.yaml
new file mode 100644
index 000000000000..7f7a0b22e93c
--- /dev/null
+++ b/mmv1/products/storageinsights/product.yaml
@@ -0,0 +1,29 @@
+# Copyright 2022 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+--- !ruby/object:Api::Product
+name: StorageInsights
+display_name: Cloud Storage Insights
+versions:
+  - !ruby/object:Api::Product::Version
+    name: ga
+    base_url: https://storageinsights.googleapis.com/v1/
+scopes:
+  - https://www.googleapis.com/auth/devstorage.full_control
+apis_required:
+  - !ruby/object:Api::Product::ApiReference
+    name: Google Cloud Storage
+    url: https://console.cloud.google.com/apis/library/storage-component.googleapis.com/
+  - !ruby/object:Api::Product::ApiReference
+    name: Google Cloud Storage Insights
+    url: https://console.cloud.google.com/apis/library/storageinsights.googleapis.com/
diff --git a/mmv1/products/tpu/Node.yaml b/mmv1/products/tpu/Node.yaml
index e3d1ac84fdc5..318d3827c782 100644
--- a/mmv1/products/tpu/Node.yaml
+++ b/mmv1/products/tpu/Node.yaml
@@ -36,6 +36,17 @@ examples:
     vars:
       node_name: 'test-tpu'
       global_address_name: 'my-global-address'
+      network_name: 'tpu-node-network'
+    skip_test: true
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'tpu_node_full_test'
+    primary_resource_id: 'tpu'
+    vars:
+      node_name: 'test-tpu'
+      network_name: 'tpu-node-network'
+    test_vars_overrides:
+      network_name: 'acctest.BootstrapSharedServiceNetworkingConnection(t, "vpc-network-1")'
+    skip_docs: true
 custom_code: !ruby/object:Provider::Terraform::CustomCode
   constants: 'templates/terraform/constants/tpu_node.erb'
 custom_diff: [
@@ -153,7 +164,7 @@ properties:
           output: true
           description: |
             The port of this network endpoint.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     immutable: true
     description: Resource labels to represent user provided metadata.
diff --git a/mmv1/products/tpuv2/Vm.yaml b/mmv1/products/tpuv2/Vm.yaml
new file mode 100644
index 000000000000..49363f49e6f2
--- /dev/null
+++ b/mmv1/products/tpuv2/Vm.yaml
@@ -0,0 +1,351 @@
+# Copyright 2023 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+--- !ruby/object:Api::Resource
+name: 'Vm'
+description: |
+  A Cloud TPU VM instance.
+references: !ruby/object:Api::Resource::ReferenceLinks
+  guides:
+    'Official Documentation': 'https://cloud.google.com/tpu/docs/'
+  api: 'https://cloud.google.com/tpu/docs/reference/rest/v2/projects.locations.nodes'
+base_url: projects/{{project}}/locations/{{zone}}/nodes
+self_link: projects/{{project}}/locations/{{zone}}/nodes/{{name}}
+create_url: projects/{{project}}/locations/{{zone}}/nodes?nodeId={{name}}
+update_url: projects/{{project}}/locations/{{zone}}/nodes/{{name}}
+update_verb: :PATCH
+update_mask: true
+autogen_async: true
+custom_diff: [
+  'acceleratorTypeCustomizeDiff',
+]
+async: !ruby/object:Api::OpAsync
+  operation: !ruby/object:Api::OpAsync::Operation
+    path: 'name'
+    base_url: '{{op_id}}'
+    wait_ms: 1000
+  result: !ruby/object:Api::OpAsync::Result
+    path: 'response'
+    resource_inside_response: true
+  status: !ruby/object:Api::OpAsync::Status
+    path: 'done'
+    complete: true
+    allowed:
+      - true
+      - false
+  error: !ruby/object:Api::OpAsync::Error
+    path: 'error'
+    message: 'message'
+custom_code: !ruby/object:Provider::Terraform::CustomCode
+  constants: templates/terraform/constants/tpu_vm.go.erb
+examples:
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'tpu_v2_vm_basic'
+    min_version: 'beta'
+    primary_resource_id: 'tpu'
+    vars:
+      vm_name: 'test-tpu'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'tpu_v2_vm_full'
+    min_version: 'beta'
+    primary_resource_id: 'tpu'
+    pull_external: true
+    vars:
+      vm_name: 'test-tpu'
+      network_name: 'tpu-net'
+      subnet_name: 'tpu-subnet'
+      sa_id: 'tpu-sa'
+      disk_name: 'tpu-disk'
+parameters:
+  - !ruby/object:Api::Type::String
+    name: 'zone'
+    description: |
+      The GCP location for the TPU. If it is not provided, the provider zone is used.
+    immutable: true
+    url_param_only: true
+    default_from_api: true
+properties:
+  - !ruby/object:Api::Type::String
+    name: 'name'
+    required: true
+    immutable: true
+    description: |
+      The immutable name of the TPU.
+    custom_flatten: 'templates/terraform/custom_flatten/name_from_self_link.erb'
+  - !ruby/object:Api::Type::String
+    name: 'runtimeVersion'
+    required: true
+    immutable: true
+    description: |
+      Runtime version for the TPU.
+  - !ruby/object:Api::Type::String
+    name: 'acceleratorType'
+    default_from_api: true
+    immutable: true
+    conflicts:
+      - accelerator_config
+    description: |
+      TPU accelerator type for the TPU. `accelerator_type` cannot be used at the same time as
+      `accelerator_config`. If neither is specified, `accelerator_type` defaults to 'v2-8'.
+  - !ruby/object:Api::Type::String
+    name: 'description'
+    description: |
+      Text description of the TPU.
+  - !ruby/object:Api::Type::String
+    name: 'cidrBlock'
+    default_from_api: true
+    immutable: true
+    description: |
+      The CIDR block that the TPU node will use when selecting an IP address. This CIDR block must
+      be a /29 block; the Compute Engine networks API forbids a smaller block, and using a larger
+      block would be wasteful (a node can only consume one IP address). Errors will occur if the
+      CIDR block has already been used for a currently existing TPU node, the CIDR block conflicts
+      with any subnetworks in the user's provided network, or the provided network is peered with
+      another network that is using that CIDR block.
+  - !ruby/object:Api::Type::NestedObject
+    name: 'networkConfig'
+    default_from_api: true
+    immutable: true
+    description: |
+      Network configurations for the TPU node.
+    properties:
+      - !ruby/object:Api::Type::String
+        name: 'network'
+        default_from_api: true
+        immutable: true
+        description: |
+          The name of the network for the TPU node. It must be a preexisting Google Compute Engine
+          network. If both network and subnetwork are specified, the given subnetwork must belong
+          to the given network. If network is not specified, it will be looked up from the
+          subnetwork if one is provided, or otherwise use "default".
+      - !ruby/object:Api::Type::String
+        name: 'subnetwork'
+        default_from_api: true
+        immutable: true
+        description: |
+          The name of the subnetwork for the TPU node. It must be a preexisting Google Compute
+          Engine subnetwork. If both network and subnetwork are specified, the given subnetwork
+          must belong to the given network. If subnetwork is not specified, the subnetwork with the
+          same name as the network will be used.
+      - !ruby/object:Api::Type::Boolean
+        name: 'enableExternalIps'
+        immutable: true
+        send_empty_value: true
+        description: |
+          Indicates that external IP addresses would be associated with the TPU workers. If set to
+          false, the specified subnetwork or network should have Private Google Access enabled.
+      - !ruby/object:Api::Type::Boolean
+        name: 'canIpForward'
+        immutable: true
+        send_empty_value: true
+        description: |
+          Allows the TPU node to send and receive packets with non-matching destination or source
+          IPs. This is required if you plan to use the TPU workers to forward routes.
+  - !ruby/object:Api::Type::NestedObject
+    name: 'serviceAccount'
+    default_from_api: true
+    immutable: true
+    description: |
+      The Google Cloud Platform Service Account to be used by the TPU node VMs. If None is
+      specified, the default compute service account will be used.
+    properties:
+      - !ruby/object:Api::Type::String
+        name: 'email'
+        default_from_api: true
+        immutable: true
+        description: |
+          Email address of the service account. If empty, default Compute service account will be used.
+      - !ruby/object:Api::Type::Array
+        name: 'scope'
+        default_from_api: true
+        immutable: true
+        diff_suppress_func: 'tpuServiceAccountAddedScopesSuppress'
+        description: |
+          The list of scopes to be made available for this service account. If empty, access to all
+          Cloud APIs will be allowed.
+        item_type: Api::Type::String
+  - !ruby/object:Api::Type::NestedObject
+    name: 'schedulingConfig'
+    immutable: true
+    description: |
+      The scheduling options for this node.
+    properties:
+      - !ruby/object:Api::Type::Boolean
+        name: 'preemptible'
+        immutable: true
+        send_empty_value: true
+        description: |
+          Defines whether the node is preemptible.
+      - !ruby/object:Api::Type::Boolean
+        name: 'reserved'
+        immutable: true
+        send_empty_value: true
+        description: |
+          Whether the node is created under a reservation.
+  - !ruby/object:Api::Type::Array
+    name: 'dataDisks'
+    description: |
+      The additional data disks for the Node.
+    item_type: !ruby/object:Api::Type::NestedObject
+      properties:
+        - !ruby/object:Api::Type::String
+          name: 'sourceDisk'
+          required: true
+          description: |
+            Specifies the full path to an existing disk. For example:
+            "projects/my-project/zones/us-central1-c/disks/my-disk".
+        - !ruby/object:Api::Type::Enum
+          name: 'mode'
+          default_value: :READ_WRITE
+          description: |
+            The mode in which to attach this disk. If not specified, the default is READ_WRITE
+            mode. Only applicable to dataDisks.
+          values:
+            - 'READ_WRITE'
+            - 'READ_ONLY'
+  - !ruby/object:Api::Type::NestedObject
+    name: 'shieldedInstanceConfig'
+    immutable: true
+    description: |
+      Shielded Instance options.
+    properties:
+      - !ruby/object:Api::Type::Boolean
+        name: 'enableSecureBoot'
+        immutable: true
+        send_empty_value: true
+        required: true
+        description: |
+          Defines whether the instance has Secure Boot enabled.
+  - !ruby/object:Api::Type::NestedObject
+    name: 'acceleratorConfig'
+    default_from_api: true
+    immutable: true
+    conflicts:
+      - accelerator_type
+    description: |
+      The AccleratorConfig for the TPU Node. `accelerator_config` cannot be used at the same time
+      as `accelerator_type`. If neither is specified, `accelerator_type` defaults to 'v2-8'.
+    properties:
+      - !ruby/object:Api::Type::Enum
+        name: 'type'
+        immutable: true
+        required: true
+        description: |
+          Type of TPU.
+        values:
+          - 'V2'
+          - 'V3'
+          - 'V4'
+      - !ruby/object:Api::Type::String
+        name: 'topology'
+        immutable: true
+        required: true
+        description: |
+          Topology of TPU in chips.
+  - !ruby/object:Api::Type::KeyValueLabels
+    name: 'labels'
+    description: Resource labels to represent user-provided metadata.
+  - !ruby/object:Api::Type::KeyValuePairs
+    name: 'metadata'
+    description: Custom metadata to apply to the TPU Node. Can set startup-script and shutdown-script.
+  - !ruby/object:Api::Type::Array
+    name: 'tags'
+    description: |
+      Tags to apply to the TPU Node. Tags are used to identify valid sources or targets for network firewalls.
+    item_type: Api::Type::String
+  - !ruby/object:Api::Type::String
+    name: 'state'
+    output: true
+    description: |
+      The current state for the TPU Node.
+  - !ruby/object:Api::Type::String
+    name: 'health'
+    output: true
+    description: |
+      The health status of the TPU node.
+  - !ruby/object:Api::Type::String
+    name: 'healthDescription'
+    output: true
+    description: |
+      If this field is populated, it contains a description of why the TPU Node is unhealthy.
+  - !ruby/object:Api::Type::String
+    name: 'apiVersion'
+    output: true
+    description: |
+      The API version that created this Node.
+  - !ruby/object:Api::Type::String
+    name: 'queuedResource'
+    output: true
+    description: |
+      The qualified name of the QueuedResource that requested this Node.
+  - !ruby/object:Api::Type::Boolean
+    name: 'multisliceNode'
+    output: true
+    description: |
+      Whether the Node belongs to a Multislice group.
+  - !ruby/object:Api::Type::Array
+    name: 'networkEndpoints'
+    output: true
+    description: |
+      The network endpoints where TPU workers can be accessed and sent work. It is recommended that
+      runtime clients of the node reach out to the 0th entry in this map first.
+    item_type: !ruby/object:Api::Type::NestedObject
+      properties:
+        - !ruby/object:Api::Type::String
+          name: 'ipAddress'
+          output: true
+          description: |
+            The internal IP address of this network endpoint.
+        - !ruby/object:Api::Type::Integer
+          name: 'port'
+          output: true
+          description: |
+            The port of this network endpoint.
+        - !ruby/object:Api::Type::NestedObject
+          name: 'accessConfig'
+          output: true
+          description: |
+            The access config for the TPU worker.
+          properties:
+            - !ruby/object:Api::Type::String
+              name: 'externalIp'
+              output: true
+              description: |
+                An external IP address associated with the TPU worker.
+  - !ruby/object:Api::Type::Array
+    name: 'symptoms'
+    output: true
+    description: |
+      The Symptoms that have occurred to the TPU Node.
+    item_type: !ruby/object:Api::Type::NestedObject
+      properties:
+        - !ruby/object:Api::Type::String
+          name: 'createTime'
+          output: true
+          description: |
+            Timestamp when the Symptom is created.
+        - !ruby/object:Api::Type::String
+          name: 'symptomType'
+          output: true
+          description: |
+            Type of the Symptom.
+        - !ruby/object:Api::Type::String
+          name: 'details'
+          output: true
+          description: |
+            Detailed information of the current Symptom.
+        - !ruby/object:Api::Type::String
+          name: 'workerId'
+          output: true
+          description: |
+            A string used to uniquely distinguish a worker within a TPU node.
diff --git a/mmv1/products/cloudiot/product.yaml b/mmv1/products/tpuv2/product.yaml
similarity index 70%
rename from mmv1/products/cloudiot/product.yaml
rename to mmv1/products/tpuv2/product.yaml
index 2539129f14da..20dded6c52e6 100644
--- a/mmv1/products/cloudiot/product.yaml
+++ b/mmv1/products/tpuv2/product.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google Inc.
+# Copyright 2023 Google Inc.
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -12,13 +12,15 @@
 # limitations under the License.
 
 --- !ruby/object:Api::Product
-name: CloudIot
-display_name: Cloud IoT Core
-legacy_name: 'cloudiot'
+name: TpuV2
+display_name: Cloud TPU v2
 versions:
   - !ruby/object:Api::Product::Version
-    name: ga
-    base_url: https://cloudiot.googleapis.com/v1/
+    name: beta
+    base_url: https://tpu.googleapis.com/v2/
 scopes:
-  - https://www.googleapis.com/auth/cloudiot
   - https://www.googleapis.com/auth/cloud-platform
+apis_required:
+  - !ruby/object:Api::Product::ApiReference
+    name: Cloud TPU API
+    url: https://console.cloud.google.com/apis/library/tpu.googleapis.com/
diff --git a/mmv1/products/vertexai/Dataset.yaml b/mmv1/products/vertexai/Dataset.yaml
index 6f27a6d908e7..71f4bfad9ad3 100644
--- a/mmv1/products/vertexai/Dataset.yaml
+++ b/mmv1/products/vertexai/Dataset.yaml
@@ -81,11 +81,10 @@ properties:
     output: true
     description: |
       The timestamp of when the dataset was last updated in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       A set of key/value label pairs to assign to this Workflow.
-    default_from_api: true
   - !ruby/object:Api::Type::NestedObject
     name: 'encryptionSpec'
     immutable: true
diff --git a/mmv1/products/vertexai/Endpoint.yaml b/mmv1/products/vertexai/Endpoint.yaml
index 900fd90ee5df..9bd52067d4e2 100644
--- a/mmv1/products/vertexai/Endpoint.yaml
+++ b/mmv1/products/vertexai/Endpoint.yaml
@@ -359,8 +359,8 @@ properties:
       "overwrite" update happens.
     output: true
     ignore_read: true
-  - !ruby/object:Api::Type::KeyValuePairs
-    name: labels
+  - !ruby/object:Api::Type::KeyValueLabels
+    name: 'labels'
     description:
       The labels with user-defined metadata to organize your Endpoints. Label
       keys and values can be no longer than 64 characters (Unicode codepoints),
diff --git a/mmv1/products/vertexai/Featurestore.yaml b/mmv1/products/vertexai/Featurestore.yaml
index d8ce854c04d3..40bb998ec75f 100644
--- a/mmv1/products/vertexai/Featurestore.yaml
+++ b/mmv1/products/vertexai/Featurestore.yaml
@@ -145,7 +145,7 @@ properties:
     output: true
     description: |
       The timestamp of when the featurestore was last updated in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       A set of key/value label pairs to assign to this Featurestore.
diff --git a/mmv1/products/vertexai/FeaturestoreEntitytype.yaml b/mmv1/products/vertexai/FeaturestoreEntitytype.yaml
index c7f097d95a1b..53fefc21ecfa 100644
--- a/mmv1/products/vertexai/FeaturestoreEntitytype.yaml
+++ b/mmv1/products/vertexai/FeaturestoreEntitytype.yaml
@@ -132,7 +132,7 @@ properties:
     output: true
     description: |
       The timestamp of when the featurestore was last updated in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       A set of key/value label pairs to assign to this EntityType.
diff --git a/mmv1/products/vertexai/FeaturestoreEntitytypeFeature.yaml b/mmv1/products/vertexai/FeaturestoreEntitytypeFeature.yaml
index 4152ab0e6327..b2379118329e 100644
--- a/mmv1/products/vertexai/FeaturestoreEntitytypeFeature.yaml
+++ b/mmv1/products/vertexai/FeaturestoreEntitytypeFeature.yaml
@@ -105,7 +105,7 @@ properties:
     output: true
     description: |
       The timestamp when the entity type was most recently updated in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       A set of key/value label pairs to assign to the feature.
diff --git a/mmv1/products/vertexai/Index.yaml b/mmv1/products/vertexai/Index.yaml
index 938893755581..28efea9b6e76 100644
--- a/mmv1/products/vertexai/Index.yaml
+++ b/mmv1/products/vertexai/Index.yaml
@@ -100,6 +100,7 @@ properties:
     properties:
       - !ruby/object:Api::Type::String
         name: 'contentsDeltaUri'
+        required: true
         description: |-
           Allows inserting, updating  or deleting the contents of the Matching Engine Index.
           The string must be a valid Cloud Storage directory path. If this
@@ -222,7 +223,7 @@ properties:
     description: Used to perform consistent read-modify-write updates.
     output: true
     ignore_read: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: The labels with user-defined metadata to organize your Indexes.
   - !ruby/object:Api::Type::String
diff --git a/mmv1/products/vertexai/IndexEndpoint.yaml b/mmv1/products/vertexai/IndexEndpoint.yaml
index 465147a362ed..7544b60e05ce 100644
--- a/mmv1/products/vertexai/IndexEndpoint.yaml
+++ b/mmv1/products/vertexai/IndexEndpoint.yaml
@@ -51,8 +51,24 @@ examples:
     vars:
       address_name: "address-name"
       network_name: "network-name"
+    skip_test: true
+  - !ruby/object:Provider::Terraform::Examples
+    name: "vertex_ai_index_endpoint_test"
+    primary_resource_id: "index_endpoint"
+    vars:
+      network_name: "network-name"
     test_vars_overrides:
-      network_name: 'acctest.BootstrapSharedTestNetwork(t, "vertex-ai-index-endpoint")'
+      network_name: 'acctest.BootstrapSharedServiceNetworkingConnection(t, "vpc-network-1")'
+    skip_docs: true
+  - !ruby/object:Provider::Terraform::Examples
+    name: "vertex_ai_index_endpoint_with_psc"
+    primary_resource_id: "index_endpoint"
+  - !ruby/object:Provider::Terraform::Examples
+    name: "vertex_ai_index_endpoint_with_false_psc"
+    primary_resource_id: "index_endpoint"
+    # It's not distinguishable if the psc is false or not set, so we need to skip the test.
+    skip_import_test: true
+    skip_docs: true
   - !ruby/object:Provider::Terraform::Examples
     name: "vertex_ai_index_endpoint_with_public_endpoint"
     primary_resource_id: "index_endpoint"
@@ -83,7 +99,7 @@ properties:
     description: Used to perform consistent read-modify-write updates.
     output: true
     ignore_read: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: The labels with user-defined metadata to organize your Indexes.
   - !ruby/object:Api::Type::String
@@ -102,6 +118,28 @@ properties:
       [Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): `projects/{project}/global/networks/{network}`.
       Where `{project}` is a project number, as in `12345`, and `{network}` is network name.
     immutable: true
+    conflicts:
+      - privateServiceConnectConfig
+  - !ruby/object:Api::Type::NestedObject
+    name: privateServiceConnectConfig
+    immutable: true
+    default_from_api: true
+    description: |-
+      Optional. Configuration for private service connect. `network` and `privateServiceConnectConfig` are mutually exclusive.
+    conflicts:
+      - network
+    custom_flatten: templates/terraform/custom_flatten/vertex_ai_index_endpoint_private_service_connect_config.go.erb
+    properties:
+      - !ruby/object:Api::Type::Boolean
+        name: enablePrivateServiceConnect
+        description: If set to true, the IndexEndpoint is created without private service access.
+        immutable: true
+        required: true
+      - !ruby/object:Api::Type::Array
+        name: projectAllowlist
+        description: A list of Projects from which the forwarding rule will target the service attachment.
+        item_type: Api::Type::String
+        immutable: true
   - !ruby/object:Api::Type::Boolean
     name: publicEndpointEnabled
     immutable: true
diff --git a/mmv1/products/vertexai/Tensorboard.yaml b/mmv1/products/vertexai/Tensorboard.yaml
index 99c2895a1e1c..3d341ba2328e 100644
--- a/mmv1/products/vertexai/Tensorboard.yaml
+++ b/mmv1/products/vertexai/Tensorboard.yaml
@@ -113,7 +113,7 @@ properties:
     output: true
     description: |
       The timestamp of when the Tensorboard was last updated in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       The labels with user-defined metadata to organize your Tensorboards.
diff --git a/mmv1/products/workflows/Workflow.yaml b/mmv1/products/workflows/Workflow.yaml
index 80d80a05e276..49d731e2ac92 100644
--- a/mmv1/products/workflows/Workflow.yaml
+++ b/mmv1/products/workflows/Workflow.yaml
@@ -77,7 +77,7 @@ properties:
     name: 'state'
     output: true
     description: State of the workflow deployment.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description: |
       A set of key/value label pairs to assign to this Workflow.
@@ -108,3 +108,7 @@ properties:
       The KMS key used to encrypt workflow and execution data.
 
       Format: projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey}
+  - !ruby/object:Api::Type::KeyValuePairs
+    name: 'userEnvVars'
+    description: |
+      User-defined environment variables associated with this workflow revision. This map has a maximum length of 20. Each string can take up to 40KiB. Keys cannot be empty strings and cannot start with “GOOGLE” or “WORKFLOWS".
diff --git a/mmv1/products/workstations/Workstation.yaml b/mmv1/products/workstations/Workstation.yaml
index fca8d282c316..9bac34f941aa 100644
--- a/mmv1/products/workstations/Workstation.yaml
+++ b/mmv1/products/workstations/Workstation.yaml
@@ -117,14 +117,18 @@ properties:
     name: 'displayName'
     description: |
       Human-readable name for this resource.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description:
       'Client-specified labels that are applied to the resource and that are
       also propagated to the underlying Compute Engine resources.'
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueAnnotations
     name: 'annotations'
     description: 'Client-specified annotations. This is distinct from labels.'
+  - !ruby/object:Api::Type::KeyValuePairs
+    name: 'env'
+    description: |
+      'Client-specified environment variables passed to the workstation container's entrypoint.'
   - !ruby/object:Api::Type::Time
     name: 'createTime'
     description: |
diff --git a/mmv1/products/workstations/WorkstationCluster.yaml b/mmv1/products/workstations/WorkstationCluster.yaml
index ed0f940c896d..5c7c54658869 100644
--- a/mmv1/products/workstations/WorkstationCluster.yaml
+++ b/mmv1/products/workstations/WorkstationCluster.yaml
@@ -63,6 +63,12 @@ examples:
     primary_resource_id: "default"
     vars:
       workstation_cluster_name: "workstation-cluster-private"
+  - !ruby/object:Provider::Terraform::Examples
+    name: "workstation_cluster_custom_domain"
+    min_version: beta
+    primary_resource_id: "default"
+    vars:
+      workstation_cluster_name: "workstation-cluster-custom-domain"
 parameters:
   - !ruby/object:Api::Type::String
     name: "workstationClusterId"
@@ -89,7 +95,7 @@ properties:
     output: true
     description: |
       The system-generated UID of the resource.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: "labels"
     description:
       "Client-specified labels that are applied to the resource and that are
@@ -118,7 +124,7 @@ properties:
       Whether this resource is in degraded mode, in which case it may require user action to restore full functionality.
       Details can be found in the conditions field.
     output: true
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueAnnotations
     name: "annotations"
     description: "Client-specified annotations. This is distinct from labels."
   - !ruby/object:Api::Type::Fingerprint
@@ -163,6 +169,19 @@ properties:
         description: |
           Additional project IDs that are allowed to attach to the workstation cluster's service attachment.
           By default, the workstation cluster's project and the VPC host project (if different) are allowed.
+  - !ruby/object:Api::Type::NestedObject
+    name: "domainConfig"
+    min_version: beta
+    description: |
+      Configuration options for a custom domain.
+    properties:
+      - !ruby/object:Api::Type::String
+        name: "domain"
+        immutable: true
+        required: true
+        description: |
+          Domain used by Workstations for HTTP ingress.
+
   - !ruby/object:Api::Type::Array
     name: "conditions"
     description: |-
diff --git a/mmv1/products/workstations/WorkstationConfig.yaml b/mmv1/products/workstations/WorkstationConfig.yaml
index 4a64f9f44852..ea500032c3d6 100644
--- a/mmv1/products/workstations/WorkstationConfig.yaml
+++ b/mmv1/products/workstations/WorkstationConfig.yaml
@@ -153,12 +153,12 @@ properties:
     name: 'displayName'
     description: |
       Human-readable name for this resource.
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueLabels
     name: 'labels'
     description:
       'Client-specified labels that are applied to the resource and that are
       also propagated to the underlying Compute Engine resources.'
-  - !ruby/object:Api::Type::KeyValuePairs
+  - !ruby/object:Api::Type::KeyValueAnnotations
     name: 'annotations'
     description: 'Client-specified annotations. This is distinct from labels.'
   - !ruby/object:Api::Type::Fingerprint
@@ -183,6 +183,19 @@ properties:
     description: |
       How long to wait before automatically stopping a workstation after it was started. A value of 0 indicates that workstations using this configuration should never time out from running duration. Must be greater than 0 and less than 24 hours if `encryption_key` is set. Defaults to 12 hours.
       A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
+  - !ruby/object:Api::Type::Array
+    name: 'replicaZones'
+    item_type: Api::Type::String
+    immutable: true
+    description: |
+      Specifies the zones used to replicate the VM and disk resources within the region. If set, exactly two zones within the workstation cluster's region must be specified—for example, `['us-central1-a', 'us-central1-f']`.
+      If this field is empty, two default zones within the region are used. Immutable after the workstation configuration is created.
+    default_from_api: true
+  - !ruby/object:Api::Type::Boolean
+    name: 'enableAuditAgent'
+    description: |
+      Whether to enable Linux `auditd` logging on the workstation. When enabled, a service account must also be specified that has `logging.buckets.write` permission on the project. Operating system audit logging is distinct from Cloud Audit Logs.
+    ignore_read: true
   - !ruby/object:Api::Type::NestedObject
     name: 'host'
     description: |
@@ -192,12 +205,14 @@ properties:
       - 'host.gceInstance.machineType'
       - 'host.gceInstance.poolSize'
       - 'host.gceInstance.tags'
+      - 'host.gceInstance.serviceAccountScopes'
       - 'host.gceInstance.disablePublicIpAddresses'
       - 'host.gceInstance.enableNestedVirtualization'
       - 'host.gceInstance.shieldedInstanceConfig.enableSecureBoot'
       - 'host.gceInstance.shieldedInstanceConfig.enableVtpm'
       - 'host.gceInstance.shieldedInstanceConfig.enableIntegrityMonitoring'
       - 'host.gceInstance.confidentialInstanceConfig.enableConfidentialCompute'
+      - 'host.gceInstance.accelerators'
     properties:
       - !ruby/object:Api::Type::NestedObject
         name: 'gceInstance'
@@ -216,6 +231,12 @@ properties:
             description: |-
               Email address of the service account that will be used on VM instances used to support this config. This service account must have permission to pull the specified container image. If not set, VMs will run without a service account, in which case the image must be publicly accessible.
             default_from_api: true
+          - !ruby/object:Api::Type::Array
+            name: 'serviceAccountScopes'
+            item_type: Api::Type::String
+            description: |-
+              Scopes to grant to the service_account. Various scopes are automatically added based on feature usage. When specified, users of workstations under this configuration must have `iam.serviceAccounts.actAs` on the service account.
+            default_from_api: true
           - !ruby/object:Api::Type::Integer
             name: 'poolSize'
             description: |-
diff --git a/mmv1/provider/core.rb b/mmv1/provider/core.rb
index fb66cbbc4377..873a0c226bbd 100644
--- a/mmv1/provider/core.rb
+++ b/mmv1/provider/core.rb
@@ -287,7 +287,17 @@ def expected_output_folder?(output_folder)
     end
 
     def replace_import_path(output_folder, target)
-      return unless @target_version_name != 'ga'
+      data = File.read("#{output_folder}/#{target}")
+
+      if data.include? "#{TERRAFORM_PROVIDER_BETA}/#{RESOURCE_DIRECTORY_BETA}"
+        raise 'Importing a package from module ' \
+              "#{TERRAFORM_PROVIDER_BETA}/#{RESOURCE_DIRECTORY_BETA} " \
+              "is not allowed in file #{target.split('/').last}. " \
+              'Please import a package from module ' \
+              "#{TERRAFORM_PROVIDER_GA}/#{RESOURCE_DIRECTORY_GA}."
+      end
+
+      return if @target_version_name == 'ga'
 
       # Replace the import pathes in utility files
       case @target_version_name
@@ -299,7 +309,6 @@ def replace_import_path(output_folder, target)
         dir = RESOURCE_DIRECTORY_PRIVATE
       end
 
-      data = File.read("#{output_folder}/#{target}")
       data = data.gsub(
         "#{TERRAFORM_PROVIDER_GA}/#{RESOURCE_DIRECTORY_GA}",
         "#{tpg}/#{dir}"
@@ -401,7 +410,9 @@ def field_specific_update_methods(properties)
     # method and group them by update url & verb.
     def properties_by_custom_update(properties)
       update_props = properties.reject do |p|
-        p.update_url.nil? || p.update_verb.nil? || p.update_verb == :NOOP
+        p.update_url.nil? || p.update_verb.nil? || p.update_verb == :NOOP ||
+          p.is_a?(Api::Type::KeyValueTerraformLabels) ||
+          p.is_a?(Api::Type::KeyValueLabels) # effective_labels is used for update
       end
 
       update_props.group_by do |p|
diff --git a/mmv1/provider/terraform.rb b/mmv1/provider/terraform.rb
index 3d2e9b2e1aa6..6a261e34ec84 100644
--- a/mmv1/provider/terraform.rb
+++ b/mmv1/provider/terraform.rb
@@ -91,6 +91,10 @@ def tf_types
         Api::Type::NestedObject => 'schema.TypeList',
         Api::Type::Array => 'schema.TypeList',
         Api::Type::KeyValuePairs => 'schema.TypeMap',
+        Api::Type::KeyValueLabels => 'schema.TypeMap',
+        Api::Type::KeyValueTerraformLabels => 'schema.TypeMap',
+        Api::Type::KeyValueEffectiveLabels => 'schema.TypeMap',
+        Api::Type::KeyValueAnnotations => 'schema.TypeMap',
         Api::Type::Map => 'schema.TypeSet',
         Api::Type::Fingerprint => 'schema.TypeString'
       }
@@ -101,11 +105,13 @@ def updatable?(resource, properties)
     end
 
     def force_new?(property, resource)
-      !property.output &&
+      ((!property.output || property.is_a?(Api::Type::KeyValueEffectiveLabels)) &&
         (property.immutable || (resource.immutable && property.update_url.nil? &&
                               property.immutable.nil? &&
                             (property.parent.nil? ||
-                             force_new?(property.parent, resource))))
+                             force_new?(property.parent, resource))))) ||
+        (property.is_a?(Api::Type::KeyValueTerraformLabels) &&
+          !updatable?(resource, resource.all_user_properties))
     end
 
     # Returns tuples of (fieldName, list of update masks) for
diff --git a/mmv1/provider/terraform/common~copy.yaml b/mmv1/provider/terraform/common~copy.yaml
index 4e34aa349fec..59f18e3508b2 100644
--- a/mmv1/provider/terraform/common~copy.yaml
+++ b/mmv1/provider/terraform/common~copy.yaml
@@ -46,8 +46,8 @@
 <% end -%>
 
 <%
-  Dir["third_party/terraform/provider/*.go"].each do |file_path|
-    fname = file_path.split('/')[-1]
+  Dir["third_party/terraform/provider/**/*.go"].each do |file_path|
+    fname = file_path.delete_prefix("third_party/terraform/provider")
 -%>
 '<%= dir -%>/provider/<%= fname -%>': 'third_party/terraform/provider/<%= fname -%>'
 <% end -%>
@@ -137,6 +137,12 @@
 -%>
 '<%= fname -%>': '<%= file_path -%>'
 <% end -%>
+<%
+  Dir["third_party/terraform/META.d/*.yaml"].each do |file_path|
+    fname = file_path.delete_prefix("third_party/terraform/")
+-%>
+'<%= fname -%>': '<%= file_path -%>'
+<% end -%>
 '.teamcity/.gitignore': 'third_party/terraform/.teamcity/.gitignore'
 '.teamcity/Makefile': 'third_party/terraform/.teamcity/Makefile'
 'version/version.go': 'third_party/terraform/version/version.go'
diff --git a/mmv1/provider/terraform/virtual_fields.rb b/mmv1/provider/terraform/virtual_fields.rb
index e81bdbffe52e..66acd30b3e03 100644
--- a/mmv1/provider/terraform/virtual_fields.rb
+++ b/mmv1/provider/terraform/virtual_fields.rb
@@ -49,12 +49,17 @@ class VirtualFields < Api::Object
       # The default value for the field (defaults to false)
       attr_reader :default_value
 
+      # If set to true, changes in the field's value require recreating the
+      # resource.
+      attr_reader :immutable
+
       def validate
         super
         check :name, type: String, required: true
         check :description, type: String, required: true
         check :type, type: Class, default: Api::Type::Boolean
         check :default_value, default: false
+        check :immutable, default: false
       end
     end
   end
diff --git a/mmv1/provider/terraform_tgc_cai2hcl.rb b/mmv1/provider/terraform_tgc_cai2hcl.rb
new file mode 100644
index 000000000000..fb5a0c8d96e0
--- /dev/null
+++ b/mmv1/provider/terraform_tgc_cai2hcl.rb
@@ -0,0 +1,47 @@
+# Copyright 2023 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'provider/terraform_oics'
+require 'fileutils'
+
+module Provider
+  # Code generator for a library converting GCP CAI objects to Terraform state.
+  class CaiToTerraformConversion < Provider::Terraform
+    def generating_hashicorp_repo?
+      # This code is not used when generating TPG/TPGB
+      false
+    end
+
+    def generate(output_folder, types, _product_path, _dump_yaml, generate_code, generate_docs) end
+
+    def generate_resource(pwd, data, _generate_code, _generate_docs) end
+
+    def compile_common_files(output_folder, products, _common_compile_file) end
+
+    def copy_common_files(output_folder, generate_code, _generate_docs)
+      return unless generate_code
+
+      Google::LOGGER.info('Coping cai2hcl common files')
+
+      FileUtils.mkdir_p(output_folder)
+
+      FileUtils.cp_r('third_party/cai2hcl/.', output_folder)
+    end
+
+    def generate_resource_tests(pwd, data) end
+
+    def generate_iam_policy(pwd, data, generate_code, _generate_docs) end
+
+    def generate_resource_sweepers(pwd, data) end
+  end
+end
diff --git a/mmv1/templates/terraform/constants/cloud_run_domain_mapping.go.erb b/mmv1/templates/terraform/constants/cloud_run_domain_mapping.go.erb
index 7ae3d75f1a55..eacab2177f96 100644
--- a/mmv1/templates/terraform/constants/cloud_run_domain_mapping.go.erb
+++ b/mmv1/templates/terraform/constants/cloud_run_domain_mapping.go.erb
@@ -1,21 +1,9 @@
-var domainMappingGoogleProvidedLabels = []string{
-	"cloud.googleapis.com/location",
-	"run.googleapis.com/overrideAt",
-}
+func hasMetadata(_ context.Context, diff *schema.ResourceDiff, meta interface{}) error {
+	newCount := diff.Get("metadata.#")
 
-func DomainMappingLabelDiffSuppress(k, old, new string, d *schema.ResourceData) bool {
-	// Suppress diffs for the labels provided by Google
-	for _, label := range domainMappingGoogleProvidedLabels {
-		if strings.Contains(k, label) && new == "" {
-			return true
-		}
+	if newCount.(int) < 1 {
+		return fmt.Errorf("Insufficient \"metadata\" blocks. 1 \"metadata\" block is required.")
 	}
 
-	// Let diff be determined by labels (above)
-	if strings.Contains(k, "labels.%") {
-		return true
-	}
-
-	// For other keys, don't suppress diff.
-	return false
-}
+	return nil
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/constants/cloud_run_service.go.erb b/mmv1/templates/terraform/constants/cloud_run_service.go.erb
index eb4bd8e2c22b..0b748a4b3ba6 100644
--- a/mmv1/templates/terraform/constants/cloud_run_service.go.erb
+++ b/mmv1/templates/terraform/constants/cloud_run_service.go.erb
@@ -7,27 +7,6 @@ func revisionNameCustomizeDiff(_ context.Context, diff *schema.ResourceDiff, v i
 	return nil
 }
 
-var cloudRunGoogleProvidedAnnotations = regexp.MustCompile(`serving\.knative\.dev/(?:(?:creator)|(?:lastModifier))$|run\.googleapis\.com/(?:(?:ingress-status)|(?:operation-id))$|cloud\.googleapis\.com/(?:(?:location))`)
-
-func cloudrunAnnotationDiffSuppress(k, old, new string, d *schema.ResourceData) bool {
-	// Suppress diffs for the annotations provided by Google
-	if cloudRunGoogleProvidedAnnotations.MatchString(k) && new == "" {
-		return true
-	}
-
-  	if strings.HasSuffix(k, "run.googleapis.com/ingress") {
-	      	return old == "all" && new == ""
-	}
-
-	// Let diff be determined by annotations (above)
-	if strings.Contains(k, "annotations.%") {
-		return true
-	}
-
-	// For other keys, don't suppress diff.
-	return false
-}
-
 var cloudRunGoogleProvidedTemplateAnnotations = regexp.MustCompile(`template\.0\.metadata\.0\.annotations\.run\.googleapis\.com/sandbox`)
 var cloudRunGoogleProvidedTemplateAnnotations_autoscaling_maxscale = regexp.MustCompile(`template\.0\.metadata\.0\.annotations\.autoscaling\.knative\.dev/maxScale`)
 
@@ -46,23 +25,6 @@ func cloudrunTemplateAnnotationDiffSuppress(k, old, new string, d *schema.Resour
 	return false
 }
 
-var cloudRunGoogleProvidedLabels = regexp.MustCompile(`cloud\.googleapis\.com/(?:(?:location))`)
-
-func cloudrunLabelDiffSuppress(k, old, new string, d *schema.ResourceData) bool {
-	// Suppress diffs for the labels provided by Google
-	if cloudRunGoogleProvidedLabels.MatchString(k) && new == "" {
-		return true
-	}
-
-	// Let diff be determined by labels (above)
-	if strings.Contains(k, "labels.%") {
-		return true
-	}
-
-	// For other keys, don't suppress diff.
-	return false
-}
-
 var cloudRunGoogleProvidedTemplateLabels = []string{
 	"run.googleapis.com/startupProbeType",
 }
diff --git a/mmv1/templates/terraform/constants/cloudiot.go.erb b/mmv1/templates/terraform/constants/cloudiot.go.erb
deleted file mode 100644
index 03905061d6ef..000000000000
--- a/mmv1/templates/terraform/constants/cloudiot.go.erb
+++ /dev/null
@@ -1,241 +0,0 @@
-func expandCloudIotDeviceRegistryHTTPConfig(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
-    original := v.(map[string]interface{})
-    transformed := make(map[string]interface{})
-
-    transformedHTTPEnabledState, err := expandCloudIotDeviceRegistryHTTPEnabledState(original["http_enabled_state"], d, config)
-    if err != nil {
-        return nil, err
-    } else if val := reflect.ValueOf(transformedHTTPEnabledState); val.IsValid() && !tpgresource.IsEmptyValue(val) {
-        transformed["httpEnabledState"] = transformedHTTPEnabledState
-    }
-
-    return transformed, nil
-}
-
-func expandCloudIotDeviceRegistryHTTPEnabledState(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
-    return v, nil
-}
-
-func expandCloudIotDeviceRegistryMqttConfig(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
-    original := v.(map[string]interface{})
-    transformed := make(map[string]interface{})
-
-    transformedMqttEnabledState, err := expandCloudIotDeviceRegistryMqttEnabledState(original["mqtt_enabled_state"], d, config)
-    if err != nil {
-        return nil, err
-    } else if val := reflect.ValueOf(transformedMqttEnabledState); val.IsValid() && !tpgresource.IsEmptyValue(val) {
-        transformed["mqttEnabledState"] = transformedMqttEnabledState
-    }
-
-    return transformed, nil
-}
-
-func expandCloudIotDeviceRegistryMqttEnabledState(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
-    return v, nil
-}
-
-func expandCloudIotDeviceRegistryStateNotificationConfig(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
-    original := v.(map[string]interface{})
-    transformed := make(map[string]interface{})
-
-    transformedPubsubTopicName, err := expandCloudIotDeviceRegistryStateNotificationConfigPubsubTopicName(original["pubsub_topic_name"], d, config)
-    if err != nil {
-        return nil, err
-    } else if val := reflect.ValueOf(transformedPubsubTopicName); val.IsValid() && !tpgresource.IsEmptyValue(val) {
-        transformed["pubsubTopicName"] = transformedPubsubTopicName
-    }
-
-    return transformed, nil
-}
-
-func expandCloudIotDeviceRegistryStateNotificationConfigPubsubTopicName(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
-    return v, nil
-}
-
-func expandCloudIotDeviceRegistryCredentials(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
-	l := v.([]interface{})
-	req := make([]interface{}, 0, len(l))
-
-	for _, raw := range l {
-		if raw == nil {
-			continue
-		}
-		original := raw.(map[string]interface{})
-		transformed := make(map[string]interface{})
-
-		transformedPublicKeyCertificate, err := expandCloudIotDeviceRegistryCredentialsPublicKeyCertificate(original["public_key_certificate"], d, config)
-		if err != nil {
-			return nil, err
-		} else if val := reflect.ValueOf(transformedPublicKeyCertificate); val.IsValid() && !tpgresource.IsEmptyValue(val) {
-			transformed["publicKeyCertificate"] = transformedPublicKeyCertificate
-		}
-
-		req = append(req, transformed)
-	}
-
-	return req, nil
-}
-
-func expandCloudIotDeviceRegistryCredentialsPublicKeyCertificate(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
-    original := v.(map[string]interface{})
-    transformed := make(map[string]interface{})
-
-    transformedFormat, err := expandCloudIotDeviceRegistryPublicKeyCertificateFormat(original["format"], d, config)
-    if err != nil {
-        return nil, err
-    } else if val := reflect.ValueOf(transformedFormat); val.IsValid() && !tpgresource.IsEmptyValue(val) {
-        transformed["format"] = transformedFormat
-    }
-
-    transformedCertificate, err := expandCloudIotDeviceRegistryPublicKeyCertificateCertificate(original["certificate"], d, config)
-    if err != nil {
-        return nil, err
-    } else if val := reflect.ValueOf(transformedCertificate); val.IsValid() && !tpgresource.IsEmptyValue(val) {
-        transformed["certificate"] = transformedCertificate
-    }
-
-    return transformed, nil
-}
-
-func expandCloudIotDeviceRegistryPublicKeyCertificateFormat(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
-    return v, nil
-}
-
-func expandCloudIotDeviceRegistryPublicKeyCertificateCertificate(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
-    return v, nil
-}
-
-func flattenCloudIotDeviceRegistryCredentials(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-	log.Printf("[DEBUG] Flattening device resitry credentials: %q", d.Id())
-	if v == nil {
-		log.Printf("[DEBUG] The credentials array is nil: %q", d.Id())
-		return v
-	}
-	l := v.([]interface{})
-	transformed := make([]interface{}, 0, len(l))
-	for _, raw := range l {
-        original := raw.(map[string]interface{})
-        log.Printf("[DEBUG] Original credential: %+v", original)
-		if len(original) < 1 {
-			log.Printf("[DEBUG] Excluding empty credential that the API returned. %q", d.Id())
-			continue
-		}
-		log.Printf("[DEBUG] Credentials array before appending a new credential: %+v", transformed)
-		transformed = append(transformed, map[string]interface{}{
-			"public_key_certificate": flattenCloudIotDeviceRegistryCredentialsPublicKeyCertificate(original["publicKeyCertificate"], d, config),
-		})
-		log.Printf("[DEBUG] Credentials array after appending a new credential: %+v", transformed)
-	}
-	return transformed
-}
-
-func flattenCloudIotDeviceRegistryCredentialsPublicKeyCertificate(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-	log.Printf("[DEBUG] Flattening device resitry credentials public key certificate: %q", d.Id())
-	if v == nil {
-		log.Printf("[DEBUG] The public key certificate is nil: %q", d.Id())
-		return v
-	}
-
-	original := v.(map[string]interface{})
-	log.Printf("[DEBUG] Original public key certificate: %+v", original)
-	transformed := make(map[string]interface{})
-
-	transformedPublicKeyCertificateFormat := flattenCloudIotDeviceRegistryPublicKeyCertificateFormat(original["format"], d, config)
-	transformed["format"] = transformedPublicKeyCertificateFormat
-
-	transformedPublicKeyCertificateCertificate := flattenCloudIotDeviceRegistryPublicKeyCertificateCertificate(original["certificate"], d, config)
-	transformed["certificate"] = transformedPublicKeyCertificateCertificate
-
-	log.Printf("[DEBUG] Transformed public key certificate: %+v", transformed)
-
-	return transformed
-}
-
-func flattenCloudIotDeviceRegistryPublicKeyCertificateFormat(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-    return v
-}
-
-func flattenCloudIotDeviceRegistryPublicKeyCertificateCertificate(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-    return v
-}
-
-func flattenCloudIotDeviceRegistryHTTPConfig(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-    if v == nil {
-        return v
-    }
-
-    original := v.(map[string]interface{})
-    transformed := make(map[string]interface{})
-
-    transformedHTTPEnabledState := flattenCloudIotDeviceRegistryHTTPConfigHTTPEnabledState(original["httpEnabledState"], d, config)
-    transformed["http_enabled_state"] = transformedHTTPEnabledState
-
-    return transformed
-}
-
-func flattenCloudIotDeviceRegistryHTTPConfigHTTPEnabledState(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-    return v
-}
-
-func flattenCloudIotDeviceRegistryMqttConfig(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-    if v == nil {
-        return v
-    }
-
-    original := v.(map[string]interface{})
-    transformed := make(map[string]interface{})
-
-    transformedMqttEnabledState := flattenCloudIotDeviceRegistryMqttConfigMqttEnabledState(original["mqttEnabledState"], d, config)
-    transformed["mqtt_enabled_state"] = transformedMqttEnabledState
-
-    return transformed
-}
-
-func flattenCloudIotDeviceRegistryMqttConfigMqttEnabledState(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-    return v
-}
-
-func flattenCloudIotDeviceRegistryStateNotificationConfig(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-    log.Printf("[DEBUG] Flattening state notification config: %+v", v)
-    if v == nil {
-        return v
-    }
-
-    original := v.(map[string]interface{})
-    transformed := make(map[string]interface{})
-
-    transformedPubsubTopicName := flattenCloudIotDeviceRegistryStateNotificationConfigPubsubTopicName(original["pubsubTopicName"], d, config)
-    if val := reflect.ValueOf(transformedPubsubTopicName); val.IsValid() && !tpgresource.IsEmptyValue(val) {
-        log.Printf("[DEBUG] pubsub topic name is not null: %v", d.Get("pubsub_topic_name"))
-        transformed["pubsub_topic_name"] = transformedPubsubTopicName
-    }
-
-
-    return transformed
-}
-
-func flattenCloudIotDeviceRegistryStateNotificationConfigPubsubTopicName(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-    return v
-}
-
-func ValidateCloudIotDeviceRegistryID(v interface{}, k string) (warnings []string, errors []error) {
-    value := v.(string)
-    if strings.HasPrefix(value, "goog") {
-        errors = append(errors, fmt.Errorf(
-            "%q (%q) can not start with \"goog\"", k, value))
-    }
-    if !regexp.MustCompile(verify.CloudIoTIdRegex).MatchString(value) {
-        errors = append(errors, fmt.Errorf(
-            "%q (%q) doesn't match regexp %q", k, value, verify.CloudIoTIdRegex))
-    }
-    return
-}
-
-func validateCloudIotDeviceRegistrySubfolderMatch(v interface{}, k string) (warnings []string, errors []error) {
-    value := v.(string)
-    if strings.HasPrefix(value, "/") {
-        errors = append(errors, fmt.Errorf(
-            "%q (%q) can not start with '/'", k, value))
-    }
-    return
-}
diff --git a/mmv1/templates/terraform/constants/compute_forwarding_rule.go.erb b/mmv1/templates/terraform/constants/compute_forwarding_rule.go.erb
new file mode 100644
index 000000000000..92afd4d61d0a
--- /dev/null
+++ b/mmv1/templates/terraform/constants/compute_forwarding_rule.go.erb
@@ -0,0 +1,16 @@
+func forwardingRuleCustomizeDiff(_ context.Context, diff *schema.ResourceDiff, v interface{}) error {
+	log.Println("[DEBUG] [PSC] Reached forwardingRuleCustomizeDiff function")
+
+	// if target is not a string it's not set so no PSC connection
+	if target, ok := diff.Get("target").(string); ok {
+		if strings.Contains(target, "/serviceAttachments/") {
+			recreateClosedPsc, _ := diff.Get("recreate_closed_psc").(bool)
+			if pscConnectionStatus, ok := diff.Get("psc_connection_status").(string); ok && recreateClosedPsc && pscConnectionStatus == "CLOSED" {
+				// https://discuss.hashicorp.com/t/force-new-resource-based-on-api-read-difference/29759/6
+				diff.SetNewComputed("psc_connection_status")
+				diff.ForceNew("psc_connection_status")
+			}
+		}
+	}
+	return nil
+}
diff --git a/mmv1/templates/terraform/constants/integration_connectors_connection.go.erb b/mmv1/templates/terraform/constants/integration_connectors_connection.go.erb
new file mode 100644
index 000000000000..15c1772b27e7
--- /dev/null
+++ b/mmv1/templates/terraform/constants/integration_connectors_connection.go.erb
@@ -0,0 +1,20 @@
+<% unless compiler == "terraformgoogleconversion-codegen" -%>
+// waitforConnectionReady waits for an connecion to leave the
+// "CREATING" state, to indicate that it's ready.
+func waitforConnectionReady(d *schema.ResourceData, config *transport_tpg.Config, timeout time.Duration) error {
+	return resource.Retry(timeout, func() *resource.RetryError {
+	if err := resourceIntegrationConnectorsConnectionRead(d, config); err != nil {
+		return resource.NonRetryableError(err)
+	}
+	name := d.Get("name").(string)
+	status := d.Get("status").([]interface{})
+	state := status[0].(map[string]interface{})["state"]
+	log.Printf("[DEBUG] Connection %q has state %v.", name, state)
+	if state == "CREATING" || state == "UPDATING" {
+		return resource.RetryableError(fmt.Errorf("Connection %q has state %q.", name, state))
+	}
+	log.Printf("[DEBUG] Connection %q has state %q.", name, state)
+	return nil
+	})
+}
+<% end -%>
diff --git a/mmv1/templates/terraform/constants/notebooks_instance.go b/mmv1/templates/terraform/constants/notebooks_instance.go
deleted file mode 100644
index 11fc19272311..000000000000
--- a/mmv1/templates/terraform/constants/notebooks_instance.go
+++ /dev/null
@@ -1,16 +0,0 @@
-const notebooksInstanceGoogleProvidedLabel = "goog-caip-notebook"
-
-func NotebooksInstanceLabelDiffSuppress(k, old, new string, d *schema.ResourceData) bool {
-	// Suppress diffs for the label provided by Google
-	if strings.Contains(k, notebooksInstanceGoogleProvidedLabel) && new == "" {
-		return true
-	}
-
-	// Let diff be determined by labels (above)
-	if strings.Contains(k, "labels.%") {
-		return true
-	}
-
-	// For other keys, don't suppress diff.
-	return false
-}
diff --git a/mmv1/templates/terraform/constants/router_nat.go.erb b/mmv1/templates/terraform/constants/router_nat.go.erb
index c0a8986d29d7..4c7997d556e9 100644
--- a/mmv1/templates/terraform/constants/router_nat.go.erb
+++ b/mmv1/templates/terraform/constants/router_nat.go.erb
@@ -98,6 +98,12 @@ func computeRouterNatIPsHash(v interface{}) int {
 	return schema.HashString(tpgresource.GetResourceNameFromSelfLink(val))
 }
 
+<% unless version == 'ga' -%>
+func computeRouterNatRulesSubnetHash(v interface{}) int {
+	return computeRouterNatIPsHash(v)
+}
+<% end -%>
+
 func computeRouterNatRulesHash(v interface{}) int {
 	obj := v.(map[string]interface{})
 	ruleNumber := obj["rule_number"].(int)
@@ -112,6 +118,12 @@ func computeRouterNatRulesHash(v interface{}) int {
 
 	sourceNatActiveIpHash := 0
 	sourceNatDrainIpHash := 0
+	<% unless version == 'ga' -%>
+	sourceNatActiveRangeHash := 0
+	sourceNatDrainRangeHash := 0
+	<% end -%>
+	routerNatRulesHash := 0
+
 	if obj["action"] != nil {
 		actions := obj["action"].([]interface{})
 		if len(actions) != 0 && actions[0] != nil {
@@ -134,8 +146,32 @@ func computeRouterNatRulesHash(v interface{}) int {
 					sourceNatDrainIpHash += schema.HashString(sourceNatDrainIpStr)
 				}
 			}
+
+			<% unless version == 'ga' -%>
+			sourceNatActiveRanges := action["source_nat_active_ranges"]
+			if sourceNatActiveRanges != nil {
+				sourceNatActiveRangesSet := sourceNatActiveRanges.(*schema.Set)
+				for _, sourceNatActiveRange := range sourceNatActiveRangesSet.List() {
+					sourceNatActiveRangeStr := fmt.Sprintf("source_nat_active_ranges-%d", computeRouterNatRulesSubnetHash(sourceNatActiveRange.(string)))
+					sourceNatActiveRangeHash += schema.HashString(sourceNatActiveRangeStr)
+				}
+			}
+
+			sourceNatDrainRanges := action["source_nat_drain_ranges"]
+			if sourceNatDrainRanges != nil {
+				sourceNatDrainRangesSet := sourceNatDrainRanges.(*schema.Set)
+				for _, sourceNatDrainRange := range sourceNatDrainRangesSet.List() {
+					sourceNatDrainRangeStr := fmt.Sprintf("source_nat_drain_ranges-%d", computeRouterNatRulesSubnetHash(sourceNatDrainRange.(string)))
+					sourceNatDrainRangeHash += schema.HashString(sourceNatDrainRangeStr)
+				}
+			}
+			<% end -%>
 		}
 	}
 
-	return ruleNumber + descriptionHash + schema.HashString(match) + sourceNatActiveIpHash + sourceNatDrainIpHash
+	routerNatRulesHash = ruleNumber + descriptionHash + schema.HashString(match) + sourceNatActiveIpHash + sourceNatDrainIpHash
+	<% unless version == 'ga' -%>
+	routerNatRulesHash += sourceNatActiveRangeHash + sourceNatDrainRangeHash
+	<% end -%>
+	return routerNatRulesHash
 }
\ No newline at end of file
diff --git a/mmv1/templates/terraform/constants/router_nat_validate_action_active_range.go.erb b/mmv1/templates/terraform/constants/router_nat_validate_action_active_range.go.erb
new file mode 100644
index 000000000000..635e90f85472
--- /dev/null
+++ b/mmv1/templates/terraform/constants/router_nat_validate_action_active_range.go.erb
@@ -0,0 +1,29 @@
+<% unless version == 'ga' -%>
+// validates if the field action.source_nat_active_ranges is filled when the type is PRIVATE.
+natType := d.Get("type").(string)
+if natType == "PRIVATE" {
+	rules := d.Get("rules").(*schema.Set)
+	for _, rule := range rules.List() {
+		objRule := rule.(map[string]interface{})
+		actions := objRule["action"].([]interface{})
+
+		containAction := len(actions) != 0 && actions[0] != nil
+		containActiveRange := true
+
+		if containAction {
+			action := actions[0].(map[string]interface{})
+			sourceNatActiveRanges := action["source_nat_active_ranges"]
+			if sourceNatActiveRanges != nil {
+				sourceNatActiveRangesSet := sourceNatActiveRanges.(*schema.Set)
+				if len(sourceNatActiveRangesSet.List()) == 0 {
+					containActiveRange = false
+				}
+			}
+		}
+
+		if !containAction || !containActiveRange {
+			return fmt.Errorf("The rule for PRIVATE nat type must contain an action with source_nat_active_ranges set")
+		}
+	}
+}
+<% end -%>
\ No newline at end of file
diff --git a/mmv1/templates/terraform/constants/secret_manager_secret.go b/mmv1/templates/terraform/constants/secret_manager_secret.go
new file mode 100644
index 000000000000..13db855f5e7e
--- /dev/null
+++ b/mmv1/templates/terraform/constants/secret_manager_secret.go
@@ -0,0 +1,25 @@
+// Prevent ForceNew when upgrading replication.automatic -> replication.auto
+func secretManagerSecretAutoCustomizeDiff(_ context.Context, diff *schema.ResourceDiff, meta interface{}) error {
+	oAutomatic, nAutomatic := diff.GetChange("replication.0.automatic")
+	_, nAuto := diff.GetChange("replication.0.auto")
+	autoLen := len(nAuto.([]interface{}))
+
+	// Do not ForceNew if we are removing "automatic" while adding "auto"
+	if oAutomatic == true && nAutomatic == false && autoLen > 0 {
+		return nil
+	}
+
+	if diff.HasChange("replication.0.automatic") {
+		if err := diff.ForceNew("replication.0.automatic"); err != nil {
+			return err
+		}
+	}
+
+	if diff.HasChange("replication.0.auto") {
+		if err := diff.ForceNew("replication.0.auto"); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/mmv1/templates/terraform/constants/tpu_vm.go.erb b/mmv1/templates/terraform/constants/tpu_vm.go.erb
new file mode 100644
index 000000000000..d985d189243a
--- /dev/null
+++ b/mmv1/templates/terraform/constants/tpu_vm.go.erb
@@ -0,0 +1,46 @@
+
+// Suppress unremovable default scope values from GCP.
+func tpuServiceAccountAddedScopesSuppress(k, old, new string, d *schema.ResourceData) bool {
+	if strings.Contains(k, "scope.#") && (new == "0" || new == "") && old != new {
+		return false
+	}
+
+	// Get changes for service_account.xx.scope
+	b := strings.Split(k, ".")
+	o, n := d.GetChange(strings.TrimSuffix(k, "."+b[len(b)-1]))
+	if o == nil || n == nil {
+		return false
+	}
+
+	oList := normalizeScopes(tpgresource.ConvertStringArr(o.([]interface{})))
+	nList := normalizeScopes(tpgresource.ConvertStringArr(n.([]interface{})))
+
+	return reflect.DeepEqual(oList, nList)
+}
+
+// Normalize the scopes by filtering out the `https://www.googleapis.com/auth/pubsub` scope during
+// comparison
+func normalizeScopes(scopes []string) []string {
+	var result []string
+	for _, s := range scopes {
+		if s != "https://www.googleapis.com/auth/pubsub" {
+			result = append(result, s)
+		}
+	}
+	return result
+}
+
+// For backwards compatibility, we need to maintain original behavior where `accelerator_type`
+// defaults "v2-8" when nothing is set. However, if the newly introduced `accelerator_config` field
+// is set, then use that value instead of the `accelerator_type` default.
+func acceleratorTypeCustomizeDiff(_ context.Context, diff *schema.ResourceDiff, v interface{}) error {
+	_, isTypeSet := diff.GetOk("accelerator_type")
+	_, isConfigSet := diff.GetOk("accelerator_config")
+	if !isTypeSet && !isConfigSet {
+		if err := diff.SetNew("accelerator_type", "v2-8"); err != nil {
+			return err
+		}
+	}
+
+	return nil	
+}
diff --git a/mmv1/templates/terraform/custom_check_destroy/firebasehosting_custom_domain_soft_delete.go.erb b/mmv1/templates/terraform/custom_check_destroy/firebasehosting_custom_domain_soft_delete.go.erb
new file mode 100644
index 000000000000..146c3b1335c1
--- /dev/null
+++ b/mmv1/templates/terraform/custom_check_destroy/firebasehosting_custom_domain_soft_delete.go.erb
@@ -0,0 +1,23 @@
+config := acctest.GoogleProviderConfig(t)
+
+url, err := tpgresource.ReplaceVarsForTest(config, rs, "{{FirebaseHostingBasePath}}projects/{{project}}/sites/{{site_id}}/customDomains/{{custom_domain}}")
+if err != nil {
+    return err
+}
+
+billingProject := ""
+
+if config.BillingProject != "" {
+    billingProject = config.BillingProject
+}
+
+resp, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+    Config:    config,
+    Method:    "GET",
+    Project:   billingProject,
+    RawURL:    url,
+    UserAgent: config.UserAgent,
+})
+if err == nil && resp["deleteTime"].(string) == "" {
+    return fmt.Errorf("FirebaseHostingCustomDomain still exists at %s", url)
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/custom_create/gameservice_rollout_create.go b/mmv1/templates/terraform/custom_create/gameservice_rollout_create.go
deleted file mode 100644
index 85da871cd049..000000000000
--- a/mmv1/templates/terraform/custom_create/gameservice_rollout_create.go
+++ /dev/null
@@ -1,16 +0,0 @@
-// Store the ID now
-id, err := tpgresource.ReplaceVars(d, config, "projects/{{project}}/locations/global/gameServerDeployments/{{deployment_id}}/rollout")
-if err != nil {
-	return fmt.Errorf("Error constructing id: %s", err)
-}
-d.SetId(id)
-
-log.Printf("[DEBUG] Creating GameServerDeploymentRollout %q: ", d.Id())
-
-err = resourceGameServicesGameServerDeploymentRolloutUpdate(d, meta)
-if err != nil {
-	d.SetId("")
-	return fmt.Errorf("Error trying to create GameServerDeploymentRollout: %s", err)
-}
-
-return nil
diff --git a/mmv1/templates/terraform/custom_delete/clear_instance_settings.go.erb b/mmv1/templates/terraform/custom_delete/clear_instance_settings.go.erb
new file mode 100644
index 000000000000..9c37ae53ac04
--- /dev/null
+++ b/mmv1/templates/terraform/custom_delete/clear_instance_settings.go.erb
@@ -0,0 +1,49 @@
+url, err := tpgresource.ReplaceVars(d, config, "{{ComputeBasePath}}projects/{{project}}/zones/{{zone}}/instanceSettings")
+if err != nil {
+        return err
+}
+
+project, err := tpgresource.GetProject(d, config)
+if err != nil {
+        return fmt.Errorf("Error fetching project for InstanceSettings: %s", err)
+}
+
+res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+	Config:    config,
+	Method:    "GET",
+	Project:   project,
+	RawURL:    url,
+	UserAgent: userAgent,
+})
+
+if err != nil {
+		return err
+}
+
+obj := map[string]interface {}{"fingerprint":res["fingerprint"], "metadata":map[string]interface {}{"items":map[string]string{}}}
+log.Printf("[DEBUG] Emptying InstanceSettings %#v", obj)
+
+url, err = transport_tpg.AddQueryParams(url, map[string]string{"updateMask": "*"})
+if err != nil {
+	return err
+}
+
+res, err = transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+	Config: config,
+	Method: "PATCH",
+    Project: project,
+	RawURL: url,
+	UserAgent: userAgent,
+	Body: obj,
+	Timeout: d.Timeout(schema.TimeoutUpdate),
+})
+
+if err != nil {
+	return fmt.Errorf("Error emptying InstanceSettings %s", err)
+} else {
+	log.Printf("[DEBUG] Finished emptying InstanceSettings %#v", res)
+}
+
+time.Sleep(1 * time.Minute)
+
+return nil
diff --git a/mmv1/templates/terraform/custom_expand/certificate_manager_certificate_construct_full_url.go.erb b/mmv1/templates/terraform/custom_expand/certificate_manager_certificate_construct_full_url.go.erb
new file mode 100644
index 000000000000..fa9b8685ff7e
--- /dev/null
+++ b/mmv1/templates/terraform/custom_expand/certificate_manager_certificate_construct_full_url.go.erb
@@ -0,0 +1,38 @@
+<%# The license inside this block applies to this file.
+	# Copyright 2017 Google Inc.
+	# Licensed under the Apache License, Version 2.0 (the "License");
+	# you may not use this file except in compliance with the License.
+	# You may obtain a copy of the License at
+	#
+	#     http://www.apache.org/licenses/LICENSE-2.0
+	#
+	# Unless required by applicable law or agreed to in writing, software
+	# distributed under the License is distributed on an "AS IS" BASIS,
+	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	# See the License for the specific language governing permissions and
+	# limitations under the License.
+-%>
+func expand<%= prefix -%><%= titlelize_property(property) -%>(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+  if v == nil {
+    return nil, nil
+  }
+  l := v.([]interface{})
+  req := make([]interface{}, 0, len(l))
+  for _, raw := range l {
+    if raw == nil {
+      return nil, fmt.Errorf("Invalid value for <%= property.name.underscore -%>: nil")
+    }
+    if strings.HasPrefix(raw.(string), "//") || strings.HasPrefix(raw.(string), "https://") {
+      // Any full URL will be passed to the API request (regardless of the resource type). This is to allow self_links of CertificateManagerCeritificate resources. 
+      // If the full URL is an invalid reference, that should be handled by the API. 
+      req = append(req, raw.(string))
+    } else if  reg,_ := regexp.Compile("projects/(.*)/locations/(.*)/certificates/(.*)") ; reg.MatchString(raw.(string)) {
+      // If the input is the id pattern of CertificateManagerCertificate resource, a prefix will be added to construct the full URL before constructing the API request.
+      self_link := "https://certificatemanager.googleapis.com/v1/" + raw.(string)
+      req = append(req, self_link)
+    } else {
+      return nil, fmt.Errorf("Invalid value for <%= property.name.underscore -%>: %v is an invalid format for a certificateManagerCertificate resource", raw.(string))
+    }
+  }
+  return req, nil
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/custom_expand/compute_instance_settings_fingerprint.erb b/mmv1/templates/terraform/custom_expand/compute_instance_settings_fingerprint.erb
new file mode 100644
index 000000000000..cff49efd90a2
--- /dev/null
+++ b/mmv1/templates/terraform/custom_expand/compute_instance_settings_fingerprint.erb
@@ -0,0 +1,30 @@
+func expand<%= prefix -%><%= titlelize_property(property) -%>(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+        project, err := tpgresource.GetProject(d, config)
+        if err != nil {
+                return nil, err
+        }
+
+		userAgent, err :=  tpgresource.GenerateUserAgentString(d, config.UserAgent)
+		if err != nil {
+			return nil, err
+		}
+
+        url, err := tpgresource.ReplaceVars(d, config, "{{ComputeBasePath}}projects/{{project}}/zones/{{zone}}/instanceSettings/{{name}}")
+        if err != nil {
+                return nil, err
+        }
+
+        res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+                Config:    config,
+                Method:    "GET",
+                Project:   project,
+                RawURL:    url,
+                UserAgent: userAgent,
+        })
+
+        if err != nil {
+		return nil, err
+	    }
+
+        return res["fingerprint"], nil
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/custom_expand/containerattached_cluster_authorization_user.go.erb b/mmv1/templates/terraform/custom_expand/containerattached_cluster_authorization_user.go.erb
index 83a5c1252680..6b837990ea41 100644
--- a/mmv1/templates/terraform/custom_expand/containerattached_cluster_authorization_user.go.erb
+++ b/mmv1/templates/terraform/custom_expand/containerattached_cluster_authorization_user.go.erb
@@ -17,12 +17,20 @@ type attachedClusterUser struct {
     Username string     `json:"username"`
 }
 
+type attachedClusterGroup struct {
+		Group string				`json:"group"`
+}
+
 // The custom expander transforms input into something like this:
 // authorization {
 //    admin_users [
 //      { username = "user1" },
 //      { username = "user2" }
 //    ]
+//    admin_groups [
+//      { group = "group1" },
+//      { group = "group2" },
+//    ]
 // }
 // The custom flattener transforms input back into something like this:
 // authorization {
@@ -30,13 +38,17 @@ type attachedClusterUser struct {
 //      "user1",
 //      "user2"
 //    ]
+//    admin_groups = [
+//      "group1",
+//      "group2"
+//    ],
 // }
 func expand<%= prefix -%><%= titlelize_property(property) -%>(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
-  	l := v.([]interface{})
+	l := v.([]interface{})
 	if len(l) == 0 || l[0] == nil {
 		return nil, nil
 	}
-  	raw := l[0]
+	raw := l[0]
 	orig := raw.(map[string]interface{})["admin_users"].([]interface{})
 	transformed := make(map[string][]interface{})
 	transformed["admin_users"] = make([]interface{}, len(orig))
@@ -45,5 +57,12 @@ func expand<%= prefix -%><%= titlelize_property(property) -%>(v interface{}, d t
 			transformed["admin_users"][i] = attachedClusterUser{ Username: u.(string) }
 		}
 	}
+	orig = raw.(map[string]interface{})["admin_groups"].([]interface{})
+	transformed["admin_groups"] = make([]interface{}, len(orig))
+	for i, u := range orig {
+		if u != nil {
+			transformed["admin_groups"][i] = attachedClusterGroup{ Group: u.(string) }
+		}
+	}
 	return transformed, nil
 }
diff --git a/mmv1/templates/terraform/custom_expand/secret_version_secret_data.go.erb b/mmv1/templates/terraform/custom_expand/secret_version_secret_data.go.erb
new file mode 100644
index 000000000000..1ac3a0450046
--- /dev/null
+++ b/mmv1/templates/terraform/custom_expand/secret_version_secret_data.go.erb
@@ -0,0 +1,24 @@
+<%- # the license inside this block applies to this file
+	# Copyright 2023 Google Inc.
+	# Licensed under the Apache License, Version 2.0 (the "License");
+	# you may not use this file except in compliance with the License.
+	# You may obtain a copy of the License at
+	#
+	#     http://www.apache.org/licenses/LICENSE-2.0
+	#
+	# Unless required by applicable law or agreed to in writing, software
+	# distributed under the License is distributed on an "AS IS" BASIS,
+	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	# See the License for the specific language governing permissions and
+	# limitations under the License.
+-%>
+func expand<%= prefix -%><%= titlelize_property(property) -%>(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	if v == nil {
+		return nil, nil
+	}
+
+	if d.Get("is_secret_data_base64").(bool) {
+		return v, nil
+	}
+	return base64.StdEncoding.EncodeToString([]byte(v.(string))), nil
+}
diff --git a/mmv1/templates/terraform/custom_flatten/containerattached_cluster_authorization_user.go.erb b/mmv1/templates/terraform/custom_flatten/containerattached_cluster_authorization_user.go.erb
index 3b01755ecd18..9c796dcc2fd7 100644
--- a/mmv1/templates/terraform/custom_flatten/containerattached_cluster_authorization_user.go.erb
+++ b/mmv1/templates/terraform/custom_flatten/containerattached_cluster_authorization_user.go.erb
@@ -19,6 +19,10 @@
 //      { username = "user1" },
 //      { username = "user2" }
 //    ]
+//    admin_groups [
+//      { group = "group1" },
+//      { group = "group2" },
+//    ]
 // }
 // The custom flattener transforms input back into something like this:
 // authorization {
@@ -26,6 +30,10 @@
 //      "user1",
 //      "user2"
 //    ]
+//    admin_groups = [
+//      "group1",
+//      "group2"
+//    ],
 // }
 func flatten<%= prefix -%><%= titlelize_property(property) -%>(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
     if v == nil {
@@ -40,6 +48,13 @@ func flatten<%= prefix -%><%= titlelize_property(property) -%>(v interface{}, d
 			transformed["admin_users"][i] = u.(map[string]interface{})["username"].(string)
 		}
 	}
+	orig = v.(map[string]interface{})["adminGroups"].([]interface{})
+	transformed["admin_groups"] = make([]string, len(orig))
+	for i, u := range orig {
+		if u != nil {
+			transformed["admin_groups"][i] = u.(map[string]interface{})["group"].(string)
+		}
+	}
 
 	return []interface{}{transformed}
 }
diff --git a/mmv1/templates/terraform/custom_flatten/database_migration_service_connection_profile_oracle_forward_ssh_password.go.erb b/mmv1/templates/terraform/custom_flatten/database_migration_service_connection_profile_oracle_forward_ssh_password.go.erb
new file mode 100644
index 000000000000..774e9f17e76b
--- /dev/null
+++ b/mmv1/templates/terraform/custom_flatten/database_migration_service_connection_profile_oracle_forward_ssh_password.go.erb
@@ -0,0 +1,17 @@
+<%# The license inside this block applies to this file.
+    # Copyright 2023 Google Inc.
+    # Licensed under the Apache License, Version 2.0 (the "License");
+    # you may not use this file except in compliance with the License.
+    # You may obtain a copy of the License at
+    #
+    #     http://www.apache.org/licenses/LICENSE-2.0
+    #
+    # Unless required by applicable law or agreed to in writing, software
+    # distributed under the License is distributed on an "AS IS" BASIS,
+    # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    # See the License for the specific language governing permissions and
+    # limitations under the License.
+-%>
+func flatten<%= prefix -%><%= titlelize_property(property) -%>(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+    return d.Get("oracle.0.forward_ssh_connectivity.0.password")
+}
diff --git a/mmv1/templates/terraform/custom_flatten/database_migration_service_connection_profile_oracle_forward_ssh_private_key.go.erb b/mmv1/templates/terraform/custom_flatten/database_migration_service_connection_profile_oracle_forward_ssh_private_key.go.erb
new file mode 100644
index 000000000000..16cf92af8fac
--- /dev/null
+++ b/mmv1/templates/terraform/custom_flatten/database_migration_service_connection_profile_oracle_forward_ssh_private_key.go.erb
@@ -0,0 +1,17 @@
+<%# The license inside this block applies to this file.
+    # Copyright 2023 Google Inc.
+    # Licensed under the Apache License, Version 2.0 (the "License");
+    # you may not use this file except in compliance with the License.
+    # You may obtain a copy of the License at
+    #
+    #     http://www.apache.org/licenses/LICENSE-2.0
+    #
+    # Unless required by applicable law or agreed to in writing, software
+    # distributed under the License is distributed on an "AS IS" BASIS,
+    # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    # See the License for the specific language governing permissions and
+    # limitations under the License.
+-%>
+func flatten<%= prefix -%><%= titlelize_property(property) -%>(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+    return d.Get("oracle.0.forward_ssh_connectivity.0.private_key")
+}
diff --git a/mmv1/templates/terraform/custom_flatten/database_migration_service_connection_profile_oracle_password.go.erb b/mmv1/templates/terraform/custom_flatten/database_migration_service_connection_profile_oracle_password.go.erb
new file mode 100644
index 000000000000..4d9c6d1a0fcc
--- /dev/null
+++ b/mmv1/templates/terraform/custom_flatten/database_migration_service_connection_profile_oracle_password.go.erb
@@ -0,0 +1,17 @@
+<%# The license inside this block applies to this file.
+    # Copyright 2023 Google Inc.
+    # Licensed under the Apache License, Version 2.0 (the "License");
+    # you may not use this file except in compliance with the License.
+    # You may obtain a copy of the License at
+    #
+    #     http://www.apache.org/licenses/LICENSE-2.0
+    #
+    # Unless required by applicable law or agreed to in writing, software
+    # distributed under the License is distributed on an "AS IS" BASIS,
+    # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    # See the License for the specific language governing permissions and
+    # limitations under the License.
+-%>
+func flatten<%= prefix -%><%= titlelize_property(property) -%>(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+    return d.Get("oracle.0.password")
+}
diff --git a/mmv1/templates/terraform/custom_flatten/database_migration_service_connection_profile_oracle_ssl_ca_certificate.go.erb b/mmv1/templates/terraform/custom_flatten/database_migration_service_connection_profile_oracle_ssl_ca_certificate.go.erb
new file mode 100644
index 000000000000..0d31e81f2f6d
--- /dev/null
+++ b/mmv1/templates/terraform/custom_flatten/database_migration_service_connection_profile_oracle_ssl_ca_certificate.go.erb
@@ -0,0 +1,17 @@
+<%# The license inside this block applies to this file.
+	# Copyright 2023 Google Inc.
+	# Licensed under the Apache License, Version 2.0 (the "License");
+	# you may not use this file except in compliance with the License.
+	# You may obtain a copy of the License at
+	#
+	#     http://www.apache.org/licenses/LICENSE-2.0
+	#
+	# Unless required by applicable law or agreed to in writing, software
+	# distributed under the License is distributed on an "AS IS" BASIS,
+	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	# See the License for the specific language governing permissions and
+	# limitations under the License.
+-%>
+func flatten<%= prefix -%><%= titlelize_property(property) -%>(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	return d.Get("oracle.0.ssl.0.ca_certificate")
+}
diff --git a/mmv1/templates/terraform/custom_flatten/database_migration_service_connection_profile_oracle_ssl_client_certificate.go.erb b/mmv1/templates/terraform/custom_flatten/database_migration_service_connection_profile_oracle_ssl_client_certificate.go.erb
new file mode 100644
index 000000000000..fbe627f6f98e
--- /dev/null
+++ b/mmv1/templates/terraform/custom_flatten/database_migration_service_connection_profile_oracle_ssl_client_certificate.go.erb
@@ -0,0 +1,17 @@
+<%# The license inside this block applies to this file.
+	# Copyright 2023 Google Inc.
+	# Licensed under the Apache License, Version 2.0 (the "License");
+	# you may not use this file except in compliance with the License.
+	# You may obtain a copy of the License at
+	#
+	#     http://www.apache.org/licenses/LICENSE-2.0
+	#
+	# Unless required by applicable law or agreed to in writing, software
+	# distributed under the License is distributed on an "AS IS" BASIS,
+	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	# See the License for the specific language governing permissions and
+	# limitations under the License.
+-%>
+func flatten<%= prefix -%><%= titlelize_property(property) -%>(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	return d.Get("oracle.0.ssl.0.client_certificate")
+}
diff --git a/mmv1/templates/terraform/custom_flatten/database_migration_service_connection_profile_oracle_ssl_client_key.go.erb b/mmv1/templates/terraform/custom_flatten/database_migration_service_connection_profile_oracle_ssl_client_key.go.erb
new file mode 100644
index 000000000000..9fec3ce7e75b
--- /dev/null
+++ b/mmv1/templates/terraform/custom_flatten/database_migration_service_connection_profile_oracle_ssl_client_key.go.erb
@@ -0,0 +1,17 @@
+<%# The license inside this block applies to this file.
+	# Copyright 2023 Google Inc.
+	# Licensed under the Apache License, Version 2.0 (the "License");
+	# you may not use this file except in compliance with the License.
+	# You may obtain a copy of the License at
+	#
+	#     http://www.apache.org/licenses/LICENSE-2.0
+	#
+	# Unless required by applicable law or agreed to in writing, software
+	# distributed under the License is distributed on an "AS IS" BASIS,
+	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	# See the License for the specific language governing permissions and
+	# limitations under the License.
+-%>
+func flatten<%= prefix -%><%= titlelize_property(property) -%>(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	return d.Get("oracle.0.ssl.0.client_key")
+}
diff --git a/mmv1/templates/terraform/custom_flatten/dialogflowcx_agent_git_integration_settings_github_settings_access_token.go.erb b/mmv1/templates/terraform/custom_flatten/dialogflowcx_agent_git_integration_settings_github_settings_access_token.go.erb
new file mode 100644
index 000000000000..7102f1e6fb07
--- /dev/null
+++ b/mmv1/templates/terraform/custom_flatten/dialogflowcx_agent_git_integration_settings_github_settings_access_token.go.erb
@@ -0,0 +1,17 @@
+<%# The license inside this block applies to this file.
+	# Copyright 2018 Google Inc.
+	# Licensed under the Apache License, Version 2.0 (the "License");
+	# you may not use this file except in compliance with the License.
+	# You may obtain a copy of the License at
+	#
+	#     http://www.apache.org/licenses/LICENSE-2.0
+	#
+	# Unless required by applicable law or agreed to in writing, software
+	# distributed under the License is distributed on an "AS IS" BASIS,
+	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	# See the License for the specific language governing permissions and
+	# limitations under the License.
+-%>
+func flatten<%= prefix -%><%= titlelize_property(property) -%>(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	return d.Get("git_integration_settings.0.github_settings.0.access_token")
+}
diff --git a/mmv1/templates/terraform/custom_flatten/identity_platform_config_anonymous.go b/mmv1/templates/terraform/custom_flatten/identity_platform_config_anonymous.go
new file mode 100644
index 000000000000..5487fd8a8ba1
--- /dev/null
+++ b/mmv1/templates/terraform/custom_flatten/identity_platform_config_anonymous.go
@@ -0,0 +1,16 @@
+func flatten<%= prefix -%><%= titlelize_property(property) -%>(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	if v == nil {
+		return nil
+	}
+
+	original := v.(map[string]interface{})
+	transformed := make(map[string]interface{})
+
+	if original["enabled"] == nil {
+		transformed["enabled"] = false
+	} else {
+		transformed["enabled"] = original["enabled"]
+	}
+
+	return []interface{}{transformed}
+}
diff --git a/mmv1/templates/terraform/custom_flatten/nat_rules_subnets_set.erb b/mmv1/templates/terraform/custom_flatten/nat_rules_subnets_set.erb
new file mode 100644
index 000000000000..e792b115351d
--- /dev/null
+++ b/mmv1/templates/terraform/custom_flatten/nat_rules_subnets_set.erb
@@ -0,0 +1,6 @@
+func flatten<%= prefix -%><%= titlelize_property(property) -%>(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	if v == nil {
+		return v
+	}
+	return schema.NewSet(computeRouterNatRulesSubnetHash, tpgresource.ConvertStringArrToInterface(tpgresource.ConvertAndMapStringArr(v.([]interface{}), tpgresource.ConvertSelfLinkToV1)))
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/custom_flatten/secret_version_access.go.erb b/mmv1/templates/terraform/custom_flatten/secret_version_access.go.erb
index 7b4320b47dac..fbfc706d5242 100644
--- a/mmv1/templates/terraform/custom_flatten/secret_version_access.go.erb
+++ b/mmv1/templates/terraform/custom_flatten/secret_version_access.go.erb
@@ -45,10 +45,14 @@ func flatten<%= prefix -%><%= titlelize_property(property) -%>(v interface{}, d
 		return err
 	}
 
-	data, err := base64.StdEncoding.DecodeString(accessRes["payload"].(map[string]interface{})["data"].(string))
-	if err != nil {
-		return err
+	if d.Get("is_secret_data_base64").(bool) {
+		transformed["secret_data"] = accessRes["payload"].(map[string]interface{})["data"].(string)
+	} else {
+		data, err := base64.StdEncoding.DecodeString(accessRes["payload"].(map[string]interface{})["data"].(string))
+		if err != nil {
+			return err
+		}
+		transformed["secret_data"] = string(data)
 	}
-	transformed["secret_data"] = string(data)
 	return []interface{}{transformed}
 }
diff --git a/mmv1/templates/terraform/custom_flatten/vertex_ai_index_endpoint_private_service_connect_config.go.erb b/mmv1/templates/terraform/custom_flatten/vertex_ai_index_endpoint_private_service_connect_config.go.erb
new file mode 100644
index 000000000000..f934d1922ab0
--- /dev/null
+++ b/mmv1/templates/terraform/custom_flatten/vertex_ai_index_endpoint_private_service_connect_config.go.erb
@@ -0,0 +1,42 @@
+<%# The license inside this block applies to this file.
+	# Copyright 2023 Google Inc.
+	# Licensed under the Apache License, Version 2.0 (the "License");
+	# you may not use this file except in compliance with the License.
+	# You may obtain a copy of the License at
+	#
+	#     http://www.apache.org/licenses/LICENSE-2.0
+	#
+	# Unless required by applicable law or agreed to in writing, software
+	# distributed under the License is distributed on an "AS IS" BASIS,
+	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	# See the License for the specific language governing permissions and
+	# limitations under the License.
+-%>
+func flatten<%= prefix -%><%= titlelize_property(property) -%>(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+    transformed := make(map[string]interface{})
+
+    if v == nil {
+        // Disabled by default, but API will not return object if value is false
+        transformed["enable_private_service_connect"] = false
+        return []interface{}{transformed}
+    }
+
+    original := v.(map[string]interface{})
+    if len(original) == 0 {
+        return nil
+    }
+
+    transformed["enable_private_service_connect"] =
+        flattenVertexAIIndexEndpointPrivateServiceConnectConfigEnablePrivateServiceConnect(original["enablePrivateServiceConnect"], d, config)
+    transformed["project_allowlist"] =
+        flattenVertexAIIndexEndpointPrivateServiceConnectConfigProjectAllowlist(original["projectAllowlist"], d, config)
+    return []interface{}{transformed}
+}
+
+func flattenVertexAIIndexEndpointPrivateServiceConnectConfigEnablePrivateServiceConnect(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+       return v
+}
+
+func flattenVertexAIIndexEndpointPrivateServiceConnectConfigProjectAllowlist(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+       return v
+}
diff --git a/mmv1/templates/terraform/custom_import/alloydb_user.go.erb b/mmv1/templates/terraform/custom_import/alloydb_user.go.erb
new file mode 100644
index 000000000000..188d9e27a5da
--- /dev/null
+++ b/mmv1/templates/terraform/custom_import/alloydb_user.go.erb
@@ -0,0 +1,17 @@
+config := meta.(*transport_tpg.Config)
+
+// current import_formats can't import fields with forward slashes in their value
+if err := tpgresource.ParseImportId([]string{
+	"(?P<cluster>.+)/users/(?P<user_id>[^/]+)",
+}, d, config); err != nil {
+	return nil, err
+}
+
+// Replace import id for the resource id
+id, err := tpgresource.ReplaceVars(d, config, "{{cluster}}/users/{{user_id}}")
+if err != nil {
+	return nil, fmt.Errorf("Error constructing id: %s", err)
+}
+d.SetId(id)
+
+return []*schema.ResourceData{d}, nil
diff --git a/mmv1/templates/terraform/custom_import/bigquery_reservation_capacity_commitment_set_id.go.erb b/mmv1/templates/terraform/custom_import/bigquery_reservation_capacity_commitment_set_id.go.erb
new file mode 100644
index 000000000000..0f3665a4d3df
--- /dev/null
+++ b/mmv1/templates/terraform/custom_import/bigquery_reservation_capacity_commitment_set_id.go.erb
@@ -0,0 +1,22 @@
+config := meta.(*transport_tpg.Config)
+if err := tpgresource.ParseImportId([]string{
+  "^projects/(?P<project>[^/]+)/locations/(?P<location>[^/]+)/capacityCommitments/(?P<capacity_commitment_id>[^/]+)$",
+  "^(?P<project>[^/]+)/(?P<location>[^/]+)/(?P<capacity_commitment_id>[^/]+)$",
+  "^(?P<location>[^/]+)/(?P<capacity_commitment_id>[^/]+)$",
+}, d, config); err != nil {
+  return nil, err
+}
+
+// Set name based on the components
+if err := d.Set("name", "projects/{{project}}/locations/{{location}}/capacityCommitments/{{capacity_commitment_id}}"); err != nil {
+  return nil, fmt.Errorf("Error setting name: %s", err)
+}
+
+// Replace import id for the resource id
+id, err := tpgresource.ReplaceVars(d, config, d.Get("name").(string))
+if err != nil {
+  return nil, fmt.Errorf("Error constructing id: %s", err)
+}
+d.SetId(id)
+
+return []*schema.ResourceData{d}, nil
\ No newline at end of file
diff --git a/mmv1/templates/terraform/custom_import/dialogflowcx_flow.go.erb b/mmv1/templates/terraform/custom_import/dialogflowcx_flow.go.erb
index 9710bd1d2b69..6deca14d0d1c 100644
--- a/mmv1/templates/terraform/custom_import/dialogflowcx_flow.go.erb
+++ b/mmv1/templates/terraform/custom_import/dialogflowcx_flow.go.erb
@@ -15,4 +15,9 @@ if err != nil {
 }
 d.SetId(id)
 
+// Set is_default_start_flow if the resource is actually the Default Start Flow
+if d.Get("name").(string) == "00000000-0000-0000-0000-000000000000" {
+    d.Set("is_default_start_flow", true)
+}
+
 return []*schema.ResourceData{d}, nil
\ No newline at end of file
diff --git a/mmv1/templates/terraform/custom_import/dialogflowcx_intent.go.erb b/mmv1/templates/terraform/custom_import/dialogflowcx_intent.go.erb
index 9f7a00d23a7c..bf26d2f2de3d 100644
--- a/mmv1/templates/terraform/custom_import/dialogflowcx_intent.go.erb
+++ b/mmv1/templates/terraform/custom_import/dialogflowcx_intent.go.erb
@@ -15,4 +15,12 @@
 	}
 	d.SetId(id)
 
+	// Set is_default_X if the resource is actually a Default Intent
+	if d.Get("name").(string) == "00000000-0000-0000-0000-000000000000" {
+		d.Set("is_default_welcome_intent", true)
+	}
+	if d.Get("name").(string) == "00000000-0000-0000-0000-000000000001" {
+		d.Set("is_default_negative_intent", true)
+	}
+
 	return []*schema.ResourceData{d}, nil
\ No newline at end of file
diff --git a/mmv1/templates/terraform/custom_import/secret_version.go.erb b/mmv1/templates/terraform/custom_import/secret_version.go.erb
index a8ddb95a8692..2119c44884c5 100644
--- a/mmv1/templates/terraform/custom_import/secret_version.go.erb
+++ b/mmv1/templates/terraform/custom_import/secret_version.go.erb
@@ -11,7 +11,7 @@
 
 	parts := secretRegex.FindStringSubmatch(name)
 	if len(parts) != 2 {
-		panic(fmt.Sprintf("Version name does not fit the format `projects/{{project}}/secrets/{{secret}}/versions/{{version}}`"))
+		return nil, fmt.Errorf("Version name does not fit the format `projects/{{project}}/secrets/{{secret}}/versions/{{version}}`")
 	}
 	if err := d.Set("secret", parts[1]); err != nil {
 		return nil, fmt.Errorf("Error setting secret: %s", err)
@@ -23,4 +23,9 @@
 		return nil, fmt.Errorf("Error setting version: %s", err)
 	}
 
-	return []*schema.ResourceData{d}, nil
\ No newline at end of file
+	// Explicitly set virtual fields to default values on import
+	if err := d.Set("deletion_policy", "DELETE"); err != nil {
+		return nil, fmt.Errorf("Error setting version: %s", err)
+	}
+
+	return []*schema.ResourceData{d}, nil
diff --git a/mmv1/templates/terraform/custom_import/tags_tag_binding.go.erb b/mmv1/templates/terraform/custom_import/tags_tag_binding.go.erb
index 22cb067951e6..b3219fa4a23e 100644
--- a/mmv1/templates/terraform/custom_import/tags_tag_binding.go.erb
+++ b/mmv1/templates/terraform/custom_import/tags_tag_binding.go.erb
@@ -8,6 +8,14 @@
         return nil, err
     }
 
+    stringParts := strings.Split(d.Get("name").(string), "/")
+    if len(stringParts) < 3 {
+        return nil, fmt.Errorf("Error parsing parent name. Should be in form {{parent}}/tagValues/{{tag_value}}")
+    }
+    if err := d.Set("parent", stringParts[0]); err != nil {
+        return nil, fmt.Errorf("Error setting parent, %s", err)
+    }
+
     name := d.Get("name").(string)
     d.SetId(name)
 
diff --git a/mmv1/templates/terraform/decoders/cloudiot_device_registry.go.erb b/mmv1/templates/terraform/decoders/cloudiot_device_registry.go.erb
deleted file mode 100644
index b5652175ebee..000000000000
--- a/mmv1/templates/terraform/decoders/cloudiot_device_registry.go.erb
+++ /dev/null
@@ -1,31 +0,0 @@
-config := meta.(*transport_tpg.Config)
-
-log.Printf("[DEBUG] Decoding state notification config: %q", d.Id())
-log.Printf("[DEBUG] State notification config before decoding: %v", d.Get("state_notification_config"))
-if err := d.Set("state_notification_config", flattenCloudIotDeviceRegistryStateNotificationConfig(res["stateNotificationConfig"], d, config)); err != nil {
-    return nil, fmt.Errorf("Error reading DeviceRegistry: %s", err)
-}
-log.Printf("[DEBUG] State notification config after decoding: %v", d.Get("state_notification_config"))
-
-log.Printf("[DEBUG] Decoding HTTP config: %q", d.Id())
-log.Printf("[DEBUG] HTTP config before decoding: %v", d.Get("http_config"))
-if err := d.Set("http_config", flattenCloudIotDeviceRegistryHTTPConfig(res["httpConfig"], d, config)); err != nil {
-    return nil, fmt.Errorf("Error reading DeviceRegistry: %s", err)
-}
-log.Printf("[DEBUG] HTTP config after decoding: %v", d.Get("http_config"))
-
-log.Printf("[DEBUG] Decoding MQTT config: %q", d.Id())
-log.Printf("[DEBUG] MQTT config before decoding: %v", d.Get("mqtt_config"))
-if err := d.Set("mqtt_config", flattenCloudIotDeviceRegistryMqttConfig(res["mqttConfig"], d, config)); err != nil {
-    return nil, fmt.Errorf("Error reading DeviceRegistry: %s", err)
-}
-log.Printf("[DEBUG] MQTT config after decoding: %v", d.Get("mqtt_config"))
-
-log.Printf("[DEBUG] Decoding credentials: %q", d.Id())
-log.Printf("[DEBUG] credentials before decoding: %v", d.Get("credentials"))
-if err := d.Set("credentials", flattenCloudIotDeviceRegistryCredentials(res["credentials"], d, config)); err != nil {
-    return nil, fmt.Errorf("Error reading DeviceRegistry: %s", err)
-}
-log.Printf("[DEBUG] credentials after decoding: %v", d.Get("credentials"))
-
-return res, nil
diff --git a/mmv1/templates/terraform/decoders/compute_target_https_proxy.go.erb b/mmv1/templates/terraform/decoders/compute_target_https_proxy.go.erb
new file mode 100644
index 000000000000..0a72fe1c476a
--- /dev/null
+++ b/mmv1/templates/terraform/decoders/compute_target_https_proxy.go.erb
@@ -0,0 +1,15 @@
+// Since both sslCertificates and certificateManagerCertificates maps to the same API field (sslCertificates), we need to check the types
+// of certificates that exist in the array and decide whether to change the field to certificateManagerCertificate or not. 
+// The decoder logic depends on the fact that the API does not allow mixed type of certificates and it returns
+// certificate manager certificates in the format of //certificatemanager.googleapis.com/projects/*/locations/*/certificates/* 
+if sslCertificates, ok := res["sslCertificates"].([]interface{}); ok && len(sslCertificates) > 0 {
+	regPat, _ := regexp.Compile("//certificatemanager.googleapis.com/projects/(.*)/locations/(.*)/certificates/(.*)")
+
+	if regPat.MatchString(sslCertificates[0].(string)) {
+		// It is enough to check only the type of one of the provided certificates beacuse all the certificates should be the same type.
+		log.Printf("[DEBUG] The field sslCertificates contains certificateManagerCertificates, the field name will be converted to certificateManagerCertificates")
+		res["certificateManagerCertificates"] = res["sslCertificates"]
+		delete(res, "sslCertificates")
+	}
+}
+return res, nil
\ No newline at end of file
diff --git a/mmv1/templates/terraform/decoders/monitoring_monitored_project.go.erb b/mmv1/templates/terraform/decoders/monitoring_monitored_project.go.erb
index c9bd178663b8..68afb6097983 100644
--- a/mmv1/templates/terraform/decoders/monitoring_monitored_project.go.erb
+++ b/mmv1/templates/terraform/decoders/monitoring_monitored_project.go.erb
@@ -12,23 +12,39 @@
 	# See the License for the specific language governing permissions and
 	# limitations under the License.
 -%>
+// terraform resource config
 config := meta.(*transport_tpg.Config)
 
-expectedName, _ := expandNestedMonitoringMonitoredProjectName(d.Get("name"), d, config)
-expectedFlattenedName := flattenNestedMonitoringMonitoredProjectName(expectedName, d, config)
-_, isNumErr := tpgresource.StringToFixed64(expectedFlattenedName.(string))
-expectProjectNumber := isNumErr == nil
+// The API returns all monitored projects
+monitoredProjects, _ := res["monitoredProjects"].([]interface{})
 
-name := res["name"].(string)
-name = tpgresource.GetResourceNameFromSelfLink(name)
+// Convert configured terraform monitored_project resource name to a ProjectNumber
+expectedProject, configProjectErr := config.NewResourceManagerClient(config.UserAgent).Projects.Get(d.Get("name").(string)).Do()
+if configProjectErr != nil {
+	return nil, configProjectErr
+}
+expectedProjectNumber := strconv.FormatInt(expectedProject.ProjectNumber, 10)
+
+log.Printf("[DEBUG] Scanning for ProjectNumber: %s.", expectedProjectNumber)
+
+// Iterate through the list of monitoredProjects to make sure one matches the configured monitored_project
+for _, monitoredProjectRaw := range monitoredProjects {
+	if monitoredProjectRaw == nil {
+		continue
+	}
+	monitoredProject := monitoredProjectRaw.(map[string]interface{})
+
+	// MonitoredProject names have the format locations/global/metricsScopes/[metricScopeProjectNumber]/projects/[projectNumber]
+	monitoredProjectName := monitoredProject["name"]
 
-if expectProjectNumber {
-	res["name"] = name
-} else if name != "" {
-	project, err := config.NewResourceManagerClient(config.UserAgent).Projects.Get(name).Do()
-	if err != nil {
-		return nil, err
+	// `res` contains the MonitoredProjects of the relevant metrics scope
+	log.Printf("[DEBUG] Matching ProjectNumbers: %s to %s.", expectedProjectNumber, monitoredProjectName)
+	if strings.HasSuffix(monitoredProjectName.(string), fmt.Sprintf("/%s", expectedProjectNumber)) {
+		// Match found - set response object name to match
+		res["name"] = monitoredProjectName
+		log.Printf("[DEBUG] Matched ProjectNumbers: %s and %s.", expectedProjectNumber, monitoredProjectName)
+		return res, nil
 	}
-	res["name"] = project.ProjectId
 }
-return res, nil
+log.Printf("[DEBUG] MonitoringMonitoredProject couldn't be matched.")
+return nil, nil
diff --git a/mmv1/templates/terraform/encoders/backend_service.go.erb b/mmv1/templates/terraform/encoders/backend_service.go.erb
index 68f383c27f95..fa15cb1e70e9 100644
--- a/mmv1/templates/terraform/encoders/backend_service.go.erb
+++ b/mmv1/templates/terraform/encoders/backend_service.go.erb
@@ -47,4 +47,43 @@ for _, backendRaw := range backends {
 	}
 }
 
+// This custom encoding helps prevent sending 0 for clientTtl, defaultTtl and
+// maxTtl in API calls to update these values  when unset in the provider
+// (doing so results in an API level error)
+c, cdnPolicyOk := d.GetOk("cdn_policy")
+
+// Only apply during updates
+if !cdnPolicyOk || obj["cdnPolicy"] == nil {
+	return obj, nil
+}
+
+currentCdnPolicies := c.([]interface{})
+
+// state does not contain cdnPolicy, so we can return early here as well
+if len(currentCdnPolicies) == 0 {
+	return obj, nil
+}
+
+futureCdnPolicy := obj["cdnPolicy"].(map[string]interface{})
+currentCdnPolicy := currentCdnPolicies[0].(map[string]interface{})
+
+cacheMode, ok := futureCdnPolicy["cache_mode"].(string)
+// Fallback to state if doesn't exist in object
+if !ok {
+	cacheMode = currentCdnPolicy["cache_mode"].(string)
+}
+
+switch cacheMode {
+case "USE_ORIGIN_HEADERS":
+	if _, ok := futureCdnPolicy["clientTtl"]; ok {
+		delete(futureCdnPolicy, "clientTtl")
+	}
+	if _, ok := futureCdnPolicy["defaultTtl"]; ok {
+		delete(futureCdnPolicy, "defaultTtl")
+	}
+	if _, ok := futureCdnPolicy["maxTtl"]; ok {
+		delete(futureCdnPolicy, "maxTtl")
+	}
+}
+
 return obj, nil
diff --git a/mmv1/templates/terraform/encoders/cloudiot_device_registry.go.erb b/mmv1/templates/terraform/encoders/cloudiot_device_registry.go.erb
deleted file mode 100644
index 37794ff71630..000000000000
--- a/mmv1/templates/terraform/encoders/cloudiot_device_registry.go.erb
+++ /dev/null
@@ -1,43 +0,0 @@
-config := meta.(*transport_tpg.Config)
-
-log.Printf("[DEBUG] Resource data before encoding extra schema entries %q: %#v", d.Id(), obj)
-
-log.Printf("[DEBUG] Encoding state notification config: %q", d.Id())
-stateNotificationConfigProp, err := expandCloudIotDeviceRegistryStateNotificationConfig(d.Get("state_notification_config"), d, config)
-if err != nil {
-    return nil, err
-} else if v, ok := d.GetOkExists("state_notification_config"); !tpgresource.IsEmptyValue(reflect.ValueOf(stateNotificationConfigProp)) && (ok || !reflect.DeepEqual(v, stateNotificationConfigProp)) {
-    log.Printf("[DEBUG] Encoding %q. Setting stateNotificationConfig: %#v", d.Id(), stateNotificationConfigProp)
-    obj["stateNotificationConfig"] = stateNotificationConfigProp
-}
-
-log.Printf("[DEBUG] Encoding HTTP config: %q", d.Id())
-httpConfigProp, err := expandCloudIotDeviceRegistryHTTPConfig(d.Get("http_config"), d, config)
-if err != nil {
-    return nil, err
-} else if v, ok := d.GetOkExists("http_config"); !tpgresource.IsEmptyValue(reflect.ValueOf(httpConfigProp)) && (ok || !reflect.DeepEqual(v, httpConfigProp)) {
-    log.Printf("[DEBUG] Encoding %q. Setting httpConfig: %#v", d.Id(), httpConfigProp)
-    obj["httpConfig"] = httpConfigProp
-}
-
-log.Printf("[DEBUG] Encoding MQTT config: %q", d.Id())
-mqttConfigProp, err := expandCloudIotDeviceRegistryMqttConfig(d.Get("mqtt_config"), d, config)
-if err != nil {
-    return nil, err
-} else if v, ok := d.GetOkExists("mqtt_config"); !tpgresource.IsEmptyValue(reflect.ValueOf(mqttConfigProp)) && (ok || !reflect.DeepEqual(v, mqttConfigProp)) {
-    log.Printf("[DEBUG] Encoding %q. Setting mqttConfig: %#v", d.Id(), mqttConfigProp)
-    obj["mqttConfig"] = mqttConfigProp
-}
-
-log.Printf("[DEBUG] Encoding credentials: %q", d.Id())
-credentialsProp, err := expandCloudIotDeviceRegistryCredentials(d.Get("credentials"), d, config)
-if err != nil {
-    return nil, err
-} else if v, ok := d.GetOkExists("credentials"); !tpgresource.IsEmptyValue(reflect.ValueOf(credentialsProp)) && (ok || !reflect.DeepEqual(v, credentialsProp)) {
-    log.Printf("[DEBUG] Encoding %q. Setting credentials: %#v", d.Id(), credentialsProp)
-    obj["credentials"] = credentialsProp
-}
-
-log.Printf("[DEBUG] Resource data after encoding extra schema entries %q: %#v", d.Id(), obj)
-
-return obj, nil
diff --git a/mmv1/templates/terraform/encoders/compute_target_https_proxy.go.erb b/mmv1/templates/terraform/encoders/compute_target_https_proxy.go.erb
new file mode 100644
index 000000000000..168d4a65c5ef
--- /dev/null
+++ b/mmv1/templates/terraform/encoders/compute_target_https_proxy.go.erb
@@ -0,0 +1,10 @@
+
+if _, ok := obj["certificateManagerCertificates"]; ok {
+	// The field certificateManagerCertificates should not be included in the API request, and it should be renamed to `sslCertificates`
+	// The API does not allow using both certificate manager certificates and sslCertificates. If that changes
+	// in the future, the encoder logic should change accordingly because this will mean that both fields are no longer mutual exclusive.
+	log.Printf("[DEBUG] converting the field CertificateManagerCertificates to sslCertificates before sending the request")
+	obj["sslCertificates"] = obj["certificateManagerCertificates"]
+	delete(obj, "certificateManagerCertificates")
+}
+return obj, nil
\ No newline at end of file
diff --git a/mmv1/templates/terraform/encoders/monitoring_monitored_project.go.erb b/mmv1/templates/terraform/encoders/monitoring_monitored_project.go.erb
index 94012980b429..1dc444ecb132 100644
--- a/mmv1/templates/terraform/encoders/monitoring_monitored_project.go.erb
+++ b/mmv1/templates/terraform/encoders/monitoring_monitored_project.go.erb
@@ -13,10 +13,14 @@
         # limitations under the License.
 -%>
 name := d.Get("name").(string)
+log.Printf("[DEBUG] Encoded monitored project name: %s", name)
 name = tpgresource.GetResourceNameFromSelfLink(name)
+log.Printf("[DEBUG] Encoded monitored project resource name: %s", name)
 d.Set("name", name)
 metricsScope := d.Get("metrics_scope").(string)
+log.Printf("[DEBUG] Encoded monitored project metricsScope: %s", metricsScope)
 metricsScope = tpgresource.GetResourceNameFromSelfLink(metricsScope)
+log.Printf("[DEBUG] Encoded monitored project metricsScope resource name: %s", metricsScope)
 d.Set("metrics_scope", metricsScope)
 obj["name"] = fmt.Sprintf("locations/global/metricsScopes/%s/projects/%s", metricsScope, name)
 return obj, nil
diff --git a/mmv1/templates/terraform/encoders/spanner_instance.go.erb b/mmv1/templates/terraform/encoders/spanner_instance.go.erb
index dbcc491e3d18..7dde01e82fa7 100644
--- a/mmv1/templates/terraform/encoders/spanner_instance.go.erb
+++ b/mmv1/templates/terraform/encoders/spanner_instance.go.erb
@@ -1,5 +1,5 @@
-// Temp Logic to accommodate processing_units and num_nodes
-if obj["processingUnits"] == nil && obj["nodeCount"] == nil {
+// Temp Logic to accommodate autoscaling_config, processing_units and num_nodes
+if obj["processingUnits"] == nil && obj["nodeCount"] == nil && obj["autoscalingConfig"] == nil {
 	obj["nodeCount"] = 1
 }
 newObj := make(map[string]interface{})
diff --git a/mmv1/templates/terraform/encoders/spanner_instance_update.go.erb b/mmv1/templates/terraform/encoders/spanner_instance_update.go.erb
index f89635e5517e..6c9cc875a3b9 100644
--- a/mmv1/templates/terraform/encoders/spanner_instance_update.go.erb
+++ b/mmv1/templates/terraform/encoders/spanner_instance_update.go.erb
@@ -18,5 +18,17 @@ if d.HasChange("labels") {
 if d.HasChange("processing_units") {
 	updateMask = append(updateMask, "processingUnits")
 }
+if d.HasChange("autoscaling_config.0.autoscaling_limits.0.max_processing_units") {
+	updateMask = append(updateMask, "autoscalingConfig.autoscalingLimits.maxProcessingUnits")
+}
+if d.HasChange("autoscaling_config.0.autoscaling_limits.0.min_processing_units") {
+	updateMask = append(updateMask, "autoscalingConfig.autoscalingLimits.minProcessingUnits")
+}
+if d.HasChange("autoscaling_config.0.autoscaling_targets.0.high_priority_cpu_utilization_percent") {
+	updateMask = append(updateMask, "autoscalingConfig.autoscalingTargets.highPriorityCpuUtilizationPercent")
+}
+if d.HasChange("autoscaling_config.0.autoscaling_targets.0.storage_utilization_percent") {
+	updateMask = append(updateMask, "autoscalingConfig.autoscalingTargets.storageUtilizationPercent")
+}
 newObj["fieldMask"] = strings.Join(updateMask, ",")
 return newObj, nil
diff --git a/mmv1/templates/terraform/env_var_context.go.erb b/mmv1/templates/terraform/env_var_context.go.erb
index de227f2d3ac6..55e0766acb25 100644
--- a/mmv1/templates/terraform/env_var_context.go.erb
+++ b/mmv1/templates/terraform/env_var_context.go.erb
@@ -25,5 +25,7 @@
 		"<%= var_name -%>": envvar.GetTestIdentityUserFromEnv(t),
 	<% elsif var_type == :PAP_DESCRIPTION  -%>
 		"<%= var_name -%>": envvar.GetTestPublicAdvertisedPrefixDescriptionFromEnv(t),
+	<% elsif var_type == :ZONE  -%>
+		"<%= var_name -%>": envvar.GetTestZoneFromEnv(),
 	<% end -%>
 <% end -%>
diff --git a/mmv1/templates/terraform/examples/access_context_manager_access_level_with_vpc_network_sources.tf.erb b/mmv1/templates/terraform/examples/access_context_manager_access_level_with_vpc_network_sources.tf.erb
new file mode 100644
index 000000000000..d80fe1a6c9ad
--- /dev/null
+++ b/mmv1/templates/terraform/examples/access_context_manager_access_level_with_vpc_network_sources.tf.erb
@@ -0,0 +1,24 @@
+resource "google_compute_network" "vpc_network" {
+	name = "tf-test"
+}
+
+resource "google_access_context_manager_access_level" "<%= ctx[:primary_resource_id] %>" {
+  parent = "accessPolicies/${google_access_context_manager_access_policy.access-policy.name}"
+  name   = "accessPolicies/${google_access_context_manager_access_policy.access-policy.name}/accessLevels/<%= ctx[:vars]['access_level_name'] %>"
+  title  = "<%= ctx[:vars]['access_level_name'] %>"
+  basic {
+    conditions {
+      vpc_network_sources {
+        vpc_subnetwork {
+          network = "//compute.googleapis.com/${google_compute_network.vpc_network.id}"
+          vpc_ip_subnetworks = ["20.0.5.0/24"]
+        }
+      }
+    }
+  }
+}
+
+resource "google_access_context_manager_access_policy" "access-policy" {
+  parent = "organizations/123456789"
+  title  = "my policy"
+}
diff --git a/mmv1/templates/terraform/examples/alloydb_backup_basic.tf.erb b/mmv1/templates/terraform/examples/alloydb_backup_basic.tf.erb
index 418ccb67c8ed..41521891bfec 100644
--- a/mmv1/templates/terraform/examples/alloydb_backup_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/alloydb_backup_basic.tf.erb
@@ -9,7 +9,7 @@ resource "google_alloydb_backup" "<%= ctx[:primary_resource_id] %>" {
 resource "google_alloydb_cluster" "<%= ctx[:primary_resource_id] %>" {
   cluster_id = "<%= ctx[:vars]['alloydb_cluster_name'] %>"
   location   = "us-central1"
-  network    = data.google_compute_network.default.id
+  network    = google_compute_network.default.id
 }
 
 resource "google_alloydb_instance" "<%= ctx[:primary_resource_id] %>" {
@@ -25,15 +25,15 @@ resource "google_compute_global_address" "private_ip_alloc" {
   address_type  = "INTERNAL"
   purpose       = "VPC_PEERING"
   prefix_length = 16
-  network       = data.google_compute_network.default.id
+  network       = google_compute_network.default.id
 }
 
 resource "google_service_networking_connection" "vpc_connection" {
-  network                 = data.google_compute_network.default.id
+  network                 = google_compute_network.default.id
   service                 = "servicenetworking.googleapis.com"
   reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
 }
 
-data "google_compute_network" "default" {
+resource "google_compute_network" "default" {
   name = "<%= ctx[:vars]['network_name'] %>"
 }
diff --git a/mmv1/templates/terraform/examples/alloydb_backup_basic_test.tf.erb b/mmv1/templates/terraform/examples/alloydb_backup_basic_test.tf.erb
new file mode 100644
index 000000000000..57d9e50b0d7e
--- /dev/null
+++ b/mmv1/templates/terraform/examples/alloydb_backup_basic_test.tf.erb
@@ -0,0 +1,23 @@
+resource "google_alloydb_backup" "<%= ctx[:primary_resource_id] %>" {
+  location     = "us-central1"
+  backup_id    = "<%= ctx[:vars]['alloydb_backup_id'] %>"
+  cluster_name = google_alloydb_cluster.<%= ctx[:primary_resource_id] %>.name
+
+  depends_on = [google_alloydb_instance.<%= ctx[:primary_resource_id] %>]
+}
+
+resource "google_alloydb_cluster" "<%= ctx[:primary_resource_id] %>" {
+  cluster_id = "<%= ctx[:vars]['alloydb_cluster_name'] %>"
+  location   = "us-central1"
+  network    = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "<%= ctx[:primary_resource_id] %>" {
+  cluster       = google_alloydb_cluster.<%= ctx[:primary_resource_id] %>.name
+  instance_id   = "<%= ctx[:vars]['alloydb_instance_name'] %>"
+  instance_type = "PRIMARY"
+}
+
+data "google_compute_network" "default" {
+  name = "<%= ctx[:vars]['network_name'] %>"
+}
diff --git a/mmv1/templates/terraform/examples/alloydb_backup_full.tf.erb b/mmv1/templates/terraform/examples/alloydb_backup_full.tf.erb
index bb280b783894..dd891fb49d30 100644
--- a/mmv1/templates/terraform/examples/alloydb_backup_full.tf.erb
+++ b/mmv1/templates/terraform/examples/alloydb_backup_full.tf.erb
@@ -4,6 +4,7 @@ resource "google_alloydb_backup" "<%= ctx[:primary_resource_id] %>" {
   cluster_name = google_alloydb_cluster.<%= ctx[:primary_resource_id] %>.name
 
   description = "example description"
+  type = "ON_DEMAND"
   labels = {
     "label" = "key"
   }
@@ -13,7 +14,7 @@ resource "google_alloydb_backup" "<%= ctx[:primary_resource_id] %>" {
 resource "google_alloydb_cluster" "<%= ctx[:primary_resource_id] %>" {
   cluster_id = "<%= ctx[:vars]['alloydb_cluster_name'] %>"
   location   = "us-central1"
-  network    = data.google_compute_network.default.id
+  network    = google_compute_network.default.id
 }
 
 resource "google_alloydb_instance" "<%= ctx[:primary_resource_id] %>" {
@@ -29,15 +30,15 @@ resource "google_compute_global_address" "private_ip_alloc" {
   address_type  = "INTERNAL"
   purpose       = "VPC_PEERING"
   prefix_length = 16
-  network       = data.google_compute_network.default.id
+  network       = google_compute_network.default.id
 }
 
 resource "google_service_networking_connection" "vpc_connection" {
-  network                 = data.google_compute_network.default.id
+  network                 = google_compute_network.default.id
   service                 = "servicenetworking.googleapis.com"
   reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
 }
 
-data "google_compute_network" "default" {
+resource "google_compute_network" "default" {
   name = "<%= ctx[:vars]['network_name'] %>"
 }
diff --git a/mmv1/templates/terraform/examples/alloydb_backup_full_test.tf.erb b/mmv1/templates/terraform/examples/alloydb_backup_full_test.tf.erb
new file mode 100644
index 000000000000..671e9c930175
--- /dev/null
+++ b/mmv1/templates/terraform/examples/alloydb_backup_full_test.tf.erb
@@ -0,0 +1,28 @@
+resource "google_alloydb_backup" "<%= ctx[:primary_resource_id] %>" {
+  location     = "us-central1"
+  backup_id    = "<%= ctx[:vars]['alloydb_backup_id'] %>"
+  cluster_name = google_alloydb_cluster.<%= ctx[:primary_resource_id] %>.name
+
+  description = "example description"
+  type = "ON_DEMAND"
+  labels = {
+    "label" = "key"
+  }
+  depends_on = [google_alloydb_instance.<%= ctx[:primary_resource_id] %>]
+}
+
+resource "google_alloydb_cluster" "<%= ctx[:primary_resource_id] %>" {
+  cluster_id = "<%= ctx[:vars]['alloydb_cluster_name'] %>"
+  location   = "us-central1"
+  network    = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "<%= ctx[:primary_resource_id] %>" {
+  cluster       = google_alloydb_cluster.<%= ctx[:primary_resource_id] %>.name
+  instance_id   = "<%= ctx[:vars]['alloydb_instance_name'] %>"
+  instance_type = "PRIMARY"
+}
+
+data "google_compute_network" "default" {
+  name = "<%= ctx[:vars]['network_name'] %>"
+}
diff --git a/mmv1/templates/terraform/examples/alloydb_instance_basic.tf.erb b/mmv1/templates/terraform/examples/alloydb_instance_basic.tf.erb
index f6907cd44237..479245a01cb2 100644
--- a/mmv1/templates/terraform/examples/alloydb_instance_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/alloydb_instance_basic.tf.erb
@@ -13,7 +13,7 @@ resource "google_alloydb_instance" "<%= ctx[:primary_resource_id] %>" {
 resource "google_alloydb_cluster" "<%= ctx[:primary_resource_id] %>" {
   cluster_id = "<%= ctx[:vars]['alloydb_cluster_name'] %>"
   location   = "us-central1"
-  network    = data.google_compute_network.default.id
+  network    = google_compute_network.default.id
 
   initial_user {
     password = "<%= ctx[:vars]['alloydb_cluster_name'] %>"
@@ -22,7 +22,7 @@ resource "google_alloydb_cluster" "<%= ctx[:primary_resource_id] %>" {
 
 data "google_project" "project" {}
 
-data "google_compute_network" "default" {
+resource "google_compute_network" "default" {
   name = "<%= ctx[:vars]['network_name'] %>"
 }
 
@@ -31,11 +31,11 @@ resource "google_compute_global_address" "private_ip_alloc" {
   address_type  = "INTERNAL"
   purpose       = "VPC_PEERING"
   prefix_length = 16
-  network       = data.google_compute_network.default.id
+  network       = google_compute_network.default.id
 }
 
 resource "google_service_networking_connection" "vpc_connection" {
-  network                 = data.google_compute_network.default.id
+  network                 = google_compute_network.default.id
   service                 = "servicenetworking.googleapis.com"
   reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
 }
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/alloydb_instance_basic_test.tf.erb b/mmv1/templates/terraform/examples/alloydb_instance_basic_test.tf.erb
new file mode 100644
index 000000000000..36e2678f46db
--- /dev/null
+++ b/mmv1/templates/terraform/examples/alloydb_instance_basic_test.tf.erb
@@ -0,0 +1,25 @@
+resource "google_alloydb_instance" "<%= ctx[:primary_resource_id] %>" {
+  cluster       = google_alloydb_cluster.<%= ctx[:primary_resource_id] %>.name
+  instance_id   = "<%= ctx[:vars]['alloydb_instance_name'] %>"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "<%= ctx[:primary_resource_id] %>" {
+  cluster_id = "<%= ctx[:vars]['alloydb_cluster_name'] %>"
+  location   = "us-central1"
+  network    = data.google_compute_network.default.id
+
+  initial_user {
+    password = "<%= ctx[:vars]['alloydb_cluster_name'] %>"
+  }
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "<%= ctx[:vars]['network_name'] %>"
+}
diff --git a/mmv1/templates/terraform/examples/alloydb_secondary_cluster_basic.tf.erb b/mmv1/templates/terraform/examples/alloydb_secondary_cluster_basic.tf.erb
new file mode 100644
index 000000000000..353cd5a26e6c
--- /dev/null
+++ b/mmv1/templates/terraform/examples/alloydb_secondary_cluster_basic.tf.erb
@@ -0,0 +1,54 @@
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "<%= ctx[:vars]['alloydb_primary_cluster_name'] %>"
+  location   = "us-central1"
+  network    = google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "<%= ctx[:vars]['alloydb_primary_instance_name'] %>"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+
+  depends_on = [google_service_networking_connection.vpc_connection]
+}
+
+resource "google_alloydb_cluster" "<%= ctx[:primary_resource_id] %>" {
+  cluster_id   = "<%= ctx[:vars]['alloydb_secondary_cluster_name'] %>"
+  location     = "us-east1"
+  network      = google_compute_network.default.id
+  cluster_type = "SECONDARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  secondary_config {
+    primary_cluster_name = google_alloydb_cluster.primary.name
+  }
+
+  depends_on = [google_alloydb_instance.primary]
+}
+
+data "google_project" "project" {}
+
+resource "google_compute_network" "default" {
+  name = "<%= ctx[:vars]['alloydb_secondary_cluster_name'] %>"
+}
+
+resource "google_compute_global_address" "private_ip_alloc" {
+  name          =  "<%= ctx[:vars]['alloydb_secondary_cluster_name'] %>"
+  address_type  = "INTERNAL"
+  purpose       = "VPC_PEERING"
+  prefix_length = 16
+  network       = google_compute_network.default.id
+}
+
+resource "google_service_networking_connection" "vpc_connection" {
+  network                 = google_compute_network.default.id
+  service                 = "servicenetworking.googleapis.com"
+  reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/alloydb_secondary_cluster_basic_test.tf.erb b/mmv1/templates/terraform/examples/alloydb_secondary_cluster_basic_test.tf.erb
new file mode 100644
index 000000000000..baa944c10798
--- /dev/null
+++ b/mmv1/templates/terraform/examples/alloydb_secondary_cluster_basic_test.tf.erb
@@ -0,0 +1,38 @@
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "<%= ctx[:vars]['alloydb_primary_cluster_name'] %>"
+  location   = "us-central1"
+  network    = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "<%= ctx[:vars]['alloydb_primary_instance_name'] %>"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "<%= ctx[:primary_resource_id] %>" {
+  cluster_id   = "<%= ctx[:vars]['alloydb_secondary_cluster_name'] %>"
+  location     = "us-east1"
+  network      = data.google_compute_network.default.id
+  cluster_type = "SECONDARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  secondary_config {
+    primary_cluster_name = google_alloydb_cluster.primary.name
+  }
+
+  depends_on = [google_alloydb_instance.primary]
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "<%= ctx[:vars]['network_name'] %>"
+}
diff --git a/mmv1/templates/terraform/examples/alloydb_secondary_instance_basic.tf.erb b/mmv1/templates/terraform/examples/alloydb_secondary_instance_basic.tf.erb
new file mode 100644
index 000000000000..bd4c628c017e
--- /dev/null
+++ b/mmv1/templates/terraform/examples/alloydb_secondary_instance_basic.tf.erb
@@ -0,0 +1,75 @@
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "<%= ctx[:vars]['alloydb_primary_cluster_name'] %>"
+  location   = "us-central1"
+  network    = google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "<%= ctx[:vars]['alloydb_primary_instance_name'] %>"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+
+  depends_on = [google_service_networking_connection.vpc_connection]
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "<%= ctx[:vars]['alloydb_secondary_cluster_name'] %>"
+  location     = "us-east1"
+  network      = google_compute_network.default.id
+  cluster_type = "SECONDARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  secondary_config {
+    primary_cluster_name = google_alloydb_cluster.primary.name
+  }
+
+  deletion_policy = "FORCE"
+
+  # Need lifecycle.ignore_changes because instance_type is an immutable field.
+  # And when promoting cluster from SECONDARY to PRIMARY, the instance_type of the associated secondary instance also changes and becomes PRIMARY.
+  # And we do not want terraform to destroy and create the instance because the field is immutable
+  lifecycle {
+    ignore_changes = [instance_type]
+  }
+
+  depends_on = [google_alloydb_instance.primary]
+}
+
+resource "google_alloydb_instance" "<%= ctx[:primary_resource_id] %>" {
+  cluster       = google_alloydb_cluster.secondary.name
+  instance_id   = "<%= ctx[:vars]['alloydb_secondary_instance_name'] %>"
+  instance_type = google_alloydb_cluster.secondary.cluster_type
+
+  machine_config {
+    cpu_count = 2
+  }
+
+  depends_on = [google_service_networking_connection.vpc_connection]
+}
+
+data "google_project" "project" {}
+
+resource "google_compute_network" "default" {
+  name = "<%= ctx[:vars]['network_name'] %>"
+}
+
+resource "google_compute_global_address" "private_ip_alloc" {
+  name          =  "<%= ctx[:vars]['alloydb_secondary_instance_name'] %>"
+  address_type  = "INTERNAL"
+  purpose       = "VPC_PEERING"
+  prefix_length = 16
+  network       = google_compute_network.default.id
+}
+
+resource "google_service_networking_connection" "vpc_connection" {
+  network                 = google_compute_network.default.id
+  service                 = "servicenetworking.googleapis.com"
+  reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
+}
diff --git a/mmv1/templates/terraform/examples/alloydb_secondary_instance_basic_test.tf.erb b/mmv1/templates/terraform/examples/alloydb_secondary_instance_basic_test.tf.erb
new file mode 100644
index 000000000000..c6cfdce0f8d4
--- /dev/null
+++ b/mmv1/templates/terraform/examples/alloydb_secondary_instance_basic_test.tf.erb
@@ -0,0 +1,50 @@
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "<%= ctx[:vars]['alloydb_primary_cluster_name'] %>"
+  location   = "us-central1"
+  network    = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "<%= ctx[:vars]['alloydb_primary_instance_name'] %>"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "<%= ctx[:vars]['alloydb_secondary_cluster_name'] %>"
+  location     = "us-east1"
+  network      = data.google_compute_network.default.id
+  cluster_type = "SECONDARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  secondary_config {
+    primary_cluster_name = google_alloydb_cluster.primary.name
+  }
+
+  deletion_policy = "FORCE"
+
+  depends_on = [google_alloydb_instance.primary]
+}
+
+resource "google_alloydb_instance" "<%= ctx[:primary_resource_id] %>" {
+  cluster       = google_alloydb_cluster.secondary.name
+  instance_id   = "<%= ctx[:vars]['alloydb_secondary_instance_name'] %>"
+  instance_type = google_alloydb_cluster.secondary.cluster_type
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "<%= ctx[:vars]['network_name'] %>"
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/alloydb_user_builtin.tf.erb b/mmv1/templates/terraform/examples/alloydb_user_builtin.tf.erb
new file mode 100644
index 000000000000..ff49ab77a102
--- /dev/null
+++ b/mmv1/templates/terraform/examples/alloydb_user_builtin.tf.erb
@@ -0,0 +1,47 @@
+resource "google_alloydb_instance" "default" {
+  cluster       = google_alloydb_cluster.default.name
+  instance_id   = "<%= ctx[:vars]['alloydb_instance_name'] %>"
+  instance_type = "PRIMARY"
+
+  depends_on = [google_service_networking_connection.vpc_connection]
+}
+
+resource "google_alloydb_cluster" "default" {
+  cluster_id = "<%= ctx[:vars]['alloydb_cluster_name'] %>"
+  location   = "us-central1"
+  network    = google_compute_network.default.id
+
+  initial_user {
+    password = "<%= ctx[:vars]['alloydb_cluster_pass'] %>"
+  }
+}
+
+data "google_project" "project" {}
+
+resource "google_compute_network" "default" {
+  name = "<%= ctx[:vars]['network_name'] %>"
+}
+
+resource "google_compute_global_address" "private_ip_alloc" {
+  name          = "<%= ctx[:vars]['alloydb_cluster_name'] %>"
+  address_type  = "INTERNAL"
+  purpose       = "VPC_PEERING"
+  prefix_length = 16
+  network       = google_compute_network.default.id
+}
+
+resource "google_service_networking_connection" "vpc_connection" {
+  network                 = google_compute_network.default.id
+  service                 = "servicenetworking.googleapis.com"
+  reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
+}
+
+resource "google_alloydb_user" "<%= ctx[:primary_resource_id] %>" {
+  cluster = google_alloydb_cluster.default.name
+  user_id = "<%= ctx[:vars]['alloydb_user_name'] %>"
+  user_type = "ALLOYDB_BUILT_IN"
+
+  password = "<%= ctx[:vars]['alloydb_user_pass'] %>"
+  database_roles = ["alloydbsuperuser"]
+  depends_on = [google_alloydb_instance.default]
+}
diff --git a/mmv1/templates/terraform/examples/alloydb_user_builtin_test.tf.erb b/mmv1/templates/terraform/examples/alloydb_user_builtin_test.tf.erb
new file mode 100644
index 000000000000..f2511be21719
--- /dev/null
+++ b/mmv1/templates/terraform/examples/alloydb_user_builtin_test.tf.erb
@@ -0,0 +1,32 @@
+resource "google_alloydb_instance" "default" {
+  cluster       = google_alloydb_cluster.default.name
+  instance_id   = "<%= ctx[:vars]['alloydb_instance_name'] %>"
+  instance_type = "PRIMARY"
+}
+
+resource "google_alloydb_cluster" "default" {
+  cluster_id = "<%= ctx[:vars]['alloydb_cluster_name'] %>"
+  location   = "us-central1"
+  network    = data.google_compute_network.default.id
+
+  initial_user {
+    password = "<%= ctx[:vars]['alloydb_cluster_pass'] %>"
+  }
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "<%= ctx[:vars]['network_name'] %>"
+}
+
+
+resource "google_alloydb_user" "<%= ctx[:primary_resource_id] %>" {
+  cluster = google_alloydb_cluster.default.name
+  user_id = "<%= ctx[:vars]['alloydb_user_name'] %>"
+  user_type = "ALLOYDB_BUILT_IN"
+
+  password = "<%= ctx[:vars]['alloydb_user_pass'] %>"
+  database_roles = ["alloydbsuperuser"]
+  depends_on = [google_alloydb_instance.default]
+}
diff --git a/mmv1/templates/terraform/examples/alloydb_user_iam.tf.erb b/mmv1/templates/terraform/examples/alloydb_user_iam.tf.erb
new file mode 100644
index 000000000000..fd2a84128dd7
--- /dev/null
+++ b/mmv1/templates/terraform/examples/alloydb_user_iam.tf.erb
@@ -0,0 +1,46 @@
+resource "google_alloydb_instance" "default" {
+  cluster       = google_alloydb_cluster.default.name
+  instance_id   = "<%= ctx[:vars]['alloydb_instance_name'] %>"
+  instance_type = "PRIMARY"
+
+  depends_on = [google_service_networking_connection.vpc_connection]
+}
+
+resource "google_alloydb_cluster" "default" {
+  cluster_id = "<%= ctx[:vars]['alloydb_cluster_name'] %>"
+  location   = "us-central1"
+  network    = google_compute_network.default.id
+
+  initial_user {
+    password = "<%= ctx[:vars]['alloydb_cluster_pass'] %>"
+  }
+}
+
+data "google_project" "project" {}
+
+resource "google_compute_network" "default" {
+  name = "<%= ctx[:vars]['network_name'] %>"
+}
+
+resource "google_compute_global_address" "private_ip_alloc" {
+  name          = "<%= ctx[:vars]['alloydb_cluster_name'] %>"
+  address_type  = "INTERNAL"
+  purpose       = "VPC_PEERING"
+  prefix_length = 16
+  network       = google_compute_network.default.id
+}
+
+resource "google_service_networking_connection" "vpc_connection" {
+  network                 = google_compute_network.default.id
+  service                 = "servicenetworking.googleapis.com"
+  reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
+}
+
+resource "google_alloydb_user" "<%= ctx[:primary_resource_id] %>" {
+  cluster = google_alloydb_cluster.default.name
+  user_id = "<%= ctx[:vars]['alloydb_user_name'] %>"
+  user_type = "ALLOYDB_IAM_USER"
+
+  database_roles = ["alloydbiamuser"]
+  depends_on = [google_alloydb_instance.default]
+}
diff --git a/mmv1/templates/terraform/examples/alloydb_user_iam_test.tf.erb b/mmv1/templates/terraform/examples/alloydb_user_iam_test.tf.erb
new file mode 100644
index 000000000000..fc5aa428a881
--- /dev/null
+++ b/mmv1/templates/terraform/examples/alloydb_user_iam_test.tf.erb
@@ -0,0 +1,30 @@
+resource "google_alloydb_instance" "default" {
+  cluster       = google_alloydb_cluster.default.name
+  instance_id   = "<%= ctx[:vars]['alloydb_instance_name'] %>"
+  instance_type = "PRIMARY"
+}
+
+resource "google_alloydb_cluster" "default" {
+  cluster_id = "<%= ctx[:vars]['alloydb_cluster_name'] %>"
+  location   = "us-central1"
+  network    = data.google_compute_network.default.id
+
+  initial_user {
+    password = "<%= ctx[:vars]['alloydb_cluster_pass'] %>"
+  }
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "<%= ctx[:vars]['network_name'] %>"
+}
+
+resource "google_alloydb_user" "<%= ctx[:primary_resource_id] %>" {
+  cluster = google_alloydb_cluster.default.name
+  user_id = "<%= ctx[:vars]['alloydb_user_name'] %>"
+  user_type = "ALLOYDB_IAM_USER"
+
+  database_roles = ["alloydbiamuser"]
+  depends_on = [google_alloydb_instance.default]
+}
diff --git a/mmv1/templates/terraform/examples/apigee_environment_nodeconfig_test.tf.erb b/mmv1/templates/terraform/examples/apigee_environment_type_test.tf.erb
similarity index 98%
rename from mmv1/templates/terraform/examples/apigee_environment_nodeconfig_test.tf.erb
rename to mmv1/templates/terraform/examples/apigee_environment_type_test.tf.erb
index a4efdafb7613..1286cc5ec1dd 100644
--- a/mmv1/templates/terraform/examples/apigee_environment_nodeconfig_test.tf.erb
+++ b/mmv1/templates/terraform/examples/apigee_environment_type_test.tf.erb
@@ -120,8 +120,5 @@ resource "google_apigee_environment" "<%= ctx[:primary_resource_id] %>" {
   name         = "tf-test%{random_suffix}"
   description  = "Apigee Environment"
   display_name = "tf-test%{random_suffix}"
-  node_config {
-    min_node_count = "3"
-    max_node_count = "5"
-  }
+  type         = "COMPREHENSIVE"
 }
diff --git a/mmv1/templates/terraform/examples/artifact_registry_repository_remote_apt.tf.erb b/mmv1/templates/terraform/examples/artifact_registry_repository_remote_apt.tf.erb
new file mode 100644
index 000000000000..fce0829c3a2e
--- /dev/null
+++ b/mmv1/templates/terraform/examples/artifact_registry_repository_remote_apt.tf.erb
@@ -0,0 +1,16 @@
+resource "google_artifact_registry_repository" "<%= ctx[:primary_resource_id] %>" {
+  location      = "us-central1"
+  repository_id = "<%= ctx[:vars]['repository_id'] %>"
+  description   = "<%= ctx[:vars]['description'] %>"
+  format        = "APT"
+  mode          = "REMOTE_REPOSITORY"
+  remote_repository_config {
+    description = "Debian buster remote repository"
+    apt_repository {
+      public_repository {
+        repository_base = "DEBIAN"
+        repository_path = "debian/dists/buster"
+      }
+    }
+  }
+}
diff --git a/mmv1/templates/terraform/examples/artifact_registry_repository_remote_yum.tf.erb b/mmv1/templates/terraform/examples/artifact_registry_repository_remote_yum.tf.erb
new file mode 100644
index 000000000000..fd78f58d53f6
--- /dev/null
+++ b/mmv1/templates/terraform/examples/artifact_registry_repository_remote_yum.tf.erb
@@ -0,0 +1,16 @@
+resource "google_artifact_registry_repository" "<%= ctx[:primary_resource_id] %>" {
+  location      = "us-central1"
+  repository_id = "<%= ctx[:vars]['repository_id'] %>"
+  description   = "<%= ctx[:vars]['description'] %>"
+  format        = "YUM"
+  mode          = "REMOTE_REPOSITORY"
+  remote_repository_config {
+    description = "Centos 8 remote repository"
+    yum_repository {
+      public_repository {
+        repository_base = "CENTOS"
+        repository_path = "centos/8-stream/BaseOS/x86_64/os"
+      }
+    }
+  }
+}
diff --git a/mmv1/templates/terraform/examples/artifact_registry_vpcsc_config.tf.erb b/mmv1/templates/terraform/examples/artifact_registry_vpcsc_config.tf.erb
new file mode 100644
index 000000000000..171b8b725d61
--- /dev/null
+++ b/mmv1/templates/terraform/examples/artifact_registry_vpcsc_config.tf.erb
@@ -0,0 +1,6 @@
+resource "google_artifact_registry_vpcsc_config" "<%= ctx[:primary_resource_id] %>" {
+  provider      = google-beta
+  location      = "us-central1"
+  vpcsc_policy   = "ALLOW"
+}
+
diff --git a/mmv1/templates/terraform/examples/backup_dr_management_server_test.tf.erb b/mmv1/templates/terraform/examples/backup_dr_management_server_test.tf.erb
new file mode 100644
index 000000000000..eb2c1c8a3ce4
--- /dev/null
+++ b/mmv1/templates/terraform/examples/backup_dr_management_server_test.tf.erb
@@ -0,0 +1,15 @@
+data "google_compute_network" "default" {
+  provider = google-beta
+  name = "<%= ctx[:vars]['network_name'] %>"
+}
+
+resource "google_backup_dr_management_server" "<%= ctx[:primary_resource_id] %>" {
+  provider = google-beta
+  location = "us-central1"
+  name     = "<%= ctx[:vars]['managementserver_name'] %>"
+  type     = "BACKUP_RESTORE" 
+  networks {
+    network      = data.google_compute_network.default.id
+    peering_mode = "PRIVATE_SERVICE_ACCESS"
+  }
+}
diff --git a/mmv1/templates/terraform/examples/base_configs/iam_test_file.go.erb b/mmv1/templates/terraform/examples/base_configs/iam_test_file.go.erb
index 35dbf60df406..7e997900fa39 100644
--- a/mmv1/templates/terraform/examples/base_configs/iam_test_file.go.erb
+++ b/mmv1/templates/terraform/examples/base_configs/iam_test_file.go.erb
@@ -58,6 +58,8 @@ import_url = import_format.gsub(/({{)%?(\w+)(}})/, '%s').gsub(object.__product.b
 			<% else -%>
 				<% import_qualifiers.push("\"#{example.region_override}\"") -%>
 			<% end -%>
+	<% elsif param == 'universe_domain' -%>
+			<% import_qualifiers.push('envvar.GetTestUniverseDomainFromEnv()') -%>
 	<% end -%>
 <% end -%>
 func TestAcc<%= resource_name -%>IamBindingGenerated(t *testing.T) {
diff --git a/mmv1/templates/terraform/examples/base_configs/test_file.go.erb b/mmv1/templates/terraform/examples/base_configs/test_file.go.erb
index b374fda44db4..64aa47337ddd 100644
--- a/mmv1/templates/terraform/examples/base_configs/test_file.go.erb
+++ b/mmv1/templates/terraform/examples/base_configs/test_file.go.erb
@@ -44,9 +44,10 @@ object.examples
     test_slug = "#{resource_name}_#{example.name.camelize(:lower)}Example"
 
     ignore_read = object.all_user_properties
-      .select{|p| p.url_param_only || p.ignore_read || p.is_a?(Api::Type::ResourceRef) }
+      .select{|p| p.url_param_only || p.ignore_read || p.is_a?(Api::Type::ResourceRef)}
       .map { |p| p.name.underscore }
       .concat(example.ignore_read_extra)
+      .concat(object.ignore_read_labels_fields(object.properties_with_excluded))
 
     # Use explicit version for the example if given.
     # Otherwise, use object version.
diff --git a/mmv1/templates/terraform/examples/bigquery_connection_cloudspanner.tf.erb b/mmv1/templates/terraform/examples/bigquery_connection_cloudspanner.tf.erb
index a605db2a1ea2..6108d5c6152b 100644
--- a/mmv1/templates/terraform/examples/bigquery_connection_cloudspanner.tf.erb
+++ b/mmv1/templates/terraform/examples/bigquery_connection_cloudspanner.tf.erb
@@ -5,5 +5,6 @@ resource "google_bigquery_connection" "<%= ctx[:primary_resource_id] %>" {
    description   = "a riveting description"
    cloud_spanner { 
       database = "<%= ctx[:vars]['database'] %>"
+      database_role = "<%= ctx[:vars]['database_role'] %>"
    }
 }
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/bigquery_connection_cloudspanner_analytics.tf.erb b/mmv1/templates/terraform/examples/bigquery_connection_cloudspanner_databoost.tf.erb
similarity index 63%
rename from mmv1/templates/terraform/examples/bigquery_connection_cloudspanner_analytics.tf.erb
rename to mmv1/templates/terraform/examples/bigquery_connection_cloudspanner_databoost.tf.erb
index 3067242747b6..dbdf60ff63dc 100644
--- a/mmv1/templates/terraform/examples/bigquery_connection_cloudspanner_analytics.tf.erb
+++ b/mmv1/templates/terraform/examples/bigquery_connection_cloudspanner_databoost.tf.erb
@@ -4,8 +4,9 @@ resource "google_bigquery_connection" "<%= ctx[:primary_resource_id] %>" {
    friendly_name = "👋"
    description   = "a riveting description"
    cloud_spanner { 
-      database                 = "<%= ctx[:vars]['database'] %>"
-      use_serverless_analytics = true
-      use_parallelism          = true
+      database        = "<%= ctx[:vars]['database'] %>"
+      use_parallelism = true
+      use_data_boost  = true
+      max_parallelism = 100
    }
 }
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/bigquery_reservation_capacity_commitment_basic.tf.erb b/mmv1/templates/terraform/examples/bigquery_reservation_capacity_commitment_basic.tf.erb
index af222adc2ced..5fe23e0a1d31 100644
--- a/mmv1/templates/terraform/examples/bigquery_reservation_capacity_commitment_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/bigquery_reservation_capacity_commitment_basic.tf.erb
@@ -1,15 +1,15 @@
 resource "google_bigquery_capacity_commitment" "<%= ctx[:primary_resource_id] %>" {
-	capacity_commitment_id = "capacity-tf-test%{random_suffix}"
+  capacity_commitment_id = "capacity-tf-test%{random_suffix}"
 
-	location   = "us-west2"
-	slot_count = 100
-	plan       = "FLEX_FLAT_RATE"
-	edition    = "ENTERPRISE"
+  location   = "us-west2"
+  slot_count = 100
+  plan       = "FLEX_FLAT_RATE"
+  edition    = "ENTERPRISE"
 }
 
 resource "time_sleep" "wait_61_seconds" {
 	depends_on = [google_bigquery_capacity_commitment.<%= ctx[:primary_resource_id] %>]
-    
+
 	# Only needed for CI tests to be able to tear down the commitment once it's expired
-    create_duration = "61s"
+  create_duration = "61s"
 }
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/bigquery_reservation_capacity_commitment_no_id.tf.erb b/mmv1/templates/terraform/examples/bigquery_reservation_capacity_commitment_no_id.tf.erb
new file mode 100644
index 000000000000..d6234e8b98dd
--- /dev/null
+++ b/mmv1/templates/terraform/examples/bigquery_reservation_capacity_commitment_no_id.tf.erb
@@ -0,0 +1,13 @@
+resource "google_bigquery_capacity_commitment" "<%= ctx[:primary_resource_id] %>" {
+  location   = "us-west2"
+  slot_count = 100
+  plan       = "FLEX_FLAT_RATE"
+  edition    = "ENTERPRISE"
+}
+
+resource "time_sleep" "wait_61_seconds" {
+  depends_on = [google_bigquery_capacity_commitment.<%= ctx[:primary_resource_id] %>]
+
+  # Only needed for CI tests to be able to tear down the commitment once it's expired
+  create_duration = "61s"
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/bigtable_app_profile_anycluster.tf.erb b/mmv1/templates/terraform/examples/bigtable_app_profile_anycluster.tf.erb
index 481548071600..f065f824c432 100644
--- a/mmv1/templates/terraform/examples/bigtable_app_profile_anycluster.tf.erb
+++ b/mmv1/templates/terraform/examples/bigtable_app_profile_anycluster.tf.erb
@@ -17,7 +17,7 @@ resource "google_bigtable_instance" "instance" {
     zone         = "us-central1-c"
     num_nodes    = 3
     storage_type = "HDD"
-  }  
+  }
 
   deletion_protection  = "<%= ctx[:vars]['deletion_protection'] %>"
 }
diff --git a/mmv1/templates/terraform/examples/bigtable_app_profile_priority.tf.erb b/mmv1/templates/terraform/examples/bigtable_app_profile_priority.tf.erb
new file mode 100644
index 000000000000..5b35117f11e9
--- /dev/null
+++ b/mmv1/templates/terraform/examples/bigtable_app_profile_priority.tf.erb
@@ -0,0 +1,28 @@
+resource "google_bigtable_instance" "instance" {
+  name = "<%= ctx[:vars]['instance_name'] %>"
+  cluster {
+    cluster_id   = "cluster-1"
+    zone         = "us-central1-b"
+    num_nodes    = 3
+    storage_type = "HDD"
+  }
+
+  deletion_protection  = "<%= ctx[:vars]['deletion_protection'] %>"
+}
+
+resource "google_bigtable_app_profile" "ap" {
+  instance       = google_bigtable_instance.instance.name
+  app_profile_id = "<%= ctx[:vars]['app_profile_name'] %>"
+
+  // Requests will be routed to the following cluster.
+  single_cluster_routing {
+    cluster_id                 = "cluster-1"
+    allow_transactional_writes = true
+  }
+
+  standard_isolation {
+    priority = "PRIORITY_LOW"
+  }
+
+  ignore_warnings = true
+}
diff --git a/mmv1/templates/terraform/examples/certificate_manager_google_managed_certificate_dns.tf.erb b/mmv1/templates/terraform/examples/certificate_manager_google_managed_certificate_dns.tf.erb
index 48d499afeff7..6e457875fbd2 100644
--- a/mmv1/templates/terraform/examples/certificate_manager_google_managed_certificate_dns.tf.erb
+++ b/mmv1/templates/terraform/examples/certificate_manager_google_managed_certificate_dns.tf.erb
@@ -2,6 +2,9 @@ resource "google_certificate_manager_certificate" "<%= ctx[:primary_resource_id]
   name        = "<%= ctx[:vars]['cert_name'] %>"
   description = "The default cert"
   scope       = "EDGE_CACHE"
+  labels = {
+    env = "test"
+  }
   managed {
     domains = [
       google_certificate_manager_dns_authorization.instance.domain,
diff --git a/mmv1/templates/terraform/examples/certificate_manager_google_managed_certificate_dns_all_regions.tf.erb b/mmv1/templates/terraform/examples/certificate_manager_google_managed_certificate_dns_all_regions.tf.erb
new file mode 100644
index 000000000000..af70e19ee7c0
--- /dev/null
+++ b/mmv1/templates/terraform/examples/certificate_manager_google_managed_certificate_dns_all_regions.tf.erb
@@ -0,0 +1,29 @@
+resource "google_certificate_manager_certificate" "<%= ctx[:primary_resource_id] %>" {
+  name        = "<%= ctx[:vars]['cert_name'] %>"
+  description = "The default cert"
+  scope       = "ALL_REGIONS"
+  managed {
+    domains = [
+      google_certificate_manager_dns_authorization.instance.domain,
+      google_certificate_manager_dns_authorization.instance2.domain,
+      ]
+    dns_authorizations = [
+      google_certificate_manager_dns_authorization.instance.id,
+      google_certificate_manager_dns_authorization.instance2.id,
+      ]
+  }
+}
+
+
+resource "google_certificate_manager_dns_authorization" "instance" {
+  name        = "<%= ctx[:vars]['dns_auth_name'] %>"
+  description = "The default dnss"
+  domain      = "<%= ctx[:vars]['dns_auth_subdomain'] %>.hashicorptest.com"
+}
+
+resource "google_certificate_manager_dns_authorization" "instance2" {
+  name        = "<%= ctx[:vars]['dns_auth_name2'] %>"
+  description = "The default dnss"
+  domain      = "<%= ctx[:vars]['dns_auth_subdomain2'] %>.hashicorptest.com"
+}
+
diff --git a/mmv1/templates/terraform/examples/certificate_manager_google_managed_certificate_issuance_config_all_regions.tf.erb b/mmv1/templates/terraform/examples/certificate_manager_google_managed_certificate_issuance_config_all_regions.tf.erb
new file mode 100644
index 000000000000..14c0f819ce59
--- /dev/null
+++ b/mmv1/templates/terraform/examples/certificate_manager_google_managed_certificate_issuance_config_all_regions.tf.erb
@@ -0,0 +1,74 @@
+resource "google_certificate_manager_certificate" "<%= ctx[:primary_resource_id] %>" {
+  name        = "<%= ctx[:vars]['cert_name'] %>"
+  description = "sample google managed all_regions certificate with issuance config for terraform"
+  scope       = "ALL_REGIONS" 
+  managed {
+    domains = [
+        "terraform.subdomain1.com"
+      ]
+    issuance_config = google_certificate_manager_certificate_issuance_config.issuanceconfig.id
+  }
+}
+
+
+
+# creating certificate_issuance_config to use it in the managed certificate
+resource "google_certificate_manager_certificate_issuance_config" "issuanceconfig" {
+  name    = "<%= ctx[:vars]["issuance_config_name"] %>"
+  description = "sample description for the certificate issuanceConfigs"
+  certificate_authority_config {
+    certificate_authority_service_config {
+        ca_pool = google_privateca_ca_pool.pool.id
+    }
+  }
+  lifetime = "1814400s"
+  rotation_window_percentage = 34
+  key_algorithm = "ECDSA_P256"
+  depends_on=[google_privateca_certificate_authority.ca_authority]
+}
+  
+resource "google_privateca_ca_pool" "pool" {
+  name     = "<%= ctx[:vars]["pool_name"] %>"
+  location = "us-central1"
+  tier     = "ENTERPRISE"
+}
+
+resource "google_privateca_certificate_authority" "ca_authority" {
+  location = "us-central1"
+  pool = google_privateca_ca_pool.pool.name
+  certificate_authority_id = "<%= ctx[:vars]["ca_name"] %>"
+  config {
+    subject_config {
+      subject {
+        organization = "HashiCorp"
+        common_name = "my-certificate-authority"
+      }
+      subject_alt_name {
+        dns_names = ["hashicorp.com"]
+      }
+    }
+    x509_config {
+      ca_options {
+        is_ca = true
+      }
+      key_usage {
+        base_key_usage {
+          cert_sign = true
+          crl_sign = true
+        }
+        extended_key_usage {
+          server_auth = true
+        }
+      }
+    }
+  }
+  key_spec {
+    algorithm = "RSA_PKCS1_4096_SHA256"
+  }
+
+  // Disable CA deletion related safe checks for easier cleanup.
+  deletion_protection                    = false
+  skip_grace_period                      = true
+  ignore_active_certificates_on_deletion = true
+}
+
diff --git a/mmv1/templates/terraform/examples/cloud_run_service_secret_environment_variables.tf.erb b/mmv1/templates/terraform/examples/cloud_run_service_secret_environment_variables.tf.erb
index 42549eff36a7..da9c2e34b428 100644
--- a/mmv1/templates/terraform/examples/cloud_run_service_secret_environment_variables.tf.erb
+++ b/mmv1/templates/terraform/examples/cloud_run_service_secret_environment_variables.tf.erb
@@ -4,7 +4,7 @@ data "google_project" "project" {
 resource "google_secret_manager_secret" "secret" {
   secret_id = "<%= ctx[:vars]['secret_id'] %>"
   replication {
-    automatic = true
+    auto {}
   }
 }
 
diff --git a/mmv1/templates/terraform/examples/cloud_run_service_secret_volumes.tf.erb b/mmv1/templates/terraform/examples/cloud_run_service_secret_volumes.tf.erb
index 09936b296aae..a3ba0b82d169 100644
--- a/mmv1/templates/terraform/examples/cloud_run_service_secret_volumes.tf.erb
+++ b/mmv1/templates/terraform/examples/cloud_run_service_secret_volumes.tf.erb
@@ -4,7 +4,7 @@ data "google_project" "project" {
 resource "google_secret_manager_secret" "secret" {
   secret_id = "<%= ctx[:vars]['secret_id'] %>"
   replication {
-    automatic = true
+    auto {}
   }
 }
 
diff --git a/mmv1/templates/terraform/examples/cloudbuild_bitbucket_server_config_peered_network.tf.erb b/mmv1/templates/terraform/examples/cloudbuild_bitbucket_server_config_peered_network.tf.erb
index f59bc3278d77..bedb109901ee 100644
--- a/mmv1/templates/terraform/examples/cloudbuild_bitbucket_server_config_peered_network.tf.erb
+++ b/mmv1/templates/terraform/examples/cloudbuild_bitbucket_server_config_peered_network.tf.erb
@@ -4,8 +4,8 @@ resource "google_project_service" "servicenetworking" {
   service = "servicenetworking.googleapis.com"
   disable_on_destroy = false
 }
- 
-data "google_compute_network" "vpc_network" {
+
+resource "google_compute_network" "vpc_network" {
     name       = "<%= ctx[:vars]['network_name'] %>"
     depends_on = [google_project_service.servicenetworking]
 }
@@ -15,11 +15,11 @@ resource "google_compute_global_address" "private_ip_alloc" {
   purpose       = "VPC_PEERING"
   address_type  = "INTERNAL"
   prefix_length = 16
-  network       = data.google_compute_network.vpc_network.id
+  network       = google_compute_network.vpc_network.id
 }
 
 resource "google_service_networking_connection" "default" {
-  network                 = data.google_compute_network.vpc_network.id
+  network                 = google_compute_network.vpc_network.id
   service                 = "servicenetworking.googleapis.com"
   reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
   depends_on              = [google_project_service.servicenetworking]
@@ -36,7 +36,7 @@ resource "google_cloudbuild_bitbucket_server_config" "<%= ctx[:primary_resource_
     }
     username = "test"
     api_key = "<api-key>"
-    peered_network = replace(data.google_compute_network.vpc_network.id, data.google_project.project.name, data.google_project.project.number)
+    peered_network = replace(google_compute_network.vpc_network.id, data.google_project.project.name, data.google_project.project.number)
     ssl_ca = "-----BEGIN CERTIFICATE-----\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\n-----END CERTIFICATE-----\n"
     depends_on = [google_service_networking_connection.default]
 }
diff --git a/mmv1/templates/terraform/examples/cloudiot_device_basic.tf.erb b/mmv1/templates/terraform/examples/cloudiot_device_basic.tf.erb
deleted file mode 100644
index dbfd02b17e4d..000000000000
--- a/mmv1/templates/terraform/examples/cloudiot_device_basic.tf.erb
+++ /dev/null
@@ -1,8 +0,0 @@
-resource "google_cloudiot_registry" "registry" {
-  name     = "<%= ctx[:vars]['cloudiot_device_registry_name'] %>"
-}
-
-resource "google_cloudiot_device" "<%= ctx[:primary_resource_id] %>" {
-  name     = "<%= ctx[:vars]['cloudiot_device_name'] %>"
-  registry = google_cloudiot_registry.registry.id
-}
diff --git a/mmv1/templates/terraform/examples/cloudiot_device_full.tf.erb b/mmv1/templates/terraform/examples/cloudiot_device_full.tf.erb
deleted file mode 100644
index 0c3457d4029c..000000000000
--- a/mmv1/templates/terraform/examples/cloudiot_device_full.tf.erb
+++ /dev/null
@@ -1,27 +0,0 @@
-resource "google_cloudiot_registry" "registry" {
-  name     = "<%= ctx[:vars]['cloudiot_device_registry_name'] %>"
-}
-
-resource "google_cloudiot_device" "<%= ctx[:primary_resource_id] %>" {
-  name     = "<%= ctx[:vars]['cloudiot_device_name'] %>"
-  registry = google_cloudiot_registry.registry.id
-
-  credentials {
-    public_key {
-        format = "RSA_PEM"
-        key = file("test-fixtures/rsa_public.pem")
-    }
-  }
-
-  blocked = false
-
-  log_level = "INFO"
-
-  metadata = {
-    test_key_1 = "test_value_1"
-  }
-
-  gateway_config {
-    gateway_type = "NON_GATEWAY"
-  }
-}
diff --git a/mmv1/templates/terraform/examples/cloudiot_device_registry_basic.tf.erb b/mmv1/templates/terraform/examples/cloudiot_device_registry_basic.tf.erb
deleted file mode 100644
index 67bf5e108304..000000000000
--- a/mmv1/templates/terraform/examples/cloudiot_device_registry_basic.tf.erb
+++ /dev/null
@@ -1,3 +0,0 @@
-resource "google_cloudiot_registry" "<%= ctx[:primary_resource_id] %>" {
-  name     = "<%= ctx[:vars]['cloudiot_registry_name'] %>"
-}
diff --git a/mmv1/templates/terraform/examples/cloudiot_device_registry_full.tf.erb b/mmv1/templates/terraform/examples/cloudiot_device_registry_full.tf.erb
deleted file mode 100644
index f5c11d9abdcc..000000000000
--- a/mmv1/templates/terraform/examples/cloudiot_device_registry_full.tf.erb
+++ /dev/null
@@ -1,46 +0,0 @@
-resource "google_pubsub_topic" "default-devicestatus" {
-  name = "<%= ctx[:vars]['cloudiot_device_status_topic_name'] %>"
-}
-
-resource "google_pubsub_topic" "default-telemetry" {
-  name = "<%= ctx[:vars]['cloudiot_device_telemetry_topic_name'] %>"
-}
-
-resource "google_pubsub_topic" "additional-telemetry" {
-  name = "<%= ctx[:vars]['cloudiot_additional_device_telemetry_topic_name'] %>"
-}
-
-resource "google_cloudiot_registry" "<%= ctx[:primary_resource_id] %>" {
-  name     = "<%= ctx[:vars]['cloudiot_registry_name'] %>"
-
-  event_notification_configs {
-    pubsub_topic_name = google_pubsub_topic.additional-telemetry.id
-    subfolder_matches = "<%= ctx[:vars]['cloudiot_subfolder_matches_additional_device_telemetry_topic'] %>"
-  }
-
-  event_notification_configs {
-    pubsub_topic_name = google_pubsub_topic.default-telemetry.id
-    subfolder_matches = ""
-  }
-
-  state_notification_config = {
-    pubsub_topic_name = google_pubsub_topic.default-devicestatus.id
-  }
-
-  mqtt_config = {
-    mqtt_enabled_state = "MQTT_ENABLED"
-  }
-
-  http_config = {
-    http_enabled_state = "HTTP_ENABLED"
-  }
-
-  log_level = "INFO"
-
-  credentials {
-    public_key_certificate = {
-      format      = "X509_CERTIFICATE_PEM"
-      certificate = file("test-fixtures/rsa_cert.pem")
-    }
-  }
-}
diff --git a/mmv1/templates/terraform/examples/cloudiot_device_registry_single_event_notification_configs.tf.erb b/mmv1/templates/terraform/examples/cloudiot_device_registry_single_event_notification_configs.tf.erb
deleted file mode 100644
index 45139229a27c..000000000000
--- a/mmv1/templates/terraform/examples/cloudiot_device_registry_single_event_notification_configs.tf.erb
+++ /dev/null
@@ -1,13 +0,0 @@
-resource "google_pubsub_topic" "default-telemetry" {
-  name = "<%= ctx[:vars]['cloudiot_device_telemetry_topic_name'] %>"
-}
-
-resource "google_cloudiot_registry" "<%= ctx[:primary_resource_id] %>" {
-  name     = "<%= ctx[:vars]['cloudiot_registry_name'] %>"
-
-  event_notification_configs {
-    pubsub_topic_name = google_pubsub_topic.default-telemetry.id
-    subfolder_matches = ""
-  }
-
-}
diff --git a/mmv1/templates/terraform/examples/cloudrunv2_job_directvpc.tf.erb b/mmv1/templates/terraform/examples/cloudrunv2_job_directvpc.tf.erb
new file mode 100644
index 000000000000..a28913e7fc13
--- /dev/null
+++ b/mmv1/templates/terraform/examples/cloudrunv2_job_directvpc.tf.erb
@@ -0,0 +1,26 @@
+resource "google_cloud_run_v2_job" "<%= ctx[:primary_resource_id] %>" {
+  name     = "<%= ctx[:vars]['cloud_run_job_name'] %>"
+  location = "us-central1"
+  launch_stage = "BETA"
+  template {
+    template{
+      containers {
+        image = "us-docker.pkg.dev/cloudrun/container/job"
+      }
+      vpc_access {
+        network_interfaces {
+          network = "default"
+          subnetwork = "default"
+          tags = ["tag1", "tag2", "tag3"]
+        }
+        egress = "ALL_TRAFFIC"
+      }
+    }
+  }
+
+  lifecycle {
+    ignore_changes = [
+      launch_stage,
+    ]
+  }
+}
diff --git a/mmv1/templates/terraform/examples/cloudrunv2_job_secret.tf.erb b/mmv1/templates/terraform/examples/cloudrunv2_job_secret.tf.erb
index 917f870f4d11..387d0baf2b05 100644
--- a/mmv1/templates/terraform/examples/cloudrunv2_job_secret.tf.erb
+++ b/mmv1/templates/terraform/examples/cloudrunv2_job_secret.tf.erb
@@ -44,7 +44,7 @@ data "google_project" "project" {
 resource "google_secret_manager_secret" "secret" {
   secret_id = "<%= ctx[:vars]['secret_id'] %>"
   replication {
-    automatic = true
+    auto {}
   }
 }
 
diff --git a/mmv1/templates/terraform/examples/cloudrunv2_job_sql.tf.erb b/mmv1/templates/terraform/examples/cloudrunv2_job_sql.tf.erb
index 05d8ef7ce361..24740a509e58 100644
--- a/mmv1/templates/terraform/examples/cloudrunv2_job_sql.tf.erb
+++ b/mmv1/templates/terraform/examples/cloudrunv2_job_sql.tf.erb
@@ -48,7 +48,7 @@ data "google_project" "project" {
 resource "google_secret_manager_secret" "secret" {
   secret_id = "<%= ctx[:vars]['secret_id'] %>"
   replication {
-    automatic = true
+    auto {}
   }
 }
 
diff --git a/mmv1/templates/terraform/examples/cloudrunv2_service_directvpc.tf.erb b/mmv1/templates/terraform/examples/cloudrunv2_service_directvpc.tf.erb
new file mode 100644
index 000000000000..626c979b98d7
--- /dev/null
+++ b/mmv1/templates/terraform/examples/cloudrunv2_service_directvpc.tf.erb
@@ -0,0 +1,18 @@
+resource "google_cloud_run_v2_service" "<%= ctx[:primary_resource_id] %>" {
+  name     = "<%= ctx[:vars]['cloud_run_service_name'] %>"
+  location = "us-central1"
+  launch_stage = "BETA"
+  template {
+    containers {
+      image = "us-docker.pkg.dev/cloudrun/container/hello"
+    }
+    vpc_access{
+      network_interfaces {
+        network = "default"
+        subnetwork = "default"
+        tags = ["tag1", "tag2", "tag3"]
+      }
+      egress = "ALL_TRAFFIC"
+    }
+  }
+}
diff --git a/mmv1/templates/terraform/examples/cloudrunv2_service_secret.tf.erb b/mmv1/templates/terraform/examples/cloudrunv2_service_secret.tf.erb
index 802a55c1992c..5b06cd4ad619 100644
--- a/mmv1/templates/terraform/examples/cloudrunv2_service_secret.tf.erb
+++ b/mmv1/templates/terraform/examples/cloudrunv2_service_secret.tf.erb
@@ -32,7 +32,7 @@ data "google_project" "project" {
 resource "google_secret_manager_secret" "secret" {
   secret_id = "<%= ctx[:vars]['secret_id'] %>"
   replication {
-    automatic = true
+    auto {}
   }
 }
 
diff --git a/mmv1/templates/terraform/examples/cloudrunv2_service_sql.tf.erb b/mmv1/templates/terraform/examples/cloudrunv2_service_sql.tf.erb
index 9deecf6bd1aa..9a05e52a98f3 100644
--- a/mmv1/templates/terraform/examples/cloudrunv2_service_sql.tf.erb
+++ b/mmv1/templates/terraform/examples/cloudrunv2_service_sql.tf.erb
@@ -51,7 +51,7 @@ data "google_project" "project" {
 resource "google_secret_manager_secret" "secret" {
   secret_id = "<%= ctx[:vars]['secret_id'] %>"
   replication {
-    automatic = true
+    auto {}
   }
 }
 
diff --git a/mmv1/templates/terraform/examples/container_attached_cluster_full.tf.erb b/mmv1/templates/terraform/examples/container_attached_cluster_full.tf.erb
index 676937a176d4..8c55f267114b 100644
--- a/mmv1/templates/terraform/examples/container_attached_cluster_full.tf.erb
+++ b/mmv1/templates/terraform/examples/container_attached_cluster_full.tf.erb
@@ -17,6 +17,7 @@ resource "google_container_attached_cluster" "primary" {
   }
   authorization {
     admin_users = [ "user1@example.com", "user2@example.com"]
+    admin_groups = [ "group1@example.com", "group2@example.com"]
   }
   oidc_config {
       issuer_url = "https://oidc.issuer.url"
@@ -36,4 +37,7 @@ resource "google_container_attached_cluster" "primary" {
       enabled = true
     }
   }
+  binary_authorization {
+    evaluation_mode = "PROJECT_SINGLETON_POLICY_ENFORCE"
+  }
 }
diff --git a/mmv1/templates/terraform/examples/database_migration_service_connection_profile_alloydb.tf.erb b/mmv1/templates/terraform/examples/database_migration_service_connection_profile_alloydb.tf.erb
index 68a6ea686b57..96384e6e4b58 100644
--- a/mmv1/templates/terraform/examples/database_migration_service_connection_profile_alloydb.tf.erb
+++ b/mmv1/templates/terraform/examples/database_migration_service_connection_profile_alloydb.tf.erb
@@ -1,7 +1,7 @@
 data "google_project" "project" {
 }
 
-data "google_compute_network" "default" {
+resource "google_compute_network" "default" {
   name = "<%= ctx[:vars]['network_name'] %>"
 }
 
@@ -10,11 +10,11 @@ resource "google_compute_global_address" "private_ip_alloc" {
   address_type  = "INTERNAL"
   purpose       = "VPC_PEERING"
   prefix_length = 16
-  network       = data.google_compute_network.default.id
+  network       = google_compute_network.default.id
 }
 
 resource "google_service_networking_connection" "vpc_connection" {
-  network                 = data.google_compute_network.default.id
+  network                 = google_compute_network.default.id
   service                 = "servicenetworking.googleapis.com"
   reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
 }
@@ -34,7 +34,7 @@ resource "google_database_migration_service_connection_profile" "<%= ctx[:primar
         user = "alloyuser%{random_suffix}"
         password = "alloypass%{random_suffix}"
       }
-      vpc_network = data.google_compute_network.default.id
+      vpc_network = google_compute_network.default.id
       labels  = { 
         alloyfoo = "alloybar" 
       }
diff --git a/mmv1/templates/terraform/examples/database_migration_service_connection_profile_oracle.tf.erb b/mmv1/templates/terraform/examples/database_migration_service_connection_profile_oracle.tf.erb
new file mode 100644
index 000000000000..583395fa8012
--- /dev/null
+++ b/mmv1/templates/terraform/examples/database_migration_service_connection_profile_oracle.tf.erb
@@ -0,0 +1,16 @@
+resource "google_database_migration_service_connection_profile" "<%= ctx[:primary_resource_id] %>" {
+  location = "us-central1"
+  connection_profile_id = "<%= ctx[:vars]["profile"] %>"
+  display_name = "<%= ctx[:vars]["profile"] %>_display"
+  labels = { 
+    foo = "bar" 
+  }
+  oracle {
+    host = "host"
+    port = 1521
+    username = "username"
+    password = "password"
+    database_service = "dbprovider"
+    static_service_ip_connectivity {}
+  }
+}
diff --git a/mmv1/templates/terraform/examples/database_migration_service_private_connection.tf.erb b/mmv1/templates/terraform/examples/database_migration_service_private_connection.tf.erb
new file mode 100644
index 000000000000..01dba5fe706e
--- /dev/null
+++ b/mmv1/templates/terraform/examples/database_migration_service_private_connection.tf.erb
@@ -0,0 +1,18 @@
+resource "google_database_migration_service_private_connection" "<%= ctx[:primary_resource_id] %>" {
+	display_name          = "dbms_pc"
+	location              = "us-central1"
+	private_connection_id = "<%= ctx[:vars]['private_connection_id'] %>"
+
+	labels = {
+		key = "value"
+	}
+
+	vpc_peering_config {
+		vpc_name = data.google_compute_network.default.id
+		subnet = "10.0.0.0/29"
+	}
+}
+
+data "google_compute_network" "default" {
+  name = "<%= ctx[:vars]['network_name'] %>"
+}
diff --git a/mmv1/templates/terraform/examples/dataform_repository.tf.erb b/mmv1/templates/terraform/examples/dataform_repository.tf.erb
index 9db54244e401..7351b0625f26 100644
--- a/mmv1/templates/terraform/examples/dataform_repository.tf.erb
+++ b/mmv1/templates/terraform/examples/dataform_repository.tf.erb
@@ -8,7 +8,7 @@ resource "google_secret_manager_secret" "secret" {
   secret_id = "secret"
 
   replication {
-    automatic = true
+    auto {}
   }
 }
 
diff --git a/mmv1/templates/terraform/examples/dataform_repository_release_config.tf.erb b/mmv1/templates/terraform/examples/dataform_repository_release_config.tf.erb
index 454d4dd3de93..e85ae9697814 100644
--- a/mmv1/templates/terraform/examples/dataform_repository_release_config.tf.erb
+++ b/mmv1/templates/terraform/examples/dataform_repository_release_config.tf.erb
@@ -8,7 +8,7 @@ resource "google_secret_manager_secret" "secret" {
   secret_id = "<%= ctx[:vars]['secret_name'] %>"
 
   replication {
-    automatic = true
+    auto {}
   }
 }
 
diff --git a/mmv1/templates/terraform/examples/dataform_repository_ssh.tf.erb b/mmv1/templates/terraform/examples/dataform_repository_ssh.tf.erb
new file mode 100644
index 000000000000..cc85dcfc5010
--- /dev/null
+++ b/mmv1/templates/terraform/examples/dataform_repository_ssh.tf.erb
@@ -0,0 +1,42 @@
+resource "google_sourcerepo_repository" "git_repository" {
+  provider = google-beta
+  name = "<%= ctx[:vars]['git_repository_name'] %>"
+}
+
+resource "google_secret_manager_secret" "secret" {
+  provider = google-beta
+  secret_id = "secret"
+
+  replication {
+    auto {}
+  }
+}
+
+resource "google_secret_manager_secret_version" "secret_version" {
+  provider = google-beta
+  secret = google_secret_manager_secret.secret.id
+
+  secret_data = "<%= ctx[:vars]['data'] %>"
+}
+
+resource "google_dataform_repository" "<%= ctx[:primary_resource_id] %>" {
+  provider = google-beta
+  name = "<%= ctx[:vars]['dataform_repository_name'] %>"
+
+  git_remote_settings {
+      url = google_sourcerepo_repository.git_repository.url
+      default_branch = "main"
+      ssh_authentication_config {
+        user_private_key_secret_version = google_secret_manager_secret_version.secret_version.id
+        host_public_key = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAklOUpkDHrfHY17SbrmTIpNLTGK9Tjom/BWDSU"
+      }
+  }
+
+  workspace_compilation_overrides {
+    default_database = "database"
+    schema_suffix = "_suffix"
+    table_prefix = "prefix_"
+  }
+
+  service_account = "1234567890-compute@developer.gserviceaccount.com"
+}
diff --git a/mmv1/templates/terraform/examples/dataform_repository_workflow_config.tf.erb b/mmv1/templates/terraform/examples/dataform_repository_workflow_config.tf.erb
index e4743c4f55dd..5e25f4915b95 100644
--- a/mmv1/templates/terraform/examples/dataform_repository_workflow_config.tf.erb
+++ b/mmv1/templates/terraform/examples/dataform_repository_workflow_config.tf.erb
@@ -8,7 +8,7 @@ resource "google_secret_manager_secret" "secret" {
   secret_id = "<%= ctx[:vars]['secret_name'] %>"
 
   replication {
-    automatic = true
+    auto {}
   }
 }
 
@@ -65,7 +65,7 @@ resource "google_dataform_repository_release_config" "release_config" {
 
 resource "google_service_account" "dataform_sa" {
   provider     = google-beta
-  account_id   = "dataform-workflow-sa"
+  account_id   = "<%= ctx[:vars]['service_account_name'] %>"
   display_name = "Dataform Service Account"
 }
 
diff --git a/mmv1/templates/terraform/examples/dataproc_metastore_service_basic.tf.erb b/mmv1/templates/terraform/examples/dataproc_metastore_service_basic.tf.erb
index a95e7607e470..368e76e15bd1 100644
--- a/mmv1/templates/terraform/examples/dataproc_metastore_service_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/dataproc_metastore_service_basic.tf.erb
@@ -12,4 +12,8 @@ resource "google_dataproc_metastore_service" "<%= ctx[:primary_resource_id] %>"
   hive_metastore_config {
     version = "2.3.6"
   }
+
+  labels = {
+    env = "test"
+  }
 }
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/dialogflowcx_agent_full.tf.erb b/mmv1/templates/terraform/examples/dialogflowcx_agent_full.tf.erb
index d93c18e15e74..1a62c572ba40 100644
--- a/mmv1/templates/terraform/examples/dialogflowcx_agent_full.tf.erb
+++ b/mmv1/templates/terraform/examples/dialogflowcx_agent_full.tf.erb
@@ -1,3 +1,9 @@
+resource "google_storage_bucket" "bucket" {
+  name                        = "<%= ctx[:vars]["bucket_name"] %>"
+  location                    = "US"
+  uniform_bucket_level_access = true
+}
+
 resource "google_dialogflow_cx_agent" "<%= ctx[:primary_resource_id] %>" {
   display_name = "<%= ctx[:vars]["agent_name"] %>"
   location = "global"
@@ -8,7 +14,40 @@ resource "google_dialogflow_cx_agent" "<%= ctx[:primary_resource_id] %>" {
   avatar_uri = "https://cloud.google.com/_static/images/cloud/icons/favicons/onecloud/super_cloud.png"
   enable_stackdriver_logging = true
   enable_spell_correction    = true
-	speech_to_text_settings {
-		enable_speech_adaptation = true
-	}
+  speech_to_text_settings {
+    enable_speech_adaptation = true
+  }
+  advanced_settings {
+    audio_export_gcs_destination {
+      uri = "${google_storage_bucket.bucket.url}/prefix-"
+    }
+    dtmf_settings {
+      enabled = true
+      max_digits = 1
+      finish_digit = "#"
+    }
+  }
+  git_integration_settings {
+    github_settings {
+      display_name = "Github Repo"
+      repository_uri = "https://api.github.com/repos/githubtraining/hellogitworld"
+      tracking_branch = "main"
+      access_token = "secret-token"
+      branches = ["main"]
+    }
+  }
+  text_to_speech_settings {
+    synthesize_speech_configs = jsonencode({
+      en = {
+        voice = {
+          name = "en-US-Neural2-A"
+        }
+      }
+      fr = {
+        voice = {
+          name = "fr-CA-Neural2-A",
+        }
+      }
+    })
+  }
 }
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/dialogflowcx_entity_type_full.tf.erb b/mmv1/templates/terraform/examples/dialogflowcx_entity_type_full.tf.erb
index 8a5c92ae08d1..9885cf4ce2ee 100644
--- a/mmv1/templates/terraform/examples/dialogflowcx_entity_type_full.tf.erb
+++ b/mmv1/templates/terraform/examples/dialogflowcx_entity_type_full.tf.erb
@@ -8,9 +8,9 @@ resource "google_dialogflow_cx_agent" "agent" {
   avatar_uri = "https://cloud.google.com/_static/images/cloud/icons/favicons/onecloud/super_cloud.png"
   enable_stackdriver_logging = true
   enable_spell_correction    = true
-	speech_to_text_settings {
-		enable_speech_adaptation = true
-	}
+  speech_to_text_settings {
+    enable_speech_adaptation = true
+  }
 }
 
 
diff --git a/mmv1/templates/terraform/examples/dialogflowcx_environment_full.tf.erb b/mmv1/templates/terraform/examples/dialogflowcx_environment_full.tf.erb
index 455f31419f38..b4f30a4de908 100644
--- a/mmv1/templates/terraform/examples/dialogflowcx_environment_full.tf.erb
+++ b/mmv1/templates/terraform/examples/dialogflowcx_environment_full.tf.erb
@@ -8,9 +8,9 @@ resource "google_dialogflow_cx_agent" "agent" {
   avatar_uri = "https://cloud.google.com/_static/images/cloud/icons/favicons/onecloud/super_cloud.png"
   enable_stackdriver_logging = true
   enable_spell_correction    = true
-	speech_to_text_settings {
-		enable_speech_adaptation = true
-	}
+  speech_to_text_settings {
+    enable_speech_adaptation = true
+  }
 }
 
 resource "google_dialogflow_cx_version" "version_1" {
diff --git a/mmv1/templates/terraform/examples/dialogflowcx_environment_regional.tf.erb b/mmv1/templates/terraform/examples/dialogflowcx_environment_regional.tf.erb
new file mode 100644
index 000000000000..ea7af171cb0e
--- /dev/null
+++ b/mmv1/templates/terraform/examples/dialogflowcx_environment_regional.tf.erb
@@ -0,0 +1,27 @@
+resource "google_dialogflow_cx_agent" "agent" {
+  display_name = "<%= ctx[:vars]["agent_name"] %>"
+  location = "us-central1"
+  default_language_code = "en"
+  supported_language_codes = ["fr","de","es"]
+  time_zone = "Europe/London"
+  description = "CX BOT Agent"
+  enable_stackdriver_logging = true
+  speech_to_text_settings {
+    enable_speech_adaptation = true
+  }
+}
+
+resource "google_dialogflow_cx_version" "version_1" {
+  parent       = google_dialogflow_cx_agent.agent.start_flow
+  display_name = "1.0.0"
+  description  = "version 1.0.0"
+}
+
+resource "google_dialogflow_cx_environment" "<%= ctx[:primary_resource_id] %>" {
+  parent       = google_dialogflow_cx_agent.agent.id
+  display_name = "Development"
+  description  = "Development Environment"
+  version_configs {
+    version = google_dialogflow_cx_version.version_1.id
+  }
+}
diff --git a/mmv1/templates/terraform/examples/dialogflowcx_flow_default_start_flow.tf.erb b/mmv1/templates/terraform/examples/dialogflowcx_flow_default_start_flow.tf.erb
new file mode 100644
index 000000000000..19bda4f341dd
--- /dev/null
+++ b/mmv1/templates/terraform/examples/dialogflowcx_flow_default_start_flow.tf.erb
@@ -0,0 +1,76 @@
+resource "google_dialogflow_cx_agent" "agent" {
+  display_name          = "<%= ctx[:vars]["agent_name"] %>"
+  location              = "global"
+  default_language_code = "en"
+  time_zone             = "America/New_York"
+}
+
+resource "google_dialogflow_cx_intent" "default_welcome_intent" {
+  parent                    = google_dialogflow_cx_agent.agent.id
+  is_default_welcome_intent = true
+  display_name              = "Default Welcome Intent"
+  priority                  = 1
+  training_phrases {
+    parts {
+      text = "Hello"
+    }
+    repeat_count = 1
+  }
+}
+
+
+resource "google_dialogflow_cx_flow" "<%= ctx[:primary_resource_id] %>" {
+  parent                = google_dialogflow_cx_agent.agent.id
+  is_default_start_flow = true
+  display_name          = "Default Start Flow"
+  description           = "A start flow created along with the agent"
+
+  nlu_settings {
+    classification_threshold = 0.3
+    model_type               = "MODEL_TYPE_STANDARD"
+  }
+
+  transition_routes {
+    intent = google_dialogflow_cx_intent.default_welcome_intent.id
+    trigger_fulfillment {
+      messages {
+        text {
+          text = ["Response to default welcome intent."]
+        }
+      }
+    }
+  }
+
+  event_handlers {
+    event = "custom-event"
+    trigger_fulfillment {
+      messages {
+        text {
+          text = ["This is a default flow."]
+        }
+      }
+    }
+  }
+
+  event_handlers {
+    event = "sys.no-match-default"
+    trigger_fulfillment {
+      messages {
+        text {
+          text = ["We've updated the default flow no-match response!"]
+        }
+      }
+    }
+  }
+
+  event_handlers {
+    event = "sys.no-input-default"
+    trigger_fulfillment {
+      messages {
+        text {
+          text = ["We've updated the default flow no-input response!"]
+        }
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/dialogflowcx_flow_full.tf.erb b/mmv1/templates/terraform/examples/dialogflowcx_flow_full.tf.erb
index ba507fe5632e..3dde921aed9f 100644
--- a/mmv1/templates/terraform/examples/dialogflowcx_flow_full.tf.erb
+++ b/mmv1/templates/terraform/examples/dialogflowcx_flow_full.tf.erb
@@ -13,6 +13,12 @@ resource "google_dialogflow_cx_agent" "agent" {
   }
 }
 
+resource "google_storage_bucket" "bucket" {
+  name                        = "<%= ctx[:vars]["bucket_name"] %>"
+  location                    = "US"
+  uniform_bucket_level_access = true
+}
+
 
 resource "google_dialogflow_cx_flow" "<%= ctx[:primary_resource_id] %>" {
   parent       = google_dialogflow_cx_agent.agent.id
@@ -262,4 +268,15 @@ resource "google_dialogflow_cx_flow" "<%= ctx[:primary_resource_id] %>" {
     }
     target_flow = google_dialogflow_cx_agent.agent.start_flow
   }
+
+  advanced_settings {
+    audio_export_gcs_destination {
+      uri = "${google_storage_bucket.bucket.url}/prefix-"
+    }
+    dtmf_settings {
+      enabled      = true
+      max_digits   = 1
+      finish_digit = "#"
+    }
+  }
 } 
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/dialogflowcx_intent_default_negative_intent.tf.erb b/mmv1/templates/terraform/examples/dialogflowcx_intent_default_negative_intent.tf.erb
new file mode 100644
index 000000000000..3d945d8b08c3
--- /dev/null
+++ b/mmv1/templates/terraform/examples/dialogflowcx_intent_default_negative_intent.tf.erb
@@ -0,0 +1,21 @@
+resource "google_dialogflow_cx_agent" "agent" {
+  display_name          = "<%= ctx[:vars]["agent_name"] %>"
+  location              = "global"
+  default_language_code = "en"
+  time_zone             = "America/New_York"
+}
+
+
+resource "google_dialogflow_cx_intent" "<%= ctx[:primary_resource_id] %>" {
+  parent                     = google_dialogflow_cx_agent.agent.id
+  is_default_negative_intent = true
+  display_name               = "Default Negative Intent"
+  priority                   = 1
+  is_fallback                = true
+  training_phrases {
+     parts {
+         text = "Never match this phrase"
+     }
+     repeat_count = 1
+  }
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/dialogflowcx_intent_default_welcome_intent.tf.erb b/mmv1/templates/terraform/examples/dialogflowcx_intent_default_welcome_intent.tf.erb
new file mode 100644
index 000000000000..0772b2bdde78
--- /dev/null
+++ b/mmv1/templates/terraform/examples/dialogflowcx_intent_default_welcome_intent.tf.erb
@@ -0,0 +1,20 @@
+resource "google_dialogflow_cx_agent" "agent" {
+  display_name          = "<%= ctx[:vars]["agent_name"] %>"
+  location              = "global"
+  default_language_code = "en"
+  time_zone             = "America/New_York"
+}
+
+
+resource "google_dialogflow_cx_intent" "<%= ctx[:primary_resource_id] %>" {
+  parent                    = google_dialogflow_cx_agent.agent.id
+  is_default_welcome_intent = true
+  display_name              = "Default Welcome Intent"
+  priority                  = 1
+  training_phrases {
+     parts {
+         text = "Hello"
+     }
+     repeat_count = 1
+  }
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/dialogflowcx_intent_full.tf.erb b/mmv1/templates/terraform/examples/dialogflowcx_intent_full.tf.erb
index 57e4668fcd97..af722ff6eeea 100644
--- a/mmv1/templates/terraform/examples/dialogflowcx_intent_full.tf.erb
+++ b/mmv1/templates/terraform/examples/dialogflowcx_intent_full.tf.erb
@@ -8,9 +8,9 @@ resource "google_dialogflow_cx_agent" "agent" {
   avatar_uri = "https://cloud.google.com/_static/images/cloud/icons/favicons/onecloud/super_cloud.png"
   enable_stackdriver_logging = true
   enable_spell_correction    = true
-	speech_to_text_settings {
-		enable_speech_adaptation = true
-	}
+  speech_to_text_settings {
+    enable_speech_adaptation = true
+  }
 }
 
 
diff --git a/mmv1/templates/terraform/examples/dialogflowcx_page_full.tf.erb b/mmv1/templates/terraform/examples/dialogflowcx_page_full.tf.erb
index 67cd79e71e36..59294cec6305 100644
--- a/mmv1/templates/terraform/examples/dialogflowcx_page_full.tf.erb
+++ b/mmv1/templates/terraform/examples/dialogflowcx_page_full.tf.erb
@@ -432,6 +432,13 @@ resource "google_dialogflow_cx_page" "<%= ctx[:primary_resource_id] %>" {
       }
       required = "true"
       redact   = "true"
+      advanced_settings {
+        dtmf_settings {
+          enabled      = true
+          max_digits   = 1
+          finish_digit = "#"
+        }
+      }
     }
   }
 
@@ -535,6 +542,14 @@ resource "google_dialogflow_cx_page" "<%= ctx[:primary_resource_id] %>" {
     }
     target_page = google_dialogflow_cx_page.my_page2.id
   }
+
+  advanced_settings {
+    dtmf_settings {
+      enabled      = true
+      max_digits   = 1
+      finish_digit = "#"
+    }
+  }
 }
 
 resource "google_dialogflow_cx_page" "my_page2" {
diff --git a/mmv1/templates/terraform/examples/dialogflowcx_security_settings_basic.tf.erb b/mmv1/templates/terraform/examples/dialogflowcx_security_settings_basic.tf.erb
new file mode 100644
index 000000000000..3110c1643922
--- /dev/null
+++ b/mmv1/templates/terraform/examples/dialogflowcx_security_settings_basic.tf.erb
@@ -0,0 +1,6 @@
+resource "google_dialogflow_cx_security_settings" "<%= ctx[:primary_resource_id] %>" {
+  display_name          = "<%= ctx[:vars]["settings_name"] %>"
+  location              = "global"
+  purge_data_types      = []
+  retention_window_days = 7
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/dialogflowcx_security_settings_full.tf.erb b/mmv1/templates/terraform/examples/dialogflowcx_security_settings_full.tf.erb
new file mode 100644
index 000000000000..e3533518fb2d
--- /dev/null
+++ b/mmv1/templates/terraform/examples/dialogflowcx_security_settings_full.tf.erb
@@ -0,0 +1,53 @@
+resource "google_data_loss_prevention_inspect_template" "inspect" {
+  parent       = "projects/<%= ctx[:test_env_vars]['project'] %>/locations/global"
+  display_name = "<%= ctx[:vars]['inspect_name'] %>"
+  inspect_config {
+    info_types {
+      name = "EMAIL_ADDRESS"
+    }
+  }
+}
+
+resource "google_data_loss_prevention_deidentify_template" "deidentify" {
+  parent       = "projects/<%= ctx[:test_env_vars]['project'] %>/locations/global"
+  display_name = "<%= ctx[:vars]['deidentify_name'] %>"
+  deidentify_config {
+    info_type_transformations {
+      transformations {
+        primitive_transformation {
+          replace_config {
+            new_value {
+              string_value = "[REDACTED]"
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+resource "google_storage_bucket" "bucket" {
+  name                        = "<%= ctx[:vars]["bucket_name"] %>"
+  location                    = "US"
+  uniform_bucket_level_access = true
+}
+
+resource "google_dialogflow_cx_security_settings" "<%= ctx[:primary_resource_id] %>" {
+  display_name        = "<%= ctx[:vars]["settings_name"] %>"
+  location            = "global"
+  redaction_strategy  = "REDACT_WITH_SERVICE"
+  redaction_scope     = "REDACT_DISK_STORAGE"
+  inspect_template    = google_data_loss_prevention_inspect_template.inspect.id
+  deidentify_template = google_data_loss_prevention_deidentify_template.deidentify.id
+  purge_data_types    = ["DIALOGFLOW_HISTORY"]
+  audio_export_settings {
+    gcs_bucket             = google_storage_bucket.bucket.id
+    audio_export_pattern   = "export"
+    enable_audio_redaction = true
+    audio_format           = "OGG"
+  }
+  insights_export_settings {
+    enable_insights_export = true
+  }
+  retention_strategy = "REMOVE_AFTER_CONVERSATION"
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/dialogflowcx_test_case_full.tf.erb b/mmv1/templates/terraform/examples/dialogflowcx_test_case_full.tf.erb
new file mode 100644
index 000000000000..c399764f03f9
--- /dev/null
+++ b/mmv1/templates/terraform/examples/dialogflowcx_test_case_full.tf.erb
@@ -0,0 +1,125 @@
+resource "google_dialogflow_cx_agent" "agent" {
+  display_name               = "<%= ctx[:vars]["agent_name"] %>"
+  location                   = "global"
+  default_language_code      = "en"
+  supported_language_codes   = ["fr", "de", "es"]
+  time_zone                  = "America/New_York"
+  description                = "Example description."
+  avatar_uri                 = "https://storage.cloud.google.com/dialogflow-test-host-image/cloud-logo.png"
+  enable_stackdriver_logging = true
+  enable_spell_correction    = true
+  speech_to_text_settings {
+    enable_speech_adaptation = true
+  }
+}
+
+resource "google_dialogflow_cx_page" "page" {
+  parent       = google_dialogflow_cx_agent.agent.start_flow
+  display_name = "MyPage"
+
+  transition_routes {
+    intent = google_dialogflow_cx_intent.intent.id
+    trigger_fulfillment {
+      messages {
+        text {
+          text = ["Training phrase response"]
+        }
+      }
+    }
+  }
+
+  event_handlers {
+    event = "some-event"
+    trigger_fulfillment {
+      messages {
+        text {
+          text = ["Handling some event"]
+        }
+      }
+    }
+  }
+}
+
+resource "google_dialogflow_cx_intent" "intent" {
+  parent       = google_dialogflow_cx_agent.agent.id
+  display_name = "MyIntent"
+  priority     = 1
+  training_phrases {
+    parts {
+      text = "training phrase"
+    }
+    repeat_count = 1
+  }
+}
+
+resource "google_dialogflow_cx_test_case" "<%= ctx[:primary_resource_id] %>" {
+  parent       = google_dialogflow_cx_agent.agent.id
+  display_name = "MyTestCase"
+  tags         = ["#tag1"]
+  notes        = "demonstrates a simple training phrase response"
+
+  test_config {
+    tracking_parameters = ["some_param"]
+    page                = google_dialogflow_cx_page.page.id
+  }
+
+  test_case_conversation_turns {
+    user_input {
+      input {
+        language_code = "en"
+        text {
+          text = "training phrase"
+        }
+      }
+      injected_parameters       = jsonencode({ some_param = "1" })
+      is_webhook_enabled        = true
+      enable_sentiment_analysis = true
+    }
+    virtual_agent_output {
+      session_parameters = jsonencode({ some_param = "1" })
+      triggered_intent {
+        name = google_dialogflow_cx_intent.intent.id
+      }
+      current_page {
+        name = google_dialogflow_cx_page.page.id
+      }
+      text_responses {
+        text = ["Training phrase response"]
+      }
+    }
+  }
+
+  test_case_conversation_turns {
+    user_input {
+      input {
+        event {
+          event = "some-event"
+        }
+      }
+    }
+    virtual_agent_output {
+      current_page {
+        name = google_dialogflow_cx_page.page.id
+      }
+      text_responses {
+        text = ["Handling some event"]
+      }
+    }
+  }
+
+  test_case_conversation_turns {
+    user_input {
+      input {
+        dtmf {
+          digits       = "12"
+          finish_digit = "3"
+        }
+      }
+    }
+    virtual_agent_output {
+      text_responses {
+        text = ["I didn't get that. Can you say it again?"]
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/dialogflowcx_version_full.tf.erb b/mmv1/templates/terraform/examples/dialogflowcx_version_full.tf.erb
index 162d5b99da20..3a7587558d3b 100644
--- a/mmv1/templates/terraform/examples/dialogflowcx_version_full.tf.erb
+++ b/mmv1/templates/terraform/examples/dialogflowcx_version_full.tf.erb
@@ -8,9 +8,9 @@ resource "google_dialogflow_cx_agent" "agent" {
   avatar_uri = "https://cloud.google.com/_static/images/cloud/icons/favicons/onecloud/super_cloud.png"
   enable_stackdriver_logging = true
   enable_spell_correction    = true
-	speech_to_text_settings {
-		enable_speech_adaptation = true
-	}
+  speech_to_text_settings {
+    enable_speech_adaptation = true
+  }
 }
 
 
diff --git a/mmv1/templates/terraform/examples/dialogflowcx_version_regional.tf.erb b/mmv1/templates/terraform/examples/dialogflowcx_version_regional.tf.erb
new file mode 100644
index 000000000000..28d9fa1ded4a
--- /dev/null
+++ b/mmv1/templates/terraform/examples/dialogflowcx_version_regional.tf.erb
@@ -0,0 +1,19 @@
+resource "google_dialogflow_cx_agent" "agent" {
+  display_name = "<%= ctx[:vars]["agent_name"] %>"
+  location = "us-central1"
+  default_language_code = "en"
+  supported_language_codes = ["fr","de","es"]
+  time_zone = "Europe/London"
+  description = "CX BOT Agent"
+  enable_stackdriver_logging = true
+  speech_to_text_settings {
+    enable_speech_adaptation = true
+  }
+}
+
+
+resource "google_dialogflow_cx_version" "<%= ctx[:primary_resource_id] %>" {
+  parent       = google_dialogflow_cx_agent.agent.start_flow
+  display_name = "1.0.0"
+  description  = "version 1.0.0"
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/dialogflowcx_webhook_full.tf.erb b/mmv1/templates/terraform/examples/dialogflowcx_webhook_full.tf.erb
index cd5fdf1534ec..efc81c37c2b1 100644
--- a/mmv1/templates/terraform/examples/dialogflowcx_webhook_full.tf.erb
+++ b/mmv1/templates/terraform/examples/dialogflowcx_webhook_full.tf.erb
@@ -8,9 +8,9 @@ resource "google_dialogflow_cx_agent" "agent" {
   avatar_uri = "https://cloud.google.com/_static/images/cloud/icons/favicons/onecloud/super_cloud.png"
   enable_stackdriver_logging = true
   enable_spell_correction    = true
-	speech_to_text_settings {
-		enable_speech_adaptation = true
-	}
+  speech_to_text_settings {
+    enable_speech_adaptation = true
+  }
 }
 
 
diff --git a/mmv1/templates/terraform/examples/dns_managed_zone_private_gke.tf.erb b/mmv1/templates/terraform/examples/dns_managed_zone_private_gke.tf.erb
index 667677b48b57..5c58fb5e6b71 100644
--- a/mmv1/templates/terraform/examples/dns_managed_zone_private_gke.tf.erb
+++ b/mmv1/templates/terraform/examples/dns_managed_zone_private_gke.tf.erb
@@ -65,5 +65,6 @@ resource "google_container_cluster" "cluster-1" {
     cluster_secondary_range_name  = google_compute_subnetwork.subnetwork-1.secondary_ip_range[0].range_name
     services_secondary_range_name = google_compute_subnetwork.subnetwork-1.secondary_ip_range[1].range_name
   }
+  deletion_protection  = "<%= ctx[:vars]['deletion_protection'] %>"
 }
 # [END dns_managed_zone_private_gke]
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/dns_managed_zone_quickstart.tf.erb b/mmv1/templates/terraform/examples/dns_managed_zone_quickstart.tf.erb
index 1cd1a836b60b..51d2a67d7bde 100644
--- a/mmv1/templates/terraform/examples/dns_managed_zone_quickstart.tf.erb
+++ b/mmv1/templates/terraform/examples/dns_managed_zone_quickstart.tf.erb
@@ -38,7 +38,7 @@ resource "google_compute_firewall" "default" {
 # to create a DNS zone
 resource "google_dns_managed_zone" "<%= ctx[:primary_resource_id] %>" {
   name          = "<%= ctx[:vars]['example_zone_googlecloudexample'] %>"
-  dns_name      = "googlecloudexample.net."
+  dns_name      = "<%= ctx[:vars]['dns_name'] %>"
   description   = "Example DNS zone"
   force_destroy = "true"
 }
diff --git a/mmv1/templates/terraform/examples/dns_response_policy_basic.tf.erb b/mmv1/templates/terraform/examples/dns_response_policy_basic.tf.erb
index 6bfde1fe8964..767f8706638c 100644
--- a/mmv1/templates/terraform/examples/dns_response_policy_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/dns_response_policy_basic.tf.erb
@@ -53,6 +53,7 @@ resource "google_container_cluster" "cluster-1" {
     cluster_secondary_range_name  = google_compute_subnetwork.subnetwork-1.secondary_ip_range[0].range_name
     services_secondary_range_name = google_compute_subnetwork.subnetwork-1.secondary_ip_range[1].range_name
   }
+  deletion_protection  = "<%= ctx[:vars]['deletion_protection'] %>"
 }
 
 resource "google_dns_response_policy" "<%= ctx[:primary_resource_id] %>" {
diff --git a/mmv1/templates/terraform/examples/edgecontainer_cluster.tf.erb b/mmv1/templates/terraform/examples/edgecontainer_cluster.tf.erb
new file mode 100644
index 000000000000..3c51211b66da
--- /dev/null
+++ b/mmv1/templates/terraform/examples/edgecontainer_cluster.tf.erb
@@ -0,0 +1,26 @@
+resource "google_edgecontainer_cluster" "<%= ctx[:primary_resource_id] %>" {
+  name = "<%= ctx[:vars]['edgecontainer_cluster_name'] %>"
+  location = "us-central1"
+
+  authorization {
+    admin_users {
+      username = "admin@hashicorptest.com"
+    }
+  }
+
+  networking {
+    cluster_ipv4_cidr_blocks = ["10.0.0.0/16"]
+    services_ipv4_cidr_blocks = ["10.1.0.0/16"]
+  }
+
+  fleet {
+    project = "projects/${data.google_project.project.number}"
+  }
+
+  labels = {
+    my_key    = "my_val"
+    other_key = "other_val"
+  }
+}
+
+data "google_project" "project" {}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/edgecontainer_cluster_with_maintenance_window.tf.erb b/mmv1/templates/terraform/examples/edgecontainer_cluster_with_maintenance_window.tf.erb
new file mode 100644
index 000000000000..db607e881694
--- /dev/null
+++ b/mmv1/templates/terraform/examples/edgecontainer_cluster_with_maintenance_window.tf.erb
@@ -0,0 +1,34 @@
+resource "google_edgecontainer_cluster" "<%= ctx[:primary_resource_id] %>" {
+  name = "<%= ctx[:vars]['edgecontainer_cluster_name'] %>"
+  location = "us-central1"
+
+  authorization {
+    admin_users {
+      username = "admin@hashicorptest.com"
+    }
+  }
+
+  networking {
+    cluster_ipv4_cidr_blocks = ["10.0.0.0/16"]
+    services_ipv4_cidr_blocks = ["10.1.0.0/16"]
+  }
+
+  fleet {
+    project = "projects/${data.google_project.project.number}"
+  }
+
+  maintenance_policy {
+    window {
+      recurring_window {
+        window {
+          start_time = "2023-01-01T08:00:00Z"
+          end_time = "2023-01-01T17:00:00Z"
+        }
+
+        recurrence = "FREQ=WEEKLY;BYDAY=SA"
+      }
+    }
+  }
+}
+
+data "google_project" "project" {}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/edgecontainer_local_control_plane_cluster.erb b/mmv1/templates/terraform/examples/edgecontainer_local_control_plane_cluster.erb
new file mode 100644
index 000000000000..f37d760e7703
--- /dev/null
+++ b/mmv1/templates/terraform/examples/edgecontainer_local_control_plane_cluster.erb
@@ -0,0 +1,32 @@
+resource "google_edgecontainer_cluster" "<%= ctx[:primary_resource_id] %>" {
+  name = "<%= ctx[:vars]['edgecontainer_cluster_name'] %>"
+  location = "us-central1"
+
+  authorization {
+    admin_users {
+      username = "admin@hashicorptest.com"
+    }
+  }
+
+  networking {
+    cluster_ipv4_cidr_blocks = ["10.0.0.0/16"]
+    services_ipv4_cidr_blocks = ["10.1.0.0/16"]
+  }
+
+  fleet {
+    project = "projects/${data.google_project.project.number}"
+  }
+
+  external_load_balancer_ipv4_address_pools = ["10.100.0.0-10.100.0.10"]
+
+  control_plane {
+    local {
+      node_location = "us-central1-edge-example-edgesite"
+      node_count = 1
+      machine_filter = "machine-name"
+      shared_deployment_policy = "ALLOWED"
+    }
+  }
+}
+
+data "google_project" "project" {}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/edgecontainer_local_control_plane_cluster.tf.erb b/mmv1/templates/terraform/examples/edgecontainer_local_control_plane_cluster.tf.erb
new file mode 100644
index 000000000000..f37d760e7703
--- /dev/null
+++ b/mmv1/templates/terraform/examples/edgecontainer_local_control_plane_cluster.tf.erb
@@ -0,0 +1,32 @@
+resource "google_edgecontainer_cluster" "<%= ctx[:primary_resource_id] %>" {
+  name = "<%= ctx[:vars]['edgecontainer_cluster_name'] %>"
+  location = "us-central1"
+
+  authorization {
+    admin_users {
+      username = "admin@hashicorptest.com"
+    }
+  }
+
+  networking {
+    cluster_ipv4_cidr_blocks = ["10.0.0.0/16"]
+    services_ipv4_cidr_blocks = ["10.1.0.0/16"]
+  }
+
+  fleet {
+    project = "projects/${data.google_project.project.number}"
+  }
+
+  external_load_balancer_ipv4_address_pools = ["10.100.0.0-10.100.0.10"]
+
+  control_plane {
+    local {
+      node_location = "us-central1-edge-example-edgesite"
+      node_count = 1
+      machine_filter = "machine-name"
+      shared_deployment_policy = "ALLOWED"
+    }
+  }
+}
+
+data "google_project" "project" {}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/edgecontainer_local_control_plane_node_pool.tf.erb b/mmv1/templates/terraform/examples/edgecontainer_local_control_plane_node_pool.tf.erb
new file mode 100644
index 000000000000..db40620bcefa
--- /dev/null
+++ b/mmv1/templates/terraform/examples/edgecontainer_local_control_plane_node_pool.tf.erb
@@ -0,0 +1,40 @@
+resource "google_edgecontainer_cluster" "<%= ctx[:primary_resource_id] %>" {
+  name = "<%= ctx[:vars]['edgecontainer_cluster_name'] %>"
+  location = "us-central1"
+
+  authorization {
+    admin_users {
+      username = "admin@hashicorptest.com"
+    }
+  }
+
+  networking {
+    cluster_ipv4_cidr_blocks = ["10.0.0.0/16"]
+    services_ipv4_cidr_blocks = ["10.1.0.0/16"]
+  }
+
+  fleet {
+    project = "projects/${data.google_project.project.number}"
+  }
+
+  external_load_balancer_ipv4_address_pools = ["10.100.0.0-10.100.0.10"]
+
+  control_plane {
+    local {
+      node_location = "us-central1-edge-example-edgesite"
+      node_count = 1
+      machine_filter = "machine-name"
+      shared_deployment_policy = "ALLOWED"
+    }
+  }
+}
+
+resource "google_edgecontainer_node_pool" "<%= ctx[:primary_resource_id] %>" {
+  name = "nodepool-1"
+  cluster = google_edgecontainer_cluster.cluster.name
+  location = "us-central1"
+  node_location = "us-central1-edge-example-edgesite"
+  node_count = 3
+}
+
+data "google_project" "project" {}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/edgecontainer_local_control_plane_node_pool_internal.tf.erb b/mmv1/templates/terraform/examples/edgecontainer_local_control_plane_node_pool_internal.tf.erb
new file mode 100644
index 000000000000..fbb0719249ce
--- /dev/null
+++ b/mmv1/templates/terraform/examples/edgecontainer_local_control_plane_node_pool_internal.tf.erb
@@ -0,0 +1,39 @@
+resource "google_edgecontainer_cluster" "cluster" {
+  name = "tf-lcp-cluster"
+  location = "us-central1"
+
+  authorization {
+    admin_users {
+      username = "admin@hashicorptest.com"
+    }
+  }
+
+  networking {
+    cluster_ipv4_cidr_blocks = ["10.16.0.0/16"]
+    services_ipv4_cidr_blocks = ["10.17.0.0/16"]
+  }
+
+  fleet {
+    project = "projects/${data.google_project.project.number}"
+  }
+
+  external_load_balancer_ipv4_address_pools = ["172.17.34.97-172.17.34.99"]
+
+  control_plane {
+    local {
+      node_location = "us-central1-edge-den25349"
+      node_count = 1
+      shared_deployment_policy = "ALLOWED"
+    }
+  }
+}
+
+resource "google_edgecontainer_node_pool" "<%= ctx[:primary_resource_id] %>" {
+  name = "nodepool-1"
+  cluster = google_edgecontainer_cluster.cluster.name
+  location = "us-central1"
+  node_location = "us-central1-edge-den25349"
+  node_count = 1
+}
+
+data "google_project" "project" {}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/edgecontainer_node_pool.tf.erb b/mmv1/templates/terraform/examples/edgecontainer_node_pool.tf.erb
new file mode 100644
index 000000000000..fb679a3f03fc
--- /dev/null
+++ b/mmv1/templates/terraform/examples/edgecontainer_node_pool.tf.erb
@@ -0,0 +1,34 @@
+resource "google_edgecontainer_cluster" "cluster" {
+  name = "default"
+  location = "us-central1"
+
+  authorization {
+    admin_users {
+      username = "admin@hashicorptest.com"
+    }
+  }
+
+  networking {
+    cluster_ipv4_cidr_blocks = ["10.0.0.0/16"]
+    services_ipv4_cidr_blocks = ["10.1.0.0/16"]
+  }
+
+  fleet {
+    project = "projects/${data.google_project.project.number}"
+  }
+}
+
+resource "google_edgecontainer_node_pool" "<%= ctx[:primary_resource_id] %>" {
+  name = "nodepool-1"
+  cluster = google_edgecontainer_cluster.cluster.name
+  location = "us-central1"
+  node_location = "us-central1-edge-example-edgesite"
+  node_count = 3
+
+  labels = {
+    my_key    = "my_val"
+    other_key = "other_val"
+  }
+}
+
+data "google_project" "project" {}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/edgecontainer_node_pool_with_cmek.tf.erb b/mmv1/templates/terraform/examples/edgecontainer_node_pool_with_cmek.tf.erb
new file mode 100644
index 000000000000..eb98e1c8caa1
--- /dev/null
+++ b/mmv1/templates/terraform/examples/edgecontainer_node_pool_with_cmek.tf.erb
@@ -0,0 +1,51 @@
+resource "google_edgecontainer_cluster" "cluster" {
+  name = "default"
+  location = "us-central1"
+
+  authorization {
+    admin_users {
+      username = "admin@hashicorptest.com"
+    }
+  }
+
+  networking {
+    cluster_ipv4_cidr_blocks = ["10.0.0.0/16"]
+    services_ipv4_cidr_blocks = ["10.1.0.0/16"]
+  }
+
+  fleet {
+    project = "projects/${data.google_project.project.number}"
+  }
+}
+
+resource "google_kms_crypto_key_iam_member" "crypto_key" {
+  crypto_key_id = google_kms_crypto_key.crypto_key.id
+  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+  member        = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-edgecontainer.iam.gserviceaccount.com"
+}
+
+resource "google_kms_crypto_key" "crypto_key" {
+  name     = "key"
+  key_ring = google_kms_key_ring.key_ring.id
+}
+
+resource "google_kms_key_ring" "key_ring" {
+  name     = "keyring"
+  location = "us-central1"
+}
+
+resource "google_edgecontainer_node_pool" "<%= ctx[:primary_resource_id] %>" {
+  depends_on = [google_kms_crypto_key_iam_member.crypto_key]
+
+  name = "nodepool-1"
+  cluster = google_edgecontainer_cluster.cluster.name
+  location = "us-central1"
+  node_location = "us-central1-edge-example-edgesite"
+  node_count = 3
+
+  local_disk_encryption {
+    kms_key = google_kms_crypto_key.crypto_key.id
+  }
+}
+
+data "google_project" "project" {}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/edgecontainer_vpn_connection.tf.erb b/mmv1/templates/terraform/examples/edgecontainer_vpn_connection.tf.erb
new file mode 100644
index 000000000000..3188a9f009fa
--- /dev/null
+++ b/mmv1/templates/terraform/examples/edgecontainer_vpn_connection.tf.erb
@@ -0,0 +1,47 @@
+resource "google_edgecontainer_cluster" "cluster" {
+  name = "default"
+  location = "us-central1"
+
+  authorization {
+    admin_users {
+      username = "admin@hashicorptest.com"
+    }
+  }
+
+  networking {
+    cluster_ipv4_cidr_blocks = ["10.0.0.0/16"]
+    services_ipv4_cidr_blocks = ["10.1.0.0/16"]
+  }
+
+  fleet {
+    project = "projects/${data.google_project.project.number}"
+  }
+}
+
+resource "google_edgecontainer_node_pool" "node_pool" {
+  name = "nodepool-1"
+  cluster = google_edgecontainer_cluster.cluster.name
+  location = "us-central1"
+  node_location = "us-central1-edge-example-edgesite"
+  node_count = 3
+}
+
+resource "google_edgecontainer_vpn_connection" "<%= ctx[:primary_resource_id] %>" {
+  depends_on = [google_edgecontainer_node_pool.node_pool]
+  name = "vpn-connection-1"
+  location = "us-central1"
+  cluster = "projects/${data.google_project.project.number}/locations/us-east1/clusters/${google_edgecontainer_cluster.cluster.name}"
+  vpc = google_compute_network.vpc.name
+  enable_high_availability = true
+
+  labels = {
+    my_key    = "my_val"
+    other_key = "other_val"
+  }
+}
+
+resource "google_compute_network" "vpc" {
+  name = "example-vpc"
+}
+
+data "google_project" "project" {}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/edgenetwork_network.tf.erb b/mmv1/templates/terraform/examples/edgenetwork_network.tf.erb
new file mode 100644
index 000000000000..f8e872cb5c16
--- /dev/null
+++ b/mmv1/templates/terraform/examples/edgenetwork_network.tf.erb
@@ -0,0 +1,12 @@
+resource "google_edgenetwork_network" "<%= ctx[:primary_resource_id] %>" {
+  network_id  = "<%= ctx[:vars]['edgenetwork_network_id'] %>"
+  location    = "<%= ctx[:test_env_vars]['location'] %>"
+  zone        = "<%= ctx[:test_env_vars]['zone'] %>"
+  description = "Example network."
+  mtu         = 9000
+  labels      = {
+    "environment" : "dev"
+  }
+}
+
+
diff --git a/mmv1/templates/terraform/examples/edgenetwork_subnet.tf.erb b/mmv1/templates/terraform/examples/edgenetwork_subnet.tf.erb
new file mode 100644
index 000000000000..8d84feca775f
--- /dev/null
+++ b/mmv1/templates/terraform/examples/edgenetwork_subnet.tf.erb
@@ -0,0 +1,20 @@
+
+resource "google_edgenetwork_subnet" "<%= ctx[:primary_resource_id] %>" {
+  subnet_id   = "<%= ctx[:vars]['edgenetwork_subnet_id'] %>"
+  location    = "<%= ctx[:test_env_vars]['location'] %>"
+  zone        = "<%= ctx[:test_env_vars]['zone'] %>"
+  description = "Example subnet."
+  network     = google_edgenetwork_network.example_network.id
+  ipv4_cidr   = ["4.4.4.1/24"]
+  labels      = {
+    "environment" : "dev"
+  }
+}
+
+resource "google_edgenetwork_network" "example_network" {
+  network_id  = "<%= ctx[:vars]['edgenetwork_network_id'] %>"
+  location    = "<%= ctx[:test_env_vars]['location'] %>"
+  zone        = "<%= ctx[:test_env_vars]['zone'] %>"
+  description = "Example network."
+  mtu         = 9000
+}
diff --git a/mmv1/templates/terraform/examples/edgenetwork_subnet_with_vlan_id.tf.erb b/mmv1/templates/terraform/examples/edgenetwork_subnet_with_vlan_id.tf.erb
new file mode 100644
index 000000000000..d8a6fc6018f7
--- /dev/null
+++ b/mmv1/templates/terraform/examples/edgenetwork_subnet_with_vlan_id.tf.erb
@@ -0,0 +1,22 @@
+
+resource "google_edgenetwork_subnet" "<%= ctx[:primary_resource_id] %>" {
+  subnet_id   = "<%= ctx[:vars]['edgenetwork_subnet_id'] %>"
+  location    = "<%= ctx[:test_env_vars]['location'] %>"
+  zone        = "<%= ctx[:test_env_vars]['zone'] %>"
+  description = "Example subnet with VLAN ID."
+  network     = google_edgenetwork_network.example_network.id
+  ipv6_cidr   = ["4444:4444:4444:4444::1/64"]
+  vlan_id     = 44
+  labels      = {
+    "environment" : "dev"
+  }
+}
+
+resource "google_edgenetwork_network" "example_network" {
+  network_id  = "<%= ctx[:vars]['edgenetwork_network_id'] %>"
+  location    = "<%= ctx[:test_env_vars]['location'] %>"
+  zone        = "<%= ctx[:test_env_vars]['zone'] %>"
+  description = "Example network."
+  mtu         = 9000
+}
+
diff --git a/mmv1/templates/terraform/examples/enable_fleet_default_member_config_configmanagement.tf.erb b/mmv1/templates/terraform/examples/enable_fleet_default_member_config_configmanagement.tf.erb
new file mode 100644
index 000000000000..17e7f4fe4f53
--- /dev/null
+++ b/mmv1/templates/terraform/examples/enable_fleet_default_member_config_configmanagement.tf.erb
@@ -0,0 +1,13 @@
+resource "google_gke_hub_feature" "feature" {
+  name = "configmanagement"
+  location = "global"
+  fleetDefaultMemberConfig {
+    configmanagement {
+      config_sync {
+        git {
+          sync_repo = "https://github.com/hashicorp/terraform"
+        }
+      }
+    }
+  }
+}
diff --git a/mmv1/templates/terraform/examples/enable_fleet_default_member_config_service_mesh.tf.erb b/mmv1/templates/terraform/examples/enable_fleet_default_member_config_service_mesh.tf.erb
new file mode 100644
index 000000000000..f495c0ba2b96
--- /dev/null
+++ b/mmv1/templates/terraform/examples/enable_fleet_default_member_config_service_mesh.tf.erb
@@ -0,0 +1,9 @@
+resource "google_gke_hub_feature" "feature" {
+  name = "servicemesh"
+  location = "global"
+  fleetDefaultMemberConfig {
+    mesh {
+      management = "MANAGEMENT_AUTOMATIC"
+    }
+  }
+}
diff --git a/mmv1/templates/terraform/examples/firebase_project_location_basic.tf.erb b/mmv1/templates/terraform/examples/firebase_project_location_basic.tf.erb
deleted file mode 100644
index 4cdebbe83a21..000000000000
--- a/mmv1/templates/terraform/examples/firebase_project_location_basic.tf.erb
+++ /dev/null
@@ -1,23 +0,0 @@
-resource "google_project" "default" {
-  provider = google-beta
-
-  project_id = "<%= ctx[:vars]['project_name'] %>"
-  name       = "<%= ctx[:vars]['project_name'] %>"
-  org_id     = "<%= ctx[:test_env_vars]['org_id'] %>"
-
-  labels = {
-    "firebase" = "enabled"
-  }
-}
-
-resource "google_firebase_project" "default" {
-  provider = google-beta
-  project  = google_project.default.project_id
-}
-
-resource "google_firebase_project_location" "<%= ctx[:primary_resource_id] %>" {
-	provider = google-beta
-	project = google_firebase_project.default.project
-
-	location_id = "us-central"
-}
diff --git a/mmv1/templates/terraform/examples/firebase_web_app_basic.tf.erb b/mmv1/templates/terraform/examples/firebase_web_app_basic.tf.erb
index c75c49c821d6..46d98f831900 100644
--- a/mmv1/templates/terraform/examples/firebase_web_app_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/firebase_web_app_basic.tf.erb
@@ -1,27 +1,7 @@
-resource "google_project" "default" {
-	provider = google-beta
-
-	project_id = "<%= ctx[:vars]['project_name'] %>"
-	name       = "<%= ctx[:vars]['project_name'] %>"
-	org_id     = "<%= ctx[:test_env_vars]['org_id'] %>"
-
-	labels = {
-		"firebase" = "enabled"
-	}
-}
-
-resource "google_firebase_project" "default" {
-	provider = google-beta
-	project  = google_project.default.project_id
-}
-
 resource "google_firebase_web_app" "<%= ctx[:primary_resource_id] %>" {
 	provider = google-beta
-	project = google_project.default.project_id
+	project = "<%= ctx[:test_env_vars]['project_id'] %>"
 	display_name = "<%= ctx[:vars]['display_name'] %>"
-	deletion_policy = "DELETE"
-
-	depends_on = [google_firebase_project.default]
 }
 
 data "google_firebase_web_app_config" "basic" {
diff --git a/mmv1/templates/terraform/examples/firebasehosting_customdomain_basic.tf.erb b/mmv1/templates/terraform/examples/firebasehosting_customdomain_basic.tf.erb
new file mode 100644
index 000000000000..5697e91ab916
--- /dev/null
+++ b/mmv1/templates/terraform/examples/firebasehosting_customdomain_basic.tf.erb
@@ -0,0 +1,7 @@
+resource "google_firebase_hosting_custom_domain" "default" {
+  provider = google-beta
+
+  project  = "<%= ctx[:test_env_vars]['project_id'] %>"
+  site_id = "<%= ctx[:vars]['site_id'] %>"
+  custom_domain = "<%= ctx[:vars]['custom_domain'] %>"
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/firebasehosting_customdomain_cloud_run.tf.erb b/mmv1/templates/terraform/examples/firebasehosting_customdomain_cloud_run.tf.erb
new file mode 100644
index 000000000000..c226ca54a7b8
--- /dev/null
+++ b/mmv1/templates/terraform/examples/firebasehosting_customdomain_cloud_run.tf.erb
@@ -0,0 +1,52 @@
+resource "google_firebase_hosting_site" "default" {
+  provider = google-beta
+  project  = "<%= ctx[:test_env_vars]['project_id'] %>"
+  site_id  = "<%= ctx[:vars]['site_id'] %>"
+}
+
+resource "google_cloud_run_v2_service" "default" {
+  provider = google-beta
+  project  = "<%= ctx[:test_env_vars]['project_id'] %>"
+  name     = "<%= ctx[:vars]['cloud_run_service_id'] %>"
+  location = "us-central1"
+
+  # Warning: allows all public traffic
+  ingress = "INGRESS_TRAFFIC_ALL"
+
+  template {
+    containers {
+      image = "us-docker.pkg.dev/cloudrun/container/hello"
+    }
+  }
+}
+
+resource "google_firebase_hosting_version" "default" {
+  provider = google-beta
+  site_id  = google_firebase_hosting_site.default.site_id
+  config {
+    rewrites {
+      glob = "/hello/**"
+      run {
+        service_id = google_cloud_run_v2_service.default.name
+        region = google_cloud_run_v2_service.default.location
+      }
+    }
+  }
+}
+
+resource "google_firebase_hosting_release" "default" {
+  provider     = google-beta
+  site_id      = google_firebase_hosting_site.default.site_id
+  version_name = google_firebase_hosting_version.default.name
+  message      = "Cloud Run Integration"
+}
+
+resource "google_firebase_hosting_custom_domain" "default" {
+  provider = google-beta
+
+  project  = "<%= ctx[:test_env_vars]['project_id'] %>"
+  site_id  = google_firebase_hosting_site.default.site_id
+  custom_domain = "<%= ctx[:vars]['custom_domain'] %>"
+
+  wait_dns_verification = false
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/firebasehosting_customdomain_full.tf.erb b/mmv1/templates/terraform/examples/firebasehosting_customdomain_full.tf.erb
new file mode 100644
index 000000000000..a144fdca89b6
--- /dev/null
+++ b/mmv1/templates/terraform/examples/firebasehosting_customdomain_full.tf.erb
@@ -0,0 +1,18 @@
+resource "google_firebase_hosting_site" "default" {
+  provider = google-beta
+  project  = "<%= ctx[:test_env_vars]['project_id'] %>"
+
+  site_id = "<%= ctx[:vars]['site_id'] %>"
+}
+
+resource "google_firebase_hosting_custom_domain" "default" {
+  provider = google-beta
+
+  project  = "<%= ctx[:test_env_vars]['project_id'] %>"
+  site_id = google_firebase_hosting_site.default.site_id
+  custom_domain = "<%= ctx[:vars]['custom_domain'] %>"
+  cert_preference = "GROUPED"
+  redirect_target = "<%= ctx[:vars]['redirect_target'] %>"
+
+  wait_dns_verification = false
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/firebasehosting_site_full.tf.erb b/mmv1/templates/terraform/examples/firebasehosting_site_full.tf.erb
index 57c88044615e..f436a7264428 100644
--- a/mmv1/templates/terraform/examples/firebasehosting_site_full.tf.erb
+++ b/mmv1/templates/terraform/examples/firebasehosting_site_full.tf.erb
@@ -2,7 +2,6 @@ resource "google_firebase_web_app" "default" {
   provider = google-beta
   project  = "<%= ctx[:test_env_vars]['project_id'] %>"
   display_name = "<%= ctx[:vars]['display_name'] %>"
-  deletion_policy = "DELETE"
 }
 
 resource "google_firebase_hosting_site" "full" {
diff --git a/mmv1/templates/terraform/examples/firestore_backup_schedule_daily.tf.erb b/mmv1/templates/terraform/examples/firestore_backup_schedule_daily.tf.erb
new file mode 100644
index 000000000000..f9bc2e5c6d26
--- /dev/null
+++ b/mmv1/templates/terraform/examples/firestore_backup_schedule_daily.tf.erb
@@ -0,0 +1,7 @@
+resource "google_firestore_backup_schedule" "<%= ctx[:primary_resource_id] %>" {
+  project = "<%= ctx[:test_env_vars]['project_id'] %>"
+
+  retention = "604800s" // 7 days (maximum possible value for daily backups)
+
+  daily_recurrence {}
+}
diff --git a/mmv1/templates/terraform/examples/firestore_backup_schedule_weekly.tf.erb b/mmv1/templates/terraform/examples/firestore_backup_schedule_weekly.tf.erb
new file mode 100644
index 000000000000..abc170595dd0
--- /dev/null
+++ b/mmv1/templates/terraform/examples/firestore_backup_schedule_weekly.tf.erb
@@ -0,0 +1,10 @@
+resource "google_firestore_backup_schedule" "<%= ctx[:primary_resource_id] %>" {
+  project  = "<%= ctx[:test_env_vars]['project_id'] %>"
+  database = "(default)"
+
+  retention = "8467200s" // 14 weeks (maximum possible value for weekly backups)
+
+  weekly_recurrence {
+    day = "SUNDAY"
+  }
+}
diff --git a/mmv1/templates/terraform/examples/firestore_database.tf.erb b/mmv1/templates/terraform/examples/firestore_database.tf.erb
index 659e57bbf1fa..771b58393b1c 100644
--- a/mmv1/templates/terraform/examples/firestore_database.tf.erb
+++ b/mmv1/templates/terraform/examples/firestore_database.tf.erb
@@ -1,31 +1,9 @@
-resource "google_project" "project" {
-  project_id      = "<%= ctx[:vars]['project_id'] %>"
-  name            = "<%= ctx[:vars]['project_id'] %>"
-  org_id          = "<%= ctx[:test_env_vars]['org_id'] %>"
-  billing_account = "<%= ctx[:test_env_vars]['billing_account'] %>"
-}
-
-resource "time_sleep" "wait_60_seconds" {
-  depends_on = [google_project.project]
-
-  create_duration = "60s"
-}
-
-resource "google_project_service" "firestore" {
-  project = google_project.project.project_id
-  service = "firestore.googleapis.com"
-
-  # Needed for CI tests for permissions to propagate, should not be needed for actual usage
-  depends_on = [time_sleep.wait_60_seconds]
-}
-
 resource "google_firestore_database" "<%= ctx[:primary_resource_id] %>" {
-  project                     = google_project.project.project_id
-  name                        = "my-database"
-  location_id                 = "nam5"
-  type                        = "FIRESTORE_NATIVE"
-  concurrency_mode            = "OPTIMISTIC"
-  app_engine_integration_mode = "DISABLED"
-
-  depends_on = [google_project_service.firestore]
+  project                           = "<%= ctx[:test_env_vars]['project_id'] %>"
+  name                              = "<%= ctx[:vars]['name']%>"
+  location_id                       = "nam5"
+  type                              = "FIRESTORE_NATIVE"
+  concurrency_mode                  = "OPTIMISTIC"
+  app_engine_integration_mode       = "DISABLED"
+  point_in_time_recovery_enablement = "POINT_IN_TIME_RECOVERY_ENABLED"
 }
diff --git a/mmv1/templates/terraform/examples/firestore_database_in_datastore_mode.tf.erb b/mmv1/templates/terraform/examples/firestore_database_in_datastore_mode.tf.erb
index 1f3b00af89b9..1f5233c2e884 100644
--- a/mmv1/templates/terraform/examples/firestore_database_in_datastore_mode.tf.erb
+++ b/mmv1/templates/terraform/examples/firestore_database_in_datastore_mode.tf.erb
@@ -1,31 +1,9 @@
-resource "google_project" "project" {
-  project_id      = "<%= ctx[:vars]['project_id'] %>"
-  name            = "<%= ctx[:vars]['project_id'] %>"
-  org_id          = "<%= ctx[:test_env_vars]['org_id'] %>"
-  billing_account = "<%= ctx[:test_env_vars]['billing_account'] %>"
-}
-
-resource "time_sleep" "wait_60_seconds" {
-  depends_on = [google_project.project]
-  create_duration = "60s"
-}
-
-resource "google_project_service" "firestore" {
-  project = google_project.project.project_id
-  service = "firestore.googleapis.com"
-
-  # Needed for CI tests for permissions to propagate, should not be needed for actual usage
-  depends_on = [time_sleep.wait_60_seconds]
-}
-
 resource "google_firestore_database" "<%= ctx[:primary_resource_id] %>" {
-  project                     = google_project.project.project_id
-  name                        = "datastore-mode-database"
-  location_id                 = "nam5"
-  type                        = "DATASTORE_MODE"
-  concurrency_mode            = "OPTIMISTIC"
-  app_engine_integration_mode = "DISABLED"
-
-  depends_on = [google_project_service.firestore]
+  project                           = "<%= ctx[:test_env_vars]['project_id'] %>"
+  name                              = "<%= ctx[:vars]['name']%>"
+  location_id                       = "nam5"
+  type                              = "DATASTORE_MODE"
+  concurrency_mode                  = "OPTIMISTIC"
+  app_engine_integration_mode       = "DISABLED"
+  point_in_time_recovery_enablement = "POINT_IN_TIME_RECOVERY_ENABLED"
 }
-
diff --git a/mmv1/templates/terraform/examples/firestore_database_with_delete_protection.tf.erb b/mmv1/templates/terraform/examples/firestore_database_with_delete_protection.tf.erb
new file mode 100644
index 000000000000..126899e3a47b
--- /dev/null
+++ b/mmv1/templates/terraform/examples/firestore_database_with_delete_protection.tf.erb
@@ -0,0 +1,11 @@
+resource "google_firestore_database" "<%= ctx[:primary_resource_id] %>" {
+  project                           = "<%= ctx[:test_env_vars]['project_id'] %>"
+  name                              = "<%= ctx[:vars]['name']%>"
+  location_id                       = "nam5"
+  type                              = "FIRESTORE_NATIVE"
+
+  # Prevents accidental deletion of the database.
+  # To delete the database, first set this field to `DELETE_PROTECTION_DISABLED`, apply the changes.
+  # Then delete the database resource and apply the changes again.
+  delete_protection_state           = "DELETE_PROTECTION_ENABLED"
+}
diff --git a/mmv1/templates/terraform/examples/firestore_field_basic.tf.erb b/mmv1/templates/terraform/examples/firestore_field_basic.tf.erb
index 71b23926b04f..b861377dab55 100644
--- a/mmv1/templates/terraform/examples/firestore_field_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/firestore_field_basic.tf.erb
@@ -13,6 +13,4 @@ resource "google_firestore_field" "<%= ctx[:primary_resource_id] %>" {
         array_config = "CONTAINS"
     }
   }
-
-  ttl_config {}
 }
diff --git a/mmv1/templates/terraform/examples/firestore_field_timestamp.tf.erb b/mmv1/templates/terraform/examples/firestore_field_timestamp.tf.erb
index 6defbde35498..a74a4b22e229 100644
--- a/mmv1/templates/terraform/examples/firestore_field_timestamp.tf.erb
+++ b/mmv1/templates/terraform/examples/firestore_field_timestamp.tf.erb
@@ -3,7 +3,9 @@ resource "google_firestore_field" "<%= ctx[:primary_resource_id] %>" {
   collection = "chatrooms_%{random_suffix}"
   field = "timestamp"
 
+  # enables a TTL policy for the document based on the value of entries with this field
+  ttl_config {}
+
   // Disable all single field indexes for the timestamp property.
   index_config {}
-  ttl_config {}
-}
\ No newline at end of file
+}
diff --git a/mmv1/templates/terraform/examples/firestore_index_datastore_mode.tf.erb b/mmv1/templates/terraform/examples/firestore_index_datastore_mode.tf.erb
new file mode 100644
index 000000000000..f878ff86e4ab
--- /dev/null
+++ b/mmv1/templates/terraform/examples/firestore_index_datastore_mode.tf.erb
@@ -0,0 +1,19 @@
+resource "google_firestore_index" "<%= ctx[:primary_resource_id] %>" {
+  project = "<%= ctx[:test_env_vars]['project_id'] %>"
+
+  collection = "chatrooms"
+
+  query_scope = "COLLECTION_RECURSIVE"
+  api_scope = "DATASTORE_MODE_API"
+
+  fields {
+    field_path = "name"
+    order      = "ASCENDING"
+  }
+
+  fields {
+    field_path = "description"
+    order      = "DESCENDING"
+  }
+
+}
diff --git a/mmv1/templates/terraform/examples/game_service_cluster_basic.tf.erb b/mmv1/templates/terraform/examples/game_service_cluster_basic.tf.erb
deleted file mode 100644
index 19eb85571952..000000000000
--- a/mmv1/templates/terraform/examples/game_service_cluster_basic.tf.erb
+++ /dev/null
@@ -1,62 +0,0 @@
-resource "google_game_services_game_server_cluster" "<%= ctx[:primary_resource_id] %>" {
-  <%# depends_on = [google_project_iam_member.kubernetes_developer] -%>
-  <%# depends_on = [module.agones_cluster, module.helm_agones] -%>
-
-  cluster_id = "<%= ctx[:vars]['agones_cluster'] %>"
-  realm_id   = google_game_services_realm.default.realm_id
-
-  connection_info {
-    gke_cluster_reference {
-      cluster = "locations/us-west1/clusters/%{agones_cluster}"
-    }
-    namespace = "default"
-  }
-}
-
-resource "google_game_services_realm" "default" {
-  realm_id   = "<%= ctx[:vars]["realm_id"] %>"
-  time_zone  = "PST8PDT"
-
-  description = "Test Game Realm"
-}
-
-
-<%#
-This resource requires that a GKE cluster is already created with Agones provisioned
-and configured correctly for this test to succeed. Since this setup requires a fair amount
-of bootstrapping that is non-essential to testing that the resource works we've decided to
-set up the cluster in advance and run the tests against it. The following Terraform config
-was used to provision the cluster. Since it is a manual set up this config not guaranteed to
-work out of the box.
-
-module "agones_cluster" {
-  source = "git::https://github.com/googleforgames/agones.git//install/terraform/modules/gke/?ref=release-1.4.0"
-
-  cluster = {
-    "name"             = var.name
-    "zone"             = "us-west1"
-    "machineType"      = "e2-standard-4"
-    "initialNodeCount" = 1
-    "project"          = "<PROJECT_ID>"
-    "network"          = "default"
-  }
-}
-
-// Install Agones via Helm
-module "helm_agones" {
-  source = "git::https://github.com/googleforgames/agones.git//install/terraform/modules/helm/?ref=release-1.4.0"
-
-  agones_version         = "1.4.0"
-  values_file            = ""
-  chart                  = "agones"
-  host                   = module.agones_cluster.host
-  token                  = module.agones_cluster.token
-  cluster_ca_certificate = module.agones_cluster.cluster_ca_certificate
-}
-
-resource "google_project_iam_member" "agent_create" {
-  project = var.project
-  role    = "roles/container.developer"
-  member  = "serviceAccount:service-<PROJECT_NUMBER>@gcp-sa-gameservices.iam.gserviceaccount.com"
-}
--%>
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/game_service_config_basic.tf.erb b/mmv1/templates/terraform/examples/game_service_config_basic.tf.erb
deleted file mode 100644
index 6c89cbcf8f7c..000000000000
--- a/mmv1/templates/terraform/examples/game_service_config_basic.tf.erb
+++ /dev/null
@@ -1,30 +0,0 @@
-resource "google_game_services_game_server_deployment" "default" {
-  deployment_id  = "<%= ctx[:vars]["deployment_id"] %>"
-  description = "a deployment description"
-}
-
-resource "google_game_services_game_server_config" "<%= ctx[:primary_resource_id] %>" {
-  config_id     = "<%= ctx[:vars]["config_id"] %>"
-  deployment_id = google_game_services_game_server_deployment.default.deployment_id
-  description   = "a config description"
-
-  fleet_configs {
-    name       = "something-unique"
-    fleet_spec = jsonencode({ "replicas" : 1, "scheduling" : "Packed", "template" : { "metadata" : { "name" : "tf-test-game-server-template" }, "spec" : { "ports": [{"name": "default", "portPolicy": "Dynamic", "containerPort": 7654, "protocol": "UDP"}], "template" : { "spec" : { "containers" : [{ "name" : "simple-udp-server", "image" : "gcr.io/agones-images/udp-server:0.14" }] } } } } })
-  }
-
-  scaling_configs {
-    name = "scaling-config-name"
-    fleet_autoscaler_spec = jsonencode({"policy": {"type": "Webhook","webhook": {"service": {"name": "autoscaler-webhook-service","namespace": "default","path": "scale"}}}})
-    selectors {
-      labels = {
-        "one" : "two"
-      }
-    }
-
-    schedules {
-      cron_job_duration = "3.500s"
-      cron_spec         = "0 0 * * 0"
-    }
-  }
-}
diff --git a/mmv1/templates/terraform/examples/game_service_deployment_basic.tf.erb b/mmv1/templates/terraform/examples/game_service_deployment_basic.tf.erb
deleted file mode 100644
index 10e00ebc6ace..000000000000
--- a/mmv1/templates/terraform/examples/game_service_deployment_basic.tf.erb
+++ /dev/null
@@ -1,5 +0,0 @@
-resource "google_game_services_game_server_deployment" "<%= ctx[:primary_resource_id] %>" {
-  deployment_id  = "<%= ctx[:vars]["deployment_id"] %>"
-  description = "a deployment description"
-}
-
diff --git a/mmv1/templates/terraform/examples/game_service_deployment_rollout_basic.tf.erb b/mmv1/templates/terraform/examples/game_service_deployment_rollout_basic.tf.erb
deleted file mode 100644
index 8d41a0ddd382..000000000000
--- a/mmv1/templates/terraform/examples/game_service_deployment_rollout_basic.tf.erb
+++ /dev/null
@@ -1,23 +0,0 @@
-resource "google_game_services_game_server_deployment" "default" {
-  deployment_id  = "<%= ctx[:vars]["deployment_id"] %>"
-  description = "a deployment description"
-}
-
-resource "google_game_services_game_server_config" "default" {
-  config_id     = "<%= ctx[:vars]["config_id"] %>"
-  deployment_id = google_game_services_game_server_deployment.default.deployment_id
-  description   = "a config description"
-
-  fleet_configs {
-    name       = "some-non-guid"
-    fleet_spec = jsonencode({ "replicas" : 1, "scheduling" : "Packed", "template" : { "metadata" : { "name" : "tf-test-game-server-template" }, "spec" : { "ports": [{"name": "default", "portPolicy": "Dynamic", "containerPort": 7654, "protocol": "UDP"}], "template" : { "spec" : { "containers" : [{ "name" : "simple-udp-server", "image" : "gcr.io/agones-images/udp-server:0.14" }] } } } } })
-
-    // Alternate usage:
-    // fleet_spec = file(fleet_configs.json)
-  }
-}
-
-resource "google_game_services_game_server_deployment_rollout" "<%= ctx[:primary_resource_id] %>" {
-  deployment_id              = google_game_services_game_server_deployment.default.deployment_id
-  default_game_server_config = google_game_services_game_server_config.default.name
-}
diff --git a/mmv1/templates/terraform/examples/game_service_realm_basic.tf.erb b/mmv1/templates/terraform/examples/game_service_realm_basic.tf.erb
deleted file mode 100644
index 0385c37a6f2c..000000000000
--- a/mmv1/templates/terraform/examples/game_service_realm_basic.tf.erb
+++ /dev/null
@@ -1,8 +0,0 @@
-resource "google_game_services_realm" "<%= ctx[:primary_resource_id] %>" {
-  realm_id  = "<%= ctx[:vars]["realm_id"] %>"
-  time_zone = "EST"
-  location  = "global"
-
-  description = "one of the nine"
-}
-
diff --git a/mmv1/templates/terraform/examples/gkebackup_backupplan_autopilot.tf.erb b/mmv1/templates/terraform/examples/gkebackup_backupplan_autopilot.tf.erb
index 333a6cfc9863..cd0bd7803090 100644
--- a/mmv1/templates/terraform/examples/gkebackup_backupplan_autopilot.tf.erb
+++ b/mmv1/templates/terraform/examples/gkebackup_backupplan_autopilot.tf.erb
@@ -12,6 +12,7 @@ resource "google_container_cluster" "primary" {
       enabled = true
     }
   }
+  deletion_protection  = "<%= ctx[:vars]['deletion_protection'] %>"
 }
 
 resource "google_gke_backup_backup_plan" "autopilot" {
diff --git a/mmv1/templates/terraform/examples/gkebackup_backupplan_basic.tf.erb b/mmv1/templates/terraform/examples/gkebackup_backupplan_basic.tf.erb
index e3f834662ab7..1377aca5ed77 100644
--- a/mmv1/templates/terraform/examples/gkebackup_backupplan_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/gkebackup_backupplan_basic.tf.erb
@@ -10,6 +10,7 @@ resource "google_container_cluster" "primary" {
       enabled = true
     }
   }
+  deletion_protection  = "<%= ctx[:vars]['deletion_protection'] %>"
 }
 
 resource "google_gke_backup_backup_plan" "basic" {
diff --git a/mmv1/templates/terraform/examples/gkebackup_backupplan_cmek.tf.erb b/mmv1/templates/terraform/examples/gkebackup_backupplan_cmek.tf.erb
index 6f2a715b7901..d9ed2a434a39 100644
--- a/mmv1/templates/terraform/examples/gkebackup_backupplan_cmek.tf.erb
+++ b/mmv1/templates/terraform/examples/gkebackup_backupplan_cmek.tf.erb
@@ -10,6 +10,7 @@ resource "google_container_cluster" "primary" {
       enabled = true
     }
   }
+  deletion_protection  = "<%= ctx[:vars]['deletion_protection'] %>"
 }
 
 resource "google_gke_backup_backup_plan" "cmek" {
diff --git a/mmv1/templates/terraform/examples/gkebackup_backupplan_full.tf.erb b/mmv1/templates/terraform/examples/gkebackup_backupplan_full.tf.erb
index 231727fabb35..cce561f53bad 100644
--- a/mmv1/templates/terraform/examples/gkebackup_backupplan_full.tf.erb
+++ b/mmv1/templates/terraform/examples/gkebackup_backupplan_full.tf.erb
@@ -10,6 +10,7 @@ resource "google_container_cluster" "primary" {
       enabled = true
     }
   }
+  deletion_protection  = "<%= ctx[:vars]['deletion_protection'] %>"
 }
 
 resource "google_gke_backup_backup_plan" "full" {
diff --git a/mmv1/templates/terraform/examples/gkebackup_restoreplan_all_cluster_resources.tf.erb b/mmv1/templates/terraform/examples/gkebackup_restoreplan_all_cluster_resources.tf.erb
new file mode 100644
index 000000000000..4f633dcada2e
--- /dev/null
+++ b/mmv1/templates/terraform/examples/gkebackup_restoreplan_all_cluster_resources.tf.erb
@@ -0,0 +1,40 @@
+resource "google_container_cluster" "primary" {
+  name               = "<%= ctx[:vars]['name'] %>-cluster"
+  location           = "us-central1"
+  initial_node_count = 1
+  workload_identity_config {
+    workload_pool = "<%= ctx[:test_env_vars]['project'] %>.svc.id.goog"
+  }
+  addons_config {
+    gke_backup_agent_config {
+      enabled = true
+    }
+  }
+  deletion_protection  = "<%= ctx[:vars]['deletion_protection'] %>"
+}
+
+resource "google_gke_backup_backup_plan" "basic" {
+  name = "<%= ctx[:vars]['name'] %>"
+  cluster = google_container_cluster.primary.id
+  location = "us-central1"
+  backup_config {
+    include_volume_data = true
+    include_secrets = true
+    all_namespaces = true
+  }
+}
+
+resource "google_gke_backup_restore_plan" "all_cluster_resources" {
+  name = "<%= ctx[:vars]['name'] %>-rp"
+  location = "us-central1"
+  backup_plan = google_gke_backup_backup_plan.basic.id
+  cluster = google_container_cluster.primary.id
+  restore_config {
+    no_namespaces = true
+    namespaced_resource_restore_mode = "FAIL_ON_CONFLICT"
+    cluster_resource_restore_scope {
+      all_group_kinds = true
+    }
+    cluster_resource_conflict_policy = "USE_EXISTING_VERSION"
+  }
+}
diff --git a/mmv1/templates/terraform/examples/gkebackup_restoreplan_all_namespaces.tf.erb b/mmv1/templates/terraform/examples/gkebackup_restoreplan_all_namespaces.tf.erb
new file mode 100644
index 000000000000..f431cda66270
--- /dev/null
+++ b/mmv1/templates/terraform/examples/gkebackup_restoreplan_all_namespaces.tf.erb
@@ -0,0 +1,41 @@
+resource "google_container_cluster" "primary" {
+  name               = "<%= ctx[:vars]['name'] %>-cluster"
+  location           = "us-central1"
+  initial_node_count = 1
+  workload_identity_config {
+    workload_pool = "<%= ctx[:test_env_vars]['project'] %>.svc.id.goog"
+  }
+  addons_config {
+    gke_backup_agent_config {
+      enabled = true
+    }
+  }
+  deletion_protection  = "<%= ctx[:vars]['deletion_protection'] %>"
+}
+
+resource "google_gke_backup_backup_plan" "basic" {
+  name = "<%= ctx[:vars]['name'] %>"
+  cluster = google_container_cluster.primary.id
+  location = "us-central1"
+  backup_config {
+    include_volume_data = true
+    include_secrets = true
+    all_namespaces = true
+  }
+}
+
+resource "google_gke_backup_restore_plan" "all_ns" {
+  name = "<%= ctx[:vars]['name'] %>"
+  location = "us-central1"
+  backup_plan = google_gke_backup_backup_plan.basic.id
+  cluster = google_container_cluster.primary.id
+  restore_config {
+    all_namespaces = true
+    namespaced_resource_restore_mode = "FAIL_ON_CONFLICT"
+    volume_data_restore_policy = "RESTORE_VOLUME_DATA_FROM_BACKUP"
+    cluster_resource_restore_scope {
+      all_group_kinds = true
+    }
+    cluster_resource_conflict_policy = "USE_EXISTING_VERSION"
+  }
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/gkebackup_restoreplan_protected_application.tf.erb b/mmv1/templates/terraform/examples/gkebackup_restoreplan_protected_application.tf.erb
new file mode 100644
index 000000000000..25b7a878e78a
--- /dev/null
+++ b/mmv1/templates/terraform/examples/gkebackup_restoreplan_protected_application.tf.erb
@@ -0,0 +1,45 @@
+resource "google_container_cluster" "primary" {
+  name               = "<%= ctx[:vars]['name'] %>-cluster"
+  location           = "us-central1"
+  initial_node_count = 1
+  workload_identity_config {
+    workload_pool = "<%= ctx[:test_env_vars]['project'] %>.svc.id.goog"
+  }
+  addons_config {
+    gke_backup_agent_config {
+      enabled = true
+    }
+  }
+  deletion_protection  = "<%= ctx[:vars]['deletion_protection'] %>"
+}
+
+resource "google_gke_backup_backup_plan" "basic" {
+  name = "<%= ctx[:vars]['name'] %>"
+  cluster = google_container_cluster.primary.id
+  location = "us-central1"
+  backup_config {
+    include_volume_data = true
+    include_secrets = true
+    all_namespaces = true
+  }
+}
+
+resource "google_gke_backup_restore_plan" "rollback_app" {
+  name = "<%= ctx[:vars]['name'] %>-rp"
+  location = "us-central1"
+  backup_plan = google_gke_backup_backup_plan.basic.id
+  cluster = google_container_cluster.primary.id
+  restore_config {
+    selected_applications {
+      namespaced_names {
+        name = "my-app"
+        namespace = "my-ns"
+      }
+    }
+    namespaced_resource_restore_mode = "DELETE_AND_RESTORE"
+    volume_data_restore_policy = "REUSE_VOLUME_HANDLE_FROM_BACKUP"
+    cluster_resource_restore_scope {
+      no_group_kinds = true
+    }
+  }
+}
diff --git a/mmv1/templates/terraform/examples/gkebackup_restoreplan_rename_namespace.tf.erb b/mmv1/templates/terraform/examples/gkebackup_restoreplan_rename_namespace.tf.erb
new file mode 100644
index 000000000000..7a3496f87c85
--- /dev/null
+++ b/mmv1/templates/terraform/examples/gkebackup_restoreplan_rename_namespace.tf.erb
@@ -0,0 +1,67 @@
+resource "google_container_cluster" "primary" {
+  name               = "<%= ctx[:vars]['name'] %>-cluster"
+  location           = "us-central1"
+  initial_node_count = 1
+  workload_identity_config {
+    workload_pool = "<%= ctx[:test_env_vars]['project'] %>.svc.id.goog"
+  }
+  addons_config {
+    gke_backup_agent_config {
+      enabled = true
+    }
+  }
+  deletion_protection  = "<%= ctx[:vars]['deletion_protection'] %>"
+}
+
+resource "google_gke_backup_backup_plan" "basic" {
+  name = "<%= ctx[:vars]['name'] %>"
+  cluster = google_container_cluster.primary.id
+  location = "us-central1"
+  backup_config {
+    include_volume_data = true
+    include_secrets = true
+    all_namespaces = true
+  }
+}
+
+resource "google_gke_backup_restore_plan" "rename_ns" {
+  name = "<%= ctx[:vars]['name'] %>-rp"
+  location = "us-central1"
+  backup_plan = google_gke_backup_backup_plan.basic.id
+  cluster = google_container_cluster.primary.id
+  restore_config {
+    selected_namespaces {
+      namespaces = ["ns1"]
+    }
+    namespaced_resource_restore_mode = "FAIL_ON_CONFLICT"
+    volume_data_restore_policy = "REUSE_VOLUME_HANDLE_FROM_BACKUP"
+    cluster_resource_restore_scope {
+      no_group_kinds = true
+    }
+    transformation_rules {
+      description = "rename namespace from ns1 to ns2"
+      resource_filter {
+        group_kinds {
+          resource_kind = "Namespace"
+        }
+        json_path = ".metadata[?(@.name == 'ns1')]"
+      }
+      field_actions {
+        op = "REPLACE"
+        path = "/metadata/name"
+        value = "ns2"
+      }
+    }
+    transformation_rules {
+      description = "move all resources from ns1 to ns2"
+      resource_filter {
+        namespaces = ["ns1"]
+      }
+      field_actions {
+        op = "REPLACE"
+        path = "/metadata/namespace"
+        value = "ns2"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/gkebackup_restoreplan_rollback_namespace.tf.erb b/mmv1/templates/terraform/examples/gkebackup_restoreplan_rollback_namespace.tf.erb
new file mode 100644
index 000000000000..61081b246b51
--- /dev/null
+++ b/mmv1/templates/terraform/examples/gkebackup_restoreplan_rollback_namespace.tf.erb
@@ -0,0 +1,50 @@
+resource "google_container_cluster" "primary" {
+  name               = "<%= ctx[:vars]['name'] %>-cluster"
+  location           = "us-central1"
+  initial_node_count = 1
+  workload_identity_config {
+    workload_pool = "<%= ctx[:test_env_vars]['project'] %>.svc.id.goog"
+  }
+  addons_config {
+    gke_backup_agent_config {
+      enabled = true
+    }
+  }
+  deletion_protection  = "<%= ctx[:vars]['deletion_protection'] %>"
+}
+
+resource "google_gke_backup_backup_plan" "basic" {
+  name = "<%= ctx[:vars]['name'] %>"
+  cluster = google_container_cluster.primary.id
+  location = "us-central1"
+  backup_config {
+    include_volume_data = true
+    include_secrets = true
+    all_namespaces = true
+  }
+}
+
+resource "google_gke_backup_restore_plan" "rollback_ns" {
+  name = "<%= ctx[:vars]['name'] %>-rp"
+  location = "us-central1"
+  backup_plan = google_gke_backup_backup_plan.basic.id
+  cluster = google_container_cluster.primary.id
+  restore_config {
+    selected_namespaces {
+      namespaces = ["my-ns"]
+    }
+    namespaced_resource_restore_mode = "DELETE_AND_RESTORE"
+    volume_data_restore_policy = "RESTORE_VOLUME_DATA_FROM_BACKUP"
+    cluster_resource_restore_scope {
+      selected_group_kinds {
+        resource_group = "apiextension.k8s.io"
+        resource_kind = "CustomResourceDefinition"
+      }
+      selected_group_kinds {
+        resource_group = "storage.k8s.io"
+        resource_kind = "StorageClass"
+      }
+    }
+    cluster_resource_conflict_policy = "USE_EXISTING_VERSION"
+  }
+}
diff --git a/mmv1/templates/terraform/examples/gkebackup_restoreplan_second_transformation.tf.erb b/mmv1/templates/terraform/examples/gkebackup_restoreplan_second_transformation.tf.erb
new file mode 100644
index 000000000000..e0dbd69e4f73
--- /dev/null
+++ b/mmv1/templates/terraform/examples/gkebackup_restoreplan_second_transformation.tf.erb
@@ -0,0 +1,65 @@
+resource "google_container_cluster" "primary" {
+  name               = "<%= ctx[:vars]['name'] %>-cluster"
+  location           = "us-central1"
+  initial_node_count = 1
+  workload_identity_config {
+    workload_pool = "<%= ctx[:test_env_vars]['project'] %>.svc.id.goog"
+  }
+  addons_config {
+    gke_backup_agent_config {
+      enabled = true
+    }
+  }
+  deletion_protection  = "<%= ctx[:vars]['deletion_protection'] %>"
+}
+
+resource "google_gke_backup_backup_plan" "basic" {
+  name = "<%= ctx[:vars]['name'] %>"
+  cluster = google_container_cluster.primary.id
+  location = "us-central1"
+  backup_config {
+    include_volume_data = true
+    include_secrets = true
+    all_namespaces = true
+  }
+}
+
+resource "google_gke_backup_restore_plan" "transform_rule" {
+  name = "<%= ctx[:vars]['name'] %>-rp"
+  description = "copy nginx env variables"
+  labels = {
+    "app" = "nginx"
+  }
+  location = "us-central1"
+  backup_plan = google_gke_backup_backup_plan.basic.id
+  cluster = google_container_cluster.primary.id
+  restore_config {
+    excluded_namespaces {
+      namespaces = ["my-ns"]
+    }
+    namespaced_resource_restore_mode = "DELETE_AND_RESTORE"
+    volume_data_restore_policy = "RESTORE_VOLUME_DATA_FROM_BACKUP"
+    cluster_resource_restore_scope {
+      excluded_group_kinds {
+        resource_group = "apiextension.k8s.io"
+        resource_kind = "CustomResourceDefinition"
+      }
+    }
+    cluster_resource_conflict_policy = "USE_EXISTING_VERSION"
+    transformation_rules {
+      description = "Copy environment variables from the nginx container to the install init container."
+      resource_filter {
+        group_kinds {
+          resource_kind = "Pod"
+          resource_group = ""
+        }
+        json_path = ".metadata[?(@.name == 'nginx')]"
+      }
+      field_actions {
+        op = "COPY"
+        path = "/spec/initContainers/0/env"
+        from_path = "/spec/containers/0/env"
+      }
+    }
+  }
+}
diff --git a/mmv1/templates/terraform/examples/gkehub_fleet_basic.tf.erb b/mmv1/templates/terraform/examples/gkehub_fleet_basic.tf.erb
new file mode 100644
index 000000000000..be6737b95efd
--- /dev/null
+++ b/mmv1/templates/terraform/examples/gkehub_fleet_basic.tf.erb
@@ -0,0 +1,3 @@
+resource "google_gke_hub_fleet" "default" {
+  display_name = "my production fleet"
+}
diff --git a/mmv1/templates/terraform/examples/gkehub_membership_basic.tf.erb b/mmv1/templates/terraform/examples/gkehub_membership_basic.tf.erb
index 0cd1916c20eb..61478e731374 100644
--- a/mmv1/templates/terraform/examples/gkehub_membership_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/gkehub_membership_basic.tf.erb
@@ -2,6 +2,7 @@ resource "google_container_cluster" "primary" {
   name               = "<%= ctx[:vars]['cluster_name'] %>"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection  = "<%= ctx[:vars]['deletion_protection'] %>"
 }
 
 resource "google_gke_hub_membership" "membership" {
@@ -11,4 +12,8 @@ resource "google_gke_hub_membership" "membership" {
       resource_link = "//container.googleapis.com/${google_container_cluster.primary.id}"
     }
   }
+
+  labels = {
+    env = "test"
+  }
 }
diff --git a/mmv1/templates/terraform/examples/gkehub_membership_binding_basic.tf.erb b/mmv1/templates/terraform/examples/gkehub_membership_binding_basic.tf.erb
index e99bb4ec5577..0546117e82df 100644
--- a/mmv1/templates/terraform/examples/gkehub_membership_binding_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/gkehub_membership_binding_basic.tf.erb
@@ -2,9 +2,10 @@ resource "google_container_cluster" "primary" {
   name               = "<%= ctx[:vars]['cluster_name'] %>"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection  = "<%= ctx[:vars]['deletion_protection'] %>"
 }
 
-resource "google_gke_hub_membership" "<%= ctx[:primary_resource_id] %>" {
+resource "google_gke_hub_membership" "membership" {
   membership_id = "tf-test-membership%{random_suffix}"
   endpoint {
     gke_cluster {
@@ -15,14 +16,14 @@ resource "google_gke_hub_membership" "<%= ctx[:primary_resource_id] %>" {
   depends_on = [google_container_cluster.primary]
 }
 
-resource "google_gke_hub_scope" "<%= ctx[:primary_resource_id] %>" {
+resource "google_gke_hub_scope" "scope" {
   scope_id = "tf-test-scope%{random_suffix}"
 }
 
 resource "google_gke_hub_membership_binding" "<%= ctx[:primary_resource_id] %>" {
   membership_binding_id = "tf-test-membership-binding%{random_suffix}"
-  scope = google_gke_hub_scope.<%= ctx[:primary_resource_id] %>.name
-  membership_id = "tf-test-membership%{random_suffix}"
+  scope = google_gke_hub_scope.scope.name
+  membership_id = google_gke_hub_membership.membership.membership_id
   location = "global"
   labels = {
       keyb = "valueb"
@@ -30,7 +31,7 @@ resource "google_gke_hub_membership_binding" "<%= ctx[:primary_resource_id] %>"
       keyc = "valuec" 
   }
   depends_on = [
-    google_gke_hub_membership.<%= ctx[:primary_resource_id] %>,
-    google_gke_hub_scope.<%= ctx[:primary_resource_id] %>
+    google_gke_hub_membership.membership,
+    google_gke_hub_scope.scope
   ]
 }
diff --git a/mmv1/templates/terraform/examples/gkehub_membership_issuer.tf.erb b/mmv1/templates/terraform/examples/gkehub_membership_issuer.tf.erb
index 159ae9de7067..a6b6c55c682b 100644
--- a/mmv1/templates/terraform/examples/gkehub_membership_issuer.tf.erb
+++ b/mmv1/templates/terraform/examples/gkehub_membership_issuer.tf.erb
@@ -5,6 +5,7 @@ resource "google_container_cluster" "primary" {
   workload_identity_config {
     workload_pool = "<%= ctx[:test_env_vars]['project'] %>.svc.id.goog"
   }
+  deletion_protection  = "<%= ctx[:vars]['deletion_protection'] %>"
 }
 
 resource "google_gke_hub_membership" "membership" {
diff --git a/mmv1/templates/terraform/examples/gkehub_membership_rbac_role_binding_basic.tf.erb b/mmv1/templates/terraform/examples/gkehub_membership_rbac_role_binding_basic.tf.erb
index 7c117e3f2426..1e7a81993016 100644
--- a/mmv1/templates/terraform/examples/gkehub_membership_rbac_role_binding_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/gkehub_membership_rbac_role_binding_basic.tf.erb
@@ -3,9 +3,10 @@ resource "google_container_cluster" "primary" {
   name               = "<%= ctx[:vars]['cluster_name'] %>"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection  = "<%= ctx[:vars]['deletion_protection'] %>"
 }
 
-resource "google_gke_hub_membership" "<%= ctx[:primary_resource_id] %>" {
+resource "google_gke_hub_membership" "membership" {
   provider = google-beta
   membership_id = "tf-test-membership%{random_suffix}"
   endpoint {
@@ -20,13 +21,13 @@ resource "google_gke_hub_membership" "<%= ctx[:primary_resource_id] %>" {
 resource "google_gke_hub_membership_rbac_role_binding" "<%= ctx[:primary_resource_id] %>" {
   provider = google-beta
   membership_rbac_role_binding_id = "tf-test-membership-rbac-role-binding%{random_suffix}"
-  membership_id = "tf-test-membership%{random_suffix}"
+  membership_id = google_gke_hub_membership.membership.membership_id
   user = "service-${data.google_project.project.number}@gcp-sa-anthossupport.iam.gserviceaccount.com"
   role {
     predefined_role = "ANTHOS_SUPPORT"
   }
   location = "global"
-  depends_on = [google_gke_hub_membership.<%= ctx[:primary_resource_id] %>]
+  depends_on = [google_gke_hub_membership.membership]
 }
 
 data "google_project" "project" {
diff --git a/mmv1/templates/terraform/examples/gkehub_membership_regional.tf.erb b/mmv1/templates/terraform/examples/gkehub_membership_regional.tf.erb
new file mode 100644
index 000000000000..5b4852f2f9e3
--- /dev/null
+++ b/mmv1/templates/terraform/examples/gkehub_membership_regional.tf.erb
@@ -0,0 +1,16 @@
+resource "google_container_cluster" "primary" {
+  name               = "<%= ctx[:vars]['cluster_name'] %>"
+  location           = "us-central1-a"
+  initial_node_count = 1
+  deletion_protection = false
+}
+
+resource "google_gke_hub_membership" "membership" {
+  membership_id = "<%= ctx[:vars]['name'] %>"
+  location = "<%= ctx[:test_env_vars]['location'] %>"
+  endpoint {
+    gke_cluster {
+      resource_link = "//container.googleapis.com/${google_container_cluster.primary.id}"
+    }
+  }
+}
diff --git a/mmv1/templates/terraform/examples/gkehub_namespace_basic.tf.erb b/mmv1/templates/terraform/examples/gkehub_namespace_basic.tf.erb
index c0d4a6265fec..e09137e9d016 100644
--- a/mmv1/templates/terraform/examples/gkehub_namespace_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/gkehub_namespace_basic.tf.erb
@@ -1,12 +1,12 @@
-resource "google_gke_hub_scope" "<%= ctx[:primary_resource_id] %>" {
+resource "google_gke_hub_scope" "scope" {
   scope_id = "tf-test-scope%{random_suffix}"
 }
 
 
 resource "google_gke_hub_namespace" "<%= ctx[:primary_resource_id] %>" { 
   scope_namespace_id = "tf-test-namespace%{random_suffix}"
-  scope_id = "tf-test-scope%{random_suffix}"
-  scope = "${google_gke_hub_scope.<%= ctx[:primary_resource_id] %>.name}"
+  scope_id = google_gke_hub_scope.scope.scope_id
+  scope = google_gke_hub_scope.scope.name
   namespace_labels = {
       keyb = "valueb"
       keya = "valuea"
@@ -17,5 +17,5 @@ resource "google_gke_hub_namespace" "<%= ctx[:primary_resource_id] %>" {
       keya = "valuea"
       keyc = "valuec" 
   }
-  depends_on = [google_gke_hub_scope.<%= ctx[:primary_resource_id] %>]
+  depends_on = [google_gke_hub_scope.scope]
 }
diff --git a/mmv1/templates/terraform/examples/gkehub_scope_basic.tf.erb b/mmv1/templates/terraform/examples/gkehub_scope_basic.tf.erb
index b00de37a00cd..9585375e4e1f 100644
--- a/mmv1/templates/terraform/examples/gkehub_scope_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/gkehub_scope_basic.tf.erb
@@ -1,3 +1,8 @@
 resource "google_gke_hub_scope" "<%= ctx[:primary_resource_id] %>" {
   scope_id = "tf-test-scope%{random_suffix}"
+  labels = {
+      keyb = "valueb"
+      keya = "valuea"
+      keyc = "valuec" 
+  }
 }
diff --git a/mmv1/templates/terraform/examples/gkehub_scope_rbac_role_binding_basic.tf.erb b/mmv1/templates/terraform/examples/gkehub_scope_rbac_role_binding_basic.tf.erb
index 1978f80d0e01..bb4bd7c43ed0 100644
--- a/mmv1/templates/terraform/examples/gkehub_scope_rbac_role_binding_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/gkehub_scope_rbac_role_binding_basic.tf.erb
@@ -1,10 +1,10 @@
-resource "google_gke_hub_scope" "<%= ctx[:primary_resource_id] %>" {
+resource "google_gke_hub_scope" "scope" {
   scope_id = "tf-test-scope%{random_suffix}"
 }
 
 resource "google_gke_hub_scope_rbac_role_binding" "<%= ctx[:primary_resource_id] %>" {
   scope_rbac_role_binding_id = "tf-test-scope-rbac-role-binding%{random_suffix}"
-  scope_id = "tf-test-scope%{random_suffix}"
+  scope_id = google_gke_hub_scope.scope.scope_id
   user = "test-email@gmail.com"
   role {
     predefined_role = "ADMIN"
@@ -12,6 +12,6 @@ resource "google_gke_hub_scope_rbac_role_binding" "<%= ctx[:primary_resource_id]
   labels = {
       key = "value" 
   }
-  depends_on = [google_gke_hub_scope.<%= ctx[:primary_resource_id] %>]
+  depends_on = [google_gke_hub_scope.scope]
 }
 
diff --git a/mmv1/templates/terraform/examples/gkeonprem_bare_metal_admin_cluster_basic.tf.erb b/mmv1/templates/terraform/examples/gkeonprem_bare_metal_admin_cluster_basic.tf.erb
index af70a9f45935..5143587838e3 100644
--- a/mmv1/templates/terraform/examples/gkeonprem_bare_metal_admin_cluster_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/gkeonprem_bare_metal_admin_cluster_basic.tf.erb
@@ -1,5 +1,4 @@
 resource "google_gkeonprem_bare_metal_admin_cluster" "<%= ctx[:primary_resource_id] %>" {
-  provider = google-beta
   name = "<%= ctx[:vars]['name'] %>"
   location = "us-west1"
   bare_metal_version = "1.13.4"
diff --git a/mmv1/templates/terraform/examples/gkeonprem_bare_metal_admin_cluster_full.tf.erb b/mmv1/templates/terraform/examples/gkeonprem_bare_metal_admin_cluster_full.tf.erb
index 58046c4f55cc..7aeccf1e06fe 100644
--- a/mmv1/templates/terraform/examples/gkeonprem_bare_metal_admin_cluster_full.tf.erb
+++ b/mmv1/templates/terraform/examples/gkeonprem_bare_metal_admin_cluster_full.tf.erb
@@ -1,10 +1,11 @@
 resource "google_gkeonprem_bare_metal_admin_cluster" "<%= ctx[:primary_resource_id] %>" {
-  provider = google-beta
   name = "<%= ctx[:vars]['name'] %>"
   location = "us-west1"
   description = "test description"
   bare_metal_version = "1.13.4"
-  annotations = {}
+  annotations = {
+    env = "test"
+  }
   network_config {
     island_mode_cidr {
       service_address_cidr_blocks = ["172.26.0.0/16"]
diff --git a/mmv1/templates/terraform/examples/gkeonprem_bare_metal_cluster_basic.tf.erb b/mmv1/templates/terraform/examples/gkeonprem_bare_metal_cluster_basic.tf.erb
index 7eef45455ab7..a4f6603803ff 100644
--- a/mmv1/templates/terraform/examples/gkeonprem_bare_metal_cluster_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/gkeonprem_bare_metal_cluster_basic.tf.erb
@@ -1,5 +1,4 @@
 resource "google_gkeonprem_bare_metal_cluster" "<%= ctx[:primary_resource_id] %>" {
-  provider = google-beta
   name = "<%= ctx[:vars]['name'] %>"
   location = "us-west1"
   admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
diff --git a/mmv1/templates/terraform/examples/gkeonprem_bare_metal_cluster_bgplb.tf.erb b/mmv1/templates/terraform/examples/gkeonprem_bare_metal_cluster_bgplb.tf.erb
index 1b76b720ef3d..9a67a2961790 100644
--- a/mmv1/templates/terraform/examples/gkeonprem_bare_metal_cluster_bgplb.tf.erb
+++ b/mmv1/templates/terraform/examples/gkeonprem_bare_metal_cluster_bgplb.tf.erb
@@ -1,5 +1,4 @@
 resource "google_gkeonprem_bare_metal_cluster" "<%= ctx[:primary_resource_id] %>" {
-  provider = google-beta
   name = "<%= ctx[:vars]['name'] %>"
   location = "us-west1"
   admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
diff --git a/mmv1/templates/terraform/examples/gkeonprem_bare_metal_cluster_manuallb.tf.erb b/mmv1/templates/terraform/examples/gkeonprem_bare_metal_cluster_manuallb.tf.erb
index 639fdbea058b..318dfdaf6a82 100644
--- a/mmv1/templates/terraform/examples/gkeonprem_bare_metal_cluster_manuallb.tf.erb
+++ b/mmv1/templates/terraform/examples/gkeonprem_bare_metal_cluster_manuallb.tf.erb
@@ -1,5 +1,4 @@
 resource "google_gkeonprem_bare_metal_cluster" "<%= ctx[:primary_resource_id] %>" {
-  provider = google-beta
   name = "<%= ctx[:vars]['name'] %>"
   location = "us-west1"
   admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
diff --git a/mmv1/templates/terraform/examples/gkeonprem_bare_metal_node_pool_basic.tf.erb b/mmv1/templates/terraform/examples/gkeonprem_bare_metal_node_pool_basic.tf.erb
index 4f3ad2ac3d57..e8a629a1e606 100644
--- a/mmv1/templates/terraform/examples/gkeonprem_bare_metal_node_pool_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/gkeonprem_bare_metal_node_pool_basic.tf.erb
@@ -1,5 +1,4 @@
 resource "google_gkeonprem_bare_metal_cluster" "default-basic" {
-  provider = google-beta
   name = "<%= ctx[:vars]['cluster'] %>"
   location = "us-west1"
   admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
@@ -70,7 +69,6 @@ resource "google_gkeonprem_bare_metal_cluster" "default-basic" {
 }
 
 resource "google_gkeonprem_bare_metal_node_pool" "<%= ctx[:primary_resource_id] %>" {
-  provider = google-beta
   name =  "<%= ctx[:vars]['name'] %>"
   bare_metal_cluster =  google_gkeonprem_bare_metal_cluster.default-basic.name
   location = "us-west1"
diff --git a/mmv1/templates/terraform/examples/gkeonprem_bare_metal_node_pool_full.tf.erb b/mmv1/templates/terraform/examples/gkeonprem_bare_metal_node_pool_full.tf.erb
index 2675c8b9d9d4..4f5b096a90a4 100644
--- a/mmv1/templates/terraform/examples/gkeonprem_bare_metal_node_pool_full.tf.erb
+++ b/mmv1/templates/terraform/examples/gkeonprem_bare_metal_node_pool_full.tf.erb
@@ -1,5 +1,4 @@
 resource "google_gkeonprem_bare_metal_cluster" "default-full" {
-  provider = google-beta
   name = "<%= ctx[:vars]['cluster'] %>"
   location = "us-west1"
   admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
@@ -70,7 +69,6 @@ resource "google_gkeonprem_bare_metal_cluster" "default-full" {
 }
 
 resource "google_gkeonprem_bare_metal_node_pool" "<%= ctx[:primary_resource_id] %>" {
-  provider = google-beta
   name =  "<%= ctx[:vars]['name'] %>"
   display_name = "test-name"
   bare_metal_cluster =  google_gkeonprem_bare_metal_cluster.default-full.name
diff --git a/mmv1/templates/terraform/examples/gkeonprem_vmware_cluster_basic.tf.erb b/mmv1/templates/terraform/examples/gkeonprem_vmware_cluster_basic.tf.erb
index 0407279358d1..3146d5a4c317 100644
--- a/mmv1/templates/terraform/examples/gkeonprem_vmware_cluster_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/gkeonprem_vmware_cluster_basic.tf.erb
@@ -1,5 +1,4 @@
 resource "google_gkeonprem_vmware_cluster" "<%= ctx[:primary_resource_id] %>" {
-  provider = google-beta
   name = "<%= ctx[:vars]['name'] %>"
   location = "us-west1"
   admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
diff --git a/mmv1/templates/terraform/examples/gkeonprem_vmware_cluster_f5lb.tf.erb b/mmv1/templates/terraform/examples/gkeonprem_vmware_cluster_f5lb.tf.erb
index e5577dcd4b7a..3f9f6a15c69b 100644
--- a/mmv1/templates/terraform/examples/gkeonprem_vmware_cluster_f5lb.tf.erb
+++ b/mmv1/templates/terraform/examples/gkeonprem_vmware_cluster_f5lb.tf.erb
@@ -1,5 +1,4 @@
 resource "google_gkeonprem_vmware_cluster" "<%= ctx[:primary_resource_id] %>" {
-  provider = google-beta  
   name = "<%= ctx[:vars]['name'] %>"
   location = "us-west1"
   admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
diff --git a/mmv1/templates/terraform/examples/gkeonprem_vmware_cluster_manuallb.tf.erb b/mmv1/templates/terraform/examples/gkeonprem_vmware_cluster_manuallb.tf.erb
index 2d9a654b48fa..8e7b695d57c3 100644
--- a/mmv1/templates/terraform/examples/gkeonprem_vmware_cluster_manuallb.tf.erb
+++ b/mmv1/templates/terraform/examples/gkeonprem_vmware_cluster_manuallb.tf.erb
@@ -1,5 +1,4 @@
 resource "google_gkeonprem_vmware_cluster" "<%= ctx[:primary_resource_id] %>" {
-  provider = google-beta
   name = "<%= ctx[:vars]['name'] %>"
   location = "us-west1"
   admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
@@ -58,6 +57,15 @@ resource "google_gkeonprem_vmware_cluster" "<%= ctx[:primary_resource_id] %>" {
       konnectivity_server_node_port = 30008
     }
   }
+  vcenter {
+    resource_pool = "test-resource-pool"
+    datastore = "test-datastore"
+    datacenter = "test-datacenter"
+    cluster = "test-cluster"
+    folder = "test-folder"
+    ca_cert_data = "test-ca-cert-data"
+    storage_policy_name = "test-storage-policy-name"
+  }
   dataplane_v2 {
     dataplane_v2_enabled = true
     windows_dataplane_v2_enabled = true
diff --git a/mmv1/templates/terraform/examples/gkeonprem_vmware_node_pool_basic.tf.erb b/mmv1/templates/terraform/examples/gkeonprem_vmware_node_pool_basic.tf.erb
index 2386e5f7bb61..850f6a1de6ab 100644
--- a/mmv1/templates/terraform/examples/gkeonprem_vmware_node_pool_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/gkeonprem_vmware_node_pool_basic.tf.erb
@@ -1,5 +1,4 @@
 resource "google_gkeonprem_vmware_cluster" "default-basic" {
-  provider = google-beta
   name = "<%= ctx[:vars]['cluster'] %>"
   location = "us-west1"
   admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
@@ -38,7 +37,6 @@ resource "google_gkeonprem_vmware_cluster" "default-basic" {
 }
 
 resource "google_gkeonprem_vmware_node_pool" "<%= ctx[:primary_resource_id] %>" {
-  provider = google-beta
   name = "<%= ctx[:vars]['name'] %>"
   location = "us-west1"
   vmware_cluster = google_gkeonprem_vmware_cluster.default-basic.name
diff --git a/mmv1/templates/terraform/examples/gkeonprem_vmware_node_pool_full.tf.erb b/mmv1/templates/terraform/examples/gkeonprem_vmware_node_pool_full.tf.erb
index 57e14aa80960..dea7971e83d1 100644
--- a/mmv1/templates/terraform/examples/gkeonprem_vmware_node_pool_full.tf.erb
+++ b/mmv1/templates/terraform/examples/gkeonprem_vmware_node_pool_full.tf.erb
@@ -1,5 +1,4 @@
 resource "google_gkeonprem_vmware_cluster" "default-full" {
-  provider = google-beta
   name = "<%= ctx[:vars]['cluster'] %>"
   location = "us-west1"
   admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
@@ -38,7 +37,6 @@ resource "google_gkeonprem_vmware_cluster" "default-full" {
 }
 
 resource "google_gkeonprem_vmware_node_pool" "<%= ctx[:primary_resource_id] %>" {
-  provider = google-beta
   name = "<%= ctx[:vars]['name'] %>"
   location = "us-west1"
   vmware_cluster = google_gkeonprem_vmware_cluster.default-full.name
diff --git a/mmv1/templates/terraform/examples/iam_deny_policy_basic.tf.erb b/mmv1/templates/terraform/examples/iam_deny_policy_basic.tf.erb
index fcca132b6cd8..ce12af38140c 100644
--- a/mmv1/templates/terraform/examples/iam_deny_policy_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/iam_deny_policy_basic.tf.erb
@@ -17,7 +17,7 @@ resource "google_iam_deny_policy" "<%= ctx[:primary_resource_id] %>" {
         title = "Some expr"
         expression = "!resource.matchTag('12345678/env', 'test')"
       }
-      denied_permissions = ["cloudresourcemanager.googleapis.com/projects.delete"]
+      denied_permissions = ["cloudresourcemanager.googleapis.com/projects.update"]
     }
   }
   rules {
@@ -28,7 +28,7 @@ resource "google_iam_deny_policy" "<%= ctx[:primary_resource_id] %>" {
         title = "Some expr"
         expression = "!resource.matchTag('12345678/env', 'test')"
       }
-      denied_permissions = ["cloudresourcemanager.googleapis.com/projects.delete"]
+      denied_permissions = ["cloudresourcemanager.googleapis.com/projects.update"]
       exception_principals = ["principal://iam.googleapis.com/projects/-/serviceAccounts/${google_service_account.test-account.email}"]
     }
   }
diff --git a/mmv1/templates/terraform/examples/iam_workforce_pool_provider_oidc_upload_key.tf.erb b/mmv1/templates/terraform/examples/iam_workforce_pool_provider_oidc_upload_key.tf.erb
index 3080784fce8d..fb0b78eafed5 100644
--- a/mmv1/templates/terraform/examples/iam_workforce_pool_provider_oidc_upload_key.tf.erb
+++ b/mmv1/templates/terraform/examples/iam_workforce_pool_provider_oidc_upload_key.tf.erb
@@ -1,14 +1,10 @@
 resource "google_iam_workforce_pool" "pool" {
-  provider = google-beta
-
   workforce_pool_id = "<%= ctx[:vars]["workforce_pool_id"] %>"
   parent            = "organizations/<%= ctx[:test_env_vars]["org_id"] %>"
   location          = "global"
 }
 
 resource "google_iam_workforce_pool_provider" "<%= ctx[:primary_resource_id] %>" {
-  provider = google-beta
-
   workforce_pool_id  = google_iam_workforce_pool.pool.workforce_pool_id
   location           = google_iam_workforce_pool.pool.location
   provider_id        = "<%= ctx[:vars]["provider_id"] %>"
diff --git a/mmv1/templates/terraform/examples/identity_platform_config_basic.tf.erb b/mmv1/templates/terraform/examples/identity_platform_config_basic.tf.erb
index 9880802797c2..0405bf9620ea 100644
--- a/mmv1/templates/terraform/examples/identity_platform_config_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/identity_platform_config_basic.tf.erb
@@ -13,10 +13,34 @@ resource "google_project_service" "identitytoolkit" {
   service = "identitytoolkit.googleapis.com"
 }
 
-
 resource "google_identity_platform_config" "default" {
   project = google_project.default.project_id
   autodelete_anonymous_users = true
+  sign_in {
+    allow_duplicate_emails = true
+   
+    anonymous {
+        enabled = true
+    }
+    email {
+        enabled = true
+        password_required = false
+    }
+    phone_number {
+        enabled = true
+        test_phone_numbers = {
+            "+11231231234" = "000000"
+        }
+    }
+  }
+  sms_region_config {
+    allowlist_only {
+      allowed_regions = [
+        "US",
+        "CA",
+      ]
+    }
+  }
   blocking_functions {
     triggers {
       event_type = "beforeSignIn"
diff --git a/mmv1/templates/terraform/examples/identity_platform_config_minimal.tf.erb b/mmv1/templates/terraform/examples/identity_platform_config_minimal.tf.erb
index 4a9299dec8c8..c026f04822fc 100644
--- a/mmv1/templates/terraform/examples/identity_platform_config_minimal.tf.erb
+++ b/mmv1/templates/terraform/examples/identity_platform_config_minimal.tf.erb
@@ -16,4 +16,8 @@ resource "google_project_service" "identitytoolkit" {
 
 resource "google_identity_platform_config" "default" {
   project = google_project.default.project_id
+  
+  depends_on = [
+    google_project_service.identitytoolkit
+  ]
 }
diff --git a/mmv1/templates/terraform/examples/instance_group_named_port_gke.tf.erb b/mmv1/templates/terraform/examples/instance_group_named_port_gke.tf.erb
index 3a4b492eca8a..32d2d23c876e 100644
--- a/mmv1/templates/terraform/examples/instance_group_named_port_gke.tf.erb
+++ b/mmv1/templates/terraform/examples/instance_group_named_port_gke.tf.erb
@@ -38,4 +38,5 @@ resource "google_container_cluster" "my_cluster" {
     cluster_ipv4_cidr_block  = "/19"
     services_ipv4_cidr_block = "/22"
   }
+  deletion_protection  = "<%= ctx[:vars]['deletion_protection'] %>"
 }
diff --git a/mmv1/templates/terraform/examples/instance_settings_basic.tf.erb b/mmv1/templates/terraform/examples/instance_settings_basic.tf.erb
new file mode 100644
index 000000000000..639c31f41293
--- /dev/null
+++ b/mmv1/templates/terraform/examples/instance_settings_basic.tf.erb
@@ -0,0 +1,13 @@
+# [START instance_settings_basic]
+
+resource "google_compute_instance_settings" "<%= ctx[:primary_resource_id] %>" {
+  provider = google-beta
+  zone = "us-east7-b"
+  metadata {
+    items = {
+      foo = "baz"
+    }
+  }
+}
+
+# [END instance_settings_basic]
diff --git a/mmv1/templates/terraform/examples/integration_connectors_connection_advanced.tf.erb b/mmv1/templates/terraform/examples/integration_connectors_connection_advanced.tf.erb
new file mode 100644
index 000000000000..7c40d7c53f77
--- /dev/null
+++ b/mmv1/templates/terraform/examples/integration_connectors_connection_advanced.tf.erb
@@ -0,0 +1,232 @@
+data "google_project" "test_project" {
+}
+
+resource "google_secret_manager_secret" "secret-basic" {
+  secret_id     = "<%= ctx[:vars]['secret_id'] %>"
+  replication {
+    user_managed {
+      replicas {
+        location = "us-central1"
+      }
+    }
+  }
+}
+
+
+resource "google_secret_manager_secret_version" "secret-version-basic" {
+  secret = google_secret_manager_secret.secret-basic.id
+  secret_data = "dummypassword"
+}
+
+resource "google_secret_manager_secret_iam_member" "secret_iam" {
+  secret_id  = google_secret_manager_secret.secret-basic.id
+  role       = "roles/secretmanager.admin"
+  member     = "serviceAccount:${data.google_project.test_project.number}-compute@developer.gserviceaccount.com"
+  depends_on = [google_secret_manager_secret_version.secret-version-basic]
+}
+
+resource "google_integration_connectors_connection" "<%= ctx[:primary_resource_id] %>" {
+  name     = "<%= ctx[:vars]['connection_name'] %>"
+  description = "tf updated description"
+  location = "us-central1"
+  service_account = "${data.google_project.test_project.number}-compute@developer.gserviceaccount.com"
+  connector_version = "projects/${data.google_project.test_project.project_id}/locations/global/providers/zendesk/connectors/zendesk/versions/1"
+  config_variable {
+      key = "proxy_enabled"
+      boolean_value = false
+  }
+  config_variable {
+    key = "sample_integer_value"
+    integer_value = 1
+  }
+
+  config_variable {
+      key = "sample_encryption_key_value"
+      encryption_key_value {
+        type = "GOOGLE_MANAGED"
+        kms_key_name = "sampleKMSKkey"
+      }
+  }
+
+  config_variable {
+    key = "sample_secret_value"
+    secret_value {
+      secret_version = google_secret_manager_secret_version.secret-version-basic.name
+    }
+  }
+
+  suspended = false
+  auth_config {
+    additional_variable {
+      key = "sample_string"
+      string_value = "sampleString"
+    }
+    additional_variable {
+      key = "sample_boolean"
+      boolean_value = false
+    }
+    additional_variable {
+      key = "sample_integer"
+      integer_value = 1
+    }
+    additional_variable {
+      key = "sample_secret_value"
+      secret_value {
+        secret_version = google_secret_manager_secret_version.secret-version-basic.name
+      }
+    }
+    additional_variable {
+      key = "sample_encryption_key_value"
+      encryption_key_value {
+        type = "GOOGLE_MANAGED"
+        kms_key_name = "sampleKMSKkey"
+      }
+    }
+    auth_type = "USER_PASSWORD"
+    auth_key = "sampleAuthKey"
+    user_password {
+      username = "user@xyz.com"
+      password {
+        secret_version = google_secret_manager_secret_version.secret-version-basic.name
+      }
+    }
+  }
+
+  destination_config {
+    key = "url"
+    destination {
+        host = "https://test.zendesk.com"
+        port = 80
+    }
+  }
+  lock_config {
+    locked = false
+    reason = "Its not locked"
+  }
+  log_config {
+    enabled = true
+  }
+  node_config {
+    min_node_count = 2
+    max_node_count = 50
+  }
+  labels = {
+    foo = "bar"
+  }
+  ssl_config {
+    additional_variable {
+      key = "sample_string"
+      string_value = "sampleString"
+    }
+    additional_variable {
+      key = "sample_boolean"
+      boolean_value = false
+    }
+    additional_variable {
+      key = "sample_integer"
+      integer_value = 1
+    }
+    additional_variable {
+      key = "sample_secret_value"
+      secret_value {
+        secret_version = google_secret_manager_secret_version.secret-version-basic.name
+      }
+    }
+    additional_variable {
+      key = "sample_encryption_key_value"
+      encryption_key_value {
+        type = "GOOGLE_MANAGED"
+        kms_key_name = "sampleKMSKkey"
+      }
+    }
+    client_cert_type = "PEM"
+    client_certificate {
+      secret_version = google_secret_manager_secret_version.secret-version-basic.name
+    }
+    client_private_key {
+      secret_version = google_secret_manager_secret_version.secret-version-basic.name
+    }
+    client_private_key_pass {
+      secret_version = google_secret_manager_secret_version.secret-version-basic.name
+    }
+    private_server_certificate {
+      secret_version = google_secret_manager_secret_version.secret-version-basic.name
+    }
+    server_cert_type = "PEM"
+    trust_model      = "PRIVATE"
+    type             = "TLS"
+    use_ssl          = true
+  }
+
+  eventing_enablement_type = "EVENTING_AND_CONNECTION"
+  eventing_config {
+    additional_variable {
+      key = "sample_string"
+      string_value = "sampleString"
+    }
+    additional_variable {
+      key = "sample_boolean"
+      boolean_value = false
+    }
+    additional_variable {
+      key = "sample_integer"
+      integer_value = 1
+    }
+    additional_variable {
+      key = "sample_secret_value"
+      secret_value {
+        secret_version = google_secret_manager_secret_version.secret-version-basic.name
+      }
+    }
+    additional_variable {
+      key = "sample_encryption_key_value"
+      encryption_key_value {
+        type = "GOOGLE_MANAGED"
+        kms_key_name = "sampleKMSKkey"
+      }
+    }
+    registration_destination_config {
+      key = "registration_destination_config"
+      destination {
+          host = "https://test.zendesk.com"
+          port = 80
+        }
+    }
+    auth_config {
+      auth_type = "USER_PASSWORD"
+      auth_key = "sampleAuthKey"
+      user_password {
+        username = "user@xyz.com"
+        password {
+          secret_version = google_secret_manager_secret_version.secret-version-basic.name
+        }
+      }
+      additional_variable {
+        key = "sample_string"
+        string_value = "sampleString"
+      }
+      additional_variable {
+        key = "sample_boolean"
+        boolean_value = false
+      }
+      additional_variable {
+        key = "sample_integer"
+        integer_value = 1
+      }
+      additional_variable {
+        key = "sample_secret_value"
+        secret_value {
+          secret_version = google_secret_manager_secret_version.secret-version-basic.name
+        }
+      }
+      additional_variable {
+        key = "sample_encryption_key_value"
+        encryption_key_value {
+          type = "GOOGLE_MANAGED"
+          kms_key_name = "sampleKMSKkey"
+        }
+      }
+    }
+    enrichment_enabled = true
+  }
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/integration_connectors_connection_basic.tf.erb b/mmv1/templates/terraform/examples/integration_connectors_connection_basic.tf.erb
new file mode 100644
index 000000000000..a0261644a100
--- /dev/null
+++ b/mmv1/templates/terraform/examples/integration_connectors_connection_basic.tf.erb
@@ -0,0 +1,17 @@
+data "google_project" "test_project" {
+}
+
+resource "google_integration_connectors_connection" "<%= ctx[:primary_resource_id] %>" {
+  name     = "<%= ctx[:vars]['connection_name'] %>"
+  location = "us-central1"
+  connector_version = "projects/${data.google_project.test_project.project_id}/locations/global/providers/gcp/connectors/pubsub/versions/1"
+  description = "tf created description"
+  config_variable {
+      key = "project_id"
+      string_value = "connectors-example"
+  }
+  config_variable {
+      key = "topic_id"
+      string_value = "test"
+  }
+}
diff --git a/mmv1/templates/terraform/examples/integration_connectors_connection_oauth.tf.erb b/mmv1/templates/terraform/examples/integration_connectors_connection_oauth.tf.erb
new file mode 100644
index 000000000000..8eba69da624f
--- /dev/null
+++ b/mmv1/templates/terraform/examples/integration_connectors_connection_oauth.tf.erb
@@ -0,0 +1,57 @@
+data "google_project" "test_project" {
+}
+
+resource "google_secret_manager_secret" "secret-basic" {
+  secret_id     = "<%= ctx[:vars]['secret_id'] %>"
+  replication {
+    user_managed {
+      replicas {
+        location = "us-central1"
+      }
+    }
+  }
+}
+
+
+resource "google_secret_manager_secret_version" "secret-version-basic" {
+  secret = google_secret_manager_secret.secret-basic.id
+  secret_data = "dummypassword"
+}
+
+resource "google_secret_manager_secret_iam_member" "secret_iam" {
+  secret_id  = google_secret_manager_secret.secret-basic.id
+  role       = "roles/secretmanager.admin"
+  member     = "serviceAccount:${data.google_project.test_project.number}-compute@developer.gserviceaccount.com"
+  depends_on = [google_secret_manager_secret_version.secret-version-basic]
+}
+
+resource "google_integration_connectors_connection" "<%= ctx[:primary_resource_id] %>" {
+  name     = "<%= ctx[:vars]['connection_name'] %>"
+  location = "us-central1"
+  connector_version = "projects/${data.google_project.test_project.project_id}/locations/global/providers/box/connectors/box/versions/1"
+  description = "tf created description"
+  config_variable {
+      key = "impersonate_user_mode"
+      string_value = "User"
+  }
+  config_variable {
+      key = "proxy_enabled"
+      boolean_value = false
+  }
+  auth_config{
+    auth_type = "OAUTH2_AUTH_CODE_FLOW"
+    oauth2_auth_code_flow {
+        auth_uri  = "sampleauthuri"
+        client_id = "sampleclientid"
+        client_secret {
+            secret_version = google_secret_manager_secret_version.secret-version-basic.name
+        }
+        enable_pkce   = true
+        scopes = [
+            "sample_scope_1",
+            "sample_scope_2"
+        ]
+    }
+  }
+
+}
diff --git a/mmv1/templates/terraform/examples/integration_connectors_connection_oauth_cc.tf.erb b/mmv1/templates/terraform/examples/integration_connectors_connection_oauth_cc.tf.erb
new file mode 100644
index 000000000000..b22e04c033d5
--- /dev/null
+++ b/mmv1/templates/terraform/examples/integration_connectors_connection_oauth_cc.tf.erb
@@ -0,0 +1,87 @@
+data "google_project" "test_project" {
+}
+
+resource "google_secret_manager_secret" "secret-basic" {
+  secret_id     = "<%= ctx[:vars]['secret_id'] %>"
+  replication {
+    user_managed {
+      replicas {
+        location = "us-central1"
+      }
+    }
+  }
+}
+
+
+resource "google_secret_manager_secret_version" "secret-version-basic" {
+  secret = google_secret_manager_secret.secret-basic.id
+  secret_data = "dummypassword"
+}
+
+resource "google_secret_manager_secret_iam_member" "secret_iam" {
+  secret_id  = google_secret_manager_secret.secret-basic.id
+  role       = "roles/secretmanager.admin"
+  member     = "serviceAccount:${data.google_project.test_project.number}-compute@developer.gserviceaccount.com"
+  depends_on = [google_secret_manager_secret_version.secret-version-basic]
+}
+
+resource "google_integration_connectors_connection" "<%= ctx[:primary_resource_id] %>" {
+  name     = "<%= ctx[:vars]['connection_name'] %>"
+  location = "us-central1"
+  connector_version = "projects/${data.google_project.test_project.project_id}/locations/global/providers/box/connectors/box/versions/1"
+  service_account = "${data.google_project.test_project.number}-compute@developer.gserviceaccount.com"
+  description = "tf created description"
+  config_variable {
+      key = "impersonate_user_mode"
+      string_value = "User"
+  }
+  config_variable {
+      key = "proxy_enabled"
+      boolean_value = false
+  }
+  auth_config {
+   auth_type = "OAUTH2_CLIENT_CREDENTIALS"
+   oauth2_client_credentials {
+     client_id = "testclientid"
+     client_secret {
+      secret_version = google_secret_manager_secret_version.secret-version-basic.name
+     }
+   }
+   additional_variable {
+     key = "oauth_jwt_cert"
+     secret_value {
+      secret_version = google_secret_manager_secret_version.secret-version-basic.name
+     }
+   }
+   additional_variable {
+     key = "oauth_jwt_cert_password"
+     secret_value {
+      secret_version = google_secret_manager_secret_version.secret-version-basic.name
+     }
+   }
+   additional_variable {
+     key = "oauth_jwt_subject_type"
+     string_value = "sample"
+   }
+   additional_variable {
+     key = "oauth_jwt_subject"
+     string_value = "sample"
+   }
+   additional_variable {
+     key = "oauth_jwt_public_key_id"
+     string_value = "sample"
+   }
+   additional_variable {
+     key = "auth_scheme"
+     string_value = "sample"
+   }
+   additional_variable {
+     key = "initiate_oauth"
+     string_value = "sample"
+   }
+   additional_variable {
+     key = "oauth_jwt_cert_type"
+     string_value = "PEMKEY_BLOB"
+   }
+ }
+}
diff --git a/mmv1/templates/terraform/examples/integration_connectors_connection_oauth_jwt.tf.erb b/mmv1/templates/terraform/examples/integration_connectors_connection_oauth_jwt.tf.erb
new file mode 100644
index 000000000000..baaebee91662
--- /dev/null
+++ b/mmv1/templates/terraform/examples/integration_connectors_connection_oauth_jwt.tf.erb
@@ -0,0 +1,55 @@
+data "google_project" "test_project" {
+}
+
+resource "google_secret_manager_secret" "secret-basic" {
+  secret_id     = "<%= ctx[:vars]['secret_id'] %>"
+  replication {
+    user_managed {
+      replicas {
+        location = "us-central1"
+      }
+    }
+  }
+}
+
+
+resource "google_secret_manager_secret_version" "secret-version-basic" {
+  secret = google_secret_manager_secret.secret-basic.id
+  secret_data = "dummypassword"
+}
+
+resource "google_secret_manager_secret_iam_member" "secret_iam" {
+  secret_id  = google_secret_manager_secret.secret-basic.id
+  role       = "roles/secretmanager.admin"
+  member     = "serviceAccount:${data.google_project.test_project.number}-compute@developer.gserviceaccount.com"
+  depends_on = [google_secret_manager_secret_version.secret-version-basic]
+}
+
+resource "google_integration_connectors_connection" "<%= ctx[:primary_resource_id] %>" {
+  name     = "<%= ctx[:vars]['connection_name'] %>"
+  location = "us-central1"
+  connector_version = "projects/${data.google_project.test_project.project_id}/locations/global/providers/box/connectors/box/versions/1"
+  service_account = "${data.google_project.test_project.number}-compute@developer.gserviceaccount.com"
+  description = "tf created description"
+  config_variable {
+      key = "impersonate_user_mode"
+      string_value = "User"
+  }
+  config_variable {
+      key = "proxy_enabled"
+      boolean_value = false
+  }
+  auth_config {
+    auth_type = "OAUTH2_JWT_BEARER"
+    oauth2_jwt_bearer {
+      client_key {
+        secret_version = google_secret_manager_secret_version.secret-version-basic.name
+      }
+      jwt_claims {
+        issuer = "test"
+        subject = "johndoe@example.org"
+        audience  = "test"
+      }
+    }
+  }
+}
diff --git a/mmv1/templates/terraform/examples/integration_connectors_connection_oauth_ssh.tf.erb b/mmv1/templates/terraform/examples/integration_connectors_connection_oauth_ssh.tf.erb
new file mode 100644
index 000000000000..26d602f1bf58
--- /dev/null
+++ b/mmv1/templates/terraform/examples/integration_connectors_connection_oauth_ssh.tf.erb
@@ -0,0 +1,56 @@
+data "google_project" "test_project" {
+}
+
+resource "google_secret_manager_secret" "secret-basic" {
+  secret_id     = "<%= ctx[:vars]['secret_id'] %>"
+  replication {
+    user_managed {
+      replicas {
+        location = "us-central1"
+      }
+    }
+  }
+}
+
+
+resource "google_secret_manager_secret_version" "secret-version-basic" {
+  secret = google_secret_manager_secret.secret-basic.id
+  secret_data = "dummypassword"
+}
+
+resource "google_secret_manager_secret_iam_member" "secret_iam" {
+  secret_id  = google_secret_manager_secret.secret-basic.id
+  role       = "roles/secretmanager.admin"
+  member     = "serviceAccount:${data.google_project.test_project.number}-compute@developer.gserviceaccount.com"
+  depends_on = [google_secret_manager_secret_version.secret-version-basic]
+}
+
+resource "google_integration_connectors_connection" "<%= ctx[:primary_resource_id] %>" {
+  name     = "<%= ctx[:vars]['connection_name'] %>"
+  location = "us-central1"
+  connector_version = "projects/${data.google_project.test_project.project_id}/locations/global/providers/box/connectors/box/versions/1"
+  service_account = "${data.google_project.test_project.number}-compute@developer.gserviceaccount.com"
+  description = "tf created description"
+  config_variable {
+      key = "impersonate_user_mode"
+      string_value = "User"
+  }
+  config_variable {
+      key = "proxy_enabled"
+      boolean_value = false
+  }
+  auth_config{
+    auth_type = "SSH_PUBLIC_KEY"
+    ssh_public_key {
+      cert_type = "PEMKEY_BLOB"
+      ssh_client_cert {
+        secret_version = google_secret_manager_secret_version.secret-version-basic.name
+      }
+      ssh_client_cert_pass {
+        secret_version = google_secret_manager_secret_version.secret-version-basic.name
+      }
+      username = "abc"
+    }
+  }
+
+}
diff --git a/mmv1/templates/terraform/examples/integration_connectors_connection_sa.tf.erb b/mmv1/templates/terraform/examples/integration_connectors_connection_sa.tf.erb
new file mode 100644
index 000000000000..9c3151fc820d
--- /dev/null
+++ b/mmv1/templates/terraform/examples/integration_connectors_connection_sa.tf.erb
@@ -0,0 +1,230 @@
+data "google_project" "test_project" {
+}
+
+resource "google_secret_manager_secret" "secret-basic" {
+  secret_id     = "<%= ctx[:vars]['secret_id'] %>"
+  replication {
+    user_managed {
+      replicas {
+        location = "us-central1"
+      }
+    }
+  }
+}
+
+
+resource "google_secret_manager_secret_version" "secret-version-basic" {
+  secret = google_secret_manager_secret.secret-basic.id
+  secret_data = "dummypassword"
+}
+
+resource "google_secret_manager_secret_iam_member" "secret_iam" {
+  secret_id  = google_secret_manager_secret.secret-basic.id
+  role       = "roles/secretmanager.admin"
+  member     = "serviceAccount:${data.google_project.test_project.number}-compute@developer.gserviceaccount.com"
+  depends_on = [google_secret_manager_secret_version.secret-version-basic]
+}
+
+resource "google_integration_connectors_connection" "<%= ctx[:primary_resource_id] %>" {
+  name     = "<%= ctx[:vars]['connection_name'] %>"
+  description = "tf updated description"
+  location = "us-central1"
+  service_account = "${data.google_project.test_project.number}-compute@developer.gserviceaccount.com"
+  connector_version = "projects/${data.google_project.test_project.project_id}/locations/global/providers/zendesk/connectors/zendesk/versions/1"
+  config_variable {
+    key = "proxy_enabled"
+    boolean_value = false
+  }
+  config_variable {
+    key = "sample_integer_value"
+    integer_value = 1
+  }
+
+  config_variable {
+      key = "sample_encryption_key_value"
+      encryption_key_value {
+        type = "GOOGLE_MANAGED"
+        kms_key_name = "sampleKMSKkey"
+      }
+  }
+
+  config_variable {
+    key = "sample_secret_value"
+    secret_value {
+      secret_version = google_secret_manager_secret_version.secret-version-basic.name
+    }
+  }
+
+  suspended = false
+  auth_config {
+    additional_variable {
+      key = "sample_string"
+      string_value = "sampleString"
+    }
+    additional_variable {
+      key = "sample_boolean"
+      boolean_value = false
+    }
+    additional_variable {
+      key = "sample_integer"
+      integer_value = 1
+    }
+    additional_variable {
+      key = "sample_secret_value"
+      secret_value {
+        secret_version = google_secret_manager_secret_version.secret-version-basic.name
+      }
+    }
+    additional_variable {
+      key = "sample_encryption_key_value"
+      encryption_key_value {
+        type = "GOOGLE_MANAGED"
+        kms_key_name = "sampleKMSKkey"
+      }
+    }
+    auth_type = "USER_PASSWORD"
+    auth_key = "sampleAuthKey"
+    user_password {
+      username = "user@xyz.com"
+      password {
+        secret_version = google_secret_manager_secret_version.secret-version-basic.name
+      }
+    }
+  }
+
+  destination_config {
+    key = "url"
+    destination {
+      service_attachment = "projects/connectors-example/regions/us-central1/serviceAttachments/test"
+    }
+  }
+  lock_config {
+    locked = false
+    reason = "Its not locked"
+  }
+  log_config {
+    enabled = true
+  }
+  node_config {
+    min_node_count = 2
+    max_node_count = 50
+  }
+  labels = {
+    foo = "bar"
+  }
+  ssl_config {
+    additional_variable {
+      key = "sample_string"
+      string_value = "sampleString"
+    }
+    additional_variable {
+      key = "sample_boolean"
+      boolean_value = false
+    }
+    additional_variable {
+      key = "sample_integer"
+      integer_value = 1
+    }
+    additional_variable {
+      key = "sample_secret_value"
+      secret_value {
+        secret_version = google_secret_manager_secret_version.secret-version-basic.name
+      }
+    }
+    additional_variable {
+      key = "sample_encryption_key_value"
+      encryption_key_value {
+        type = "GOOGLE_MANAGED"
+        kms_key_name = "sampleKMSKkey"
+      }
+    }
+    client_cert_type = "PEM"
+    client_certificate {
+      secret_version = google_secret_manager_secret_version.secret-version-basic.name
+    }
+    client_private_key {
+      secret_version = google_secret_manager_secret_version.secret-version-basic.name
+    }
+    client_private_key_pass {
+      secret_version = google_secret_manager_secret_version.secret-version-basic.name
+    }
+    private_server_certificate {
+      secret_version = google_secret_manager_secret_version.secret-version-basic.name
+    }
+    server_cert_type = "PEM"
+    trust_model      = "PRIVATE"
+    type             = "TLS"
+    use_ssl          = true
+  }
+
+  eventing_enablement_type = "EVENTING_AND_CONNECTION"
+  eventing_config {
+    additional_variable {
+      key = "sample_string"
+      string_value = "sampleString"
+    }
+    additional_variable {
+      key = "sample_boolean"
+      boolean_value = false
+    }
+    additional_variable {
+      key = "sample_integer"
+      integer_value = 1
+    }
+    additional_variable {
+      key = "sample_secret_value"
+      secret_value {
+        secret_version = google_secret_manager_secret_version.secret-version-basic.name
+      }
+    }
+    additional_variable {
+      key = "sample_encryption_key_value"
+      encryption_key_value {
+        type = "GOOGLE_MANAGED"
+        kms_key_name = "sampleKMSKkey"
+      }
+    }
+    registration_destination_config {
+      key = "registration_destination_config"
+      destination {
+          service_attachment = "projects/connectors-example/regions/us-central1/serviceAttachments/test"
+        }
+    }
+    auth_config {
+      auth_type = "USER_PASSWORD"
+      auth_key = "sampleAuthKey"
+      user_password {
+        username = "user@xyz.com"
+        password {
+          secret_version = google_secret_manager_secret_version.secret-version-basic.name
+        }
+      }
+      additional_variable {
+        key = "sample_string"
+        string_value = "sampleString"
+      }
+      additional_variable {
+        key = "sample_boolean"
+        boolean_value = false
+      }
+      additional_variable {
+        key = "sample_integer"
+        integer_value = 1
+      }
+      additional_variable {
+        key = "sample_secret_value"
+        secret_value {
+          secret_version = google_secret_manager_secret_version.secret-version-basic.name
+        }
+      }
+      additional_variable {
+        key = "sample_encryption_key_value"
+        encryption_key_value {
+          type = "GOOGLE_MANAGED"
+          kms_key_name = "sampleKMSKkey"
+        }
+      }
+    }
+    enrichment_enabled = true
+  }
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/looker_instance_enterprise_full.tf.erb b/mmv1/templates/terraform/examples/looker_instance_enterprise_full.tf.erb
index 5a223f1e21db..54d74ad63d8e 100644
--- a/mmv1/templates/terraform/examples/looker_instance_enterprise_full.tf.erb
+++ b/mmv1/templates/terraform/examples/looker_instance_enterprise_full.tf.erb
@@ -5,7 +5,7 @@ resource "google_looker_instance" "<%= ctx[:primary_resource_id] %>" {
   private_ip_enabled = true
   public_ip_enabled  = false
   reserved_range     = "${google_compute_global_address.looker_range.name}"
-  consumer_network   = data.google_compute_network.looker_network.id
+  consumer_network   = google_compute_network.looker_network.id
   admin_settings {
     allowed_email_domains = ["google.com"]
   }
@@ -49,7 +49,7 @@ resource "google_looker_instance" "<%= ctx[:primary_resource_id] %>" {
 }
 
 resource "google_service_networking_connection" "looker_vpc_connection" {
-  network                 = data.google_compute_network.looker_network.id
+  network                 = google_compute_network.looker_network.id
   service                 = "servicenetworking.googleapis.com"
   reserved_peering_ranges = [google_compute_global_address.looker_range.name]
 }
@@ -59,12 +59,12 @@ resource "google_compute_global_address" "looker_range" {
   purpose       = "VPC_PEERING"
   address_type  = "INTERNAL"
   prefix_length = 20
-  network       = data.google_compute_network.looker_network.id
+  network       = google_compute_network.looker_network.id
 }
 
 data "google_project" "project" {}
 
-data "google_compute_network" "looker_network" {
+resource "google_compute_network" "looker_network" {
   name = "<%= ctx[:vars]["network_name"] %>"
 }
 
diff --git a/mmv1/templates/terraform/examples/looker_instance_enterprise_full_test.tf.erb b/mmv1/templates/terraform/examples/looker_instance_enterprise_full_test.tf.erb
new file mode 100644
index 000000000000..20fade6649cc
--- /dev/null
+++ b/mmv1/templates/terraform/examples/looker_instance_enterprise_full_test.tf.erb
@@ -0,0 +1,62 @@
+resource "google_looker_instance" "<%= ctx[:primary_resource_id] %>" {
+  name               = "<%= ctx[:vars]["instance_name"] %>"
+  platform_edition   = "LOOKER_CORE_ENTERPRISE_ANNUAL"
+  region             = "us-central1"
+  private_ip_enabled = true
+  public_ip_enabled  = false
+  reserved_range     = "${data.google_compute_global_address.looker_range.name}"
+  consumer_network   = data.google_compute_network.looker_network.id
+  admin_settings {
+    allowed_email_domains = ["google.com"]
+  }
+  encryption_config {
+    kms_key_name = "<%= ctx[:vars]["kms_key_name"] %>"
+  }
+  maintenance_window {
+    day_of_week = "THURSDAY"
+    start_time {
+      hours   = 22
+      minutes = 0
+      seconds = 0
+      nanos   = 0
+    }
+  }
+  deny_maintenance_period {
+    start_date {
+      year = 2050
+      month = 1
+      day = 1
+    }
+    end_date {
+      year = 2050
+      month = 2
+      day = 1
+    }
+    time {
+      hours = 10
+      minutes = 0
+      seconds = 0
+      nanos = 0
+    }
+  }
+  oauth_config {
+    client_id = "<%= ctx[:vars]["client_id"] %>"
+    client_secret = "<%= ctx[:vars]["client_secret"] %>"
+  }
+}
+
+data "google_compute_global_address" "looker_range" {
+  name          = "<%= ctx[:vars]["address_name"] %>"
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "looker_network" {
+  name = "<%= ctx[:vars]["network_name"] %>"
+}
+
+resource "google_kms_crypto_key_iam_member" "crypto_key" {
+  crypto_key_id = "<%= ctx[:vars]["kms_key_name"] %>"
+  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+  member        = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-looker.iam.gserviceaccount.com"
+}
diff --git a/mmv1/templates/terraform/examples/memcache_instance_basic.tf.erb b/mmv1/templates/terraform/examples/memcache_instance_basic.tf.erb
index e021bacf3d63..2744c21f85b4 100644
--- a/mmv1/templates/terraform/examples/memcache_instance_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/memcache_instance_basic.tf.erb
@@ -6,7 +6,7 @@
 // If this network hasn't been created and you are using this example in your
 // config, add an additional network resource or change
 // this from "data"to "resource"
-data "google_compute_network" "memcache_network" {
+resource "google_compute_network" "memcache_network" {
   name = "<%= ctx[:vars]['network_name'] %>"
 }
 
@@ -15,11 +15,11 @@ resource "google_compute_global_address" "service_range" {
   purpose       = "VPC_PEERING"
   address_type  = "INTERNAL"
   prefix_length = 16
-  network       = data.google_compute_network.memcache_network.id
+  network       = google_compute_network.memcache_network.id
 }
 
 resource "google_service_networking_connection" "private_service_connection" {
-  network                 = data.google_compute_network.memcache_network.id
+  network                 = google_compute_network.memcache_network.id
   service                 = "servicenetworking.googleapis.com"
   reserved_peering_ranges = [google_compute_global_address.service_range.name]
 }
@@ -28,6 +28,10 @@ resource "google_memcache_instance" "<%= ctx[:primary_resource_id] %>" {
   name = "<%= ctx[:vars]["instance_name"] %>"
   authorized_network = google_service_networking_connection.private_service_connection.network
 
+  labels = {
+    env = "test"
+  }
+
   node_config {
     cpu_count      = 1
     memory_size_mb = 1024
diff --git a/mmv1/templates/terraform/examples/memcache_instance_basic_test.tf.erb b/mmv1/templates/terraform/examples/memcache_instance_basic_test.tf.erb
new file mode 100644
index 000000000000..fb4794bbabaa
--- /dev/null
+++ b/mmv1/templates/terraform/examples/memcache_instance_basic_test.tf.erb
@@ -0,0 +1,40 @@
+// This example assumes this network already exists.
+// The API creates a tenant network per network authorized for a
+// Memcache instance and that network is not deleted when the user-created
+// network (authorized_network) is deleted, so this prevents issues
+// with tenant network quota.
+// If this network hasn't been created and you are using this example in your
+// config, add an additional network resource or change
+// this from "data"to "resource"
+data "google_compute_network" "memcache_network" {
+  name = "<%= ctx[:vars]['network_name'] %>"
+}
+
+resource "google_memcache_instance" "<%= ctx[:primary_resource_id] %>" {
+  name = "<%= ctx[:vars]["instance_name"] %>"
+  authorized_network = data.google_compute_network.memcache_network.id
+
+  labels = {
+    env = "test"
+  }
+
+  node_config {
+    cpu_count      = 1
+    memory_size_mb = 1024
+  }
+  node_count = 1
+  memcache_version = "MEMCACHE_1_5"
+
+  maintenance_policy {
+    weekly_maintenance_window {
+      day      = "SATURDAY"
+      duration = "14400s"
+      start_time {
+        hours = 0
+        minutes = 30
+        seconds = 0
+        nanos = 0
+      }
+    }
+  }
+}
diff --git a/mmv1/templates/terraform/examples/monitoring_alert_policy_promql_condition.tf.erb b/mmv1/templates/terraform/examples/monitoring_alert_policy_promql_condition.tf.erb
new file mode 100644
index 000000000000..4e20a3bbdf6e
--- /dev/null
+++ b/mmv1/templates/terraform/examples/monitoring_alert_policy_promql_condition.tf.erb
@@ -0,0 +1,18 @@
+resource "google_monitoring_alert_policy" "<%= ctx[:primary_resource_id] %>" {
+  display_name = "<%= ctx[:vars]["alert_policy_display_name"] %>"
+  combiner     = "OR"
+  conditions {
+    display_name = "test condition"
+    condition_prometheus_query_language {
+      query      = "compute_googleapis_com:instance_cpu_usage_time > 0"
+      duration   = "60s"
+      evaluation_interval = "60s"
+      alert_rule  = "AlwaysOn"
+      rule_group  = "a test"
+    }
+  }
+
+  alert_strategy {
+    auto_close  = "1800s"
+  }
+}
diff --git a/mmv1/templates/terraform/examples/network_attachment_basic.tf.erb b/mmv1/templates/terraform/examples/network_attachment_basic.tf.erb
index 519d5b98a4c9..a0196c7a4b3f 100644
--- a/mmv1/templates/terraform/examples/network_attachment_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/network_attachment_basic.tf.erb
@@ -35,16 +35,16 @@ resource "google_compute_subnetwork" "default" {
 
 resource "google_project" "rejected_producer_project" {
     provider = google-beta
-    project_id      = "prj-rejected%{random_suffix}"
-    name            = "prj-rejected%{random_suffix}"
+    project_id      = "<%= ctx[:vars]['rejected_producer_project_name'] %>"
+    name            = "<%= ctx[:vars]['rejected_producer_project_name'] %>"
     org_id          = "<%= ctx[:test_env_vars]['org_id'] %>"
     billing_account = "<%= ctx[:test_env_vars]['billing_account'] %>"
 }
 
 resource "google_project" "accepted_producer_project" {
     provider = google-beta
-    project_id      = "prj-accepted%{random_suffix}"
-    name            = "prj-accepted%{random_suffix}"
+    project_id      = "<%= ctx[:vars]['accepted_producer_project_name'] %>"
+    name            = "<%= ctx[:vars]['accepted_producer_project_name'] %>"
     org_id          = "<%= ctx[:test_env_vars]['org_id'] %>"
     billing_account = "<%= ctx[:test_env_vars]['billing_account'] %>"
 }
diff --git a/mmv1/templates/terraform/examples/network_attachment_instance_usage.tf.erb b/mmv1/templates/terraform/examples/network_attachment_instance_usage.tf.erb
index a72678e2c98e..6e5963d781c8 100644
--- a/mmv1/templates/terraform/examples/network_attachment_instance_usage.tf.erb
+++ b/mmv1/templates/terraform/examples/network_attachment_instance_usage.tf.erb
@@ -36,8 +36,10 @@ resource "google_compute_instance" "default" {
     }
 
     network_interface {
-        network = google_compute_network.default.id
-        subnetwork = google_compute_subnetwork.default.id
-        network_attachment = google_compute_network_attachment.default.name
+		network = "default"
+	}
+
+    network_interface {
+        network_attachment = google_compute_network_attachment.default.self_link
     }
 }
diff --git a/mmv1/templates/terraform/examples/network_connectivity_policy_based_route_basic.tf.erb b/mmv1/templates/terraform/examples/network_connectivity_policy_based_route_basic.tf.erb
new file mode 100644
index 000000000000..59e6a798d9b1
--- /dev/null
+++ b/mmv1/templates/terraform/examples/network_connectivity_policy_based_route_basic.tf.erb
@@ -0,0 +1,13 @@
+resource "google_network_connectivity_policy_based_route" "<%= ctx[:primary_resource_id] %>" {
+  name = "<%= ctx[:vars]['pbr_name'] %>"
+  network = google_compute_network.my_network.id
+  filter {
+    protocol_version = "IPV4"
+  }
+  next_hop_other_routes = "DEFAULT_ROUTING"
+}
+
+resource "google_compute_network" "my_network" {
+  name                    = "<%= ctx[:vars]['network_name'] %>"
+  auto_create_subnetworks = false
+}
diff --git a/mmv1/templates/terraform/examples/network_connectivity_policy_based_route_full.tf.erb b/mmv1/templates/terraform/examples/network_connectivity_policy_based_route_full.tf.erb
new file mode 100644
index 000000000000..6d3ae8d3f211
--- /dev/null
+++ b/mmv1/templates/terraform/examples/network_connectivity_policy_based_route_full.tf.erb
@@ -0,0 +1,34 @@
+resource "google_network_connectivity_policy_based_route" "<%= ctx[:primary_resource_id] %>" {
+  name = "<%= ctx[:vars]['pbr_name'] %>"
+  description = "My routing policy"
+  network = google_compute_network.my_network.id
+  priority = 2302
+
+  filter {
+    protocol_version = "IPV4"
+    ip_protocol = "UDP"
+    src_range = "10.0.0.0/24"
+    dest_range = "0.0.0.0/0"
+  }
+  next_hop_ilb_ip = google_compute_global_address.ilb.address
+
+  virtual_machine {
+    tags = ["restricted"]
+  }
+
+  labels = {
+    env = "default"
+  }
+}
+
+resource "google_compute_network" "my_network" {
+  name                    = "<%= ctx[:vars]['network_name'] %>"
+  auto_create_subnetworks = false
+}
+
+# This example substitutes an arbitrary internal IP for an internal network
+# load balancer for brevity. Consult https://cloud.google.com/load-balancing/docs/internal
+# to set one up.
+resource "google_compute_global_address" "ilb" {
+  name = "<%= ctx[:vars]['ilb_name'] %>"
+}
diff --git a/mmv1/templates/terraform/examples/network_management_connectivity_test_instances.tf.erb b/mmv1/templates/terraform/examples/network_management_connectivity_test_instances.tf.erb
index 09a5dc0f7c6a..190c4fc40b1e 100644
--- a/mmv1/templates/terraform/examples/network_management_connectivity_test_instances.tf.erb
+++ b/mmv1/templates/terraform/examples/network_management_connectivity_test_instances.tf.erb
@@ -10,6 +10,9 @@ resource "google_network_management_connectivity_test" "<%= ctx[:primary_resourc
   }
 
   protocol = "TCP"
+  labels = {
+    env = "test"
+  }
 }
 
 resource "google_compute_instance" "source" {
diff --git a/mmv1/templates/terraform/examples/network_peering_routes_config_gke.tf.erb b/mmv1/templates/terraform/examples/network_peering_routes_config_gke.tf.erb
index bd6ef2cd8a7b..a75f44cafcb9 100644
--- a/mmv1/templates/terraform/examples/network_peering_routes_config_gke.tf.erb
+++ b/mmv1/templates/terraform/examples/network_peering_routes_config_gke.tf.erb
@@ -49,4 +49,5 @@ resource "google_container_cluster" "private_cluster" {
     cluster_secondary_range_name  = google_compute_subnetwork.container_subnetwork.secondary_ip_range[0].range_name
     services_secondary_range_name = google_compute_subnetwork.container_subnetwork.secondary_ip_range[1].range_name
   }
+  deletion_protection  = "<%= ctx[:vars]['deletion_protection'] %>"
 }
diff --git a/mmv1/templates/terraform/examples/network_security_server_tls_policy_mtls.tf.erb b/mmv1/templates/terraform/examples/network_security_server_tls_policy_mtls.tf.erb
new file mode 100644
index 000000000000..12073fee43c1
--- /dev/null
+++ b/mmv1/templates/terraform/examples/network_security_server_tls_policy_mtls.tf.erb
@@ -0,0 +1,41 @@
+data "google_project" "project" {
+  provider = google-beta
+}
+
+resource "google_network_security_server_tls_policy" "<%= ctx[:primary_resource_id] %>" {
+  provider = google-beta
+  name     = "<%= ctx[:vars]['resource_name'] %>"
+
+  description = "my description"
+  location    = "global"
+  allow_open  = "false"
+
+  mtls_policy {
+    client_validation_mode         = "REJECT_INVALID"
+    client_validation_trust_config = "projects/${data.google_project.project.number}/locations/global/trustConfigs/${google_certificate_manager_trust_config.default.name}"
+  }
+
+  labels = {
+    foo = "bar"
+  }
+}
+
+resource "google_certificate_manager_trust_config" "default" {
+  provider    = google-beta
+  name        = "<%= ctx[:vars]['trust_config_name'] %>"
+  description = "sample trust config description"
+  location    = "global"
+
+  trust_stores {
+    trust_anchors {
+      pem_certificate = file("test-fixtures/ca_cert.pem")
+    }
+    intermediate_cas {
+      pem_certificate = file("test-fixtures/ca_cert.pem")
+    }
+  }
+
+  labels = {
+    foo = "bar"
+  }
+}
diff --git a/mmv1/templates/terraform/examples/network_services_edge_cache_keyset_dual_token.tf.erb b/mmv1/templates/terraform/examples/network_services_edge_cache_keyset_dual_token.tf.erb
index 1e6da83840d0..f3de7e77986b 100644
--- a/mmv1/templates/terraform/examples/network_services_edge_cache_keyset_dual_token.tf.erb
+++ b/mmv1/templates/terraform/examples/network_services_edge_cache_keyset_dual_token.tf.erb
@@ -2,7 +2,7 @@ resource "google_secret_manager_secret" "secret-basic" {
   secret_id = "<%= ctx[:vars]['secret_name'] %>"
 
   replication {
-    automatic = true
+    auto {}
   }
 }
 
diff --git a/mmv1/templates/terraform/examples/network_services_edge_cache_origin_v4auth.tf.erb b/mmv1/templates/terraform/examples/network_services_edge_cache_origin_v4auth.tf.erb
index c9b4633cce96..3402b30dbed9 100644
--- a/mmv1/templates/terraform/examples/network_services_edge_cache_origin_v4auth.tf.erb
+++ b/mmv1/templates/terraform/examples/network_services_edge_cache_origin_v4auth.tf.erb
@@ -2,7 +2,7 @@ resource "google_secret_manager_secret" "secret-basic" {
   secret_id = "<%= ctx[:vars]['secret_name'] %>"
 
   replication {
-    automatic = true
+    auto {}
   }
 }
 
diff --git a/mmv1/templates/terraform/examples/network_services_edge_cache_service_dual_token.tf.erb b/mmv1/templates/terraform/examples/network_services_edge_cache_service_dual_token.tf.erb
index d7df43d9cfef..b86f61c44e12 100644
--- a/mmv1/templates/terraform/examples/network_services_edge_cache_service_dual_token.tf.erb
+++ b/mmv1/templates/terraform/examples/network_services_edge_cache_service_dual_token.tf.erb
@@ -2,7 +2,7 @@ resource "google_secret_manager_secret" "secret-basic" {
   secret_id = "<%= ctx[:vars]['secret_name'] %>"
 
   replication {
-    automatic = true
+    auto {}
   }
 }
 
diff --git a/mmv1/templates/terraform/examples/node_group_basic.tf.erb b/mmv1/templates/terraform/examples/node_group_basic.tf.erb
index 39b32a385c4d..3ed5b02dd02b 100644
--- a/mmv1/templates/terraform/examples/node_group_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/node_group_basic.tf.erb
@@ -9,6 +9,6 @@ resource "google_compute_node_group" "<%= ctx[:primary_resource_id] %>" {
   zone        = "us-central1-f"
   description = "example google_compute_node_group for Terraform Google Provider"
 
-  size          = 1
+  initial_size          = 1
   node_template = google_compute_node_template.soletenant-tmpl.id
 }
diff --git a/mmv1/templates/terraform/examples/node_group_maintenance_interval.tf.erb b/mmv1/templates/terraform/examples/node_group_maintenance_interval.tf.erb
new file mode 100644
index 000000000000..94f2cb55a7d6
--- /dev/null
+++ b/mmv1/templates/terraform/examples/node_group_maintenance_interval.tf.erb
@@ -0,0 +1,18 @@
+resource "google_compute_node_template" "soletenant-tmpl" {
+  provider  = google-beta
+  name      = "<%= ctx[:vars]['template_name'] %>"
+  region    = "us-central1"
+  node_type = "c2-node-60-240"
+}
+
+resource "google_compute_node_group" "<%= ctx[:primary_resource_id] %>" {
+  provider    = google-beta
+  name        = "<%= ctx[:vars]['group_name'] %>"
+  zone        = "us-central1-a"
+  description = "example google_compute_node_group for Terraform Google Provider"
+
+  initial_size          = 1
+  node_template = google_compute_node_template.soletenant-tmpl.id
+
+  maintenance_interval  = "RECURRENT"
+}
diff --git a/mmv1/templates/terraform/examples/node_group_share_settings.tf.erb b/mmv1/templates/terraform/examples/node_group_share_settings.tf.erb
index 278cd3f0ffbb..b2658a831187 100644
--- a/mmv1/templates/terraform/examples/node_group_share_settings.tf.erb
+++ b/mmv1/templates/terraform/examples/node_group_share_settings.tf.erb
@@ -15,7 +15,7 @@ resource "google_compute_node_group" "<%= ctx[:primary_resource_id] %>" {
   zone        = "us-central1-f"
   description = "example google_compute_node_group for Terraform Google Provider"
 
-  size          = 1
+  initial_size          = 1
   node_template = google_compute_node_template.soletenant-tmpl.id
 
   share_settings {
diff --git a/mmv1/templates/terraform/examples/only_external_vpn_gateway_full.tf.erb b/mmv1/templates/terraform/examples/only_external_vpn_gateway_full.tf.erb
index 6fc73528fdcb..08bde7a9dab8 100644
--- a/mmv1/templates/terraform/examples/only_external_vpn_gateway_full.tf.erb
+++ b/mmv1/templates/terraform/examples/only_external_vpn_gateway_full.tf.erb
@@ -8,6 +8,5 @@ resource "google_compute_external_vpn_gateway" "<%= ctx[:primary_resource_id] %>
   }
   labels = {
     key = "value"
-    otherkey = ""
   }
 }
diff --git a/mmv1/templates/terraform/examples/org_policy_custom_constraint_basic.tf.erb b/mmv1/templates/terraform/examples/org_policy_custom_constraint_basic.tf.erb
index 552ea7ea749f..61a4805230b8 100644
--- a/mmv1/templates/terraform/examples/org_policy_custom_constraint_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/org_policy_custom_constraint_basic.tf.erb
@@ -1,7 +1,6 @@
 resource "google_org_policy_custom_constraint" "<%= ctx[:primary_resource_id] %>" {
-  provider = google-beta
 
-  name         = "custom.disableGkeAutoUpgrade"
+  name         = "<%= ctx[:vars]['policy_name'] %>"
   parent       = "organizations/<%= ctx[:test_env_vars]['org_id'] %>"
 
   action_type    = "ALLOW"
diff --git a/mmv1/templates/terraform/examples/org_policy_custom_constraint_full.tf.erb b/mmv1/templates/terraform/examples/org_policy_custom_constraint_full.tf.erb
index 9f5a73289c8a..cf08b9504acd 100644
--- a/mmv1/templates/terraform/examples/org_policy_custom_constraint_full.tf.erb
+++ b/mmv1/templates/terraform/examples/org_policy_custom_constraint_full.tf.erb
@@ -1,7 +1,6 @@
 resource "google_org_policy_custom_constraint" "<%= ctx[:primary_resource_id] %>" {
-  provider = google-beta
 
-  name         = "custom.disableGkeAutoUpgrade"
+  name         = "<%= ctx[:vars]['policy_name'] %>"
   parent       = "organizations/<%= ctx[:test_env_vars]['org_id'] %>"
   display_name = "Disable GKE auto upgrade"
   description  = "Only allow GKE NodePool resource to be created or updated if AutoUpgrade is not enabled where this custom constraint is enforced."
@@ -13,7 +12,6 @@ resource "google_org_policy_custom_constraint" "<%= ctx[:primary_resource_id] %>
 }
 
 resource "google_org_policy_policy" "bool" {
-  provider = google-beta
 
   name   = "organizations/<%= ctx[:test_env_vars]['org_id'] %>/policies/${google_org_policy_custom_constraint.constraint.name}"
   parent = "organizations/<%= ctx[:test_env_vars]['org_id'] %>"
diff --git a/mmv1/templates/terraform/examples/os_config_patch_deployment_full.tf.erb b/mmv1/templates/terraform/examples/os_config_patch_deployment_full.tf.erb
index d95d70b62e0c..fa8db9e11d16 100644
--- a/mmv1/templates/terraform/examples/os_config_patch_deployment_full.tf.erb
+++ b/mmv1/templates/terraform/examples/os_config_patch_deployment_full.tf.erb
@@ -16,7 +16,7 @@ resource "google_os_config_patch_deployment" "<%= ctx[:primary_resource_id] %>"
 
   patch_config {
     mig_instances_allowed = true
-    
+
     reboot_config = "ALWAYS"
 
     apt {
@@ -40,6 +40,7 @@ resource "google_os_config_patch_deployment" "<%= ctx[:primary_resource_id] %>"
 
     windows_update {
       classifications = ["CRITICAL", "SECURITY", "UPDATE"]
+      excludes = ["5012170"]
     }
 
     pre_step {
@@ -93,6 +94,7 @@ resource "google_os_config_patch_deployment" "<%= ctx[:primary_resource_id] %>"
       week_day_of_month {
         week_ordinal = -1
         day_of_week  = "TUESDAY"
+        day_offset   = 3
       }
     }
   }
diff --git a/mmv1/templates/terraform/examples/redis_cluster_ha.tf.erb b/mmv1/templates/terraform/examples/redis_cluster_ha.tf.erb
index baaf1bc10f76..a2ef9d488324 100644
--- a/mmv1/templates/terraform/examples/redis_cluster_ha.tf.erb
+++ b/mmv1/templates/terraform/examples/redis_cluster_ha.tf.erb
@@ -1,5 +1,4 @@
 resource "google_redis_cluster" "<%= ctx[:primary_resource_id] %>" {
-  provider       = google-beta
   name           = "<%= ctx[:vars]['cluster_name'] %>"
   shard_count    = 3
   psc_configs {
@@ -12,10 +11,13 @@ resource "google_redis_cluster" "<%= ctx[:primary_resource_id] %>" {
   depends_on = [
     google_network_connectivity_service_connection_policy.default
   ]
+
+  lifecycle {
+    prevent_destroy = <%= ctx[:vars]['prevent_destroy'] %>
+  }
 }
 
 resource "google_network_connectivity_service_connection_policy" "default" {
-  provider = google-beta
   name = "<%= ctx[:vars]['policy_name'] %>"
   location = "us-central1"
   service_class = "gcp-memorystore-redis"
@@ -27,7 +29,6 @@ resource "google_network_connectivity_service_connection_policy" "default" {
 }
 
 resource "google_compute_subnetwork" "producer_subnet" {
-  provider      = google-beta
   name          = "<%= ctx[:vars]['subnet_name'] %>"
   ip_cidr_range = "10.0.0.248/29"
   region        = "us-central1"
@@ -35,7 +36,6 @@ resource "google_compute_subnetwork" "producer_subnet" {
 }
 
 resource "google_compute_network" "producer_net" {
-  provider                = google-beta
   name                    = "<%= ctx[:vars]['network_name'] %>"
   auto_create_subnetworks = false
 }
diff --git a/mmv1/templates/terraform/examples/redis_instance_basic.tf.erb b/mmv1/templates/terraform/examples/redis_instance_basic.tf.erb
index ac403764b5ca..5cf774559a06 100644
--- a/mmv1/templates/terraform/examples/redis_instance_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/redis_instance_basic.tf.erb
@@ -1,4 +1,8 @@
 resource "google_redis_instance" "<%= ctx[:primary_resource_id] %>" {
   name           = "<%= ctx[:vars]["instance_name"] %>"
   memory_size_gb = 1
+
+  lifecycle {
+    prevent_destroy = <%= ctx[:vars]['prevent_destroy'] %>
+  }
 }
diff --git a/mmv1/templates/terraform/examples/redis_instance_cmek.tf.erb b/mmv1/templates/terraform/examples/redis_instance_cmek.tf.erb
index acb9ba91a95e..c40840101d3f 100644
--- a/mmv1/templates/terraform/examples/redis_instance_cmek.tf.erb
+++ b/mmv1/templates/terraform/examples/redis_instance_cmek.tf.erb
@@ -17,6 +17,10 @@ resource "google_redis_instance" "<%= ctx[:primary_resource_id] %>" {
     other_key = "other_val"
   }
   customer_managed_key = google_kms_crypto_key.redis_key.id
+
+  lifecycle {
+    prevent_destroy = <%= ctx[:vars]['prevent_destroy'] %>
+  }
 }
 
 resource "google_kms_key_ring" "redis_keyring" {
diff --git a/mmv1/templates/terraform/examples/redis_instance_full.tf.erb b/mmv1/templates/terraform/examples/redis_instance_full.tf.erb
index e737c4ec6111..2bcac657ff0c 100644
--- a/mmv1/templates/terraform/examples/redis_instance_full.tf.erb
+++ b/mmv1/templates/terraform/examples/redis_instance_full.tf.erb
@@ -28,6 +28,10 @@ resource "google_redis_instance" "<%= ctx[:primary_resource_id] %>" {
       }
     }
   }
+
+  lifecycle {
+    prevent_destroy = <%= ctx[:vars]['prevent_destroy'] %>
+  }
 }
 
 // This example assumes this network already exists.
diff --git a/mmv1/templates/terraform/examples/redis_instance_full_with_persistence_config.tf.erb b/mmv1/templates/terraform/examples/redis_instance_full_with_persistence_config.tf.erb
index c0d7774feaff..4f8bbf2654c5 100644
--- a/mmv1/templates/terraform/examples/redis_instance_full_with_persistence_config.tf.erb
+++ b/mmv1/templates/terraform/examples/redis_instance_full_with_persistence_config.tf.erb
@@ -9,4 +9,8 @@ resource "google_redis_instance" "<%= ctx[:primary_resource_id] %>" {
     persistence_mode = "RDB"
     rdb_snapshot_period = "TWELVE_HOURS"
   }
+
+  lifecycle {
+    prevent_destroy = <%= ctx[:vars]['prevent_destroy'] %>
+  }
 }
diff --git a/mmv1/templates/terraform/examples/redis_instance_mrr.tf.erb b/mmv1/templates/terraform/examples/redis_instance_mrr.tf.erb
index b0ab91f58bf2..2b038101dedf 100644
--- a/mmv1/templates/terraform/examples/redis_instance_mrr.tf.erb
+++ b/mmv1/templates/terraform/examples/redis_instance_mrr.tf.erb
@@ -18,6 +18,10 @@ resource "google_redis_instance" "<%= ctx[:primary_resource_id] %>" {
     my_key    = "my_val"
     other_key = "other_val"
   }
+
+  lifecycle {
+    prevent_destroy = <%= ctx[:vars]['prevent_destroy'] %>
+  }
 }
 
 // This example assumes this network already exists.
diff --git a/mmv1/templates/terraform/examples/redis_instance_private_service.tf.erb b/mmv1/templates/terraform/examples/redis_instance_private_service.tf.erb
index 800df78e22aa..9eedaf4a9fb3 100644
--- a/mmv1/templates/terraform/examples/redis_instance_private_service.tf.erb
+++ b/mmv1/templates/terraform/examples/redis_instance_private_service.tf.erb
@@ -6,7 +6,7 @@
 // If this network hasn't been created and you are using this example in your
 // config, add an additional network resource or change
 // this from "data"to "resource"
-data "google_compute_network" "redis-network" {
+resource "google_compute_network" "redis-network" {
   name = "<%= ctx[:vars]['network_name'] %>"
 }
 
@@ -15,11 +15,11 @@ resource "google_compute_global_address" "service_range" {
   purpose       = "VPC_PEERING"
   address_type  = "INTERNAL"
   prefix_length = 16
-  network       = data.google_compute_network.redis-network.id
+  network       = google_compute_network.redis-network.id
 }
 
 resource "google_service_networking_connection" "private_service_connection" {
-  network                 = data.google_compute_network.redis-network.id
+  network                 = google_compute_network.redis-network.id
   service                 = "servicenetworking.googleapis.com"
   reserved_peering_ranges = [google_compute_global_address.service_range.name]
 }
@@ -32,7 +32,7 @@ resource "google_redis_instance" "<%= ctx[:primary_resource_id] %>" {
   location_id             = "us-central1-a"
   alternative_location_id = "us-central1-f"
 
-  authorized_network = data.google_compute_network.redis-network.id
+  authorized_network = google_compute_network.redis-network.id
   connect_mode       = "PRIVATE_SERVICE_ACCESS"
 
   redis_version     = "REDIS_4_0"
@@ -40,4 +40,7 @@ resource "google_redis_instance" "<%= ctx[:primary_resource_id] %>" {
 
   depends_on = [google_service_networking_connection.private_service_connection]
 
-}
\ No newline at end of file
+  lifecycle {
+    prevent_destroy = <%= ctx[:vars]['prevent_destroy'] %>
+  }
+}
diff --git a/mmv1/templates/terraform/examples/redis_instance_private_service_test.tf.erb b/mmv1/templates/terraform/examples/redis_instance_private_service_test.tf.erb
new file mode 100644
index 000000000000..0b69e81cf45b
--- /dev/null
+++ b/mmv1/templates/terraform/examples/redis_instance_private_service_test.tf.erb
@@ -0,0 +1,30 @@
+// This example assumes this network already exists.
+// The API creates a tenant network per network authorized for a
+// Redis instance and that network is not deleted when the user-created
+// network (authorized_network) is deleted, so this prevents issues
+// with tenant network quota.
+// If this network hasn't been created and you are using this example in your
+// config, add an additional network resource or change
+// this from "data"to "resource"
+data "google_compute_network" "redis-network" {
+  name = "<%= ctx[:vars]['network_name'] %>"
+}
+
+resource "google_redis_instance" "<%= ctx[:primary_resource_id] %>" {
+  name           = "<%= ctx[:vars]['instance_name'] %>"
+  tier           = "STANDARD_HA"
+  memory_size_gb = 1
+
+  location_id             = "us-central1-a"
+  alternative_location_id = "us-central1-f"
+
+  authorized_network = data.google_compute_network.redis-network.id
+  connect_mode       = "PRIVATE_SERVICE_ACCESS"
+
+  redis_version     = "REDIS_4_0"
+  display_name      = "Terraform Test Instance"
+
+  lifecycle {
+    prevent_destroy = <%= ctx[:vars]['prevent_destroy'] %>
+  }
+}
diff --git a/mmv1/templates/terraform/examples/router_nat_private.tf.erb b/mmv1/templates/terraform/examples/router_nat_private.tf.erb
new file mode 100644
index 000000000000..8606db04c60a
--- /dev/null
+++ b/mmv1/templates/terraform/examples/router_nat_private.tf.erb
@@ -0,0 +1,73 @@
+resource "google_compute_network" "net" {
+  provider = google-beta
+
+  name     = "<%= ctx[:vars]['network_name'] %>"
+}
+
+resource "google_compute_subnetwork" "subnet" {
+  provider      = google-beta
+
+  name          = "<%= ctx[:vars]['subnet_name'] %>"
+  network       = google_compute_network.net.id
+  ip_cidr_range = "10.0.0.0/16"
+  region        = "us-central1"
+  purpose       = "PRIVATE_NAT"
+}
+
+resource "google_compute_router" "router" {
+  provider = google-beta
+
+  name     = "<%= ctx[:vars]['router_name'] %>"
+  region   = google_compute_subnetwork.subnet.region
+  network  = google_compute_network.net.id
+}
+
+resource "google_network_connectivity_hub" "hub" {
+  provider    = google-beta
+
+  name        = "<%= ctx[:vars]['hub_name'] %>"
+  description = "vpc hub for inter vpc nat"
+}
+
+resource "google_network_connectivity_spoke" "spoke" {
+  provider    = google-beta
+
+  name        = "<%= ctx[:vars]['spoke_name'] %>"
+  location    = "global"
+  description = "vpc spoke for inter vpc nat"
+  hub         =  google_network_connectivity_hub.hub.id
+  linked_vpc_network {
+    exclude_export_ranges = [
+      "198.51.100.0/24",
+      "10.10.0.0/16"
+    ]
+    uri = google_compute_network.net.self_link
+  }
+}
+
+resource "google_compute_router_nat" "<%= ctx[:primary_resource_id] %>" {
+  provider                            = google-beta
+
+  name                                = "<%= ctx[:vars]['nat_name'] %>"
+  router                              = google_compute_router.router.name
+  region                              = google_compute_router.router.region
+  source_subnetwork_ip_ranges_to_nat  = "LIST_OF_SUBNETWORKS"
+  enable_dynamic_port_allocation      = false
+  enable_endpoint_independent_mapping = false
+  min_ports_per_vm                    = 32
+  type                                = "PRIVATE"
+  subnetwork {
+    name                    = google_compute_subnetwork.subnet.id
+    source_ip_ranges_to_nat = ["ALL_IP_RANGES"]
+  }
+  rules {
+    rule_number = 100
+    description = "rule for private nat"
+    match       = "nexthop.hub == \"//networkconnectivity.googleapis.com/projects/acm-test-proj-123/locations/global/hubs/<%= ctx[:vars]['hub_name'] %>\""
+    action {
+      source_nat_active_ranges = [
+        google_compute_subnetwork.subnet.self_link
+      ]
+    }
+  }
+}
diff --git a/mmv1/templates/terraform/examples/scc_folder_custom_module_basic.tf.erb b/mmv1/templates/terraform/examples/scc_folder_custom_module_basic.tf.erb
new file mode 100644
index 000000000000..5a56b75249da
--- /dev/null
+++ b/mmv1/templates/terraform/examples/scc_folder_custom_module_basic.tf.erb
@@ -0,0 +1,23 @@
+resource "google_folder" "folder" {
+  parent       = "organizations/<%= ctx[:test_env_vars]['org_id'] %>"
+  display_name = "<%= ctx[:vars]['folder_display_name'] %>"
+}
+
+resource "google_scc_folder_custom_module" "<%= ctx[:primary_resource_id] %>" {
+  folder = google_folder.folder.folder_id
+  display_name = "<%= ctx[:vars]['display_name'] %>"
+  enablement_state = "ENABLED"
+  custom_config {
+    predicate {
+      expression = "resource.rotationPeriod > duration(\"2592000s\")"
+    }
+    resource_selector {
+      resource_types = [
+        "cloudkms.googleapis.com/CryptoKey",
+      ]
+    }
+    description = "The rotation period of the identified cryptokey resource exceeds 30 days."
+    recommendation = "Set the rotation period to at most 30 days."
+    severity = "MEDIUM"
+  }
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/scc_folder_custom_module_full.tf.erb b/mmv1/templates/terraform/examples/scc_folder_custom_module_full.tf.erb
new file mode 100644
index 000000000000..b54bcd04c701
--- /dev/null
+++ b/mmv1/templates/terraform/examples/scc_folder_custom_module_full.tf.erb
@@ -0,0 +1,37 @@
+resource "google_folder" "folder" {
+  parent       = "organizations/<%= ctx[:test_env_vars]['org_id'] %>"
+  display_name = "<%= ctx[:vars]['folder_display_name'] %>"
+}
+
+resource "google_scc_folder_custom_module" "<%= ctx[:primary_resource_id] %>" {
+  folder = google_folder.folder.folder_id
+  display_name = "<%= ctx[:vars]['display_name'] %>"
+  enablement_state = "ENABLED"
+  custom_config {
+    predicate {
+      expression = "resource.rotationPeriod > duration(\"2592000s\")"
+      title = "Purpose of the expression"
+      description = "description of the expression"
+      location = "location of the expression"
+    }
+    custom_output {
+      properties {
+        name = "duration"
+        value_expression {
+          expression = "resource.rotationPeriod"
+          title = "Purpose of the expression"
+          description = "description of the expression"
+          location = "location of the expression"
+        }
+      }
+    }
+    resource_selector {
+      resource_types = [
+        "cloudkms.googleapis.com/CryptoKey",
+      ]
+    }
+    severity = "LOW"
+    description = "Description of the custom module"
+    recommendation = "Steps to resolve violation"
+  }
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/scc_organization_custom_module_basic.tf.erb b/mmv1/templates/terraform/examples/scc_organization_custom_module_basic.tf.erb
new file mode 100644
index 000000000000..841f40f5be13
--- /dev/null
+++ b/mmv1/templates/terraform/examples/scc_organization_custom_module_basic.tf.erb
@@ -0,0 +1,18 @@
+resource "google_scc_organization_custom_module" "<%= ctx[:primary_resource_id] %>" {
+  organization = "<%= ctx[:test_env_vars]['org_id'] %>"
+  display_name = "<%= ctx[:vars]['display_name'] %>"
+  enablement_state = "ENABLED"
+  custom_config {
+    predicate {
+      expression = "resource.rotationPeriod > duration(\"2592000s\")"
+    }
+    resource_selector {
+      resource_types = [
+        "cloudkms.googleapis.com/CryptoKey",
+      ]
+    }
+    description = "The rotation period of the identified cryptokey resource exceeds 30 days."
+    recommendation = "Set the rotation period to at most 30 days."
+    severity = "MEDIUM"
+  }
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/scc_organization_custom_module_full.tf.erb b/mmv1/templates/terraform/examples/scc_organization_custom_module_full.tf.erb
new file mode 100644
index 000000000000..2737451ae4c3
--- /dev/null
+++ b/mmv1/templates/terraform/examples/scc_organization_custom_module_full.tf.erb
@@ -0,0 +1,32 @@
+resource "google_scc_organization_custom_module" "<%= ctx[:primary_resource_id] %>" {
+  organization = "<%= ctx[:test_env_vars]['org_id'] %>"
+  display_name = "<%= ctx[:vars]['display_name'] %>"
+  enablement_state = "ENABLED"
+  custom_config {
+    predicate {
+      expression = "resource.rotationPeriod > duration(\"2592000s\")"
+      title = "Purpose of the expression"
+      description = "description of the expression"
+      location = "location of the expression"
+    }
+    custom_output {
+      properties {
+        name = "duration"
+        value_expression {
+          expression = "resource.rotationPeriod"
+          title = "Purpose of the expression"
+          description = "description of the expression"
+          location = "location of the expression"
+        }
+      }
+    }
+    resource_selector {
+      resource_types = [
+        "cloudkms.googleapis.com/CryptoKey",
+      ]
+    }
+    severity = "LOW"
+    description = "Description of the custom module"
+    recommendation = "Steps to resolve violation"
+  }
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/scc_project_custom_module_basic.tf.erb b/mmv1/templates/terraform/examples/scc_project_custom_module_basic.tf.erb
new file mode 100644
index 000000000000..8ec2a4bb9785
--- /dev/null
+++ b/mmv1/templates/terraform/examples/scc_project_custom_module_basic.tf.erb
@@ -0,0 +1,17 @@
+resource "google_scc_project_custom_module" "<%= ctx[:primary_resource_id] %>" {
+  display_name = "<%= ctx[:vars]['display_name'] %>"
+  enablement_state = "ENABLED"
+  custom_config {
+    predicate {
+      expression = "resource.rotationPeriod > duration(\"2592000s\")"
+    }
+    resource_selector {
+      resource_types = [
+        "cloudkms.googleapis.com/CryptoKey",
+      ]
+    }
+    description = "The rotation period of the identified cryptokey resource exceeds 30 days."
+    recommendation = "Set the rotation period to at most 30 days."
+    severity = "MEDIUM"
+  }
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/scc_project_custom_module_full.tf.erb b/mmv1/templates/terraform/examples/scc_project_custom_module_full.tf.erb
new file mode 100644
index 000000000000..4b8ed23aa7ad
--- /dev/null
+++ b/mmv1/templates/terraform/examples/scc_project_custom_module_full.tf.erb
@@ -0,0 +1,31 @@
+resource "google_scc_project_custom_module" "<%= ctx[:primary_resource_id] %>" {
+  display_name = "<%= ctx[:vars]['display_name'] %>"
+  enablement_state = "ENABLED"
+  custom_config {
+    predicate {
+      expression = "resource.rotationPeriod > duration(\"2592000s\")"
+      title = "Purpose of the expression"
+      description = "description of the expression"
+      location = "location of the expression"
+    }
+    custom_output {
+      properties {
+        name = "duration"
+        value_expression {
+          expression = "resource.rotationPeriod"
+          title = "Purpose of the expression"
+          description = "description of the expression"
+          location = "location of the expression"
+        }
+      }
+    }
+    resource_selector {
+      resource_types = [
+        "cloudkms.googleapis.com/CryptoKey",
+      ]
+    }
+    severity = "LOW"
+    description = "Description of the custom module"
+    recommendation = "Steps to resolve violation"
+  }
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/secret_version_basic.tf.erb b/mmv1/templates/terraform/examples/secret_version_basic.tf.erb
index 3df2522be8f0..3bcaa96bd77c 100644
--- a/mmv1/templates/terraform/examples/secret_version_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/secret_version_basic.tf.erb
@@ -6,7 +6,7 @@ resource "google_secret_manager_secret" "secret-basic" {
   }
 
   replication {
-    automatic = true
+    auto {}
   }
 }
 
diff --git a/mmv1/templates/terraform/examples/secret_version_deletion_policy_abandon.tf.erb b/mmv1/templates/terraform/examples/secret_version_deletion_policy_abandon.tf.erb
new file mode 100644
index 000000000000..d095cef163bc
--- /dev/null
+++ b/mmv1/templates/terraform/examples/secret_version_deletion_policy_abandon.tf.erb
@@ -0,0 +1,18 @@
+resource "google_secret_manager_secret" "secret-basic" {
+  secret_id = "<%= ctx[:vars]['secret_id'] %>"
+
+  replication {
+    user_managed {
+      replicas {
+        location = "us-central1"
+      }
+    }
+  }
+}
+
+resource "google_secret_manager_secret_version" "<%= ctx[:primary_resource_id] %>" {
+  secret = google_secret_manager_secret.secret-basic.id
+
+  secret_data = "<%= ctx[:vars]['data'] %>"
+  deletion_policy = "ABANDON"
+}
diff --git a/mmv1/templates/terraform/examples/secret_version_deletion_policy_disable.tf.erb b/mmv1/templates/terraform/examples/secret_version_deletion_policy_disable.tf.erb
new file mode 100644
index 000000000000..a5933f9fe85f
--- /dev/null
+++ b/mmv1/templates/terraform/examples/secret_version_deletion_policy_disable.tf.erb
@@ -0,0 +1,18 @@
+resource "google_secret_manager_secret" "secret-basic" {
+  secret_id = "<%= ctx[:vars]['secret_id'] %>"
+
+  replication {
+    user_managed {
+      replicas {
+        location = "us-central1"
+      }
+    }
+  }
+}
+
+resource "google_secret_manager_secret_version" "<%= ctx[:primary_resource_id] %>" {
+  secret = google_secret_manager_secret.secret-basic.id
+
+  secret_data = "<%= ctx[:vars]['data'] %>"
+  deletion_policy = "DISABLE"
+}
diff --git a/mmv1/templates/terraform/examples/secret_version_with_base64_string_secret_data.tf.erb b/mmv1/templates/terraform/examples/secret_version_with_base64_string_secret_data.tf.erb
new file mode 100644
index 000000000000..c9fd886c37a5
--- /dev/null
+++ b/mmv1/templates/terraform/examples/secret_version_with_base64_string_secret_data.tf.erb
@@ -0,0 +1,18 @@
+resource "google_secret_manager_secret" "secret-basic" {
+  secret_id = "<%= ctx[:vars]['secret_id'] %>"
+
+  replication {
+    user_managed {
+      replicas {
+        location = "us-central1"
+      }
+    }
+  }
+}
+
+resource "google_secret_manager_secret_version" "<%= ctx[:primary_resource_id] %>" {
+  secret = google_secret_manager_secret.secret-basic.id
+
+  is_secret_data_base64 = true
+  secret_data = filebase64("<%= ctx[:vars]['data'] %>")
+}
diff --git a/mmv1/templates/terraform/examples/secret_with_annotations.tf.erb b/mmv1/templates/terraform/examples/secret_with_annotations.tf.erb
index 4ae910ae37e0..3199ce7781eb 100644
--- a/mmv1/templates/terraform/examples/secret_with_annotations.tf.erb
+++ b/mmv1/templates/terraform/examples/secret_with_annotations.tf.erb
@@ -14,6 +14,6 @@ resource "google_secret_manager_secret" "<%= ctx[:primary_resource_id] %>" {
   }
 
   replication {
-    automatic = true
+    auto {}
   }
 }
diff --git a/mmv1/templates/terraform/examples/secret_with_automatic_cmek.tf.erb b/mmv1/templates/terraform/examples/secret_with_automatic_cmek.tf.erb
new file mode 100644
index 000000000000..d268bcecaa08
--- /dev/null
+++ b/mmv1/templates/terraform/examples/secret_with_automatic_cmek.tf.erb
@@ -0,0 +1,21 @@
+data "google_project" "project" {}
+
+resource "google_kms_crypto_key_iam_member" "kms-secret-binding" {
+  crypto_key_id = "<%= ctx[:vars]['kms_key_name'] %>"
+  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+  member        = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-secretmanager.iam.gserviceaccount.com"
+}
+
+resource "google_secret_manager_secret" "<%= ctx[:primary_resource_id] %>" {
+  secret_id = "<%= ctx[:vars]['secret_id'] %>"
+
+  replication {
+    auto {
+      customer_managed_encryption {
+        kms_key_name = "<%= ctx[:vars]['kms_key_name'] %>"
+      }
+    }
+  }
+
+  depends_on = [ google_kms_crypto_key_iam_member.kms-secret-binding ]
+}
diff --git a/mmv1/templates/terraform/examples/sql_mysql_instance_private_ip.tf.erb b/mmv1/templates/terraform/examples/sql_mysql_instance_private_ip.tf.erb
deleted file mode 100644
index 9056ec99bdc0..000000000000
--- a/mmv1/templates/terraform/examples/sql_mysql_instance_private_ip.tf.erb
+++ /dev/null
@@ -1,47 +0,0 @@
-# [START cloud_sql_mysql_instance_private_ip]
-
-# [START vpc_mysql_instance_private_ip_network]
-resource "google_compute_network" "private_network" {
-  name                    = "<%= ctx[:vars]['private_network'] %>"
-  auto_create_subnetworks = "false"
-}
-# [END vpc_mysql_instance_private_ip_network]
-
-# [START vpc_mysql_instance_private_ip_address]
-resource "google_compute_global_address" "private_ip_address" {
-  name          = "<%= ctx[:vars]['private_ip_address'] %>"
-  purpose       = "VPC_PEERING"
-  address_type  = "INTERNAL"
-  prefix_length = 16
-  network       = google_compute_network.private_network.id
-}
-# [END vpc_mysql_instance_private_ip_address]
-
-# [START vpc_mysql_instance_private_ip_service_connection]
-resource "google_service_networking_connection" "private_vpc_connection" {
-  network                 = google_compute_network.private_network.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.private_ip_address.name]
-}
-# [END vpc_mysql_instance_private_ip_service_connection]
-
-# [START cloud_sql_mysql_instance_private_ip_instance]
-resource "google_sql_database_instance" "<%= ctx[:primary_resource_id] %>" {
-  name             = "<%= ctx[:vars]['private_ip_sql_instance'] %>"
-  region           = "us-central1"
-  database_version = "MYSQL_8_0"
-
-  depends_on = [google_service_networking_connection.private_vpc_connection]
-
-  settings {
-    tier = "db-f1-micro"
-    ip_configuration {
-      ipv4_enabled    = "false"
-      private_network = google_compute_network.private_network.id
-    }
-  }
-  deletion_protection = "false"
-}
-# [END cloud_sql_mysql_instance_private_ip_instance]
-
-# [END cloud_sql_mysql_instance_private_ip]
diff --git a/mmv1/templates/terraform/examples/sql_postgres_instance_private_ip.tf.erb b/mmv1/templates/terraform/examples/sql_postgres_instance_private_ip.tf.erb
deleted file mode 100644
index 154849a0a011..000000000000
--- a/mmv1/templates/terraform/examples/sql_postgres_instance_private_ip.tf.erb
+++ /dev/null
@@ -1,47 +0,0 @@
-# [START cloud_sql_postgres_instance_private_ip]
-
-# [START vpc_postgres_instance_private_ip_network]
-resource "google_compute_network" "private_network" {
-  name                    = "<%= ctx[:vars]['private_network'] %>"
-  auto_create_subnetworks = "false"
-}
-# [END vpc_postgres_instance_private_ip_network]
-
-# [START vpc_postgres_instance_private_ip_address]
-resource "google_compute_global_address" "private_ip_address" {
-  name          = "<%= ctx[:vars]['private_ip_address'] %>"
-  purpose       = "VPC_PEERING"
-  address_type  = "INTERNAL"
-  prefix_length = 16
-  network       = google_compute_network.private_network.id
-}
-# [END vpc_postgres_instance_private_ip_address]
-
-# [START vpc_postgres_instance_private_ip_service_connection]
-resource "google_service_networking_connection" "private_vpc_connection" {
-  network                 = google_compute_network.private_network.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.private_ip_address.name]
-}
-# [END vpc_postgres_instance_private_ip_service_connection]
-
-# [START cloud_sql_postgres_instance_private_ip_instance]
-resource "google_sql_database_instance" "<%= ctx[:primary_resource_id] %>" {
-  name             = "<%= ctx[:vars]['private_ip_sql_instance'] %>"
-  region           = "us-central1"
-  database_version = "POSTGRES_14"
-
-  depends_on = [google_service_networking_connection.private_vpc_connection]
-
-  settings {
-    tier = "db-custom-2-7680"
-    ip_configuration {
-      ipv4_enabled    = "false"
-      private_network = google_compute_network.private_network.id
-    }
-  }
-  deletion_protection = "false"
-}
-# [END cloud_sql_postgres_instance_private_ip_instance]
-
-# [END cloud_sql_postgres_instance_private_ip]
diff --git a/mmv1/templates/terraform/examples/sql_sqlserver_instance_active_directory.tf.erb b/mmv1/templates/terraform/examples/sql_sqlserver_instance_active_directory.tf.erb
deleted file mode 100644
index e800c427bce2..000000000000
--- a/mmv1/templates/terraform/examples/sql_sqlserver_instance_active_directory.tf.erb
+++ /dev/null
@@ -1,51 +0,0 @@
-# [START cloud_sql_sqlserver_instance_directory_instance]
-
-# [START vpc_sqlserver_instance_active_directory_network]
-resource "google_compute_network" "private_network" {
-  name                    = "<%= ctx[:vars]['private_network'] %>"
-  auto_create_subnetworks = "false"
-}
-# [END vpc_sqlserver_instance_active_directory_network]
-
-# [START vpc_sqlserver_instance_active_directory_address]
-resource "google_compute_global_address" "private_ip_address" {
-  name          = "<%= ctx[:vars]['private_ip_address'] %>"
-  purpose       = "VPC_PEERING"
-  address_type  = "INTERNAL"
-  prefix_length = 16
-  network       = google_compute_network.private_network.id
-}
-# [END vpc_sqlserver_instance_active_directory_address]
-
-# [START vpc_sqlserver_instance_active_directory_service_connection]
-resource "google_service_networking_connection" "private_vpc_connection" {
-  network                 = google_compute_network.private_network.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.private_ip_address.name]
-}
-# [END vpc_sqlserver_instance_active_directory_service_connection]
-
-# [START cloud_sql_sqlserver_instance_active_directory_instance]
-resource "google_sql_database_instance" "<%= ctx[:primary_resource_id] %>" {
-  name             = "<%= ctx[:vars]['database_instance_name'] %>"
-  region           = "us-central1"
-  database_version = "SQLSERVER_2019_STANDARD"
-  root_password    = "INSERT-PASSWORD-HERE"
-
-  depends_on = [google_service_networking_connection.private_vpc_connection]
-
-  settings {
-    tier = "db-custom-2-7680"
-    active_directory_config {
-      domain = "ad.domain.com"
-    }
-    ip_configuration {
-      ipv4_enabled    = "false"
-      private_network = google_compute_network.private_network.id
-    }
-  }
-  deletion_protection =  "<%= ctx[:vars]['deletion_protection'] %>"
-}
-# [END cloud_sql_sqlserver_instance_active_directory_instance]
-
-# [END cloud_sql_sqlserver_instance_directory_instance"
diff --git a/mmv1/templates/terraform/examples/sql_sqlserver_instance_private_ip.tf.erb b/mmv1/templates/terraform/examples/sql_sqlserver_instance_private_ip.tf.erb
deleted file mode 100644
index f66c7aa32c42..000000000000
--- a/mmv1/templates/terraform/examples/sql_sqlserver_instance_private_ip.tf.erb
+++ /dev/null
@@ -1,48 +0,0 @@
-# [START cloud_sql_sqlserver_instance_private_ip]
-
-# [START vpc_sqlserver_instance_private_ip_network]
-resource "google_compute_network" "private_network" {
-  name                    = "<%= ctx[:vars]['private_network'] %>"
-  auto_create_subnetworks = "false"
-}
-# [END vpc_sqlserver_instance_private_ip_network]
-
-# [START vpc_sqlserver_instance_private_ip_address]
-resource "google_compute_global_address" "private_ip_address" {
-  name          = "<%= ctx[:vars]['private_ip_address'] %>"
-  purpose       = "VPC_PEERING"
-  address_type  = "INTERNAL"
-  prefix_length = 16
-  network       = google_compute_network.private_network.id
-}
-# [END vpc_sqlserver_instance_private_ip_address]
-
-# [START vpc_sqlserver_instance_private_ip_service_connection]
-resource "google_service_networking_connection" "private_vpc_connection" {
-  network                 = google_compute_network.private_network.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.private_ip_address.name]
-}
-# [END vpc_sqlserver_instance_private_ip_service_connection]
-
-# [START cloud_sql_sqlserver_instance_private_ip_instance]
-resource "google_sql_database_instance" "<%= ctx[:primary_resource_id] %>" {
-  name             = "<%= ctx[:vars]['private_ip_sql_instance'] %>"
-  region           = "us-central1"
-  database_version = "SQLSERVER_2019_STANDARD"
-  root_password        = "INSERT-PASSWORD-HERE"
-
-  depends_on = [google_service_networking_connection.private_vpc_connection]
-
-  settings {
-    tier = "db-custom-2-7680"
-    ip_configuration {
-      ipv4_enabled    = "false"
-      private_network = google_compute_network.private_network.id
-    }
-  }
-  deletion_protection = "false"
-}
-# [END cloud_sql_sqlserver_instance_private_ip_instance]
-
-# [END cloud_sql_sqlserver_instance_private_ip]
diff --git a/mmv1/templates/terraform/examples/storage_insights_report_config.tf.erb b/mmv1/templates/terraform/examples/storage_insights_report_config.tf.erb
new file mode 100644
index 000000000000..fba9c9d3ee0b
--- /dev/null
+++ b/mmv1/templates/terraform/examples/storage_insights_report_config.tf.erb
@@ -0,0 +1,48 @@
+data "google_project" "project" {
+}
+
+resource "google_storage_insights_report_config" "<%= ctx[:primary_resource_id] %>" {
+  display_name = "Test Report Config"
+  location = "us-central1"
+  frequency_options {
+    frequency = "WEEKLY"
+    start_date {
+      day = 15
+      month = 3
+      year = 2050
+    }
+    end_date {
+      day = 15
+      month = 4
+      year = 2050
+    }
+  }
+  csv_options {
+    record_separator = "\n"
+    delimiter = ","
+    header_required = false
+  }
+  object_metadata_report_options {
+    metadata_fields = ["bucket", "name", "project"]
+    storage_filters {
+      bucket = google_storage_bucket.report_bucket.name
+    }
+    storage_destination_options {
+      bucket = google_storage_bucket.report_bucket.name
+      destination_path = "test-insights-reports"
+    }
+  }
+}
+
+resource "google_storage_bucket" "report_bucket" {
+  name                        = "<%= ctx[:vars]['bucket_name'] %>"
+  location                    = "us-central1"
+  force_destroy               = true
+  uniform_bucket_level_access = true
+}
+
+resource "google_storage_bucket_iam_member" "admin" {
+  bucket = google_storage_bucket.report_bucket.name
+  role   = "roles/storage.admin"
+  member = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-storageinsights.iam.gserviceaccount.com"
+}
diff --git a/mmv1/templates/terraform/examples/subnetwork_cidr_overlap.tf.erb b/mmv1/templates/terraform/examples/subnetwork_cidr_overlap.tf.erb
new file mode 100644
index 000000000000..137f0ccc784c
--- /dev/null
+++ b/mmv1/templates/terraform/examples/subnetwork_cidr_overlap.tf.erb
@@ -0,0 +1,16 @@
+resource "google_compute_subnetwork" "subnetwork-cidr-overlap" {
+  provider = google-beta
+
+  name                             = "<%= ctx[:vars]['subnetwork_name'] %>"
+  region                           = "us-west2"
+  ip_cidr_range                    = "192.168.1.0/24"
+  allow_subnet_cidr_routes_overlap = true
+  network                          = google_compute_network.net-cidr-overlap.id
+}
+
+resource "google_compute_network" "net-cidr-overlap" {
+  provider                = google-beta
+
+  name                    = "<%= ctx[:vars]['network_name'] %>"
+  auto_create_subnetworks = false
+}
diff --git a/mmv1/templates/terraform/examples/subnetwork_purpose_private_nat.tf.erb b/mmv1/templates/terraform/examples/subnetwork_purpose_private_nat.tf.erb
new file mode 100644
index 000000000000..198e86759998
--- /dev/null
+++ b/mmv1/templates/terraform/examples/subnetwork_purpose_private_nat.tf.erb
@@ -0,0 +1,16 @@
+resource "google_compute_subnetwork" "subnetwork-purpose-private-nat" {
+  provider         = google-beta
+
+  name             = "<%= ctx[:vars]['subnetwork_name'] %>"
+  region           = "us-west2"
+  ip_cidr_range    = "192.168.1.0/24"
+  purpose          = "PRIVATE_NAT"
+  network          = google_compute_network.custom-test.id
+}
+
+resource "google_compute_network" "custom-test" {
+  provider                = google-beta
+
+  name                    = "<%= ctx[:vars]['network_name'] %>"
+  auto_create_subnetworks = false
+}
diff --git a/mmv1/templates/terraform/examples/target_https_proxy_certificate_manager_certificate.tf.erb b/mmv1/templates/terraform/examples/target_https_proxy_certificate_manager_certificate.tf.erb
new file mode 100644
index 000000000000..32856ea91677
--- /dev/null
+++ b/mmv1/templates/terraform/examples/target_https_proxy_certificate_manager_certificate.tf.erb
@@ -0,0 +1,45 @@
+
+resource "google_compute_target_https_proxy" "<%= ctx[:primary_resource_id] %>" {
+  name                             = "<%= ctx[:vars]['target_https_proxy_name'] %>"
+  url_map                          = google_compute_url_map.default.id
+  certificate_manager_certificates =  ["//certificatemanager.googleapis.com/${google_certificate_manager_certificate.default.id}"] # [google_certificate_manager_certificate.default.id] is also acceptable
+}
+
+resource "google_certificate_manager_certificate" "default" {
+  name              = "<%= ctx[:vars]['certificate_manager_certificate_name'] %>"
+  scope             = "ALL_REGIONS"
+  self_managed {
+    pem_certificate = file("test-fixtures/cert.pem")
+    pem_private_key = file("test-fixtures/private-key.pem")                                                                                                                
+  }
+}
+
+resource "google_compute_url_map" "default" {
+  name        = "<%= ctx[:vars]['url_map_name'] %>"
+  description = "a description"
+
+  default_service = google_compute_backend_service.default.id
+
+  host_rule {
+    hosts        = ["mysite.com"]
+    path_matcher = "allpaths"
+  }
+
+  path_matcher {
+    name            = "allpaths"
+    default_service = google_compute_backend_service.default.id
+
+    path_rule {
+      paths   = ["/*"]
+      service = google_compute_backend_service.default.id
+    }
+  }
+}
+
+resource "google_compute_backend_service" "default" {
+  name        = "<%= ctx[:vars]['backend_service_name'] %>"
+  port_name   = "http"
+  protocol    = "HTTP"
+  timeout_sec = 10
+  load_balancing_scheme = "INTERNAL_MANAGED"
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/target_https_proxy_mtls.tf.erb b/mmv1/templates/terraform/examples/target_https_proxy_mtls.tf.erb
new file mode 100644
index 000000000000..c77f12732a4d
--- /dev/null
+++ b/mmv1/templates/terraform/examples/target_https_proxy_mtls.tf.erb
@@ -0,0 +1,93 @@
+# [START cloudloadbalancing_target_https_proxy_mtls]
+data "google_project" "project" {
+  provider = google-beta
+}
+
+resource "google_compute_target_https_proxy" "<%= ctx[:primary_resource_id] %>" {
+  provider          = google-beta
+  name              = "<%= ctx[:vars]['target_https_proxy_name'] %>"
+  url_map           = google_compute_url_map.default.id
+  ssl_certificates  = [google_compute_ssl_certificate.default.id]
+  server_tls_policy = google_network_security_server_tls_policy.default.id
+}
+
+resource "google_certificate_manager_trust_config" "default" {
+  provider    = google-beta
+  name        = "<%= ctx[:vars]["trust_config_name"] %>"
+  description = "sample description for the trust config"
+  location    = "global"
+
+  trust_stores {
+    trust_anchors {
+      pem_certificate = file("test-fixtures/ca_cert.pem")
+    }
+    intermediate_cas {
+      pem_certificate = file("test-fixtures/ca_cert.pem")
+    }
+  }
+
+  labels = {
+    foo = "bar"
+  }
+}
+
+resource "google_network_security_server_tls_policy" "default" {
+  provider               = google-beta
+  name                   = "<%= ctx[:vars]['server_tls_policy_name'] %>"
+  description            = "my description"
+  location               = "global"
+  allow_open             = "false"
+  mtls_policy {
+    client_validation_mode = "ALLOW_INVALID_OR_MISSING_CLIENT_CERT"
+    client_validation_trust_config = "projects/${data.google_project.project.number}/locations/global/trustConfigs/${google_certificate_manager_trust_config.default.name}"
+  }
+}
+
+resource "google_compute_ssl_certificate" "default" {
+  provider    = google-beta
+  name        = "<%= ctx[:vars]['ssl_certificate_name'] %>"
+  private_key = file("path/to/private.key")
+  certificate = file("path/to/certificate.crt")
+}
+
+resource "google_compute_url_map" "default" {
+  provider    = google-beta
+  name        = "<%= ctx[:vars]['url_map_name'] %>"
+  description = "a description"
+
+  default_service = google_compute_backend_service.default.id
+
+  host_rule {
+    hosts        = ["mysite.com"]
+    path_matcher = "allpaths"
+  }
+
+  path_matcher {
+    name            = "allpaths"
+    default_service = google_compute_backend_service.default.id
+
+    path_rule {
+      paths   = ["/*"]
+      service = google_compute_backend_service.default.id
+    }
+  }
+}
+
+resource "google_compute_backend_service" "default" {
+  provider    = google-beta
+  name        = "<%= ctx[:vars]['backend_service_name'] %>"
+  port_name   = "http"
+  protocol    = "HTTP"
+  timeout_sec = 10
+
+  health_checks = [google_compute_http_health_check.default.id]
+}
+
+resource "google_compute_http_health_check" "default" {
+  provider           = google-beta
+  name               = "<%= ctx[:vars]['http_health_check_name'] %>"
+  request_path       = "/"
+  check_interval_sec = 1
+  timeout_sec        = 1
+}
+# [END cloudloadbalancing_target_https_proxy_mtls]
diff --git a/mmv1/templates/terraform/examples/tpu_node_full.tf.erb b/mmv1/templates/terraform/examples/tpu_node_full.tf.erb
index 0f88b33e3210..cebe528b24ac 100644
--- a/mmv1/templates/terraform/examples/tpu_node_full.tf.erb
+++ b/mmv1/templates/terraform/examples/tpu_node_full.tf.erb
@@ -34,8 +34,8 @@ resource "google_tpu_node" "<%= ctx[:primary_resource_id] %>" {
   }
 }
 
-data "google_compute_network" "network" {
-  name = "default"
+resource "google_compute_network" "network" {
+  name = "<%= ctx[:vars]['network_name'] %>"
 }
 
 resource "google_compute_global_address" "service_range" {
@@ -43,11 +43,11 @@ resource "google_compute_global_address" "service_range" {
   purpose       = "VPC_PEERING"
   address_type  = "INTERNAL"
   prefix_length = 16
-  network       = data.google_compute_network.network.id
+  network       = google_compute_network.network.id
 }
 
 resource "google_service_networking_connection" "private_service_connection" {
-  network                 = data.google_compute_network.network.id
+  network                 = google_compute_network.network.id
   service                 = "servicenetworking.googleapis.com"
   reserved_peering_ranges = [google_compute_global_address.service_range.name]
 }
\ No newline at end of file
diff --git a/mmv1/templates/terraform/examples/tpu_node_full_test.tf.erb b/mmv1/templates/terraform/examples/tpu_node_full_test.tf.erb
new file mode 100644
index 000000000000..bd62288a6577
--- /dev/null
+++ b/mmv1/templates/terraform/examples/tpu_node_full_test.tf.erb
@@ -0,0 +1,39 @@
+data "google_tpu_tensorflow_versions" "available" {
+}
+
+<%#-
+  WARNING: cidr_block must not overlap with other existing TPU blocks
+  Make sure if you change this value that it does not overlap with the
+  autogenerated examples.
+-%>
+
+resource "google_tpu_node" "<%= ctx[:primary_resource_id] %>" {
+  name = "<%= ctx[:vars]["node_name"] %>"
+  zone = "us-central1-b"
+
+  accelerator_type = "v3-8"
+
+  tensorflow_version = data.google_tpu_tensorflow_versions.available.versions[0]
+
+  description = "Terraform Google Provider test TPU"
+  use_service_networking = true
+<%#-
+  We previously used a separate network resource here, but TPUs only allow using 50
+  different network names, ever. This caused our tests to start failing, so just
+  use the default network in order to still demonstrate using as many fields as
+  possible on the resource.
+-%>
+  network = data.google_compute_network.network.id
+
+  labels = {
+    foo = "bar"
+  }
+
+  scheduling_config {
+    preemptible = true
+  }
+}
+
+data "google_compute_network" "network" {
+  name = "<%= ctx[:vars]['network_name'] %>"
+}
diff --git a/mmv1/templates/terraform/examples/tpu_v2_vm_basic.tf.erb b/mmv1/templates/terraform/examples/tpu_v2_vm_basic.tf.erb
new file mode 100644
index 000000000000..9888f0e30cbb
--- /dev/null
+++ b/mmv1/templates/terraform/examples/tpu_v2_vm_basic.tf.erb
@@ -0,0 +1,12 @@
+data "google_tpu_v2_runtime_versions" "available" {
+  provider = google-beta
+}
+
+resource "google_tpu_v2_vm" "<%= ctx[:primary_resource_id] %>" {
+  provider = google-beta
+
+  name = "<%= ctx[:vars]["vm_name"] %>"
+  zone = "us-central1-c"
+
+  runtime_version = "tpu-vm-tf-2.13.0"
+}
diff --git a/mmv1/templates/terraform/examples/tpu_v2_vm_full.tf.erb b/mmv1/templates/terraform/examples/tpu_v2_vm_full.tf.erb
new file mode 100644
index 000000000000..2e5fe2a82689
--- /dev/null
+++ b/mmv1/templates/terraform/examples/tpu_v2_vm_full.tf.erb
@@ -0,0 +1,103 @@
+data "google_tpu_v2_runtime_versions" "available" {
+  provider = google-beta
+}
+
+data "google_tpu_v2_accelerator_types" "available" {
+  provider = google-beta
+}
+
+resource "google_tpu_v2_vm" "<%= ctx[:primary_resource_id] %>" {
+  provider = google-beta
+
+  name = "<%= ctx[:vars]["vm_name"] %>"
+  zone = "us-central1-c"
+  description = "Text description of the TPU."
+
+  runtime_version  = "tpu-vm-tf-2.13.0"
+
+  accelerator_config {
+    type     = "V2"
+    topology = "2x2"
+  }
+
+  cidr_block = "10.0.0.0/29"
+
+  network_config {
+    can_ip_forward      = true
+    enable_external_ips = true
+    network             = google_compute_network.network.id
+    subnetwork          = google_compute_subnetwork.subnet.id
+  }
+  
+  scheduling_config {
+    preemptible = true
+  }
+
+  shielded_instance_config {
+    enable_secure_boot = true
+  }
+
+  service_account {
+    email = google_service_account.sa.email
+    scope = [
+      "https://www.googleapis.com/auth/cloud-platform",
+    ]
+  }
+
+  data_disks {
+    source_disk = google_compute_disk.disk.id
+    mode        = "READ_ONLY"
+  }
+
+  labels = {
+    foo = "bar"
+  }
+
+  metadata = {
+    foo = "bar"
+  }
+
+  tags = ["foo"]
+
+  depends_on = [time_sleep.wait_60_seconds]
+}
+
+resource "google_compute_subnetwork" "subnet" {
+  provider = google-beta
+
+  name          = "<%= ctx[:vars]['subnet_name'] %>"
+  ip_cidr_range = "10.0.0.0/16"
+  region        = "us-central1"
+  network       = google_compute_network.network.id
+}
+
+resource "google_compute_network" "network" {
+  provider = google-beta
+
+  name                    = "<%= ctx[:vars]['network_name'] %>"
+  auto_create_subnetworks = false
+}
+
+resource "google_service_account" "sa" {
+  provider = google-beta
+
+  account_id   = "<%= ctx[:vars]['sa_id'] %>"
+  display_name = "Test TPU VM"
+}
+
+resource "google_compute_disk" "disk" {
+  provider = google-beta
+
+  name  = "<%= ctx[:vars]['disk_name'] %>"
+  image = "debian-cloud/debian-11"
+  size  = 10
+  type  = "pd-ssd"
+  zone  = "us-central1-c"
+}
+
+# Wait after service account creation to limit eventual consistency errors.
+resource "time_sleep" "wait_60_seconds" {
+  depends_on = [google_service_account.sa]
+
+  create_duration = "60s"
+}
diff --git a/mmv1/templates/terraform/examples/uptime_check_config_http.tf.erb b/mmv1/templates/terraform/examples/uptime_check_config_http.tf.erb
index a20f502162e6..3d13d3ab99f5 100644
--- a/mmv1/templates/terraform/examples/uptime_check_config_http.tf.erb
+++ b/mmv1/templates/terraform/examples/uptime_check_config_http.tf.erb
@@ -1,13 +1,20 @@
 resource "google_monitoring_uptime_check_config" "<%= ctx[:primary_resource_id] %>" {
   display_name = "<%= ctx[:vars]["display_name"] %>"
   timeout      = "60s"
+  user_labels  = {
+    example-key = "example-value"
+  }
 
   http_check {
     path = "some-path"
     port = "8010"
     request_method = "POST"
-    content_type = "URL_ENCODED"
+    content_type = "USER_PROVIDED"
+    custom_content_type = "application/json"
     body = "Zm9vJTI1M0RiYXI="
+    ping_config {
+      pings_count = 1
+    }
   }
 
   monitored_resource {
diff --git a/mmv1/templates/terraform/examples/uptime_check_tcp.tf.erb b/mmv1/templates/terraform/examples/uptime_check_tcp.tf.erb
index c86059090301..46e4e78374b1 100644
--- a/mmv1/templates/terraform/examples/uptime_check_tcp.tf.erb
+++ b/mmv1/templates/terraform/examples/uptime_check_tcp.tf.erb
@@ -4,6 +4,9 @@ resource "google_monitoring_uptime_check_config" "<%= ctx[:primary_resource_id]
 
   tcp_check {
     port = 888
+    ping_config {
+      pings_count = 2
+    }
   }
 
   resource_group {
diff --git a/mmv1/templates/terraform/examples/vertex_ai_dataset.tf.erb b/mmv1/templates/terraform/examples/vertex_ai_dataset.tf.erb
index e5a5828cf0a2..17b7440b4288 100644
--- a/mmv1/templates/terraform/examples/vertex_ai_dataset.tf.erb
+++ b/mmv1/templates/terraform/examples/vertex_ai_dataset.tf.erb
@@ -2,4 +2,8 @@ resource "google_vertex_ai_dataset" "dataset" {
   display_name          = "<%= ctx[:vars]['display_name'] %>"
   metadata_schema_uri   = "gs://google-cloud-aiplatform/schema/dataset/metadata/image_1.0.0.yaml"
   region                = "us-central1"
+
+  labels = {
+    env = "test"
+  }
 }
diff --git a/mmv1/templates/terraform/examples/vertex_ai_endpoint_network.tf.erb b/mmv1/templates/terraform/examples/vertex_ai_endpoint_network.tf.erb
index abe0b82b3080..752c25264502 100644
--- a/mmv1/templates/terraform/examples/vertex_ai_endpoint_network.tf.erb
+++ b/mmv1/templates/terraform/examples/vertex_ai_endpoint_network.tf.erb
@@ -7,7 +7,7 @@ resource "google_vertex_ai_endpoint" "<%= ctx[:primary_resource_id] %>" {
   labels       = {
     label-one = "value-one"
   }
-  network      = "projects/${data.google_project.project.number}/global/networks/${data.google_compute_network.vertex_network.name}"
+  network      = "projects/${data.google_project.project.number}/global/networks/${google_compute_network.vertex_network.name}"
   encryption_spec {
     kms_key_name = "<%= ctx[:vars]['kms_key_name'] %>"
   }
@@ -17,7 +17,7 @@ resource "google_vertex_ai_endpoint" "<%= ctx[:primary_resource_id] %>" {
 }
 
 resource "google_service_networking_connection" "vertex_vpc_connection" {
-  network                 = data.google_compute_network.vertex_network.id
+  network                 = google_compute_network.vertex_network.id
   service                 = "servicenetworking.googleapis.com"
   reserved_peering_ranges = [google_compute_global_address.vertex_range.name]
 }
@@ -27,10 +27,10 @@ resource "google_compute_global_address" "vertex_range" {
   purpose       = "VPC_PEERING"
   address_type  = "INTERNAL"
   prefix_length = 24
-  network       = data.google_compute_network.vertex_network.id
+  network       = google_compute_network.vertex_network.id
 }
 
-data "google_compute_network" "vertex_network" {
+resource "google_compute_network" "vertex_network" {
   name       = "<%= ctx[:vars]['network_name'] %>"
 }
 
diff --git a/mmv1/templates/terraform/examples/vertex_ai_index_endpoint.tf.erb b/mmv1/templates/terraform/examples/vertex_ai_index_endpoint.tf.erb
index c15e65269e41..2c0b78e4e339 100644
--- a/mmv1/templates/terraform/examples/vertex_ai_index_endpoint.tf.erb
+++ b/mmv1/templates/terraform/examples/vertex_ai_index_endpoint.tf.erb
@@ -5,14 +5,14 @@ resource "google_vertex_ai_index_endpoint" "<%= ctx[:primary_resource_id] %>" {
   labels       = {
     label-one = "value-one"
   }
-  network      = "projects/${data.google_project.project.number}/global/networks/${data.google_compute_network.vertex_network.name}"
+  network      = "projects/${data.google_project.project.number}/global/networks/${google_compute_network.vertex_network.name}"
   depends_on   = [
     google_service_networking_connection.vertex_vpc_connection
   ]
 }
 
 resource "google_service_networking_connection" "vertex_vpc_connection" {
-  network                 = data.google_compute_network.vertex_network.id
+  network                 = google_compute_network.vertex_network.id
   service                 = "servicenetworking.googleapis.com"
   reserved_peering_ranges = [google_compute_global_address.vertex_range.name]
 }
@@ -22,10 +22,10 @@ resource "google_compute_global_address" "vertex_range" {
   purpose       = "VPC_PEERING"
   address_type  = "INTERNAL"
   prefix_length = 24
-  network       = data.google_compute_network.vertex_network.id
+  network       = google_compute_network.vertex_network.id
 }
 
-data "google_compute_network" "vertex_network" {
+resource "google_compute_network" "vertex_network" {
   name       = "<%= ctx[:vars]['network_name'] %>"
 }
 
diff --git a/mmv1/templates/terraform/examples/vertex_ai_index_endpoint_test.tf.erb b/mmv1/templates/terraform/examples/vertex_ai_index_endpoint_test.tf.erb
new file mode 100644
index 000000000000..323c08e69c3a
--- /dev/null
+++ b/mmv1/templates/terraform/examples/vertex_ai_index_endpoint_test.tf.erb
@@ -0,0 +1,15 @@
+resource "google_vertex_ai_index_endpoint" "<%= ctx[:primary_resource_id] %>" {
+  display_name = "sample-endpoint"
+  description  = "A sample vertex endpoint"
+  region       = "us-central1"
+  labels       = {
+    label-one = "value-one"
+  }
+  network      = "projects/${data.google_project.project.number}/global/networks/${data.google_compute_network.vertex_network.name}"
+}
+
+data "google_compute_network" "vertex_network" {
+  name       = "<%= ctx[:vars]['network_name'] %>"
+}
+
+data "google_project" "project" {}
diff --git a/mmv1/templates/terraform/examples/vertex_ai_index_endpoint_with_false_psc.tf.erb b/mmv1/templates/terraform/examples/vertex_ai_index_endpoint_with_false_psc.tf.erb
new file mode 100644
index 000000000000..83d069c229e9
--- /dev/null
+++ b/mmv1/templates/terraform/examples/vertex_ai_index_endpoint_with_false_psc.tf.erb
@@ -0,0 +1,12 @@
+resource "google_vertex_ai_index_endpoint" "<%= ctx[:primary_resource_id] %>" {
+  display_name = "sample-endpoint"
+  description  = "A sample vertex endpoint"
+  region       = "us-central1"
+  labels       = {
+    label-one = "value-one"
+  }
+
+  private_service_connect_config {
+    enable_private_service_connect = false
+  }
+}
diff --git a/mmv1/templates/terraform/examples/vertex_ai_index_endpoint_with_psc.tf.erb b/mmv1/templates/terraform/examples/vertex_ai_index_endpoint_with_psc.tf.erb
new file mode 100644
index 000000000000..1f52eaf2d962
--- /dev/null
+++ b/mmv1/templates/terraform/examples/vertex_ai_index_endpoint_with_psc.tf.erb
@@ -0,0 +1,17 @@
+resource "google_vertex_ai_index_endpoint" "<%= ctx[:primary_resource_id] %>" {
+  display_name = "sample-endpoint"
+  description  = "A sample vertex endpoint"
+  region       = "us-central1"
+  labels       = {
+    label-one = "value-one"
+  }
+
+  private_service_connect_config {
+    enable_private_service_connect = true
+    project_allowlist = [
+        data.google_project.project.number,
+    ]
+  }
+}
+
+data "google_project" "project" {}
diff --git a/mmv1/templates/terraform/examples/workflow_basic.tf.erb b/mmv1/templates/terraform/examples/workflow_basic.tf.erb
index 3369b4985048..8ed99e697d2f 100644
--- a/mmv1/templates/terraform/examples/workflow_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/workflow_basic.tf.erb
@@ -8,6 +8,12 @@ resource "google_workflows_workflow" "<%= ctx[:primary_resource_id] %>" {
   region        = "us-central1"
   description   = "Magic"
   service_account = google_service_account.test_account.id
+  labels = {
+    env = "test"
+  }
+  user_env_vars = {
+    url = "https://timeapi.io/api/Time/current/zone?timeZone=Europe/Amsterdam"
+  }
   source_contents = <<-EOF
   # This is a sample workflow. You can replace it with your source code.
   #
@@ -23,7 +29,7 @@ resource "google_workflows_workflow" "<%= ctx[:primary_resource_id] %>" {
   - getCurrentTime:
       call: http.get
       args:
-          url: https://timeapi.io/api/Time/current/zone?timeZone=Europe/Amsterdam
+          url: $${sys.get_env("url")}
       result: currentTime
   - readWikipedia:
       call: http.get
diff --git a/mmv1/templates/terraform/examples/workstation_basic.tf.erb b/mmv1/templates/terraform/examples/workstation_basic.tf.erb
index 2cfb2b733912..b5432bd1c060 100644
--- a/mmv1/templates/terraform/examples/workstation_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/workstation_basic.tf.erb
@@ -54,6 +54,10 @@ resource "google_workstations_workstation" "<%= ctx[:primary_resource_id] %>" {
     "label" = "key"
   }
 
+  env = {
+    name = "foo"
+  }
+
   annotations = {
     label-one = "value-one"
   }
diff --git a/mmv1/templates/terraform/examples/workstation_cluster_custom_domain.tf.erb b/mmv1/templates/terraform/examples/workstation_cluster_custom_domain.tf.erb
new file mode 100644
index 000000000000..d11e4a828ae2
--- /dev/null
+++ b/mmv1/templates/terraform/examples/workstation_cluster_custom_domain.tf.erb
@@ -0,0 +1,41 @@
+resource "google_workstations_workstation_cluster" "<%= ctx[:primary_resource_id] %>" {
+  provider               = google-beta
+  workstation_cluster_id = "<%= ctx[:vars]['workstation_cluster_name'] %>"
+  network                = google_compute_network.default.id
+  subnetwork             = google_compute_subnetwork.default.id
+  location               = "us-central1"
+
+  private_cluster_config {
+    enable_private_endpoint = true
+  }
+
+  domain_config {
+    domain = "workstations.example.com"
+  }
+
+  labels = {
+    "label" = "key"
+  }
+
+  annotations = {
+    label-one = "value-one"
+  }
+}
+
+data "google_project" "project" {
+  provider = google-beta
+}
+
+resource "google_compute_network" "default" {
+  provider                = google-beta
+  name                    = "<%= ctx[:vars]['workstation_cluster_name'] %>"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "default" {
+  provider = google-beta
+  name          = "<%= ctx[:vars]['workstation_cluster_name'] %>"
+  ip_cidr_range = "10.0.0.0/24"
+  region        = "us-central1"
+  network       = google_compute_network.default.name
+}
diff --git a/mmv1/templates/terraform/examples/workstation_config_accelerators.tf.erb b/mmv1/templates/terraform/examples/workstation_config_accelerators.tf.erb
index 35640b4a07b5..c9e819ec40bf 100644
--- a/mmv1/templates/terraform/examples/workstation_config_accelerators.tf.erb
+++ b/mmv1/templates/terraform/examples/workstation_config_accelerators.tf.erb
@@ -40,7 +40,7 @@ resource "google_workstations_workstation_config" "<%= ctx[:primary_resource_id]
       boot_disk_size_gb           = 35
       disable_public_ip_addresses = true
       accelerators {
-        type  = "nvidia-tesla-p100"
+        type  = "nvidia-tesla-t4"
         count = "1"
       }
     }
diff --git a/mmv1/templates/terraform/examples/workstation_config_basic.tf.erb b/mmv1/templates/terraform/examples/workstation_config_basic.tf.erb
index 314df7dd12f2..807fa7964410 100644
--- a/mmv1/templates/terraform/examples/workstation_config_basic.tf.erb
+++ b/mmv1/templates/terraform/examples/workstation_config_basic.tf.erb
@@ -37,6 +37,15 @@ resource "google_workstations_workstation_config" "<%= ctx[:primary_resource_id]
   idle_timeout = "600s"
   running_timeout = "21600s"
 
+  replica_zones = ["us-central1-a", "us-central1-b"]
+  annotations = {
+    label-one = "value-one"
+  }
+
+  labels = {
+    "label" = "key"
+  }
+
   host {
     gce_instance {
       machine_type                = "e2-standard-4"
diff --git a/mmv1/templates/terraform/examples/workstation_config_service_account.tf.erb b/mmv1/templates/terraform/examples/workstation_config_service_account.tf.erb
new file mode 100644
index 000000000000..18e1b07cbd34
--- /dev/null
+++ b/mmv1/templates/terraform/examples/workstation_config_service_account.tf.erb
@@ -0,0 +1,55 @@
+resource "google_compute_network" "default" {
+  provider                = google-beta
+  name                    = "<%= ctx[:vars]['workstation_cluster_name'] %>"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "default" {
+  provider      = google-beta
+  name          = "<%= ctx[:vars]['workstation_cluster_name'] %>"
+  ip_cidr_range = "10.0.0.0/24"
+  region        = "us-central1"
+  network       = google_compute_network.default.name
+}
+
+resource "google_workstations_workstation_cluster" "<%= ctx[:primary_resource_id] %>" {
+  provider               = google-beta
+  workstation_cluster_id = "<%= ctx[:vars]['workstation_cluster_name'] %>"
+  network                = google_compute_network.default.id
+  subnetwork             = google_compute_subnetwork.default.id
+  location               = "us-central1"
+  
+  labels = {
+    "label" = "key"
+  }
+
+  annotations = {
+    label-one = "value-one"
+  }
+}
+
+resource "google_service_account" "default" {
+  provider = google-beta
+
+  account_id   = "<%= ctx[:vars]['account_id'] %>"
+  display_name = "Service Account"
+}
+
+resource "google_workstations_workstation_config" "<%= ctx[:primary_resource_id] %>" {
+  provider               = google-beta
+  workstation_config_id  = "<%= ctx[:vars]['workstation_config_name'] %>"
+  workstation_cluster_id = google_workstations_workstation_cluster.<%= ctx[:primary_resource_id] %>.workstation_cluster_id
+  location   		         = "us-central1"
+
+  enable_audit_agent = true
+
+  host {
+    gce_instance {
+      machine_type                = "e2-standard-4"
+      boot_disk_size_gb           = 35
+      disable_public_ip_addresses = true
+      service_account             = google_service_account.default.email
+      service_account_scopes      = ["https://www.googleapis.com/auth/cloud-platform"]
+    }
+  }
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/expand_property_method.erb b/mmv1/templates/terraform/expand_property_method.erb
index d3a034e84ca2..d74d7bcc777c 100644
--- a/mmv1/templates/terraform/expand_property_method.erb
+++ b/mmv1/templates/terraform/expand_property_method.erb
@@ -75,6 +75,7 @@ func expand<%= prefix -%><%= titlelize_property(property) -%>(v interface{}, d t
 func expand<%= prefix -%><%= titlelize_property(property) -%>(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
   transformed := make(map[string]interface{})
 <%     property.nested_properties.each do |prop| -%>
+<%           next if prop.is_a?(Api::Type::KeyValuePairs) && prop.ignore_write -%>
   <% schemaPrefix = prop.flatten_object ? "nil" : "d.Get( \"#{prop.name.underscore}\" )" -%>
   transformed<%= titlelize_property(prop) -%>, err := expand<%= prefix -%><%= titlelize_property(property) -%><%= titlelize_property(prop) -%>(<%= schemaPrefix -%>, d, config)
   if err != nil {
@@ -130,6 +131,7 @@ func expand<%= prefix -%><%= titlelize_property(property) -%>(v interface{}, d t
     transformed := make(map[string]interface{})
 
 <%       property.nested_properties.each do |prop| -%>
+<%           next if prop.is_a?(Api::Type::KeyValuePairs) && prop.ignore_write -%>
       transformed<%= titlelize_property(prop) -%>, err := expand<%= prefix -%><%= titlelize_property(property) -%><%= titlelize_property(prop) -%>(original["<%= prop.name.underscore -%>"], d, config)
       if err != nil {
         return nil, err
@@ -175,6 +177,7 @@ func expand<%= prefix -%><%= titlelize_property(property) -%>(v interface{}, d t
 
 <% if !property.nested_properties.nil? -%>
 <%   property.nested_properties.each do |prop| -%>
+<%      next if prop.is_a?(Api::Type::KeyValuePairs) && prop.ignore_write -%>
 <%# Map is a map from {key -> object} in the API, but Terraform can't represent that
 so we treat the key as a property of the object in Terraform schema. %>
 <%=    lines(build_expand_method(prefix + titlelize_property(property), prop, object, pwd), 1) -%>
diff --git a/mmv1/templates/terraform/extra_schema_entry/cloudiot_device_registry.go.erb b/mmv1/templates/terraform/extra_schema_entry/cloudiot_device_registry.go.erb
deleted file mode 100644
index 7a1a8eec8f7a..000000000000
--- a/mmv1/templates/terraform/extra_schema_entry/cloudiot_device_registry.go.erb
+++ /dev/null
@@ -1,32 +0,0 @@
-"state_notification_config": {
-    Type:     schema.TypeMap,
-    Description: `A PubSub topic to publish device state updates.`,
-    Optional: true,
-},
-"mqtt_config": {
-    Type:     schema.TypeMap,
-    Description: `Activate or deactivate MQTT.`,
-    Computed: true,
-    Optional: true,
-},
-"http_config": {
-    Type:     schema.TypeMap,
-    Description: `Activate or deactivate HTTP.`,
-    Computed: true,
-    Optional: true,
-},
-"credentials": {
-    Type:     schema.TypeList,
-    Description: `List of public key certificates to authenticate devices.`,
-    Optional: true,
-    MaxItems: 10,
-    Elem: &schema.Resource{
-        Schema: map[string]*schema.Schema{
-            "public_key_certificate": {
-                Type:     schema.TypeMap,
-                Description: `A public key certificate format and data.`,
-                Required: true,
-            },
-        },
-    },
-},
diff --git a/mmv1/templates/terraform/extra_schema_entry/secret_version_is_secret_data_base64.go.erb b/mmv1/templates/terraform/extra_schema_entry/secret_version_is_secret_data_base64.go.erb
new file mode 100644
index 000000000000..4a7326ae8a22
--- /dev/null
+++ b/mmv1/templates/terraform/extra_schema_entry/secret_version_is_secret_data_base64.go.erb
@@ -0,0 +1,21 @@
+<%# The license inside this block applies to this file.
+	# Copyright 2023 Google Inc.
+	# Licensed under the Apache License, Version 2.0 (the "License");
+	# you may not use this file except in compliance with the License.
+	# You may obtain a copy of the License at
+	#
+	#     http://www.apache.org/licenses/LICENSE-2.0
+	#
+	# Unless required by applicable law or agreed to in writing, software
+	# distributed under the License is distributed on an "AS IS" BASIS,
+	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	# See the License for the specific language governing permissions and
+	# limitations under the License.
+-%>
+"is_secret_data_base64": {
+	Type:        schema.TypeBool,
+	Optional:    true,
+	ForceNew:    true,
+	Default:     false,
+	Description: `If set to 'true', the secret data is expected to be base64-encoded string and would be sent as is.`,
+},
diff --git a/mmv1/templates/terraform/flatten_property_method.erb b/mmv1/templates/terraform/flatten_property_method.erb
index ed6eda44afcc..f13a7d670744 100644
--- a/mmv1/templates/terraform/flatten_property_method.erb
+++ b/mmv1/templates/terraform/flatten_property_method.erb
@@ -93,6 +93,19 @@ func flatten<%= prefix -%><%= titlelize_property(property) -%>(v interface{}, d
     <% end -%>
     })
   }
+  return transformed
+<% elsif (property.is_a?(Api::Type::KeyValueLabels)) || (property.is_a?(Api::Type::KeyValueAnnotations)) || (property.is_a?(Api::Type::KeyValueTerraformLabels)) -%>
+  if v == nil {
+    return v
+  }
+
+  transformed := make(map[string]interface{})
+  if l, ok := d.GetOkExists("<%= property.terraform_lineage -%>"); ok {
+    for k := range l.(map[string]interface{}) {
+      transformed[k] = v.(map[string]interface{})[k]
+    }
+  }
+
   return transformed
 <% elsif property.is_a?(Api::Type::Integer) -%>
 	// Handles the string fixed64 format
diff --git a/mmv1/templates/terraform/post_create/firebasehosting_custom_domain_wait_dns_verification.erb b/mmv1/templates/terraform/post_create/firebasehosting_custom_domain_wait_dns_verification.erb
new file mode 100644
index 000000000000..3772581bc2bc
--- /dev/null
+++ b/mmv1/templates/terraform/post_create/firebasehosting_custom_domain_wait_dns_verification.erb
@@ -0,0 +1,14 @@
+if d.Get("wait_dns_verification") == true {
+    // Wait for the creation operation to complete before treating the resource
+    // as created
+    var opRes map[string]interface{}
+    err = FirebaseHostingOperationWaitTimeWithResponse(
+        config, res, &opRes, project, "Creating CustomDomain", userAgent,
+        d.Timeout(schema.TimeoutCreate))
+    if err != nil {
+        // The resource didn't actually create
+        d.SetId("")
+
+        return fmt.Errorf("Error waiting to create CustomDomain: %s", err)
+    }
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/post_create/integration_connectors_connection.go.erb b/mmv1/templates/terraform/post_create/integration_connectors_connection.go.erb
new file mode 100644
index 000000000000..07fd1790b3d6
--- /dev/null
+++ b/mmv1/templates/terraform/post_create/integration_connectors_connection.go.erb
@@ -0,0 +1,3 @@
+if err := waitforConnectionReady(d, config, d.Timeout(schema.TimeoutCreate) - time.Minute); err != nil {
+  return fmt.Errorf("Error waiting for Connection %q to finish being in CREATING state during creation: %q", d.Get("name").(string), err)
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/post_create/labels.erb b/mmv1/templates/terraform/post_create/labels.erb
index 83c6dcea64a9..1aaf5c26ce90 100644
--- a/mmv1/templates/terraform/post_create/labels.erb
+++ b/mmv1/templates/terraform/post_create/labels.erb
@@ -1,5 +1,8 @@
 <% if properties.any?{ |p| p.name == "labels" } -%>
-if v, ok := d.GetOkExists("labels"); !tpgresource.IsEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, labelsProp)) {
+if v, ok := d.GetOkExists("effective_labels"); !tpgresource.IsEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, labelsProp)) {
+	labels := d.Get("labels")
+	terraformLables := d.Get("terraform_labels")
+
 	// Labels cannot be set in a create.  We'll have to set them here.
 	err = resource<%= resource_name -%>Read(d, meta)
 	if err != nil {
@@ -7,8 +10,8 @@ if v, ok := d.GetOkExists("labels"); !tpgresource.IsEmptyValue(reflect.ValueOf(v
 	}
 
 	obj := make(map[string]interface{})
-	// d.Get("labels") will have been overridden by the Read call.
-	labelsProp, err := expand<%= resource_name -%>Labels(v, d, config)
+	// d.Get("effective_labels") will have been overridden by the Read call.
+	labelsProp, err := expand<%= resource_name -%>EffectiveLabels(v, d, config)
 	if err != nil {
 		return err
 	}
@@ -46,5 +49,19 @@ if v, ok := d.GetOkExists("labels"); !tpgresource.IsEmptyValue(reflect.ValueOf(v
 		return err
 	}
 
+	// Set back the labels field, as it is needed to decide the value of "labels" in the state in the read function.
+	if err := d.Set("labels", labels); err != nil {
+		return fmt.Errorf("Error setting back labels: %s", err)
+	}
+
+	// Set back the terraform_labels field, as it is needed to decide the value of "terraform_labels" in the state in the read function.
+	if err := d.Set("terraform_labels", terraformLables); err != nil {
+		return fmt.Errorf("Error setting back terraform_labels: %s", err)
+	}
+
+	// Set back the effective_labels field, as it is needed to decide the value of "effective_labels" in the state in the read function.
+	if err := d.Set("effective_labels", v); err != nil {
+		return fmt.Errorf("Error setting back effective_labels: %s", err)
+	}
 }
 <% end -%>
diff --git a/mmv1/templates/terraform/post_create/network_security_address_group_operation.go.erb b/mmv1/templates/terraform/post_create/network_security_address_group_operation.go.erb
deleted file mode 100644
index 00856471f3f0..000000000000
--- a/mmv1/templates/terraform/post_create/network_security_address_group_operation.go.erb
+++ /dev/null
@@ -1,9 +0,0 @@
-err = NetworkSecurityAddressGroupOperationWaitTime(
-    config, res, "Creating AddressGroup", userAgent,
-    d.Timeout(schema.TimeoutCreate))
-
-if err != nil {
-    // The resource didn't actually create
-    d.SetId("")
-    return fmt.Errorf("Error waiting to create AddressGroup: %s", err)
-}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/post_delete/network_security_address_group_operation.go.erb b/mmv1/templates/terraform/post_delete/network_security_address_group_operation.go.erb
deleted file mode 100644
index fd92b7a9c63f..000000000000
--- a/mmv1/templates/terraform/post_delete/network_security_address_group_operation.go.erb
+++ /dev/null
@@ -1,7 +0,0 @@
-err = NetworkSecurityAddressGroupOperationWaitTime(
-    config, res, "Deleting AddressGroup", userAgent,
-    d.Timeout(schema.TimeoutDelete))
-
-if err != nil {
-    return err
-}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/post_import/integration_connectors_connection.go.erb b/mmv1/templates/terraform/post_import/integration_connectors_connection.go.erb
new file mode 100644
index 000000000000..c78d42a26036
--- /dev/null
+++ b/mmv1/templates/terraform/post_import/integration_connectors_connection.go.erb
@@ -0,0 +1,3 @@
+if err := waitforConnectionReady(d, config, d.Timeout(schema.TimeoutCreate) - time.Minute); err != nil {
+  return nil, fmt.Errorf("Error waiting for Connection %q to be in a stable state: %q", d.Get("name").(string), err)
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/post_update/cloudbuild_bitbucketserver_config.go.erb b/mmv1/templates/terraform/post_update/cloudbuild_bitbucketserver_config.go.erb
index ea7bf250862a..c8368000fbed 100644
--- a/mmv1/templates/terraform/post_update/cloudbuild_bitbucketserver_config.go.erb
+++ b/mmv1/templates/terraform/post_update/cloudbuild_bitbucketserver_config.go.erb
@@ -21,7 +21,7 @@ if d.HasChange("connected_repositories") {
 	for _, repo := range removeRepos {
 		obj := make(map[string]interface{})
 		obj["connectedRepository"] = repo
-		res, err = transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+		_, err = transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
 			Config: config,
 			Method: "POST",
 			Project: billingProject,
@@ -61,7 +61,7 @@ if d.HasChange("connected_repositories") {
 			return err
 		}
 
-		res, err = transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+		res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
 			Config: config,
 			Method: "POST",
 			Project: billingProject,
diff --git a/mmv1/templates/terraform/post_update/integration_connectors_connection.go.erb b/mmv1/templates/terraform/post_update/integration_connectors_connection.go.erb
new file mode 100644
index 000000000000..db66cc890e3e
--- /dev/null
+++ b/mmv1/templates/terraform/post_update/integration_connectors_connection.go.erb
@@ -0,0 +1,3 @@
+if err := waitforConnectionReady(d, config, d.Timeout(schema.TimeoutCreate) - time.Minute); err != nil {
+  return fmt.Errorf("Error waiting for Connection %q to finish being in UPDATING state during updation: %q", d.Get("name").(string), err)
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/post_update/network_security_address_group_operation.go.erb b/mmv1/templates/terraform/post_update/network_security_address_group_operation.go.erb
deleted file mode 100644
index cea6431f3fd2..000000000000
--- a/mmv1/templates/terraform/post_update/network_security_address_group_operation.go.erb
+++ /dev/null
@@ -1,7 +0,0 @@
-err = NetworkSecurityAddressGroupOperationWaitTime(
-    config, res, "Updating AddressGroup", userAgent,
-    d.Timeout(schema.TimeoutUpdate))
-
-if err != nil {
-    return err
-}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/pre_create/alloydb_restore_cluster.go.erb b/mmv1/templates/terraform/pre_create/alloydb_cluster.go.erb
similarity index 55%
rename from mmv1/templates/terraform/pre_create/alloydb_restore_cluster.go.erb
rename to mmv1/templates/terraform/pre_create/alloydb_cluster.go.erb
index 1cce1c5bf5b9..87ac9c897160 100644
--- a/mmv1/templates/terraform/pre_create/alloydb_restore_cluster.go.erb
+++ b/mmv1/templates/terraform/pre_create/alloydb_cluster.go.erb
@@ -30,4 +30,36 @@ if backupSource != nil || continuousBackupSource != nil {
 	}
 	restoreClusterRequestBody["cluster"] = cluster
 	obj = restoreClusterRequestBody
-}
\ No newline at end of file
+}
+
+
+// Read the secondary cluster config to call the api for creating secondary cluster
+
+var secondaryConfig interface{}
+var clusterType interface{}
+
+if val, ok := obj["secondaryConfig"]; ok {
+	secondaryConfig = val
+}
+
+if val, ok := obj["clusterType"]; ok {
+	clusterType = val
+}
+
+if clusterType == "SECONDARY" {
+	if secondaryConfig != nil {
+		// Use createsecondary API if this is a secondary cluster
+		url = strings.Replace(url, "clusters?clusterId", "clusters:createsecondary?cluster_id", 1)
+
+	// Validation error if secondary_config is not defined
+	} else {
+		return fmt.Errorf("Error creating cluster. Can not create secondary cluster without secondary_config field.")
+	}
+}
+
+// Validation error if secondary_config is defined but, cluster type is not secondary
+if secondaryConfig != nil {
+	if clusterType != "SECONDARY" {
+		return fmt.Errorf("Error creating cluster. Add {cluster_type: \"SECONDARY\"} if attempting to create a secondary cluster, otherwise remove the secondary_config.")
+	}
+}
diff --git a/mmv1/templates/terraform/pre_create/alloydb_instance.go.erb b/mmv1/templates/terraform/pre_create/alloydb_instance.go.erb
new file mode 100644
index 000000000000..ba3d97920cd4
--- /dev/null
+++ b/mmv1/templates/terraform/pre_create/alloydb_instance.go.erb
@@ -0,0 +1,5 @@
+// Read the config and call createsecondary api if instance_type is SECONDARY
+
+if instanceType := d.Get("instance_type"); instanceType == "SECONDARY" {
+  url = strings.Replace(url, "instances?instanceId", "instances:createsecondary?instanceId", 1)
+}
diff --git a/mmv1/templates/terraform/pre_create/compute_global_address.go.erb b/mmv1/templates/terraform/pre_create/compute_global_address.go.erb
new file mode 100644
index 000000000000..bdf5ae5d293f
--- /dev/null
+++ b/mmv1/templates/terraform/pre_create/compute_global_address.go.erb
@@ -0,0 +1,5 @@
+// Note: Global external IP addresses and internal IP addresses are always Premium Tier.
+// An address with type INTERNAL cannot have a network tier
+if addressTypeProp != "INTERNAL" {
+    obj["networkTier"] = "PREMIUM"
+}
diff --git a/mmv1/templates/terraform/pre_create/compute_node_group_url_replace.go.erb b/mmv1/templates/terraform/pre_create/compute_node_group_url_replace.go.erb
index 62e4828bb500..a85b927ba68a 100644
--- a/mmv1/templates/terraform/pre_create/compute_node_group_url_replace.go.erb
+++ b/mmv1/templates/terraform/pre_create/compute_node_group_url_replace.go.erb
@@ -1,8 +1,12 @@
 var sizeParam string
-if v, ok := d.GetOkExists("size"); ok {
-	sizeParam = fmt.Sprintf("%v", v)
-} else if v, ok := d.GetOkExists("initial_size"); ok {
+if v, ok := d.GetOkExists("initial_size"); ok {
 	sizeParam = fmt.Sprintf("%v", v)
+}else{
+	if _, ok := d.GetOkExists("autoscaling_policy"); ok{
+		sizeParam = fmt.Sprintf("%v", d.Get("autoscaling_policy.min_nodes"))
+	}else{
+		return errors.New("An initial_size or autoscaling_policy must be configured on node group creation.")
+	}
 }
 
 url = regexp.MustCompile("PRE_CREATE_REPLACE_ME").ReplaceAllLiteralString(url, sizeParam)
diff --git a/mmv1/templates/terraform/pre_create/dialogflowcx_set_location_skip_default_obj.go.erb b/mmv1/templates/terraform/pre_create/dialogflowcx_set_location_skip_default_obj.go.erb
new file mode 100644
index 000000000000..b48f3e7d1a24
--- /dev/null
+++ b/mmv1/templates/terraform/pre_create/dialogflowcx_set_location_skip_default_obj.go.erb
@@ -0,0 +1,43 @@
+
+// extract location from the parent
+location := ""
+
+if parts := regexp.MustCompile(`locations\/([^\/]*)\/`).FindStringSubmatch(d.Get("parent").(string)); parts != nil {
+    location = parts[1]
+} else {
+    return fmt.Errorf(
+        "Saw %s when the parent is expected to contains location %s",
+        d.Get("parent"),
+        "projects/{{project}}/locations/{{location}}/...",
+    )
+}
+
+url = strings.Replace(url,"-dialogflow",fmt.Sprintf("%s-dialogflow",location),1)
+
+// if it's a default object Dialogflow creates for you, "Update" instead of "Create"
+// Note: below we try to access fields that aren't present in the resource, because this custom code is reused across multiple Dialogflow resources that contain different fields. When the field isn't present, we deliberately ignore the error and the boolean is false.
+isDefaultStartFlow, _ := d.Get("is_default_start_flow").(bool)
+isDefaultWelcomeIntent, _ := d.Get("is_default_welcome_intent").(bool)
+isDefaultNegativeIntent, _ := d.Get("is_default_negative_intent").(bool)
+if isDefaultStartFlow || isDefaultWelcomeIntent || isDefaultNegativeIntent {
+    // hardcode the default object ID:
+    var defaultObjName string
+    if isDefaultStartFlow || isDefaultWelcomeIntent {
+        defaultObjName = "00000000-0000-0000-0000-000000000000"
+    }
+    if isDefaultNegativeIntent {
+        defaultObjName = "00000000-0000-0000-0000-000000000001"
+    }
+
+    // Store the ID
+    d.Set("name", defaultObjName)
+    id, err := tpgresource.ReplaceVars(d, config, "<%= id_format(object) -%>")
+    if err != nil {
+        return fmt.Errorf("Error constructing id: %s", err)
+    }
+    d.SetId(id)
+
+    // and defer to the Update method:
+    log.Printf("[DEBUG] Updating default <%= resource_name -%>")
+    return resource<%= resource_name -%>Update(d, meta)
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/pre_create/network_security_address_group_operation.go.erb b/mmv1/templates/terraform/pre_create/network_security_address_group_operation.go.erb
new file mode 100644
index 000000000000..e06fc5dfb184
--- /dev/null
+++ b/mmv1/templates/terraform/pre_create/network_security_address_group_operation.go.erb
@@ -0,0 +1 @@
+project = ""
\ No newline at end of file
diff --git a/mmv1/templates/terraform/pre_delete/alloydb_cluster.go.erb b/mmv1/templates/terraform/pre_delete/alloydb_cluster.go.erb
new file mode 100644
index 000000000000..743d7e857912
--- /dev/null
+++ b/mmv1/templates/terraform/pre_delete/alloydb_cluster.go.erb
@@ -0,0 +1,4 @@
+// Forcefully delete the secondary cluster and the dependent instances because deletion of secondary instance is not supported.
+if deletionPolicy := d.Get("deletion_policy"); deletionPolicy == "FORCE" {
+    url = url + "?force=true"
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/pre_delete/alloydb_instance.go.erb b/mmv1/templates/terraform/pre_delete/alloydb_instance.go.erb
new file mode 100644
index 000000000000..68d0ca605bc4
--- /dev/null
+++ b/mmv1/templates/terraform/pre_delete/alloydb_instance.go.erb
@@ -0,0 +1,18 @@
+// Read the config and avoid calling the delete API if the instance_type is SECONDARY and instead return nil
+// Returning nil is equivalent of returning a success message to the users
+// This is done because deletion of secondary instance is not supported
+// Instead users should be deleting the secondary cluster which will forcefully delete the associated secondary instance
+// A warning message prompts the user to delete the associated secondary cluster.
+// Users can always undo the delete secondary instance action by importing the deleted secondary instance by calling terraform import
+
+var instanceType interface{}
+instanceTypeProp, err := expandAlloydbInstanceInstanceType(d.Get("instance_type"), d, config)
+if err != nil {
+    return err
+} else if v, ok := d.GetOkExists("instance_type"); !tpgresource.IsEmptyValue(reflect.ValueOf(instanceTypeProp)) && (ok || !reflect.DeepEqual(v, instanceTypeProp)) {
+    instanceType = instanceTypeProp
+}
+if instanceType != nil && instanceType == "SECONDARY" {
+    log.Printf("[WARNING] This operation didn't delete the Secondary Instance %q. Please delete the associated Secondary Cluster as well to delete the entire cluster and the secondary instance.\n", d.Id())
+    return nil
+}
diff --git a/mmv1/templates/terraform/pre_delete/compute_global_network_endpoint.go.erb b/mmv1/templates/terraform/pre_delete/compute_global_network_endpoint.go.erb
index 636fda9531fe..53144f4d14b6 100644
--- a/mmv1/templates/terraform/pre_delete/compute_global_network_endpoint.go.erb
+++ b/mmv1/templates/terraform/pre_delete/compute_global_network_endpoint.go.erb
@@ -3,7 +3,7 @@ portProp, err := expandNestedComputeGlobalNetworkEndpointPort(d.Get("port"), d,
 if err != nil {
   return err
 }
-if portProp != "" {
+if portProp != "" && portProp != 0 {
 	toDelete["port"] = portProp	
 }
 
diff --git a/mmv1/templates/terraform/pre_delete/dialogflowcx_set_location_skip_default_obj.go.erb b/mmv1/templates/terraform/pre_delete/dialogflowcx_set_location_skip_default_obj.go.erb
new file mode 100644
index 000000000000..520f992a5d8b
--- /dev/null
+++ b/mmv1/templates/terraform/pre_delete/dialogflowcx_set_location_skip_default_obj.go.erb
@@ -0,0 +1,26 @@
+
+// extract location from the parent
+location := ""
+
+if parts := regexp.MustCompile(`locations\/([^\/]*)\/`).FindStringSubmatch(d.Get("parent").(string)); parts != nil {
+    location = parts[1]
+} else {
+    return fmt.Errorf(
+        "Saw %s when the parent is expected to contains location %s",
+        d.Get("parent"),
+        "projects/{{project}}/locations/{{location}}/...",
+    )
+}
+
+url = strings.Replace(url,"-dialogflow",fmt.Sprintf("%s-dialogflow",location),1)
+
+// if it's a default object Dialogflow creates for you, skip deletion
+// Note: below we try to access fields that aren't present in the resource, because this custom code is reused across multiple Dialogflow resources that contain different fields. When the field isn't present, we deliberately ignore the error and the boolean is false.
+isDefaultStartFlow, _ := d.Get("is_default_start_flow").(bool)
+isDefaultWelcomeIntent, _ := d.Get("is_default_welcome_intent").(bool)
+isDefaultNegativeIntent, _ := d.Get("is_default_negative_intent").(bool)
+if isDefaultStartFlow || isDefaultWelcomeIntent || isDefaultNegativeIntent {
+    // we can't delete these resources so do nothing
+    log.Printf("[DEBUG] Not deleting default <%= resource_name -%>")
+    return nil
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/pre_delete/network_security_address_group_operation.go.erb b/mmv1/templates/terraform/pre_delete/network_security_address_group_operation.go.erb
new file mode 100644
index 000000000000..e06fc5dfb184
--- /dev/null
+++ b/mmv1/templates/terraform/pre_delete/network_security_address_group_operation.go.erb
@@ -0,0 +1 @@
+project = ""
\ No newline at end of file
diff --git a/mmv1/templates/terraform/pre_delete/secret_version_deletion_policy.go.erb b/mmv1/templates/terraform/pre_delete/secret_version_deletion_policy.go.erb
new file mode 100644
index 000000000000..4e91b9d3e79f
--- /dev/null
+++ b/mmv1/templates/terraform/pre_delete/secret_version_deletion_policy.go.erb
@@ -0,0 +1,24 @@
+<%- # the license inside this block applies to this file
+	# Copyright 2023 Google Inc.
+	# Licensed under the Apache License, Version 2.0 (the "License");
+	# you may not use this file except in compliance with the License.
+	# You may obtain a copy of the License at
+	#
+	#     http://www.apache.org/licenses/LICENSE-2.0
+	#
+	# Unless required by applicable law or agreed to in writing, software
+	# distributed under the License is distributed on an "AS IS" BASIS,
+	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	# See the License for the specific language governing permissions and
+	# limitations under the License.
+-%>
+deletionPolicy := d.Get("deletion_policy");
+
+if deletionPolicy == "ABANDON" {
+	return nil
+} else if deletionPolicy == "DISABLE" {
+	url, err = tpgresource.ReplaceVars(d, config, "{{SecretManagerBasePath}}{{name}}:disable")
+	if err != nil {
+		return err
+	}
+}
diff --git a/mmv1/templates/terraform/pre_read/secret_version_is_secret_data_base64.go.erb b/mmv1/templates/terraform/pre_read/secret_version_is_secret_data_base64.go.erb
new file mode 100644
index 000000000000..e51b366178d9
--- /dev/null
+++ b/mmv1/templates/terraform/pre_read/secret_version_is_secret_data_base64.go.erb
@@ -0,0 +1,20 @@
+<%# The license inside this block applies to this file.
+	# Copyright 2023 Google Inc.
+	# Licensed under the Apache License, Version 2.0 (the "License");
+	# you may not use this file except in compliance with the License.
+	# You may obtain a copy of the License at
+	#
+	#     http://www.apache.org/licenses/LICENSE-2.0
+	#
+	# Unless required by applicable law or agreed to in writing, software
+	# distributed under the License is distributed on an "AS IS" BASIS,
+	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	# See the License for the specific language governing permissions and
+	# limitations under the License.
+-%>
+// Explicitly set the field to default value if unset
+if _, ok := d.GetOkExists("is_secret_data_base64"); !ok {
+	if err := d.Set("is_secret_data_base64", false); err != nil {
+		return fmt.Errorf("Error setting is_secret_data_base64: %s", err)
+	}
+}
diff --git a/mmv1/templates/terraform/pre_update/alloydb_cluster.go.erb b/mmv1/templates/terraform/pre_update/alloydb_cluster.go.erb
new file mode 100644
index 000000000000..0c893e92f2cd
--- /dev/null
+++ b/mmv1/templates/terraform/pre_update/alloydb_cluster.go.erb
@@ -0,0 +1,72 @@
+// Restrict modification of cluster_type from PRIMARY to SECONDARY as it is an invalid operation
+if d.HasChange("cluster_type") && d.Get("cluster_type") == "SECONDARY" {
+    return fmt.Errorf("Can not convert a primary cluster to a secondary cluster.")
+}
+
+// Restrict setting secondary_config if cluster_type is PRIMARY
+if d.Get("cluster_type") == "PRIMARY" && !tpgresource.IsEmptyValue(reflect.ValueOf(d.Get("secondary_config"))) {
+    return fmt.Errorf("Can not set secondary config for primary cluster.")
+}
+
+// Implementation for cluster promotion
+if d.HasChange("cluster_type") && d.Get("cluster_type") == "PRIMARY" {
+
+    if !d.HasChange("secondary_config") || !tpgresource.IsEmptyValue(reflect.ValueOf(d.Get("secondary_config"))) {
+        return fmt.Errorf("Remove the secondary_config field to promote the cluster to primary cluster.")
+    }
+
+    // If necassary precondition checks for cluster promotion is fine ONLY then
+    // Promote cluster as a separate implementation within the update logic
+
+    promoteUrl := strings.Split(url, "?updateMask=")[0] + ":promote"
+    emptyObj := make(map[string]interface{})
+
+    // Remove promote changes from obj and updateMask
+    delete(obj, "clusterType")
+    delete(obj, "secondaryConfig")
+
+    index := 0
+    for _, label := range updateMask {
+        if label != "clusterType" && label != "secondaryConfig" {
+            updateMask[index] = label
+            index++
+        }
+    }
+    updateMask = updateMask[:index]
+
+    // Update url with the new updateMask
+    url := strings.Split(url, "?updateMask=")[0]
+    url, err = transport_tpg.AddQueryParams(url, map[string]string{"updateMask": strings.Join(updateMask, ",")})
+    if err != nil {
+        return err
+    }
+
+    // err == nil indicates that the billing_project value was found
+    if bp, err := tpgresource.GetBillingProject(d, config); err == nil {
+        billingProject = bp
+    }
+
+    res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+        Config:    config,
+        Method:    "POST",
+        Project:   billingProject,
+        RawURL:    promoteUrl,
+        UserAgent: userAgent,
+        Body:      emptyObj,
+        Timeout:   d.Timeout(schema.TimeoutCreate),
+    })
+    if err != nil {
+        return fmt.Errorf("Error promoting Cluster: %s", err)
+    }
+
+    err = AlloydbOperationWaitTime(
+        config, res, project, "Promoting Cluster", userAgent,
+        d.Timeout(schema.TimeoutCreate))
+
+    if err != nil {
+        return fmt.Errorf("Error waiting to promote Cluster: %s", err)
+    }
+
+    log.Printf("[DEBUG] Finished promoting Cluster %q: %#v", d.Id(), res)
+
+}
\ No newline at end of file
diff --git a/mmv1/templates/terraform/pre_update/bigquerydatatransfer_config.erb b/mmv1/templates/terraform/pre_update/bigquerydatatransfer_config.erb
new file mode 100644
index 000000000000..9302553ed7df
--- /dev/null
+++ b/mmv1/templates/terraform/pre_update/bigquerydatatransfer_config.erb
@@ -0,0 +1,54 @@
+<%- # the license inside this block applies to this file
+	# Copyright 2023 Google Inc.
+	# Licensed under the Apache License, Version 2.0 (the "License");
+	# you may not use this file except in compliance with the License.
+	# You may obtain a copy of the License at
+	#
+	#     http://www.apache.org/licenses/LICENSE-2.0
+	#
+	# Unless required by applicable law or agreed to in writing, software
+	# distributed under the License is distributed on an "AS IS" BASIS,
+	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	# See the License for the specific language governing permissions and
+	# limitations under the License.
+-%>
+updateMask := []string{}
+if v, ok := d.GetOk("service_account_name"); ok {
+  if v != nil && d.HasChange("service_account_name") {
+    updateMask = append(updateMask, "serviceAccountName")
+  }
+}
+if d.HasChange("display_name") {
+  updateMask = append(updateMask, "displayName")
+}
+if d.HasChange("destination_dataset_id") {
+  updateMask = append(updateMask, "destinationDatasetId")
+}
+if d.HasChange("schedule") {
+  updateMask = append(updateMask, "schedule")
+}
+if d.HasChange("schedule_options") {
+  updateMask = append(updateMask, "scheduleOptions")
+}
+if d.HasChange("email_preferences") {
+  updateMask = append(updateMask, "emailPreferences")
+}
+if d.HasChange("notification_pubsub_topic") {
+  updateMask = append(updateMask, "notificationPubsubTopic")
+}
+if d.HasChange("data_refresh_window_days") {
+  updateMask = append(updateMask, "dataRefreshWindowDays")
+}
+if d.HasChange("disabled") {
+  updateMask = append(updateMask, "disabled")
+}
+if d.HasChange("params") {
+  updateMask = append(updateMask, "params")
+}
+
+// updateMask is a URL parameter but not present in the schema, so ReplaceVars
+// won't set it
+url, err = transport_tpg.AddQueryParams(url, map[string]string{"updateMask": strings.Join(updateMask, ",")})
+if err != nil {
+	return err
+}
diff --git a/mmv1/templates/terraform/pre_update/cloudiot_device_registry.go.erb b/mmv1/templates/terraform/pre_update/cloudiot_device_registry.go.erb
deleted file mode 100644
index 226c0efca146..000000000000
--- a/mmv1/templates/terraform/pre_update/cloudiot_device_registry.go.erb
+++ /dev/null
@@ -1,35 +0,0 @@
-log.Printf("[DEBUG] updateMask before adding extra schema entries %q: %v", d.Id(), updateMask)
-
-log.Printf("[DEBUG] Pre-update on state notification config: %q", d.Id())
-if d.HasChange("state_notification_config") {
-	log.Printf("[DEBUG] %q stateNotificationConfig.pubsubTopicName has a change. Adding it to the update mask", d.Id())
-	updateMask = append(updateMask, "stateNotificationConfig.pubsubTopicName")
-}
-
-log.Printf("[DEBUG] Pre-update on MQTT config: %q", d.Id())
-if d.HasChange("mqtt_config") {
-	log.Printf("[DEBUG] %q mqttConfig.mqttEnabledState has a change. Adding it to the update mask", d.Id())
-	updateMask = append(updateMask, "mqttConfig.mqttEnabledState")
-}
-
-log.Printf("[DEBUG] Pre-update on HTTP config: %q", d.Id())
-if d.HasChange("http_config") {
-	log.Printf("[DEBUG] %q httpConfig.httpEnabledState has a change. Adding it to the update mask", d.Id())
-	updateMask = append(updateMask, "httpConfig.httpEnabledState")
-}
-
-log.Printf("[DEBUG] Pre-update on credentials: %q", d.Id())
-if d.HasChange("credentials") {
-	log.Printf("[DEBUG] %q credentials has a change. Adding it to the update mask", d.Id())
-	updateMask = append(updateMask, "credentials")
-}
-
-log.Printf("[DEBUG] updateMask after adding extra schema entries %q: %v", d.Id(), updateMask)
-
-// Refreshing updateMask after adding extra schema entries
-url, err = transport_tpg.AddQueryParams(url, map[string]string{"updateMask": strings.Join(updateMask, ",")})
-if err != nil {
-	return err
-}
-
-log.Printf("[DEBUG] Update URL %q: %v", d.Id(), url)
diff --git a/mmv1/templates/terraform/pre_update/containerattached_update.go.erb b/mmv1/templates/terraform/pre_update/containerattached_update.go.erb
index 9c7b10aefae8..4c3c3a4cbe86 100644
--- a/mmv1/templates/terraform/pre_update/containerattached_update.go.erb
+++ b/mmv1/templates/terraform/pre_update/containerattached_update.go.erb
@@ -1,17 +1,23 @@
 // The generated code sets the wrong masks for the following fields.
 newUpdateMask := []string{}
-if d.HasChange("authorization") {
+if d.HasChange("authorization.0.admin_users") {
     newUpdateMask = append(newUpdateMask, "authorization.admin_users")
 }
+if d.HasChange("authorization.0.admin_groups") {
+    newUpdateMask = append(newUpdateMask, "authorization.admin_groups")
+}
 if d.HasChange("logging_config") {
     newUpdateMask = append(newUpdateMask, "logging_config.component_config.enable_components")
 }
 if d.HasChange("monitoring_config") {
     newUpdateMask = append(newUpdateMask, "monitoring_config.managed_prometheus_config.enabled")
 }
+if d.HasChange("binary_authorization") {
+    newUpdateMask = append(newUpdateMask, "binary_authorization.evaluation_mode")
+}
 // Pull out any other set fields from the generated mask.
 for _, mask := range updateMask {
-    if mask == "authorization" || mask == "loggingConfig" || mask == "monitoringConfig" {
+    if mask == "authorization" || mask == "loggingConfig" || mask == "monitoringConfig" || mask == "binaryAuthorization" {
         continue
     }
     newUpdateMask = append(newUpdateMask, mask)
diff --git a/mmv1/templates/terraform/pre_update/datastream_stream.go.erb b/mmv1/templates/terraform/pre_update/datastream_stream.go.erb
index b344fe4f3826..661a52faa84b 100644
--- a/mmv1/templates/terraform/pre_update/datastream_stream.go.erb
+++ b/mmv1/templates/terraform/pre_update/datastream_stream.go.erb
@@ -25,6 +25,17 @@ if err != nil {
   return err
 }
 
+// lables and terraform_labels fields are overriden with the labels before updating inside the function waitForDatastreamStreamReady
+labels := d.Get("labels")
+terraformLabels := d.Get("terraform_labels")
+
 if err := waitForDatastreamStreamReady(d, config, d.Timeout(schema.TimeoutCreate) - time.Minute); err != nil {
   return fmt.Errorf("Error waiting for Stream %q to be NOT_STARTED, RUNNING, or PAUSED before updating: %q", d.Get("name").(string), err)
+}
+
+if err := d.Set("labels", labels); err != nil {
+  return fmt.Errorf("Error setting back labels field: %s", err)
+}
+if err := d.Set("terraform_labels", terraformLabels); err != nil {
+  return fmt.Errorf("Error setting back terraform_labels field: %s", err)
 }
\ No newline at end of file
diff --git a/mmv1/templates/terraform/pre_update/network_security_address_group_operation.go.erb b/mmv1/templates/terraform/pre_update/network_security_address_group_operation.go.erb
new file mode 100644
index 000000000000..e06fc5dfb184
--- /dev/null
+++ b/mmv1/templates/terraform/pre_update/network_security_address_group_operation.go.erb
@@ -0,0 +1 @@
+project = ""
\ No newline at end of file
diff --git a/mmv1/templates/terraform/pre_update/secret_manager_secret.go.erb b/mmv1/templates/terraform/pre_update/secret_manager_secret.go.erb
index d952ff9b5007..138b27ab4308 100644
--- a/mmv1/templates/terraform/pre_update/secret_manager_secret.go.erb
+++ b/mmv1/templates/terraform/pre_update/secret_manager_secret.go.erb
@@ -23,10 +23,15 @@ if d.HasChange("replication") {
     updateMask = append(updateMask, "replication")
 }
 
+// As the API expects only one of ttl or expireTime
+if d.HasChange("ttl") && !d.HasChange("expire_time") {
+    delete(obj, "expireTime")
+}
+
 // Refreshing updateMask after adding extra schema entries
 url, err = transport_tpg.AddQueryParams(url, map[string]string{"updateMask": strings.Join(updateMask, ",")})
 if err != nil {
-	return err
+    return err
 }
 
 log.Printf("[DEBUG] Update URL %q: %v", d.Id(), url)
diff --git a/mmv1/templates/terraform/resource.erb b/mmv1/templates/terraform/resource.erb
index 4306de057c7a..edeaa9a62f1c 100644
--- a/mmv1/templates/terraform/resource.erb
+++ b/mmv1/templates/terraform/resource.erb
@@ -65,6 +65,7 @@ import (
     client_name_lower = client_name.downcase
     has_project = object.base_url.include?('{{project}}') || (object.create_url && object.create_url.include?('{{project}}'))
     has_region = object.base_url.include?('{{region}}') && object.parameters.any?{ |p| p.name == 'region' && p.ignore_read }
+    has_zone = object.base_url.include?('{{zone}}') && object.parameters.any?{ |p| p.name == 'zone' && p.ignore_read }
     # In order of preference, use TF override,
     # general defined timeouts, or default Timeouts
     timeouts = object.timeouts
@@ -104,7 +105,7 @@ func Resource<%= resource_name -%>() *schema.Resource {
 <%  if object.state_upgraders -%>
 
         StateUpgraders: []schema.StateUpgrader{
-<%      for v in 0..object.schema_version-1 -%>
+<%      for v in object.state_upgrade_base_schema_version..object.schema_version-1 -%>
             {
                 Type: resource<%= "#{resource_name}ResourceV#{v}" -%>().CoreConfigSchema().ImpliedType(),
                 Upgrade: Resource<%= "#{resource_name}UpgradeV#{v}" -%>,
@@ -113,7 +114,7 @@ func Resource<%= resource_name -%>() *schema.Resource {
 <%      end -%>
         },
 <%  end -%>
-<%  if object.custom_diff.any? || object.settable_properties.any? {|p| p.unordered_list}-%>
+<% if ((has_project || has_region || has_zone) && !object.skip_default_cdiff) || object.custom_diff.any? || object.settable_properties.any? {|p| p.unordered_list}-%>
         CustomizeDiff: customdiff.All(
 <%      if object.settable_properties.any? {|p| p.unordered_list} -%>
         <%=
@@ -126,6 +127,15 @@ func Resource<%= resource_name -%>() *schema.Resource {
 <%          for cdiff in object.custom_diff-%>
         <%= cdiff%>,
 <%          end -%>
+<%      end -%>
+<%      if has_project && !object.skip_default_cdiff -%>
+            tpgresource.DefaultProviderProject,
+<%      end -%>
+<%      if has_region && !object.skip_default_cdiff  -%>
+            tpgresource.DefaultProviderRegion,
+<%      end -%>
+<%      if has_zone && !object.skip_default_cdiff  -%>
+            tpgresource.DefaultProviderZone,
 <%      end -%>
         ),
 <%  end -%>
@@ -145,6 +155,9 @@ func Resource<%= resource_name -%>() *schema.Resource {
             "<%= field.name -%>": {
                 Type: <%= tf_type(field) -%>,
                 Optional: true,
+<%       if field.immutable -%>
+                ForceNew: true,
+<%       end -%>
 <%       unless field.default_value.nil? -%>
                 Default:  <%= go_literal(field.default_value) -%>,
 <%       end -%>
@@ -640,6 +653,16 @@ func resource<%= resource_name -%>Read(d *schema.ResourceData, meta interface{})
     }
 <%  end -%>
 
+<%  if has_zone -%>
+    zone, err := tpgresource.GetZone(d, config)
+    if err != nil {
+        return err
+    }
+    if err := d.Set("zone", zone); err != nil {
+        return fmt.Errorf("Error reading <%= object.name -%>: %s", err)
+    }
+<%  end -%>
+
 <%  object.gettable_properties.reject{|p| p.ignore_read }.each do |prop| -%>
 <%    if prop.flatten_object -%>
 // Terraform must set the top level schema field, but since this object contains collapsed properties
@@ -772,7 +795,7 @@ func resource<%= resource_name -%>Update(d *schema.ResourceData, meta interface{
       billingProject = bp
     }
 
-<%      if object.update_mask && field_specific_update_methods(object.root_properties) -%>
+<%      if object.update_mask -%>
 // if updateMask is empty we are not updating anything so skip the post
 if len(updateMask) > 0 {
 <%      end -%>
@@ -818,7 +841,7 @@ if len(updateMask) > 0 {
     }
 <%        end -%>
 <%      end -%>
-<%      if object.update_mask && field_specific_update_methods(object.root_properties) -%>
+<%      if object.update_mask -%>
   }
 <%      end -%>
 <%    end # if !object.immutable -%>
@@ -1130,7 +1153,7 @@ func resource<%= resource_name -%>Import(d *schema.ResourceData, meta interface{
     config := meta.(*transport_tpg.Config)
     if err := tpgresource.ParseImportId([]string{
 <%      for import_id in import_id_formats_from_resource(object) -%>
-        "<%= format2regex(import_id) %>",
+        "^<%= format2regex(import_id) %>$",
 <%      end -%>
     }, d, config); err != nil {
       return nil, err
diff --git a/mmv1/templates/terraform/resource.html.markdown.erb b/mmv1/templates/terraform/resource.html.markdown.erb
index 94bf44959df5..d475ab319ba5 100644
--- a/mmv1/templates/terraform/resource.html.markdown.erb
+++ b/mmv1/templates/terraform/resource.html.markdown.erb
@@ -193,6 +193,26 @@ This resource does not support import.
 
 <%= object.name -%> can be imported using any of these accepted formats:
 
+<% import_id_formats_from_resource(object).map{ |id| id.gsub('%', '') }.each do |id_format| -%>
+* `<%= id_format %>`
+<% end -%>
+
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import <%= object.name -%> using one of the formats above. For example:
+
+<%
+  # Select the first import format in the list for the import block example
+  import_block_id = import_id_formats_from_resource(object).map{ |id| id.gsub('%', '') }[0]
+  -%>
+```tf
+import {
+  id = "<%= import_block_id %>"
+  to = <%= terraform_name -%>.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), <%= object.name -%> can be imported using one of the formats above. For example:
+
 ```
 <% import_id_formats_from_resource(object).map{ |id| id.gsub('%', '') }.each do |id_format| -%>
 $ terraform import <%= terraform_name -%>.default <%= id_format %>
diff --git a/mmv1/templates/terraform/resource_definition/identity_platform_project_default_config_deprecation.go.erb b/mmv1/templates/terraform/resource_definition/identity_platform_project_default_config_deprecation.go.erb
new file mode 100644
index 000000000000..9bdf1b6ba8eb
--- /dev/null
+++ b/mmv1/templates/terraform/resource_definition/identity_platform_project_default_config_deprecation.go.erb
@@ -0,0 +1,17 @@
+<%# The license inside this block applies to this file.
+	# Copyright 2023 Google Inc.
+	# Licensed under the Apache License, Version 2.0 (the "License");
+	# you may not use this file except in compliance with the License.
+	# You may obtain a copy of the License at
+	#
+	#     http://www.apache.org/licenses/LICENSE-2.0
+	#
+	# Unless required by applicable law or agreed to in writing, software
+	# distributed under the License is distributed on an "AS IS" BASIS,
+	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	# See the License for the specific language governing permissions and
+	# limitations under the License.
+-%>
+DeprecationMessage: "Deprecated. Use the `google_identity_platform_config` resource instead. " +
+                    "It contains a more comprehensive list of fields, and was created before " +
+                    "`google_identity_platform_project_default_config` was added.",
diff --git a/mmv1/templates/terraform/state_migrations/cloud_run_domain_mapping.go.erb b/mmv1/templates/terraform/state_migrations/cloud_run_domain_mapping.go.erb
new file mode 100644
index 000000000000..865a0a95c905
--- /dev/null
+++ b/mmv1/templates/terraform/state_migrations/cloud_run_domain_mapping.go.erb
@@ -0,0 +1,276 @@
+var domainMappingGoogleProvidedLocationLabel = "cloud.googleapis.com/location"
+var domainMappingGoogleProvidedOverrideLabel = "run.googleapis.com/overrideAt"
+
+var domainMappingGoogleProvidedLabels = []string{
+	domainMappingGoogleProvidedLocationLabel,
+	domainMappingGoogleProvidedOverrideLabel,
+}
+
+func DomainMappingLabelDiffSuppress(k, old, new string, d *schema.ResourceData) bool {
+	// Suppress diffs for the labels provided by Google
+	for _, label := range domainMappingGoogleProvidedLabels {
+		if strings.Contains(k, label) && new == "" {
+			return true
+		}
+	}
+
+	// Let diff be determined by labels (above)
+	if strings.Contains(k, "labels.%") {
+		return true
+	}
+
+	// For other keys, don't suppress diff.
+	return false
+}
+
+func resourceCloudRunDomainMappingResourceV0() *schema.Resource {
+	return &schema.Resource{
+		Schema: map[string]*schema.Schema{
+			"location": {
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: `The location of the cloud run instance. eg us-central1`,
+			},
+			"metadata": {
+				Type:        schema.TypeList,
+				Required:    true,
+				ForceNew:    true,
+				Description: `Metadata associated with this DomainMapping.`,
+				MaxItems:    1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"namespace": {
+							Type:     schema.TypeString,
+							Required: true,
+							ForceNew: true,
+							Description: `In Cloud Run the namespace must be equal to either the
+project ID or project number.`,
+						},
+						"annotations": {
+							Type:             schema.TypeMap,
+							Computed:         true,
+							Optional:         true,
+							ForceNew:         true,
+							DiffSuppressFunc: cloudrunAnnotationDiffSuppress,
+							Description: `Annotations is a key value map stored with a resource that
+may be set by external tools to store and retrieve arbitrary metadata. More
+info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
+
+**Note**: The Cloud Run API may add additional annotations that were not provided in your config.
+If terraform plan shows a diff where a server-side annotation is added, you can add it to your config
+or apply the lifecycle.ignore_changes rule to the metadata.0.annotations field.`,
+							Elem: &schema.Schema{Type: schema.TypeString},
+						},
+						"labels": {
+							Type:             schema.TypeMap,
+							Computed:         true,
+							Optional:         true,
+							ForceNew:         true,
+							DiffSuppressFunc: DomainMappingLabelDiffSuppress,
+							Description: `Map of string keys and values that can be used to organize and categorize
+(scope and select) objects. May match selectors of replication controllers
+and routes.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels`,
+							Elem: &schema.Schema{Type: schema.TypeString},
+						},
+						"generation": {
+							Type:        schema.TypeInt,
+							Computed:    true,
+							Description: `A sequence number representing a specific generation of the desired state.`,
+						},
+						"resource_version": {
+							Type:     schema.TypeString,
+							Computed: true,
+							Description: `An opaque value that represents the internal version of this object that
+can be used by clients to determine when objects have changed. May be used
+for optimistic concurrency, change detection, and the watch operation on a
+resource or set of resources. They may only be valid for a
+particular resource or set of resources.
+
+More info:
+https://git.k8s.io/community/contributors/devel/api-conventions.md#concurrency-control-and-consistency`,
+						},
+						"self_link": {
+							Type:        schema.TypeString,
+							Computed:    true,
+							Description: `SelfLink is a URL representing this object.`,
+						},
+						"uid": {
+							Type:     schema.TypeString,
+							Computed: true,
+							Description: `UID is a unique id generated by the server on successful creation of a resource and is not
+allowed to change on PUT operations.
+
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids`,
+						},
+					},
+				},
+			},
+			"name": {
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: `Name should be a [verified](https://support.google.com/webmasters/answer/9008080) domain`,
+			},
+			"spec": {
+				Type:        schema.TypeList,
+				Required:    true,
+				ForceNew:    true,
+				Description: `The spec for this DomainMapping.`,
+				MaxItems:    1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"route_name": {
+							Type:             schema.TypeString,
+							Required:         true,
+							ForceNew:         true,
+							DiffSuppressFunc: tpgresource.CompareSelfLinkOrResourceName,
+							Description: `The name of the Cloud Run Service that this DomainMapping applies to.
+The route must exist.`,
+						},
+						"certificate_mode": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							ForceNew:     true,
+							ValidateFunc: verify.ValidateEnum([]string{"NONE", "AUTOMATIC", ""}),
+							Description:  `The mode of the certificate. Default value: "AUTOMATIC" Possible values: ["NONE", "AUTOMATIC"]`,
+							Default:      "AUTOMATIC",
+						},
+						"force_override": {
+							Type:     schema.TypeBool,
+							Optional: true,
+							ForceNew: true,
+							Description: `If set, the mapping will override any mapping set before this spec was set.
+It is recommended that the user leaves this empty to receive an error
+warning about a potential conflict and only set it once the respective UI
+has given such a warning.`,
+						},
+					},
+				},
+			},
+			"status": {
+				Type:        schema.TypeList,
+				Computed:    true,
+				Description: `The current status of the DomainMapping.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"resource_records": {
+							Type:     schema.TypeList,
+							Optional: true,
+							Description: `The resource records required to configure this domain mapping. These
+records must be added to the domain's DNS configuration in order to
+serve the application via this domain mapping.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"type": {
+										Type:         schema.TypeString,
+										Optional:     true,
+										ValidateFunc: verify.ValidateEnum([]string{"A", "AAAA", "CNAME", ""}),
+										Description:  `Resource record type. Example: 'AAAA'. Possible values: ["A", "AAAA", "CNAME"]`,
+									},
+									"name": {
+										Type:     schema.TypeString,
+										Computed: true,
+										Description: `Relative name of the object affected by this record. Only applicable for
+'CNAME' records. Example: 'www'.`,
+									},
+									"rrdata": {
+										Type:     schema.TypeString,
+										Computed: true,
+										Description: `Data for this record. Values vary by record type, as defined in RFC 1035
+(section 5) and RFC 1034 (section 3.6.1).`,
+									},
+								},
+							},
+						},
+						"conditions": {
+							Type:     schema.TypeList,
+							Computed: true,
+							Description: `Array of observed DomainMappingConditions, indicating the current state
+of the DomainMapping.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"message": {
+										Type:        schema.TypeString,
+										Computed:    true,
+										Description: `Human readable message indicating details about the current status.`,
+									},
+									"reason": {
+										Type:        schema.TypeString,
+										Computed:    true,
+										Description: `One-word CamelCase reason for the condition's current status.`,
+									},
+									"status": {
+										Type:        schema.TypeString,
+										Computed:    true,
+										Description: `Status of the condition, one of True, False, Unknown.`,
+									},
+									"type": {
+										Type:        schema.TypeString,
+										Computed:    true,
+										Description: `Type of domain mapping condition.`,
+									},
+								},
+							},
+						},
+						"mapped_route_name": {
+							Type:        schema.TypeString,
+							Computed:    true,
+							Description: `The name of the route that the mapping currently points to.`,
+						},
+						"observed_generation": {
+							Type:     schema.TypeInt,
+							Computed: true,
+							Description: `ObservedGeneration is the 'Generation' of the DomainMapping that
+was last processed by the controller.`,
+						},
+					},
+				},
+			},
+			"project": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+		},
+		UseJSONNumber: true,
+	}
+}
+
+func ResourceCloudRunDomainMappingUpgradeV0(_ context.Context, rawState map[string]interface{}, meta interface{}) (map[string]interface{}, error) {
+	log.Printf("[DEBUG] Attributes before migration: %#v", rawState)
+
+	if rawState["metadata"] != nil {
+		rawMetadatas := rawState["metadata"].([]interface{})
+		if len(rawMetadatas) > 0 && rawMetadatas[0] != nil {
+			// Upgrade labels fields
+			rawMetadata := rawMetadatas[0].(map[string]interface{})
+
+			rawLabels := rawMetadata["labels"]
+			if rawLabels != nil {
+				labels := make(map[string]interface{})
+				effectiveLabels := make(map[string]interface{})
+
+				for k, v := range rawLabels.(map[string]interface{}) {
+					effectiveLabels[k] = v
+
+					if !strings.Contains(k, domainMappingGoogleProvidedLocationLabel) && !strings.Contains(k, domainMappingGoogleProvidedOverrideLabel) {
+						labels[k] = v
+					}
+				}
+
+				rawMetadata["labels"] = labels
+				rawMetadata["effective_labels"] = effectiveLabels
+			}
+
+			upgradeAnnotations(rawMetadata)
+
+			rawState["metadata"] = []interface{}{rawMetadata}
+		}
+	}
+
+	log.Printf("[DEBUG] Attributes after migration: %#v", rawState)
+	return rawState, nil
+}
diff --git a/mmv1/templates/terraform/state_migrations/cloud_run_service.go.erb b/mmv1/templates/terraform/state_migrations/cloud_run_service.go.erb
new file mode 100644
index 000000000000..9c807cef403f
--- /dev/null
+++ b/mmv1/templates/terraform/state_migrations/cloud_run_service.go.erb
@@ -0,0 +1,1099 @@
+var cloudRunGoogleProvidedAnnotations = regexp.MustCompile(`serving\.knative\.dev/(?:(?:creator)|(?:lastModifier))$|run\.googleapis\.com/(?:(?:ingress-status)|(?:operation-id))$|cloud\.googleapis\.com/(?:(?:location))`)
+
+func cloudrunAnnotationDiffSuppress(k, old, new string, d *schema.ResourceData) bool {
+	// Suppress diffs for the annotations provided by Google
+	if cloudRunGoogleProvidedAnnotations.MatchString(k) && new == "" {
+		return true
+	}
+
+  	if strings.HasSuffix(k, "run.googleapis.com/ingress") {
+	      	return old == "all" && new == ""
+	}
+
+	// Let diff be determined by annotations (above)
+	if strings.Contains(k, "annotations.%") {
+		return true
+	}
+
+	// For other keys, don't suppress diff.
+	return false
+}
+
+var cloudRunGoogleProvidedLabels = regexp.MustCompile(`cloud\.googleapis\.com/(?:(?:location))`)
+
+func cloudrunLabelDiffSuppress(k, old, new string, d *schema.ResourceData) bool {
+	// Suppress diffs for the labels provided by Google
+	if cloudRunGoogleProvidedLabels.MatchString(k) && new == "" {
+		return true
+	}
+
+	// Let diff be determined by labels (above)
+	if strings.Contains(k, "labels.%") {
+		return true
+	}
+
+	// For other keys, don't suppress diff.
+	return false
+}
+
+func resourceCloudRunServiceResourceV1() *schema.Resource {
+	return &schema.Resource{
+		Schema: map[string]*schema.Schema{
+			"location": {
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: `The location of the cloud run instance. eg us-central1`,
+			},
+			"name": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+				Description: `Name must be unique within a Google Cloud project and region.
+Is required when creating resources. Name is primarily intended
+for creation idempotence and configuration definition. Cannot be updated.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names`,
+			},
+			"template": {
+				Type:     schema.TypeList,
+				Optional: true,
+				Description: `template holds the latest specification for the Revision to
+be stamped out. The template references the container image, and may also
+include labels and annotations that should be attached to the Revision.
+To correlate a Revision, and/or to force a Revision to be created when the
+spec doesn't otherwise change, a nonce label may be provided in the
+template metadata. For more details, see:
+https://github.com/knative/serving/blob/main/docs/client-conventions.md#associate-modifications-with-revisions
+
+Cloud Run does not currently support referencing a build that is
+responsible for materializing the container image from source.`,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"spec": {
+							Type:        schema.TypeList,
+							Computed:    true,
+							Optional:    true,
+							Description: `RevisionSpec holds the desired state of the Revision (from the client).`,
+							MaxItems:    1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"containers": {
+										Type:        schema.TypeList,
+										Computed:    true,
+										Optional:    true,
+										Description: `Containers defines the unit of execution for this Revision.`,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"image": {
+													Type:     schema.TypeString,
+													Required: true,
+													Description: `Docker image name. This is most often a reference to a container located
+in the container registry, such as gcr.io/cloudrun/hello`,
+												},
+												"args": {
+													Type:     schema.TypeList,
+													Optional: true,
+													Description: `Arguments to the entrypoint.
+The docker image's CMD is used if this is not provided.`,
+													Elem: &schema.Schema{
+														Type: schema.TypeString,
+													},
+												},
+												"command": {
+													Type:     schema.TypeList,
+													Optional: true,
+													Description: `Entrypoint array. Not executed within a shell.
+The docker image's ENTRYPOINT is used if this is not provided.`,
+													Elem: &schema.Schema{
+														Type: schema.TypeString,
+													},
+												},
+												"env": {
+													Type:        schema.TypeSet,
+													Optional:    true,
+													Description: `List of environment variables to set in the container.`,
+													Elem:        cloudrunServiceSpecTemplateSpecContainersContainersEnvSchema(),
+													// Default schema.HashSchema is used.
+												},
+												"env_from": {
+													Type:       schema.TypeList,
+													Optional:   true,
+													Deprecated: "`env_from` is deprecated and will be removed in a future major release. This field is not supported by the Cloud Run API.",
+													ForceNew:   true,
+													Description: `List of sources to populate environment variables in the container.
+All invalid keys will be reported as an event when the container is starting.
+When a key exists in multiple sources, the value associated with the last source will
+take precedence. Values defined by an Env with a duplicate key will take
+precedence.`,
+													Elem: &schema.Resource{
+														Schema: map[string]*schema.Schema{
+															"config_map_ref": {
+																Type:        schema.TypeList,
+																Optional:    true,
+																Description: `The ConfigMap to select from.`,
+																MaxItems:    1,
+																Elem: &schema.Resource{
+																	Schema: map[string]*schema.Schema{
+																		"local_object_reference": {
+																			Type:        schema.TypeList,
+																			Optional:    true,
+																			Description: `The ConfigMap to select from.`,
+																			MaxItems:    1,
+																			Elem: &schema.Resource{
+																				Schema: map[string]*schema.Schema{
+																					"name": {
+																						Type:        schema.TypeString,
+																						Required:    true,
+																						Description: `Name of the referent.`,
+																					},
+																				},
+																			},
+																		},
+																		"optional": {
+																			Type:        schema.TypeBool,
+																			Optional:    true,
+																			Description: `Specify whether the ConfigMap must be defined`,
+																		},
+																	},
+																},
+															},
+															"prefix": {
+																Type:        schema.TypeString,
+																Optional:    true,
+																Description: `An optional identifier to prepend to each key in the ConfigMap.`,
+															},
+															"secret_ref": {
+																Type:        schema.TypeList,
+																Optional:    true,
+																Description: `The Secret to select from.`,
+																MaxItems:    1,
+																Elem: &schema.Resource{
+																	Schema: map[string]*schema.Schema{
+																		"local_object_reference": {
+																			Type:        schema.TypeList,
+																			Optional:    true,
+																			Description: `The Secret to select from.`,
+																			MaxItems:    1,
+																			Elem: &schema.Resource{
+																				Schema: map[string]*schema.Schema{
+																					"name": {
+																						Type:        schema.TypeString,
+																						Required:    true,
+																						Description: `Name of the referent.`,
+																					},
+																				},
+																			},
+																		},
+																		"optional": {
+																			Type:        schema.TypeBool,
+																			Optional:    true,
+																			Description: `Specify whether the Secret must be defined`,
+																		},
+																	},
+																},
+															},
+														},
+													},
+												},
+												"liveness_probe": {
+													Type:        schema.TypeList,
+													Optional:    true,
+													Description: `Periodic probe of container liveness. Container will be restarted if the probe fails.`,
+													MaxItems:    1,
+													Elem: &schema.Resource{
+														Schema: map[string]*schema.Schema{
+															"failure_threshold": {
+																Type:     schema.TypeInt,
+																Optional: true,
+																Description: `Minimum consecutive failures for the probe to be considered failed after
+having succeeded. Defaults to 3. Minimum value is 1.`,
+																Default: 3,
+															},
+															"grpc": {
+																Type:        schema.TypeList,
+																Optional:    true,
+																Description: `GRPC specifies an action involving a GRPC port.`,
+																MaxItems:    1,
+																Elem: &schema.Resource{
+																	Schema: map[string]*schema.Schema{
+																		"port": {
+																			Type:     schema.TypeInt,
+																			Computed: true,
+																			Optional: true,
+																			Description: `Port number to access on the container. Number must be in the range 1 to 65535.
+If not specified, defaults to the same value as container.ports[0].containerPort.`,
+																		},
+																		"service": {
+																			Type:     schema.TypeString,
+																			Optional: true,
+																			Description: `The name of the service to place in the gRPC HealthCheckRequest
+(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+If this is not specified, the default behavior is defined by gRPC.`,
+																		},
+																	},
+																},
+																ExactlyOneOf: []string{},
+															},
+															"http_get": {
+																Type:        schema.TypeList,
+																Optional:    true,
+																Description: `HttpGet specifies the http request to perform.`,
+																MaxItems:    1,
+																Elem: &schema.Resource{
+																	Schema: map[string]*schema.Schema{
+																		"http_headers": {
+																			Type:        schema.TypeList,
+																			Optional:    true,
+																			Description: `Custom headers to set in the request. HTTP allows repeated headers.`,
+																			Elem: &schema.Resource{
+																				Schema: map[string]*schema.Schema{
+																					"name": {
+																						Type:        schema.TypeString,
+																						Required:    true,
+																						Description: `The header field name.`,
+																					},
+																					"value": {
+																						Type:        schema.TypeString,
+																						Optional:    true,
+																						Description: `The header field value.`,
+																						Default:     "",
+																					},
+																				},
+																			},
+																		},
+																		"path": {
+																			Type:        schema.TypeString,
+																			Optional:    true,
+																			Description: `Path to access on the HTTP server. If set, it should not be empty string.`,
+																			Default:     "/",
+																		},
+																		"port": {
+																			Type:     schema.TypeInt,
+																			Computed: true,
+																			Optional: true,
+																			Description: `Port number to access on the container. Number must be in the range 1 to 65535.
+If not specified, defaults to the same value as container.ports[0].containerPort.`,
+																		},
+																	},
+																},
+																ExactlyOneOf: []string{},
+															},
+															"initial_delay_seconds": {
+																Type:     schema.TypeInt,
+																Optional: true,
+																Description: `Number of seconds after the container has started before the probe is
+initiated.
+Defaults to 0 seconds. Minimum value is 0. Maximum value is 3600.`,
+																Default: 0,
+															},
+															"period_seconds": {
+																Type:     schema.TypeInt,
+																Optional: true,
+																Description: `How often (in seconds) to perform the probe.
+Default to 10 seconds. Minimum value is 1. Maximum value is 3600.`,
+																Default: 10,
+															},
+															"timeout_seconds": {
+																Type:     schema.TypeInt,
+																Optional: true,
+																Description: `Number of seconds after which the probe times out.
+Defaults to 1 second. Minimum value is 1. Maximum value is 3600.
+Must be smaller than period_seconds.`,
+																Default: 1,
+															},
+														},
+													},
+												},
+												"name": {
+													Type:        schema.TypeString,
+													Computed:    true,
+													Optional:    true,
+													Description: `Name of the container`,
+												},
+												"ports": {
+													Type:        schema.TypeList,
+													Computed:    true,
+													Optional:    true,
+													Description: `List of open ports in the container.`,
+													Elem: &schema.Resource{
+														Schema: map[string]*schema.Schema{
+															"container_port": {
+																Type:        schema.TypeInt,
+																Optional:    true,
+																Description: `Port number the container listens on. This must be a valid port number (between 1 and 65535). Defaults to "8080".`,
+															},
+															"name": {
+																Type:        schema.TypeString,
+																Computed:    true,
+																Optional:    true,
+																Description: `If specified, used to specify which protocol to use. Allowed values are "http1" (HTTP/1) and "h2c" (HTTP/2 end-to-end). Defaults to "http1".`,
+															},
+															"protocol": {
+																Type:        schema.TypeString,
+																Optional:    true,
+																Description: `Protocol for port. Must be "TCP". Defaults to "TCP".`,
+															},
+														},
+													},
+												},
+												"resources": {
+													Type:        schema.TypeList,
+													Computed:    true,
+													Optional:    true,
+													Description: `Compute Resources required by this container. Used to set values such as max memory`,
+													MaxItems:    1,
+													Elem: &schema.Resource{
+														Schema: map[string]*schema.Schema{
+															"limits": {
+																Type:     schema.TypeMap,
+																Computed: true,
+																Optional: true,
+																Description: `Limits describes the maximum amount of compute resources allowed.
+The values of the map is string form of the 'quantity' k8s type:
+https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go`,
+																Elem: &schema.Schema{Type: schema.TypeString},
+															},
+															"requests": {
+																Type:     schema.TypeMap,
+																Optional: true,
+																Description: `Requests describes the minimum amount of compute resources required.
+If Requests is omitted for a container, it defaults to Limits if that is
+explicitly specified, otherwise to an implementation-defined value.
+The values of the map is string form of the 'quantity' k8s type:
+https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go`,
+																Elem: &schema.Schema{Type: schema.TypeString},
+															},
+														},
+													},
+												},
+												"startup_probe": {
+													Type:     schema.TypeList,
+													Computed: true,
+													Optional: true,
+													Description: `Startup probe of application within the container.
+All other probes are disabled if a startup probe is provided, until it
+succeeds. Container will not be added to service endpoints if the probe fails.`,
+													MaxItems: 1,
+													Elem: &schema.Resource{
+														Schema: map[string]*schema.Schema{
+															"failure_threshold": {
+																Type:     schema.TypeInt,
+																Optional: true,
+																Description: `Minimum consecutive failures for the probe to be considered failed after
+having succeeded. Defaults to 3. Minimum value is 1.`,
+																Default: 3,
+															},
+															"grpc": {
+																Type:        schema.TypeList,
+																Optional:    true,
+																Description: `GRPC specifies an action involving a GRPC port.`,
+																MaxItems:    1,
+																Elem: &schema.Resource{
+																	Schema: map[string]*schema.Schema{
+																		"port": {
+																			Type:     schema.TypeInt,
+																			Computed: true,
+																			Optional: true,
+																			Description: `Port number to access on the container. Number must be in the range 1 to 65535.
+If not specified, defaults to the same value as container.ports[0].containerPort.`,
+																		},
+																		"service": {
+																			Type:     schema.TypeString,
+																			Optional: true,
+																			Description: `The name of the service to place in the gRPC HealthCheckRequest
+(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+If this is not specified, the default behavior is defined by gRPC.`,
+																		},
+																	},
+																},
+																ExactlyOneOf: []string{},
+															},
+															"http_get": {
+																Type:        schema.TypeList,
+																Optional:    true,
+																Description: `HttpGet specifies the http request to perform.`,
+																MaxItems:    1,
+																Elem: &schema.Resource{
+																	Schema: map[string]*schema.Schema{
+																		"http_headers": {
+																			Type:        schema.TypeList,
+																			Optional:    true,
+																			Description: `Custom headers to set in the request. HTTP allows repeated headers.`,
+																			Elem: &schema.Resource{
+																				Schema: map[string]*schema.Schema{
+																					"name": {
+																						Type:        schema.TypeString,
+																						Required:    true,
+																						Description: `The header field name.`,
+																					},
+																					"value": {
+																						Type:        schema.TypeString,
+																						Optional:    true,
+																						Description: `The header field value.`,
+																						Default:     "",
+																					},
+																				},
+																			},
+																		},
+																		"path": {
+																			Type:        schema.TypeString,
+																			Optional:    true,
+																			Description: `Path to access on the HTTP server. If set, it should not be empty string.`,
+																			Default:     "/",
+																		},
+																		"port": {
+																			Type:     schema.TypeInt,
+																			Computed: true,
+																			Optional: true,
+																			Description: `Port number to access on the container. Number must be in the range 1 to 65535.
+If not specified, defaults to the same value as container.ports[0].containerPort.`,
+																		},
+																	},
+																},
+																ExactlyOneOf: []string{},
+															},
+															"initial_delay_seconds": {
+																Type:     schema.TypeInt,
+																Optional: true,
+																Description: `Number of seconds after the container has started before the probe is
+initiated.
+Defaults to 0 seconds. Minimum value is 0. Maximum value is 240.`,
+																Default: 0,
+															},
+															"period_seconds": {
+																Type:     schema.TypeInt,
+																Optional: true,
+																Description: `How often (in seconds) to perform the probe.
+Default to 10 seconds. Minimum value is 1. Maximum value is 240.`,
+																Default: 10,
+															},
+															"tcp_socket": {
+																Type:        schema.TypeList,
+																Optional:    true,
+																Description: `TcpSocket specifies an action involving a TCP port.`,
+																MaxItems:    1,
+																Elem: &schema.Resource{
+																	Schema: map[string]*schema.Schema{
+																		"port": {
+																			Type:     schema.TypeInt,
+																			Computed: true,
+																			Optional: true,
+																			Description: `Port number to access on the container. Number must be in the range 1 to 65535.
+If not specified, defaults to the same value as container.ports[0].containerPort.`,
+																		},
+																	},
+																},
+																ExactlyOneOf: []string{},
+															},
+															"timeout_seconds": {
+																Type:     schema.TypeInt,
+																Optional: true,
+																Description: `Number of seconds after which the probe times out.
+Defaults to 1 second. Minimum value is 1. Maximum value is 3600.
+Must be smaller than periodSeconds.`,
+																Default: 1,
+															},
+														},
+													},
+												},
+												"volume_mounts": {
+													Type:     schema.TypeList,
+													Optional: true,
+													Description: `Volume to mount into the container's filesystem.
+Only supports SecretVolumeSources.`,
+													Elem: &schema.Resource{
+														Schema: map[string]*schema.Schema{
+															"mount_path": {
+																Type:     schema.TypeString,
+																Required: true,
+																Description: `Path within the container at which the volume should be mounted.  Must
+not contain ':'.`,
+															},
+															"name": {
+																Type:        schema.TypeString,
+																Required:    true,
+																Description: `This must match the Name of a Volume.`,
+															},
+														},
+													},
+												},
+												"working_dir": {
+													Type:       schema.TypeString,
+													Optional:   true,
+													Deprecated: "`working_dir` is deprecated and will be removed in a future major release. This field is not supported by the Cloud Run API.",
+													ForceNew:   true,
+													Description: `Container's working directory.
+If not specified, the container runtime's default will be used, which
+might be configured in the container image.`,
+												},
+											},
+										},
+									},
+									"container_concurrency": {
+										Type:     schema.TypeInt,
+										Computed: true,
+										Optional: true,
+										Description: `ContainerConcurrency specifies the maximum allowed in-flight (concurrent)
+requests per container of the Revision. Values are:
+- '0' thread-safe, the system should manage the max concurrency. This is
+    the default value.
+- '1' not-thread-safe. Single concurrency
+- '2-N' thread-safe, max concurrency of N`,
+									},
+									"service_account_name": {
+										Type:     schema.TypeString,
+										Computed: true,
+										Optional: true,
+										Description: `Email address of the IAM service account associated with the revision of the
+service. The service account represents the identity of the running revision,
+and determines what permissions the revision has. If not provided, the revision
+will use the project's default service account.`,
+									},
+									"timeout_seconds": {
+										Type:        schema.TypeInt,
+										Computed:    true,
+										Optional:    true,
+										Description: `TimeoutSeconds holds the max duration the instance is allowed for responding to a request.`,
+									},
+									"volumes": {
+										Type:        schema.TypeList,
+										Optional:    true,
+										Description: `Volume represents a named volume in a container.`,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"name": {
+													Type:        schema.TypeString,
+													Required:    true,
+													Description: `Volume's name.`,
+												},
+<% unless version == "ga" -%>
+												"empty_dir": {
+													Type:        schema.TypeList,
+													Optional:    true,
+													Description: `Ephemeral storage which can be backed by real disks (HD, SSD), network storage or memory (i.e. tmpfs). For now only in memory (tmpfs) is supported. It is ephemeral in the sense that when the sandbox is taken down, the data is destroyed with it (it does not persist across sandbox runs).`,
+													MaxItems:    1,
+													Elem: &schema.Resource{
+														Schema: map[string]*schema.Schema{
+															"medium": {
+																Type:        schema.TypeString,
+																Optional:    true,
+																Description: `The medium on which the data is stored. The default is "" which means to use the node's default medium. Must be an empty string (default) or Memory.`,
+															},
+															"size_limit": {
+																Type:        schema.TypeString,
+																Optional:    true,
+																Description: `Limit on the storage usable by this EmptyDir volume. The size limit is also applicable for memory medium. The maximum usage on memory medium EmptyDir would be the minimum value between the SizeLimit specified here and the sum of memory limits of all containers in a pod. This field's values are of the 'Quantity' k8s type: https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/quantity/. The default is nil which means that the limit is undefined. More info: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir.`,
+															},
+														},
+													},
+												},
+<% end -%>
+												"secret": {
+													Type:     schema.TypeList,
+													Optional: true,
+													Description: `The secret's value will be presented as the content of a file whose
+name is defined in the item path. If no items are defined, the name of
+the file is the secret_name.`,
+													MaxItems: 1,
+													Elem: &schema.Resource{
+														Schema: map[string]*schema.Schema{
+															"secret_name": {
+																Type:     schema.TypeString,
+																Required: true,
+																Description: `The name of the secret in Cloud Secret Manager. By default, the secret
+is assumed to be in the same project.
+If the secret is in another project, you must define an alias.
+An alias definition has the form:
+{alias}:projects/{project-id|project-number}/secrets/{secret-name}.
+If multiple alias definitions are needed, they must be separated by
+commas.
+The alias definitions must be set on the run.googleapis.com/secrets
+annotation.`,
+															},
+															"default_mode": {
+																Type:     schema.TypeInt,
+																Optional: true,
+																Description: `Mode bits to use on created files by default. Must be a value between 0000
+and 0777. Defaults to 0644. Directories within the path are not affected by
+this setting. This might be in conflict with other options that affect the
+file mode, like fsGroup, and the result can be other mode bits set.`,
+															},
+															"items": {
+																Type:     schema.TypeList,
+																Optional: true,
+																Description: `If unspecified, the volume will expose a file whose name is the
+secret_name.
+If specified, the key will be used as the version to fetch from Cloud
+Secret Manager and the path will be the name of the file exposed in the
+volume. When items are defined, they must specify a key and a path.`,
+																Elem: &schema.Resource{
+																	Schema: map[string]*schema.Schema{
+																		"key": {
+																			Type:     schema.TypeString,
+																			Required: true,
+																			Description: `The Cloud Secret Manager secret version.
+Can be 'latest' for the latest value or an integer for a specific version.`,
+																		},
+																		"path": {
+																			Type:     schema.TypeString,
+																			Required: true,
+																			Description: `The relative path of the file to map the key to.
+May not be an absolute path.
+May not contain the path element '..'.
+May not start with the string '..'.`,
+																		},
+																		"mode": {
+																			Type:     schema.TypeInt,
+																			Optional: true,
+																			Description: `Mode bits to use on this file, must be a value between 0000 and 0777. If
+not specified, the volume defaultMode will be used. This might be in
+conflict with other options that affect the file mode, like fsGroup, and
+the result can be other mode bits set.`,
+																		},
+																	},
+																},
+															},
+														},
+													},
+												},
+											},
+										},
+									},
+									"serving_state": {
+										Type:       schema.TypeString,
+										Computed:   true,
+										Deprecated: "`serving_state` is deprecated and will be removed in a future major release. This field is not supported by the Cloud Run API.",
+										Description: `ServingState holds a value describing the state the resources
+are in for this Revision.
+It is expected
+that the system will manipulate this based on routability and load.`,
+									},
+								},
+							},
+						},
+						"metadata": {
+							Type:     schema.TypeList,
+							Computed: true,
+							Optional: true,
+							Description: `Optional metadata for this Revision, including labels and annotations.
+Name will be generated by the Configuration. To set minimum instances
+for this revision, use the "autoscaling.knative.dev/minScale" annotation
+key. To set maximum instances for this revision, use the
+"autoscaling.knative.dev/maxScale" annotation key. To set Cloud SQL
+connections for the revision, use the "run.googleapis.com/cloudsql-instances"
+annotation key.`,
+							MaxItems: 1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"annotations": {
+										Type:             schema.TypeMap,
+										Computed:         true,
+										Optional:         true,
+										DiffSuppressFunc: cloudrunTemplateAnnotationDiffSuppress,
+										Description: `Annotations is a key value map stored with a resource that
+may be set by external tools to store and retrieve arbitrary metadata. More
+info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
+
+**Note**: The Cloud Run API may add additional annotations that were not provided in your config.
+If terraform plan shows a diff where a server-side annotation is added, you can add it to your config
+or apply the lifecycle.ignore_changes rule to the metadata.0.annotations field.
+
+Annotations with 'run.googleapis.com/' and 'autoscaling.knative.dev' are restricted. Use the following annotation
+keys to configure features on a Revision template:
+
+- 'autoscaling.knative.dev/maxScale' sets the [maximum number of container
+  instances](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--max-instances) of the Revision to run.
+- 'autoscaling.knative.dev/minScale' sets the [minimum number of container
+  instances](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--min-instances) of the Revision to run.
+- 'run.googleapis.com/client-name' sets the client name calling the Cloud Run API.
+- 'run.googleapis.com/cloudsql-instances' sets the [Cloud SQL
+  instances](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--add-cloudsql-instances) the Revision connects to.
+- 'run.googleapis.com/cpu-throttling' sets whether to throttle the CPU when the container is not actively serving
+  requests. See https://cloud.google.com/sdk/gcloud/reference/run/deploy#--[no-]cpu-throttling.
+- 'run.googleapis.com/encryption-key-shutdown-hours' sets the number of hours to wait before an automatic shutdown
+  server after CMEK key revocation is detected.
+- 'run.googleapis.com/encryption-key' sets the [CMEK key](https://cloud.google.com/run/docs/securing/using-cmek)
+  reference to encrypt the container with.
+- 'run.googleapis.com/execution-environment' sets the [execution
+  environment](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--execution-environment)
+  where the application will run.
+- 'run.googleapis.com/post-key-revocation-action-type' sets the
+  [action type](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--post-key-revocation-action-type)
+  after CMEK key revocation.
+- 'run.googleapis.com/secrets' sets a list of key-value pairs to set as
+  [secrets](https://cloud.google.com/run/docs/configuring/secrets#yaml).
+- 'run.googleapis.com/sessionAffinity' sets whether to enable
+  [session affinity](https://cloud.google.com/sdk/gcloud/reference/beta/run/deploy#--[no-]session-affinity)
+  for connections to the Revision.
+- 'run.googleapis.com/startup-cpu-boost' sets whether to allocate extra CPU to containers on startup.
+  See https://cloud.google.com/sdk/gcloud/reference/run/deploy#--[no-]cpu-boost.
+- 'run.googleapis.com/vpc-access-connector' sets a [VPC connector](https://cloud.google.com/run/docs/configuring/connecting-vpc#terraform_1)
+  for the Revision.
+- 'run.googleapis.com/vpc-access-egress' sets the outbound traffic to send through the VPC connector for this resource.
+  See https://cloud.google.com/sdk/gcloud/reference/run/deploy#--vpc-egress.`,
+										Elem: &schema.Schema{Type: schema.TypeString},
+									},
+									"labels": {
+										Type:             schema.TypeMap,
+										Computed:         true,
+										Optional:         true,
+										DiffSuppressFunc: cloudrunTemplateLabelDiffSuppress,
+										Description: `Map of string keys and values that can be used to organize and categorize
+(scope and select) objects.`,
+										Elem: &schema.Schema{Type: schema.TypeString},
+									},
+									"name": {
+										Type:     schema.TypeString,
+										Computed: true,
+										Optional: true,
+										Description: `Name must be unique within a Google Cloud project and region.
+Is required when creating resources. Name is primarily intended
+for creation idempotence and configuration definition. Cannot be updated.`,
+									},
+									"namespace": {
+										Type:     schema.TypeString,
+										Computed: true,
+										Optional: true,
+										Description: `In Cloud Run the namespace must be equal to either the
+project ID or project number. It will default to the resource's project.`,
+									},
+									"generation": {
+										Type:        schema.TypeInt,
+										Computed:    true,
+										Description: `A sequence number representing a specific generation of the desired state.`,
+									},
+									"resource_version": {
+										Type:     schema.TypeString,
+										Computed: true,
+										Description: `An opaque value that represents the internal version of this object that
+can be used by clients to determine when objects have changed. May be used
+for optimistic concurrency, change detection, and the watch operation on a
+resource or set of resources. They may only be valid for a
+particular resource or set of resources.`,
+									},
+									"self_link": {
+										Type:        schema.TypeString,
+										Computed:    true,
+										Description: `SelfLink is a URL representing this object.`,
+									},
+									"uid": {
+										Type:     schema.TypeString,
+										Computed: true,
+										Description: `UID is a unique id generated by the server on successful creation of a resource and is not
+allowed to change on PUT operations.`,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			"traffic": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Optional: true,
+				Description: `Traffic specifies how to distribute traffic over a collection of Knative Revisions
+and Configurations`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"percent": {
+							Type:        schema.TypeInt,
+							Required:    true,
+							Description: `Percent specifies percent of the traffic to this Revision or Configuration.`,
+						},
+						"latest_revision": {
+							Type:     schema.TypeBool,
+							Optional: true,
+							Description: `LatestRevision may be optionally provided to indicate that the latest ready
+Revision of the Configuration should be used for this traffic target. When
+provided LatestRevision must be true if RevisionName is empty; it must be
+false when RevisionName is non-empty.`,
+						},
+						"revision_name": {
+							Type:        schema.TypeString,
+							Optional:    true,
+							Description: `RevisionName of a specific revision to which to send this portion of traffic.`,
+						},
+						"tag": {
+							Type:        schema.TypeString,
+							Optional:    true,
+							Description: `Tag is optionally used to expose a dedicated url for referencing this target exclusively.`,
+						},
+						"url": {
+							Type:     schema.TypeString,
+							Computed: true,
+							Description: `URL displays the URL for accessing tagged traffic targets. URL is displayed in status,
+and is disallowed on spec. URL must contain a scheme (e.g. http://) and a hostname,
+but may not contain anything else (e.g. basic auth, url path, etc.)`,
+						},
+					},
+				},
+			},
+
+			"metadata": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Optional: true,
+				Description: `Metadata associated with this Service, including name, namespace, labels,
+and annotations.`,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"annotations": {
+							Type:             schema.TypeMap,
+							Computed:         true,
+							Optional:         true,
+							DiffSuppressFunc: cloudrunAnnotationDiffSuppress,
+							Description: `Annotations is a key value map stored with a resource that
+may be set by external tools to store and retrieve arbitrary metadata. More
+info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
+
+**Note**: The Cloud Run API may add additional annotations that were not provided in your config.
+If terraform plan shows a diff where a server-side annotation is added, you can add it to your config
+or apply the lifecycle.ignore_changes rule to the metadata.0.annotations field.
+
+Annotations with 'run.googleapis.com/' and 'autoscaling.knative.dev' are restricted. Use the following annotation
+keys to configure features on a Service:
+
+- 'run.googleapis.com/binary-authorization-breakglass' sets the [Binary Authorization breakglass](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--breakglass).
+- 'run.googleapis.com/binary-authorization' sets the [Binary Authorization](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--binary-authorization).
+- 'run.googleapis.com/client-name' sets the client name calling the Cloud Run API.
+- 'run.googleapis.com/custom-audiences' sets the [custom audiences](https://cloud.google.com/sdk/gcloud/reference/alpha/run/deploy#--add-custom-audiences)
+  that can be used in the audience field of ID token for authenticated requests.
+- 'run.googleapis.com/description' sets a user defined description for the Service.
+- 'run.googleapis.com/ingress' sets the [ingress settings](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--ingress)
+  for the Service. For example, '"run.googleapis.com/ingress" = "all"'.
+- 'run.googleapis.com/launch-stage' sets the [launch stage](https://cloud.google.com/run/docs/troubleshooting#launch-stage-validation)
+  when a preview feature is used. For example, '"run.googleapis.com/launch-stage": "BETA"'`,
+							Elem: &schema.Schema{Type: schema.TypeString},
+						},
+						"labels": {
+							Type:             schema.TypeMap,
+							Computed:         true,
+							Optional:         true,
+							DiffSuppressFunc: cloudrunLabelDiffSuppress,
+							Description: `Map of string keys and values that can be used to organize and categorize
+(scope and select) objects. May match selectors of replication controllers
+and routes.`,
+							Elem: &schema.Schema{Type: schema.TypeString},
+						},
+						"namespace": {
+							Type:     schema.TypeString,
+							Computed: true,
+							Optional: true,
+							Description: `In Cloud Run the namespace must be equal to either the
+project ID or project number.`,
+						},
+						"generation": {
+							Type:        schema.TypeInt,
+							Computed:    true,
+							Description: `A sequence number representing a specific generation of the desired state.`,
+						},
+						"resource_version": {
+							Type:     schema.TypeString,
+							Computed: true,
+							Description: `An opaque value that represents the internal version of this object that
+can be used by clients to determine when objects have changed. May be used
+for optimistic concurrency, change detection, and the watch operation on a
+resource or set of resources. They may only be valid for a
+particular resource or set of resources.`,
+						},
+						"self_link": {
+							Type:        schema.TypeString,
+							Computed:    true,
+							Description: `SelfLink is a URL representing this object.`,
+						},
+						"uid": {
+							Type:     schema.TypeString,
+							Computed: true,
+							Description: `UID is a unique id generated by the server on successful creation of a resource and is not
+allowed to change on PUT operations.`,
+						},
+					},
+				},
+			},
+			"status": {
+				Type:        schema.TypeList,
+				Computed:    true,
+				Description: `The current status of the Service.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"conditions": {
+							Type:        schema.TypeList,
+							Computed:    true,
+							Description: `Array of observed Service Conditions, indicating the current ready state of the service.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"message": {
+										Type:        schema.TypeString,
+										Computed:    true,
+										Description: `Human readable message indicating details about the current status.`,
+									},
+									"reason": {
+										Type:        schema.TypeString,
+										Computed:    true,
+										Description: `One-word CamelCase reason for the condition's current status.`,
+									},
+									"status": {
+										Type:        schema.TypeString,
+										Computed:    true,
+										Description: `Status of the condition, one of True, False, Unknown.`,
+									},
+									"type": {
+										Type:        schema.TypeString,
+										Computed:    true,
+										Description: `Type of domain mapping condition.`,
+									},
+								},
+							},
+						},
+						"latest_created_revision_name": {
+							Type:     schema.TypeString,
+							Computed: true,
+							Description: `From ConfigurationStatus. LatestCreatedRevisionName is the last revision that was created
+from this Service's Configuration. It might not be ready yet, for that use
+LatestReadyRevisionName.`,
+						},
+						"latest_ready_revision_name": {
+							Type:     schema.TypeString,
+							Computed: true,
+							Description: `From ConfigurationStatus. LatestReadyRevisionName holds the name of the latest Revision
+stamped out from this Service's Configuration that has had its "Ready" condition become
+"True".`,
+						},
+						"observed_generation": {
+							Type:     schema.TypeInt,
+							Computed: true,
+							Description: `ObservedGeneration is the 'Generation' of the Route that was last processed by the
+controller.
+
+Clients polling for completed reconciliation should poll until observedGeneration =
+metadata.generation and the Ready condition's status is True or False.`,
+						},
+						"traffic": {
+							Type:     schema.TypeList,
+							Computed: true,
+							Description: `Traffic specifies how to distribute traffic over a collection of Knative Revisions
+and Configurations`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"latest_revision": {
+										Type:     schema.TypeBool,
+										Computed: true,
+										Description: `LatestRevision may be optionally provided to indicate that the latest ready
+Revision of the Configuration should be used for this traffic target. When
+provided LatestRevision must be true if RevisionName is empty; it must be
+false when RevisionName is non-empty.`,
+									},
+									"percent": {
+										Type:        schema.TypeInt,
+										Computed:    true,
+										Description: `Percent specifies percent of the traffic to this Revision or Configuration.`,
+									},
+									"revision_name": {
+										Type:        schema.TypeString,
+										Computed:    true,
+										Description: `RevisionName of a specific revision to which to send this portion of traffic.`,
+									},
+									"tag": {
+										Type:        schema.TypeString,
+										Computed:    true,
+										Description: `Tag is optionally used to expose a dedicated url for referencing this target exclusively.`,
+									},
+									"url": {
+										Type:     schema.TypeString,
+										Computed: true,
+										Description: `URL displays the URL for accessing tagged traffic targets. URL is displayed in status,
+and is disallowed on spec. URL must contain a scheme (e.g. http://) and a hostname,
+but may not contain anything else (e.g. basic auth, url path, etc.)`,
+									},
+								},
+							},
+						},
+						"url": {
+							Type:     schema.TypeString,
+							Computed: true,
+							Description: `From RouteStatus. URL holds the url that will distribute traffic over the provided traffic
+targets. It generally has the form
+https://{route-hash}-{project-hash}-{cluster-level-suffix}.a.run.app`,
+						},
+					},
+				},
+			},
+			"autogenerate_revision_name": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+				Description: `If set to 'true', the revision name (template.metadata.name) will be omitted and
+autogenerated by Cloud Run. This cannot be set to 'true' while 'template.metadata.name'
+is also set.
+(For legacy support, if 'template.metadata.name' is unset in state while
+this field is set to false, the revision name will still autogenerate.)`,
+			},
+			"project": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+		},
+		UseJSONNumber: true,
+	}
+}
+
+func upgradeAnnotations(rawMetadata map[string]interface{}) {
+	rawAnnotations := rawMetadata["annotations"]
+	if rawAnnotations != nil {
+		annotations := make(map[string]interface{})
+		effectiveAnnotations := make(map[string]interface{})
+
+		for k, v := range rawAnnotations.(map[string]interface{}) {
+			effectiveAnnotations[k] = v
+
+			if !(cloudRunGoogleProvidedAnnotations.MatchString(k) || (strings.HasSuffix(k, "run.googleapis.com/ingress") && v == "all")) {
+				annotations[k] = v
+			}
+		}
+
+		rawMetadata["annotations"] = annotations
+		rawMetadata["effective_annotations"] = effectiveAnnotations
+	}
+}
+
+func ResourceCloudRunServiceUpgradeV1(_ context.Context, rawState map[string]interface{}, meta interface{}) (map[string]interface{}, error) {
+	log.Printf("[DEBUG] Attributes before migration: %#v", rawState)
+
+	if rawState["metadata"] != nil {
+		rawMetadatas := rawState["metadata"].([]interface{})
+
+		// Upgrade labels fields
+		if len(rawMetadatas) > 0 && rawMetadatas[0] != nil {
+			rawMetadata := rawMetadatas[0].(map[string]interface{})
+
+			rawLabels := rawMetadata["labels"]
+			if rawLabels != nil {
+				labels := make(map[string]interface{})
+				effectiveLabels := make(map[string]interface{})
+
+				for k, v := range rawLabels.(map[string]interface{}) {
+					effectiveLabels[k] = v
+
+					if !cloudRunGoogleProvidedLabels.MatchString(k) {
+						labels[k] = v
+					}
+				}
+
+				rawMetadata["labels"] = labels
+				rawMetadata["effective_labels"] = effectiveLabels
+			}
+
+			upgradeAnnotations(rawMetadata)
+
+			rawState["metadata"] = []interface{}{rawMetadata}
+		}
+	}
+
+	log.Printf("[DEBUG] Attributes after migration: %#v", rawState)
+	return rawState, nil
+}
diff --git a/mmv1/templates/terraform/state_migrations/filestore_instance.go.erb b/mmv1/templates/terraform/state_migrations/filestore_instance.go.erb
index 4bfeb4e5e87e..597bf6f1c304 100644
--- a/mmv1/templates/terraform/state_migrations/filestore_instance.go.erb
+++ b/mmv1/templates/terraform/state_migrations/filestore_instance.go.erb
@@ -138,8 +138,8 @@ addresses reserved for this instance.`,
         Type:         schema.TypeString,
         Required:     true,
         ForceNew:     true,
-        ValidateFunc: validation.StringInSlice([]string{"TIER_UNSPECIFIED", "STANDARD", "PREMIUM", "BASIC_HDD", "BASIC_SSD", "HIGH_SCALE_SSD"}, false),
-        Description:  `The service tier of the instance. Possible values: ["TIER_UNSPECIFIED", "STANDARD", "PREMIUM", "BASIC_HDD", "BASIC_SSD", "HIGH_SCALE_SSD"]`,
+        ValidateFunc: validation.StringInSlice([]string{"TIER_UNSPECIFIED", "STANDARD", "PREMIUM", "BASIC_HDD", "BASIC_SSD", "HIGH_SCALE_SSD", "ZONAL"}, false),
+        Description:  `The service tier of the instance. Possible values: ["TIER_UNSPECIFIED", "STANDARD", "PREMIUM", "BASIC_HDD", "BASIC_SSD", "HIGH_SCALE_SSD", "ZONAL"]`,
       },
       "zone": {
         Type:        schema.TypeString,
diff --git a/mmv1/templates/terraform/state_migrations/gke_hub_membership.go.erb b/mmv1/templates/terraform/state_migrations/gke_hub_membership.go.erb
new file mode 100644
index 000000000000..b7c1415f5f0a
--- /dev/null
+++ b/mmv1/templates/terraform/state_migrations/gke_hub_membership.go.erb
@@ -0,0 +1,91 @@
+func resourceGKEHubMembershipResourceV0() *schema.Resource {
+	return &schema.Resource{
+		Schema: map[string]*schema.Schema{
+			"membership_id": {
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: `The client-provided identifier of the membership.`,
+			},
+			"authority": {
+				Type:     schema.TypeList,
+				Optional: true,
+				Description: `Authority encodes how Google will recognize identities from this Membership.
+See the workload identity documentation for more details:
+https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity`,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"issuer": {
+							Type:     schema.TypeString,
+							Required: true,
+							ForceNew: true,
+							Description: `A JSON Web Token (JWT) issuer URI. 'issuer' must start with 'https://' and // be a valid
+with length <2000 characters. For example: 'https://container.googleapis.com/v1/projects/my-project/locations/us-west1/clusters/my-cluster' (must be 'locations' rather than 'zones'). If the cluster is provisioned with Terraform, this is '"https://container.googleapis.com/v1/${google_container_cluster.my-cluster.id}"'.`,
+						},
+					},
+				},
+			},
+			"endpoint": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				ForceNew:    true,
+				Description: `If this Membership is a Kubernetes API server hosted on GKE, this is a self link to its GCP resource.`,
+				MaxItems:    1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"gke_cluster": {
+							Type:        schema.TypeList,
+							Optional:    true,
+							ForceNew:    true,
+							Description: `If this Membership is a Kubernetes API server hosted on GKE, this is a self link to its GCP resource.`,
+							MaxItems:    1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"resource_link": {
+										Type:             schema.TypeString,
+										Required:         true,
+										ForceNew:         true,
+										DiffSuppressFunc: suppressGkeHubEndpointSelfLinkDiff,
+										Description: `Self-link of the GCP resource for the GKE cluster.
+For example: '//container.googleapis.com/projects/my-project/zones/us-west1-a/clusters/my-cluster'.
+It can be at the most 1000 characters in length. If the cluster is provisioned with Terraform,
+this can be '"//container.googleapis.com/${google_container_cluster.my-cluster.id}"' or
+'google_container_cluster.my-cluster.id'.`,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			"labels": {
+				Type:        schema.TypeMap,
+				Optional:    true,
+				Description: `Labels to apply to this membership.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+			},
+			"name": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: `The unique identifier of the membership.`,
+			},
+			"project": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+		},
+	}
+}
+
+func ResourceGKEHubMembershipUpgradeV0(_ context.Context, rawState map[string]interface{}, meta interface{}) (map[string]interface{}, error) {
+	log.Printf("[DEBUG] Attributes before migration: %#v", rawState)
+
+	// Version 0 didn't support location. Default it to global.
+	rawState["location"] = "global"
+
+	log.Printf("[DEBUG] Attributes after migration: %#v", rawState)
+	return rawState, nil
+}
diff --git a/mmv1/templates/terraform/state_migrations/notebooks_instance.go.erb b/mmv1/templates/terraform/state_migrations/notebooks_instance.go.erb
new file mode 100644
index 000000000000..069dacdd5216
--- /dev/null
+++ b/mmv1/templates/terraform/state_migrations/notebooks_instance.go.erb
@@ -0,0 +1,407 @@
+const notebooksInstanceGoogleProvidedLabel = "goog-caip-notebook"
+
+func NotebooksInstanceLabelDiffSuppress(k, old, new string, d *schema.ResourceData) bool {
+	// Suppress diffs for the label provided by Google
+	if strings.Contains(k, notebooksInstanceGoogleProvidedLabel) && new == "" {
+		return true
+	}
+
+	// Let diff be determined by labels (above)
+	if strings.Contains(k, "labels.%") {
+		return true
+	}
+
+	// For other keys, don't suppress diff.
+	return false
+}
+
+func resourceNotebooksInstanceResourceV0() *schema.Resource {
+	return &schema.Resource{
+		Schema: map[string]*schema.Schema{
+			"location": {
+				Type:             schema.TypeString,
+				Required:         true,
+				ForceNew:         true,
+				DiffSuppressFunc: tpgresource.CompareSelfLinkOrResourceName,
+				Description:      `A reference to the zone where the machine resides.`,
+			},
+			"machine_type": {
+				Type:             schema.TypeString,
+				Required:         true,
+				ForceNew:         true,
+				DiffSuppressFunc: tpgresource.CompareSelfLinkOrResourceName,
+				Description:      `A reference to a machine type which defines VM kind.`,
+			},
+			"name": {
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: `The name specified for the Notebook instance.`,
+			},
+			"accelerator_config": {
+				Type:     schema.TypeList,
+				Optional: true,
+				ForceNew: true,
+				Description: `The hardware accelerator used on this instance. If you use accelerators,
+make sure that your configuration has enough vCPUs and memory to support the
+machineType you have selected.`,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"core_count": {
+							Type:        schema.TypeInt,
+							Required:    true,
+							ForceNew:    true,
+							Description: `Count of cores of this accelerator.`,
+						},
+						"type": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ForceNew:     true,
+							ValidateFunc: verify.ValidateEnum([]string{"ACCELERATOR_TYPE_UNSPECIFIED", "NVIDIA_TESLA_K80", "NVIDIA_TESLA_P100", "NVIDIA_TESLA_V100", "NVIDIA_TESLA_P4", "NVIDIA_TESLA_T4", "NVIDIA_TESLA_T4_VWS", "NVIDIA_TESLA_P100_VWS", "NVIDIA_TESLA_P4_VWS", "NVIDIA_TESLA_A100", "TPU_V2", "TPU_V3"}),
+							Description:  `Type of this accelerator. Possible values: ["ACCELERATOR_TYPE_UNSPECIFIED", "NVIDIA_TESLA_K80", "NVIDIA_TESLA_P100", "NVIDIA_TESLA_V100", "NVIDIA_TESLA_P4", "NVIDIA_TESLA_T4", "NVIDIA_TESLA_T4_VWS", "NVIDIA_TESLA_P100_VWS", "NVIDIA_TESLA_P4_VWS", "NVIDIA_TESLA_A100", "TPU_V2", "TPU_V3"]`,
+						},
+					},
+				},
+			},
+			"boot_disk_size_gb": {
+				Type:     schema.TypeInt,
+				Optional: true,
+				ForceNew: true,
+				Description: `The size of the boot disk in GB attached to this instance,
+up to a maximum of 64000 GB (64 TB). The minimum recommended value is 100 GB.
+If not specified, this defaults to 100.`,
+			},
+			"boot_disk_type": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				ValidateFunc: verify.ValidateEnum([]string{"DISK_TYPE_UNSPECIFIED", "PD_STANDARD", "PD_SSD", "PD_BALANCED", "PD_EXTREME", ""}),
+				Description:  `Possible disk types for notebook instances. Possible values: ["DISK_TYPE_UNSPECIFIED", "PD_STANDARD", "PD_SSD", "PD_BALANCED", "PD_EXTREME"]`,
+			},
+			"container_image": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				ForceNew:    true,
+				Description: `Use a container image to start the notebook instance.`,
+				MaxItems:    1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"repository": {
+							Type:     schema.TypeString,
+							Required: true,
+							ForceNew: true,
+							Description: `The path to the container image repository.
+For example: gcr.io/{project_id}/{imageName}`,
+						},
+						"tag": {
+							Type:        schema.TypeString,
+							Optional:    true,
+							ForceNew:    true,
+							Description: `The tag of the container image. If not specified, this defaults to the latest tag.`,
+						},
+					},
+				},
+				ExactlyOneOf: []string{"vm_image", "container_image"},
+			},
+			"custom_gpu_driver_path": {
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+				Description: `Specify a custom Cloud Storage path where the GPU driver is stored.
+If not specified, we'll automatically choose from official GPU drivers.`,
+			},
+			"data_disk_size_gb": {
+				Type:     schema.TypeInt,
+				Optional: true,
+				ForceNew: true,
+				Description: `The size of the data disk in GB attached to this instance,
+up to a maximum of 64000 GB (64 TB).
+You can choose the size of the data disk based on how big your notebooks and data are.
+If not specified, this defaults to 100.`,
+			},
+			"data_disk_type": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				ValidateFunc: verify.ValidateEnum([]string{"DISK_TYPE_UNSPECIFIED", "PD_STANDARD", "PD_SSD", "PD_BALANCED", "PD_EXTREME", ""}),
+				Description:  `Possible disk types for notebook instances. Possible values: ["DISK_TYPE_UNSPECIFIED", "PD_STANDARD", "PD_SSD", "PD_BALANCED", "PD_EXTREME"]`,
+			},
+			"disk_encryption": {
+				Type:             schema.TypeString,
+				Optional:         true,
+				ForceNew:         true,
+				ValidateFunc:     verify.ValidateEnum([]string{"DISK_ENCRYPTION_UNSPECIFIED", "GMEK", "CMEK", ""}),
+				DiffSuppressFunc: tpgresource.EmptyOrDefaultStringSuppress("DISK_ENCRYPTION_UNSPECIFIED"),
+				Description:      `Disk encryption method used on the boot and data disks, defaults to GMEK. Possible values: ["DISK_ENCRYPTION_UNSPECIFIED", "GMEK", "CMEK"]`,
+			},
+			"install_gpu_driver": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				ForceNew: true,
+				Description: `Whether the end user authorizes Google Cloud to install GPU driver
+on this instance. If this field is empty or set to false, the GPU driver
+won't be installed. Only applicable to instances with GPUs.`,
+			},
+			"instance_owners": {
+				Type:     schema.TypeList,
+				Optional: true,
+				ForceNew: true,
+				Description: `The list of owners of this instance after creation.
+Format: alias@example.com.
+Currently supports one owner only.
+If not specified, all of the service account users of
+your VM instance's service account can use the instance.`,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+			"kms_key": {
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+				Description: `The KMS key used to encrypt the disks, only applicable if diskEncryption is CMEK.
+Format: projects/{project_id}/locations/{location}/keyRings/{key_ring_id}/cryptoKeys/{key_id}`,
+			},
+			"labels": {
+				Type:             schema.TypeMap,
+				Computed:         true,
+				Optional:         true,
+				DiffSuppressFunc: NotebooksInstanceLabelDiffSuppress,
+				Description: `Labels to apply to this instance. These can be later modified by the setLabels method.
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
+			},
+			"metadata": {
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Custom metadata to apply to this instance.
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
+			},
+			"network": {
+				Type:             schema.TypeString,
+				Computed:         true,
+				Optional:         true,
+				ForceNew:         true,
+				DiffSuppressFunc: tpgresource.CompareSelfLinkOrResourceName,
+				Description: `The name of the VPC that this instance is in.
+Format: projects/{project_id}/global/networks/{network_id}`,
+			},
+			"nic_type": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				ValidateFunc: verify.ValidateEnum([]string{"UNSPECIFIED_NIC_TYPE", "VIRTIO_NET", "GVNIC", ""}),
+				Description:  `The type of vNIC driver. Possible values: ["UNSPECIFIED_NIC_TYPE", "VIRTIO_NET", "GVNIC"]`,
+			},
+			"no_proxy_access": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				ForceNew:    true,
+				Description: `The notebook instance will not register with the proxy..`,
+			},
+			"no_public_ip": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				ForceNew:    true,
+				Description: `No public IP will be assigned to this instance.`,
+			},
+			"no_remove_data_disk": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				ForceNew:    true,
+				Description: `If true, the data disk will not be auto deleted when deleting the instance.`,
+			},
+			"post_startup_script": {
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+				Description: `Path to a Bash script that automatically runs after a
+notebook instance fully boots up. The path must be a URL
+or Cloud Storage path (gs://path-to-file/file-name).`,
+			},
+			"reservation_affinity": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				ForceNew:    true,
+				Description: `Reservation Affinity for consuming Zonal reservation.`,
+				MaxItems:    1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"consume_reservation_type": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ForceNew:     true,
+							ValidateFunc: verify.ValidateEnum([]string{"NO_RESERVATION", "ANY_RESERVATION", "SPECIFIC_RESERVATION"}),
+							Description:  `The type of Compute Reservation. Possible values: ["NO_RESERVATION", "ANY_RESERVATION", "SPECIFIC_RESERVATION"]`,
+						},
+						"key": {
+							Type:        schema.TypeString,
+							Optional:    true,
+							ForceNew:    true,
+							Description: `Corresponds to the label key of reservation resource.`,
+						},
+						"values": {
+							Type:        schema.TypeList,
+							Optional:    true,
+							ForceNew:    true,
+							Description: `Corresponds to the label values of reservation resource.`,
+							Elem: &schema.Schema{
+								Type: schema.TypeString,
+							},
+						},
+					},
+				},
+			},
+			"service_account": {
+				Type:     schema.TypeString,
+				Computed: true,
+				Optional: true,
+				ForceNew: true,
+				Description: `The service account on this instance, giving access to other
+Google Cloud services. You can use any service account within
+the same project, but you must have the service account user
+permission to use the instance. If not specified,
+the Compute Engine default service account is used.`,
+			},
+			"service_account_scopes": {
+				Type:     schema.TypeList,
+				Optional: true,
+				ForceNew: true,
+				Description: `Optional. The URIs of service account scopes to be included in Compute Engine instances.
+If not specified, the following scopes are defined:
+- https://www.googleapis.com/auth/cloud-platform
+- https://www.googleapis.com/auth/userinfo.email`,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+			"shielded_instance_config": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Optional: true,
+				ForceNew: true,
+				Description: `A set of Shielded Instance options. Check [Images using supported Shielded VM features]
+Not all combinations are valid`,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"enable_integrity_monitoring": {
+							Type:     schema.TypeBool,
+							Optional: true,
+							ForceNew: true,
+							Description: `Defines whether the instance has integrity monitoring enabled. Enables monitoring and attestation of the
+boot integrity of the instance. The attestation is performed against the integrity policy baseline.
+This baseline is initially derived from the implicitly trusted boot image when the instance is created.
+Enabled by default.`,
+							Default: true,
+						},
+						"enable_secure_boot": {
+							Type:     schema.TypeBool,
+							Optional: true,
+							ForceNew: true,
+							Description: `Defines whether the instance has Secure Boot enabled. Secure Boot helps ensure that the system only runs
+authentic software by verifying the digital signature of all boot components, and halting the boot process
+if signature verification fails.
+Disabled by default.`,
+						},
+						"enable_vtpm": {
+							Type:     schema.TypeBool,
+							Optional: true,
+							ForceNew: true,
+							Description: `Defines whether the instance has the vTPM enabled.
+Enabled by default.`,
+							Default: true,
+						},
+					},
+				},
+			},
+			"subnet": {
+				Type:             schema.TypeString,
+				Computed:         true,
+				Optional:         true,
+				ForceNew:         true,
+				DiffSuppressFunc: tpgresource.CompareSelfLinkOrResourceName,
+				Description: `The name of the subnet that this instance is in.
+Format: projects/{project_id}/regions/{region}/subnetworks/{subnetwork_id}`,
+			},
+			"tags": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				ForceNew:    true,
+				Description: `The Compute Engine tags to add to instance.`,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+			"vm_image": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				ForceNew:    true,
+				Description: `Use a Compute Engine VM image to start the notebook instance.`,
+				MaxItems:    1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"project": {
+							Type:     schema.TypeString,
+							Required: true,
+							ForceNew: true,
+							Description: `The name of the Google Cloud project that this VM image belongs to.
+Format: projects/{project_id}`,
+						},
+						"image_family": {
+							Type:        schema.TypeString,
+							Optional:    true,
+							ForceNew:    true,
+							Description: `Use this VM image family to find the image; the newest image in this family will be used.`,
+						},
+						"image_name": {
+							Type:        schema.TypeString,
+							Optional:    true,
+							ForceNew:    true,
+							Description: `Use VM image name to find the image.`,
+						},
+					},
+				},
+				ExactlyOneOf: []string{"vm_image", "container_image"},
+			},
+			"create_time": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Optional:    true,
+				Description: `Instance creation time`,
+			},
+			"proxy_uri": {
+				Type:     schema.TypeString,
+				Computed: true,
+				Description: `The proxy endpoint that is used to access the Jupyter notebook.
+Only returned when the resource is in a 'PROVISIONED' state. If
+needed you can utilize 'terraform apply -refresh-only' to await
+the population of this value.`,
+			},
+			"state": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: `The state of this instance.`,
+			},
+			"update_time": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Optional:    true,
+				Description: `Instance update time.`,
+			},
+			"project": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+		},
+		UseJSONNumber: true,
+	}
+}
+
+func ResourceNotebooksInstanceUpgradeV0(_ context.Context, rawState map[string]interface{}, meta interface{}) (map[string]interface{}, error) {
+	return tpgresource.LabelsStateUpgrade(rawState, notebooksInstanceGoogleProvidedLabel)
+}
\ No newline at end of file
diff --git a/mmv1/third_party/cai2hcl/common/converter.go b/mmv1/third_party/cai2hcl/common/converter.go
new file mode 100644
index 000000000000..d0bccc4cdfb5
--- /dev/null
+++ b/mmv1/third_party/cai2hcl/common/converter.go
@@ -0,0 +1,22 @@
+package common
+
+import (
+	"github.com/GoogleCloudPlatform/terraform-google-conversion/v2/caiasset"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/zclconf/go-cty/cty"
+)
+
+// Converter interface for resources.
+type Converter interface {
+	// Convert turns assets into hcl blocks.
+	Convert(asset []*caiasset.Asset) ([]*HCLResourceBlock, error)
+}
+
+// Function initializing a converter from TF resource name and TF resource schema.
+type ConverterFactory = func(name string, schema map[string]*schema.Schema) Converter
+
+// HCLResourceBlock identifies the HCL block's labels and content.
+type HCLResourceBlock struct {
+	Labels []string
+	Value  cty.Value
+}
diff --git a/mmv1/third_party/cai2hcl/common/utils.go b/mmv1/third_party/cai2hcl/common/utils.go
new file mode 100644
index 000000000000..f2d163f2825b
--- /dev/null
+++ b/mmv1/third_party/cai2hcl/common/utils.go
@@ -0,0 +1,165 @@
+package common
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	"github.com/GoogleCloudPlatform/terraform-google-conversion/v2/caiasset"
+	hashicorpcty "github.com/hashicorp/go-cty/cty"
+	"github.com/hashicorp/hcl/hcl/printer"
+	"github.com/hashicorp/hcl/v2/hclwrite"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	tpg "github.com/hashicorp/terraform-provider-google-beta/google-beta/provider"
+	"github.com/zclconf/go-cty/cty"
+	ctyjson "github.com/zclconf/go-cty/cty/json"
+)
+
+// Extracts named part from resource url.
+func ParseFieldValue(url string, name string) string {
+	fragments := strings.Split(url, "/")
+	for ix, item := range fragments {
+		if item == name && ix+1 < len(fragments) {
+			return fragments[ix+1]
+		}
+	}
+	return ""
+}
+
+// Decodes the map object into the target struct.
+func DecodeJSON(data map[string]interface{}, v interface{}) error {
+	b, err := json.Marshal(data)
+	if err != nil {
+		return err
+	}
+	if err := json.Unmarshal(b, &v); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Converts resource from untyped map format to TF JSON.
+func MapToCtyValWithSchema(m map[string]interface{}, s map[string]*schema.Schema) (cty.Value, error) {
+	b, err := json.Marshal(&m)
+	if err != nil {
+		return cty.NilVal, fmt.Errorf("error marshaling map as JSON: %v", err)
+	}
+	ty, err := hashicorpCtyTypeToZclconfCtyType(schema.InternalMap(s).CoreConfigSchema().ImpliedType())
+	if err != nil {
+		return cty.NilVal, fmt.Errorf("error casting type: %v", err)
+	}
+	ret, err := ctyjson.Unmarshal(b, ty)
+	if err != nil {
+		return cty.NilVal, fmt.Errorf("error unmarshaling JSON as cty.Value: %v", err)
+	}
+	return ret, nil
+}
+
+// Initializes map of converters.
+func CreateConverterMap(converterFactories map[string]ConverterFactory) map[string]Converter {
+	tpgProvider := tpg.Provider()
+
+	result := make(map[string]Converter, len(converterFactories))
+	for name, factory := range converterFactories {
+		result[name] = factory(name, tpgProvider.ResourcesMap[name].Schema)
+	}
+
+	return result
+}
+
+func Convert(assets []*caiasset.Asset, converterNames map[string]string, converterMap map[string]Converter) ([]byte, error) {
+	// Group resources from the same tf resource type for convert.
+	// tf -> cai has 1:N mappings occasionally
+	groups := make(map[string][]*caiasset.Asset)
+	for _, asset := range assets {
+		name, ok := converterNames[asset.Type]
+		if !ok {
+			continue
+		}
+		groups[name] = append(groups[name], asset)
+	}
+
+	f := hclwrite.NewFile()
+	rootBody := f.Body()
+	for name, v := range groups {
+		converter, ok := converterMap[name]
+		if !ok {
+			continue
+		}
+		items, err := converter.Convert(v)
+		if err != nil {
+			return nil, err
+		}
+
+		for _, resourceBlock := range items {
+			hclBlock := rootBody.AppendNewBlock("resource", resourceBlock.Labels)
+			if err := hclWriteBlock(resourceBlock.Value, hclBlock.Body()); err != nil {
+				return nil, err
+			}
+		}
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return printer.Format(f.Bytes())
+}
+
+func hclWriteBlock(val cty.Value, body *hclwrite.Body) error {
+	if val.IsNull() {
+		return nil
+	}
+	if !val.Type().IsObjectType() {
+		return fmt.Errorf("expect object type only, but type = %s", val.Type().FriendlyName())
+	}
+	it := val.ElementIterator()
+	for it.Next() {
+		objKey, objVal := it.Element()
+		if objVal.IsNull() {
+			continue
+		}
+		objValType := objVal.Type()
+		switch {
+		case objValType.IsObjectType():
+			newBlock := body.AppendNewBlock(objKey.AsString(), nil)
+			if err := hclWriteBlock(objVal, newBlock.Body()); err != nil {
+				return err
+			}
+		case objValType.IsCollectionType():
+			if objVal.LengthInt() == 0 {
+				continue
+			}
+			// Presumes map should not contain object type.
+			if !objValType.IsMapType() && objValType.ElementType().IsObjectType() {
+				listIterator := objVal.ElementIterator()
+				for listIterator.Next() {
+					_, listVal := listIterator.Element()
+					subBlock := body.AppendNewBlock(objKey.AsString(), nil)
+					if err := hclWriteBlock(listVal, subBlock.Body()); err != nil {
+						return err
+					}
+				}
+				continue
+			}
+			fallthrough
+		default:
+			if objValType.FriendlyName() == "string" && objVal.AsString() == "" {
+				continue
+			}
+			body.SetAttributeValue(objKey.AsString(), objVal)
+		}
+	}
+	return nil
+}
+
+func hashicorpCtyTypeToZclconfCtyType(t hashicorpcty.Type) (cty.Type, error) {
+	b, err := json.Marshal(t)
+	if err != nil {
+		return cty.NilType, err
+	}
+	var ret cty.Type
+	if err := json.Unmarshal(b, &ret); err != nil {
+		return cty.NilType, err
+	}
+	return ret, nil
+}
diff --git a/mmv1/third_party/cai2hcl/convert.go b/mmv1/third_party/cai2hcl/convert.go
new file mode 100644
index 000000000000..82af21826754
--- /dev/null
+++ b/mmv1/third_party/cai2hcl/convert.go
@@ -0,0 +1,29 @@
+package cai2hcl
+
+import (
+	"fmt"
+
+	"github.com/GoogleCloudPlatform/terraform-google-conversion/v2/caiasset"
+
+	"github.com/GoogleCloudPlatform/terraform-google-conversion/v2/cai2hcl/common"
+	"go.uber.org/zap"
+)
+
+// Struct for options so that adding new options does not
+// require updating function signatures all along the pipe.
+type Options struct {
+	ErrorLogger *zap.Logger
+}
+
+// Converts CAI Assets into HCL.
+func Convert(assets []*caiasset.Asset, options *Options) ([]byte, error) {
+	if options == nil || options.ErrorLogger == nil {
+		return nil, fmt.Errorf("logger is not initialized")
+	}
+
+	t, err := common.Convert(assets, ConverterNames, ConverterMap)
+
+	options.ErrorLogger.Debug(string(t))
+
+	return t, err
+}
diff --git a/mmv1/third_party/cai2hcl/convert_test.go b/mmv1/third_party/cai2hcl/convert_test.go
new file mode 100644
index 000000000000..bf9208825217
--- /dev/null
+++ b/mmv1/third_party/cai2hcl/convert_test.go
@@ -0,0 +1,60 @@
+package cai2hcl
+
+import (
+	"testing"
+
+	"github.com/GoogleCloudPlatform/terraform-google-conversion/v2/cai2hcl/common"
+	"github.com/GoogleCloudPlatform/terraform-google-conversion/v2/cai2hcl/services/compute"
+	cai2hclTesting "github.com/GoogleCloudPlatform/terraform-google-conversion/v2/cai2hcl/testing"
+)
+
+func TestConvertCompute(t *testing.T) {
+	cai2hclTesting.AssertTestFiles(
+		t,
+		ConverterNames, ConverterMap,
+		"./services/compute/testdata",
+		[]string{
+			"full_compute_instance",
+		})
+}
+
+func TestConvertResourcemanager(t *testing.T) {
+	cai2hclTesting.AssertTestFiles(
+		t,
+		ConverterNames, ConverterMap,
+		"./services/resourcemanager/testdata",
+		[]string{
+			"project_create",
+		})
+}
+
+func TestConvertPanicsOnConverterNamesConflict(t *testing.T) {
+	assertPanic(t, func() {
+		joinConverterNames([]map[string]string{
+			{"compute.googleapis.com/Instance": "compute_instance_1"},
+			{"compute.googleapis.com/Instance": "compute_instance_2"},
+		})
+	})
+}
+
+func TestConvertPanicsOnConverterMapConflict(t *testing.T) {
+	assertPanic(t, func() {
+		joinConverterMaps([]map[string]common.Converter{
+			common.CreateConverterMap(map[string]common.ConverterFactory{
+				"google_compute_instance": compute.NewComputeInstanceConverter,
+			}),
+			common.CreateConverterMap(map[string]common.ConverterFactory{
+				"google_compute_instance": compute.NewComputeForwardingRuleConverter,
+			}),
+		})
+	})
+}
+
+func assertPanic(t *testing.T, f func()) {
+	defer func() {
+		if r := recover(); r == nil {
+			t.Errorf("The code did not panic")
+		}
+	}()
+	f()
+}
diff --git a/mmv1/third_party/cai2hcl/converter_map.go b/mmv1/third_party/cai2hcl/converter_map.go
new file mode 100644
index 000000000000..f562d1a72279
--- /dev/null
+++ b/mmv1/third_party/cai2hcl/converter_map.go
@@ -0,0 +1,52 @@
+package cai2hcl
+
+import (
+	"github.com/GoogleCloudPlatform/terraform-google-conversion/v2/cai2hcl/common"
+	"github.com/GoogleCloudPlatform/terraform-google-conversion/v2/cai2hcl/services/compute"
+	"github.com/GoogleCloudPlatform/terraform-google-conversion/v2/cai2hcl/services/resourcemanager"
+)
+
+var allConverterNames = []map[string]string{
+	compute.ConverterNames,
+	resourcemanager.ConverterNames,
+}
+
+var allConverterMaps = []map[string]common.Converter{
+	compute.ConverterMap,
+	resourcemanager.ConverterMap,
+}
+
+var ConverterNames = joinConverterNames(allConverterNames)
+var ConverterMap = joinConverterMaps(allConverterMaps)
+
+func joinConverterNames(arr []map[string]string) map[string]string {
+	result := make(map[string]string)
+
+	for _, m := range arr {
+		for key, value := range m {
+			if _, hasKey := result[key]; hasKey {
+				panic("Converters from different services are not unique")
+			}
+
+			result[key] = value
+		}
+	}
+
+	return result
+}
+
+func joinConverterMaps(arr []map[string]common.Converter) map[string]common.Converter {
+	result := make(map[string]common.Converter)
+
+	for _, m := range arr {
+		for key, value := range m {
+			if _, hasKey := result[key]; hasKey {
+				panic("Converters from different services are not unique")
+			}
+
+			result[key] = value
+		}
+	}
+
+	return result
+}
diff --git a/mmv1/third_party/cai2hcl/services/compute/compute_forwarding_rule.go b/mmv1/third_party/cai2hcl/services/compute/compute_forwarding_rule.go
new file mode 100644
index 000000000000..c36b4cb6fbfc
--- /dev/null
+++ b/mmv1/third_party/cai2hcl/services/compute/compute_forwarding_rule.go
@@ -0,0 +1,93 @@
+package compute
+
+import (
+	"fmt"
+
+	"github.com/GoogleCloudPlatform/terraform-google-conversion/v2/cai2hcl/common"
+	"github.com/GoogleCloudPlatform/terraform-google-conversion/v2/caiasset"
+
+	tfschema "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	computeV1 "google.golang.org/api/compute/v1"
+)
+
+// ComputeForwardingRuleAssetType is the CAI asset type name for compute instance.
+const ComputeForwardingRuleAssetType string = "compute.googleapis.com/ForwardingRule"
+
+// ComputeForwardingRuleConverter for regional forwarding rule.
+type ComputeForwardingRuleConverter struct {
+	name   string
+	schema map[string]*tfschema.Schema
+}
+
+// NewComputeForwardingRuleConverter returns an HCL converter for compute instance.
+func NewComputeForwardingRuleConverter(name string, schema map[string]*tfschema.Schema) common.Converter {
+	return &ComputeForwardingRuleConverter{
+		name:   name,
+		schema: schema,
+	}
+}
+
+// Convert converts asset to HCL resource blocks.
+func (c *ComputeForwardingRuleConverter) Convert(assets []*caiasset.Asset) ([]*common.HCLResourceBlock, error) {
+	var blocks []*common.HCLResourceBlock
+	for _, asset := range assets {
+		if asset == nil {
+			continue
+		}
+		if asset.Resource != nil && asset.Resource.Data != nil {
+			block, err := c.convertResourceData(asset)
+			if err != nil {
+				return nil, err
+			}
+			blocks = append(blocks, block)
+		}
+	}
+	return blocks, nil
+}
+
+// Convert REST payload to JSON/
+// Ported from https://github.com/hashicorp/terraform-provider-google/blob/main/google/resource_compute_forwarding_rule.go#L351
+func (c *ComputeForwardingRuleConverter) convertResourceData(asset *caiasset.Asset) (*common.HCLResourceBlock, error) {
+	if asset == nil || asset.Resource == nil || asset.Resource.Data == nil {
+		return nil, fmt.Errorf("asset resource data is nil")
+	}
+
+	var resource *computeV1.ForwardingRule
+	if err := common.DecodeJSON(asset.Resource.Data, &resource); err != nil {
+		return nil, err
+	}
+
+	hcl := map[string]interface{}{
+		"name":                            resource.Name,
+		"all_ports":                       resource.AllPorts,
+		"allow_global_access":             resource.AllowGlobalAccess,
+		"backend_service":                 resource.BackendService,
+		"description":                     resource.Description,
+		"ip_address":                      resource.IPAddress,
+		"ip_protocol":                     resource.IPProtocol,
+		"is_mirroring_collector":          resource.IsMirroringCollector,
+		"labels":                          resource.Labels,
+		"load_balancing_scheme":           resource.LoadBalancingScheme,
+		"network":                         resource.Network,
+		"network_tier":                    resource.NetworkTier,
+		"port_range":                      resource.PortRange,
+		"ports":                           resource.Ports,
+		"subnetwork":                      resource.Subnetwork,
+		"target":                          resource.Target,
+		"service_label":                   resource.ServiceLabel,
+		"service_directory_registrations": resource.ServiceDirectoryRegistrations,
+	}
+
+	if resource.Region != "" {
+		hcl["region"] = common.ParseFieldValue(resource.Region, "regions")
+	}
+
+	ctyVal, err := common.MapToCtyValWithSchema(hcl, c.schema)
+	if err != nil {
+		return nil, err
+	}
+	return &common.HCLResourceBlock{
+		Labels: []string{c.name, resource.Name},
+		Value:  ctyVal,
+	}, nil
+}
diff --git a/mmv1/third_party/cai2hcl/services/compute/compute_forwarding_rule_test.go b/mmv1/third_party/cai2hcl/services/compute/compute_forwarding_rule_test.go
new file mode 100644
index 000000000000..4a7cfb3c89d3
--- /dev/null
+++ b/mmv1/third_party/cai2hcl/services/compute/compute_forwarding_rule_test.go
@@ -0,0 +1,17 @@
+package compute
+
+import (
+	"testing"
+
+	cai2hclTesting "github.com/GoogleCloudPlatform/terraform-google-conversion/v2/cai2hcl/testing"
+)
+
+func TestComputeForwardingRule(t *testing.T) {
+	cai2hclTesting.AssertTestFiles(
+		t,
+		ConverterNames, ConverterMap,
+		"./testdata",
+		[]string{
+			"full_compute_forwarding_rule",
+		})
+}
diff --git a/mmv1/third_party/cai2hcl/services/compute/compute_instance.go b/mmv1/third_party/cai2hcl/services/compute/compute_instance.go
new file mode 100644
index 000000000000..d6356a2e3ede
--- /dev/null
+++ b/mmv1/third_party/cai2hcl/services/compute/compute_instance.go
@@ -0,0 +1,369 @@
+package compute
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/GoogleCloudPlatform/terraform-google-conversion/v2/caiasset"
+
+	"github.com/GoogleCloudPlatform/terraform-google-conversion/v2/cai2hcl/common"
+	tfschema "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/zclconf/go-cty/cty"
+	"google.golang.org/api/compute/v1"
+)
+
+// ComputeInstanceAssetType is the CAI asset type name for compute instance.
+const ComputeInstanceAssetType string = "compute.googleapis.com/Instance"
+
+// ComputeInstanceConverter for compute instance resource.
+type ComputeInstanceConverter struct {
+	name   string
+	schema map[string]*tfschema.Schema
+}
+
+// NewComputeInstanceConverter returns an HCL converter for compute instance.
+func NewComputeInstanceConverter(name string, schema map[string]*tfschema.Schema) common.Converter {
+	return &ComputeInstanceConverter{
+		name:   name,
+		schema: schema,
+	}
+}
+
+// Convert converts asset to HCL resource blocks.
+func (c *ComputeInstanceConverter) Convert(assets []*caiasset.Asset) ([]*common.HCLResourceBlock, error) {
+	var blocks []*common.HCLResourceBlock
+	for _, asset := range assets {
+		if asset == nil {
+			continue
+		}
+		if asset.IAMPolicy != nil {
+			iamBlock, err := c.convertIAM(asset)
+			if err != nil {
+				return nil, err
+			}
+			blocks = append(blocks, iamBlock)
+		}
+		if asset.Resource != nil && asset.Resource.Data != nil {
+			block, err := c.convertResourceData(asset)
+			if err != nil {
+				return nil, err
+			}
+			blocks = append(blocks, block)
+		}
+	}
+	return blocks, nil
+}
+
+func (c *ComputeInstanceConverter) convertIAM(asset *caiasset.Asset) (*common.HCLResourceBlock, error) {
+	if asset == nil || asset.IAMPolicy == nil {
+		return nil, fmt.Errorf("asset IAM policy is nil")
+	}
+	zone := common.ParseFieldValue(asset.Name, "zones")
+	instanceName := common.ParseFieldValue(asset.Name, "instances")
+	project := common.ParseFieldValue(asset.Name, "projects")
+
+	policyData, err := json.Marshal(asset.IAMPolicy)
+	if err != nil {
+		return nil, err
+	}
+
+	return &common.HCLResourceBlock{
+		Labels: []string{
+			c.name + "_iam_policy",
+			instanceName + "_iam_policy",
+		},
+		Value: cty.ObjectVal(map[string]cty.Value{
+			"zone":          cty.StringVal(zone),
+			"instance_name": cty.StringVal(instanceName),
+			"project":       cty.StringVal(project),
+			"policy_data":   cty.StringVal(string(policyData)),
+		}),
+	}, nil
+}
+
+func (c *ComputeInstanceConverter) convertResourceData(asset *caiasset.Asset) (*common.HCLResourceBlock, error) {
+	if asset == nil || asset.Resource == nil || asset.Resource.Data == nil {
+		return nil, fmt.Errorf("asset resource data is nil")
+	}
+
+	var instance *compute.Instance
+	if err := common.DecodeJSON(asset.Resource.Data, &instance); err != nil {
+		return nil, err
+	}
+
+	bootDisks, scratchDisks, attachedDisks := convertDisks(instance.Disks)
+
+	hclData := make(map[string]interface{})
+	hclData["can_ip_forward"] = instance.CanIpForward
+	hclData["description"] = instance.Description
+	hclData["boot_disk"] = bootDisks
+	hclData["scratch_disk"] = scratchDisks
+	hclData["attached_disk"] = attachedDisks
+	hclData["machine_type"] = common.ParseFieldValue(instance.MachineType, "machineTypes")
+	hclData["name"] = instance.Name
+	hclData["network_interface"] = flattenNetworkInterfaces(instance.NetworkInterfaces)
+	hclData["tags"] = instance.Tags.Items
+	hclData["tags_fingerprint"] = instance.Tags.Fingerprint
+	hclData["labels"] = instance.Labels
+	hclData["service_account"] = flattenServiceAccounts(instance.ServiceAccounts)
+	hclData["guest_accelerator"] = flattenGuestAccelerators(instance.GuestAccelerators)
+	hclData["min_cpu_platform"] = instance.MinCpuPlatform
+	hclData["scheduling"] = convertScheduling(instance.Scheduling)
+	hclData["deletion_protection"] = instance.DeletionProtection
+	hclData["hostname"] = instance.Hostname
+	hclData["shielded_instance_config"] = flattenShieldedVmConfig(instance.ShieldedInstanceConfig)
+	hclData["enable_display"] = flattenEnableDisplay(instance.DisplayDevice)
+	hclData["metadata_fingerprint"] = instance.Metadata.Fingerprint
+	hclData["metadata"] = convertMetadata(instance.Metadata)
+
+	if instance.Zone == "" {
+		hclData["zone"] = common.ParseFieldValue(asset.Name, "zones")
+	} else {
+		hclData["zone"] = common.ParseFieldValue(instance.Zone, "zones")
+	}
+
+	ctyVal, err := common.MapToCtyValWithSchema(hclData, c.schema)
+	if err != nil {
+		return nil, err
+	}
+	return &common.HCLResourceBlock{
+		Labels: []string{c.name, instance.Name},
+		Value:  ctyVal,
+	}, nil
+
+}
+
+func convertDisks(disks []*compute.AttachedDisk) (bootDisks []map[string]interface{}, scratchDisks []map[string]interface{}, attachedDisks []map[string]interface{}) {
+	for _, disk := range disks {
+		if disk.Boot {
+			bootDisks = append(bootDisks, convertBootDisk(disk))
+			continue
+		}
+		if disk.Type == "SCRATCH" {
+			scratchDisks = append(scratchDisks, flattenScratchDisk(disk))
+			continue
+		}
+		attachedDisks = append(attachedDisks, convertAttachedDisk(disk))
+	}
+	return
+}
+
+func convertBootDisk(disk *compute.AttachedDisk) map[string]interface{} {
+	data := map[string]interface{}{
+		"auto_delete": disk.AutoDelete,
+		"device_name": disk.DeviceName,
+		"source":      disk.Source,
+		"mode":        disk.Mode,
+	}
+	if disk.InitializeParams != nil {
+		data["initialize_params"] = []map[string]interface{}{
+			{
+				"size":   disk.InitializeParams.DiskSizeGb,
+				"type":   common.ParseFieldValue(disk.InitializeParams.DiskType, "diskTypes"),
+				"image":  disk.InitializeParams.SourceImage,
+				"labels": disk.InitializeParams.Labels,
+			},
+		}
+	}
+	if disk.DiskEncryptionKey != nil {
+		if disk.DiskEncryptionKey.RawKey != "" {
+			data["disk_encryption_key_raw"] = disk.DiskEncryptionKey.RawKey
+		}
+		if disk.DiskEncryptionKey.Sha256 != "" {
+			data["disk_encryption_key_sha256"] = disk.DiskEncryptionKey.Sha256
+		}
+		if disk.DiskEncryptionKey.KmsKeyName != "" {
+			data["kms_key_self_link"] = disk.DiskEncryptionKey.KmsKeyName
+		}
+	}
+
+	return data
+}
+
+func convertAttachedDisk(disk *compute.AttachedDisk) map[string]interface{} {
+	data := map[string]interface{}{
+		"source":      disk.Source,
+		"mode":        disk.Mode,
+		"device_name": disk.DeviceName,
+	}
+	if disk.DiskEncryptionKey != nil {
+		if disk.DiskEncryptionKey.RawKey != "" {
+			data["disk_encryption_key_raw"] = disk.DiskEncryptionKey.RawKey
+		}
+		if disk.DiskEncryptionKey.Sha256 != "" {
+			data["disk_encryption_key_sha256"] = disk.DiskEncryptionKey.Sha256
+		}
+		if disk.DiskEncryptionKey.KmsKeyName != "" {
+			data["kms_key_self_link"] = disk.DiskEncryptionKey.KmsKeyName
+		}
+	}
+	return data
+}
+
+func convertScheduling(sched *compute.Scheduling) []map[string]interface{} {
+	data := map[string]interface{}{
+		"automatic_restart":   sched.AutomaticRestart,
+		"preemptible":         sched.Preemptible,
+		"on_host_maintenance": sched.OnHostMaintenance,
+		// node_affinities are not converted into cai
+		"node_affinities": convertSchedulingNodeAffinity(sched.NodeAffinities),
+	}
+	if sched.MinNodeCpus > 0 {
+		data["min_node_cpus"] = sched.MinNodeCpus
+	}
+	if len(sched.ProvisioningModel) > 0 {
+		data["provisioning_model"] = sched.ProvisioningModel
+	}
+	return []map[string]interface{}{data}
+}
+
+func convertSchedulingNodeAffinity(items []*compute.SchedulingNodeAffinity) []map[string]interface{} {
+	arr := make([]map[string]interface{}, len(items))
+	for ix, item := range items {
+		arr[ix] = make(map[string]interface{})
+		arr[ix]["key"] = item.Key
+		arr[ix]["operator"] = item.Operator
+		arr[ix]["values"] = item.Values
+	}
+	return arr
+}
+
+func convertMetadata(metadata *compute.Metadata) map[string]interface{} {
+	md := flattenMetadata(metadata)
+
+	// If the existing state contains "metadata_startup_script" instead of "metadata.startup-script",
+	// we should move the remote metadata.startup-script to metadata_startup_script to avoid
+	// specifying it in two places.
+	if _, ok := md["metadata_startup_script"]; ok {
+		md["metadata_startup_script"] = md["startup-script"]
+		delete(md, "startup-script")
+	}
+
+	return md
+}
+
+func flattenMetadata(metadata *compute.Metadata) map[string]interface{} {
+	metadataMap := make(map[string]interface{})
+	for _, item := range metadata.Items {
+		metadataMap[item.Key] = *item.Value
+	}
+	return metadataMap
+}
+
+func flattenGuestAccelerators(accelerators []*compute.AcceleratorConfig) []map[string]interface{} {
+	acceleratorsSchema := make([]map[string]interface{}, len(accelerators))
+	for i, accelerator := range accelerators {
+		acceleratorsSchema[i] = map[string]interface{}{
+			"count": accelerator.AcceleratorCount,
+			"type":  accelerator.AcceleratorType,
+		}
+	}
+	return acceleratorsSchema
+}
+
+func flattenShieldedVmConfig(shieldedVmConfig *compute.ShieldedInstanceConfig) []map[string]bool {
+	if shieldedVmConfig == nil {
+		return nil
+	}
+
+	return []map[string]bool{{
+		"enable_secure_boot":          shieldedVmConfig.EnableSecureBoot,
+		"enable_vtpm":                 shieldedVmConfig.EnableVtpm,
+		"enable_integrity_monitoring": shieldedVmConfig.EnableIntegrityMonitoring,
+	}}
+}
+
+func flattenEnableDisplay(displayDevice *compute.DisplayDevice) interface{} {
+	if displayDevice == nil {
+		return nil
+	}
+
+	return displayDevice.EnableDisplay
+}
+
+func flattenServiceAccounts(serviceAccounts []*compute.ServiceAccount) []map[string]interface{} {
+	result := make([]map[string]interface{}, len(serviceAccounts))
+	for i, serviceAccount := range serviceAccounts {
+		result[i] = map[string]interface{}{
+			"email":  serviceAccount.Email,
+			"scopes": serviceAccount.Scopes,
+		}
+	}
+	return result
+}
+
+func flattenNetworkInterfaces(networkInterfaces []*compute.NetworkInterface) []map[string]interface{} {
+	flattened := make([]map[string]interface{}, len(networkInterfaces))
+	for i, iface := range networkInterfaces {
+		var ac []map[string]interface{}
+		ac, _ = flattenAccessConfigs(iface.AccessConfigs)
+
+		flattened[i] = map[string]interface{}{
+			"network_ip":         iface.NetworkIP,
+			"network":            iface.Network,
+			"subnetwork":         iface.Subnetwork,
+			"access_config":      ac,
+			"alias_ip_range":     flattenAliasIpRange(iface.AliasIpRanges),
+			"nic_type":           iface.NicType,
+			"stack_type":         iface.StackType,
+			"ipv6_access_config": flattenIpv6AccessConfigs(iface.Ipv6AccessConfigs),
+			"queue_count":        iface.QueueCount,
+		}
+		// Instance template interfaces never have names, so they're absent
+		// in the instance template network_interface schema. We want to use the
+		// same flattening code for both resource types, so we avoid trying to
+		// set the name field when it's not set at the GCE end.
+		if iface.Name != "" {
+			flattened[i]["name"] = iface.Name
+		}
+	}
+	return flattened
+}
+
+func flattenIpv6AccessConfigs(ipv6AccessConfigs []*compute.AccessConfig) []map[string]interface{} {
+	flattened := make([]map[string]interface{}, len(ipv6AccessConfigs))
+	for i, ac := range ipv6AccessConfigs {
+		flattened[i] = map[string]interface{}{
+			"network_tier": ac.NetworkTier,
+		}
+		flattened[i]["public_ptr_domain_name"] = ac.PublicPtrDomainName
+		flattened[i]["external_ipv6"] = ac.ExternalIpv6
+	}
+	return flattened
+}
+
+func flattenAccessConfigs(accessConfigs []*compute.AccessConfig) ([]map[string]interface{}, string) {
+	flattened := make([]map[string]interface{}, len(accessConfigs))
+	natIP := ""
+	for i, ac := range accessConfigs {
+		flattened[i] = map[string]interface{}{
+			"nat_ip":       ac.NatIP,
+			"network_tier": ac.NetworkTier,
+		}
+		if ac.SetPublicPtr {
+			flattened[i]["public_ptr_domain_name"] = ac.PublicPtrDomainName
+		}
+		if natIP == "" {
+			natIP = ac.NatIP
+		}
+	}
+	return flattened, natIP
+}
+
+func flattenAliasIpRange(ranges []*compute.AliasIpRange) []map[string]interface{} {
+	rangesSchema := make([]map[string]interface{}, 0, len(ranges))
+	for _, ipRange := range ranges {
+		rangesSchema = append(rangesSchema, map[string]interface{}{
+			"ip_cidr_range":         ipRange.IpCidrRange,
+			"subnetwork_range_name": ipRange.SubnetworkRangeName,
+		})
+	}
+	return rangesSchema
+}
+
+func flattenScratchDisk(disk *compute.AttachedDisk) map[string]interface{} {
+	result := map[string]interface{}{
+		"interface": disk.Interface,
+	}
+	return result
+}
diff --git a/mmv1/third_party/cai2hcl/services/compute/compute_instance_test.go b/mmv1/third_party/cai2hcl/services/compute/compute_instance_test.go
new file mode 100644
index 000000000000..0772913b5277
--- /dev/null
+++ b/mmv1/third_party/cai2hcl/services/compute/compute_instance_test.go
@@ -0,0 +1,18 @@
+package compute
+
+import (
+	"testing"
+
+	cai2hclTesting "github.com/GoogleCloudPlatform/terraform-google-conversion/v2/cai2hcl/testing"
+)
+
+func TestComputeInstance(t *testing.T) {
+	cai2hclTesting.AssertTestFiles(
+		t,
+		ConverterNames, ConverterMap,
+		"./testdata",
+		[]string{
+			"full_compute_instance",
+			"compute_instance_iam",
+		})
+}
diff --git a/mmv1/third_party/cai2hcl/services/compute/converter_map.go b/mmv1/third_party/cai2hcl/services/compute/converter_map.go
new file mode 100644
index 000000000000..4532694d57cd
--- /dev/null
+++ b/mmv1/third_party/cai2hcl/services/compute/converter_map.go
@@ -0,0 +1,15 @@
+package compute
+
+import (
+	"github.com/GoogleCloudPlatform/terraform-google-conversion/v2/cai2hcl/common"
+)
+
+var ConverterNames = map[string]string{
+	ComputeInstanceAssetType:       "google_compute_instance",
+	ComputeForwardingRuleAssetType: "google_compute_forwarding_rule",
+}
+
+var ConverterMap = common.CreateConverterMap(map[string]common.ConverterFactory{
+	"google_compute_instance":        NewComputeInstanceConverter,
+	"google_compute_forwarding_rule": NewComputeForwardingRuleConverter,
+})
diff --git a/mmv1/third_party/cai2hcl/services/compute/testdata/compute_instance_iam.json b/mmv1/third_party/cai2hcl/services/compute/testdata/compute_instance_iam.json
new file mode 100644
index 000000000000..2b958e3f2ba7
--- /dev/null
+++ b/mmv1/third_party/cai2hcl/services/compute/testdata/compute_instance_iam.json
@@ -0,0 +1,17 @@
+[
+  {
+    "name": "//compute.googleapis.com/projects/test-project/zones/example_zone/instances/example_instance",
+    "asset_type": "compute.googleapis.com/Instance",
+    "ancestry_path": "organizations/123/folders/456/project/test-project",
+    "iam_policy": {
+      "bindings": [
+        {
+          "role": "roles/compute.osLogin",
+          "members": [
+            "user:jane@example.com"
+          ]
+        }
+      ]
+    }
+  }
+]
diff --git a/mmv1/third_party/cai2hcl/services/compute/testdata/compute_instance_iam.tf b/mmv1/third_party/cai2hcl/services/compute/testdata/compute_instance_iam.tf
new file mode 100644
index 000000000000..769126f6220a
--- /dev/null
+++ b/mmv1/third_party/cai2hcl/services/compute/testdata/compute_instance_iam.tf
@@ -0,0 +1,6 @@
+resource "google_compute_instance_iam_policy" "example_instance_iam_policy" {
+  instance_name = "example_instance"
+  policy_data   = "{\"bindings\":[{\"role\":\"roles/compute.osLogin\",\"members\":[\"user:jane@example.com\"]}]}"
+  project       = "test-project"
+  zone          = "example_zone"
+}
diff --git a/mmv1/third_party/cai2hcl/services/compute/testdata/full_compute_forwarding_rule.json b/mmv1/third_party/cai2hcl/services/compute/testdata/full_compute_forwarding_rule.json
new file mode 100644
index 000000000000..d86ad6f2d421
--- /dev/null
+++ b/mmv1/third_party/cai2hcl/services/compute/testdata/full_compute_forwarding_rule.json
@@ -0,0 +1,52 @@
+[
+  {
+    "name": "//compute.googleapis.com/projects/myproj/regions/us-central1/forwardingRules/test-1",
+    "asset_type": "compute.googleapis.com/ForwardingRule",
+    "ancestry_path": "organizations/123/folders/456/project/myproj",
+    "resource": {
+      "version": "v1",
+      "discovery_document_uri": "https://www.googleapis.com/discovery/v1/apis/compute/v1/rest",
+      "discovery_name": "ForwardingRule",
+      "parent": "//cloudresourcemanager.googleapis.com/projects/myproj",
+      "data": {
+        "name": "test-1",
+        "IPAddress": "10.128.0.62",
+        "IPProtocol": "TCP",
+        "allowGlobalAccess": false,
+        "loadBalancingScheme": "INTERNAL_MANAGED",
+        "description": "test description",
+        "networkTier": "PREMIUM",
+        "portRange": "80-82",
+        "region": "projects/myproj/regions/us-central1",
+        "subnetwork": "projects/myproj/regions/us-central1/subnetworks/default",
+        "target": "projects/myproj/regions/us-central1/targetHttpProxies/test1-target-proxy",
+        "allPorts": true
+      }
+    }
+  },
+  {
+    "name": "//compute.googleapis.com/projects/myproj/regions/us-central1/instances/test-2",
+    "asset_type": "compute.googleapis.com/ForwardingRule",
+    "ancestry_path": "organizations/123/folders/456/project/myproj",
+    "resource": {
+      "version": "v1",
+      "discovery_document_uri": "https://www.googleapis.com/discovery/v1/apis/compute/v1/rest",
+      "discovery_name": "ForwardingRule",
+      "parent": "//cloudresourcemanager.googleapis.com/projects/myproj",
+      "data": {
+        "name": "test-2",
+        "IPAddress": "projects/myproj/regions/us-central1/addresses/test-ip-1",
+        "IPProtocol": "TCP",
+        "backendService": "projects/myproj/regions/us-central1/backendServices/test-bs-1",
+        "ipVersion": "IPV6",
+        "loadBalancingScheme": "EXTERNAL",
+        "ports": [
+          "80",
+          "81"
+        ],
+        "region": "projects/myproj/regions/us-central1",
+        "all_ports": false
+      }
+    }
+  }
+]
\ No newline at end of file
diff --git a/mmv1/third_party/cai2hcl/services/compute/testdata/full_compute_forwarding_rule.tf b/mmv1/third_party/cai2hcl/services/compute/testdata/full_compute_forwarding_rule.tf
new file mode 100644
index 000000000000..382c32ad9077
--- /dev/null
+++ b/mmv1/third_party/cai2hcl/services/compute/testdata/full_compute_forwarding_rule.tf
@@ -0,0 +1,28 @@
+resource "google_compute_forwarding_rule" "test-1" {
+  all_ports              = true
+  allow_global_access    = false
+  description            = "test description"
+  ip_address             = "10.128.0.62"
+  ip_protocol            = "TCP"
+  is_mirroring_collector = false
+  load_balancing_scheme  = "INTERNAL_MANAGED"
+  name                   = "test-1"
+  network_tier           = "PREMIUM"
+  port_range             = "80-82"
+  region                 = "us-central1"
+  subnetwork             = "projects/myproj/regions/us-central1/subnetworks/default"
+  target                 = "projects/myproj/regions/us-central1/targetHttpProxies/test1-target-proxy"
+}
+
+resource "google_compute_forwarding_rule" "test-2" {
+  all_ports              = false
+  allow_global_access    = false
+  backend_service        = "projects/myproj/regions/us-central1/backendServices/test-bs-1"
+  ip_address             = "projects/myproj/regions/us-central1/addresses/test-ip-1"
+  ip_protocol            = "TCP"
+  is_mirroring_collector = false
+  load_balancing_scheme  = "EXTERNAL"
+  name                   = "test-2"
+  ports                  = ["80", "81"]
+  region                 = "us-central1"
+}
diff --git a/mmv1/third_party/cai2hcl/services/compute/testdata/full_compute_instance.json b/mmv1/third_party/cai2hcl/services/compute/testdata/full_compute_instance.json
new file mode 100644
index 000000000000..22ade1953198
--- /dev/null
+++ b/mmv1/third_party/cai2hcl/services/compute/testdata/full_compute_instance.json
@@ -0,0 +1,180 @@
+[
+  {
+    "name": "//compute.googleapis.com/projects/test-project/zones/us-central1-a/instances/test1",
+    "asset_type": "compute.googleapis.com/Instance",
+    "ancestry_path": "organizations/123/folders/456/project/test-project",
+    "resource": {
+      "version": "v1",
+      "discovery_document_uri": "https://www.googleapis.com/discovery/v1/apis/compute/v1/rest",
+      "discovery_name": "Instance",
+      "parent": "//cloudresourcemanager.googleapis.com/projects/test-project",
+      "data": {
+        "canIpForward": true,
+        "shieldedInstanceConfig": {
+          "enableIntegrityMonitoring": true,
+          "enableSecureBoot": true,
+          "enableVtpm": true
+        },
+        "deletionProtection": true,
+        "description": "test-description",
+        "disks": [
+          {
+            "autoDelete": true,
+            "boot": true,
+            "deviceName": "test-device_name",
+            "diskEncryptionKey": {
+              "rawKey": "test-disk_encryption_key_raw"
+            },
+            "initializeParams": {
+              "diskSizeGb": "42",
+              "diskType": "projects/test-project/zones/us-central1-a/diskTypes/pd-standard",
+              "sourceImage": "projects/debian-cloud/global/images/debian-9"
+            },
+            "mode": "READ_WRITE",
+            "source": "projects/test-project/zones/us-central1-a/disks/test-source"
+          },
+          {
+            "autoDelete": true,
+            "initializeParams": {
+              "diskType": "projects/test-project/zones/us-central1-a/diskTypes/local-ssd"
+            },
+            "interface": "SCSI",
+            "type": "SCRATCH"
+          },
+          {
+            "autoDelete": true,
+            "initializeParams": {
+              "diskType": "projects/test-project/zones/us-central1-a/diskTypes/local-ssd"
+            },
+            "interface": "SCSI",
+            "type": "SCRATCH"
+          },
+          {
+            "deviceName": "test-device_name",
+            "diskEncryptionKey": {
+              "kmsKeyName": "test-kms_key_self_link"
+            },
+            "mode": "READ_ONLY",
+            "source": "projects/test-project/zones/us-central1-a/disks/test-source"
+          },
+          {
+            "mode": "READ_WRITE",
+            "source": "projects/test-project/zones/us-central1-a/disks/test-source2"
+          }
+        ],
+        "guestAccelerators": [
+          {
+            "acceleratorCount": 42,
+            "acceleratorType": "projects/test-project/zones/us-central1-a/acceleratorTypes/test-guest_accelerator-type1"
+          },
+          {
+            "acceleratorCount": 42,
+            "acceleratorType": "projects/test-project/zones/us-central1-a/acceleratorTypes/test-guest_accelerator-type2"
+          }
+        ],
+        "hostname": "test-hostname",
+        "labels": {
+          "label_foo1": "label-bar1"
+        },
+        "machineType": "projects/test-project/zones/us-central1-a/machineTypes/n1-standard-1",
+        "metadata": {
+          "items": [
+            {
+              "key": "metadata_foo1",
+              "value": "metadata-bar1"
+            }
+          ]
+        },
+        "minCpuPlatform": "test-min_cpu_platform",
+        "name": "test1",
+        "networkInterfaces": [
+          {
+            "accessConfigs": [
+              {
+                "natIP": "192.168.0.42",
+                "type": "ONE_TO_ONE_NAT"
+              },
+              {
+                "networkTier": "STANDARD",
+                "type": "ONE_TO_ONE_NAT"
+              },
+              {
+                "publicPtrDomainName": "test-public_ptr_domain_name",
+                "setPublicPtr": true,
+                "type": "ONE_TO_ONE_NAT"
+              }
+            ],
+            "aliasIpRanges": [
+              {
+                "ipCidrRange": "test-ip_cidr_range",
+                "subnetworkRangeName": "test-subnetwork_range_name"
+              }
+            ],
+            "network": "projects/test-project/global/networks/default",
+            "networkIP": "test-network_ip"
+          },
+          {
+            "subnetwork": "projects/test-subnetwork_project/regions/us-central1/subnetworks/test-subnetwork"
+          }
+        ],
+        "scheduling": {
+          "automaticRestart": true,
+          "onHostMaintenance": "test-on_host_maintenance",
+          "preemptible": true
+        },
+        "serviceAccounts": [
+          {
+            "email": "test-email",
+            "scopes": [
+              "https://www.googleapis.com/auth/cloud-platform"
+            ]
+          }
+        ],
+        "tags": {
+          "items": [
+            "bar",
+            "foo"
+          ]
+        },
+        "zone": "projects/test-project/zones/us-central1-a"
+      }
+    }
+  },
+  {
+    "name": "//compute.googleapis.com/projects/test-project/zones/us-central1-a/instances/test2",
+    "asset_type": "compute.googleapis.com/Instance",
+    "ancestry_path": "organizations/123/folders/456/project/test-project",
+    "resource": {
+      "version": "v1",
+      "discovery_document_uri": "https://www.googleapis.com/discovery/v1/apis/compute/v1/rest",
+      "discovery_name": "Instance",
+      "parent": "//cloudresourcemanager.googleapis.com/projects/test-project",
+      "data": {
+        "canIpForward": false,
+        "deletionProtection": false,
+        "disks": [
+          {
+            "autoDelete": true,
+            "boot": true,
+            "diskEncryptionKey": {
+              "kmsKeyName": "test-kms_key_self_link"
+            },
+            "mode": "READ_WRITE"
+          }
+        ],
+        "machineType": "projects/test-project/zones/us-central1-a/machineTypes/n1-standard-1",
+        "metadata": {},
+        "name": "test2",
+        "networkInterfaces": [
+          {
+            "network": "projects/test-project/global/networks/default"
+          }
+        ],
+        "scheduling": {
+          "automaticRestart": true
+        },
+        "tags": {}
+      }
+    }
+  }
+]
diff --git a/mmv1/third_party/cai2hcl/services/compute/testdata/full_compute_instance.tf b/mmv1/third_party/cai2hcl/services/compute/testdata/full_compute_instance.tf
new file mode 100644
index 000000000000..6db2fc8da4bf
--- /dev/null
+++ b/mmv1/third_party/cai2hcl/services/compute/testdata/full_compute_instance.tf
@@ -0,0 +1,138 @@
+resource "google_compute_instance" "test1" {
+  attached_disk {
+    device_name       = "test-device_name"
+    kms_key_self_link = "test-kms_key_self_link"
+    mode              = "READ_ONLY"
+    source            = "projects/test-project/zones/us-central1-a/disks/test-source"
+  }
+
+  attached_disk {
+    mode   = "READ_WRITE"
+    source = "projects/test-project/zones/us-central1-a/disks/test-source2"
+  }
+
+  boot_disk {
+    auto_delete             = true
+    device_name             = "test-device_name"
+    disk_encryption_key_raw = "test-disk_encryption_key_raw"
+
+    initialize_params {
+      image = "projects/debian-cloud/global/images/debian-9"
+      size  = 42
+      type  = "pd-standard"
+    }
+
+    mode   = "READ_WRITE"
+    source = "projects/test-project/zones/us-central1-a/disks/test-source"
+  }
+
+  can_ip_forward      = true
+  deletion_protection = true
+  description         = "test-description"
+
+  guest_accelerator {
+    count = 42
+    type  = "projects/test-project/zones/us-central1-a/acceleratorTypes/test-guest_accelerator-type1"
+  }
+
+  guest_accelerator {
+    count = 42
+    type  = "projects/test-project/zones/us-central1-a/acceleratorTypes/test-guest_accelerator-type2"
+  }
+
+  hostname = "test-hostname"
+
+  labels = {
+    label_foo1 = "label-bar1"
+  }
+
+  machine_type = "n1-standard-1"
+
+  metadata = {
+    metadata_foo1 = "metadata-bar1"
+  }
+
+  min_cpu_platform = "test-min_cpu_platform"
+  name             = "test1"
+
+  network_interface {
+    access_config {
+      nat_ip = "192.168.0.42"
+    }
+
+    access_config {
+      network_tier = "STANDARD"
+    }
+
+    access_config {
+      public_ptr_domain_name = "test-public_ptr_domain_name"
+    }
+
+    alias_ip_range {
+      ip_cidr_range         = "test-ip_cidr_range"
+      subnetwork_range_name = "test-subnetwork_range_name"
+    }
+
+    network     = "projects/test-project/global/networks/default"
+    network_ip  = "test-network_ip"
+    queue_count = 0
+  }
+
+  network_interface {
+    queue_count = 0
+    subnetwork  = "projects/test-subnetwork_project/regions/us-central1/subnetworks/test-subnetwork"
+  }
+
+  scheduling {
+    automatic_restart   = true
+    on_host_maintenance = "test-on_host_maintenance"
+    preemptible         = true
+  }
+
+  scratch_disk {
+    interface = "SCSI"
+  }
+
+  scratch_disk {
+    interface = "SCSI"
+  }
+
+  service_account {
+    email  = "test-email"
+    scopes = ["https://www.googleapis.com/auth/cloud-platform"]
+  }
+
+  shielded_instance_config {
+    enable_integrity_monitoring = true
+    enable_secure_boot          = true
+    enable_vtpm                 = true
+  }
+
+  tags = ["bar", "foo"]
+  zone = "us-central1-a"
+}
+
+resource "google_compute_instance" "test2" {
+  boot_disk {
+    auto_delete       = true
+    kms_key_self_link = "test-kms_key_self_link"
+    mode              = "READ_WRITE"
+  }
+
+  can_ip_forward      = false
+  deletion_protection = false
+  machine_type        = "n1-standard-1"
+  name                = "test2"
+
+  network_interface {
+    network     = "projects/test-project/global/networks/default"
+    queue_count = 0
+  }
+
+  scheduling {
+    automatic_restart = true
+    preemptible       = false
+  }
+
+  zone = "us-central1-a"
+}
diff --git a/mmv1/third_party/cai2hcl/services/resourcemanager/converter_map.go b/mmv1/third_party/cai2hcl/services/resourcemanager/converter_map.go
new file mode 100644
index 000000000000..9c5e2a0db0b2
--- /dev/null
+++ b/mmv1/third_party/cai2hcl/services/resourcemanager/converter_map.go
@@ -0,0 +1,14 @@
+package resourcemanager
+
+import (
+	"github.com/GoogleCloudPlatform/terraform-google-conversion/v2/cai2hcl/common"
+)
+
+var ConverterNames = map[string]string{
+	ProjectAssetType:        "google_project",
+	ProjectBillingAssetType: "google_project",
+}
+
+var ConverterMap = common.CreateConverterMap(map[string]common.ConverterFactory{
+	"google_project": NewProjectConverter,
+})
diff --git a/mmv1/third_party/cai2hcl/services/resourcemanager/project.go b/mmv1/third_party/cai2hcl/services/resourcemanager/project.go
new file mode 100644
index 000000000000..01b3431d8a62
--- /dev/null
+++ b/mmv1/third_party/cai2hcl/services/resourcemanager/project.go
@@ -0,0 +1,139 @@
+package resourcemanager
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	"github.com/GoogleCloudPlatform/terraform-google-conversion/v2/cai2hcl/common"
+	"github.com/GoogleCloudPlatform/terraform-google-conversion/v2/caiasset"
+
+	tfschema "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/zclconf/go-cty/cty"
+	"google.golang.org/api/cloudresourcemanager/v1"
+)
+
+// ProjectAssetType is the CAI asset type name for project.
+const ProjectAssetType string = "cloudresourcemanager.googleapis.com/Project"
+
+// ProjectAssetType is the CAI asset type name for project.
+const ProjectBillingAssetType string = "cloudbilling.googleapis.com/ProjectBillingInfo"
+
+// ProjectConverter for compute project resource.
+type ProjectConverter struct {
+	name     string
+	schema   map[string]*tfschema.Schema
+	billings map[string]string
+}
+
+// NewProjectConverter returns an HCL converter for compute project.
+func NewProjectConverter(name string, schema map[string]*tfschema.Schema) common.Converter {
+	return &ProjectConverter{
+		name:     name,
+		schema:   schema,
+		billings: make(map[string]string),
+	}
+}
+
+// Convert converts asset resource data.
+func (c *ProjectConverter) Convert(assets []*caiasset.Asset) ([]*common.HCLResourceBlock, error) {
+	// process billing info
+	for _, asset := range assets {
+		if asset == nil {
+			continue
+		}
+		if asset.Type == "cloudbilling.googleapis.com/ProjectBillingInfo" {
+			project := common.ParseFieldValue(asset.Name, "projects")
+			projectAssetName := fmt.Sprintf("//cloudresourcemanager.googleapis.com/projects/%s", project)
+			c.billings[projectAssetName] = c.convertBilling(asset)
+		}
+	}
+
+	var blocks []*common.HCLResourceBlock
+	for _, asset := range assets {
+		if asset == nil {
+			continue
+		}
+		if asset.Type == "cloudbilling.googleapis.com/ProjectBillingInfo" {
+			continue
+		}
+		if asset.IAMPolicy != nil {
+			iamBlock, err := c.convertIAM(asset)
+			if err != nil {
+				return nil, err
+			}
+			blocks = append(blocks, iamBlock)
+		}
+		if asset.Resource != nil && asset.Resource.Data != nil {
+			block, err := c.convertResourceData(asset)
+			if err != nil {
+				return nil, err
+			}
+			blocks = append(blocks, block)
+		}
+	}
+	return blocks, nil
+}
+
+func (c *ProjectConverter) convertIAM(asset *caiasset.Asset) (*common.HCLResourceBlock, error) {
+	if asset.IAMPolicy == nil {
+		return nil, fmt.Errorf("asset IAM policy is nil")
+	}
+
+	project := common.ParseFieldValue(asset.Name, "projects")
+	policyData, err := json.Marshal(asset.IAMPolicy)
+	if err != nil {
+		return nil, err
+	}
+
+	return &common.HCLResourceBlock{
+		Labels: []string{
+			c.name + "_iam_policy",
+			project + "_iam_policy",
+		},
+		Value: cty.ObjectVal(map[string]cty.Value{
+			"project":     cty.StringVal(project),
+			"policy_data": cty.StringVal(string(policyData)),
+		}),
+	}, nil
+}
+
+func (c *ProjectConverter) convertBilling(asset *caiasset.Asset) string {
+	if asset != nil && asset.Resource != nil && asset.Resource.Data != nil {
+		return strings.TrimPrefix(asset.Resource.Data["billingAccountName"].(string), "billingAccounts/")
+	}
+	return ""
+}
+
+func (c *ProjectConverter) convertResourceData(asset *caiasset.Asset) (*common.HCLResourceBlock, error) {
+	if asset == nil || asset.Resource == nil || asset.Resource.Data == nil {
+		return nil, fmt.Errorf("asset resource data is nil")
+	}
+	var project *cloudresourcemanager.Project
+	if err := common.DecodeJSON(asset.Resource.Data, &project); err != nil {
+		return nil, err
+	}
+
+	hclData := make(map[string]interface{})
+	hclData["name"] = project.Name
+	hclData["project_id"] = project.ProjectId
+	hclData["labels"] = project.Labels
+	if strings.Contains(asset.Resource.Parent, "folders/") {
+		hclData["folder_id"] = common.ParseFieldValue(asset.Resource.Parent, "folders")
+	} else if strings.Contains(asset.Resource.Parent, "organizations/") {
+		hclData["org_id"] = common.ParseFieldValue(asset.Resource.Parent, "organizations")
+	}
+
+	if billingAccount, ok := c.billings[asset.Name]; ok {
+		hclData["billing_account"] = billingAccount
+	}
+
+	ctyVal, err := common.MapToCtyValWithSchema(hclData, c.schema)
+	if err != nil {
+		return nil, err
+	}
+	return &common.HCLResourceBlock{
+		Labels: []string{c.name, project.ProjectId},
+		Value:  ctyVal,
+	}, nil
+}
diff --git a/mmv1/third_party/cai2hcl/services/resourcemanager/project_test.go b/mmv1/third_party/cai2hcl/services/resourcemanager/project_test.go
new file mode 100644
index 000000000000..d29d4a71abcb
--- /dev/null
+++ b/mmv1/third_party/cai2hcl/services/resourcemanager/project_test.go
@@ -0,0 +1,18 @@
+package resourcemanager
+
+import (
+	"testing"
+
+	cai2hclTesting "github.com/GoogleCloudPlatform/terraform-google-conversion/v2/cai2hcl/testing"
+)
+
+func TestComputeInstance(t *testing.T) {
+	cai2hclTesting.AssertTestFiles(
+		t,
+		ConverterNames, ConverterMap,
+		"./testdata",
+		[]string{
+			"project_create",
+			"project_iam",
+		})
+}
diff --git a/mmv1/third_party/cai2hcl/services/resourcemanager/testdata/project_create.json b/mmv1/third_party/cai2hcl/services/resourcemanager/testdata/project_create.json
new file mode 100644
index 000000000000..a2c0af039b4d
--- /dev/null
+++ b/mmv1/third_party/cai2hcl/services/resourcemanager/testdata/project_create.json
@@ -0,0 +1,36 @@
+[
+  {
+    "name": "//cloudbilling.googleapis.com/projects/example-project/billingInfo",
+    "asset_type": "cloudbilling.googleapis.com/ProjectBillingInfo",
+    "ancestry_path": "organizations/123/folders/456/project/example-project",
+    "resource": {
+      "version": "v1",
+      "discovery_document_uri": "https://www.googleapis.com/discovery/v1/apis/cloudbilling/v1/rest",
+      "discovery_name": "ProjectBillingInfo",
+      "parent": "//cloudresourcemanager.googleapis.com/projects/example-project",
+      "data": {
+        "billingAccountName": "billingAccounts/example-account",
+        "name": "projects/example-project/billingInfo",
+        "projectId": "example-project"
+      }
+    }
+  },
+  {
+    "name": "//cloudresourcemanager.googleapis.com/projects/example-project",
+    "asset_type": "cloudresourcemanager.googleapis.com/Project",
+    "ancestry_path": "organizations/123/folders/456/project/example-project",
+    "resource": {
+      "version": "v1",
+      "discovery_document_uri": "https://www.googleapis.com/discovery/v1/apis/compute/v1/rest",
+      "discovery_name": "Project",
+      "parent": "//cloudresourcemanager.googleapis.com/folders/456",
+      "data": {
+        "name": "My Project",
+        "labels": {
+          "project-label-key-a": "project-label-val-a"
+        },
+        "projectId": "example-project"
+      }
+    }
+  }
+]
diff --git a/mmv1/third_party/cai2hcl/services/resourcemanager/testdata/project_create.tf b/mmv1/third_party/cai2hcl/services/resourcemanager/testdata/project_create.tf
new file mode 100644
index 000000000000..822a86613e97
--- /dev/null
+++ b/mmv1/third_party/cai2hcl/services/resourcemanager/testdata/project_create.tf
@@ -0,0 +1,11 @@
+resource "google_project" "example-project" {
+  billing_account = "example-account"
+  folder_id       = "456"
+
+  labels = {
+    project-label-key-a = "project-label-val-a"
+  }
+
+  name       = "My Project"
+  project_id = "example-project"
+}
diff --git a/mmv1/third_party/cai2hcl/services/resourcemanager/testdata/project_iam.json b/mmv1/third_party/cai2hcl/services/resourcemanager/testdata/project_iam.json
new file mode 100644
index 000000000000..2bd24af69ede
--- /dev/null
+++ b/mmv1/third_party/cai2hcl/services/resourcemanager/testdata/project_iam.json
@@ -0,0 +1,38 @@
+[
+  {
+    "name": "//cloudresourcemanager.googleapis.com/projects/example-project",
+    "asset_type": "cloudresourcemanager.googleapis.com/Project",
+    "ancestry_path": "organizations/123/folders/456/project/example-project",
+    "iam_policy": {
+      "bindings": [
+        {
+          "role": "roles/editor",
+          "members": [
+            "user:example-a@google.com",
+            "user:example-b@google.com"
+          ]
+        },
+        {
+          "role": "roles/storage.admin",
+          "members": [
+            "user:example-a@google.com",
+            "user:example-b@google.com"
+          ]
+        },
+        {
+          "role": "roles/owner",
+          "members": [
+            "user:example-a@google.com"
+          ]
+        },
+        {
+          "role": "roles/viewer",
+          "members": [
+            "user:example-a@google.com",
+            "user:example-b@google.com"
+          ]
+        }
+      ]
+    }
+  }
+]
diff --git a/mmv1/third_party/cai2hcl/services/resourcemanager/testdata/project_iam.tf b/mmv1/third_party/cai2hcl/services/resourcemanager/testdata/project_iam.tf
new file mode 100644
index 000000000000..4fb6d9d28b4a
--- /dev/null
+++ b/mmv1/third_party/cai2hcl/services/resourcemanager/testdata/project_iam.tf
@@ -0,0 +1,4 @@
+resource "google_project_iam_policy" "example-project_iam_policy" {
+  policy_data = "{\"bindings\":[{\"role\":\"roles/editor\",\"members\":[\"user:example-a@google.com\",\"user:example-b@google.com\"]},{\"role\":\"roles/storage.admin\",\"members\":[\"user:example-a@google.com\",\"user:example-b@google.com\"]},{\"role\":\"roles/owner\",\"members\":[\"user:example-a@google.com\"]},{\"role\":\"roles/viewer\",\"members\":[\"user:example-a@google.com\",\"user:example-b@google.com\"]}]}"
+  project     = "example-project"
+}
diff --git a/mmv1/third_party/cai2hcl/testing/assert_test_files.go b/mmv1/third_party/cai2hcl/testing/assert_test_files.go
new file mode 100644
index 000000000000..e7393402d266
--- /dev/null
+++ b/mmv1/third_party/cai2hcl/testing/assert_test_files.go
@@ -0,0 +1,79 @@
+package testing
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/GoogleCloudPlatform/terraform-google-conversion/v2/cai2hcl/common"
+	"github.com/GoogleCloudPlatform/terraform-google-conversion/v2/caiasset"
+	"go.uber.org/zap"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+type _TestCase struct {
+	name         string
+	sourceFolder string
+}
+
+func AssertTestFiles(t *testing.T, converterNames map[string]string, converterMap map[string]common.Converter, folder string, fileNames []string) {
+	cases := []_TestCase{}
+
+	for _, name := range fileNames {
+		cases = append(cases, _TestCase{name: name, sourceFolder: folder})
+	}
+
+	for i := range cases {
+		c := cases[i]
+
+		t.Run(c.name, func(t *testing.T) {
+			t.Parallel()
+
+			err := assertTestData(c, converterNames, converterMap)
+			if err != nil {
+				t.Fatal(err)
+			}
+		})
+	}
+}
+
+func assertTestData(testCase _TestCase, converterNames map[string]string, converterMap map[string]common.Converter) (err error) {
+	fileName := testCase.name
+	folder := testCase.sourceFolder
+
+	assetFilePath := fmt.Sprintf("%s/%s.json", folder, fileName)
+	expectedTfFilePath := fmt.Sprintf("%s/%s.tf", folder, fileName)
+	assetPayload, err := os.ReadFile(assetFilePath)
+	if err != nil {
+		return fmt.Errorf("cannot open %s, got: %s", assetFilePath, err)
+	}
+	want, err := os.ReadFile(expectedTfFilePath)
+	if err != nil {
+		return fmt.Errorf("cannot open %s, got: %s", expectedTfFilePath, err)
+	}
+
+	var assets []*caiasset.Asset
+	if err := json.Unmarshal(assetPayload, &assets); err != nil {
+		return fmt.Errorf("cannot unmarshal: %s", err)
+	}
+
+	logger, err := zap.NewDevelopment()
+	if err != nil {
+		return err
+	}
+
+	got, err := common.Convert(assets, converterNames, converterMap)
+	if err != nil {
+		return err
+	}
+
+	if diff := cmp.Diff(string(want), string(got)); diff != "" {
+		logger.Debug(fmt.Sprintf("Expected %s to be:\n%s\nBut was:\n%s", expectedTfFilePath, string(want), string(got)))
+
+		return fmt.Errorf("cmp.Diff() got diff (-want +got): %s", diff)
+	}
+
+	return nil
+}
diff --git a/mmv1/third_party/terraform/.copywrite.hcl.erb b/mmv1/third_party/terraform/.copywrite.hcl.erb
index 5c26cb7b03cf..60920fe6f523 100644
--- a/mmv1/third_party/terraform/.copywrite.hcl.erb
+++ b/mmv1/third_party/terraform/.copywrite.hcl.erb
@@ -22,6 +22,7 @@ project {
     "google-<%= version -%>/**/test-fixtures/**",
 <% end -%>
     "META.d/*.yml",
+    "META.d/*.yaml",
     ".golangci.yml",
     ".goreleaser.yml",
   ]
diff --git a/mmv1/third_party/terraform/.teamcity/components/generated/build_components.erb b/mmv1/third_party/terraform/.teamcity/components/generated/build_components.erb
index 83e6570fe690..36363fbd5a8a 100644
--- a/mmv1/third_party/terraform/.teamcity/components/generated/build_components.erb
+++ b/mmv1/third_party/terraform/.teamcity/components/generated/build_components.erb
@@ -117,14 +117,40 @@ fun BuildSteps.RunAcceptanceTests() {
     } else {
         step(ScriptBuildStep {
             name = "Compile Test Binary"
-            scriptContent = "go test -c -o test-binary"
             workingDir = "%PACKAGE_PATH%"
+            scriptContent = """
+                #!/bin/bash
+                export TEST_FILE_COUNT=$(ls ./*_test.go | wc -l)
+                if test ${'$'}TEST_FILE_COUNT -gt "0"; then
+                    echo "Compiling test binary"
+                    go test -c -o test-binary
+                else
+                    echo "Skipping compilation of test binary; no Go test files found"
+                fi
+            """.trimIndent()
+
         })
 
         step(ScriptBuildStep {
             name = "Run via jen20/teamcity-go-test"
-            scriptContent = "./test-binary -test.list=\"%TEST_PREFIX%\" | teamcity-go-test -test ./test-binary -parallelism \"%PARALLELISM%\" -timeout \"%TIMEOUT%h\""
             workingDir = "%PACKAGE_PATH%"
+            scriptContent = """
+                #!/bin/bash
+                if ! test -f "./test-binary"; then
+                  echo "Skipping test execution; file ./test-binary does not exist."
+                  exit 0
+                fi
+                
+                export TEST_COUNT=${'$'}(./test-binary -test.list=%TEST_PREFIX% | wc -l)
+                echo "Found ${'$'}{TEST_COUNT} tests that match the given test prefix %TEST_PREFIX%"
+                if test ${'$'}TEST_COUNT -le "0"; then
+                  echo "Skipping test execution; no tests to run"
+                  exit 0
+                fi
+                
+                echo "Starting tests"  
+                ./test-binary -test.list="%TEST_PREFIX%" | teamcity-go-test -test ./test-binary -parallelism "%PARALLELISM%" -timeout "%TIMEOUT%h"
+            """.trimIndent()
         })
     }
 }
diff --git a/mmv1/third_party/terraform/.teamcity/components/generated/project.erb b/mmv1/third_party/terraform/.teamcity/components/generated/project.erb
index 6896cb8f7ad3..8453e7ad3879 100644
--- a/mmv1/third_party/terraform/.teamcity/components/generated/project.erb
+++ b/mmv1/third_party/terraform/.teamcity/components/generated/project.erb
@@ -114,15 +114,4 @@ class NightlyTriggerConfiguration(environment: String, branchRef: String, nightl
     var daysOfWeek = daysOfWeek
     var daysOfMonth = daysOfMonth
 
-    init {
-        // If the environment parameter is set to the value of MAJOR_RELEASE_TESTING, 
-        // change the days of week to the day for v5.0.0 feature branch testing
-        if (environment == MAJOR_RELEASE_TESTING) {
-<% if version == 'ga' -%>
-            this.daysOfWeek = "5" // Thursday for GA, TeamCity numbers days Sun=1...Sat=7
-<% elsif version == 'beta' -%>
-            this.daysOfWeek = "6" // Friday for Beta, TeamCity numbers days Sun=1...Sat=7
-<% end -%>
-        }
-    }
 }
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/.teamcity/components/generated/settings.erb b/mmv1/third_party/terraform/.teamcity/components/generated/settings.erb
index e9bcb012de14..a77fa4c5f2f0 100644
--- a/mmv1/third_party/terraform/.teamcity/components/generated/settings.erb
+++ b/mmv1/third_party/terraform/.teamcity/components/generated/settings.erb
@@ -16,11 +16,7 @@ var defaultParallelism = 6
 var defaultTerraformCoreVersion = "1.2.5"
 
 // This represents a cron view of days of the week
-<% if version == 'ga' -%>
-const val defaultDaysOfWeek = "1-4,6-7" // All nights except Thursday (5) for GA; feature branch testing happens on Thursdays and TeamCity numbers days Sun=1...Sat=7
-<% elsif version == 'beta' -%>
-const val defaultDaysOfWeek = "1-5,7" // All nights except Friday (6) for Beta; feature branch testing happens on Fridays and TeamCity numbers days Sun=1...Sat=7
-<% end -%>
+const val defaultDaysOfWeek = "*"
 
 // Cron value for any day of month
 const val defaultDaysOfMonth = "*"
diff --git a/mmv1/third_party/terraform/META.d/_summary.yaml b/mmv1/third_party/terraform/META.d/_summary.yaml
new file mode 100644
index 000000000000..c3dc9c1febb3
--- /dev/null
+++ b/mmv1/third_party/terraform/META.d/_summary.yaml
@@ -0,0 +1,12 @@
+---
+
+schema: 1.1
+
+partition: tf-ecosystem
+
+summary:
+  owner: team-tf-hybrid-cloud
+  description: |
+    The Terraform Google provider is a plugin that allows Terraform to manage resources on Google Cloud Platform.  
+  
+  visibility: external
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/META.d/links.yaml b/mmv1/third_party/terraform/META.d/links.yaml
new file mode 100644
index 000000000000..b15cd0fc2485
--- /dev/null
+++ b/mmv1/third_party/terraform/META.d/links.yaml
@@ -0,0 +1,7 @@
+runbooks: []
+#- name: <Link name>
+#  link: <Link URL>
+
+other_links: []
+#- name: <Link name>
+#  link: <Link URL>
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/acctest/bootstrap_test_utils.go b/mmv1/third_party/terraform/acctest/bootstrap_test_utils.go
index 9f14e6d713c8..213db73ecbd3 100644
--- a/mmv1/third_party/terraform/acctest/bootstrap_test_utils.go
+++ b/mmv1/third_party/terraform/acctest/bootstrap_test_utils.go
@@ -13,6 +13,7 @@ import (
 	tpgcompute "github.com/hashicorp/terraform-provider-google/google/services/compute"
 	"github.com/hashicorp/terraform-provider-google/google/services/privateca"
 	"github.com/hashicorp/terraform-provider-google/google/services/resourcemanager"
+	tpgservicenetworking "github.com/hashicorp/terraform-provider-google/google/services/servicenetworking"
 	"github.com/hashicorp/terraform-provider-google/google/services/sql"
 	"github.com/hashicorp/terraform-provider-google/google/tpgiamresource"
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
@@ -23,6 +24,7 @@ import (
 	cloudresourcemanager "google.golang.org/api/cloudresourcemanager/v1"
 	iam "google.golang.org/api/iam/v1"
 	"google.golang.org/api/iamcredentials/v1"
+	"google.golang.org/api/servicenetworking/v1"
 	"google.golang.org/api/serviceusage/v1"
 	sqladmin "google.golang.org/api/sqladmin/v1beta4"
 )
@@ -291,6 +293,7 @@ const SharedTestNetworkPrefix = "tf-bootstrap-net-"
 // BootstrapSharedTestNetwork will return a persistent compute network for a
 // test or set of tests.
 //
+// Usage 1
 // Resources like service_networking_connection use a consumer network and
 // create a complementing tenant network which we don't control. These tenant
 // networks never get cleaned up and they can accumulate to the point where a
@@ -298,6 +301,10 @@ const SharedTestNetworkPrefix = "tf-bootstrap-net-"
 // test runs, we can reduce the number of tenant networks that are needed.
 // See b/146351146 for more context.
 //
+// Usage 2
+// Bootstrap networks used in tests (gke clusters, dataproc clusters...)
+// to avoid traffic to the default network
+//
 // testId specifies the test for which a shared network is used/initialized.
 // Note that if the network is being used for a service_networking_connection,
 // the same testId should generally not be used across tests, to avoid race
@@ -354,6 +361,171 @@ func BootstrapSharedTestNetwork(t *testing.T, testId string) string {
 	return network.Name
 }
 
+type AddressSettings struct {
+	PrefixLength int
+}
+
+func AddressWithPrefixLength(prefixLength int) func(*AddressSettings) {
+	return func(settings *AddressSettings) {
+		settings.PrefixLength = prefixLength
+	}
+}
+
+func NewAddressSettings(options ...func(*AddressSettings)) *AddressSettings {
+	settings := &AddressSettings{
+		PrefixLength: 16, // default prefix length
+	}
+
+	for _, o := range options {
+		o(settings)
+	}
+	return settings
+}
+
+const SharedTestGlobalAddressPrefix = "tf-bootstrap-addr-"
+
+// params are the functions to set compute global address
+func BootstrapSharedTestGlobalAddress(t *testing.T, testId string, params ...func(*AddressSettings)) string {
+	project := envvar.GetTestProjectFromEnv()
+	projectNumber := envvar.GetTestProjectNumberFromEnv()
+	addressName := SharedTestGlobalAddressPrefix + testId
+	networkName := BootstrapSharedTestNetwork(t, testId)
+	networkId := fmt.Sprintf("projects/%v/global/networks/%v", projectNumber, networkName)
+
+	config := BootstrapConfig(t)
+	if config == nil {
+		return ""
+	}
+
+	log.Printf("[DEBUG] Getting shared test global address %q", addressName)
+	_, err := config.NewComputeClient(config.UserAgent).GlobalAddresses.Get(project, addressName).Do()
+	if err != nil && transport_tpg.IsGoogleApiErrorWithCode(err, 404) {
+		log.Printf("[DEBUG] Global address %q not found, bootstrapping", addressName)
+		url := fmt.Sprintf("%sprojects/%s/global/addresses", config.ComputeBasePath, project)
+
+		settings := NewAddressSettings(params...)
+
+		netObj := map[string]interface{}{
+			"name":          addressName,
+			"address_type":  "INTERNAL",
+			"purpose":       "VPC_PEERING",
+			"prefix_length": settings.PrefixLength,
+			"network":       networkId,
+		}
+
+		res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+			Config:    config,
+			Method:    "POST",
+			Project:   project,
+			RawURL:    url,
+			UserAgent: config.UserAgent,
+			Body:      netObj,
+			Timeout:   4 * time.Minute,
+		})
+		if err != nil {
+			t.Fatalf("Error bootstrapping shared test global address %q: %s", addressName, err)
+		}
+
+		log.Printf("[DEBUG] Waiting for global address creation to finish")
+		err = tpgcompute.ComputeOperationWaitTime(config, res, project, "Error bootstrapping shared test global address", config.UserAgent, 4*time.Minute)
+		if err != nil {
+			t.Fatalf("Error bootstrapping shared test global address %q: %s", addressName, err)
+		}
+	}
+
+	address, err := config.NewComputeClient(config.UserAgent).GlobalAddresses.Get(project, addressName).Do()
+	if err != nil {
+		t.Errorf("Error getting shared test global address %q: %s", addressName, err)
+	}
+	if address == nil {
+		t.Fatalf("Error getting shared test global address %q: is nil", addressName)
+	}
+	return address.Name
+}
+
+// BootstrapSharedServiceNetworkingConnection will create a shared network
+// if it hasn't been created in the test project, a global address
+// if it hasn't been created in the test project, and a service networking connection
+// if it hasn't been created in the test project.
+//
+// params are the functions to set compute global address
+//
+// BootstrapSharedServiceNetworkingConnection returns a persistent compute network name
+// for a test or set of tests.
+//
+// To delete a service networking conneciton, all of the service instances that use that connection
+// must be deleted first. After the service instances are deleted, some service producers delay the deletion
+// utnil a waiting period has passed. For example, after four days that you delete a SQL instance,
+// the service networking connection can be deleted.
+// That is the reason to use the shared service networking connection for thest resources.
+// https://cloud.google.com/vpc/docs/configure-private-services-access#removing-connection
+//
+// testId specifies the test for which a shared network and a gobal address are used/initialized.
+func BootstrapSharedServiceNetworkingConnection(t *testing.T, testId string, params ...func(*AddressSettings)) string {
+	parentService := "services/servicenetworking.googleapis.com"
+	projectId := envvar.GetTestProjectFromEnv()
+
+	config := BootstrapConfig(t)
+	if config == nil {
+		return ""
+	}
+
+	// Get project number by calling the API
+	crmClient := config.NewResourceManagerClient(config.UserAgent)
+	project, err := crmClient.Projects.Get(projectId).Do()
+	if err != nil {
+		t.Fatalf("Error getting project: %s", err)
+	}
+
+	networkName := SharedTestNetworkPrefix + testId
+	networkId := fmt.Sprintf("projects/%v/global/networks/%v", project.ProjectNumber, networkName)
+	globalAddressName := BootstrapSharedTestGlobalAddress(t, testId, params...)
+
+	readCall := config.NewServiceNetworkingClient(config.UserAgent).Services.Connections.List(parentService).Network(networkId)
+	if config.UserProjectOverride {
+		readCall.Header().Add("X-Goog-User-Project", projectId)
+	}
+	response, err := readCall.Do()
+	if err != nil {
+		t.Errorf("Error getting shared test service networking connection: %s", err)
+	}
+
+	var connection *servicenetworking.Connection
+	for _, c := range response.Connections {
+		if c.Network == networkId {
+			connection = c
+			break
+		}
+	}
+
+	if connection == nil {
+		log.Printf("[DEBUG] Service networking connection not found, bootstrapping")
+
+		connection := &servicenetworking.Connection{
+			Network:               networkId,
+			ReservedPeeringRanges: []string{globalAddressName},
+		}
+
+		createCall := config.NewServiceNetworkingClient(config.UserAgent).Services.Connections.Create(parentService, connection)
+		if config.UserProjectOverride {
+			createCall.Header().Add("X-Goog-User-Project", projectId)
+		}
+		op, err := createCall.Do()
+		if err != nil {
+			t.Fatalf("Error bootstrapping shared test service networking connection: %s", err)
+		}
+
+		log.Printf("[DEBUG] Waiting for service networking connection creation to finish")
+		if err := tpgservicenetworking.ServiceNetworkingOperationWaitTime(config, op, "Create Service Networking Connection", config.UserAgent, projectId, 4*time.Minute); err != nil {
+			t.Fatalf("Error bootstrapping shared test service networking connection: %s", err)
+		}
+	}
+
+	log.Printf("[DEBUG] Getting shared test service networking connection")
+
+	return networkName
+}
+
 var SharedServicePerimeterProjectPrefix = "tf-bootstrap-sp-"
 
 func BootstrapServicePerimeterProjects(t *testing.T, desiredProjects int) []*cloudresourcemanager.Project {
@@ -788,7 +960,7 @@ func BootstrapSubnet(t *testing.T, subnetName string, networkName string) string
 			"name":        subnetName,
 			"region ":     region,
 			"network":     networkUrl,
-			"ipCidrRange": "10.77.1.0/28",
+			"ipCidrRange": "10.77.0.0/20",
 		}
 
 		res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
@@ -886,6 +1058,79 @@ func BootstrapNetworkAttachment(t *testing.T, networkAttachmentName string, subn
 	return networkAttachment.Name
 }
 
+// The default network within GCP already comes pre configured with
+// certain firewall rules open to allow internal communication. As we
+// are boostrapping a network for dataproc tests, we need to additionally
+// open up similar rules to allow the nodes to talk to each other
+// internally as part of their configuration or this will just hang.
+const SharedTestFirewallPrefix = "tf-bootstrap-firewall-"
+
+func BootstrapFirewallForDataprocSharedNetwork(t *testing.T, firewallName string, networkName string) string {
+	project := envvar.GetTestProjectFromEnv()
+	firewallName = SharedTestFirewallPrefix + firewallName
+
+	config := BootstrapConfig(t)
+	if config == nil {
+		return ""
+	}
+
+	log.Printf("[DEBUG] Getting Firewall %q for Network %q", firewallName, networkName)
+	_, err := config.NewComputeClient(config.UserAgent).Firewalls.Get(project, firewallName).Do()
+	if err != nil && transport_tpg.IsGoogleApiErrorWithCode(err, 404) {
+		log.Printf("[DEBUG] firewallName %q not found, bootstrapping", firewallName)
+		url := fmt.Sprintf("%sprojects/%s/global/firewalls", config.ComputeBasePath, project)
+
+		networkId := fmt.Sprintf("projects/%s/global/networks/%s", project, networkName)
+		allowObj := []interface{}{
+			map[string]interface{}{
+				"IPProtocol": "icmp",
+			},
+			map[string]interface{}{
+				"IPProtocol": "tcp",
+				"ports":      []string{"0-65535"},
+			},
+			map[string]interface{}{
+				"IPProtocol": "udp",
+				"ports":      []string{"0-65535"},
+			},
+		}
+
+		firewallObj := map[string]interface{}{
+			"name":    firewallName,
+			"network": networkId,
+			"allowed": allowObj,
+		}
+
+		res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+			Config:    config,
+			Method:    "POST",
+			Project:   project,
+			RawURL:    url,
+			UserAgent: config.UserAgent,
+			Body:      firewallObj,
+			Timeout:   4 * time.Minute,
+		})
+		if err != nil {
+			t.Fatalf("Error bootstrapping Firewall %q for Network %q: %s", firewallName, networkName, err)
+		}
+
+		log.Printf("[DEBUG] Waiting for Firewall creation to finish")
+		err = tpgcompute.ComputeOperationWaitTime(config, res, project, "Error bootstrapping Firewall", config.UserAgent, 4*time.Minute)
+		if err != nil {
+			t.Fatalf("Error bootstrapping Firewall %q: %s", firewallName, err)
+		}
+	}
+
+	firewall, err := config.NewComputeClient(config.UserAgent).Firewalls.Get(project, firewallName).Do()
+	if err != nil {
+		t.Errorf("Error getting Firewall %q: %s", firewallName, err)
+	}
+	if firewall == nil {
+		t.Fatalf("Error getting Firewall %q: is nil", firewallName)
+	}
+	return firewall.Name
+}
+
 func SetupProjectsAndGetAccessToken(org, billing, pid, service string, config *transport_tpg.Config) (string, error) {
 	// Create project-1 and project-2
 	rmService := config.NewResourceManagerClient(config.UserAgent)
diff --git a/mmv1/third_party/terraform/acctest/test_utils.go.erb b/mmv1/third_party/terraform/acctest/test_utils.go.erb
index bf081eac3c9a..3fc319222497 100644
--- a/mmv1/third_party/terraform/acctest/test_utils.go.erb
+++ b/mmv1/third_party/terraform/acctest/test_utils.go.erb
@@ -50,6 +50,12 @@ func CheckDataSourceStateMatchesResourceStateWithIgnores(dataSourceName, resourc
 			if _, ok := ignoreFields[k]; ok {
 				continue
 			}
+			if _, ok := ignoreFields["labels.%"]; ok && strings.HasPrefix(k, "labels.") {
+				continue
+			}
+			if _, ok := ignoreFields["terraform_labels.%"]; ok && strings.HasPrefix(k, "terraform_labels.") {
+				continue
+			}
 			if k == "%" {
 				continue
 			}
diff --git a/mmv1/third_party/terraform/envvar/envvar_utils.go b/mmv1/third_party/terraform/envvar/envvar_utils.go
index 72a7f190ec39..fb8c1134ab2c 100644
--- a/mmv1/third_party/terraform/envvar/envvar_utils.go
+++ b/mmv1/third_party/terraform/envvar/envvar_utils.go
@@ -74,6 +74,10 @@ var OrgTargetEnvVars = []string{
 	"GOOGLE_ORG_2",
 }
 
+var UniverseDomainEnvVars = []string{
+	"GOOGLE_UNIVERSE_DOMAIN",
+}
+
 // This is the billing account that will be charged for the infrastructure used during testing. For
 // that reason, it is also the billing account used for creating new projects.
 var BillingAccountEnvVars = []string{
@@ -111,6 +115,12 @@ func GetTestCredsFromEnv() string {
 	return transport_tpg.MultiEnvSearch(CredsEnvVars)
 }
 
+// Returns googleapis.com if there's no universe set.
+func GetTestUniverseDomainFromEnv(t *testing.T) string {
+	SkipIfEnvNotSet(t, IdentityUserEnvVars...)
+	return transport_tpg.MultiEnvSearch(UniverseDomainEnvVars)
+}
+
 // AccTestPreCheck ensures at least one of the region env variables is set.
 func GetTestRegionFromEnv() string {
 	return transport_tpg.MultiEnvSearch(RegionEnvVars)
diff --git a/mmv1/third_party/terraform/fwmodels/provider_model.go.erb b/mmv1/third_party/terraform/fwmodels/provider_model.go.erb
index a7583193bad2..6faed26104ca 100644
--- a/mmv1/third_party/terraform/fwmodels/provider_model.go.erb
+++ b/mmv1/third_party/terraform/fwmodels/provider_model.go.erb
@@ -21,6 +21,8 @@ type ProviderModel struct {
 	UserProjectOverride                types.Bool   `tfsdk:"user_project_override"`
 	RequestTimeout                     types.String `tfsdk:"request_timeout"`
 	RequestReason                      types.String `tfsdk:"request_reason"`
+	UniverseDomain                     types.String `tfsdk:"universe_domain"`
+	DefaultLabels                      types.Map    `tfsdk:"default_labels"`
 
 	// Generated Products
 <% products.each do |product| -%>
@@ -53,9 +55,6 @@ type ProviderModel struct {
 	CloudResourceManagerCustomEndpoint types.String `tfsdk:"cloud_resource_manager_custom_endpoint"`
 	EventarcCustomEndpoint             types.String `tfsdk:"eventarc_custom_endpoint"`
 	FirebaserulesCustomEndpoint        types.String `tfsdk:"firebaserules_custom_endpoint"`
-<% if version == "ga" -%>
-	OrgPolicyCustomEndpoint            types.String `tfsdk:"org_policy_custom_endpoint"`
-<% end -%>
 	RecaptchaEnterpriseCustomEndpoint  types.String `tfsdk:"recaptcha_enterprise_custom_endpoint"`
 
 	GkehubFeatureCustomEndpoint        types.String `tfsdk:"gkehub_feature_custom_endpoint"`
diff --git a/mmv1/third_party/terraform/fwprovider/framework_provider.go.erb b/mmv1/third_party/terraform/fwprovider/framework_provider.go.erb
index a6eaaee55dd0..ad79257dbc1f 100644
--- a/mmv1/third_party/terraform/fwprovider/framework_provider.go.erb
+++ b/mmv1/third_party/terraform/fwprovider/framework_provider.go.erb
@@ -71,6 +71,7 @@ func (p *FrameworkProvider) Schema(_ context.Context, _ provider.SchemaRequest,
                         path.MatchRoot("access_token"),
                     }...),
                     CredentialsValidator(),
+                    NonEmptyStringValidator(),
                 },
             },
             "access_token": schema.StringAttribute{
@@ -79,10 +80,14 @@ func (p *FrameworkProvider) Schema(_ context.Context, _ provider.SchemaRequest,
                     stringvalidator.ConflictsWith(path.Expressions{
                         path.MatchRoot("credentials"),
                     }...),
+                    NonEmptyStringValidator(),
                 },
             },
             "impersonate_service_account": schema.StringAttribute{
                 Optional: true,
+                Validators: []validator.String{
+                    NonEmptyStringValidator(),
+                },
             },
             "impersonate_service_account_delegates": schema.ListAttribute{
                 Optional:    true,
@@ -90,15 +95,27 @@ func (p *FrameworkProvider) Schema(_ context.Context, _ provider.SchemaRequest,
             },
             "project": schema.StringAttribute{
                 Optional: true,
+                Validators: []validator.String{
+                    NonEmptyStringValidator(),
+                },
             },
             "billing_project": schema.StringAttribute{
                 Optional: true,
+                Validators: []validator.String{
+                    NonEmptyStringValidator(),
+                },
             },
             "region": schema.StringAttribute{
                 Optional: true,
+                Validators: []validator.String{
+                    NonEmptyStringValidator(),
+                },
             },
             "zone": schema.StringAttribute{
                 Optional: true,
+                Validators: []validator.String{
+                    NonEmptyStringValidator(),
+                },
             },
             "scopes": schema.ListAttribute{
                 Optional:    true,
@@ -113,7 +130,13 @@ func (p *FrameworkProvider) Schema(_ context.Context, _ provider.SchemaRequest,
             "request_reason": schema.StringAttribute{
                 Optional: true,
             },
-
+            "universe_domain": schema.StringAttribute{
+                Optional: true,
+            },
+            "default_labels": schema.MapAttribute{
+                Optional:    true,
+                ElementType: types.StringType,
+            },
             // Generated Products
             <% products.each do |product| -%>
             "<%= product[:definitions].name.underscore -%>_custom_endpoint": &schema.StringAttribute{
diff --git a/mmv1/third_party/terraform/fwprovider/framework_provider_internal_test.go b/mmv1/third_party/terraform/fwprovider/framework_provider_internal_test.go
index e81196794205..aa866ac10451 100644
--- a/mmv1/third_party/terraform/fwprovider/framework_provider_internal_test.go
+++ b/mmv1/third_party/terraform/fwprovider/framework_provider_internal_test.go
@@ -44,10 +44,11 @@ func TestFrameworkProvider_CredentialsValidator(t *testing.T) {
 				return types.StringValue(stringContents)
 			},
 		},
-		"configuring credentials as an empty string is valid": {
+		"configuring credentials as an empty string is not valid": {
 			ConfigValue: func(t *testing.T) types.String {
 				return types.StringValue("")
 			},
+			ExpectedErrorCount: 1,
 		},
 		"leaving credentials unconfigured is valid": {
 			ConfigValue: func(t *testing.T) types.String {
diff --git a/mmv1/third_party/terraform/fwprovider/framework_validators.go b/mmv1/third_party/terraform/fwprovider/framework_validators.go
index 31bf849d0368..3af98fd9db92 100644
--- a/mmv1/third_party/terraform/fwprovider/framework_validators.go
+++ b/mmv1/third_party/terraform/fwprovider/framework_validators.go
@@ -7,7 +7,6 @@ import (
 	"time"
 
 	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
-	"github.com/hashicorp/terraform-plugin-framework/types"
 
 	googleoauth "golang.org/x/oauth2/google"
 )
@@ -31,7 +30,7 @@ func (v credentialsValidator) MarkdownDescription(ctx context.Context) string {
 
 // ValidateString performs the validation.
 func (v credentialsValidator) ValidateString(ctx context.Context, request validator.StringRequest, response *validator.StringResponse) {
-	if request.ConfigValue.IsNull() || request.ConfigValue.IsUnknown() || request.ConfigValue.Equal(types.StringValue("")) {
+	if request.ConfigValue.IsNull() || request.ConfigValue.IsUnknown() {
 		return
 	}
 
@@ -85,3 +84,34 @@ func (v nonnegativedurationValidator) ValidateString(ctx context.Context, reques
 func NonNegativeDurationValidator() validator.String {
 	return nonnegativedurationValidator{}
 }
+
+// Non Empty String Validator
+type nonEmptyStringValidator struct {
+}
+
+// Description describes the validation in plain text formatting.
+func (v nonEmptyStringValidator) Description(_ context.Context) string {
+	return "value expected to be a string that isn't an empty string"
+}
+
+// MarkdownDescription describes the validation in Markdown formatting.
+func (v nonEmptyStringValidator) MarkdownDescription(ctx context.Context) string {
+	return v.Description(ctx)
+}
+
+// ValidateString performs the validation.
+func (v nonEmptyStringValidator) ValidateString(ctx context.Context, request validator.StringRequest, response *validator.StringResponse) {
+	if request.ConfigValue.IsNull() || request.ConfigValue.IsUnknown() {
+		return
+	}
+
+	value := request.ConfigValue.ValueString()
+
+	if value == "" {
+		response.Diagnostics.AddError("expected a non-empty string", fmt.Sprintf("%s was set to `%s`", request.Path, value))
+	}
+}
+
+func NonEmptyStringValidator() validator.String {
+	return nonEmptyStringValidator{}
+}
diff --git a/mmv1/third_party/terraform/fwresource/framework_location.go b/mmv1/third_party/terraform/fwresource/framework_location.go
index 5a0559a290ef..609ab65b98b1 100644
--- a/mmv1/third_party/terraform/fwresource/framework_location.go
+++ b/mmv1/third_party/terraform/fwresource/framework_location.go
@@ -32,12 +32,14 @@ type LocationDescription struct {
 func (ld *LocationDescription) GetLocation() (types.String, error) {
 	// Location from resource config
 	if !ld.ResourceLocation.IsNull() && !ld.ResourceLocation.IsUnknown() && !ld.ResourceLocation.Equal(types.StringValue("")) {
-		return ld.ResourceLocation, nil
+		location := tpgresource.GetResourceNameFromSelfLink(ld.ResourceLocation.ValueString()) // Location could be a self link
+		return types.StringValue(location), nil
 	}
 
 	// Location from region in resource config
 	if !ld.ResourceRegion.IsNull() && !ld.ResourceRegion.IsUnknown() && !ld.ResourceRegion.Equal(types.StringValue("")) {
-		return ld.ResourceRegion, nil
+		region := tpgresource.GetResourceNameFromSelfLink(ld.ResourceRegion.ValueString()) // Region could be a self link
+		return types.StringValue(region), nil
 	}
 
 	// Location from zone in resource config
@@ -46,9 +48,16 @@ func (ld *LocationDescription) GetLocation() (types.String, error) {
 		return types.StringValue(location), nil
 	}
 
+	// Location from region in provider config
+	if !ld.ProviderRegion.IsNull() && !ld.ProviderRegion.IsUnknown() && !ld.ProviderRegion.Equal(types.StringValue("")) {
+		location := tpgresource.GetResourceNameFromSelfLink(ld.ProviderRegion.ValueString()) // Region could be a self link
+		return types.StringValue(location), nil
+	}
+
 	// Location from zone in provider config
 	if !ld.ProviderZone.IsNull() && !ld.ProviderZone.IsUnknown() && !ld.ProviderZone.Equal(types.StringValue("")) {
-		return ld.ProviderZone, nil
+		location := tpgresource.GetResourceNameFromSelfLink(ld.ProviderZone.ValueString()) // Zone could be a self link
+		return types.StringValue(location), nil
 	}
 
 	var err error
@@ -71,17 +80,18 @@ func (ld *LocationDescription) GetRegion() (types.String, error) {
 	}
 	// Region from zone in resource config
 	if !ld.ResourceZone.IsNull() && !ld.ResourceZone.IsUnknown() && !ld.ResourceZone.Equal(types.StringValue("")) {
-		region := tpgresource.GetRegionFromZone(ld.ResourceZone.ValueString())
-		return types.StringValue(region), nil
+		region := tpgresource.GetResourceNameFromSelfLink(ld.ResourceZone.ValueString()) // Region could be a self link
+		return types.StringValue(tpgresource.GetRegionFromZone(region)), nil
 	}
 	// Region from provider config
 	if !ld.ProviderRegion.IsNull() && !ld.ProviderRegion.IsUnknown() && !ld.ProviderRegion.Equal(types.StringValue("")) {
-		return ld.ProviderRegion, nil
+		region := tpgresource.GetResourceNameFromSelfLink(ld.ProviderRegion.ValueString()) // Region could be a self link
+		return types.StringValue(region), nil
 	}
 	// Region from zone in provider config
 	if !ld.ProviderZone.IsNull() && !ld.ProviderZone.IsUnknown() && !ld.ProviderZone.Equal(types.StringValue("")) {
-		region := tpgresource.GetRegionFromZone(ld.ProviderZone.ValueString())
-		return types.StringValue(region), nil
+		region := tpgresource.GetResourceNameFromSelfLink(ld.ProviderZone.ValueString()) // Region could be a self link
+		return types.StringValue(tpgresource.GetRegionFromZone(region)), nil
 	}
 
 	var err error
@@ -103,7 +113,9 @@ func (ld *LocationDescription) GetZone() (types.String, error) {
 		return types.StringValue(zone), nil
 	}
 	if !ld.ProviderZone.IsNull() && !ld.ProviderZone.IsUnknown() && !ld.ProviderZone.Equal(types.StringValue("")) {
-		return ld.ProviderZone, nil
+		// Zone could be a self link
+		zone := tpgresource.GetResourceNameFromSelfLink(ld.ProviderZone.ValueString())
+		return types.StringValue(zone), nil
 	}
 
 	var err error
diff --git a/mmv1/third_party/terraform/fwresource/framework_location_test.go b/mmv1/third_party/terraform/fwresource/framework_location_test.go
index 8204030d68e1..1e5c5026715a 100644
--- a/mmv1/third_party/terraform/fwresource/framework_location_test.go
+++ b/mmv1/third_party/terraform/fwresource/framework_location_test.go
@@ -126,11 +126,23 @@ func TestLocationDescription_GetRegion(t *testing.T) {
 			},
 			ExpectedRegion: types.StringValue("provider-zone"), // is truncated
 		},
-		"does not shorten region values when derived from a zone self link set in the resource config": {
+		"shortens region values when derived from a zone self link set in the resource config": {
 			ld: LocationDescription{
 				ResourceZone: types.StringValue("https://www.googleapis.com/compute/v1/projects/my-project/zones/us-central1-a"),
 			},
-			ExpectedRegion: types.StringValue("https://www.googleapis.com/compute/v1/projects/my-project/zones/us-central1"), // Value isn't shortened from URI to name
+			ExpectedRegion: types.StringValue("us-central1"),
+		},
+		"shortens region values set as self links in the provider config": {
+			ld: LocationDescription{
+				ProviderRegion: types.StringValue("https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1"),
+			},
+			ExpectedRegion: types.StringValue("us-central1"),
+		},
+		"shortens region values when derived from a zone self link set in the provider config": {
+			ld: LocationDescription{
+				ProviderZone: types.StringValue("https://www.googleapis.com/compute/v1/projects/my-project/zones/us-central1-a"),
+			},
+			ExpectedRegion: types.StringValue("us-central1"),
 		},
 		"returns the value of the region field in provider config when region/zone is unset in resource config": {
 			ld: LocationDescription{
@@ -228,11 +240,11 @@ func TestLocationDescription_GetLocation(t *testing.T) {
 			},
 			ExpectedLocation: types.StringValue("resource-location"),
 		},
-		"does not shorten the location value when it is set as a self link in the resource config": {
+		"shortens the location value when it is set as a self link in the resource config": {
 			ld: LocationDescription{
 				ResourceLocation: types.StringValue("https://www.googleapis.com/compute/v1/projects/my-project/locations/resource-location"),
 			},
-			ExpectedLocation: types.StringValue("https://www.googleapis.com/compute/v1/projects/my-project/locations/resource-location"),
+			ExpectedLocation: types.StringValue("resource-location"),
 		},
 		"returns the region value set in the resource config when location is not in the schema": {
 			ld: LocationDescription{
@@ -241,11 +253,11 @@ func TestLocationDescription_GetLocation(t *testing.T) {
 			},
 			ExpectedLocation: types.StringValue("resource-region"),
 		},
-		"does not shorten the region value when it is set as a self link in the resource config": {
+		"shortens the region value when it is set as a self link in the resource config": {
 			ld: LocationDescription{
 				ResourceRegion: types.StringValue("https://www.googleapis.com/compute/v1/projects/my-project/regions/resource-region"),
 			},
-			ExpectedLocation: types.StringValue("https://www.googleapis.com/compute/v1/projects/my-project/regions/resource-region"),
+			ExpectedLocation: types.StringValue("resource-region"),
 		},
 		"returns the zone value set in the resource config when neither location nor region in the schema": {
 			ld: LocationDescription{
@@ -259,18 +271,24 @@ func TestLocationDescription_GetLocation(t *testing.T) {
 			},
 			ExpectedLocation: types.StringValue("resource-zone-a"),
 		},
-		"returns the zone value from the provider config when none of location/region/zone are set in the resource config": {
+		"returns the region value from the provider config when none of location/region/zone are set in the resource config": {
 			ld: LocationDescription{
-				ProviderRegion: types.StringValue("provider-region"), // unused
+				ProviderRegion: types.StringValue("provider-region"), // Preferred to use region value over zone value if both are set
 				ProviderZone:   types.StringValue("provider-zone-a"),
 			},
+			ExpectedLocation: types.StringValue("provider-region"),
+		},
+		"returns the zone value from the provider config when none of location/region/zone are set in the resource config and region is not set in the provider config": {
+			ld: LocationDescription{
+				ProviderZone: types.StringValue("provider-zone-a"),
+			},
 			ExpectedLocation: types.StringValue("provider-zone-a"),
 		},
-		"does not shorten the zone value when it is set as a self link in the provider config": {
+		"shortens the zone value when it is set as a self link in the provider config": {
 			ld: LocationDescription{
 				ProviderZone: types.StringValue("https://www.googleapis.com/compute/v1/projects/my-project/zones/provider-zone-a"),
 			},
-			ExpectedLocation: types.StringValue("https://www.googleapis.com/compute/v1/projects/my-project/zones/provider-zone-a"),
+			ExpectedLocation: types.StringValue("provider-zone-a"),
 		},
 		// Handling of empty strings
 		"returns the region value set in the resource config when location is an empty string": {
@@ -297,13 +315,6 @@ func TestLocationDescription_GetLocation(t *testing.T) {
 			},
 			ExpectedLocation: types.StringValue("provider-zone-a"),
 		},
-		// Error states
-		"does not use the region value set in the provider config": {
-			ld: LocationDescription{
-				ProviderRegion: types.StringValue("provider-region"),
-			},
-			ExpectedError: true,
-		},
 		"returns an error when none of location/region/zone are set on the resource, and neither region or zone is set on the provider": {
 			ExpectedError: true,
 		},
diff --git a/mmv1/third_party/terraform/fwtransport/framework_config.go.erb b/mmv1/third_party/terraform/fwtransport/framework_config.go.erb
index a97a99cb5a36..ea6240f14e95 100644
--- a/mmv1/third_party/terraform/fwtransport/framework_config.go.erb
+++ b/mmv1/third_party/terraform/fwtransport/framework_config.go.erb
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"net/http"
 	"os"
+	"regexp"
 	"strconv"
 	"time"
 
@@ -19,6 +20,7 @@ import (
 	"github.com/hashicorp/go-cleanhttp"
 	"github.com/hashicorp/terraform-plugin-framework/diag"
 	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-framework/types/basetypes"
 	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/logging"
 
@@ -31,35 +33,32 @@ import (
 )
 
 type FrameworkProviderConfig struct {
-    BillingProject types.String
-    Client *http.Client
-    Context context.Context
-    gRPCLoggingOptions []option.ClientOption
-    PollInterval time.Duration
-    Project types.String
-    Region types.String
-    Zone types.String
-    RequestBatcherIam *transport_tpg.RequestBatcher
-    RequestBatcherServiceUsage *transport_tpg.RequestBatcher
-    Scopes []string
-    TokenSource oauth2.TokenSource
-    UserAgent string
-    UserProjectOverride types.Bool
-
-    // paths for client setup
-    <% products.each do |product| -%>
-    <%= product[:definitions].name -%>BasePath string
-    <% end -%>
-}
-
-var defaultClientScopes = []string{
-	"https://www.googleapis.com/auth/cloud-platform",
-	"https://www.googleapis.com/auth/userinfo.email",
+	BillingProject             types.String
+	Client                     *http.Client
+	Context                    context.Context
+	gRPCLoggingOptions         []option.ClientOption
+	PollInterval               time.Duration
+	Project                    types.String
+	Region                     types.String
+	Zone                       types.String
+	RequestBatcherIam          *transport_tpg.RequestBatcher
+	RequestBatcherServiceUsage *transport_tpg.RequestBatcher
+	Scopes                     types.List
+	TokenSource                oauth2.TokenSource
+	UniverseDomain             types.String
+	UserAgent                  string
+	UserProjectOverride        types.Bool
+
+	// paths for client setup
+	<% products.each do |product| -%>
+	<%= product[:definitions].name -%>BasePath string
+	<% end -%>
 }
 
 // LoadAndValidateFramework handles the bulk of configuring the provider
 // it is pulled out so that we can manually call this from our testing provider as well
 func (p *FrameworkProviderConfig) LoadAndValidateFramework(ctx context.Context, data *fwmodels.ProviderModel, tfVersion string, diags *diag.Diagnostics, providerversion string) {
+
 	// Set defaults if needed
 	p.HandleDefaults(ctx, data, diags)
 	if diags.HasError() {
@@ -100,17 +99,20 @@ func (p *FrameworkProviderConfig) LoadAndValidateFramework(ctx context.Context,
 	p.Context = ctx
 	p.BillingProject = data.BillingProject
 	p.Project = data.Project
-	p.Region = data.Region
+	p.Region = GetRegionFromRegionSelfLink(data.Region)
+	p.Scopes = data.Scopes
 	p.Zone = data.Zone
 	p.UserProjectOverride = data.UserProjectOverride
 	p.PollInterval = 10 * time.Second
+	p.Project = data.Project
+	p.UniverseDomain = data.UniverseDomain
 	p.RequestBatcherServiceUsage = transport_tpg.NewRequestBatcher("Service Usage", ctx, batchingConfig)
 	p.RequestBatcherIam = transport_tpg.NewRequestBatcher("IAM", ctx, batchingConfig)
 }
 
 // HandleDefaults will handle all the defaults necessary in the provider
 func (p *FrameworkProviderConfig) HandleDefaults(ctx context.Context, data *fwmodels.ProviderModel, diags *diag.Diagnostics) {
-	if data.AccessToken.IsNull() && data.Credentials.IsNull() {
+	if (data.AccessToken.IsNull() || data.AccessToken.IsUnknown()) && (data.Credentials.IsNull() || data.Credentials.IsUnknown()) {
 		credentials := transport_tpg.MultiEnvDefault([]string{
 			"GOOGLE_CREDENTIALS",
 			"GOOGLE_CLOUD_KEYFILE_JSON",
@@ -130,11 +132,11 @@ func (p *FrameworkProviderConfig) HandleDefaults(ctx context.Context, data *fwmo
 		}
 	}
 
-	if data.ImpersonateServiceAccount.IsNull() && os.Getenv("GOOGLE_IMPERSONATE_SERVICE_ACCOUNT") != "" {
+	if (data.ImpersonateServiceAccount.IsNull() || data.ImpersonateServiceAccount.IsUnknown()) && os.Getenv("GOOGLE_IMPERSONATE_SERVICE_ACCOUNT") != "" {
 		data.ImpersonateServiceAccount = types.StringValue(os.Getenv("GOOGLE_IMPERSONATE_SERVICE_ACCOUNT"))
 	}
 
-	if data.Project.IsNull() {
+	if data.Project.IsNull() || data.Project.IsUnknown() {
 		project := transport_tpg.MultiEnvDefault([]string{
 			"GOOGLE_PROJECT",
 			"GOOGLE_CLOUD_PROJECT",
@@ -150,7 +152,7 @@ func (p *FrameworkProviderConfig) HandleDefaults(ctx context.Context, data *fwmo
 		data.BillingProject = types.StringValue(os.Getenv("GOOGLE_BILLING_PROJECT"))
 	}
 
-	if data.Region.IsNull() {
+	if data.Region.IsNull() || data.Region.IsUnknown() {
 		region := transport_tpg.MultiEnvDefault([]string{
 			"GOOGLE_REGION",
 			"GCLOUD_REGION",
@@ -162,7 +164,7 @@ func (p *FrameworkProviderConfig) HandleDefaults(ctx context.Context, data *fwmo
 		}
 	}
 
-	if data.Zone.IsNull() {
+	if data.Zone.IsNull() || data.Zone.IsUnknown() {
 		zone := transport_tpg.MultiEnvDefault([]string{
 			"GOOGLE_ZONE",
 			"GCLOUD_ZONE",
@@ -176,14 +178,14 @@ func (p *FrameworkProviderConfig) HandleDefaults(ctx context.Context, data *fwmo
 
 	if len(data.Scopes.Elements()) == 0 {
 		var d diag.Diagnostics
-		data.Scopes, d = types.ListValueFrom(ctx, types.StringType, defaultClientScopes)
+		data.Scopes, d = types.ListValueFrom(ctx, types.StringType, transport_tpg.DefaultClientScopes)
 		diags.Append(d...)
 		if diags.HasError() {
 			return
 		}
 	}
 
-	if !data.Batching.IsNull() {
+	if !data.Batching.IsNull() && !data.Batching.IsUnknown() {
 		var pbConfigs []fwmodels.ProviderBatching
 		d := data.Batching.ElementsAs(ctx, &pbConfigs, true)
 		diags.Append(d...)
@@ -191,18 +193,18 @@ func (p *FrameworkProviderConfig) HandleDefaults(ctx context.Context, data *fwmo
 			return
 		}
 
-		if pbConfigs[0].SendAfter.IsNull() {
+		if pbConfigs[0].SendAfter.IsNull() || pbConfigs[0].SendAfter.IsUnknown() {
 			pbConfigs[0].SendAfter = types.StringValue("10s")
 		}
 
-		if pbConfigs[0].EnableBatching.IsNull() {
+		if pbConfigs[0].EnableBatching.IsNull() || pbConfigs[0].EnableBatching.IsUnknown() {
 			pbConfigs[0].EnableBatching = types.BoolValue(true)
 		}
 
 		data.Batching, d = types.ListValueFrom(ctx, types.ObjectType{}.WithAttributeTypes(fwmodels.ProviderBatchingAttributes), pbConfigs)
 	}
 
-	if data.UserProjectOverride.IsNull() && os.Getenv("USER_PROJECT_OVERRIDE") != "" {
+	if (data.UserProjectOverride.IsNull() || data.UserProjectOverride.IsUnknown()) && os.Getenv("USER_PROJECT_OVERRIDE") != "" {
 		override, err := strconv.ParseBool(os.Getenv("USER_PROJECT_OVERRIDE"))
 		if err != nil {
 			diags.AddError(
@@ -211,11 +213,11 @@ func (p *FrameworkProviderConfig) HandleDefaults(ctx context.Context, data *fwmo
 		data.UserProjectOverride = types.BoolValue(override)
 	}
 
-	if data.RequestReason.IsNull() && os.Getenv("CLOUDSDK_CORE_REQUEST_REASON") != "" {
+	if (data.RequestReason.IsNull() || data.RequestReason.IsUnknown()) && os.Getenv("CLOUDSDK_CORE_REQUEST_REASON") != "" {
 		data.RequestReason = types.StringValue(os.Getenv("CLOUDSDK_CORE_REQUEST_REASON"))
 	}
 
-	if data.RequestTimeout.IsNull() {
+	if data.RequestTimeout.IsNull() || data.RequestTimeout.IsUnknown() {
 		data.RequestTimeout = types.StringValue("120s")
 	}
 
@@ -517,7 +519,7 @@ func (p *FrameworkProviderConfig) logGoogleIdentities(ctx context.Context, data
 	// a separate diagnostics here
 	var d diag.Diagnostics
 
-	if data.ImpersonateServiceAccount.IsNull() {
+	if data.ImpersonateServiceAccount.IsNull() || data.ImpersonateServiceAccount.IsUnknown() {
 
 		tokenSource := GetTokenSource(ctx, data, true, diags)
 		if diags.HasError() {
@@ -577,19 +579,23 @@ func GetCredentials(ctx context.Context, data fwmodels.ProviderModel, initialCre
 	var clientScopes []string
 	var delegates []string
 
-	d := data.Scopes.ElementsAs(ctx, &clientScopes, false)
-	diags.Append(d...)
-	if diags.HasError() {
-		return googleoauth.Credentials{}
+	if !data.Scopes.IsNull() && !data.Scopes.IsUnknown() {
+		d := data.Scopes.ElementsAs(ctx, &clientScopes, false)
+		diags.Append(d...)
+		if diags.HasError() {
+			return googleoauth.Credentials{}
+		}
 	}
 
-	d = data.ImpersonateServiceAccountDelegates.ElementsAs(ctx, &delegates, false)
-	diags.Append(d...)
-	if diags.HasError() {
-		return googleoauth.Credentials{}
+	if !data.ImpersonateServiceAccountDelegates.IsNull() && !data.ImpersonateServiceAccountDelegates.IsUnknown() {
+		d := data.ImpersonateServiceAccountDelegates.ElementsAs(ctx, &delegates, false)
+		diags.Append(d...)
+		if diags.HasError() {
+			return googleoauth.Credentials{}
+		}
 	}
 
-	if !data.AccessToken.IsNull() {
+	if !data.AccessToken.IsNull() && !data.AccessToken.IsUnknown() {
 		contents, _, err := verify.PathOrContents(data.AccessToken.ValueString())
 		if err != nil {
 			diags.AddError("error loading access token", err.Error())
@@ -614,7 +620,7 @@ func GetCredentials(ctx context.Context, data fwmodels.ProviderModel, initialCre
 		}
 	}
 
-	if !data.Credentials.IsNull() {
+	if !data.Credentials.IsNull() && !data.Credentials.IsUnknown() {
 		contents, _, err := verify.PathOrContents(data.Credentials.ValueString())
 		if err != nil {
 			diags.AddError(fmt.Sprintf("error loading credentials: %s", err), err.Error())
@@ -673,7 +679,8 @@ func GetBatchingConfig(ctx context.Context, data types.List, diags *diag.Diagnos
 		EnableBatching: true,
 	}
 
-	if data.IsNull() {
+	// Handle if entire batching block is null/unknown
+	if data.IsNull() || data.IsUnknown() {
 		return bc
 	}
 
@@ -698,3 +705,16 @@ func GetBatchingConfig(ctx context.Context, data types.List, diags *diag.Diagnos
 
 	return bc
 }
+
+func GetRegionFromRegionSelfLink(selfLink basetypes.StringValue) basetypes.StringValue {
+	re := regexp.MustCompile("/compute/[a-zA-Z0-9]*/projects/[a-zA-Z0-9-]*/regions/([a-zA-Z0-9-]*)")
+	value := selfLink.String()
+	switch {
+	case re.MatchString(value):
+		if res := re.FindStringSubmatch(value); len(res) == 2 && res[1] != "" {
+			region := res[1]
+			return types.StringValue(region)
+		}
+	}
+	return selfLink
+}
diff --git a/mmv1/third_party/terraform/fwtransport/framework_config_test.go.erb b/mmv1/third_party/terraform/fwtransport/framework_config_test.go.erb
index 0a2b57c91cdb..e430390dc814 100644
--- a/mmv1/third_party/terraform/fwtransport/framework_config_test.go.erb
+++ b/mmv1/third_party/terraform/fwtransport/framework_config_test.go.erb
@@ -102,33 +102,34 @@ func TestFrameworkProvider_LoadAndValidateFramework_project(t *testing.T) {
 			ExpectedConfigStructValue: types.StringNull(),
 		},
 		// Handling empty strings in config
-		// TODO(SarahFrench) make these tests pass to address: https://github.com/hashicorp/terraform-provider-google/issues/14255
-		// "when project is set as an empty string the field is treated as if it's unset, without error": {
-		// 	ConfigValues: fwmodels.ProviderModel{
-		// 		Project: types.StringValue(""),
-		// 	},
-		// 	ExpectedDataModelValue:    types.StringNull(),
-		// 	ExpectedConfigStructValue: types.StringNull(),
-		// },
-		// "when project is set as an empty string an environment variable will be used": {
-		// 	ConfigValues: fwmodels.ProviderModel{
-		// 		Project: types.StringValue(""),
-		// 	},
-		// 	EnvVariables: map[string]string{
-		// 		"GOOGLE_PROJECT": "project-from-GOOGLE_PROJECT",
-		// 	},
-		// 	ExpectedDataModelValue:    types.StringNull(),
-		// 	ExpectedConfigStructValue: types.StringValue("project-from-GOOGLE_PROJECT"),
-		// },
+		"when project is set as an empty string the empty string is used and not ignored": {
+			ConfigValues: fwmodels.ProviderModel{
+				Project: types.StringValue(""),
+			},
+			ExpectedDataModelValue:    types.StringValue(""),
+			ExpectedConfigStructValue: types.StringValue(""),
+		},
+		"when project is set as an empty string, the empty string is not ignored in favor of an environment variable": {
+			ConfigValues: fwmodels.ProviderModel{
+				Project: types.StringValue(""),
+			},
+			EnvVariables: map[string]string{
+				"GOOGLE_PROJECT": "project-from-GOOGLE_PROJECT",
+			},
+			ExpectedDataModelValue:    types.StringValue(""),
+			ExpectedConfigStructValue: types.StringValue(""),
+		},
 		// Handling unknown values
-		// TODO(SarahFrench) make these tests pass to address: https://github.com/hashicorp/terraform-provider-google/issues/14444
-		// "when project is an unknown value, the provider treats it as if it's unset (align to SDK behaviour)": {
-		// 	ConfigValues: fwmodels.ProviderModel{
-		// 		Project: types.StringUnknown(),
-		// 	},
-		// 	ExpectedDataModelValue:    types.StringNull(),
-		// 	ExpectedConfigStructValue: types.StringNull(),
-		// },
+		"when project is an unknown value, the provider treats it as if it's unset and uses an environment variable instead": {
+			ConfigValues: fwmodels.ProviderModel{
+				Project: types.StringUnknown(),
+			},
+			EnvVariables: map[string]string{
+				"GOOGLE_PROJECT": "project-from-GOOGLE_PROJECT",
+			},
+			ExpectedDataModelValue:    types.StringValue("project-from-GOOGLE_PROJECT"),
+			ExpectedConfigStructValue: types.StringValue("project-from-GOOGLE_PROJECT"),
+		},
 	}
 
 	for tn, tc := range cases {
@@ -142,7 +143,7 @@ func TestFrameworkProvider_LoadAndValidateFramework_project(t *testing.T) {
 			tfVersion := "foobar"
 			providerversion := "999"
 			diags := diag.Diagnostics{}
-			
+
 			data := tc.ConfigValues
 			data.Credentials = types.StringValue(transport_tpg.TestFakeCredentialsPath)
 			impersonateServiceAccountDelegates, _ := types.ListValue(types.StringType, []attr.Value{}) // empty list
@@ -193,40 +194,40 @@ func TestFrameworkProvider_LoadAndValidateFramework_credentials(t *testing.T) {
 	}{
 		"credentials can be configured as a path to a credentials JSON file": {
 			ConfigValues: fwmodels.ProviderModel{
-					Credentials: types.StringValue(transport_tpg.TestFakeCredentialsPath),
-				},
-				ExpectedDataModelValue: types.StringValue(transport_tpg.TestFakeCredentialsPath),
-			},
-			"configuring credentials as a path to a non-existent file results in an error": {
-				ConfigValues: fwmodels.ProviderModel{
-					Credentials: types.StringValue(pathToMissingFile),
-				},
-				ExpectError: true,
-			},
-			"credentials set in the config are not overridden by environment variables": {
-				ConfigValues: fwmodels.ProviderModel{
-					Credentials: types.StringValue(acctest.GenerateFakeCredentialsJson("test")),
-				},
-				EnvVariables: map[string]string{
-					"GOOGLE_CREDENTIALS":             acctest.GenerateFakeCredentialsJson("GOOGLE_CREDENTIALS"),
-					"GOOGLE_CLOUD_KEYFILE_JSON":      acctest.GenerateFakeCredentialsJson("GOOGLE_CLOUD_KEYFILE_JSON"),
-					"GCLOUD_KEYFILE_JSON":            acctest.GenerateFakeCredentialsJson("GCLOUD_KEYFILE_JSON"),
-					"GOOGLE_APPLICATION_CREDENTIALS": acctest.GenerateFakeCredentialsJson("GOOGLE_APPLICATION_CREDENTIALS"),
-				},
-				ExpectedDataModelValue: types.StringValue(acctest.GenerateFakeCredentialsJson("test")),
-			},
-			"when credentials is unset in the config, environment variables are used: GOOGLE_CREDENTIALS used first": {
-				ConfigValues: fwmodels.ProviderModel{
-					Credentials: types.StringNull(), // unset
-				},
-				EnvVariables: map[string]string{
-					"GOOGLE_CREDENTIALS":             acctest.GenerateFakeCredentialsJson("GOOGLE_CREDENTIALS"),
-					"GOOGLE_CLOUD_KEYFILE_JSON":      acctest.GenerateFakeCredentialsJson("GOOGLE_CLOUD_KEYFILE_JSON"),
-					"GCLOUD_KEYFILE_JSON":            acctest.GenerateFakeCredentialsJson("GCLOUD_KEYFILE_JSON"),
-					"GOOGLE_APPLICATION_CREDENTIALS": acctest.GenerateFakeCredentialsJson("GOOGLE_APPLICATION_CREDENTIALS"),
-				},
-				ExpectedDataModelValue: types.StringValue(acctest.GenerateFakeCredentialsJson("GOOGLE_CREDENTIALS")),
+				Credentials: types.StringValue(transport_tpg.TestFakeCredentialsPath),
+			},
+			ExpectedDataModelValue: types.StringValue(transport_tpg.TestFakeCredentialsPath),
+		},
+		"configuring credentials as a path to a non-existent file results in an error": {
+			ConfigValues: fwmodels.ProviderModel{
+				Credentials: types.StringValue(pathToMissingFile),
+			},
+			ExpectError: true,
+		},
+		"credentials set in the config are not overridden by environment variables": {
+			ConfigValues: fwmodels.ProviderModel{
+				Credentials: types.StringValue(acctest.GenerateFakeCredentialsJson("test")),
+			},
+			EnvVariables: map[string]string{
+				"GOOGLE_CREDENTIALS":             acctest.GenerateFakeCredentialsJson("GOOGLE_CREDENTIALS"),
+				"GOOGLE_CLOUD_KEYFILE_JSON":      acctest.GenerateFakeCredentialsJson("GOOGLE_CLOUD_KEYFILE_JSON"),
+				"GCLOUD_KEYFILE_JSON":            acctest.GenerateFakeCredentialsJson("GCLOUD_KEYFILE_JSON"),
+				"GOOGLE_APPLICATION_CREDENTIALS": acctest.GenerateFakeCredentialsJson("GOOGLE_APPLICATION_CREDENTIALS"),
+			},
+			ExpectedDataModelValue: types.StringValue(acctest.GenerateFakeCredentialsJson("test")),
+		},
+		"when credentials is unset in the config, environment variables are used: GOOGLE_CREDENTIALS used first": {
+			ConfigValues: fwmodels.ProviderModel{
+				Credentials: types.StringNull(), // unset
+			},
+			EnvVariables: map[string]string{
+				"GOOGLE_CREDENTIALS":             acctest.GenerateFakeCredentialsJson("GOOGLE_CREDENTIALS"),
+				"GOOGLE_CLOUD_KEYFILE_JSON":      acctest.GenerateFakeCredentialsJson("GOOGLE_CLOUD_KEYFILE_JSON"),
+				"GCLOUD_KEYFILE_JSON":            acctest.GenerateFakeCredentialsJson("GCLOUD_KEYFILE_JSON"),
+				"GOOGLE_APPLICATION_CREDENTIALS": acctest.GenerateFakeCredentialsJson("GOOGLE_APPLICATION_CREDENTIALS"),
 			},
+			ExpectedDataModelValue: types.StringValue(acctest.GenerateFakeCredentialsJson("GOOGLE_CREDENTIALS")),
+		},
 		"when credentials is unset in the config, environment variables are used: GOOGLE_CLOUD_KEYFILE_JSON used second": {
 			ConfigValues: fwmodels.ProviderModel{
 				Credentials: types.StringNull(), // unset
@@ -263,17 +264,16 @@ func TestFrameworkProvider_LoadAndValidateFramework_credentials(t *testing.T) {
 			},
 			ExpectedDataModelValue: types.StringNull(),
 		},
-		// Handling empty strings in config
-		// TODO(SarahFrench) make these tests pass to address: https://github.com/hashicorp/terraform-provider-google/issues/14255
-		// "when credentials is set to an empty string in the config (and access_token unset), GOOGLE_APPLICATION_CREDENTIALS is used": {
-		// ConfigValues: fwmodels.ProviderModel{
-		// 	Credentials: types.StringValue(""),
-		// },
-		// 	EnvVariables: map[string]string{
-		// 		"GOOGLE_APPLICATION_CREDENTIALS": transport_tpg.TestFakeCredentialsPath, // needs to be a path to a file when used by code
-		// 	},
-		// 	ExpectedDataModelValue: types.StringNull(),
-		// },
+		// Error states
+		"when credentials is set to an empty string in the config the value isn't ignored and results in an error": {
+			ConfigValues: fwmodels.ProviderModel{
+				Credentials: types.StringValue(""),
+			},
+			EnvVariables: map[string]string{
+				"GOOGLE_APPLICATION_CREDENTIALS": transport_tpg.TestFakeCredentialsPath, // needs to be a path to a file when used by code
+			},
+			ExpectError: true,
+		},
 		// NOTE: these tests can't run in Cloud Build due to ADC locating credentials despite `GOOGLE_APPLICATION_CREDENTIALS` being unset
 		// See https://cloud.google.com/docs/authentication/application-default-credentials#search_order
 		// Also, when running these tests locally you need to run `gcloud auth application-default revoke` to ensure your machine isn't supplying ADCs
@@ -335,15 +335,16 @@ func TestFrameworkProvider_LoadAndValidateFramework_credentials(t *testing.T) {
 	}
 }
 
-// TODO(SarahFrench) make this test pass to address: https://github.com/hashicorp/terraform-provider-google/issues/14444
+// NOTE: these tests can't run in Cloud Build due to ADC locating credentials despite `GOOGLE_APPLICATION_CREDENTIALS` being unset
+// See https://cloud.google.com/docs/authentication/application-default-credentials#search_order
+// Also, when running these tests locally you need to run `gcloud auth application-default revoke` to ensure your machine isn't supplying ADCs
 // func TestFrameworkProvider_LoadAndValidateFramework_credentials_unknown(t *testing.T) {
 // 	// This test case is kept separate from other credentials tests, as it requires comparing
 // 	// error messages returned by two different error states:
 // 	// - When credentials = Null
 // 	// - When credentials = Unknown
 
-// 	t.Run("when project is an unknown value, the provider treats it as if it's unset (align to SDK behaviour)", func(t *testing.T) {
-
+// 	t.Run("the same error is returned whether credentials is set as a null or unknown value (and access_token isn't set)", func(t *testing.T) {
 // 		// Arrange
 // 		acctest.UnsetTestProviderConfigEnvs(t)
 
@@ -434,23 +435,23 @@ func TestFrameworkProvider_LoadAndValidateFramework_billingProject(t *testing.T)
 			ExpectedConfigStructValue: types.StringNull(),
 		},
 		// Handling empty strings in config
-		// "when billing_project is set as an empty string the field is treated as if it's unset, without error": {
-		// 	ConfigValues: fwmodels.ProviderModel{
-		// 		BillingProject: types.StringValue(""),
-		// 	},
-		// 	ExpectedDataModelValue:    types.StringNull(),
-		// 	ExpectedConfigStructValue: types.StringNull(),
-		// },
-		// "when billing_project is set as an empty string an environment variable will be used": {
-		// 	ConfigValues: fwmodels.ProviderModel{
-		// 		BillingProject: types.StringValue(""),
-		// 	},
-		// 	EnvVariables: map[string]string{
-		// 		"GOOGLE_BILLING_PROJECT": "billing-project-from-env",
-		// 	},
-		// 	ExpectedDataModelValue:    types.StringValue("billing-project-from-env"),
-		// 	ExpectedConfigStructValue: types.StringValue("billing-project-from-env"),
-		// },
+		"when billing_project is set as an empty string the empty string is used and not ignored": {
+			ConfigValues: fwmodels.ProviderModel{
+				BillingProject: types.StringValue(""),
+			},
+			ExpectedDataModelValue:    types.StringValue(""),
+			ExpectedConfigStructValue: types.StringValue(""),
+		},
+		"when billing_project is set as an empty string, the empty string is not ignored in favor of an environment variable": {
+			ConfigValues: fwmodels.ProviderModel{
+				BillingProject: types.StringValue(""),
+			},
+			EnvVariables: map[string]string{
+				"GOOGLE_BILLING_PROJECT": "billing-project-from-env",
+			},
+			ExpectedDataModelValue:    types.StringValue(""),
+			ExpectedConfigStructValue: types.StringValue(""),
+		},
 	}
 
 	for tn, tc := range cases {
@@ -497,7 +498,6 @@ func TestFrameworkProvider_LoadAndValidateFramework_billingProject(t *testing.T)
 	}
 }
 
-
 func TestFrameworkProvider_LoadAndValidateFramework_region(t *testing.T) {
 
 	// Note: In the test function we need to set the below fields in test case's fwmodels.ProviderModel value
@@ -522,15 +522,13 @@ func TestFrameworkProvider_LoadAndValidateFramework_region(t *testing.T) {
 			ExpectedDataModelValue:    types.StringValue("region-from-config"),
 			ExpectedConfigStructValue: types.StringValue("region-from-config"),
 		},
-		// This test currently fails - PF code doesn't behave like SDK code
-		// TODO(SarahFrench) - address https://github.com/hashicorp/terraform-provider-google/issues/15714
-		// "region values can be supplied as a self link": {
-		// 	ConfigValues: fwmodels.ProviderModel{
-		// 		Region: types.StringValue("https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1"),
-		// 	},
-		// 	ExpectedDataModelValue:    types.StringValue("https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1"),
-		// 	ExpectedConfigStructValue: types.StringValue("us-central1"),
-		// },
+		"region values can be supplied as a self link": {
+			ConfigValues: fwmodels.ProviderModel{
+				Region: types.StringValue("https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1"),
+			},
+			ExpectedDataModelValue:    types.StringValue("https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1"),
+			ExpectedConfigStructValue: types.StringValue("us-central1"),
+		},
 		"region value can be set by environment variable: GOOGLE_REGION is used": {
 			ConfigValues: fwmodels.ProviderModel{
 				Region: types.StringNull(),
@@ -549,33 +547,34 @@ func TestFrameworkProvider_LoadAndValidateFramework_region(t *testing.T) {
 			ExpectedConfigStructValue: types.StringNull(),
 		},
 		// Handling empty strings in config
-		// TODO(SarahFrench) make these tests pass to address: https://github.com/hashicorp/terraform-provider-google/issues/14255
-		// "when region is set as an empty string the field is treated as if it's unset, without error": {
-		// 	ConfigValues: fwmodels.ProviderModel{
-		// 		Region: types.StringValue(""),
-		// 	},
-		// 	ExpectedDataModelValue:    types.StringNull(),
-		// 	ExpectedConfigStructValue: types.StringNull(),
-		// },
-		// "when region is set as an empty string an environment variable will be used": {
-		// 	ConfigValues: fwmodels.ProviderModel{
-		// 		Region: types.StringValue(""),
-		// 	},
-		// 	EnvVariables: map[string]string{
-		// 		"GOOGLE_REGION": "region-from-env",
-		// 	},
-		// 	ExpectedDataModelValue:    types.StringValue("region-from-env"),
-		// 	ExpectedConfigStructValue: types.StringValue("region-from-env"),
-		// },
+		"when region is set as an empty string the empty string is used and not ignored": {
+			ConfigValues: fwmodels.ProviderModel{
+				Region: types.StringValue(""),
+			},
+			ExpectedDataModelValue:    types.StringValue(""),
+			ExpectedConfigStructValue: types.StringValue(""),
+		},
+		"when region is set as an empty string, the empty string is not ignored in favor of an environment variable": {
+			ConfigValues: fwmodels.ProviderModel{
+				Region: types.StringValue(""),
+			},
+			EnvVariables: map[string]string{
+				"GOOGLE_REGION": "region-from-env",
+			},
+			ExpectedDataModelValue:    types.StringValue(""),
+			ExpectedConfigStructValue: types.StringValue(""),
+		},
 		// Handling unknown values
-		// TODO(SarahFrench) make these tests pass to address: https://github.com/hashicorp/terraform-provider-google/issues/14444
-		// "when region is an unknown value, the provider treats it as if it's unset (align to SDK behaviour)": {
-		// 	ConfigValues: fwmodels.ProviderModel{
-		// 		Region: types.StringUnknown(),
-		// 	},
-		// 	ExpectedDataModelValue:    types.StringNull(),
-		// 	ExpectedConfigStructValue: types.StringNull(),
-		// },
+		"when region is an unknown value, the provider treats it as if it's unset and uses an environment variable instead": {
+			ConfigValues: fwmodels.ProviderModel{
+				Region: types.StringUnknown(),
+			},
+			EnvVariables: map[string]string{
+				"GOOGLE_REGION": "region-from-env",
+			},
+			ExpectedDataModelValue:    types.StringValue("region-from-env"),
+			ExpectedConfigStructValue: types.StringValue("region-from-env"),
+		},
 	}
 
 	for tn, tc := range cases {
@@ -698,33 +697,34 @@ func TestFrameworkProvider_LoadAndValidateFramework_zone(t *testing.T) {
 			ExpectedConfigStructValue: types.StringNull(),
 		},
 		// Handling empty strings in config
-		// TODO(SarahFrench) make these tests pass to address: https://github.com/hashicorp/terraform-provider-google/issues/14255
-		// "when zone is set as an empty string the field is treated as if it's unset, without error": {
-		// 	ConfigValues: fwmodels.ProviderModel{
-		// 		Zone: types.StringValue(""),
-		// 	},
-		// 	ExpectedDataModelValue:    types.StringNull(),
-		// 	ExpectedConfigStructValue: types.StringNull(),
-		// },
-		// "when zone is set as an empty string an environment variable will be used": {
-		// 	ConfigValues: fwmodels.ProviderModel{
-		// 		Zone: types.StringValue(""),
-		// 	},
-		// 	EnvVariables: map[string]string{
-		// 		"GOOGLE_ZONE": "zone-from-env",
-		// 	},
-		// 	ExpectedDataModelValue:    types.StringValue("zone-from-env"),
-		// 	ExpectedConfigStructValue: types.StringValue("zone-from-env"),
-		// },
+		"when zone is set as an empty string the empty string is used and not ignored": {
+			ConfigValues: fwmodels.ProviderModel{
+				Zone: types.StringValue(""),
+			},
+			ExpectedDataModelValue:    types.StringValue(""),
+			ExpectedConfigStructValue: types.StringValue(""),
+		},
+		"when zone is set as an empty string, the empty string is not ignored in favor of an environment variable": {
+			ConfigValues: fwmodels.ProviderModel{
+				Zone: types.StringValue(""),
+			},
+			EnvVariables: map[string]string{
+				"GOOGLE_ZONE": "zone-from-env",
+			},
+			ExpectedDataModelValue:    types.StringValue(""),
+			ExpectedConfigStructValue: types.StringValue(""),
+		},
 		// Handling unknown values
-		// TODO(SarahFrench) make these tests pass to address: https://github.com/hashicorp/terraform-provider-google/issues/14444
-		// "when zone is an unknown value, the provider treats it as if it's unset (align to SDK behaviour)": {
-		// 	ConfigValues: fwmodels.ProviderModel{
-		// 		Zone: types.StringUnknown(),
-		// 	},
-		// 	ExpectedDataModelValue:    types.StringNull(),
-		// 	ExpectedConfigStructValue: types.StringNull(),
-		// },
+		"when zone is an unknown value, the provider treats it as if it's unset and uses an environment variable instead": {
+			ConfigValues: fwmodels.ProviderModel{
+				Zone: types.StringUnknown(),
+			},
+			EnvVariables: map[string]string{
+				"GOOGLE_ZONE": "zone-from-env",
+			},
+			ExpectedDataModelValue:    types.StringValue("zone-from-env"),
+			ExpectedConfigStructValue: types.StringValue("zone-from-env"),
+		},
 	}
 
 	for tn, tc := range cases {
@@ -779,11 +779,11 @@ func TestFrameworkProvider_LoadAndValidateFramework_accessToken(t *testing.T) {
 	// - ImpersonateServiceAccountDelegates: If we don't set this, we get a nil pointer exception ¯\_(ツ)_/¯
 
 	cases := map[string]struct {
-		ConfigValues              fwmodels.ProviderModel
-		EnvVariables              map[string]string
-		ExpectedDataModelValue    basetypes.StringValue // Sometimes the value is mutated, and no longer matches the original value we supply
+		ConfigValues           fwmodels.ProviderModel
+		EnvVariables           map[string]string
+		ExpectedDataModelValue basetypes.StringValue // Sometimes the value is mutated, and no longer matches the original value we supply
 		// ExpectedConfigStructValue not used here, as credentials info isn't stored in the config struct
-		ExpectError               bool
+		ExpectError bool
 	}{
 		"access_token configured in the provider can be invalid without resulting in errors": {
 			ConfigValues: fwmodels.ProviderModel{
@@ -814,31 +814,31 @@ func TestFrameworkProvider_LoadAndValidateFramework_accessToken(t *testing.T) {
 			ExpectedDataModelValue: types.StringNull(),
 		},
 		// Handling empty strings in config
-		// TODO(SarahFrench) make these tests pass to address: https://github.com/hashicorp/terraform-provider-google/issues/14255
-		// "when access_token is set as an empty string the field is treated as if it's unset, without error (as long as credentials supplied in its absence)": {
-		// 	ConfigValues: fwmodels.ProviderModel{
-		// 		AccessToken: types.StringValue(""),
-		// 		Credentials: types.StringValue(transport_tpg.TestFakeCredentialsPath),
-		// 	},
-		// 	ExpectedDataModelValue: types.StringNull(),
-		// },
-		// "when access_token is set as an empty string in the config, an environment variable is used": {
-		// 	ConfigValues: fwmodels.ProviderModel{
-		// 		AccessToken: types.StringValue(""),
-		// 	},
-		// 	EnvVariables: map[string]string{
-		// 		"GOOGLE_OAUTH_ACCESS_TOKEN": "value-from-GOOGLE_OAUTH_ACCESS_TOKEN",
-		// 	},
-		// 	ExpectedDataModelValue: types.StringValue("value-from-GOOGLE_OAUTH_ACCESS_TOKEN"),
-		// },
+		"when access_token is set as an empty string the empty string is used and not ignored": {
+			ConfigValues: fwmodels.ProviderModel{
+				AccessToken: types.StringValue(""),
+			},
+			ExpectedDataModelValue: types.StringValue(""),
+		},
+		"when access_token is set as an empty string, the empty string is not ignored in favor of an environment variable": {
+			ConfigValues: fwmodels.ProviderModel{
+				AccessToken: types.StringValue(""),
+			},
+			EnvVariables: map[string]string{
+				"GOOGLE_OAUTH_ACCESS_TOKEN": "value-from-GOOGLE_OAUTH_ACCESS_TOKEN",
+			},
+			ExpectedDataModelValue: types.StringValue(""),
+		},
 		// Handling unknown values
-		// TODO(SarahFrench) make these tests pass to address: https://github.com/hashicorp/terraform-provider-google/issues/14444
-		// "when access_token is an unknown value, the provider treats it as if it's unset (align to SDK behaviour)": {
-		// 	ConfigValues: fwmodels.ProviderModel{
-		// 		AccessToken: types.StringUnknown(),
-		// 	},
-		// 	ExpectedDataModelValue:    types.StringNull(),
-		// },
+		"when access_token is an unknown value, the provider treats it as if it's unset and uses an environment variable instead": {
+			ConfigValues: fwmodels.ProviderModel{
+				AccessToken: types.StringUnknown(),
+			},
+			EnvVariables: map[string]string{
+				"GOOGLE_OAUTH_ACCESS_TOKEN": "value-from-GOOGLE_OAUTH_ACCESS_TOKEN",
+			},
+			ExpectedDataModelValue: types.StringValue("value-from-GOOGLE_OAUTH_ACCESS_TOKEN"),
+		},
 	}
 
 	for tn, tc := range cases {
@@ -960,14 +960,16 @@ func TestFrameworkProvider_LoadAndValidateFramework_userProjectOverride(t *testi
 			ExpectedConfigStructValue: types.BoolNull(),
 		},
 		// Handling unknown values
-		// TODO(SarahFrench) make these tests pass to address: https://github.com/hashicorp/terraform-provider-google/issues/14444
-		// "when user_project_override is an unknown value, the provider treats it as if it's unset (align to SDK behaviour)": {
-		// 	ConfigValues: fwmodels.ProviderModel{
-		// 		UserProjectOverride: types.BoolUnknown(),
-		// 	},
-		// 	ExpectedDataModelValue:    types.BoolNull(),
-		// 	ExpectedConfigStructValue: types.BoolNull(),
-		// },
+		"when user_project_override is an unknown value, the provider treats it as if it's unset and uses an environment variable instead": {
+			ConfigValues: fwmodels.ProviderModel{
+				UserProjectOverride: types.BoolUnknown(),
+			},
+			EnvVariables: map[string]string{
+				"USER_PROJECT_OVERRIDE": "true",
+			},
+			ExpectedDataModelValue:    types.BoolValue(true),
+			ExpectedConfigStructValue: types.BoolValue(true),
+		},
 	}
 
 	for tn, tc := range cases {
@@ -999,7 +1001,7 @@ func TestFrameworkProvider_LoadAndValidateFramework_userProjectOverride(t *testi
 			if diags.HasError() && !tc.ExpectError {
 				for i, err := range diags.Errors() {
 					num := i + 1
-					t.Logf("unexpected error #%d : %s", num, err.Summary())
+					t.Logf("unexpected error #%d : %s : %s", num, err.Summary(), err.Detail())
 				}
 				t.Fatalf("did not expect error, but [%d] error(s) occurred", diags.ErrorsCount())
 			}
@@ -1054,21 +1056,31 @@ func TestFrameworkProvider_LoadAndValidateFramework_impersonateServiceAccount(t
 			ExpectedDataModelValue: types.StringNull(),
 		},
 		// Handling empty strings in config
-		// TODO(SarahFrench) make these tests pass to address: https://github.com/hashicorp/terraform-provider-google/issues/14255
-		// "when impersonate_service_account is set as an empty array the field is treated as if it's unset, without error": {
-		// 	ConfigValues: fwmodels.ProviderModel{
-		// 		ImpersonateServiceAccount: types.StringValue(""),
-		// 	},
-		// 	ExpectedDataModelValue: types.StringNull(),
-		// },
+		"when impersonate_service_account is set as an empty string the empty string is used and not ignored": {
+			ConfigValues: fwmodels.ProviderModel{
+				ImpersonateServiceAccount: types.StringValue(""),
+			},
+			ExpectedDataModelValue: types.StringValue(""),
+		},
+		"when impersonate_service_account is set as an empty string, the empty string is not ignored in favor of an environment variable": {
+			ConfigValues: fwmodels.ProviderModel{
+				ImpersonateServiceAccount: types.StringValue(""),
+			},
+			EnvVariables: map[string]string{
+				"GOOGLE_IMPERSONATE_SERVICE_ACCOUNT": "value-from-env@example.com",
+			},
+			ExpectedDataModelValue: types.StringValue(""),
+		},
 		// Handling unknown values
-		// TODO(SarahFrench) make these tests pass to address: https://github.com/hashicorp/terraform-provider-google/issues/14444
-		// "when impersonate_service_account is an unknown value, the provider treats it as if it's unset (align to SDK behaviour)": {
-		// 	ConfigValues: fwmodels.ProviderModel{
-		// 		ImpersonateServiceAccount: types.StringUnknown(),
-		// 	},
-		// 	ExpectedDataModelValue:    types.StringNull(),
-		// },
+		"when impersonate_service_account is an unknown value, the provider treats it as if it's unset and uses an environment variable instead": {
+			ConfigValues: fwmodels.ProviderModel{
+				ImpersonateServiceAccount: types.StringUnknown(),
+			},
+			EnvVariables: map[string]string{
+				"GOOGLE_IMPERSONATE_SERVICE_ACCOUNT": "value-from-env@example.com",
+			},
+			ExpectedDataModelValue: types.StringValue("value-from-env@example.com"),
+		},
 	}
 
 	for tn, tc := range cases {
@@ -1100,7 +1112,7 @@ func TestFrameworkProvider_LoadAndValidateFramework_impersonateServiceAccount(t
 			if diags.HasError() && !tc.ExpectError {
 				for i, err := range diags.Errors() {
 					num := i + 1
-					t.Logf("unexpected error #%d : %s", num, err.Summary())
+					t.Logf("unexpected error #%d : %s : %s", num, err.Summary(), err.Detail())
 				}
 				t.Fatalf("did not expect error, but [%d] error(s) occurred", diags.ErrorsCount())
 			}
@@ -1126,9 +1138,11 @@ func TestFrameworkProvider_LoadAndValidateFramework_impersonateServiceAccountDel
 		SetAsUnknown                            bool
 		ImpersonateServiceAccountDelegatesValue []string
 		EnvVariables                            map[string]string
-		ExpectedDataModelValue                  []string
-		// ExpectedConfigStructValue not used here, as impersonate_service_account_delegates info isn't stored in the config struct
-		ExpectError bool
+
+		ExpectedNull           bool
+		ExpectedUnknown        bool
+		ExpectedDataModelValue []string
+		ExpectError            bool
 	}{
 		"impersonate_service_account_delegates value can be set in the provider schema": {
 			ImpersonateServiceAccountDelegatesValue: []string{
@@ -1142,20 +1156,19 @@ func TestFrameworkProvider_LoadAndValidateFramework_impersonateServiceAccountDel
 		},
 		// Note: no environment variables can be used for impersonate_service_account_delegates
 		"when no impersonate_service_account_delegates value is provided via config, the field remains unset without error": {
-			SetAsNull: true, // not setting impersonate_service_account_delegates
-			ExpectedDataModelValue: nil,
+			SetAsNull:    true, // not setting impersonate_service_account_delegates
+			ExpectedNull: true,
 		},
 		// Handling empty values in config
-		"when impersonate_service_account_delegates is set as an empty array the field is treated as if it's unset, without error": {
+		"when impersonate_service_account_delegates is set as an empty array, that value isn't ignored": {
 			ImpersonateServiceAccountDelegatesValue: []string{},
 			ExpectedDataModelValue:                  []string{},
 		},
 		// Handling unknown values
-		// TODO(SarahFrench) make these tests pass to address: https://github.com/hashicorp/terraform-provider-google/issues/14444
-		// "when impersonate_service_account_delegates is an unknown value, the provider treats it as if it's unset (align to SDK behaviour)": {
-		// 	SetAsUnknown: true,
-		// 	// Currently this causes an error at google/fwtransport/framework_config.go:1518
-		// },
+		"when impersonate_service_account_delegates is an unknown value, the provider treats it as if it's unset, without error": {
+			SetAsUnknown:    true,
+			ExpectedUnknown: true,
+		},
 	}
 
 	for tn, tc := range cases {
@@ -1196,16 +1209,536 @@ func TestFrameworkProvider_LoadAndValidateFramework_impersonateServiceAccountDel
 			if diags.HasError() && !tc.ExpectError {
 				for i, err := range diags.Errors() {
 					num := i + 1
-					t.Logf("unexpected error #%d : %s", num, err.Summary())
+					t.Logf("unexpected error #%d : %s : %s", num, err.Summary(), err.Detail())
 				}
 				t.Fatalf("did not expect error, but [%d] error(s) occurred", diags.ErrorsCount())
 			}
 			// Checking mutation of the data model
-			expected, _ := types.ListValueFrom(ctx, types.StringType, tc.ExpectedDataModelValue)
+			var expected attr.Value
+			if !tc.ExpectedNull && !tc.ExpectedUnknown {
+				expected, _ = types.ListValueFrom(ctx, types.StringType, tc.ExpectedDataModelValue)
+			}
+			if tc.ExpectedNull {
+				expected = types.ListNull(types.StringType)
+			}
+			if tc.ExpectedUnknown {
+				expected = types.ListUnknown(types.StringType)
+			}
 			if !data.ImpersonateServiceAccountDelegates.Equal(expected) {
 				t.Fatalf("want impersonate_service_account in the `fwmodels.ProviderModel` struct to be `%s`, but got the value `%s`", expected, data.ImpersonateServiceAccountDelegates.String())
 			}
 			// fwtransport.FrameworkProviderConfig does not store impersonate_service_account info, so test does not make assertions on config struct
 		})
 	}
-}
\ No newline at end of file
+}
+
+func TestFrameworkProvider_LoadAndValidateFramework_scopes(t *testing.T) {
+
+	// Note: In the test function we need to set the below fields in test case's fwmodels.ProviderModel value
+	// this is to stop the code under tests experiencing errors, and could be addressed in future refactoring.
+	// - Credentials: If we don't set this then the test looks for application default credentials and can fail depending on the machine running the test
+	// - ImpersonateServiceAccountDelegates: If we don't set this, we get a nil pointer exception ¯\_(ツ)_/¯
+
+	cases := map[string]struct {
+		ScopesValue               []string
+		EnvVariables              map[string]string
+		ExpectedDataModelValue    []string
+		ExpectedConfigStructValue []string
+		SetAsNull                 bool
+		SetAsUnknown              bool
+		ExpectError               bool
+	}{
+		"scopes are set in the provider config as a list": {
+			ScopesValue:               []string{"fizz", "buzz", "baz"},
+			ExpectedDataModelValue:    []string{"fizz", "buzz", "baz"},
+			ExpectedConfigStructValue: []string{"fizz", "buzz", "baz"},
+		},
+		"scopes can be left unset in the provider config without any issues, and a default value is used": {
+			SetAsNull:                 true,
+			ExpectedDataModelValue:    transport_tpg.DefaultClientScopes,
+			ExpectedConfigStructValue: transport_tpg.DefaultClientScopes,
+		},
+		// Handling empty values in config
+		"scopes set as an empty list the field is treated as if it's unset and a default value is used without errors": {
+			ScopesValue:               []string{},
+			ExpectedDataModelValue:    transport_tpg.DefaultClientScopes,
+			ExpectedConfigStructValue: transport_tpg.DefaultClientScopes,
+		},
+		// Handling unknown values
+		"when scopes is an unknown value, the provider treats it as if it's unset and a default value is used without errors": {
+			SetAsUnknown:              true,
+			ExpectedDataModelValue:    transport_tpg.DefaultClientScopes,
+			ExpectedConfigStructValue: transport_tpg.DefaultClientScopes,
+		},
+	}
+
+	for tn, tc := range cases {
+		t.Run(tn, func(t *testing.T) {
+
+			// Arrange
+			acctest.UnsetTestProviderConfigEnvs(t)
+			acctest.SetupTestEnvs(t, tc.EnvVariables)
+
+			ctx := context.Background()
+			tfVersion := "foobar"
+			providerversion := "999"
+			diags := diag.Diagnostics{}
+
+			data := fwmodels.ProviderModel{}
+			data.Credentials = types.StringValue(transport_tpg.TestFakeCredentialsPath)
+			impersonateServiceAccountDelegates, _ := types.ListValue(types.StringType, []attr.Value{}) // empty list
+			data.ImpersonateServiceAccountDelegates = impersonateServiceAccountDelegates
+			// Set ImpersonateServiceAccountDelegates depending on test case
+			if !tc.SetAsNull && !tc.SetAsUnknown {
+				s, _ := types.ListValueFrom(ctx, types.StringType, tc.ScopesValue)
+				data.Scopes = s
+			}
+			if tc.SetAsNull {
+				data.Scopes = types.ListNull(types.StringType)
+			}
+			if tc.SetAsUnknown {
+				data.Scopes = types.ListUnknown(types.StringType)
+			}
+
+			p := fwtransport.FrameworkProviderConfig{}
+
+			// Act
+			p.LoadAndValidateFramework(ctx, &data, tfVersion, &diags, providerversion)
+
+			// Assert
+			if diags.HasError() && tc.ExpectError {
+				return
+			}
+			if diags.HasError() && !tc.ExpectError {
+				for i, err := range diags.Errors() {
+					num := i + 1
+					t.Logf("unexpected error #%d : %s : %s", num, err.Summary(), err.Detail())
+				}
+				t.Fatalf("did not expect error, but [%d] error(s) occurred", diags.ErrorsCount())
+			}
+			// Checking mutation of the data model
+			expectedDm, _ := types.ListValueFrom(ctx, types.StringType, tc.ExpectedDataModelValue)
+			if !data.Scopes.Equal(expectedDm) {
+				t.Fatalf("want project in the `fwmodels.ProviderModel` struct to be `%s`, but got the value `%s`", tc.ExpectedDataModelValue, data.Scopes.String())
+			}
+			// Checking the value passed to the config structs
+			expectedFpc, _ := types.ListValueFrom(ctx, types.StringType, tc.ExpectedConfigStructValue)
+			if !p.Scopes.Equal(expectedFpc) {
+				t.Fatalf("want project in the `FrameworkProviderConfig` struct to be `%s`, but got the value `%s`", tc.ExpectedConfigStructValue, p.Scopes.String())
+			}
+		})
+	}
+}
+
+func TestFrameworkProvider_LoadAndValidateFramework_requestReason(t *testing.T) {
+
+	// Note: In the test function we need to set the below fields in test case's fwmodels.ProviderModel value
+	// this is to stop the code under tests experiencing errors, and could be addressed in future refactoring.
+	// - Credentials: If we don't set this then the test looks for application default credentials and can fail depending on the machine running the test
+	// - ImpersonateServiceAccountDelegates: If we don't set this, we get a nil pointer exception ¯\_(ツ)_/¯
+
+	cases := map[string]struct {
+		ConfigValues           fwmodels.ProviderModel
+		EnvVariables           map[string]string
+		ExpectedDataModelValue basetypes.StringValue
+		// ExpectedConfigStructValue not used here, as credentials info isn't stored in the config struct
+		ExpectError bool
+	}{
+		"when request_reason is unset in the config, environment variable CLOUDSDK_CORE_REQUEST_REASON is used": {
+			ConfigValues: fwmodels.ProviderModel{
+				RequestReason: types.StringNull(),
+			},
+			EnvVariables: map[string]string{
+				"CLOUDSDK_CORE_REQUEST_REASON": "foo",
+			},
+			ExpectedDataModelValue: types.StringValue("foo"),
+		},
+		"request_reason set in the config is not overridden by environment variables": {
+			ConfigValues: fwmodels.ProviderModel{
+				RequestReason: types.StringValue("value-from-config"),
+			},
+			EnvVariables: map[string]string{
+				"CLOUDSDK_CORE_REQUEST_REASON": "value-from-env",
+			},
+			ExpectedDataModelValue: types.StringValue("value-from-config"),
+		},
+		"when no request_reason is provided via config or environment variables, the field remains unset without error": {
+			ConfigValues: fwmodels.ProviderModel{
+				RequestReason: types.StringNull(),
+			},
+			ExpectedDataModelValue: types.StringNull(),
+		},
+		// Handling empty strings in config
+		"when request_reason is set as an empty string, the empty string is not ignored in favor of an environment variable": {
+			ConfigValues: fwmodels.ProviderModel{
+				RequestReason: types.StringValue(""),
+			},
+			EnvVariables: map[string]string{
+				"CLOUDSDK_CORE_REQUEST_REASON": "foo",
+			},
+			ExpectedDataModelValue: types.StringValue(""),
+		},
+		"when request_reason is set as an empty string the empty string is used and not ignored": {
+			ConfigValues: fwmodels.ProviderModel{
+				RequestReason: types.StringValue(""),
+			},
+			ExpectedDataModelValue: types.StringValue(""),
+		},
+		// Handling unknown values
+		"when request_reason is an unknown value, the provider treats it as if it's unset and uses an environment variable instead": {
+			ConfigValues: fwmodels.ProviderModel{
+				RequestReason: types.StringUnknown(),
+			},
+			EnvVariables: map[string]string{
+				"CLOUDSDK_CORE_REQUEST_REASON": "foo",
+			},
+			ExpectedDataModelValue: types.StringValue("foo"),
+		},
+	}
+
+	for tn, tc := range cases {
+		t.Run(tn, func(t *testing.T) {
+
+			// Arrange
+			acctest.UnsetTestProviderConfigEnvs(t)
+			acctest.SetupTestEnvs(t, tc.EnvVariables)
+
+			ctx := context.Background()
+			tfVersion := "foobar"
+			providerversion := "999"
+			diags := diag.Diagnostics{}
+
+			data := tc.ConfigValues
+			data.Credentials = types.StringValue(transport_tpg.TestFakeCredentialsPath)
+			impersonateServiceAccountDelegates, _ := types.ListValue(types.StringType, []attr.Value{}) // empty list
+			data.ImpersonateServiceAccountDelegates = impersonateServiceAccountDelegates
+
+			p := fwtransport.FrameworkProviderConfig{}
+
+			// Act
+			p.LoadAndValidateFramework(ctx, &data, tfVersion, &diags, providerversion)
+
+			// Assert
+			if diags.HasError() && tc.ExpectError {
+				return
+			}
+			if diags.HasError() && !tc.ExpectError {
+				for i, err := range diags.Errors() {
+					num := i + 1
+					t.Logf("unexpected error #%d : %s : %s", num, err.Summary(), err.Detail())
+				}
+				t.Fatalf("did not expect error, but [%d] error(s) occurred", diags.ErrorsCount())
+			}
+			// Checking mutation of the data model
+			if !data.RequestReason.Equal(tc.ExpectedDataModelValue) {
+				t.Fatalf("want request_reason in the `fwmodels.ProviderModel` struct to be `%s`, but got the value `%s`", tc.ExpectedDataModelValue, data.RequestReason.String())
+			}
+			// fwtransport.FrameworkProviderConfig does not store the request reason info, so test does not make assertions on config struct
+		})
+	}
+}
+
+func TestFrameworkProvider_LoadAndValidateFramework_requestTimeout(t *testing.T) {
+
+	// Note: In the test function we need to set the below fields in test case's fwmodels.ProviderModel value
+	// this is to stop the code under tests experiencing errors, and could be addressed in future refactoring.
+	// - Credentials: If we don't set this then the test looks for application default credentials and can fail depending on the machine running the test
+	// - ImpersonateServiceAccountDelegates: If we don't set this, we get a nil pointer exception ¯\_(ツ)_/¯
+
+	cases := map[string]struct {
+		ConfigValues           fwmodels.ProviderModel
+		EnvVariables           map[string]string
+		ExpectedDataModelValue basetypes.StringValue
+		// ExpectedConfigStructValue not used here, as credentials info isn't stored in the config struct
+		ExpectError bool
+	}{
+		"if a valid request_timeout is configured in the provider, no error will occur": {
+			ConfigValues: fwmodels.ProviderModel{
+				RequestTimeout: types.StringValue("10s"),
+			},
+			ExpectedDataModelValue: types.StringValue("10s"),
+		},
+		"if an invalid request_timeout is configured in the provider, an error will occur": {
+			ConfigValues: fwmodels.ProviderModel{
+				RequestTimeout: types.StringValue("timeout"),
+			},
+			ExpectError: true,
+		},
+		"when request_timeout is set as an empty string, the empty string isn't ignored and an error will occur": {
+			ConfigValues: fwmodels.ProviderModel{
+				RequestTimeout: types.StringValue(""),
+			},
+			ExpectError: true,
+		},
+		// In the SDK version of the provider config code, this scenario results in a value of "0s"
+		// instead of "120s", but the final 'effective' value is also "120s"
+		// See : https://github.com/hashicorp/terraform-provider-google/blob/09cb850ee64bcd78e4457df70905530c1ed75f19/google/transport/config.go#L1228-L1233
+		"when request_timeout is unset in the config, the default value is 120s.": {
+			ConfigValues: fwmodels.ProviderModel{
+				RequestTimeout: types.StringNull(),
+			},
+			ExpectedDataModelValue: types.StringValue("120s"),
+		},
+		// Handling unknown values
+		"when request_timeout is an unknown value, the provider treats it as if it's unset and uses the default value 120s": {
+			ConfigValues: fwmodels.ProviderModel{
+				RequestTimeout: types.StringUnknown(),
+			},
+			ExpectedDataModelValue: types.StringValue("120s"),
+		},
+	}
+
+	for tn, tc := range cases {
+		t.Run(tn, func(t *testing.T) {
+
+			// Arrange
+			acctest.UnsetTestProviderConfigEnvs(t)
+			acctest.SetupTestEnvs(t, tc.EnvVariables)
+
+			ctx := context.Background()
+			tfVersion := "foobar"
+			providerversion := "999"
+			diags := diag.Diagnostics{}
+
+			data := tc.ConfigValues
+			data.Credentials = types.StringValue(transport_tpg.TestFakeCredentialsPath)
+			impersonateServiceAccountDelegates, _ := types.ListValue(types.StringType, []attr.Value{}) // empty list
+			data.ImpersonateServiceAccountDelegates = impersonateServiceAccountDelegates
+
+			p := fwtransport.FrameworkProviderConfig{}
+
+			// Act
+			p.LoadAndValidateFramework(ctx, &data, tfVersion, &diags, providerversion)
+
+			// Assert
+			if diags.HasError() && tc.ExpectError {
+				return
+			}
+			if diags.HasError() && !tc.ExpectError {
+				for i, err := range diags.Errors() {
+					num := i + 1
+					t.Logf("unexpected error #%d : %s : %s", num, err.Summary(), err.Detail())
+				}
+				t.Fatalf("did not expect error, but [%d] error(s) occurred", diags.ErrorsCount())
+			}
+			// Checking mutation of the data model
+			if !data.RequestTimeout.Equal(tc.ExpectedDataModelValue) {
+				t.Fatalf("want request_timeout in the `fwmodels.ProviderModel` struct to be `%s`, but got the value `%s`", tc.ExpectedDataModelValue, data.RequestTimeout.String())
+			}
+			// fwtransport.FrameworkProviderConfig does not store the request timeout info, so test does not make assertions on config struct
+		})
+	}
+}
+
+func TestFrameworkProvider_LoadAndValidateFramework_batching(t *testing.T) {
+
+	// Note: In the test function we need to set the below fields in test case's fwmodels.ProviderModel value
+	// this is to stop the code under tests experiencing errors, and could be addressed in future refactoring.
+	// - Credentials: If we don't set this then the test looks for application default credentials and can fail depending on the machine running the test
+	// - ImpersonateServiceAccountDelegates: If we don't set this, we get a nil pointer exception ¯\_(ツ)_/¯
+
+	cases := map[string]struct {
+		// It's not easy to create the value of Batching in the test case, so these inputs are used in the test function
+		SetBatchingAsNull    bool
+		SetBatchingAsUnknown bool
+		EnableBatchingValue  basetypes.BoolValue
+		SendAfterValue       basetypes.StringValue
+
+		EnvVariables map[string]string
+
+		ExpectBatchingNull        bool
+		ExpectBatchingUnknown     bool
+		ExpectEnableBatchingValue basetypes.BoolValue
+		ExpectSendAfterValue      basetypes.StringValue
+		ExpectError               bool
+	}{
+		"batching can be configured with values for enable_batching and send_after": {
+			EnableBatchingValue:       types.BoolValue(true),
+			SendAfterValue:            types.StringValue("45s"),
+			ExpectEnableBatchingValue: types.BoolValue(true),
+			ExpectSendAfterValue:      types.StringValue("45s"),
+		},
+		"if batching is an empty block, it will set the default values for enable_batching and send_after": {
+			// In this test, we try to create a list containing only null values
+			EnableBatchingValue:       types.BoolNull(),
+			SendAfterValue:            types.StringNull(),
+			ExpectEnableBatchingValue: types.BoolValue(true),
+			ExpectSendAfterValue:      types.StringValue("10s"),
+		},
+		"when batching is configured with only enable_batching, send_after will be set to a default value": {
+			EnableBatchingValue:       types.BoolValue(true),
+			SendAfterValue:            types.StringNull(),
+			ExpectEnableBatchingValue: types.BoolValue(true),
+			ExpectSendAfterValue:      types.StringValue("10s"),
+		},
+		"when batching is configured with only send_after, enable_batching will be set to a default value": {
+			EnableBatchingValue:       types.BoolNull(),
+			SendAfterValue:            types.StringValue("45s"),
+			ExpectEnableBatchingValue: types.BoolValue(true),
+			ExpectSendAfterValue:      types.StringValue("45s"),
+		},
+		"when the whole batching block is a null value, the provider provides default values for send_after and enable_batching": {
+			SetBatchingAsNull:         true,
+			ExpectEnableBatchingValue: types.BoolValue(true),
+			ExpectSendAfterValue:      types.StringValue("3s"),
+		},
+		// Handling unknown values
+		"when batching is an unknown value, the provider treats it as if it's unset (align to SDK behaviour)": {
+			SetBatchingAsUnknown:      true,
+			ExpectEnableBatchingValue: types.BoolValue(true),
+			ExpectSendAfterValue:      types.StringValue("3s"),
+		},
+		"when batching is configured with send_after as an unknown value, send_after will be set to a default value": {
+			EnableBatchingValue:       types.BoolValue(true),
+			SendAfterValue:            types.StringUnknown(),
+			ExpectEnableBatchingValue: types.BoolValue(true),
+			ExpectSendAfterValue:      types.StringValue("10s"),
+		},
+		"when batching is configured with enable_batching as an unknown value, enable_batching will be set to a default value": {
+			EnableBatchingValue:       types.BoolUnknown(),
+			SendAfterValue:            types.StringValue("45s"),
+			ExpectEnableBatchingValue: types.BoolValue(true),
+			ExpectSendAfterValue:      types.StringValue("45s"),
+		},
+		// Error states
+		"when batching is configured with send_after as an empty string, the empty string is not ignored and results in an error": {
+			EnableBatchingValue: types.BoolValue(true),
+			SendAfterValue:      types.StringValue(""),
+			ExpectError:         true,
+		},
+		"if batching is configured with send_after as an invalid value, there's an error": {
+			SendAfterValue: types.StringValue("invalid value"),
+			ExpectError:    true,
+		},
+		"if batching is configured with send_after as number value without seconds (s), there's an error": {
+			SendAfterValue: types.StringValue("123"),
+			ExpectError:    true,
+		},
+	}
+
+	for tn, tc := range cases {
+		t.Run(tn, func(t *testing.T) {
+
+			// Arrange
+			acctest.UnsetTestProviderConfigEnvs(t)
+			acctest.SetupTestEnvs(t, tc.EnvVariables)
+
+			ctx := context.Background()
+			tfVersion := "foobar"
+			providerversion := "999"
+			diags := diag.Diagnostics{}
+
+			data := fwmodels.ProviderModel{}
+			data.Credentials = types.StringValue(transport_tpg.TestFakeCredentialsPath)
+			impersonateServiceAccountDelegates, _ := types.ListValue(types.StringType, []attr.Value{}) // empty list
+			data.ImpersonateServiceAccountDelegates = impersonateServiceAccountDelegates
+
+			// TODO(SarahFrench) - this code will change when batching is reworked
+			// See https://github.com/GoogleCloudPlatform/magic-modules/pull/7668
+			if !tc.SetBatchingAsNull && !tc.SetBatchingAsUnknown {
+				b, _ := types.ObjectValue(
+					map[string]attr.Type{
+						"enable_batching": types.BoolType,
+						"send_after":      types.StringType,
+					},
+					map[string]attr.Value{
+						"enable_batching": tc.EnableBatchingValue,
+						"send_after":      tc.SendAfterValue,
+					},
+				)
+				batching, _ := types.ListValue(types.ObjectType{}.WithAttributeTypes(fwmodels.ProviderBatchingAttributes), []attr.Value{b})
+				data.Batching = batching
+			}
+			if tc.SetBatchingAsNull {
+				data.Batching = types.ListNull(types.ObjectType{}.WithAttributeTypes(fwmodels.ProviderBatchingAttributes))
+			}
+			if tc.SetBatchingAsUnknown {
+				data.Batching = types.ListUnknown(types.ObjectType{}.WithAttributeTypes(fwmodels.ProviderBatchingAttributes))
+			}
+
+			p := fwtransport.FrameworkProviderConfig{}
+
+			// Act
+			p.LoadAndValidateFramework(ctx, &data, tfVersion, &diags, providerversion)
+
+			// Assert
+			if diags.HasError() && tc.ExpectError {
+				return
+			}
+			if diags.HasError() && !tc.ExpectError {
+				for i, err := range diags.Errors() {
+					num := i + 1
+					t.Logf("unexpected error #%d : %s", num, err.Summary())
+				}
+				t.Fatalf("did not expect error, but [%d] error(s) occurred", diags.ErrorsCount())
+			}
+			// Checking mutation of the data model
+			if !data.Batching.IsNull() && tc.ExpectBatchingNull {
+				t.Fatalf("want batching in the `fwmodels.ProviderModel` struct to be null, but got the value `%s`", data.Batching.String())
+			}
+			if !data.Batching.IsUnknown() && tc.ExpectBatchingUnknown {
+				t.Fatalf("want batching in the `fwmodels.ProviderModel` struct to be unknown, but got the value `%s`", data.Batching.String())
+			}
+
+			// The code doesn't mutate values in the fwmodels.ProviderModel struct if the whole batching block is null/unknown,
+			// so run these checks below only if we're not setting the whole batching block is null/unknown
+			if !tc.SetBatchingAsNull && !tc.SetBatchingAsUnknown {
+				var pbConfigs []fwmodels.ProviderBatching
+				_ = data.Batching.ElementsAs(ctx, &pbConfigs, true)
+				if !pbConfigs[0].EnableBatching.Equal(tc.ExpectEnableBatchingValue) {
+					t.Fatalf("want batching.enable_batching in the `fwmodels.ProviderModel` struct to be `%s`, but got the value `%s`", tc.ExpectEnableBatchingValue.String(), pbConfigs[0].EnableBatching.String())
+				}
+				if !pbConfigs[0].SendAfter.Equal(tc.ExpectSendAfterValue) {
+					t.Fatalf("want batching.send_after in the `fwmodels.ProviderModel` struct to be `%s`, but got the value `%s`", tc.ExpectSendAfterValue.String(), pbConfigs[0].SendAfter.String())
+				}
+			}
+
+			// Check how the batching block's values are used to configure other parts of the `FrameworkProviderConfig` struct
+			// - RequestBatcherServiceUsage
+			// - RequestBatcherIam
+			if p.RequestBatcherServiceUsage.BatchingConfig.EnableBatching != tc.ExpectEnableBatchingValue.ValueBool() {
+				t.Fatalf("want batching.enable_batching to be `%s`, but got the value `%v`", tc.ExpectEnableBatchingValue.String(), p.RequestBatcherServiceUsage.BatchingConfig.EnableBatching)
+			}
+			if !types.StringValue(p.RequestBatcherServiceUsage.BatchingConfig.SendAfter.String()).Equal(tc.ExpectSendAfterValue) {
+				t.Fatalf("want batching.send_after to be `%s`, but got the value `%s`", tc.ExpectSendAfterValue.String(), p.RequestBatcherServiceUsage.BatchingConfig.SendAfter.String())
+			}
+			if p.RequestBatcherIam.BatchingConfig.EnableBatching != tc.ExpectEnableBatchingValue.ValueBool() {
+				t.Fatalf("want batching.enable_batching to be `%s`, but got the value `%v`", tc.ExpectEnableBatchingValue.String(), p.RequestBatcherIam.BatchingConfig.EnableBatching)
+			}
+			if !types.StringValue(p.RequestBatcherIam.BatchingConfig.SendAfter.String()).Equal(tc.ExpectSendAfterValue) {
+				t.Fatalf("want batching.send_after to be `%s`, but got the value `%s`", tc.ExpectSendAfterValue.String(), p.RequestBatcherIam.BatchingConfig.SendAfter.String())
+			}
+		})
+	}
+}
+
+func TestGetRegionFromRegionSelfLink(t *testing.T) {
+	cases := map[string]struct {
+		Input          basetypes.StringValue
+		ExpectedOutput basetypes.StringValue
+	}{
+		"A short region name is returned unchanged": {
+			Input:          types.StringValue("us-central1"),
+			ExpectedOutput: types.StringValue("us-central1"),
+		},
+		"A selflink is shortened to a region name": {
+			Input:          types.StringValue("https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1"),
+			ExpectedOutput: types.StringValue("us-central1"),
+		},
+		"Logic is specific to region selflinks; zone selflinks are not shortened": {
+			Input:          types.StringValue("https://www.googleapis.com/compute/v1/projects/my-project/zones/asia-east1-a"),
+			ExpectedOutput: types.StringValue("https://www.googleapis.com/compute/v1/projects/my-project/zones/asia-east1-a"),
+		},
+	}
+
+	for tn, tc := range cases {
+		t.Run(tn, func(t *testing.T) {
+
+			region := fwtransport.GetRegionFromRegionSelfLink(tc.Input)
+
+			if region != tc.ExpectedOutput {
+				t.Fatalf("want %s,  got %s", region, tc.ExpectedOutput)
+			}
+		})
+	}
+}
diff --git a/mmv1/third_party/terraform/go.mod.erb b/mmv1/third_party/terraform/go.mod.erb
index 13b659db12a6..59eabb794b05 100644
--- a/mmv1/third_party/terraform/go.mod.erb
+++ b/mmv1/third_party/terraform/go.mod.erb
@@ -4,7 +4,7 @@ go 1.19
 
 require (
 	cloud.google.com/go/bigtable v1.19.0
-	github.com/GoogleCloudPlatform/declarative-resource-client-library v1.50.0
+	github.com/GoogleCloudPlatform/declarative-resource-client-library v1.56.0
 	github.com/apparentlymart/go-cidr v1.1.0
 	github.com/davecgh/go-spew v1.1.1
 	github.com/dnaeon/go-vcr v1.0.1
@@ -24,20 +24,20 @@ require (
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/mitchellh/hashstructure v1.1.0
 	github.com/sirupsen/logrus v1.8.1
-	golang.org/x/net v0.14.0
-	golang.org/x/oauth2 v0.11.0
-	google.golang.org/api v0.138.0
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20230807174057-1744710a1577
-	google.golang.org/grpc v1.57.0
+	golang.org/x/net v0.17.0
+	golang.org/x/oauth2 v0.13.0
+	google.golang.org/api v0.148.0
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20231012201019-e917dd12ba7a
+	google.golang.org/grpc v1.58.3
 	google.golang.org/protobuf v1.31.0
 )
 
 require (
 	bitbucket.org/creachadair/stringset v0.0.8 // indirect
-	cloud.google.com/go v0.110.6 // indirect
+	cloud.google.com/go v0.110.8 // indirect
 	cloud.google.com/go/compute v1.23.0 // indirect
 	cloud.google.com/go/compute/metadata v0.2.3 // indirect
-	cloud.google.com/go/iam v1.1.1 // indirect
+	cloud.google.com/go/iam v1.1.2 // indirect
 	cloud.google.com/go/longrunning v0.5.1 // indirect
 	github.com/agext/levenshtein v1.2.2 // indirect
 	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
@@ -46,18 +46,18 @@ require (
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/cncf/udpa/go v0.0.0-20220112060539-c52dc94e7fbe // indirect
 	github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4 // indirect
-	github.com/envoyproxy/go-control-plane v0.11.1-0.20230524094728-9239064ad72f // indirect
-	github.com/envoyproxy/protoc-gen-validate v0.10.1 // indirect
+	github.com/envoyproxy/go-control-plane v0.11.1 // indirect
+	github.com/envoyproxy/protoc-gen-validate v1.0.2 // indirect
 	github.com/fatih/color v1.13.0 // indirect
 	github.com/gammazero/deque v0.0.0-20180920172122-f6adf94963e4 // indirect
 	github.com/golang/glog v1.1.0 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/go-cmp v0.5.9 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/go-cpy v0.0.0-20211218193943-a9c933c06932 // indirect
-	github.com/google/s2a-go v0.1.5 // indirect
-	github.com/google/uuid v1.3.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.2.5 // indirect
+	github.com/google/s2a-go v0.1.7 // indirect
+	github.com/google/uuid v1.3.1 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.1 // indirect
 	github.com/googleapis/gax-go/v2 v2.12.0 // indirect
 	github.com/hashicorp/go-checkpoint v0.5.0 // indirect
 	github.com/hashicorp/go-hclog v1.2.1 // indirect
@@ -85,13 +85,13 @@ require (
 	github.com/vmihailenco/tagparser v0.1.2 // indirect
 	github.com/zclconf/go-cty v1.11.0 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	golang.org/x/crypto v0.12.0 // indirect
-	golang.org/x/sync v0.3.0 // indirect
-	golang.org/x/sys v0.11.0 // indirect
-	golang.org/x/text v0.12.0 // indirect
+	golang.org/x/crypto v0.14.0 // indirect
+	golang.org/x/sync v0.4.0 // indirect
+	golang.org/x/sys v0.13.0 // indirect
+	golang.org/x/text v0.13.0 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20230803162519-f966b187b2e5 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20230803162519-f966b187b2e5 // indirect
+	google.golang.org/genproto v0.0.0-20231002182017-d307bd883b97 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20231002182017-d307bd883b97 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 )
diff --git a/mmv1/third_party/terraform/go.sum b/mmv1/third_party/terraform/go.sum
index 205203241069..ae762a901d39 100644
--- a/mmv1/third_party/terraform/go.sum
+++ b/mmv1/third_party/terraform/go.sum
@@ -2,21 +2,21 @@ bitbucket.org/creachadair/stringset v0.0.8 h1:gQqe4vs8XWgMyijfyKE6K8o4TcyGGrRXe0
 bitbucket.org/creachadair/stringset v0.0.8/go.mod h1:AgthVMyMxC/6FK1KBJ2ALdqkZObGN8hOetgpwXyMn34=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.110.6 h1:8uYAkj3YHTP/1iwReuHPxLSbdcyc+dSBbzFMrVwDR6Q=
-cloud.google.com/go v0.110.6/go.mod h1:+EYjdK8e5RME/VY/qLCAtuyALQ9q67dvuum8i+H5xsI=
+cloud.google.com/go v0.110.8 h1:tyNdfIxjzaWctIiLYOTalaLKZ17SI44SKFW26QbOhME=
+cloud.google.com/go v0.110.8/go.mod h1:Iz8AkXJf1qmxC3Oxoep8R1T36w8B92yU29PcBhHO5fk=
 cloud.google.com/go/bigtable v1.19.0 h1:wiq9LT0kukfInzvy1joMDijCw/OD1UChpSbORXYn0LI=
 cloud.google.com/go/bigtable v1.19.0/go.mod h1:xl5kPa8PTkJjdBxg6qdGH88464nNqmbISHSRU+D2yFE=
 cloud.google.com/go/compute v1.23.0 h1:tP41Zoavr8ptEqaW6j+LQOnyBBhO7OkOMAGrgLopTwY=
 cloud.google.com/go/compute v1.23.0/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM=
 cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
 cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
-cloud.google.com/go/iam v1.1.1 h1:lW7fzj15aVIXYHREOqjRBV9PsH0Z6u8Y46a1YGvQP4Y=
-cloud.google.com/go/iam v1.1.1/go.mod h1:A5avdyVL2tCppe4unb0951eI9jreack+RJ0/d+KUZOU=
+cloud.google.com/go/iam v1.1.2 h1:gacbrBdWcoVmGLozRuStX45YKvJtzIjJdAolzUs1sm4=
+cloud.google.com/go/iam v1.1.2/go.mod h1:A5avdyVL2tCppe4unb0951eI9jreack+RJ0/d+KUZOU=
 cloud.google.com/go/longrunning v0.5.1 h1:Fr7TXftcqTudoyRJa113hyaqlGdiBQkp0Gq7tErFDWI=
 cloud.google.com/go/longrunning v0.5.1/go.mod h1:spvimkwdz6SPWKEt/XBij79E9fiTkHSQl/fRUUQJYJc=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/GoogleCloudPlatform/declarative-resource-client-library v1.50.0 h1:tsuB2FrGmDXIPUdhRD6YdUuvIzAly6+RYpyRkKWwk9E=
-github.com/GoogleCloudPlatform/declarative-resource-client-library v1.50.0/go.mod h1:pL2Qt5HT+x6xrTd806oMiM3awW6kNIXB/iiuClz6m6k=
+github.com/GoogleCloudPlatform/declarative-resource-client-library v1.56.0 h1:R8zbp/2oVfPbMF1u6RTkf5s+J4hA6sWAEo8E7xsrbpY=
+github.com/GoogleCloudPlatform/declarative-resource-client-library v1.56.0/go.mod h1:pL2Qt5HT+x6xrTd806oMiM3awW6kNIXB/iiuClz6m6k=
 github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
 github.com/Microsoft/go-winio v0.4.16 h1:FtSW/jqD+l4ba5iPBj9CODVtgfYAD8w2wS923g/cFDk=
 github.com/Microsoft/go-winio v0.4.16/go.mod h1:XB6nPKklQyQ7GC9LdcBEcBl8PF76WugXOPRXwdLnMv0=
@@ -27,7 +27,6 @@ github.com/acomagu/bufpipe v1.0.3/go.mod h1:mxdxdup/WdsKVreO5GpW4+M/1CE2sMG4jeGJ
 github.com/agext/levenshtein v1.2.2 h1:0S/Yg6LYmFJ5stwQeRp6EeOcCbj7xiqQSdNelsXvaqE=
 github.com/agext/levenshtein v1.2.2/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
 github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYUyUczH0OGQWaF5ceTx0UBShxjsH6f8oGKYe2c=
-github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
 github.com/apparentlymart/go-cidr v1.1.0 h1:2mAhrMoF+nhXqxTzSZMUzDHkLjmIHC+Zzn4tdgBZjnU=
 github.com/apparentlymart/go-cidr v1.1.0/go.mod h1:EBcsNrHc3zQeuaeCeCtQruQm+n9/YjEn/vI25Lg7Gwc=
 github.com/apparentlymart/go-dump v0.0.0-20190214190832-042adf3cf4a0 h1:MzVXffFUye+ZcSR6opIgz9Co7WcDx6ZcY+RjfFHoA0I=
@@ -41,18 +40,13 @@ github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QH
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.4.1 h1:iKLQ0xPNFxR/2hzXZMrBo8f1j86j5WHzznCCQxV/b8g=
 github.com/census-instrumentation/opencensus-proto v0.4.1/go.mod h1:4T9NM4+4Vw91VeyqjLS6ao50K5bOcLKN6Q42XnYaRYw=
-github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
 github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
 github.com/cncf/udpa/go v0.0.0-20220112060539-c52dc94e7fbe h1:QQ3GSy+MqSHxm/d8nCtnAiZdYFd45cYZPs8vOOIYKfk=
 github.com/cncf/udpa/go v0.0.0-20220112060539-c52dc94e7fbe/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
-github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4 h1:/inchEIKaYC1Akx+H+gqO04wryn5h75LSazbRlnya1k=
 github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/creachadair/staticfile v0.1.2/go.mod h1:a3qySzCIXEprDGxk6tSxSI+dBBdLzqeBOMhZ+o2d3pM=
@@ -67,13 +61,11 @@ github.com/emirpasic/gods v1.12.0/go.mod h1:YfzfFFoVP/catgzJb4IKIqXjX78Ha8FMSDh3
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
-github.com/envoyproxy/go-control-plane v0.11.1-0.20230524094728-9239064ad72f h1:7T++XKzy4xg7PKy+bM+Sa9/oe1OC88yz2hXQUISoXfA=
-github.com/envoyproxy/go-control-plane v0.11.1-0.20230524094728-9239064ad72f/go.mod h1:sfYdkwUW4BA3PbKjySwjJy+O4Pu0h62rlqCMHNk+K+Q=
+github.com/envoyproxy/go-control-plane v0.11.1 h1:wSUXTlLfiAQRWs2F+p+EKOY9rUyis1MyGqJ2DIk5HpM=
+github.com/envoyproxy/go-control-plane v0.11.1/go.mod h1:uhMcXKCQMEJHiAb0w+YGefQLaTEw+YhGluxZkrTmD0g=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/envoyproxy/protoc-gen-validate v0.10.1 h1:c0g45+xCJhdgFGw7a5QAfdS4byAbud7miNWJ1WwEVf8=
-github.com/envoyproxy/protoc-gen-validate v0.10.1/go.mod h1:DRjgyB0I43LtJapqN6NiRwroiAU2PaFuvk/vjgh61ss=
+github.com/envoyproxy/protoc-gen-validate v1.0.2 h1:QkIBuU5k+x7/QXPvPPnWXWlCdaBFApVqftFV6k087DA=
+github.com/envoyproxy/protoc-gen-validate v1.0.2/go.mod h1:GpiZQP3dDbg4JouG/NNS7QWXpgx6x8QiMKdmN72jogE=
 github.com/fatih/color v1.13.0 h1:8LOYc1KYPPmyKMuN8QV2DNRWNbLo6LZ0iLs8+mlH53w=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
@@ -81,7 +73,6 @@ github.com/gammazero/deque v0.0.0-20180920172122-f6adf94963e4 h1:R+19WKQClnfMXS6
 github.com/gammazero/deque v0.0.0-20180920172122-f6adf94963e4/go.mod h1:GeIq9qoE43YdGnDXURnmKTnGg15pQz4mYkXSTChbneI=
 github.com/gammazero/workerpool v0.0.0-20181230203049-86a96b5d5d92 h1:EipXK6U05IQ2wtuFRn4k3h0+2lXypzItoXGVyf4r9Io=
 github.com/gammazero/workerpool v0.0.0-20181230203049-86a96b5d5d92/go.mod h1:w9RqFVO2BM3xwWEcAB8Fwp0OviTBBEiRmSBDfbXnd3w=
-github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/gliderlabs/ssh v0.2.2/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
 github.com/go-git/gcfg v1.5.0 h1:Q5ViNfGF8zFgyJWPqYwA7qGFoMTEiBmdlkcfRmpIMa4=
 github.com/go-git/gcfg v1.5.0/go.mod h1:5m20vg6GwYabIxaOonVkTdrILxQMpEShl1xiMF4ua+E=
@@ -116,10 +107,8 @@ github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrU
 github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
 github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
 github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
 github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/google/btree v1.1.2 h1:xf4v41cLI2Z6FxbKm+8Bu+m8ifhj15JuZ9sa0jZCMUU=
@@ -131,22 +120,22 @@ github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cpy v0.0.0-20211218193943-a9c933c06932 h1:5/4TSDzpDnHQ8rKEEQBjRlYx77mHOvXu08oGchxej7o=
 github.com/google/go-cpy v0.0.0-20211218193943-a9c933c06932/go.mod h1:cC6EdPbj/17GFCPDK39NRarlMI+kt+O60S12cNB5J9Y=
-github.com/google/s2a-go v0.1.5 h1:8IYp3w9nysqv3JH+NJgXJzGbDHzLOTj43BmSkp+O7qg=
-github.com/google/s2a-go v0.1.5/go.mod h1:Ej+mSEMGRnqRzjc7VtF+jdBwYG5fuJfiZ8ELkjEwM0A=
+github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
+github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
-github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.2.5 h1:UR4rDjcgpgEnqpIEvkiqTYKBCKLNmlge2eVjoZfySzM=
-github.com/googleapis/enterprise-certificate-proxy v0.2.5/go.mod h1:RxW0N9901Cko1VOCW3SXCpWP+mlIEkk2tP7jnHy9a3w=
+github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
+github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/enterprise-certificate-proxy v0.3.1 h1:SBWmZhjUDRorQxrN0nwzf+AHBxnbFjViHQS4P0yVpmQ=
+github.com/googleapis/enterprise-certificate-proxy v0.3.1/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0=
 github.com/googleapis/gax-go/v2 v2.12.0 h1:A+gCJKdRfqXkr+BIRGtZLibNXf0m1f9E4HG56etFpas=
 github.com/googleapis/gax-go/v2 v2.12.0/go.mod h1:y+aIqrI5eb1YGMVJfuV3185Ts/D7qKpsEkdD5+I6QGU=
 github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 h1:+9834+KizmvFV7pXQGSXQTsaWhq2GjuNUt0aUU0YBYw=
 github.com/grpc-ecosystem/go-grpc-middleware v1.3.0/go.mod h1:z0ButlSOZa5vEBq9m2m2hlwIgKw+rp3sdCBRoJY+30Y=
-github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
 github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-checkpoint v0.5.0 h1:MFYpPZCnQqQTE18jFwSII6eUQrD/oxMFp3mlgcqk5mU=
@@ -250,7 +239,6 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/sebdah/goldie v1.0.0/go.mod h1:jXP4hmWywNEwZzhMuv2ccnqTSFpuq8iyQhtQdkkZBH4=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
@@ -265,7 +253,6 @@ github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpE
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
@@ -284,7 +271,6 @@ github.com/xanzy/ssh-agent v0.3.0 h1:wUMzuKtKilRgBAD1sUb8gOwwRr2FGoBVumcjoOACClI
 github.com/xanzy/ssh-agent v0.3.0/go.mod h1:3s9xbODqPuuhK9JV1R321M/FlMZSBvE5aY6eAcqrDh0=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/zclconf/go-cty v1.1.0/go.mod h1:xnAOWiHeOqg2nWS62VtQ7pbOu17FtxJNW8RLEih+O3s=
 github.com/zclconf/go-cty v1.2.0/go.mod h1:hOPWgoHbaTUnI5k4D2ld+GRpFJSCe6bCM7m1q/N4PQ8=
 github.com/zclconf/go-cty v1.10.0/go.mod h1:vVKLxnk3puL4qRAv72AO+W99LUD4da90g3uUAzyuvAk=
@@ -293,7 +279,6 @@ github.com/zclconf/go-cty v1.11.0/go.mod h1:s9IfD1LK5ccNMSWCVFCE2rJfHiZgi7JijgeW
 github.com/zclconf/go-cty-debug v0.0.0-20191215020915-b22d67c1ba0b/go.mod h1:ZRKQfBXbGkpdV6QMzT3rU1kSTAnfu1dO8dPKjYprgj8=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
-go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
@@ -304,17 +289,14 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20220314234659-1baeb1ce4c0b/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.12.0 h1:tFM/ta59kqch6LlvYnPa0yx5a83cL2nHflFhYKvv9Yk=
-golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
+golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
+golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180811021610-c39426892332/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -327,30 +309,25 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20191009170851-d66e71096ffb/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210326060303-6b1517762897/go.mod h1:uSPa2vr4CLtc/ILN5odXGNXS6mhrKVzTaCXzk9m6W3k=
-golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.14.0 h1:BONx9s002vGdD9umnlX1Po8vOZmrgH34qlHcD1MfK14=
-golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
+golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
+golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.11.0 h1:vPL4xzxBM4niKCW6g9whtaWVXTJf1U5e4aZxxFx/gbU=
-golang.org/x/oauth2 v0.11.0/go.mod h1:LdF7O/8bLR/qWK9DrpXmbHLTouvRHK0SgJl0GmDBchk=
+golang.org/x/oauth2 v0.13.0 h1:jDDenyj+WgFtmV3zYVoi8aE2BwtXFLWOA67ZfNWftiY=
+golang.org/x/oauth2 v0.13.0/go.mod h1:/JMhi4ZRXAf4HG9LiNmxvk+45+96RUlVThiH8FzNBn0=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.4.0 h1:zxkM55ReGkDlKSM+Fu41A+zmbZuaPVbGMzvvdUPznYQ=
+golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -362,33 +339,25 @@ golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210324051608-47abb6519492/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210502180810-71e4cd670f79/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.11.0 h1:eG7RXZHdqOJ1i+0lgLgCpSXAp6M3LYlAo6osgSi0xOM=
-golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.11.0 h1:F9tnn/DA/Im8nCwm+fX+1/eBwi4qFjRT++MhtVC4ZX0=
+golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
-golang.org/x/text v0.12.0 h1:k+n5B8goJNdU7hSvEtMUz3d1Q6D/XW4COJSJR6fN0mc=
-golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -397,15 +366,14 @@ golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBn
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 h1:H2TDz8ibqkAF6YGhCdN3jS9O0/s90v0rJh3X/OLHEUk=
 golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
-google.golang.org/api v0.138.0 h1:K/tVp05MxNVbHShRw9m7e9VJGdagNeTdMzqPH7AUqr0=
-google.golang.org/api v0.138.0/go.mod h1:4xyob8CxC+0GChNBvEUAk8VBKNvYOTWM9T3v3UfRxuY=
+google.golang.org/api v0.148.0 h1:HBq4TZlN4/1pNcu0geJZ/Q50vIwIXT532UIMYoo0vOs=
+google.golang.org/api v0.148.0/go.mod h1:8/TBgwaKjfqTdacOJrOv2+2Q6fBDU1uHKK06oGSkxzU=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
@@ -414,25 +382,21 @@ google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCID
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20200423170343-7949de9c1215/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20230803162519-f966b187b2e5 h1:L6iMMGrtzgHsWofoFcihmDEMYeDR9KN/ThbPWGrh++g=
-google.golang.org/genproto v0.0.0-20230803162519-f966b187b2e5/go.mod h1:oH/ZOT02u4kWEp7oYBGYFFkCdKS/uYR9Z7+0/xuuFp8=
-google.golang.org/genproto/googleapis/api v0.0.0-20230803162519-f966b187b2e5 h1:nIgk/EEq3/YlnmVVXVnm14rC2oxgs1o0ong4sD/rd44=
-google.golang.org/genproto/googleapis/api v0.0.0-20230803162519-f966b187b2e5/go.mod h1:5DZzOUPCLYL3mNkQ0ms0F3EuUNZ7py1Bqeq6sxzI7/Q=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230807174057-1744710a1577 h1:wukfNtZmZUurLN/atp2hiIeTKn7QJWIQdHzqmsOnAOk=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230807174057-1744710a1577/go.mod h1:+Bk1OCOj40wS2hwAMA+aCW9ypzm63QTBBHp6lQ3p+9M=
+google.golang.org/genproto v0.0.0-20231002182017-d307bd883b97 h1:SeZZZx0cP0fqUyA+oRzP9k7cSwJlvDFiROO72uwD6i0=
+google.golang.org/genproto v0.0.0-20231002182017-d307bd883b97/go.mod h1:t1VqOqqvce95G3hIDCT5FeO3YUc6Q4Oe24L/+rNMxRk=
+google.golang.org/genproto/googleapis/api v0.0.0-20231002182017-d307bd883b97 h1:W18sezcAYs+3tDZX4F80yctqa12jcP1PUS2gQu1zTPU=
+google.golang.org/genproto/googleapis/api v0.0.0-20231002182017-d307bd883b97/go.mod h1:iargEX0SFPm3xcfMI0d1domjg0ZF4Aa0p2awqyxhvF0=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231012201019-e917dd12ba7a h1:a2MQQVoTo96JC9PMGtGBymLp7+/RzpFc2yX/9WfFg1c=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231012201019-e917dd12ba7a/go.mod h1:4cYg8o5yUbm77w8ZX00LhMVNl/YVBFJRYWDc0uYWMs0=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
-google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
-google.golang.org/grpc v1.57.0 h1:kfzNeI/klCGD2YPMUlaGNT3pxvYfga7smW3Vth8Zsiw=
-google.golang.org/grpc v1.57.0/go.mod h1:Sd+9RMTACXwmub0zcNY2c4arhtrbBYD1AUHI/dt16Mo=
+google.golang.org/grpc v1.58.3 h1:BjnpXut1btbtgN/6sp+brB2Kbm2LjNXnidYujAVbSoQ=
+google.golang.org/grpc v1.58.3/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -455,7 +419,6 @@ gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EV
 gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
 gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
diff --git a/mmv1/third_party/terraform/provider/provider.go.erb b/mmv1/third_party/terraform/provider/provider.go.erb
index 9fd136341311..a05c3f5dc892 100644
--- a/mmv1/third_party/terraform/provider/provider.go.erb
+++ b/mmv1/third_party/terraform/provider/provider.go.erb
@@ -3,8 +3,10 @@ package provider
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"os"
+	"strings"
 	"time"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -39,8 +41,6 @@ import (
 	"github.com/hashicorp/terraform-provider-google/google/tpgiamresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 	"github.com/hashicorp/terraform-provider-google/google/verify"
-
-	googleoauth "golang.org/x/oauth2/google"
 )
 
 // Provider returns a *schema.Provider.
@@ -60,21 +60,23 @@ func Provider() *schema.Provider {
 	provider := &schema.Provider{
 		Schema: map[string]*schema.Schema{
 			"credentials": {
-				Type:     schema.TypeString,
-				Optional: true,
-				ValidateFunc: ValidateCredentials,
+				Type:          schema.TypeString,
+				Optional:      true,
+				ValidateFunc:  ValidateCredentials,
 				ConflictsWith: []string{"access_token"},
 			},
 
 			"access_token": {
-				Type:     schema.TypeString,
-				Optional: true,
+				Type:          schema.TypeString,
+				Optional:      true,
+				ValidateFunc:  ValidateEmptyStrings,
 				ConflictsWith: []string{"credentials"},
 			},
 
 			"impersonate_service_account": {
-				Type:     schema.TypeString,
-				Optional: true,
+				Type:         schema.TypeString,
+				Optional:     true,
+				ValidateFunc: ValidateEmptyStrings,
 			},
 
 			"impersonate_service_account_delegates": {
@@ -84,23 +86,27 @@ func Provider() *schema.Provider {
 			},
 
 			"project": {
-				Type:     schema.TypeString,
-				Optional: true,
+				Type:         schema.TypeString,
+				Optional:     true,
+				ValidateFunc: ValidateEmptyStrings,
 			},
 
 			"billing_project": {
-				Type:     schema.TypeString,
-				Optional: true,
+				Type:         schema.TypeString,
+				Optional:     true,
+				ValidateFunc: ValidateEmptyStrings,
 			},
 
 			"region": {
-				Type:     schema.TypeString,
-				Optional: true,
+				Type:         schema.TypeString,
+				Optional:     true,
+				ValidateFunc: ValidateEmptyStrings,
 			},
 
 			"zone": {
-				Type:     schema.TypeString,
-				Optional: true,
+				Type:         schema.TypeString,
+				Optional:     true,
+				ValidateFunc: ValidateEmptyStrings,
 			},
 
 			"scopes": {
@@ -109,6 +115,11 @@ func Provider() *schema.Provider {
 				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
 
+			"universe_domain": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+
 			"batching": {
 				Type:     schema.TypeList,
 				Optional: true,
@@ -143,6 +154,12 @@ func Provider() *schema.Provider {
 				Optional: true,
 			},
 
+			"default_labels": {
+				Type:     schema.TypeMap,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+
 			// Generated Products
 			<% products.each do |product| -%>
 			"<%= product[:definitions].name.underscore -%>_custom_endpoint": {
@@ -208,11 +225,16 @@ func DatasourceMapWithErrors() (map[string]*schema.Resource, error) {
 		"google_alloydb_supported_database_flags":          alloydb.DataSourceAlloydbSupportedDatabaseFlags(),
 		"google_artifact_registry_repository":              artifactregistry.DataSourceArtifactRegistryRepository(),
 		"google_app_engine_default_service_account":        appengine.DataSourceGoogleAppEngineDefaultServiceAccount(),
+		<% unless version == 'ga' -%>
+		"google_backup_dr_management_server":				backupdr.DataSourceGoogleCloudBackupDRService(),
+		<% end -%>
 		"google_beyondcorp_app_connection":                 beyondcorp.DataSourceGoogleBeyondcorpAppConnection(),
 		"google_beyondcorp_app_connector":                  beyondcorp.DataSourceGoogleBeyondcorpAppConnector(),
 		"google_beyondcorp_app_gateway":                    beyondcorp.DataSourceGoogleBeyondcorpAppGateway(),
 		"google_billing_account":                           billing.DataSourceGoogleBillingAccount(),
+		"google_bigquery_dataset":          								bigquery.DataSourceGoogleBigqueryDataset(),
 		"google_bigquery_default_service_account":          bigquery.DataSourceGoogleBigqueryDefaultServiceAccount(),
+		"google_certificate_manager_certificate_map":       certificatemanager.DataSourceGoogleCertificateManagerCertificateMap(),
 		"google_cloudbuild_trigger":                        cloudbuild.DataSourceGoogleCloudBuildTrigger(),
 		"google_cloudfunctions_function":                   cloudfunctions.DataSourceGoogleCloudFunctionsFunction(),
 		"google_cloudfunctions2_function":                  cloudfunctions2.DataSourceGoogleCloudFunctions2Function(),
@@ -221,8 +243,11 @@ func DatasourceMapWithErrors() (map[string]*schema.Resource, error) {
 		<% end -%>
 		"google_cloud_identity_groups":                     cloudidentity.DataSourceGoogleCloudIdentityGroups(),
 		"google_cloud_identity_group_memberships":          cloudidentity.DataSourceGoogleCloudIdentityGroupMemberships(),
+		"google_cloud_identity_group_lookup":               cloudidentity.DataSourceGoogleCloudIdentityGroupLookup(),
 		"google_cloud_run_locations":                       cloudrun.DataSourceGoogleCloudRunLocations(),
 		"google_cloud_run_service":                         cloudrun.DataSourceGoogleCloudRunService(),
+		"google_cloud_run_v2_job":                          cloudrunv2.DataSourceGoogleCloudRunV2Job(),
+		"google_cloud_run_v2_service":                      cloudrunv2.DataSourceGoogleCloudRunV2Service(),
 		"google_composer_environment":                      composer.DataSourceGoogleComposerEnvironment(),
 		"google_composer_image_versions":                   composer.DataSourceGoogleComposerImageVersions(),
 		"google_compute_address":                           compute.DataSourceGoogleComputeAddress(),
@@ -244,6 +269,7 @@ func DatasourceMapWithErrors() (map[string]*schema.Resource, error) {
 		"google_compute_instance_template":                 compute.DataSourceGoogleComputeInstanceTemplate(),
 		"google_compute_lb_ip_ranges":                      compute.DataSourceGoogleComputeLbIpRanges(),
 		"google_compute_network":                           compute.DataSourceGoogleComputeNetwork(),
+		"google_compute_networks":                          compute.DataSourceGoogleComputeNetworks(),
 		"google_compute_network_endpoint_group":            compute.DataSourceGoogleComputeNetworkEndpointGroup(),
 		"google_compute_network_peering":                   compute.DataSourceComputeNetworkPeering(),
 		"google_compute_node_types":                        compute.DataSourceGoogleComputeNodeTypes(),
@@ -272,7 +298,6 @@ func DatasourceMapWithErrors() (map[string]*schema.Resource, error) {
 		"google_container_registry_repository":             containeranalysis.DataSourceGoogleContainerRepo(),
 		"google_dataproc_metastore_service":                dataprocmetastore.DataSourceDataprocMetastoreService(),
 		"google_datastream_static_ips":                     datastream.DataSourceGoogleDatastreamStaticIps(),
-		"google_game_services_game_server_deployment_rollout":  gameservices.DataSourceGameServicesGameServerDeploymentRollout(),
 		"google_iam_policy":                                resourcemanager.DataSourceGoogleIamPolicy(),
 		"google_iam_role":                                  resourcemanager.DataSourceGoogleIamRole(),
 		"google_iam_testable_permissions":                  resourcemanager.DataSourceGoogleIamTestablePermissions(),
@@ -318,6 +343,7 @@ func DatasourceMapWithErrors() (map[string]*schema.Resource, error) {
 		"google_runtimeconfig_variable":                    runtimeconfig.DataSourceGoogleRuntimeconfigVariable(),
 		<% end -%>
 		"google_secret_manager_secret":                     secretmanager.DataSourceSecretManagerSecret(),
+		"google_secret_manager_secrets":                    secretmanager.DataSourceSecretManagerSecrets(),
 		"google_secret_manager_secret_version":             secretmanager.DataSourceSecretManagerSecretVersion(),
 		"google_secret_manager_secret_version_access":      secretmanager.DataSourceSecretManagerSecretVersionAccess(),
 		"google_service_account":                           resourcemanager.DataSourceGoogleServiceAccount(),
@@ -345,6 +371,10 @@ func DatasourceMapWithErrors() (map[string]*schema.Resource, error) {
 		"google_tags_tag_key":                              tags.DataSourceGoogleTagsTagKey(),
 		"google_tags_tag_value":                            tags.DataSourceGoogleTagsTagValue(),
 		"google_tpu_tensorflow_versions":                   tpu.DataSourceTpuTensorflowVersions(),
+		<% unless version == 'ga' -%>
+		"google_tpu_v2_runtime_versions":                   tpuv2.DataSourceTpuV2RuntimeVersions(),
+		"google_tpu_v2_accelerator_types":                  tpuv2.DataSourceTpuV2AcceleratorTypes(),
+		<% end -%>
 		"google_vpc_access_connector":                      vpcaccess.DataSourceVPCAccessConnector(),
 		"google_redis_instance":                            redis.DataSourceGoogleRedisInstance(),
 		"google_vertex_ai_index":                           vertexai.DataSourceVertexAIIndex(),
@@ -508,8 +538,6 @@ end     # products.each do
 				<% end -%>
 				"google_dataproc_cluster":                      dataproc.ResourceDataprocCluster(),
 				"google_dataproc_job":                          dataproc.ResourceDataprocJob(),
-				"google_dialogflow_cx_version":                 dialogflowcx.ResourceDialogflowCXVersion(),
-                "google_dialogflow_cx_environment":             dialogflowcx.ResourceDialogflowCXEnvironment(),
 				"google_dns_record_set":                        dns.ResourceDnsRecordSet(),
 				"google_endpoints_service":                     servicemanagement.ResourceEndpointsService(),
 				"google_folder":                                resourcemanager.ResourceGoogleFolder(),
@@ -689,6 +717,43 @@ func ProviderConfigure(ctx context.Context, d *schema.ResourceData, p *schema.Pr
 			"GOOGLE_OAUTH_ACCESS_TOKEN",
 		})
 	}
+	
+	// set universe_domain based on the service account key file.
+	if config.Credentials != "" {
+		contents, _, err := verify.PathOrContents(config.Credentials)
+		if err != nil {
+			return nil, diag.FromErr(fmt.Errorf("error loading service account credentials: %s", err))
+		}
+		var content map[string]any
+
+		if err := json.Unmarshal([]byte(contents), &content); err != nil {
+			return nil, diag.FromErr(err)
+		}
+
+		if content["universe_domain"] != nil {
+			config.UniverseDomain = content["universe_domain"].(string)
+		}
+	}
+	
+	// Check if the user provided a value from the universe_domain field
+	if v, ok := d.GetOk("universe_domain"); ok {
+		if config.UniverseDomain == "" {
+			config.UniverseDomain = v.(string)
+		} else if  v.(string) != config.UniverseDomain {
+			if _, err := os.Stat(config.Credentials); err == nil {
+				return nil, diag.FromErr(fmt.Errorf("'%s' does not match the universe domain '%s' already set in the credential file '%s'. The 'universe_domain' provider configuration can not be used to override the universe domain that is defined in the active credential.  Set the 'universe_domain' provider configuration when universe domain information is not already available in the credential, e.g. when authenticating with a JWT token.", v, config.UniverseDomain, config.Credentials))
+			} else {
+				return nil, diag.FromErr(fmt.Errorf("'%s' does not match the universe domain '%s' supplied directly to Terraform. The 'universe_domain' provider configuration can not be used to override the universe domain that is defined in the active credential.  Set the 'universe_domain' provider configuration when universe domain information is not already available in the credential, e.g. when authenticating with a JWT token.", v, config.UniverseDomain))
+			}
+		}
+	}
+
+	// Replace hostname by the universe_domain field.
+	if config.UniverseDomain != "" && config.UniverseDomain != "googleapis.com" {
+		for key, basePath := range transport_tpg.DefaultBasePaths {
+			transport_tpg.DefaultBasePaths[key] = strings.ReplaceAll(basePath, "googleapis.com", config.UniverseDomain)
+		}
+	}
 
 	// Given that impersonate_service_account is a secondary auth method, it has
 	// no conflicts to worry about. We pull the env var in a DefaultFunc.
@@ -712,6 +777,13 @@ func ProviderConfigure(ctx context.Context, d *schema.ResourceData, p *schema.Pr
 		config.Scopes[i] = scope.(string)
 	}
 
+	config.DefaultLabels = make(map[string]string)
+	defaultLabels := d.Get("default_labels").(map[string]interface{})
+
+	for k, v := range defaultLabels {
+		config.DefaultLabels[k] = v.(string)
+	}
+
 	batchCfg, err := transport_tpg.ExpandProviderBatchingConfig(d.Get("batching"))
 	if err != nil {
 		return nil, diag.FromErr(err)
@@ -754,23 +826,6 @@ func ProviderConfigure(ctx context.Context, d *schema.ResourceData, p *schema.Pr
 	return transport_tpg.ProviderDCLConfigure(d, &config), nil
 }
 
-func ValidateCredentials(v interface{}, k string) (warnings []string, errors []error) {
-	if v == nil || v.(string) == "" {
-		return
-	}
-	creds := v.(string)
-	// if this is a path and we can stat it, assume it's ok
-	if _, err := os.Stat(creds); err == nil {
-		return
-	}
-	if _, err := googleoauth.CredentialsFromJSON(context.Background(), []byte(creds)); err != nil {
-		errors = append(errors,
-			fmt.Errorf("JSON credentials are not valid: %s", err))
-	}
-
-	return
-}
-
 func mergeResourceMaps(ms ...map[string]*schema.Resource) (map[string]*schema.Resource, error) {
 	merged := make(map[string]*schema.Resource)
 	duplicates := []string{}
diff --git a/mmv1/third_party/terraform/provider/provider_internal_test.go b/mmv1/third_party/terraform/provider/provider_internal_test.go
index 343fccc741a7..5bf88ff03983 100644
--- a/mmv1/third_party/terraform/provider/provider_internal_test.go
+++ b/mmv1/third_party/terraform/provider/provider_internal_test.go
@@ -42,10 +42,13 @@ func TestProvider_ValidateCredentials(t *testing.T) {
 				return string(contents)
 			},
 		},
-		"configuring credentials as an empty string is valid": {
+		"configuring credentials as an empty string is not valid": {
 			ConfigValue: func(t *testing.T) interface{} {
 				return ""
 			},
+			ExpectedErrors: []error{
+				errors.New("expected a non-empty string"),
+			},
 		},
 		"leaving credentials unconfigured is valid": {
 			ValueNotProvided: true,
@@ -67,15 +70,65 @@ func TestProvider_ValidateCredentials(t *testing.T) {
 
 			// Assert
 			if len(ws) != len(tc.ExpectedWarnings) {
-				t.Errorf("Expected %d warnings, got %d: %v", len(tc.ExpectedWarnings), len(ws), ws)
+				t.Fatalf("Expected %d warnings, got %d: %v", len(tc.ExpectedWarnings), len(ws), ws)
 			}
 			if len(es) != len(tc.ExpectedErrors) {
-				t.Errorf("Expected %d errors, got %d: %v", len(tc.ExpectedErrors), len(es), es)
+				t.Fatalf("Expected %d errors, got %d: %v", len(tc.ExpectedErrors), len(es), es)
 			}
 
-			if len(tc.ExpectedErrors) > 0 {
+			if len(tc.ExpectedErrors) > 0 && len(es) > 0 {
 				if es[0].Error() != tc.ExpectedErrors[0].Error() {
-					t.Errorf("Expected first error to be \"%s\", got \"%s\"", tc.ExpectedErrors[0], es[0])
+					t.Fatalf("Expected first error to be \"%s\", got \"%s\"", tc.ExpectedErrors[0], es[0])
+				}
+			}
+		})
+	}
+}
+
+func TestProvider_ValidateEmptyStrings(t *testing.T) {
+	cases := map[string]struct {
+		ConfigValue      interface{}
+		ValueNotProvided bool
+		ExpectedWarnings []string
+		ExpectedErrors   []error
+	}{
+		"non-empty strings are valid": {
+			ConfigValue: "foobar",
+		},
+		"unconfigured values are valid": {
+			ValueNotProvided: true,
+		},
+		"empty strings are not valid": {
+			ConfigValue: "",
+			ExpectedErrors: []error{
+				errors.New("expected a non-empty string"),
+			},
+		},
+	}
+	for tn, tc := range cases {
+		t.Run(tn, func(t *testing.T) {
+
+			// Arrange
+			var configValue interface{}
+			if !tc.ValueNotProvided {
+				configValue = tc.ConfigValue
+			}
+
+			// Act
+			// Note: second argument is currently unused by the function but is necessary to fulfill the SchemaValidateFunc type's function signature
+			ws, es := provider.ValidateEmptyStrings(configValue, "")
+
+			// Assert
+			if len(ws) != len(tc.ExpectedWarnings) {
+				t.Fatalf("Expected %d warnings, got %d: %v", len(tc.ExpectedWarnings), len(ws), ws)
+			}
+			if len(es) != len(tc.ExpectedErrors) {
+				t.Fatalf("Expected %d errors, got %d: %v", len(tc.ExpectedErrors), len(es), es)
+			}
+
+			if len(tc.ExpectedErrors) > 0 && len(es) > 0 {
+				if es[0].Error() != tc.ExpectedErrors[0].Error() {
+					t.Fatalf("Expected first error to be \"%s\", got \"%s\"", tc.ExpectedErrors[0], es[0])
 				}
 			}
 		})
@@ -403,7 +456,7 @@ func TestProvider_ProviderConfigure_impersonateServiceAccount(t *testing.T) {
 			ExpectedValue:    "",
 		},
 		// Handling empty strings in config
-		"when impersonate_service_account is set as an empty array the field is treated as if it's unset, without error": {
+		"when impersonate_service_account is set as an empty string the field is treated as if it's unset, without error": {
 			ConfigValues: map[string]interface{}{
 				"impersonate_service_account": "",
 				"credentials":                 transport_tpg.TestFakeCredentialsPath,
@@ -412,6 +465,16 @@ func TestProvider_ProviderConfigure_impersonateServiceAccount(t *testing.T) {
 			ExpectFieldUnset: true,
 			ExpectedValue:    "",
 		},
+		"when impersonate_service_account is set as an empty string in the config, an environment variable is used": {
+			ConfigValues: map[string]interface{}{
+				"impersonate_service_account": "",
+				"credentials":                 transport_tpg.TestFakeCredentialsPath,
+			},
+			EnvVariables: map[string]string{
+				"GOOGLE_IMPERSONATE_SERVICE_ACCOUNT": "value-from-env@example.com",
+			},
+			ExpectedValue: "value-from-env@example.com",
+		},
 	}
 
 	for tn, tc := range cases {
@@ -1255,22 +1318,10 @@ func TestProvider_ProviderConfigure_scopes(t *testing.T) {
 		"scopes are set in the provider config as a list": {
 			ConfigValues: map[string]interface{}{
 				"credentials": transport_tpg.TestFakeCredentialsPath,
-				"scopes": []string{
-					"fizz",
-					"buzz",
-					"fizzbuzz",
-				},
-			},
-			ExpectedSchemaValue: []string{
-				"fizz",
-				"buzz",
-				"fizzbuzz",
-			},
-			ExpectedConfigValue: []string{
-				"fizz",
-				"buzz",
-				"fizzbuzz",
+				"scopes":      []string{"fizz", "buzz", "fizzbuzz"},
 			},
+			ExpectedSchemaValue: []string{"fizz", "buzz", "fizzbuzz"},
+			ExpectedConfigValue: []string{"fizz", "buzz", "fizzbuzz"},
 		},
 		"scopes can be left unset in the provider config without any issues, and a default value is used": {
 			ConfigValues: map[string]interface{}{
@@ -1389,17 +1440,17 @@ func TestProvider_ProviderConfigure_requestTimeout(t *testing.T) {
 			ExpectError:         true,
 			ExpectFieldUnset:    false,
 		},
-		// it's default value is set when RequestTimeout value is 0.
-		// This can be seen in this part of the config code where the default value is set to 120s
+		// RequestTimeout is "0s" if unset by the user, and logic elsewhere will supply a different value.
+		// This can be seen in this part of the config code where the default value is set to "120s"
 		// https://github.com/hashicorp/terraform-provider-google/blob/09cb850ee64bcd78e4457df70905530c1ed75f19/google/transport/config.go#L1228-L1233
-		"when config is unset, the value will be 0s in order to set the default value": {
+		"when request_timeout is unset in the config, the default value is 0s. (initially; this value is subsequently overwritten)": {
 			ConfigValues: map[string]interface{}{
 				"credentials": transport_tpg.TestFakeCredentialsPath,
 			},
 			ExpectedValue:    "0s",
 			ExpectFieldUnset: true,
 		},
-		"when value is empty, the value will be 0s in order to set the default value": {
+		"when request_timeout is set as an empty string, the default value is 0s. (initially; this value is subsequently overwritten)": {
 			ConfigValues: map[string]interface{}{
 				"request_timeout": "",
 				"credentials":     transport_tpg.TestFakeCredentialsPath,
@@ -1493,6 +1544,27 @@ func TestProvider_ProviderConfigure_requestReason(t *testing.T) {
 				// request_reason unset
 				"credentials": transport_tpg.TestFakeCredentialsPath,
 			},
+			ExpectedSchemaValue: "",
+			ExpectedConfigValue: "",
+		},
+		// Handling empty values in config
+		"when request_reason is set as an empty string in the config it is overridden by environment variables": {
+			ConfigValues: map[string]interface{}{
+				"request_reason": "",
+				"credentials":    transport_tpg.TestFakeCredentialsPath,
+			},
+			EnvVariables: map[string]string{
+				"CLOUDSDK_CORE_REQUEST_REASON": "test",
+			},
+			ExpectedSchemaValue: "test",
+			ExpectedConfigValue: "test",
+		},
+		"when request_reason is set as an empty string in the config, the field remains unset without error": {
+			ConfigValues: map[string]interface{}{
+				"request_reason": "",
+				"credentials":    transport_tpg.TestFakeCredentialsPath,
+			},
+			ExpectedSchemaValue: "",
 			ExpectedConfigValue: "",
 		},
 	}
@@ -1556,31 +1628,32 @@ func TestProvider_ProviderConfigure_batching(t *testing.T) {
 		ExpectedEnableBatchingValue bool
 		ExpectedSendAfterValue      string
 	}{
-		"if batch is an empty block, it will set the default values": {
-			ConfigValues: map[string]interface{}{
-				"credentials": transport_tpg.TestFakeCredentialsPath,
-			},
-			// Although at the schema level it's shown that by default it's set to false, the actual default value
-			// is true and can be seen in the `ExpanderProviderBatchingConfig` struct
-			// https://github.com/GoogleCloudPlatform/magic-modules/blob/8cd4a506f0ac4db7b07a8cce914449d34df6f20b/mmv1/third_party/terraform/transport/config.go.erb#L504-L508
-			ExpectedEnableBatchingValue: false,
-			ExpectedSendAfterValue:      "", // uses "" value to be able to set the default value of 30s
-			ExpectFieldUnset:            true,
-		},
-		"if batch is configured with both enable_batching and send_after": {
+		"batching can be configured with values for enable_batching and send_after": {
 			ConfigValues: map[string]interface{}{
 				"credentials": transport_tpg.TestFakeCredentialsPath,
 				"batching": []interface{}{
 					map[string]interface{}{
 						"enable_batching": true,
-						"send_after":      "10s",
+						"send_after":      "45s",
 					},
 				},
 			},
 			ExpectedEnableBatchingValue: true,
-			ExpectedSendAfterValue:      "10s",
+			ExpectedSendAfterValue:      "45s",
+		},
+		"if batching is an empty block, it will set the default values for enable_batching and send_after": {
+			ConfigValues: map[string]interface{}{
+				"credentials": transport_tpg.TestFakeCredentialsPath,
+				// batching not set
+			},
+			// Although at the schema level it's shown that by default it's set to false, the actual default value
+			// is true and can be seen in the `ExpanderProviderBatchingConfig` struct
+			// https://github.com/GoogleCloudPlatform/magic-modules/blob/8cd4a506f0ac4db7b07a8cce914449d34df6f20b/mmv1/third_party/terraform/transport/config.go.erb#L504-L508
+			ExpectedEnableBatchingValue: false,
+			ExpectedSendAfterValue:      "", // uses "" value to be able to set the default value of 30s
+			ExpectFieldUnset:            true,
 		},
-		"if batch is configured with only enable_batching": {
+		"when batching is configured with only enable_batching, send_after will be set to a default value": {
 			ConfigValues: map[string]interface{}{
 				"credentials": transport_tpg.TestFakeCredentialsPath,
 				"batching": []interface{}{
@@ -1592,19 +1665,20 @@ func TestProvider_ProviderConfigure_batching(t *testing.T) {
 			ExpectedEnableBatchingValue: true,
 			ExpectedSendAfterValue:      "",
 		},
-		"if batch is configured with only send_after": {
+		"when batching is configured with only send_after, enable_batching will be set to a default value": {
 			ConfigValues: map[string]interface{}{
 				"credentials": transport_tpg.TestFakeCredentialsPath,
 				"batching": []interface{}{
 					map[string]interface{}{
-						"send_after": "10s",
+						"send_after": "45s",
 					},
 				},
 			},
 			ExpectedEnableBatchingValue: false,
-			ExpectedSendAfterValue:      "10s",
+			ExpectedSendAfterValue:      "45s",
 		},
-		"if batch is configured with invalid value for send_after": {
+		// Error states
+		"if batching is configured with send_after as an invalid value, there's an error": {
 			ConfigValues: map[string]interface{}{
 				"credentials": transport_tpg.TestFakeCredentialsPath,
 				"batching": []interface{}{
@@ -1616,7 +1690,7 @@ func TestProvider_ProviderConfigure_batching(t *testing.T) {
 			ExpectedSendAfterValue: "invalid value",
 			ExpectError:            true,
 		},
-		"if batch is configured with value without seconds (s) for send_after": {
+		"if batching is configured with send_after as number value without seconds (s), there's an error": {
 			ConfigValues: map[string]interface{}{
 				"credentials": transport_tpg.TestFakeCredentialsPath,
 				"batching": []interface{}{
@@ -1665,10 +1739,10 @@ func TestProvider_ProviderConfigure_batching(t *testing.T) {
 				if ok {
 					val := v.(string)
 					if val != tc.ExpectedSendAfterValue {
-						t.Fatalf("expected request_timeout value set in provider data to be %v, got %v", tc.ExpectedSendAfterValue, val)
+						t.Fatalf("expected send_after value set in provider data to be %v, got %v", tc.ExpectedSendAfterValue, val)
 					}
 					if tc.ExpectFieldUnset {
-						t.Fatalf("expected request_timeout value to not be set in provider data, got %s", val)
+						t.Fatalf("expected send_after value to not be set in provider data, got %s", val)
 					}
 				}
 				// Return early in tests where errors expected
diff --git a/mmv1/third_party/terraform/provider/provider_test.go.erb b/mmv1/third_party/terraform/provider/provider_test.go.erb
index 2406a3969d41..4072b9b1246f 100644
--- a/mmv1/third_party/terraform/provider/provider_test.go.erb
+++ b/mmv1/third_party/terraform/provider/provider_test.go.erb
@@ -35,7 +35,6 @@ func TestProvider_noDuplicatesInResourceMap(t *testing.T) {
 	}
 }
 
-
 func TestProvider_noDuplicatesInDatasourceMap(t *testing.T) {
 	_, err := provider.DatasourceMapWithErrors()
 	if err != nil {
@@ -132,6 +131,7 @@ func TestAccProviderUserProjectOverride(t *testing.T) {
 				ResourceName:      "google_pubsub_topic.project-2-topic",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"}, 
 			},
 			{
 				Config: testAccProviderUserProjectOverride_step3(accessToken, true),
@@ -181,6 +181,144 @@ func TestAccProviderIndirectUserProjectOverride(t *testing.T) {
 	})
 }
 
+func TestAccProviderCredentialsEmptyString(t *testing.T) {
+	// Test is not parallel because ENVs are set.
+	// Need to skip VCR as this test downloads providers from the Terraform Registry
+	acctest.SkipIfVcr(t)
+
+	creds := envvar.GetTestCredsFromEnv()
+	project := envvar.GetTestProjectFromEnv()
+	t.Setenv("GOOGLE_CREDENTIALS", creds)
+	t.Setenv("GOOGLE_PROJECT", project)
+
+	pid := "tf-test-" + acctest.RandString(t, 10)
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck: func() { acctest.AccTestPreCheck(t) },
+		// No TestDestroy since that's not really the point of this test
+		Steps: []resource.TestStep{
+			{
+				// This is a control for the other test steps; the provider block doesn't contain `credentials = ""`
+				Config:                   testAccProviderCredentials_actWithCredsFromEnv(pid),
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+				PlanOnly:                 true,
+				ExpectNonEmptyPlan:       true,
+			},
+			{
+				// Assert that errors are expected with credentials when
+				// - GOOGLE_CREDENTIALS is set
+				// - provider block has credentials = ""
+				// - TPG v4.60.2 is used
+				// Context: this was an addidental breaking change introduced with muxing
+				Config: testAccProviderCredentials_actWithCredsFromEnv_emptyString(pid),
+				ExternalProviders: map[string]resource.ExternalProvider{
+					"google": {
+						VersionConstraint: "4.60.2",
+						Source:            "hashicorp/google",
+					},
+				},
+				PlanOnly:           true,
+				ExpectNonEmptyPlan: true,
+				ExpectError:        regexp.MustCompile(`unexpected end of JSON input`),
+			},
+			{
+				// Assert that errors are NOT expected with credentials when
+				// - GOOGLE_CREDENTIALS is set
+				// - provider block has credentials = ""
+				// - TPG v4.84.0 is used
+				// Context: this was the fix for the unintended breaking change in 4.60.2
+				Config: testAccProviderCredentials_actWithCredsFromEnv_emptyString(pid),
+				ExternalProviders: map[string]resource.ExternalProvider{
+					"google": {
+						VersionConstraint: "4.84.0",
+						Source:            "hashicorp/google",
+					},
+				},
+				PlanOnly:           true,
+				ExpectNonEmptyPlan: true,
+			},
+			{
+				// Validation errors are expected in 5.0.0+
+				// Context: we intentionally introduced the breaking change again in 5.0.0+
+				Config:                   testAccProviderCredentials_actWithCredsFromEnv_emptyString(pid),
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+				PlanOnly:                 true,
+				ExpectNonEmptyPlan:       true,
+				ExpectError:              regexp.MustCompile(`expected a non-empty string`),
+			},
+		},
+	})
+}
+
+func TestAccProviderEmptyStrings(t *testing.T) {
+	t.Parallel()
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		// No TestDestroy since that's not really the point of this test
+		Steps: []resource.TestStep{
+			// When no values are set in the provider block there are no errors
+			// This test case is a control to show validation doesn't accidentally flag unset fields
+			// The "" argument is a lack of key = value being passed into the provider block
+			{
+				Config:             testAccProvider_checkPlanTimeErrors("", acctest.RandString(t, 10)),
+				PlanOnly:           true,
+				ExpectNonEmptyPlan: true,
+			},
+			// credentials as an empty string causes a validation error
+			{
+				Config:             testAccProvider_checkPlanTimeErrors(`credentials = ""`, acctest.RandString(t, 10)),
+				PlanOnly:           true,
+				ExpectNonEmptyPlan: true,
+				ExpectError:        regexp.MustCompile(`expected a non-empty string`),
+			},
+			// access_token as an empty string causes a validation error
+			{
+				Config:             testAccProvider_checkPlanTimeErrors(`access_token = ""`, acctest.RandString(t, 10)),
+				PlanOnly:           true,
+				ExpectNonEmptyPlan: true,
+				ExpectError:        regexp.MustCompile(`expected a non-empty string`),
+			},
+			// impersonate_service_account as an empty string causes a validation error
+			{
+				Config:             testAccProvider_checkPlanTimeErrors(`impersonate_service_account = ""`, acctest.RandString(t, 10)),
+				PlanOnly:           true,
+				ExpectNonEmptyPlan: true,
+				ExpectError:        regexp.MustCompile(`expected a non-empty string`),
+			},
+			// project as an empty string causes a validation error
+			{
+				Config:             testAccProvider_checkPlanTimeErrors(`project = ""`, acctest.RandString(t, 10)),
+				PlanOnly:           true,
+				ExpectNonEmptyPlan: true,
+				ExpectError:        regexp.MustCompile(`expected a non-empty string`),
+			},
+			// billing_project as an empty string causes a validation error
+			{
+				Config:             testAccProvider_checkPlanTimeErrors(`billing_project = ""`, acctest.RandString(t, 10)),
+				PlanOnly:           true,
+				ExpectNonEmptyPlan: true,
+				ExpectError:        regexp.MustCompile(`expected a non-empty string`),
+			},
+			// region as an empty string causes a validation error
+			{
+				Config:             testAccProvider_checkPlanTimeErrors(`region = ""`, acctest.RandString(t, 10)),
+				PlanOnly:           true,
+				ExpectNonEmptyPlan: true,
+				ExpectError:        regexp.MustCompile(`expected a non-empty string`),
+			},
+			// zone as an empty string causes a validation error
+			{
+				Config:             testAccProvider_checkPlanTimeErrors(`zone = ""`, acctest.RandString(t, 10)),
+				PlanOnly:           true,
+				ExpectNonEmptyPlan: true,
+				ExpectError:        regexp.MustCompile(`expected a non-empty string`),
+			},
+		},
+	})
+}
+
 func testAccProviderBasePath_setBasePath(endpoint, name string) string {
 	return fmt.Sprintf(`
 provider "google" {
@@ -321,4 +459,43 @@ func testAccCheckComputeAddressDestroyProducer(t *testing.T) func(s *terraform.S
 
 		return nil
 	}
-}
\ No newline at end of file
+}
+
+func testAccProviderCredentials_actWithCredsFromEnv(name string) string {
+	return fmt.Sprintf(`
+provider "google" {
+  alias       = "testing_credentials"
+
+}
+
+resource "google_compute_address" "default" {
+  provider = google.testing_credentials
+  name     = "%s"
+}`, name)
+}
+
+func testAccProviderCredentials_actWithCredsFromEnv_emptyString(name string) string {
+	return fmt.Sprintf(`
+provider "google" {
+  alias       = "testing_credentials"
+  credentials = ""
+}
+
+resource "google_compute_address" "default" {
+  provider = google.testing_credentials
+  name     = "%s"
+}`, name)
+}
+
+func testAccProvider_checkPlanTimeErrors(providerArgument, randString string) string {
+	return fmt.Sprintf(`
+provider "google" {
+	%s
+}
+
+# A random resource so that the test can generate a plan (can't check validation errors when plan is empty)
+resource "google_pubsub_topic" "example" {
+  name = "tf-test-planned-resource-%s"
+}
+`, providerArgument, randString)
+}
diff --git a/mmv1/third_party/terraform/provider/provider_validators.go.erb b/mmv1/third_party/terraform/provider/provider_validators.go.erb
new file mode 100644
index 000000000000..25b7825f0703
--- /dev/null
+++ b/mmv1/third_party/terraform/provider/provider_validators.go.erb
@@ -0,0 +1,48 @@
+<% autogen_exception -%>
+package provider
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	googleoauth "golang.org/x/oauth2/google"
+)
+
+func ValidateCredentials(v interface{}, k string) (warnings []string, errors []error) {
+	if v == nil {
+		return
+	}
+	creds := v.(string)
+
+	// reject empty strings
+	if v.(string) == "" {
+		errors = append(errors,
+			fmt.Errorf("expected a non-empty string"))
+		return
+	}
+
+	// if this is a path and we can stat it, assume it's ok
+	if _, err := os.Stat(creds); err == nil {
+		return
+	}
+	if _, err := googleoauth.CredentialsFromJSON(context.Background(), []byte(creds)); err != nil {
+		errors = append(errors,
+			fmt.Errorf("JSON credentials are not valid: %s", err))
+	}
+
+	return
+}
+
+func ValidateEmptyStrings(v interface{}, k string) (warnings []string, errors []error) {
+	if v == nil {
+		return
+	}
+
+	if v.(string) == "" {
+		errors = append(errors,
+			fmt.Errorf("expected a non-empty string"))
+	}
+
+	return
+}
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/provider/universe/universe_domain_compute_test.go b/mmv1/third_party/terraform/provider/universe/universe_domain_compute_test.go
new file mode 100644
index 000000000000..9d4959857c48
--- /dev/null
+++ b/mmv1/third_party/terraform/provider/universe/universe_domain_compute_test.go
@@ -0,0 +1,109 @@
+package universe_test
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+	"github.com/hashicorp/terraform-provider-google/google/envvar"
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
+)
+
+func TestAccUniverseDomainDisk(t *testing.T) {
+	// Skip this test in all env since this can only run in specific test project.
+	t.Skip()
+
+	universeDomain := envvar.GetTestUniverseDomainFromEnv(t)
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeDiskDestroyProducer(t),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccUniverseDomain_basic_disk(universeDomain),
+			},
+		},
+	})
+}
+
+func TestAccDefaultUniverseDomainDisk(t *testing.T) {
+	universeDomain := "googleapis.com"
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeDiskDestroyProducer(t),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccUniverseDomain_basic_disk(universeDomain),
+			},
+		},
+	})
+}
+
+func testAccUniverseDomain_basic_disk(universeDomain string) string {
+	return fmt.Sprintf(`
+provider "google" {
+  universe_domain = "%s"
+}
+	  
+resource "google_compute_instance_template" "instance_template" {
+  name = "demo-this"
+  machine_type = "n1-standard-1"
+
+// boot disk
+  disk {
+	disk_size_gb = 20
+  }
+
+  network_interface {
+	network = "default"
+  }
+}
+`, universeDomain)
+}
+
+func testAccCheckComputeDiskDestroyProducer(t *testing.T) func(s *terraform.State) error {
+	return func(s *terraform.State) error {
+		for name, rs := range s.RootModule().Resources {
+			if rs.Type != "google_compute_disk" {
+				continue
+			}
+			if strings.HasPrefix(name, "data.") {
+				continue
+			}
+
+			config := acctest.GoogleProviderConfig(t)
+
+			url, err := tpgresource.ReplaceVarsForTest(config, rs, "{{ComputeBasePath}}projects/{{project}}/zones/{{zone}}/disks/{{name}}")
+			if err != nil {
+				return err
+			}
+
+			billingProject := ""
+
+			if config.BillingProject != "" {
+				billingProject = config.BillingProject
+			}
+
+			_, err = transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+				Config:    config,
+				Method:    "GET",
+				Project:   billingProject,
+				RawURL:    url,
+				UserAgent: config.UserAgent,
+			})
+			if err == nil {
+				return fmt.Errorf("ComputeDisk still exists at %s", url)
+			}
+		}
+
+		return nil
+	}
+}
diff --git a/mmv1/third_party/terraform/provider/universe/universe_domain_pubsub_test.go b/mmv1/third_party/terraform/provider/universe/universe_domain_pubsub_test.go
new file mode 100644
index 000000000000..ac1bbbffec01
--- /dev/null
+++ b/mmv1/third_party/terraform/provider/universe/universe_domain_pubsub_test.go
@@ -0,0 +1,99 @@
+package universe_test
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+	"github.com/hashicorp/terraform-provider-google/google/envvar"
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
+)
+
+func TestAccUniverseDomainPubSub(t *testing.T) {
+	// Skip this test in all env since this can only run in specific test project.
+	t.Skip()
+
+	universeDomain := envvar.GetTestUniverseDomainFromEnv(t)
+	topic := fmt.Sprintf("tf-test-topic-%s", acctest.RandString(t, 10))
+	subscription := fmt.Sprintf("tf-test-sub-%s", acctest.RandString(t, 10))
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckPubsubSubscriptionDestroyProducer(t),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccUniverseDomain_basic_pubsub(universeDomain, topic, subscription),
+			},
+		},
+	})
+}
+
+func testAccUniverseDomain_basic_pubsub(universeDomain, topic, subscription string) string {
+	return fmt.Sprintf(`
+provider "google" {
+  universe_domain = "%s"
+}
+	  
+resource "google_pubsub_topic" "foo" {
+  name = "%s"
+}
+  
+resource "google_pubsub_subscription" "foo" {
+  name  = "%s"
+  topic = google_pubsub_topic.foo.id
+  
+  message_retention_duration = "1200s"
+  retain_acked_messages      = true
+  ack_deadline_seconds       = 20
+  expiration_policy {
+	ttl = ""
+  }
+  enable_message_ordering    = false
+}
+`, universeDomain, topic, subscription)
+}
+
+func testAccCheckPubsubSubscriptionDestroyProducer(t *testing.T) func(s *terraform.State) error {
+	return func(s *terraform.State) error {
+		for name, rs := range s.RootModule().Resources {
+			if rs.Type != "google_pubsub_subscription" {
+				continue
+			}
+			if strings.HasPrefix(name, "data.") {
+				continue
+			}
+
+			config := acctest.GoogleProviderConfig(t)
+
+			url, err := tpgresource.ReplaceVarsForTest(config, rs, "{{PubsubBasePath}}projects/{{project}}/subscriptions/{{name}}")
+			if err != nil {
+				return err
+			}
+
+			billingProject := ""
+
+			if config.BillingProject != "" {
+				billingProject = config.BillingProject
+			}
+
+			_, err = transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+				Config:    config,
+				Method:    "GET",
+				Project:   billingProject,
+				RawURL:    url,
+				UserAgent: config.UserAgent,
+			})
+			if err == nil {
+				return fmt.Errorf("PubsubSubscription still exists at %s", url)
+			}
+		}
+
+		return nil
+	}
+}
diff --git a/mmv1/third_party/terraform/provider/universe/universe_domain_storage_test.go b/mmv1/third_party/terraform/provider/universe/universe_domain_storage_test.go
new file mode 100644
index 000000000000..934b3e83ef41
--- /dev/null
+++ b/mmv1/third_party/terraform/provider/universe/universe_domain_storage_test.go
@@ -0,0 +1,71 @@
+package universe_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+	"github.com/hashicorp/terraform-provider-google/google/envvar"
+)
+
+func TestAccUniverseDomainStorage(t *testing.T) {
+	// Skip this test in all env since this can only run in specific test project.
+	// Location field from `google_storage_bucket` needs to be changed depending on the universe.
+	t.Skip()
+
+	universeDomain := envvar.GetTestUniverseDomainFromEnv(t)
+	bucketName := acctest.TestBucketName(t)
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccStorageBucketDestroyProducer(t),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccUniverseDomain_bucket(universeDomain, bucketName),
+			},
+		},
+	})
+}
+
+func testAccUniverseDomain_bucket(universeDomain string, bucketName string) string {
+	return fmt.Sprintf(`
+provider "google" {
+  universe_domain = "%s"
+}
+	  
+resource "google_storage_bucket" "foo" {
+  name     = "%s"
+  location = "US"
+}
+  
+data "google_storage_bucket" "bar" {
+  name = google_storage_bucket.foo.name
+  depends_on = [
+	google_storage_bucket.foo,
+  ]
+}
+`, universeDomain, bucketName)
+}
+
+func testAccStorageBucketDestroyProducer(t *testing.T) func(s *terraform.State) error {
+	return func(s *terraform.State) error {
+		config := acctest.GoogleProviderConfig(t)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "google_storage_bucket" {
+				continue
+			}
+
+			_, err := config.NewStorageClient(config.UserAgent).Buckets.Get(rs.Primary.ID).Do()
+			if err == nil {
+				return fmt.Errorf("Bucket still exists")
+			}
+		}
+
+		return nil
+	}
+}
diff --git a/mmv1/third_party/terraform/provider/universe/universe_domain_util.go b/mmv1/third_party/terraform/provider/universe/universe_domain_util.go
new file mode 100644
index 000000000000..3a44bb0b1c4a
--- /dev/null
+++ b/mmv1/third_party/terraform/provider/universe/universe_domain_util.go
@@ -0,0 +1,3 @@
+// Temp file to resolve no non-test file in directory error.
+
+package universe
diff --git a/mmv1/third_party/terraform/scripts/diff.go.erb b/mmv1/third_party/terraform/scripts/diff.go.erb
index 3d71b8f690a2..809ef0b048de 100644
--- a/mmv1/third_party/terraform/scripts/diff.go.erb
+++ b/mmv1/third_party/terraform/scripts/diff.go.erb
@@ -13,7 +13,8 @@ import (
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	googleOld "github.com/hashicorp/terraform-provider-clean-<%= provider_name -%>/<%= provider_name -%>/provider"
-	google "github.com/hashicorp/terraform-provider-<%= provider_name -%>/<%= provider_name -%>/provider"
+	// "github.com/hashicorp/terraform-provider-google/google/provider" will be replaced with corresponding package based on the version when generating the provider package
+	google "github.com/hashicorp/terraform-provider-google/google/provider"
 )
 
 var verbose bool
diff --git a/mmv1/third_party/terraform/scripts/go.mod b/mmv1/third_party/terraform/scripts/go.mod
new file mode 100644
index 000000000000..8db8f05e9c85
--- /dev/null
+++ b/mmv1/third_party/terraform/scripts/go.mod
@@ -0,0 +1,3 @@
+module github.com/hashicorp/terraform-provider-google/scripts
+
+go 1.20
diff --git a/mmv1/third_party/terraform/services/accessapproval/data_source_access_approval_folder_service_account.go b/mmv1/third_party/terraform/services/accessapproval/data_source_access_approval_folder_service_account.go
index 2bc48454a986..4727870ba944 100644
--- a/mmv1/third_party/terraform/services/accessapproval/data_source_access_approval_folder_service_account.go
+++ b/mmv1/third_party/terraform/services/accessapproval/data_source_access_approval_folder_service_account.go
@@ -56,7 +56,7 @@ func dataSourceAccessApprovalFolderServiceAccountRead(d *schema.ResourceData, me
 		UserAgent: userAgent,
 	})
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("AccessApprovalFolderServiceAccount %q", d.Id()))
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("AccessApprovalFolderServiceAccount %q", d.Id()), url)
 	}
 
 	if err := d.Set("name", res["name"]); err != nil {
diff --git a/mmv1/third_party/terraform/services/accessapproval/data_source_access_approval_organization_service_account.go b/mmv1/third_party/terraform/services/accessapproval/data_source_access_approval_organization_service_account.go
index b7b2005fbc6e..d785f52f82ed 100644
--- a/mmv1/third_party/terraform/services/accessapproval/data_source_access_approval_organization_service_account.go
+++ b/mmv1/third_party/terraform/services/accessapproval/data_source_access_approval_organization_service_account.go
@@ -56,7 +56,7 @@ func dataSourceAccessApprovalOrganizationServiceAccountRead(d *schema.ResourceDa
 		UserAgent: userAgent,
 	})
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("AccessApprovalOrganizationServiceAccount %q", d.Id()))
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("AccessApprovalOrganizationServiceAccount %q", d.Id()), url)
 	}
 
 	if err := d.Set("name", res["name"]); err != nil {
diff --git a/mmv1/third_party/terraform/services/accessapproval/data_source_access_approval_project_service_account.go b/mmv1/third_party/terraform/services/accessapproval/data_source_access_approval_project_service_account.go
index 1f9794f50e5e..4a0cf4b73036 100644
--- a/mmv1/third_party/terraform/services/accessapproval/data_source_access_approval_project_service_account.go
+++ b/mmv1/third_party/terraform/services/accessapproval/data_source_access_approval_project_service_account.go
@@ -56,7 +56,7 @@ func dataSourceAccessApprovalProjectServiceAccountRead(d *schema.ResourceData, m
 		UserAgent: userAgent,
 	})
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("AccessApprovalProjectServiceAccount %q", d.Id()))
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("AccessApprovalProjectServiceAccount %q", d.Id()), url)
 	}
 
 	if err := d.Set("name", res["name"]); err != nil {
diff --git a/mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_access_level_condition_test.go b/mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_access_level_condition_test.go
index 9b21e7384e73..047e93801469 100644
--- a/mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_access_level_condition_test.go
+++ b/mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_access_level_condition_test.go
@@ -22,10 +22,10 @@ func testAccAccessContextManagerAccessLevelCondition_basicTest(t *testing.T) {
 	project := envvar.GetTestProjectFromEnv()
 
 	serviceAccountName := fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10))
+	vpcName := fmt.Sprintf("test-vpc-%s", acctest.RandString(t, 10))
 
 	expected := map[string]interface{}{
-		"ipSubnetworks": []interface{}{"192.0.4.0/24"},
-		"members":       []interface{}{"user:test@google.com", "user:test2@google.com", fmt.Sprintf("serviceAccount:%s@%s.iam.gserviceaccount.com", serviceAccountName, project)},
+		"members": []interface{}{"user:test@google.com", "user:test2@google.com", fmt.Sprintf("serviceAccount:%s@%s.iam.gserviceaccount.com", serviceAccountName, project)},
 		"devicePolicy": map[string]interface{}{
 			"requireCorpOwned": true,
 			"osConstraints": []interface{}{
@@ -35,6 +35,14 @@ func testAccAccessContextManagerAccessLevelCondition_basicTest(t *testing.T) {
 			},
 		},
 		"regions": []interface{}{"IT", "US"},
+		"vpcNetworkSources": []interface{}{
+			map[string]interface{}{
+				"vpcSubnetwork": map[string]interface{}{
+					"network":          fmt.Sprintf("//compute.googleapis.com/projects/%s/global/networks/%s", project, vpcName),
+					"vpcIpSubnetworks": []interface{}{"20.0.5.0/24"},
+				},
+			},
+		},
 	}
 
 	acctest.VcrTest(t, resource.TestCase{
@@ -43,7 +51,7 @@ func testAccAccessContextManagerAccessLevelCondition_basicTest(t *testing.T) {
 		CheckDestroy:             testAccCheckAccessContextManagerAccessLevelConditionDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccAccessContextManagerAccessLevelCondition_basic(org, "my policy", "level", serviceAccountName),
+				Config: testAccAccessContextManagerAccessLevelCondition_basic(org, "my policy", "level", serviceAccountName, vpcName),
 				Check:  testAccCheckAccessContextManagerAccessLevelConditionPresent(t, "google_access_context_manager_access_level_condition.access-level-condition", expected),
 			},
 		},
@@ -111,7 +119,7 @@ func testAccCheckAccessContextManagerAccessLevelConditionDestroyProducer(t *test
 	}
 }
 
-func testAccAccessContextManagerAccessLevelCondition_basic(org, policyTitle, levelTitleName, saName string) string {
+func testAccAccessContextManagerAccessLevelCondition_basic(org, policyTitle, levelTitleName, saName, vpcName string) string {
 	return fmt.Sprintf(`
 resource "google_access_context_manager_access_policy" "test-access" {
   parent = "organizations/%s"
@@ -139,10 +147,6 @@ resource "google_access_context_manager_access_level" "test-access" {
   "US",
       ]
     }
-
-    conditions {
-      ip_subnetworks = ["176.0.4.0/24"]
-    }
   }
 
   lifecycle {
@@ -154,9 +158,12 @@ resource "google_service_account" "created-later" {
   account_id = "%s"
 }
 
+resource "google_compute_network" "vpc_network" {
+	name = "%s"
+}
+
 resource "google_access_context_manager_access_level_condition" "access-level-condition" {
   access_level = google_access_context_manager_access_level.test-access.name
-  ip_subnetworks = ["192.0.4.0/24"]
   members = ["user:test@google.com", "user:test2@google.com", "serviceAccount:${google_service_account.created-later.email}"]
   negate = false
   device_policy {
@@ -171,6 +178,13 @@ resource "google_access_context_manager_access_level_condition" "access-level-co
     "IT",
     "US",
   ]
+
+	vpc_network_sources {
+		vpc_subnetwork {
+      network = "//compute.googleapis.com/${google_compute_network.vpc_network.id}"
+      vpc_ip_subnetworks = ["20.0.5.0/24"]
+		}
+	}
 }
-`, org, policyTitle, levelTitleName, levelTitleName, saName)
+`, org, policyTitle, levelTitleName, levelTitleName, saName, vpcName)
 }
diff --git a/mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_access_level_test.go.erb b/mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_access_level_test.go.erb
index d1de435be63f..fd21c8ed60d7 100644
--- a/mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_access_level_test.go.erb
+++ b/mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_access_level_test.go.erb
@@ -19,6 +19,7 @@ import (
 
 func testAccAccessContextManagerAccessLevel_basicTest(t *testing.T) {
 	org := envvar.GetTestOrgFromEnv(t)
+	vpcName := fmt.Sprintf("test-vpc-%s", acctest.RandString(t, 10))
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -26,7 +27,7 @@ func testAccAccessContextManagerAccessLevel_basicTest(t *testing.T) {
 		CheckDestroy: testAccCheckAccessContextManagerAccessLevelDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccAccessContextManagerAccessLevel_basic(org, "my policy", "level"),
+				Config: testAccAccessContextManagerAccessLevel_basic(org, "my policy", "level", vpcName),
 			},
 			{
 				ResourceName:      "google_access_context_manager_access_level.test-access",
@@ -114,7 +115,7 @@ func testAccAccessContextManagerAccessLevel_customTest(t *testing.T) {
 	})
 }
 
-func testAccAccessContextManagerAccessLevel_basic(org, policyTitle, levelTitleName string) string {
+func testAccAccessContextManagerAccessLevel_basic(org, policyTitle, levelTitleName, vpcName string) string {
 	return fmt.Sprintf(`
 resource "google_access_context_manager_access_policy" "test-access" {
   parent = "organizations/%s"
@@ -133,7 +134,30 @@ resource "google_access_context_manager_access_level" "test-access" {
     }
   }
 }
-`, org, policyTitle, levelTitleName, levelTitleName)
+
+resource "google_compute_network" "vpc_network" {
+  name = "%s"
+}
+
+resource "google_access_context_manager_access_level" "test-access2" {
+  parent      = "accessPolicies/${google_access_context_manager_access_policy.test-access.name}"
+  name        = "accessPolicies/${google_access_context_manager_access_policy.test-access.name}/accessLevels/%s2"
+  title       = "%s2"
+  description = "hello2"
+  basic {
+    combining_function = "AND"
+    conditions {
+      vpc_network_sources {
+        vpc_subnetwork {
+          network = "//compute.googleapis.com/${google_compute_network.vpc_network.id}"
+          vpc_ip_subnetworks = ["20.0.5.0/24"]
+        }
+      }
+    }
+  }
+}
+
+`, org, policyTitle, levelTitleName, levelTitleName, vpcName, levelTitleName, levelTitleName)
 }
 
 func testAccAccessContextManagerAccessLevel_custom(org, policyTitle, levelTitleName string) string {
diff --git a/mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_access_levels_test.go b/mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_access_levels_test.go
index 4098e8683ff3..21e782058d6f 100644
--- a/mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_access_levels_test.go
+++ b/mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_access_levels_test.go
@@ -17,6 +17,7 @@ import (
 
 func testAccAccessContextManagerAccessLevels_basicTest(t *testing.T) {
 	org := envvar.GetTestOrgFromEnv(t)
+	vpcName := fmt.Sprintf("test-vpc-%s", acctest.RandString(t, 10))
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -32,7 +33,7 @@ func testAccAccessContextManagerAccessLevels_basicTest(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccAccessContextManagerAccessLevels_basicUpdated(org, "my new policy", "corpnet_access", "prodnet_access"),
+				Config: testAccAccessContextManagerAccessLevels_basicUpdated(org, "my new policy", "corpnet_access", "prodnet_access", vpcName),
 			},
 			{
 				ResourceName:      "google_access_context_manager_access_levels.test-access",
@@ -116,13 +117,17 @@ resource "google_access_context_manager_access_levels" "test-access" {
 `, org, policyTitle, levelTitleName1, levelTitleName1, levelTitleName2, levelTitleName2)
 }
 
-func testAccAccessContextManagerAccessLevels_basicUpdated(org, policyTitle, levelTitleName1, levelTitleName2 string) string {
+func testAccAccessContextManagerAccessLevels_basicUpdated(org, policyTitle, levelTitleName1, levelTitleName2, vpcName string) string {
 	return fmt.Sprintf(`
 resource "google_access_context_manager_access_policy" "test-access" {
   parent = "organizations/%s"
   title  = "%s"
 }
 
+resource "google_compute_network" "vpc_network" {
+	name = "%s"
+}
+
 resource "google_access_context_manager_access_levels" "test-access" {
   parent      = "accessPolicies/${google_access_context_manager_access_policy.test-access.name}"
 
@@ -139,17 +144,22 @@ resource "google_access_context_manager_access_levels" "test-access" {
   }
 
   access_levels {
-	name        = "accessPolicies/${google_access_context_manager_access_policy.test-access.name}/accessLevels/%s"
-	title       = "%s"
-	description = "hello again"
-	basic {
-	  conditions {
-	    ip_subnetworks = ["176.0.4.0/24"]
-	  }
+    name        = "accessPolicies/${google_access_context_manager_access_policy.test-access.name}/accessLevels/%s"
+    title       = "%s"
+    description = "hello again"
+    basic {
+      conditions {
+        vpc_network_sources {
+          vpc_subnetwork {
+            network = "//compute.googleapis.com/${google_compute_network.vpc_network.id}"
+            vpc_ip_subnetworks = ["20.0.5.0/24"]
+          }
+        }
+      }
     }
   }
 }
-`, org, policyTitle, levelTitleName1, levelTitleName1, levelTitleName2, levelTitleName2)
+`, org, policyTitle, vpcName, levelTitleName1, levelTitleName1, levelTitleName2, levelTitleName2)
 }
 
 func testAccAccessContextManagerAccessLevel_empty(org, policyTitle string) string {
diff --git a/mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_service_perimeter_egress_policy_test.go b/mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_service_perimeter_egress_policy_test.go
index f0556dfceb5c..d6c2db7e0771 100644
--- a/mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_service_perimeter_egress_policy_test.go
+++ b/mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_service_perimeter_egress_policy_test.go
@@ -110,10 +110,27 @@ resource "google_access_context_manager_service_perimeter_egress_policy" "test-a
 
 }
 
+resource "google_access_context_manager_access_level" "test-access" {
+  parent      = "accessPolicies/${google_access_context_manager_access_policy.test-access.name}"
+  name        = "accessPolicies/${google_access_context_manager_access_policy.test-access.name}/accessLevels/level"
+  title       = "level"
+  description = "hello"
+  basic {
+    combining_function = "AND"
+    conditions {
+      ip_subnetworks = ["192.0.4.0/24"]
+    }
+  }
+}
+
 resource "google_access_context_manager_service_perimeter_egress_policy" "test-access2" {
 	perimeter = google_access_context_manager_service_perimeter.test-access.name
 	egress_from {
 		identity_type = "ANY_USER_ACCOUNT"
+		sources {
+			access_level = google_access_context_manager_access_level.test-access.name
+		}
+		source_restriction = "SOURCE_RESTRICTION_ENABLED"
 	}
 }
 
diff --git a/mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_service_perimeter_test.go.erb b/mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_service_perimeter_test.go.erb
index 8e945af590f8..4281966ca65a 100644
--- a/mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_service_perimeter_test.go.erb
+++ b/mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_service_perimeter_test.go.erb
@@ -207,6 +207,87 @@ resource "google_access_context_manager_service_perimeter" "test-access" {
   name           = "accessPolicies/${google_access_context_manager_access_policy.test-access.name}/servicePerimeters/%s"
   title          = "%s"
   perimeter_type = "PERIMETER_TYPE_REGULAR"
+  use_explicit_dry_run_spec = true
+  spec {
+    restricted_services = ["bigquery.googleapis.com", "storage.googleapis.com"]
+		access_levels       = [google_access_context_manager_access_level.test-access.name]
+
+		vpc_accessible_services {
+			enable_restriction = true
+			allowed_services   = ["bigquery.googleapis.com", "storage.googleapis.com"]
+		}
+
+		ingress_policies {
+			ingress_from {
+				sources {
+					access_level = google_access_context_manager_access_level.test-access.name
+				}
+				identity_type = "ANY_IDENTITY"
+			}
+
+			ingress_to {
+				resources = [ "*" ]
+				operations {
+					service_name = "bigquery.googleapis.com"
+
+					method_selectors {
+						method = "BigQueryStorage.ReadRows"
+					}
+
+					method_selectors {
+						method = "TableService.ListTables"
+					}
+
+					method_selectors {
+						permission = "bigquery.jobs.get"
+					}
+				}
+
+				operations {
+					service_name = "storage.googleapis.com"
+
+					method_selectors {
+						method = "google.storage.objects.create"
+					}
+				}
+			}
+		}
+		ingress_policies {
+			ingress_from {
+				identities = ["user:test@google.com"]
+			}
+			ingress_to {
+				resources = ["*"]
+			}
+		}
+
+		egress_policies {
+			egress_from {
+				identity_type = "ANY_USER_ACCOUNT"
+				sources {
+					access_level = google_access_context_manager_access_level.test-access.name
+				}
+				source_restriction = "SOURCE_RESTRICTION_ENABLED"
+			}
+			egress_to {
+				operations {
+					service_name = "bigquery.googleapis.com"
+					method_selectors {
+						permission = "externalResource.read"
+					}
+				}
+				external_resources = ["s3://bucket1"]
+			}
+		}
+		egress_policies {
+			egress_from {
+				identities = ["user:test@google.com"]
+			}
+			egress_to {
+				resources = ["*"]
+			}
+		}
+  }
   status {
     restricted_services = ["bigquery.googleapis.com", "storage.googleapis.com"]
 		access_levels       = [google_access_context_manager_access_level.test-access.name]
@@ -251,10 +332,39 @@ resource "google_access_context_manager_service_perimeter" "test-access" {
 				}
 			}
 		}
+		ingress_policies {
+			ingress_from {
+				identities = ["user:test@google.com"]
+			}
+			ingress_to {
+				resources = ["*"]
+			}
+		}
 
 		egress_policies {
 			egress_from {
 				identity_type = "ANY_USER_ACCOUNT"
+				sources {
+					access_level = google_access_context_manager_access_level.test-access.name
+				}
+				source_restriction = "SOURCE_RESTRICTION_ENABLED"
+			}
+			egress_to {
+				operations {
+					service_name = "bigquery.googleapis.com"
+					method_selectors {
+						permission = "externalResource.read"
+					}
+				}
+				external_resources = ["s3://bucket1"]
+			}
+		}
+		egress_policies {
+			egress_from {
+				identities = ["user:test@google.com"]
+			}
+			egress_to {
+				resources = ["*"]
 			}
 		}
   }
diff --git a/mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_services_perimeters_test.go b/mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_services_perimeters_test.go
index d66bb2950e49..01ef093c0d13 100644
--- a/mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_services_perimeters_test.go
+++ b/mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_services_perimeters_test.go
@@ -136,6 +136,13 @@ resource "google_access_context_manager_service_perimeters" "test-access" {
             }
           }
         }
+        egress_from {
+          identity_type = "ANY_USER_ACCOUNT"
+          sources {
+            access_level = google_access_context_manager_access_level.test-access.name
+          }
+          source_restriction = "SOURCE_RESTRICTION_ENABLED"
+        }
       }
     }
   }
@@ -199,17 +206,156 @@ resource "google_access_context_manager_service_perimeters" "test-access" {
     name           = "accessPolicies/${google_access_context_manager_access_policy.test-access.name}/servicePerimeters/%s"
     title          = "%s"
     perimeter_type = "PERIMETER_TYPE_REGULAR"
+    use_explicit_dry_run_spec = true
+    spec {
+    restricted_services = ["bigquery.googleapis.com", "storage.googleapis.com"]
+    	access_levels       = [google_access_context_manager_access_level.test-access.name]
+    
+    	vpc_accessible_services {
+    		enable_restriction = true
+    		allowed_services   = ["bigquery.googleapis.com", "storage.googleapis.com"]
+    	}
+    
+    	ingress_policies {
+    		ingress_from {
+    			sources {
+    				access_level = google_access_context_manager_access_level.test-access.name
+    			}
+    			identity_type = "ANY_IDENTITY"
+    		}
+    
+    		ingress_to {
+    			resources = [ "*" ]
+    			operations {
+    				service_name = "bigquery.googleapis.com"
+    
+    				method_selectors {
+    					method = "BigQueryStorage.ReadRows"
+    				}
+    
+    				method_selectors {
+    					method = "TableService.ListTables"
+    				}
+    
+    				method_selectors {
+    					permission = "bigquery.jobs.get"
+    				}
+    			}
+    
+    			operations {
+    				service_name = "storage.googleapis.com"
+    
+    				method_selectors {
+    					method = "google.storage.objects.create"
+    				}
+    			}
+    		}
+    	}
+    	ingress_policies {
+    		ingress_from {
+    			identities = ["user:test@google.com"]
+    		}
+    		ingress_to {
+    			resources = ["*"]
+    		}
+    	}
+    
+    	egress_policies {
+    		egress_from {
+    			identity_type = "ANY_USER_ACCOUNT"
+    		}
+    		egress_to {
+    			operations {
+    				service_name = "bigquery.googleapis.com"
+    				method_selectors {
+    					permission = "externalResource.read"
+    				}
+    			}
+    			external_resources = ["s3://bucket1"]
+    		}
+    	}
+    	egress_policies {
+    		egress_from {
+    			identities = ["user:test@google.com"]
+    		}
+    		egress_to {
+    			resources = ["*"]
+    		}
+    	}
+    }
     status {
-      restricted_services = ["bigquery.googleapis.com"]
+      restricted_services = ["bigquery.googleapis.com", "storage.googleapis.com"]
+      access_levels       = [google_access_context_manager_access_level.test-access.name]
+
+      vpc_accessible_services {
+        enable_restriction = true
+        allowed_services   = ["bigquery.googleapis.com", "storage.googleapis.com"]
+      }
+
+      ingress_policies {
+        ingress_from {
+          sources {
+            access_level = google_access_context_manager_access_level.test-access.name
+          }
+          identity_type = "ANY_IDENTITY"
+        }
+
+        ingress_to {
+          resources = [ "*" ]
+          operations {
+            service_name = "bigquery.googleapis.com"
+
+            method_selectors {
+              method = "BigQueryStorage.ReadRows"
+            }
+
+            method_selectors {
+              method = "TableService.ListTables"
+            }
+
+            method_selectors {
+              permission = "bigquery.jobs.get"
+            }
+          }
+
+          operations {
+            service_name = "storage.googleapis.com"
+
+            method_selectors {
+              method = "google.storage.objects.create"
+            }
+          }
+        }
+      }
+      ingress_policies {
+        ingress_from {
+          identities = ["user:test@google.com"]
+        }
+        ingress_to {
+          resources = ["*"]
+        }
+      }
+
       egress_policies {
+        egress_from {
+          identity_type = "ANY_USER_ACCOUNT"
+        }
         egress_to {
-          external_resources = ["s3://bucket2"]
           operations {
             service_name = "bigquery.googleapis.com"
             method_selectors {
-              method = "*"
+              permission = "externalResource.read"
             }
           }
+          external_resources = ["s3://bucket1"]
+        }
+      }
+      egress_policies {
+        egress_from {
+          identities = ["user:test@google.com"]
+        }
+        egress_to {
+          resources = ["*"]
         }
       }
     }
diff --git a/mmv1/third_party/terraform/services/activedirectory/resource_active_directory_domain_update_test.go b/mmv1/third_party/terraform/services/activedirectory/resource_active_directory_domain_update_test.go
index f88bc7f5e808..de9069c50cc4 100644
--- a/mmv1/third_party/terraform/services/activedirectory/resource_active_directory_domain_update_test.go
+++ b/mmv1/third_party/terraform/services/activedirectory/resource_active_directory_domain_update_test.go
@@ -39,7 +39,7 @@ func TestAccActiveDirectoryDomain_update(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"domain_name"},
+				ImportStateVerifyIgnore: []string{"domain_name", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccADDomainUpdate(context),
@@ -48,7 +48,7 @@ func TestAccActiveDirectoryDomain_update(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"domain_name"},
+				ImportStateVerifyIgnore: []string{"domain_name", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccADDomainBasic(context),
@@ -57,7 +57,7 @@ func TestAccActiveDirectoryDomain_update(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"domain_name"},
+				ImportStateVerifyIgnore: []string{"domain_name", "labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/alloydb/data_source_alloydb_locations.go b/mmv1/third_party/terraform/services/alloydb/data_source_alloydb_locations.go
index d23793f6a7d2..e79df23ac67b 100644
--- a/mmv1/third_party/terraform/services/alloydb/data_source_alloydb_locations.go
+++ b/mmv1/third_party/terraform/services/alloydb/data_source_alloydb_locations.go
@@ -94,7 +94,7 @@ func dataSourceAlloydbLocationsRead(d *schema.ResourceData, meta interface{}) er
 		UserAgent: userAgent,
 	})
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("Locations %q", d.Id()))
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("Locations %q", d.Id()), url)
 	}
 	var locations []map[string]interface{}
 	for {
@@ -142,7 +142,7 @@ func dataSourceAlloydbLocationsRead(d *schema.ResourceData, meta interface{}) er
 			UserAgent: userAgent,
 		})
 		if err != nil {
-			return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("Locations %q", d.Id()))
+			return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("Locations %q", d.Id()), url)
 		}
 	}
 
diff --git a/mmv1/third_party/terraform/services/alloydb/data_source_alloydb_supported_database_flags.go b/mmv1/third_party/terraform/services/alloydb/data_source_alloydb_supported_database_flags.go
index 6404eaa63247..a1615661d5cc 100644
--- a/mmv1/third_party/terraform/services/alloydb/data_source_alloydb_supported_database_flags.go
+++ b/mmv1/third_party/terraform/services/alloydb/data_source_alloydb_supported_database_flags.go
@@ -147,7 +147,7 @@ func dataSourceAlloydbSupportedDatabaseFlagsRead(d *schema.ResourceData, meta in
 		UserAgent: userAgent,
 	})
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("SupportedDatabaseFlags %q", d.Id()))
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("SupportedDatabaseFlags %q", d.Id()), url)
 	}
 	var supportedDatabaseFlags []map[string]interface{}
 	for {
@@ -221,7 +221,7 @@ func dataSourceAlloydbSupportedDatabaseFlagsRead(d *schema.ResourceData, meta in
 			UserAgent: userAgent,
 		})
 		if err != nil {
-			return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("SupportedDatabaseFlags %q", d.Id()))
+			return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("SupportedDatabaseFlags %q", d.Id()), url)
 		}
 	}
 	if err := d.Set("supported_database_flags", supportedDatabaseFlags); err != nil {
diff --git a/mmv1/third_party/terraform/services/alloydb/resource_alloydb_backup_test.go b/mmv1/third_party/terraform/services/alloydb/resource_alloydb_backup_test.go
index 4da0e5c86fa7..6f5c9c6c8616 100644
--- a/mmv1/third_party/terraform/services/alloydb/resource_alloydb_backup_test.go
+++ b/mmv1/third_party/terraform/services/alloydb/resource_alloydb_backup_test.go
@@ -10,9 +10,10 @@ import (
 func TestAccAlloydbBackup_update(t *testing.T) {
 	t.Parallel()
 
+	random_suffix := acctest.RandString(t, 10)
 	context := map[string]interface{}{
-		"network_name":  acctest.BootstrapSharedTestNetwork(t, "alloydb-backup-update"),
-		"random_suffix": acctest.RandString(t, 10),
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydb-backup-update-1"),
+		"random_suffix": random_suffix,
 	}
 
 	acctest.VcrTest(t, resource.TestCase{
@@ -21,13 +22,13 @@ func TestAccAlloydbBackup_update(t *testing.T) {
 		CheckDestroy:             testAccCheckAlloydbBackupDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccAlloydbBackup_alloydbBackupFullExample(context),
+				Config: testAccAlloydbBackup_alloydbBackupBasic(context),
 			},
 			{
 				ResourceName:            "google_alloydb_backup.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"backup_id", "location", "reconciling", "update_time"},
+				ImportStateVerifyIgnore: []string{"backup_id", "location", "reconciling", "update_time", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccAlloydbBackup_update(context),
@@ -36,14 +37,13 @@ func TestAccAlloydbBackup_update(t *testing.T) {
 				ResourceName:            "google_alloydb_backup.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"backup_id", "location", "reconciling", "update_time"},
+				ImportStateVerifyIgnore: []string{"backup_id", "location", "reconciling", "update_time", "labels", "terraform_labels"},
 			},
 		},
 	})
 }
 
-// Updates "label" field from testAccAlloydbBackup_alloydbBackupFullExample
-func testAccAlloydbBackup_update(context map[string]interface{}) string {
+func testAccAlloydbBackup_alloydbBackupBasic(context map[string]interface{}) string {
 	return acctest.Nprintf(`
 resource "google_alloydb_backup" "default" {
   location     = "us-central1"
@@ -52,8 +52,7 @@ resource "google_alloydb_backup" "default" {
 
   description = "example description"
   labels = {
-    "label" = "updated_key"
-    "label2" = "updated_key2"
+    "label" = "key"
   }
   depends_on = [google_alloydb_instance.default]
 }
@@ -68,22 +67,40 @@ resource "google_alloydb_instance" "default" {
   cluster       = google_alloydb_cluster.default.name
   instance_id   = "tf-test-alloydb-instance%{random_suffix}"
   instance_type = "PRIMARY"
+}
 
-  depends_on = [google_service_networking_connection.vpc_connection]
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+`, context)
 }
 
-resource "google_compute_global_address" "private_ip_alloc" {
-  name          =  "tf-test-alloydb-cluster%{random_suffix}"
-  address_type  = "INTERNAL"
-  purpose       = "VPC_PEERING"
-  prefix_length = 16
-  network       = data.google_compute_network.default.id
+// Updates "label" field
+func testAccAlloydbBackup_update(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_backup" "default" {
+  location     = "us-central1"
+  backup_id    = "tf-test-alloydb-backup%{random_suffix}"
+  cluster_name = google_alloydb_cluster.default.name
+
+  description = "example description"
+  labels = {
+    "label" = "updated_key"
+    "label2" = "updated_key2"
+  }
+  depends_on = [google_alloydb_instance.default]
 }
 
-resource "google_service_networking_connection" "vpc_connection" {
-  network                 = data.google_compute_network.default.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
+resource "google_alloydb_cluster" "default" {
+  cluster_id = "tf-test-alloydb-cluster%{random_suffix}"
+  location   = "us-central1"
+  network    = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "default" {
+  cluster       = google_alloydb_cluster.default.name
+  instance_id   = "tf-test-alloydb-instance%{random_suffix}"
+  instance_type = "PRIMARY"
 }
 
 data "google_compute_network" "default" {
@@ -98,7 +115,7 @@ func TestAccAlloydbBackup_createBackupWithMandatoryFields(t *testing.T) {
 
 	context := map[string]interface{}{
 		"random_suffix": acctest.RandString(t, 10),
-		"network_name":  acctest.BootstrapSharedTestNetwork(t, "alloydbbackup-mandatory"),
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydb-backup-mandatory-1"),
 	}
 
 	acctest.VcrTest(t, resource.TestCase{
@@ -138,32 +155,6 @@ resource "google_alloydb_instance" "default" {
   cluster       = google_alloydb_cluster.default.name
   instance_id   = "tf-test-alloydb-instance%{random_suffix}"
   instance_type = "PRIMARY"
-
-  depends_on = [google_service_networking_connection.vpc_connection]
-}
-
-resource "google_compute_global_address" "private_ip_alloc" {
-  name          =  "tf-test-alloydb-cluster%{random_suffix}"
-  address_type  = "INTERNAL"
-  purpose       = "VPC_PEERING"
-  prefix_length = 16
-  network       = data.google_compute_network.default.id
-  lifecycle {
-	ignore_changes = [
-		address,
-		creation_timestamp,
-		id,
-		network,
-		project,
-		self_link
-	]
-  }
-}
-
-resource "google_service_networking_connection" "vpc_connection" {
-  network                 = data.google_compute_network.default.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
 }
 `, context)
 }
@@ -172,7 +163,7 @@ func TestAccAlloydbBackup_usingCMEK(t *testing.T) {
 	t.Parallel()
 
 	context := map[string]interface{}{
-		"network_name":  acctest.BootstrapSharedTestNetwork(t, "alloydb-backup-cmek"),
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydb-backup-cmek-1"),
 		"random_suffix": acctest.RandString(t, 10),
 		"key_name":      "tf-test-key-" + acctest.RandString(t, 10),
 	}
@@ -189,7 +180,7 @@ func TestAccAlloydbBackup_usingCMEK(t *testing.T) {
 				ResourceName:            "google_alloydb_backup.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"backup_id", "location", "reconciling", "update_time"},
+				ImportStateVerifyIgnore: []string{"backup_id", "location", "reconciling", "update_time", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -222,22 +213,6 @@ resource "google_alloydb_instance" "default" {
 	cluster       = google_alloydb_cluster.default.name
 	instance_id   = "tf-test-alloydb-instance%{random_suffix}"
 	instance_type = "PRIMARY"
-	  
-	depends_on = [google_service_networking_connection.vpc_connection]
-}
-	  
-resource "google_compute_global_address" "private_ip_alloc" {
-	name          =  "tf-test-alloydb-cluster%{random_suffix}"
-	address_type  = "INTERNAL"
-	purpose       = "VPC_PEERING"
-	prefix_length = 16
-	network       = data.google_compute_network.default.id
-}
-	  
-resource "google_service_networking_connection" "vpc_connection" {
-	network                 = data.google_compute_network.default.id
-	service                 = "servicenetworking.googleapis.com"
-	reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
 }
 	  
 data "google_compute_network" "default" {
diff --git a/mmv1/third_party/terraform/services/alloydb/resource_alloydb_cluster_restore_test.go b/mmv1/third_party/terraform/services/alloydb/resource_alloydb_cluster_restore_test.go
index d6def69f6832..5288d8ea62f8 100644
--- a/mmv1/third_party/terraform/services/alloydb/resource_alloydb_cluster_restore_test.go
+++ b/mmv1/third_party/terraform/services/alloydb/resource_alloydb_cluster_restore_test.go
@@ -19,7 +19,7 @@ func TestAccAlloydbCluster_restore(t *testing.T) {
 
 	context := map[string]interface{}{
 		"random_suffix": acctest.RandString(t, 10),
-		"network_name":  acctest.BootstrapSharedTestNetwork(t, "alloydbinstance-restore"),
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydb-instance-restore-1"),
 	}
 
 	acctest.VcrTest(t, resource.TestCase{
@@ -93,8 +93,6 @@ resource "google_alloydb_instance" "source" {
   cluster       = google_alloydb_cluster.source.name
   instance_id   = "tf-test-alloydb-instance%{random_suffix}"
   instance_type = "PRIMARY"
-
-  depends_on = [google_service_networking_connection.vpc_connection]
 }
 
 resource "google_alloydb_backup" "default" {
@@ -110,20 +108,6 @@ data "google_project" "project" {}
 data "google_compute_network" "default" {
   name = "%{network_name}"
 }
-
-resource "google_compute_global_address" "private_ip_alloc" {
-  name          =  "tf-test-alloydb-cluster%{random_suffix}"
-  address_type  = "INTERNAL"
-  purpose       = "VPC_PEERING"
-  prefix_length = 16
-  network       = data.google_compute_network.default.id
-}
-
-resource "google_service_networking_connection" "vpc_connection" {
-  network                 = data.google_compute_network.default.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
-}
 `, context)
 }
 
@@ -140,8 +124,6 @@ resource "google_alloydb_instance" "source" {
   cluster       = google_alloydb_cluster.source.name
   instance_id   = "tf-test-alloydb-instance%{random_suffix}"
   instance_type = "PRIMARY"
-
-  depends_on = [google_service_networking_connection.vpc_connection]
 }
 
 resource "google_alloydb_backup" "default" {
@@ -174,20 +156,6 @@ data "google_project" "project" {}
 data "google_compute_network" "default" {
   name = "%{network_name}"
 }
-
-resource "google_compute_global_address" "private_ip_alloc" {
-  name          =  "tf-test-alloydb-cluster%{random_suffix}"
-  address_type  = "INTERNAL"
-  purpose       = "VPC_PEERING"
-  prefix_length = 16
-  network       = data.google_compute_network.default.id
-}
-
-resource "google_service_networking_connection" "vpc_connection" {
-  network                 = data.google_compute_network.default.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
-}
 `, context)
 }
 
@@ -204,8 +172,6 @@ resource "google_alloydb_instance" "source" {
   cluster       = google_alloydb_cluster.source.name
   instance_id   = "tf-test-alloydb-instance%{random_suffix}"
   instance_type = "PRIMARY"
-
-  depends_on = [google_service_networking_connection.vpc_connection]
 }
 
 resource "google_alloydb_backup" "default" {
@@ -235,20 +201,6 @@ data "google_project" "project" {}
 data "google_compute_network" "default" {
   name = "%{network_name}"
 }
-
-resource "google_compute_global_address" "private_ip_alloc" {
-  name          =  "tf-test-alloydb-cluster%{random_suffix}"
-  address_type  = "INTERNAL"
-  purpose       = "VPC_PEERING"
-  prefix_length = 16
-  network       = data.google_compute_network.default.id
-}
-
-resource "google_service_networking_connection" "vpc_connection" {
-  network                 = data.google_compute_network.default.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
-}
 `, context)
 }
 
@@ -264,8 +216,6 @@ resource "google_alloydb_instance" "source" {
   cluster       = google_alloydb_cluster.source.name
   instance_id   = "tf-test-alloydb-instance%{random_suffix}"
   instance_type = "PRIMARY"
-
-  depends_on = [google_service_networking_connection.vpc_connection]
 }
 
 resource "google_alloydb_backup" "default" {
@@ -294,20 +244,6 @@ data "google_project" "project" {}
 data "google_compute_network" "default" {
   name = "%{network_name}"
 }
-
-resource "google_compute_global_address" "private_ip_alloc" {
-  name          =  "tf-test-alloydb-cluster%{random_suffix}"
-  address_type  = "INTERNAL"
-  purpose       = "VPC_PEERING"
-  prefix_length = 16
-  network       = data.google_compute_network.default.id
-}
-
-resource "google_service_networking_connection" "vpc_connection" {
-  network                 = data.google_compute_network.default.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
-}
 `, context)
 }
 
@@ -325,8 +261,6 @@ resource "google_alloydb_instance" "source" {
   cluster       = google_alloydb_cluster.source.name
   instance_id   = "tf-test-alloydb-instance%{random_suffix}"
   instance_type = "PRIMARY"
-
-  depends_on = [google_service_networking_connection.vpc_connection]
 }
 
 resource "google_alloydb_backup" "default" {
@@ -369,20 +303,6 @@ data "google_project" "project" {}
 data "google_compute_network" "default" {
   name = "%{network_name}"
 }
-
-resource "google_compute_global_address" "private_ip_alloc" {
-  name          =  "tf-test-alloydb-cluster%{random_suffix}"
-  address_type  = "INTERNAL"
-  purpose       = "VPC_PEERING"
-  prefix_length = 16
-  network       = data.google_compute_network.default.id
-}
-
-resource "google_service_networking_connection" "vpc_connection" {
-  network                 = data.google_compute_network.default.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
-}
 `, context)
 }
 
@@ -400,8 +320,6 @@ resource "google_alloydb_instance" "source" {
   cluster       = google_alloydb_cluster.source.name
   instance_id   = "tf-test-alloydb-instance%{random_suffix}"
   instance_type = "PRIMARY"
-
-  depends_on = [google_service_networking_connection.vpc_connection]
 }
 
 resource "google_alloydb_backup" "default" {
@@ -454,20 +372,6 @@ data "google_project" "project" {}
 data "google_compute_network" "default" {
   name = "%{network_name}"
 }
-
-resource "google_compute_global_address" "private_ip_alloc" {
-  name          =  "tf-test-alloydb-cluster%{random_suffix}"
-  address_type  = "INTERNAL"
-  purpose       = "VPC_PEERING"
-  prefix_length = 16
-  network       = data.google_compute_network.default.id
-}
-
-resource "google_service_networking_connection" "vpc_connection" {
-  network                 = data.google_compute_network.default.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
-}
 `, context)
 }
 
@@ -485,8 +389,6 @@ resource "google_alloydb_instance" "source" {
   cluster       = google_alloydb_cluster.source.name
   instance_id   = "tf-test-alloydb-instance%{random_suffix}"
   instance_type = "PRIMARY"
-
-  depends_on = [google_service_networking_connection.vpc_connection]
 }
 
 resource "google_alloydb_backup" "default" {
@@ -549,20 +451,6 @@ data "google_project" "project" {}
 data "google_compute_network" "default" {
   name = "%{network_name}"
 }
-
-resource "google_compute_global_address" "private_ip_alloc" {
-  name          =  "tf-test-alloydb-cluster%{random_suffix}"
-  address_type  = "INTERNAL"
-  purpose       = "VPC_PEERING"
-  prefix_length = 16
-  network       = data.google_compute_network.default.id
-}
-
-resource "google_service_networking_connection" "vpc_connection" {
-  network                 = data.google_compute_network.default.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
-}
 `, context)
 }
 
@@ -580,8 +468,6 @@ resource "google_alloydb_instance" "source" {
   cluster       = google_alloydb_cluster.source.name
   instance_id   = "tf-test-alloydb-instance%{random_suffix}"
   instance_type = "PRIMARY"
-
-  depends_on = [google_service_networking_connection.vpc_connection]
 }
 
 resource "google_alloydb_backup" "default" {
@@ -616,19 +502,5 @@ data "google_project" "project" {}
 data "google_compute_network" "default" {
   name = "%{network_name}"
 }
-
-resource "google_compute_global_address" "private_ip_alloc" {
-  name          =  "tf-test-alloydb-cluster%{random_suffix}"
-  address_type  = "INTERNAL"
-  purpose       = "VPC_PEERING"
-  prefix_length = 16
-  network       = data.google_compute_network.default.id
-}
-
-resource "google_service_networking_connection" "vpc_connection" {
-  network                 = data.google_compute_network.default.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
-}
 `, context)
 }
diff --git a/mmv1/third_party/terraform/services/alloydb/resource_alloydb_cluster_test.go b/mmv1/third_party/terraform/services/alloydb/resource_alloydb_cluster_test.go
index 0539c908324b..21ba1948a2ff 100644
--- a/mmv1/third_party/terraform/services/alloydb/resource_alloydb_cluster_test.go
+++ b/mmv1/third_party/terraform/services/alloydb/resource_alloydb_cluster_test.go
@@ -26,7 +26,7 @@ func TestAccAlloydbCluster_update(t *testing.T) {
 				ResourceName:            "google_alloydb_cluster.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"initial_user", "cluster_id", "location"},
+				ImportStateVerifyIgnore: []string{"initial_user", "cluster_id", "location", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccAlloydbCluster_update(context),
@@ -35,7 +35,7 @@ func TestAccAlloydbCluster_update(t *testing.T) {
 				ResourceName:            "google_alloydb_cluster.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"initial_user", "cluster_id", "location"},
+				ImportStateVerifyIgnore: []string{"initial_user", "cluster_id", "location", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccAlloydbCluster_alloydbClusterBasicExample(context),
@@ -1092,3 +1092,94 @@ resource "google_kms_crypto_key_iam_binding" "crypto_key" {
   }
 `, context)
 }
+
+// Ensures cluster creation works with networkConfig.
+func TestAccAlloydbCluster_withNetworkConfig(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbCluster_withNetworkConfig(context),
+			},
+			{
+				ResourceName:      "google_alloydb_cluster.default",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccAlloydbCluster_withNetworkConfig(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "default" {
+  cluster_id = "tf-test-alloydb-cluster%{random_suffix}"
+  location   = "us-central1"
+  network_config {
+	network    = "projects/${data.google_project.project.number}/global/networks/${google_compute_network.default.name}"
+  }
+}
+data "google_project" "project" {}
+resource "google_compute_network" "default" {
+  name = "tf-test-alloydb-cluster%{random_suffix}"
+}
+`, context)
+}
+
+// Ensures cluster creation works with networkConfig and a specified allocated IP range.
+func TestAccAlloydbCluster_withNetworkConfigAndAllocatedIPRange(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbCluster_withNetworkConfigAndAllocatedIPRange(context),
+			},
+			{
+				ResourceName:      "google_alloydb_cluster.default",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccAlloydbCluster_withNetworkConfigAndAllocatedIPRange(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "default" {
+  cluster_id = "tf-test-alloydb-cluster%{random_suffix}"
+  location   = "us-central1"
+  network_config {
+	network    = "projects/${data.google_project.project.number}/global/networks/${google_compute_network.default.name}"
+	allocated_ip_range = google_compute_global_address.private_ip_alloc.name
+  }
+}
+data "google_project" "project" {}
+resource "google_compute_network" "default" {
+  name = "tf-test-alloydb-cluster%{random_suffix}"
+}
+resource "google_compute_global_address" "private_ip_alloc" {
+	name          =  "tf-test-alloydb-cluster%{random_suffix}"
+	address_type  = "INTERNAL"
+	purpose       = "VPC_PEERING"
+	prefix_length = 16
+	network       = google_compute_network.default.id
+  }
+  
+`, context)
+}
diff --git a/mmv1/third_party/terraform/services/alloydb/resource_alloydb_instance_test.go b/mmv1/third_party/terraform/services/alloydb/resource_alloydb_instance_test.go
index 944d04c25ad1..4294edc2afb0 100644
--- a/mmv1/third_party/terraform/services/alloydb/resource_alloydb_instance_test.go
+++ b/mmv1/third_party/terraform/services/alloydb/resource_alloydb_instance_test.go
@@ -10,9 +10,10 @@ import (
 func TestAccAlloydbInstance_update(t *testing.T) {
 	t.Parallel()
 
+	random_suffix := acctest.RandString(t, 10)
 	context := map[string]interface{}{
-		"random_suffix": acctest.RandString(t, 10),
-		"network_name":  acctest.BootstrapSharedTestNetwork(t, "alloydbinstance-update"),
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydb-instance-update-1"),
+		"random_suffix": random_suffix,
 	}
 
 	acctest.VcrTest(t, resource.TestCase{
@@ -21,7 +22,7 @@ func TestAccAlloydbInstance_update(t *testing.T) {
 		CheckDestroy:             testAccCheckAlloydbInstanceDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccAlloydbInstance_alloydbInstanceBasicExample(context),
+				Config: testAccAlloydbInstance_alloydbInstanceBasic(context),
 			},
 			{
 				ResourceName:            "google_alloydb_instance.default",
@@ -36,12 +37,40 @@ func TestAccAlloydbInstance_update(t *testing.T) {
 				ResourceName:            "google_alloydb_instance.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"cluster", "instance_id", "reconciling", "update_time"},
+				ImportStateVerifyIgnore: []string{"cluster", "instance_id", "reconciling", "update_time", "labels", "terraform_labels"},
 			},
 		},
 	})
 }
 
+func testAccAlloydbInstance_alloydbInstanceBasic(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_instance" "default" {
+  cluster       = google_alloydb_cluster.default.name
+  instance_id   = "tf-test-alloydb-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "default" {
+  cluster_id = "tf-test-alloydb-cluster%{random_suffix}"
+  location   = "us-central1"
+  network    = data.google_compute_network.default.id
+
+  initial_user {
+    password = "tf-test-alloydb-cluster%{random_suffix}"
+  }
+}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+`, context)
+}
+
 func testAccAlloydbInstance_update(context map[string]interface{}) string {
 	return acctest.Nprintf(`
 resource "google_alloydb_instance" "default" {
@@ -56,8 +85,6 @@ resource "google_alloydb_instance" "default" {
   labels = {
 	test = "tf-test-alloydb-instance%{random_suffix}"
   }
-
-  depends_on = [google_service_networking_connection.vpc_connection]
 }
 
 resource "google_alloydb_cluster" "default" {
@@ -70,26 +97,9 @@ resource "google_alloydb_cluster" "default" {
   }
 }
 
-data "google_project" "project" {
-}
-
 data "google_compute_network" "default" {
   name = "%{network_name}"
 }
-
-resource "google_compute_global_address" "private_ip_alloc" {
-  name          =  "tf-test-alloydb-cluster%{random_suffix}"
-  address_type  = "INTERNAL"
-  purpose       = "VPC_PEERING"
-  prefix_length = 16
-  network       = data.google_compute_network.default.id
-}
-
-resource "google_service_networking_connection" "vpc_connection" {
-  network                 = data.google_compute_network.default.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
-}
 `, context)
 }
 
@@ -99,7 +109,7 @@ func TestAccAlloydbInstance_createInstanceWithMandatoryFields(t *testing.T) {
 
 	context := map[string]interface{}{
 		"random_suffix": acctest.RandString(t, 10),
-		"network_name":  acctest.BootstrapSharedTestNetwork(t, "alloydbinstance-mandatory"),
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydb-instance-mandatory-1"),
 	}
 
 	acctest.VcrTest(t, resource.TestCase{
@@ -120,8 +130,6 @@ resource "google_alloydb_instance" "default" {
   cluster       = google_alloydb_cluster.default.name
   instance_id   = "tf-test-alloydb-instance%{random_suffix}"
   instance_type = "PRIMARY"
-
-  depends_on = [google_service_networking_connection.vpc_connection]
 }
 
 resource "google_alloydb_cluster" "default" {
@@ -135,30 +143,16 @@ data "google_project" "project" {}
 data "google_compute_network" "default" {
   name = "%{network_name}"
 }
-
-resource "google_compute_global_address" "private_ip_alloc" {
-  name          =  "tf-test-alloydb-cluster%{random_suffix}"
-  address_type  = "INTERNAL"
-  purpose       = "VPC_PEERING"
-  prefix_length = 16
-  network       = data.google_compute_network.default.id
-}
-
-resource "google_service_networking_connection" "vpc_connection" {
-  network                 = data.google_compute_network.default.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
-}
 `, context)
 }
 
 // This test passes if we are able to create a primary instance with maximum number of fields
-func TestAccAlloydbInstance_createInstanceWithMaximumFields(t *testing.T) {
+/* func TestAccAlloydbInstance_createInstanceWithMaximumFields(t *testing.T) {
 	t.Parallel()
 
 	context := map[string]interface{}{
 		"random_suffix": acctest.RandString(t, 10),
-		"network_name":  acctest.BootstrapSharedTestNetwork(t, "alloydbinstance-maximum"),
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydb-instance-maximum-1"),
 	}
 
 	acctest.VcrTest(t, resource.TestCase{
@@ -193,6 +187,12 @@ resource "google_alloydb_instance" "default" {
   machine_config {
 	  cpu_count = 4
   }
+  query_insights_config {
+    query_string_length = 300
+    record_application_tags = "false"
+    record_client_address = "true"
+    query_plans_per_minute = 10
+  }
   depends_on = [google_service_networking_connection.vpc_connection]
   lifecycle {
     ignore_changes = [
@@ -213,22 +213,8 @@ data "google_project" "project" {}
 data "google_compute_network" "default" {
   name = "%{network_name}"
 }
-
-resource "google_compute_global_address" "private_ip_alloc" {
-  name          =  "tf-test-alloydb-cluster%{random_suffix}"
-  address_type  = "INTERNAL"
-  purpose       = "VPC_PEERING"
-  prefix_length = 16
-  network       = data.google_compute_network.default.id
-}
-
-resource "google_service_networking_connection" "vpc_connection" {
-  network                 = data.google_compute_network.default.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
-}
 `, context)
-}
+}*/
 
 // This test passes if we are able to create a primary instance with an associated read-pool instance
 func TestAccAlloydbInstance_createPrimaryAndReadPoolInstance(t *testing.T) {
@@ -236,7 +222,7 @@ func TestAccAlloydbInstance_createPrimaryAndReadPoolInstance(t *testing.T) {
 
 	context := map[string]interface{}{
 		"random_suffix": acctest.RandString(t, 10),
-		"network_name":  acctest.BootstrapSharedTestNetwork(t, "alloydbinstance-readpool"),
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydb-instance-readpool-1"),
 	}
 
 	acctest.VcrTest(t, resource.TestCase{
@@ -257,7 +243,6 @@ resource "google_alloydb_instance" "primary" {
   cluster       = google_alloydb_cluster.default.name
   instance_id   = "tf-test-alloydb-instance%{random_suffix}"
   instance_type = "PRIMARY"
-  depends_on = [google_service_networking_connection.vpc_connection]
 }
 
 resource "google_alloydb_instance" "read_pool" {
@@ -267,7 +252,7 @@ resource "google_alloydb_instance" "read_pool" {
   read_pool_config {
     node_count = 4
   }
-  depends_on = [google_service_networking_connection.vpc_connection, google_alloydb_instance.primary]
+  depends_on = [google_alloydb_instance.primary]
 }
 
 resource "google_alloydb_cluster" "default" {
@@ -281,30 +266,16 @@ data "google_project" "project" {}
 data "google_compute_network" "default" {
   name = "%{network_name}"
 }
-
-resource "google_compute_global_address" "private_ip_alloc" {
-  name          =  "tf-test-alloydb-cluster%{random_suffix}"
-  address_type  = "INTERNAL"
-  purpose       = "VPC_PEERING"
-  prefix_length = 16
-  network       = data.google_compute_network.default.id
-}
-
-resource "google_service_networking_connection" "vpc_connection" {
-  network                 = data.google_compute_network.default.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
-}
 `, context)
 }
 
 // This test passes if we are able to update a database flag in primary instance
-func TestAccAlloydbInstance_updateDatabaseFlagInPrimaryInstance(t *testing.T) {
+/*func TestAccAlloydbInstance_updateDatabaseFlagInPrimaryInstance(t *testing.T) {
 	t.Parallel()
 
 	context := map[string]interface{}{
 		"random_suffix": acctest.RandString(t, 10),
-		"network_name":  acctest.BootstrapSharedTestNetwork(t, "alloydbinstance-updatedb"),
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydb-instance-updatedb-1"),
 	}
 
 	acctest.VcrTest(t, resource.TestCase{
@@ -336,7 +307,6 @@ resource "google_alloydb_instance" "primary" {
   database_flags = {
 	  "alloydb.enable_auto_explain" = "true"
   }
-  depends_on = [google_service_networking_connection.vpc_connection]
 }
 
 resource "google_alloydb_cluster" "default" {
@@ -350,22 +320,8 @@ data "google_project" "project" {}
 data "google_compute_network" "default" {
   name = "%{network_name}"
 }
-
-resource "google_compute_global_address" "private_ip_alloc" {
-  name          =  "tf-test-alloydb-cluster%{random_suffix}"
-  address_type  = "INTERNAL"
-  purpose       = "VPC_PEERING"
-  prefix_length = 16
-  network       = data.google_compute_network.default.id
-}
-
-resource "google_service_networking_connection" "vpc_connection" {
-  network                 = data.google_compute_network.default.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
-}
 `, context)
-}
+}*/
 
 func testAccAlloydbInstance_autoExplainDisabledInPrimaryInstance(context map[string]interface{}) string {
 	return acctest.Nprintf(`
@@ -376,7 +332,6 @@ resource "google_alloydb_instance" "primary" {
   database_flags = {
 	  "alloydb.enable_auto_explain" = "false"
   }
-  depends_on = [google_service_networking_connection.vpc_connection]
 }
 
 resource "google_alloydb_cluster" "default" {
@@ -390,19 +345,222 @@ data "google_project" "project" {}
 data "google_compute_network" "default" {
   name = "%{network_name}"
 }
+`, context)
+}
 
-resource "google_compute_global_address" "private_ip_alloc" {
-  name          =  "tf-test-alloydb-cluster%{random_suffix}"
-  address_type  = "INTERNAL"
-  purpose       = "VPC_PEERING"
-  prefix_length = 16
-  network       = data.google_compute_network.default.id
+// This test passes if we are able to create a primary instance by specifying network_config.network and network_config.allocated_ip_range
+func TestAccAlloydbInstance_createInstanceWithNetworkConfigAndAllocatedIPRange(t *testing.T) {
+	t.Parallel()
+
+	testId := "alloydbinstance-network-config-1"
+	addressName := acctest.BootstrapSharedTestGlobalAddress(t, testId)
+	networkName := acctest.BootstrapSharedServiceNetworkingConnection(t, testId)
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+		"network_name":  networkName,
+		"address_name":  addressName,
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbInstance_createInstanceWithNetworkConfigAndAllocatedIPRange(context),
+			},
+		},
+	})
+}
+
+func testAccAlloydbInstance_createInstanceWithNetworkConfigAndAllocatedIPRange(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_instance" "default" {
+  cluster       = google_alloydb_cluster.default.name
+  instance_id   = "tf-test-alloydb-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+}
+
+resource "google_alloydb_cluster" "default" {
+  cluster_id = "tf-test-alloydb-cluster%{random_suffix}"
+  location   = "us-central1"
+  network_config {
+    network    = data.google_compute_network.default.id
+    allocated_ip_range = data.google_compute_global_address.private_ip_alloc.name
+  }
+}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
 }
 
-resource "google_service_networking_connection" "vpc_connection" {
-  network                 = data.google_compute_network.default.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
+data "google_compute_global_address" "private_ip_alloc" {
+  name =  "%{address_name}"
+}
+`, context)
+}
+
+// This test passes if an instance is able to be created specifying require
+// connectors and the ssl mode; if the instance is able to update require
+// connectors, and the ssl mode in the client connection config; if the ssl
+// mode specified is removed it doesn't not change the ssl mode; and if the
+// require connectors is remove it doesn't change require connectors either.
+func TestAccAlloydbInstance_clientConnectionConfig(t *testing.T) {
+	t.Parallel()
+
+	suffix := acctest.RandString(t, 10)
+	networkName := acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-clientconnectionconfig")
+
+	context := map[string]interface{}{
+		"random_suffix":      suffix,
+		"network_name":       networkName,
+		"require_connectors": true,
+		"ssl_mode":           "ENCRYPTED_ONLY",
+	}
+	context2 := map[string]interface{}{
+		"random_suffix":      suffix,
+		"network_name":       networkName,
+		"require_connectors": false,
+		"ssl_mode":           "ALLOW_UNENCRYPTED_AND_ENCRYPTED",
+	}
+	context3 := map[string]interface{}{
+		"random_suffix":      suffix,
+		"network_name":       networkName,
+		"require_connectors": false,
+	}
+	context4 := map[string]interface{}{
+		"random_suffix":      suffix,
+		"network_name":       networkName,
+		"require_connectors": false,
+		"ssl_mode":           "ENCRYPTED_ONLY",
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbInstance_clientConnectionConfig(context),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_alloydb_instance.default", "client_connection_config.0.require_connectors", "true"),
+					resource.TestCheckResourceAttr("google_alloydb_instance.default", "client_connection_config.0.ssl_config.0.ssl_mode", "ENCRYPTED_ONLY"),
+				),
+			},
+			{
+				ResourceName:            "google_alloydb_instance.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"cluster", "instance_id", "reconciling", "update_time"},
+			},
+			{
+				Config: testAccAlloydbInstance_clientConnectionConfig(context2),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_alloydb_instance.default", "client_connection_config.0.require_connectors", "false"),
+					resource.TestCheckResourceAttr("google_alloydb_instance.default", "client_connection_config.0.ssl_config.0.ssl_mode", "ALLOW_UNENCRYPTED_AND_ENCRYPTED"),
+				),
+			},
+			{
+				ResourceName:            "google_alloydb_instance.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"cluster", "instance_id", "reconciling", "update_time"},
+			},
+			{
+				Config: testAccAlloydbInstance_noSSLModeConfig(context3),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_alloydb_instance.default", "client_connection_config.0.require_connectors", "false"),
+					resource.TestCheckResourceAttr("google_alloydb_instance.default", "client_connection_config.0.ssl_config.0.ssl_mode", "ALLOW_UNENCRYPTED_AND_ENCRYPTED"),
+				),
+			},
+			{
+				ResourceName:            "google_alloydb_instance.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"cluster", "instance_id", "reconciling", "update_time"},
+			},
+			{
+				Config: testAccAlloydbInstance_clientConnectionConfig(context4),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_alloydb_instance.default", "client_connection_config.0.require_connectors", "false"),
+					resource.TestCheckResourceAttr("google_alloydb_instance.default", "client_connection_config.0.ssl_config.0.ssl_mode", "ENCRYPTED_ONLY"),
+				),
+			},
+			{
+				ResourceName:            "google_alloydb_instance.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"cluster", "instance_id", "reconciling", "update_time"},
+			},
+			{
+				Config: testAccAlloydbInstance_noSSLModeConfig(context3),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_alloydb_instance.default", "client_connection_config.0.require_connectors", "false"),
+					resource.TestCheckResourceAttr("google_alloydb_instance.default", "client_connection_config.0.ssl_config.0.ssl_mode", "ENCRYPTED_ONLY"),
+				),
+			},
+			{
+				ResourceName:            "google_alloydb_instance.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"cluster", "instance_id", "reconciling", "update_time"},
+			},
+		},
+	})
+}
+
+func testAccAlloydbInstance_noSSLModeConfig(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_instance" "default" {
+  cluster       = google_alloydb_cluster.default.name
+  instance_id   = "tf-test-alloydb-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  client_connection_config {
+    require_connectors = %{require_connectors}
+  }	
+}
+
+resource "google_alloydb_cluster" "default" {
+  cluster_id = "tf-test-alloydb-cluster%{random_suffix}"
+  location   = "us-central1"
+  network    = data.google_compute_network.default.id
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+	name = "%{network_name}"
+}
+`, context)
+}
+
+func testAccAlloydbInstance_clientConnectionConfig(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_instance" "default" {
+  cluster       = google_alloydb_cluster.default.name
+  instance_id   = "tf-test-alloydb-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  client_connection_config {
+    require_connectors = %{require_connectors}
+    ssl_config {
+      ssl_mode = "%{ssl_mode}"
+    }
+  }	
+}
+
+resource "google_alloydb_cluster" "default" {
+  cluster_id = "tf-test-alloydb-cluster%{random_suffix}"
+  location   = "us-central1"
+  network    = data.google_compute_network.default.id
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+	name = "%{network_name}"
 }
 `, context)
 }
diff --git a/mmv1/third_party/terraform/services/alloydb/resource_alloydb_secondary_cluster_test.go b/mmv1/third_party/terraform/services/alloydb/resource_alloydb_secondary_cluster_test.go
new file mode 100644
index 000000000000..55e01d0a2c54
--- /dev/null
+++ b/mmv1/third_party/terraform/services/alloydb/resource_alloydb_secondary_cluster_test.go
@@ -0,0 +1,1743 @@
+package alloydb_test
+
+import (
+	"regexp"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+)
+
+// The cluster creation should succeed with minimal number of arguments
+func TestAccAlloydbCluster_secondaryClusterMandatoryFields(t *testing.T) {
+	t.Parallel()
+	// https://github.com/hashicorp/terraform-provider-google/issues/16231
+	acctest.SkipIfVcr(t)
+	context := map[string]interface{}{
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbCluster_secondaryClusterMandatoryFields(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "labels", "annotations", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccAlloydbCluster_secondaryClusterMandatoryFields(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network    = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "us-east1"
+  network      = data.google_compute_network.default.id
+  cluster_type = "SECONDARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  secondary_config {
+    primary_cluster_name = google_alloydb_cluster.primary.name
+  }
+
+  depends_on = [google_alloydb_instance.primary]
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+`, context)
+}
+
+// Validation test to ensure proper error is raised if create secondary cluster is called without any secondary_config field
+func TestAccAlloydbCluster_secondaryClusterMissingSecondaryConfig(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config:      testAccAlloydbCluster_secondaryClusterMissingSecondaryConfig(context),
+				ExpectError: regexp.MustCompile("Error creating cluster. Can not create secondary cluster without secondary_config field."),
+			},
+		},
+	})
+}
+
+func testAccAlloydbCluster_secondaryClusterMissingSecondaryConfig(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network    = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "us-east1"
+  network      = data.google_compute_network.default.id
+  cluster_type = "SECONDARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  depends_on = [google_alloydb_instance.primary]
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+`, context)
+}
+
+// Validation test to ensure proper error is raised if secondary_config field is provided but no cluster_type is specified.
+func TestAccAlloydbCluster_secondaryClusterDefinedSecondaryConfigButMissingClusterTypeSecondary(t *testing.T) {
+	t.Parallel()
+
+	// Unskip in https://github.com/hashicorp/terraform-provider-google/issues/16231
+	acctest.SkipIfVcr(t)
+
+	context := map[string]interface{}{
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config:      testAccAlloydbCluster_secondaryClusterDefinedSecondaryConfigButMissingClusterTypeSecondary(context),
+				ExpectError: regexp.MustCompile("Error creating cluster. Add {cluster_type: \"SECONDARY\"} if attempting to create a secondary cluster, otherwise remove the secondary_config."),
+			},
+		},
+	})
+}
+
+func testAccAlloydbCluster_secondaryClusterDefinedSecondaryConfigButMissingClusterTypeSecondary(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network    = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "us-east1"
+  network      = data.google_compute_network.default.id
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  secondary_config {
+    primary_cluster_name = google_alloydb_cluster.primary.name
+  }
+
+  depends_on = [google_alloydb_instance.primary]
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+`, context)
+}
+
+// Validation test to ensure proper error is raised if secondary_config field is provided but cluster_type is primary
+func TestAccAlloydbCluster_secondaryClusterDefinedSecondaryConfigButClusterTypeIsPrimary(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config:      testAccAlloydbCluster_secondaryClusterDefinedSecondaryConfigButClusterTypeIsPrimary(context),
+				ExpectError: regexp.MustCompile("Error creating cluster. Add {cluster_type: \"SECONDARY\"} if attempting to create a secondary cluster, otherwise remove the secondary_config."),
+			},
+		},
+	})
+}
+
+func testAccAlloydbCluster_secondaryClusterDefinedSecondaryConfigButClusterTypeIsPrimary(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network    = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "us-east1"
+  network      = data.google_compute_network.default.id
+  cluster_type = "PRIMARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  secondary_config {
+    primary_cluster_name = google_alloydb_cluster.primary.name
+  }
+
+  depends_on = [google_alloydb_instance.primary]
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+`, context)
+}
+
+// This test passes if secondary cluster can be updated
+func TestAccAlloydbCluster_secondaryClusterUpdate(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbCluster_secondaryClusterMandatoryFields(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "labels", "annotations", "terraform_labels"},
+			},
+			{
+				Config: testAccAlloydbCluster_secondaryClusterUpdate(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "labels", "annotations", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccAlloydbCluster_secondaryClusterUpdate(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network    = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "us-east1"
+  network      = data.google_compute_network.default.id
+  cluster_type = "SECONDARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  secondary_config {
+    primary_cluster_name = google_alloydb_cluster.primary.name
+  }
+
+  labels = {
+    foo = "bar"
+  }
+
+  depends_on = [google_alloydb_instance.primary]
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+`, context)
+}
+
+// Test if adding automatedBackupPolicy throws an error as it can not be enabled on secondary cluster
+func TestAccAlloydbCluster_secondaryClusterAddAutomatedBackupPolicy(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+		"random_suffix": acctest.RandString(t, 10),
+		"hour":          23,
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbCluster_secondaryClusterMandatoryFields(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "labels", "annotations", "terraform_labels"},
+			},
+			{
+				// Invalid input check - can not add automated backup policy to a secondary cluster
+				Config:      testAccAlloydbCluster_secondaryClusterAddAutomatedBackupPolicy(context),
+				ExpectError: regexp.MustCompile("cannot enable automated backups on secondary cluster until it is promoted"),
+			},
+		},
+	})
+}
+
+func testAccAlloydbCluster_secondaryClusterAddAutomatedBackupPolicy(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network    = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "us-east1"
+  network      = data.google_compute_network.default.id
+  cluster_type = "SECONDARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  secondary_config {
+    primary_cluster_name = google_alloydb_cluster.primary.name
+  }
+
+  automated_backup_policy {
+    location      = "us-central1"
+    backup_window = "1800s"
+    enabled       = true
+
+    weekly_schedule {
+      days_of_week = ["MONDAY"]
+
+      start_times {
+        hours   = %{hour}
+        minutes = 0
+        seconds = 0
+        nanos   = 0
+      }
+    }
+
+    quantity_based_retention {
+      count = 1
+    }
+
+    labels = {
+      test = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+    }
+  }
+
+  depends_on = [google_alloydb_instance.primary]
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+`, context)
+}
+
+func TestAccAlloydbCluster_secondaryClusterUsingCMEK(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+		"random_suffix": acctest.RandString(t, 10),
+		"key_name":      "tf-test-key-" + acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbCluster_secondaryClusterUsingCMEK(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "labels", "annotations", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccAlloydbCluster_secondaryClusterUsingCMEK(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network      = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "us-east1"
+  network      = data.google_compute_network.default.id
+  cluster_type = "SECONDARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  secondary_config {
+    primary_cluster_name = google_alloydb_cluster.primary.name
+  }
+
+  encryption_config {
+    kms_key_name = google_kms_crypto_key.key.id
+  }
+
+  depends_on = [google_alloydb_instance.primary, google_kms_crypto_key_iam_binding.crypto_key]
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+
+resource "google_kms_key_ring" "keyring" {
+  name     = "%{key_name}"
+  location = "us-east1"
+}
+
+resource "google_kms_crypto_key" "key" {
+  name     = "%{key_name}"
+  key_ring = google_kms_key_ring.keyring.id
+}
+
+resource "google_kms_crypto_key_iam_binding" "crypto_key" {
+  crypto_key_id = google_kms_crypto_key.key.id
+  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+  members = [
+	"serviceAccount:service-${data.google_project.project.number}@gcp-sa-alloydb.iam.gserviceaccount.com",
+  ]
+}
+`, context)
+}
+
+// Ensures secondary cluster creation works with networkConfig.
+func TestAccAlloydbCluster_secondaryClusterWithNetworkConfig(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbCluster_secondaryClusterWithNetworkConfig(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "labels", "annotations", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccAlloydbCluster_secondaryClusterWithNetworkConfig(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network_config {
+	network    = "projects/${data.google_project.project.number}/global/networks/${data.google_compute_network.default.name}"
+  }
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "us-east1"
+  network_config {
+	network    = "projects/${data.google_project.project.number}/global/networks/${data.google_compute_network.default.name}"
+  }
+  cluster_type = "SECONDARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  secondary_config {
+    primary_cluster_name = google_alloydb_cluster.primary.name
+  }
+
+  depends_on = [google_alloydb_instance.primary]
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+`, context)
+}
+
+// Ensures secondary cluster creation works with networkConfig and a specified allocated IP range.
+func TestAccAlloydbCluster_secondaryClusterWithNetworkConfigAndAllocatedIPRange(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"address_name":  acctest.BootstrapSharedTestGlobalAddress(t, "alloydbinstance-network-config-1"),
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbCluster_secondaryClusterWithNetworkConfigAndAllocatedIPRange(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "labels", "annotations", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccAlloydbCluster_secondaryClusterWithNetworkConfigAndAllocatedIPRange(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network_config {
+	network    = "projects/${data.google_project.project.number}/global/networks/${data.google_compute_network.default.name}"
+	allocated_ip_range = data.google_compute_global_address.private_ip_alloc.name
+  }
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "us-east1"
+  network_config {
+	network    = "projects/${data.google_project.project.number}/global/networks/${data.google_compute_network.default.name}"
+	allocated_ip_range = data.google_compute_global_address.private_ip_alloc.name
+  }
+  cluster_type = "SECONDARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  secondary_config {
+    primary_cluster_name = google_alloydb_cluster.primary.name
+  }
+
+  depends_on = [google_alloydb_instance.primary]
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+
+data "google_compute_global_address" "private_ip_alloc" {
+  name          =  "%{address_name}"
+}
+`, context)
+}
+
+// This test passes if secondary cluster can be promoted
+func TestAccAlloydbCluster_secondaryClusterPromote(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix":              acctest.RandString(t, 10),
+		"secondary_cluster_location": "us-east1",
+		"network_name":               acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbInstance_secondaryClusterWithInstance(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "deletion_policy", "labels", "annotations", "terraform_labels"},
+			},
+			{
+				Config: testAccAlloydbCluster_secondaryClusterPromote(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "deletion_policy", "labels", "annotations", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccAlloydbInstance_secondaryClusterWithInstance(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network      = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "%{secondary_cluster_location}"
+  network      = data.google_compute_network.default.id
+  cluster_type = "SECONDARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  secondary_config {
+    primary_cluster_name = google_alloydb_cluster.primary.name
+  }
+
+  deletion_policy = "FORCE"
+
+  depends_on = [google_alloydb_instance.primary]
+}
+
+resource "google_alloydb_instance" "secondary" {
+  cluster       = google_alloydb_cluster.secondary.name
+  instance_id   = "tf-test-alloydb-secondary-instance%{random_suffix}"
+  instance_type = google_alloydb_cluster.secondary.cluster_type
+
+  machine_config {
+    cpu_count = 2
+  }
+
+  lifecycle {
+    ignore_changes = [instance_type]
+  }
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+`, context)
+}
+
+func testAccAlloydbCluster_secondaryClusterPromote(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network      = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "%{secondary_cluster_location}"
+  network      = data.google_compute_network.default.id
+  cluster_type = "PRIMARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+}
+
+resource "google_alloydb_instance" "secondary" {
+  cluster       = google_alloydb_cluster.secondary.name
+  instance_id   = "tf-test-alloydb-secondary-instance%{random_suffix}"
+  instance_type = google_alloydb_cluster.secondary.cluster_type
+
+  machine_config {
+    cpu_count = 2
+  }
+
+  lifecycle {
+    ignore_changes = [instance_type]
+  }
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+`, context)
+}
+
+// This test passes if secondary cluster can be promoted and updated simultaneously
+func TestAccAlloydbCluster_secondaryClusterPromoteAndSimultaneousUpdate(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix":              acctest.RandString(t, 10),
+		"secondary_cluster_location": "us-east1",
+		"network_name":               acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbInstance_secondaryClusterWithInstance(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "deletion_policy", "labels", "annotations", "terraform_labels"},
+			},
+			{
+				Config: testAccAlloydbCluster_secondaryClusterPromoteAndSimultaneousUpdate(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "deletion_policy", "labels", "annotations", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccAlloydbCluster_secondaryClusterPromoteAndSimultaneousUpdate(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network      = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "%{secondary_cluster_location}"
+  network      = data.google_compute_network.default.id
+  cluster_type = "PRIMARY"
+
+  continuous_backup_config {
+    enabled = true
+  }
+
+  labels = {
+    foo = "bar" 
+  }  
+}
+
+resource "google_alloydb_instance" "secondary" {
+  cluster       = google_alloydb_cluster.secondary.name
+  instance_id   = "tf-test-alloydb-secondary-instance%{random_suffix}"
+  instance_type = google_alloydb_cluster.secondary.cluster_type
+
+  machine_config {
+    cpu_count = 2
+  }
+
+  lifecycle {
+    ignore_changes = [instance_type]
+  }
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+`, context)
+}
+
+// This test passes if secondary cluster can be promoted and the original primary can be deleted after promotion
+func TestAccAlloydbCluster_secondaryClusterPromoteAndDeleteOriginalPrimary(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix":              acctest.RandString(t, 10),
+		"secondary_cluster_location": "us-east1",
+		"network_name":               acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbInstance_secondaryClusterWithInstance(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "deletion_policy", "labels", "annotations", "terraform_labels"},
+			},
+			{
+				Config: testAccAlloydbCluster_secondaryClusterPromote(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "deletion_policy", "labels", "annotations", "terraform_labels"},
+			},
+			{
+				Config: testAccAlloydbCluster_secondaryClusterPromoteAndDeleteOriginalPrimary(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "deletion_policy", "labels", "annotations", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccAlloydbCluster_secondaryClusterPromoteAndDeleteOriginalPrimary(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "%{secondary_cluster_location}"
+  network      = data.google_compute_network.default.id
+  cluster_type = "PRIMARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+}
+
+resource "google_alloydb_instance" "secondary" {
+  cluster       = google_alloydb_cluster.secondary.name
+  instance_id   = "tf-test-alloydb-secondary-instance%{random_suffix}"
+  instance_type = google_alloydb_cluster.secondary.cluster_type
+
+  machine_config {
+    cpu_count = 2
+  }
+
+  lifecycle {
+    ignore_changes = [instance_type]
+  }
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+`, context)
+}
+
+// This test passes if the promoted secondary cluster can be updated
+func TestAccAlloydbCluster_secondaryClusterPromoteAndUpdate(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix":              acctest.RandString(t, 10),
+		"secondary_cluster_location": "us-east1",
+		"network_name":               acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbInstance_secondaryClusterWithInstance(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "deletion_policy", "labels", "annotations", "terraform_labels"},
+			},
+			{
+				Config: testAccAlloydbCluster_secondaryClusterPromote(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "deletion_policy", "labels", "annotations", "terraform_labels"},
+			},
+			{
+				Config: testAccAlloydbCluster_secondaryClusterPromoteAndUpdate(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "deletion_policy", "labels", "annotations", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccAlloydbCluster_secondaryClusterPromoteAndUpdate(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network      = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "%{secondary_cluster_location}"
+  network      = data.google_compute_network.default.id
+  cluster_type = "PRIMARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  labels = {
+    foo = "bar"
+  }
+
+}
+
+resource "google_alloydb_instance" "secondary" {
+  cluster       = google_alloydb_cluster.secondary.name
+  instance_id   = "tf-test-alloydb-secondary-instance%{random_suffix}"
+  instance_type = google_alloydb_cluster.secondary.cluster_type
+
+  machine_config {
+    cpu_count = 2
+  }
+
+  lifecycle {
+    ignore_changes = [instance_type]
+  }
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+`, context)
+}
+
+// This test passes if secondary cluster can be promoted with networkConfig and a specified allocated IP range
+func TestAccAlloydbCluster_secondaryClusterPromoteWithNetworkConfigAndAllocatedIPRange(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+		"address_name":  acctest.BootstrapSharedTestGlobalAddress(t, "alloydbinstance-network-config-1"),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbInstance_secondaryClusterWithInstanceAndNetworkConfigAndAllocatedIPRange(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "deletion_policy", "labels", "annotations", "terraform_labels"},
+			},
+			{
+				Config: testAccAlloydbCluster_secondaryClusterPromoteWithNetworkConfigAndAllocatedIPRange(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "deletion_policy", "labels", "annotations", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccAlloydbInstance_secondaryClusterWithInstanceAndNetworkConfigAndAllocatedIPRange(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network_config {
+    network    = "projects/${data.google_project.project.number}/global/networks/${data.google_compute_network.default.name}"
+    allocated_ip_range = data.google_compute_global_address.private_ip_alloc.name
+  }
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "us-south1"
+  network_config {
+    network    = "projects/${data.google_project.project.number}/global/networks/${data.google_compute_network.default.name}"
+    allocated_ip_range = data.google_compute_global_address.private_ip_alloc.name
+  }
+  cluster_type = "SECONDARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  secondary_config {
+    primary_cluster_name = google_alloydb_cluster.primary.name
+  }
+
+  deletion_policy = "FORCE"
+
+  depends_on = [google_alloydb_instance.primary]
+}
+
+resource "google_alloydb_instance" "secondary" {
+  cluster       = google_alloydb_cluster.secondary.name
+  instance_id   = "tf-test-alloydb-secondary-instance%{random_suffix}"
+  instance_type = google_alloydb_cluster.secondary.cluster_type
+
+  machine_config {
+    cpu_count = 2
+  }
+
+  lifecycle {
+    ignore_changes = [instance_type]
+  }
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+
+data "google_compute_global_address" "private_ip_alloc" {
+  name          =  "%{address_name}"
+}
+`, context)
+}
+
+func testAccAlloydbCluster_secondaryClusterPromoteWithNetworkConfigAndAllocatedIPRange(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network_config {
+    network    = "projects/${data.google_project.project.number}/global/networks/${data.google_compute_network.default.name}"
+    allocated_ip_range = data.google_compute_global_address.private_ip_alloc.name
+  }
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "us-south1"
+  network_config {
+    network    = "projects/${data.google_project.project.number}/global/networks/${data.google_compute_network.default.name}"
+    allocated_ip_range = data.google_compute_global_address.private_ip_alloc.name
+  }
+  cluster_type = "PRIMARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+}
+
+resource "google_alloydb_instance" "secondary" {
+  cluster       = google_alloydb_cluster.secondary.name
+  instance_id   = "tf-test-alloydb-secondary-instance%{random_suffix}"
+  instance_type = google_alloydb_cluster.secondary.cluster_type
+
+  machine_config {
+    cpu_count = 2
+  }
+
+  lifecycle {
+    ignore_changes = [instance_type]
+  }
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+
+data "google_compute_global_address" "private_ip_alloc" {
+  name          =  "%{address_name}"
+}
+`, context)
+}
+
+// This test passes if automated backup policy and inital user can be added and deleted from the promoted secondary cluster
+func TestAccAlloydbCluster_secondaryClusterPromoteAndAddAndDeleteAutomatedBackupPolicyAndInitialUser(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix":              acctest.RandString(t, 10),
+		"secondary_cluster_location": "us-south1",
+		"network_name":               acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+		"hour":                       23,
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbInstance_secondaryClusterWithInstance(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "deletion_policy", "labels", "annotations", "terraform_labels"},
+			},
+			{
+				Config: testAccAlloydbCluster_secondaryClusterPromote(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "deletion_policy", "labels", "annotations", "terraform_labels"},
+			},
+			{
+				Config: testAccAlloydbCluster_secondaryClusterPromoteAndAddAutomatedBackupPolicyAndInitialUser(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "deletion_policy", "labels", "annotations", "terraform_labels"},
+			},
+			{
+				Config: testAccAlloydbCluster_secondaryClusterPromote(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "deletion_policy", "labels", "annotations", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccAlloydbCluster_secondaryClusterPromoteAndAddAutomatedBackupPolicyAndInitialUser(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network      = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "%{secondary_cluster_location}"
+  network      = data.google_compute_network.default.id
+  cluster_type = "PRIMARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  initial_user {
+    user     = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+    password = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  }
+
+  automated_backup_policy {
+    location      = "%{secondary_cluster_location}"
+    backup_window = "1800s"
+    enabled       = true
+
+    weekly_schedule {
+      days_of_week = ["MONDAY"]
+
+      start_times {
+        hours   = %{hour}
+        minutes = 0
+        seconds = 0
+        nanos   = 0
+      }
+    }
+
+    quantity_based_retention {
+      count = 1
+    }
+
+    labels = {
+      test = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+    }
+  }
+}
+
+resource "google_alloydb_instance" "secondary" {
+  cluster       = google_alloydb_cluster.secondary.name
+  instance_id   = "tf-test-alloydb-secondary-instance%{random_suffix}"
+  instance_type = google_alloydb_cluster.secondary.cluster_type
+
+  machine_config {
+    cpu_count = 2
+  }
+
+  lifecycle {
+    ignore_changes = [instance_type]
+  }
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+`, context)
+}
+
+// This test passes if time based retention policy can be added and deleted from the promoted secondary cluster
+func TestAccAlloydbCluster_secondaryClusterPromoteAndDeleteTimeBasedRetentionPolicy(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix":              acctest.RandString(t, 10),
+		"secondary_cluster_location": "us-south1",
+		"network_name":               acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbInstance_secondaryClusterWithInstance(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "deletion_policy", "labels", "annotations", "terraform_labels"},
+			},
+			{
+				Config: testAccAlloydbCluster_secondaryClusterPromote(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "deletion_policy", "labels", "annotations", "terraform_labels"},
+			},
+			{
+				Config: testAccAlloydbCluster_secondaryClusterPromoteWithTimeBasedRetentionPolicy(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "deletion_policy", "labels", "annotations", "terraform_labels"},
+			},
+			{
+				Config: testAccAlloydbCluster_secondaryClusterPromoteWithoutTimeBasedRetentionPolicy(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "deletion_policy", "labels", "annotations", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccAlloydbCluster_secondaryClusterPromoteWithTimeBasedRetentionPolicy(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network      = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "%{secondary_cluster_location}"
+  network      = data.google_compute_network.default.id
+  cluster_type = "PRIMARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  initial_user {
+    user     = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+    password = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  }
+
+  automated_backup_policy {
+    location      = "%{secondary_cluster_location}"
+    backup_window = "1800s"
+    enabled       = true
+
+    weekly_schedule {
+      days_of_week = ["MONDAY"]
+
+      start_times {
+        hours   = 23
+        minutes = 0
+        seconds = 0
+        nanos   = 0
+      }
+    }
+    time_based_retention {
+      retention_period = "4.5s"
+    }
+  }
+  lifecycle {
+    ignore_changes = [
+      automated_backup_policy[0].time_based_retention
+    ]
+  }
+}
+
+resource "google_alloydb_instance" "secondary" {
+  cluster       = google_alloydb_cluster.secondary.name
+  instance_id   = "tf-test-alloydb-secondary-instance%{random_suffix}"
+  instance_type = google_alloydb_cluster.secondary.cluster_type
+
+  machine_config {
+    cpu_count = 2
+  }
+
+  lifecycle {
+    ignore_changes = [instance_type]
+  }
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+`, context)
+}
+
+func testAccAlloydbCluster_secondaryClusterPromoteWithoutTimeBasedRetentionPolicy(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network      = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "%{secondary_cluster_location}"
+  network      = data.google_compute_network.default.id
+  cluster_type = "PRIMARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  initial_user {
+    user     = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+    password = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  }
+
+  automated_backup_policy {
+    location      = "%{secondary_cluster_location}"
+    backup_window = "1800s"
+    enabled       = true
+
+    weekly_schedule {
+      days_of_week = ["MONDAY"]
+
+      start_times {
+        hours   = 23
+        minutes = 0
+        seconds = 0
+        nanos   = 0
+      }
+    }
+  }
+  lifecycle {
+    ignore_changes = [
+      automated_backup_policy[0].time_based_retention
+    ]
+  }
+}
+
+resource "google_alloydb_instance" "secondary" {
+  cluster       = google_alloydb_cluster.secondary.name
+  instance_id   = "tf-test-alloydb-secondary-instance%{random_suffix}"
+  instance_type = google_alloydb_cluster.secondary.cluster_type
+
+  machine_config {
+    cpu_count = 2
+  }
+
+  lifecycle {
+    ignore_changes = [instance_type]
+  }
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+`, context)
+}
+
+// This test passes if continuous backup config can be enabled in the promoted secondary cluster
+func TestAccAlloydbCluster_secondaryClusterPromoteAndAddContinuousBackupConfig(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix":              acctest.RandString(t, 10),
+		"secondary_cluster_location": "us-south1",
+		"network_name":               acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbInstance_secondaryClusterWithInstance(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "deletion_policy", "labels", "annotations", "terraform_labels"},
+			},
+			{
+				Config: testAccAlloydbCluster_secondaryClusterPromote(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "deletion_policy", "labels", "annotations", "terraform_labels"},
+			},
+			{
+				Config: testAccAlloydbCluster_secondaryClusterPromoteAndAddContinuousBackupConfig(context),
+			},
+			{
+				ResourceName:            "google_alloydb_cluster.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_user", "restore_backup_source", "restore_continuous_backup_source", "cluster_id", "location", "deletion_policy", "labels", "annotations", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccAlloydbCluster_secondaryClusterPromoteAndAddContinuousBackupConfig(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network      = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "%{secondary_cluster_location}"
+  network      = data.google_compute_network.default.id
+  cluster_type = "PRIMARY"
+
+  continuous_backup_config {
+    enabled              = true
+    recovery_window_days = 14
+  }
+
+}
+
+resource "google_alloydb_instance" "secondary" {
+  cluster       = google_alloydb_cluster.secondary.name
+  instance_id   = "tf-test-alloydb-secondary-instance%{random_suffix}"
+  instance_type = google_alloydb_cluster.secondary.cluster_type
+
+  machine_config {
+    cpu_count = 2
+  }
+
+  lifecycle {
+    ignore_changes = [instance_type]
+  }
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+`, context)
+}
diff --git a/mmv1/third_party/terraform/services/alloydb/resource_alloydb_secondary_instance_test.go b/mmv1/third_party/terraform/services/alloydb/resource_alloydb_secondary_instance_test.go
new file mode 100644
index 000000000000..6cb158429e11
--- /dev/null
+++ b/mmv1/third_party/terraform/services/alloydb/resource_alloydb_secondary_instance_test.go
@@ -0,0 +1,627 @@
+package alloydb_test
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+)
+
+// This test passes if secondary instance's machine config can be updated
+func TestAccAlloydbInstance_secondaryInstanceUpdateMachineConfig(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbInstance_secondaryInstanceInitial(context),
+			},
+			{
+				ResourceName:            "google_alloydb_instance.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"cluster", "instance_id", "reconciling", "update_time", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccAlloydbInstance_secondaryInstanceUpdateMachineConfig(context),
+			},
+			{
+				ResourceName:            "google_alloydb_instance.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"cluster", "instance_id", "reconciling", "update_time", "labels", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccAlloydbInstance_secondaryInstanceInitial(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network      = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "us-east1"
+  network      = data.google_compute_network.default.id
+  cluster_type = "SECONDARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  secondary_config {
+    primary_cluster_name = google_alloydb_cluster.primary.name
+  }
+
+  deletion_policy = "FORCE"
+
+  depends_on = [google_alloydb_instance.primary]
+}
+
+resource "google_alloydb_instance" "secondary" {
+  cluster       = google_alloydb_cluster.secondary.name
+  instance_id   = "tf-test-alloydb-secondary-instance%{random_suffix}"
+  instance_type = google_alloydb_cluster.secondary.cluster_type
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+`, context)
+}
+
+func testAccAlloydbInstance_secondaryInstanceUpdateMachineConfig(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network      = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "us-east1"
+  network      = data.google_compute_network.default.id
+  cluster_type = "SECONDARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  secondary_config {
+    primary_cluster_name = google_alloydb_cluster.primary.name
+  }
+
+  deletion_policy = "FORCE"
+
+  depends_on = [google_alloydb_instance.primary]
+}
+
+resource "google_alloydb_instance" "secondary" {
+  cluster       = google_alloydb_cluster.secondary.name
+  instance_id   = "tf-test-alloydb-secondary-instance%{random_suffix}"
+  instance_type = google_alloydb_cluster.secondary.cluster_type
+
+  machine_config {
+    cpu_count = 4
+  }
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+`, context)
+}
+
+// This test passes if we are able to create a secondary instance with an associated read-pool instance
+func TestAccAlloydbInstance_secondaryInstanceWithReadPoolInstance(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbInstance_secondaryInstanceWithReadPoolInstance(context),
+			},
+			{
+				ResourceName:            "google_alloydb_instance.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"cluster", "instance_id", "reconciling", "update_time", "labels", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccAlloydbInstance_secondaryInstanceWithReadPoolInstance(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network      = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "us-west1"
+  network      = data.google_compute_network.default.id
+  cluster_type = "SECONDARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  secondary_config {
+    primary_cluster_name = google_alloydb_cluster.primary.name
+  }
+
+  deletion_policy = "FORCE"
+
+  depends_on = [google_alloydb_instance.primary]
+}
+
+resource "google_alloydb_instance" "secondary" {
+  cluster       = google_alloydb_cluster.secondary.name
+  instance_id   = "tf-test-alloydb-secondary-instance%{random_suffix}"
+  instance_type = google_alloydb_cluster.secondary.cluster_type
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_instance" "read_pool" {
+  cluster       = google_alloydb_cluster.secondary.name
+  instance_id   = "tf-test-alloydb-read-instance%{random_suffix}-read"
+  instance_type = "READ_POOL"
+  read_pool_config {
+    node_count = 4
+  }
+  depends_on = [google_alloydb_instance.secondary]
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+`, context)
+}
+
+// This test passes if we are able to create a secondary instance by specifying network_config.network and network_config.allocated_ip_range
+func TestAccAlloydbCluster_secondaryInstanceWithNetworkConfigAndAllocatedIPRange(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+		"address_name":  acctest.BootstrapSharedTestGlobalAddress(t, "alloydbinstance-network-config-1"),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbCluster_secondaryInstanceWithNetworkConfigAndAllocatedIPRange(context),
+			},
+			{
+				ResourceName:            "google_alloydb_instance.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"cluster", "instance_id", "reconciling", "update_time", "labels", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccAlloydbCluster_secondaryInstanceWithNetworkConfigAndAllocatedIPRange(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network_config {
+    network    = data.google_compute_network.default.id
+    allocated_ip_range = data.google_compute_global_address.private_ip_alloc.name
+  }
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "us-west1"
+  network_config {
+    network    = data.google_compute_network.default.id
+    allocated_ip_range = data.google_compute_global_address.private_ip_alloc.name
+  }
+  cluster_type = "SECONDARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  secondary_config {
+    primary_cluster_name = google_alloydb_cluster.primary.name
+  }
+
+  deletion_policy = "FORCE"
+
+  depends_on = [google_alloydb_instance.primary]
+}
+
+resource "google_alloydb_instance" "secondary" {
+  cluster       = google_alloydb_cluster.secondary.name
+  instance_id   = "tf-test-alloydb-secondary-instance%{random_suffix}"
+  instance_type = google_alloydb_cluster.secondary.cluster_type
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+
+data "google_compute_global_address" "private_ip_alloc" {
+  name =  "%{address_name}"
+}
+`, context)
+}
+
+// This test passes if secondary instance's database flag config can be updated
+func TestAccAlloydbInstance_secondaryInstanceUpdateDatabaseFlag(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbInstance_secondaryInstanceInitial(context),
+			},
+			{
+				ResourceName:            "google_alloydb_instance.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"cluster", "instance_id", "reconciling", "update_time", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccAlloydbInstance_secondaryInstanceUpdateDatabaseFlag(context),
+			},
+			{
+				ResourceName:            "google_alloydb_instance.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"cluster", "instance_id", "reconciling", "update_time", "labels", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccAlloydbInstance_secondaryInstanceUpdateDatabaseFlag(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network      = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "us-east1"
+  network      = data.google_compute_network.default.id
+  cluster_type = "SECONDARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  secondary_config {
+    primary_cluster_name = google_alloydb_cluster.primary.name
+  }
+
+  deletion_policy = "FORCE"
+
+  depends_on = [google_alloydb_instance.primary]
+}
+
+resource "google_alloydb_instance" "secondary" {
+  cluster       = google_alloydb_cluster.secondary.name
+  instance_id   = "tf-test-alloydb-secondary-instance%{random_suffix}"
+  instance_type = google_alloydb_cluster.secondary.cluster_type
+
+  machine_config {
+    cpu_count = 2
+  }
+
+  database_flags = {
+	  "alloydb.enable_auto_explain" = "true"
+  }
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+`, context)
+}
+
+// This test passes if secondary instance's query insight config can be updated
+func TestAccAlloydbInstance_secondaryInstanceUpdateQueryInsightConfig(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbInstance_secondaryInstanceInitial(context),
+			},
+			{
+				ResourceName:            "google_alloydb_instance.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"cluster", "instance_id", "reconciling", "update_time", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccAlloydbInstance_secondaryInstanceUpdateQueryInsightConfig(context),
+			},
+			{
+				ResourceName:            "google_alloydb_instance.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"cluster", "instance_id", "reconciling", "update_time", "labels", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccAlloydbInstance_secondaryInstanceUpdateQueryInsightConfig(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network      = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "us-east1"
+  network      = data.google_compute_network.default.id
+  cluster_type = "SECONDARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  secondary_config {
+    primary_cluster_name = google_alloydb_cluster.primary.name
+  }
+
+  deletion_policy = "FORCE"
+
+  depends_on = [google_alloydb_instance.primary]
+}
+
+resource "google_alloydb_instance" "secondary" {
+  cluster       = google_alloydb_cluster.secondary.name
+  instance_id   = "tf-test-alloydb-secondary-instance%{random_suffix}"
+  instance_type = google_alloydb_cluster.secondary.cluster_type
+
+  machine_config {
+    cpu_count = 2
+  }
+
+  query_insights_config {
+      query_plans_per_minute = 10
+      query_string_length = 2048
+      record_application_tags = true
+      record_client_address = true
+  }
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+`, context)
+}
+
+// This test passes if we are able to create a secondary instance with maximum fields
+func TestAccAlloydbInstance_secondaryInstanceMaximumFields(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbInstance_secondaryInstanceMaximumFields(context),
+			},
+			{
+				ResourceName:            "google_alloydb_instance.secondary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"cluster", "instance_id", "reconciling", "update_time", "labels", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccAlloydbInstance_secondaryInstanceMaximumFields(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_cluster" "primary" {
+  cluster_id = "tf-test-alloydb-primary-cluster%{random_suffix}"
+  location   = "us-central1"
+  network      = data.google_compute_network.default.id
+}
+
+resource "google_alloydb_instance" "primary" {
+  cluster       = google_alloydb_cluster.primary.name
+  instance_id   = "tf-test-alloydb-primary-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+
+  machine_config {
+    cpu_count = 2
+  }
+}
+
+resource "google_alloydb_cluster" "secondary" {
+  cluster_id   = "tf-test-alloydb-secondary-cluster%{random_suffix}"
+  location     = "us-west1"
+  network      = data.google_compute_network.default.id
+  cluster_type = "SECONDARY"
+
+  continuous_backup_config {
+    enabled = false
+  }
+
+  secondary_config {
+    primary_cluster_name = google_alloydb_cluster.primary.name
+  }
+
+  deletion_policy = "FORCE"
+
+  depends_on = [google_alloydb_instance.primary]
+}
+
+resource "google_alloydb_instance" "secondary" {
+  cluster       = google_alloydb_cluster.secondary.name
+  instance_id   = "tf-test-alloydb-secondary-instance%{random_suffix}"
+  instance_type = google_alloydb_cluster.secondary.cluster_type
+
+  machine_config {
+    cpu_count = 2
+  }
+
+  labels = {
+    test_label = "test-alloydb-label"
+  }
+
+  query_insights_config {
+      query_plans_per_minute = 10
+      query_string_length = 2048
+      record_application_tags = true
+      record_client_address = true
+  }
+
+  availability_type = "REGIONAL"
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+`, context)
+}
diff --git a/mmv1/third_party/terraform/services/alloydb/resource_alloydb_user_test.go b/mmv1/third_party/terraform/services/alloydb/resource_alloydb_user_test.go
new file mode 100644
index 000000000000..d13b3bd44b8c
--- /dev/null
+++ b/mmv1/third_party/terraform/services/alloydb/resource_alloydb_user_test.go
@@ -0,0 +1,211 @@
+package alloydb_test
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+)
+
+func TestAccAlloydbUser_updateRoles_BuiltIn(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbUserDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbUser_alloydbUserBuiltinTestExample(context),
+			},
+			{
+				ResourceName:            "google_alloydb_user.user1",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"password"},
+			},
+			{
+				Config: testAccAlloydbUser_updateRoles_BuiltIn(context),
+			},
+			{
+				ResourceName:            "google_alloydb_user.user1",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"password"},
+			},
+		},
+	})
+}
+
+func testAccAlloydbUser_updateRoles_BuiltIn(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_instance" "default" {
+  cluster       = google_alloydb_cluster.default.name
+  instance_id   = "tf-test-alloydb-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+}
+
+resource "google_alloydb_cluster" "default" {
+  cluster_id = "tf-test-alloydb-cluster%{random_suffix}"
+  location   = "us-central1"
+  network    = data.google_compute_network.default.id
+
+  initial_user {
+    password = "tf_test_cluster_secret%{random_suffix}"
+  }
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+
+resource "google_alloydb_user" "user1" {
+  cluster = google_alloydb_cluster.default.name
+  user_id = "user1%{random_suffix}"
+  user_type = "ALLOYDB_BUILT_IN"
+
+  password = "tf_test_user_secret%{random_suffix}"
+  database_roles = []
+  depends_on = [google_alloydb_instance.default]
+}`, context)
+}
+
+func TestAccAlloydbUser_updatePassword_BuiltIn(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbUserDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbUser_alloydbUserBuiltinTestExample(context),
+			},
+			{
+				ResourceName:            "google_alloydb_user.user1",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"password"},
+			},
+			{
+				Config: testAccAlloydbUser_updatePass_BuiltIn(context),
+			},
+			{
+				ResourceName:            "google_alloydb_user.user1",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"password"},
+			},
+		},
+	})
+}
+
+func testAccAlloydbUser_updatePass_BuiltIn(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_instance" "default" {
+  cluster       = google_alloydb_cluster.default.name
+  instance_id   = "tf-test-alloydb-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+}
+
+resource "google_alloydb_cluster" "default" {
+  cluster_id = "tf-test-alloydb-cluster%{random_suffix}"
+  location   = "us-central1"
+  network    = data.google_compute_network.default.id
+
+  initial_user {
+    password = "tf_test_cluster_secret%{random_suffix}"
+  }
+}
+
+data "google_project" "project" {}
+
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+
+resource "google_alloydb_user" "user1" {
+  cluster = google_alloydb_cluster.default.name
+  user_id = "user1%{random_suffix}"
+  user_type = "ALLOYDB_BUILT_IN"
+
+  password = "tf_test_user_secret%{random_suffix}-foo"
+  database_roles = ["alloydbsuperuser"]
+  depends_on = [google_alloydb_instance.default]
+}`, context)
+}
+
+func TestAccAlloydbUser_updateRoles_IAM(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydbinstance-network-config-1"),
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbUserDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbUser_alloydbUserIamTestExample(context),
+			},
+			{
+				ResourceName:            "google_alloydb_user.user2",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{},
+			},
+			{
+				Config: testAccAlloydbUser_updateRoles_Iam(context),
+			},
+			{
+				ResourceName:            "google_alloydb_user.user2",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{},
+			},
+		},
+	})
+}
+
+func testAccAlloydbUser_updateRoles_Iam(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_instance" "default" {
+  cluster       = google_alloydb_cluster.default.name
+  instance_id   = "tf-test-alloydb-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+}
+resource "google_alloydb_cluster" "default" {
+  cluster_id = "tf-test-alloydb-cluster%{random_suffix}"
+  location   = "us-central1"
+  network    = data.google_compute_network.default.id
+  initial_user {
+    password = "tf_test_cluster_secret%{random_suffix}"
+  }
+}
+data "google_project" "project" {}
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+resource "google_alloydb_user" "user2" {
+  cluster = google_alloydb_cluster.default.name
+  user_id = "user2@foo.com%{random_suffix}"
+  user_type = "ALLOYDB_IAM_USER"
+  database_roles = ["alloydbiamuser", "alloydbsuperuser"]
+  depends_on = [google_alloydb_instance.default]
+}`, context)
+}
diff --git a/mmv1/third_party/terraform/services/apigee/resource_apigee_environment_nodeconfig_test.go.erb b/mmv1/third_party/terraform/services/apigee/resource_apigee_environment_nodeconfig_test.go.erb
deleted file mode 100644
index d493d58dcde3..000000000000
--- a/mmv1/third_party/terraform/services/apigee/resource_apigee_environment_nodeconfig_test.go.erb
+++ /dev/null
@@ -1,182 +0,0 @@
-<% autogen_exception -%>
-package apigee_test
-<% unless version == 'ga' -%>
-
-import (
-	"testing"
-
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-provider-google/google/acctest"
-	"github.com/hashicorp/terraform-provider-google/google/envvar"
-)
-
-func TestAccApigeeEnvironment_apigeeEnvironmentNodeconfigTestExampleUpdate(t *testing.T) {
-	acctest.SkipIfVcr(t)
-	t.Parallel()
-
-	context := map[string]interface{}{
-		"org_id":          envvar.GetTestOrgFromEnv(t),
-		"billing_account": envvar.GetTestBillingAccountFromEnv(t),
-		"random_suffix":   acctest.RandString(t, 10),
-	}
-
-	acctest.VcrTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
-		ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
-		CheckDestroy: testAccCheckApigeeEnvironmentDestroyProducer(t),
-		Steps: []resource.TestStep{
-			{
-				Config: testAccApigeeEnvironment_apigeeEnvironmentNodeconfigTestExample(context),
-			},
-			{
-				ResourceName:            "google_apigee_environment.apigee_environment",
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"org_id"},
-                        },
-                        {
-                                Config: testAccApigeeEnvironment_apigeeEnvironmentNodeconfigTestExampleUpdate(context),
-                        },
-                        {
-                                ResourceName:            "google_apigee_environment.apigee_environment",
-                                ImportState:             true,
-                                ImportStateVerify:       true,
-                                ImportStateVerifyIgnore: []string{"org_id"},
-                        },
-		},
-	})
-}
-
-func testAccApigeeEnvironment_apigeeEnvironmentNodeconfigTestExampleUpdate(context map[string]interface{}) string {
-        return acctest.Nprintf(`
-resource "google_project" "project" {
-  provider = google-beta
-
-  project_id      = "tf-test%{random_suffix}"
-  name            = "tf-test%{random_suffix}"
-  org_id          = "%{org_id}"
-  billing_account = "%{billing_account}"
-}
-
-resource "google_project_service" "apigee" {
-  provider = google-beta
-
-  project = google_project.project.project_id
-  service = "apigee.googleapis.com"
-}
-
-resource "google_project_service" "compute" {
-  provider = google-beta
-
-  project = google_project.project.project_id
-  service = "compute.googleapis.com"
-}
-
-resource "google_project_service" "servicenetworking" {
-  provider = google-beta
-
-  project = google_project.project.project_id
-  service = "servicenetworking.googleapis.com"
-}
-
-resource "google_project_service" "kms" {
-  provider = google-beta
-
-  project = google_project.project.project_id
-  service = "cloudkms.googleapis.com"
-}
-
-resource "google_compute_network" "apigee_network" {
-  provider = google-beta
-
-  name       = "apigee-network"
-  project    = google_project.project.project_id
-  depends_on = [google_project_service.compute]
-}
-
-resource "google_compute_global_address" "apigee_range" {
-  provider = google-beta
-
-  name          = "tf-test-apigee-range%{random_suffix}"
-  purpose       = "VPC_PEERING"
-  address_type  = "INTERNAL"
-  prefix_length = 16
-  network       = google_compute_network.apigee_network.id
-  project       = google_project.project.project_id
-}
-
-resource "google_service_networking_connection" "apigee_vpc_connection" {
-  provider = google-beta
-
-  network                 = google_compute_network.apigee_network.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.apigee_range.name]
-  depends_on              = [google_project_service.servicenetworking]
-}
-
-resource "google_kms_key_ring" "apigee_keyring" {
-  provider = google-beta
-
-  name       = "apigee-keyring"
-  location   = "us-central1"
-  project    = google_project.project.project_id
-  depends_on = [google_project_service.kms]
-}
-
-resource "google_kms_crypto_key" "apigee_key" {
-  provider = google-beta
-
-  name            = "apigee-key"
-  key_ring        = google_kms_key_ring.apigee_keyring.id
-}
-
-resource "google_project_service_identity" "apigee_sa" {
-  provider = google-beta
-
-  project = google_project.project.project_id
-  service = google_project_service.apigee.service
-}
-
-resource "google_kms_crypto_key_iam_binding" "apigee_sa_keyuser" {
-  provider = google-beta
-
-  crypto_key_id = google_kms_crypto_key.apigee_key.id
-  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
-
-  members = [
-    "serviceAccount:${google_project_service_identity.apigee_sa.email}",
-  ]
-}
-
-resource "google_apigee_organization" "apigee_org" {
-  provider = google-beta
-
-  analytics_region                     = "us-central1"
-  project_id                           = google_project.project.project_id
-  authorized_network                   = google_compute_network.apigee_network.id
-  billing_type                         = "PAYG"
-  runtime_database_encryption_key_name = google_kms_crypto_key.apigee_key.id
-
-  depends_on = [
-    google_service_networking_connection.apigee_vpc_connection,
-    google_project_service.apigee,
-    google_kms_crypto_key_iam_binding.apigee_sa_keyuser,
-  ]
-}
-
-resource "google_apigee_environment" "apigee_environment" {
-  provider = google-beta
-
-  org_id       = google_apigee_organization.apigee_org.id
-  name         = "tf-test%{random_suffix}"
-  description  = "Apigee Environment"
-  display_name = "tf-test%{random_suffix}"
-  node_config {
-    min_node_count = "4"
-    max_node_count = "5"
-  }
-}
-`, context)
-}
-
-<% end -%>
diff --git a/mmv1/third_party/terraform/services/appengine/data_source_google_app_engine_default_service_account.go b/mmv1/third_party/terraform/services/appengine/data_source_google_app_engine_default_service_account.go
index bd38291084d5..99764bfe0fcf 100644
--- a/mmv1/third_party/terraform/services/appengine/data_source_google_app_engine_default_service_account.go
+++ b/mmv1/third_party/terraform/services/appengine/data_source_google_app_engine_default_service_account.go
@@ -62,7 +62,7 @@ func dataSourceGoogleAppEngineDefaultServiceAccountRead(d *schema.ResourceData,
 
 	sa, err := config.NewIamClient(userAgent).Projects.ServiceAccounts.Get(serviceAccountName).Do()
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("Service Account %q", serviceAccountName))
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("Service Account %q", serviceAccountName), serviceAccountName)
 	}
 
 	d.SetId(sa.Name)
diff --git a/mmv1/third_party/terraform/services/appengine/resource_app_engine_application.go b/mmv1/third_party/terraform/services/appengine/resource_app_engine_application.go
index 0ca799ade56d..c7d631e84806 100644
--- a/mmv1/third_party/terraform/services/appengine/resource_app_engine_application.go
+++ b/mmv1/third_party/terraform/services/appengine/resource_app_engine_application.go
@@ -32,6 +32,7 @@ func ResourceAppEngineApplication() *schema.Resource {
 		},
 
 		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
 			appEngineApplicationLocationIDCustomizeDiff,
 		),
 
diff --git a/mmv1/third_party/terraform/services/artifactregistry/data_source_artifact_registry_repository.go b/mmv1/third_party/terraform/services/artifactregistry/data_source_artifact_registry_repository.go
index 09c832b4aff9..272ec3411b70 100644
--- a/mmv1/third_party/terraform/services/artifactregistry/data_source_artifact_registry_repository.go
+++ b/mmv1/third_party/terraform/services/artifactregistry/data_source_artifact_registry_repository.go
@@ -38,12 +38,21 @@ func dataSourceArtifactRegistryRepositoryRead(d *schema.ResourceData, meta inter
 	}
 
 	repository_id := d.Get("repository_id").(string)
-	d.SetId(fmt.Sprintf("projects/%s/locations/%s/repositories/%s", project, location, repository_id))
+	id := fmt.Sprintf("projects/%s/locations/%s/repositories/%s", project, location, repository_id)
+	d.SetId(id)
 
 	err = resourceArtifactRegistryRepositoryRead(d, meta)
 	if err != nil {
 		return err
 	}
 
+	if err := tpgresource.SetDataSourceLabels(d); err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+
 	return nil
 }
diff --git a/mmv1/third_party/terraform/services/artifactregistry/data_source_artifact_registry_repository_test.go b/mmv1/third_party/terraform/services/artifactregistry/data_source_artifact_registry_repository_test.go
index 7c663fbe0a60..22c2f610e1e8 100644
--- a/mmv1/third_party/terraform/services/artifactregistry/data_source_artifact_registry_repository_test.go
+++ b/mmv1/third_party/terraform/services/artifactregistry/data_source_artifact_registry_repository_test.go
@@ -38,6 +38,10 @@ resource "google_artifact_registry_repository" "my-repo" {
   repository_id = "tf-test-my-repository%{random_suffix}"
   description   = "example docker repository%{random_suffix}"
   format        = "DOCKER"
+  labels = {
+    my_key    = "my_val"
+    other_key = "other_val"
+  }
 }
 
 data "google_artifact_registry_repository" "my-repo" {
diff --git a/mmv1/third_party/terraform/services/artifactregistry/resource_artifact_registry_repository_test.go.erb b/mmv1/third_party/terraform/services/artifactregistry/resource_artifact_registry_repository_test.go.erb
index d098eb1c0edc..6f409d267936 100644
--- a/mmv1/third_party/terraform/services/artifactregistry/resource_artifact_registry_repository_test.go.erb
+++ b/mmv1/third_party/terraform/services/artifactregistry/resource_artifact_registry_repository_test.go.erb
@@ -26,6 +26,7 @@ func TestAccArtifactRegistryRepository_update(t *testing.T) {
 				ResourceName:      "google_artifact_registry_repository.test",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccArtifactRegistryRepository_update2(repositoryID),
@@ -34,6 +35,7 @@ func TestAccArtifactRegistryRepository_update(t *testing.T) {
 				ResourceName:      "google_artifact_registry_repository.test",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/backupdr/data_source_backup_dr_management_server.go.erb b/mmv1/third_party/terraform/services/backupdr/data_source_backup_dr_management_server.go.erb
new file mode 100644
index 000000000000..e3652da8b873
--- /dev/null
+++ b/mmv1/third_party/terraform/services/backupdr/data_source_backup_dr_management_server.go.erb
@@ -0,0 +1,105 @@
+<% autogen_exception -%>
+package backupdr
+<% unless version == 'ga' -%>
+
+import (
+	"fmt"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
+	"strings"
+)
+
+func DataSourceGoogleCloudBackupDRService() *schema.Resource {
+
+	dsSchema := tpgresource.DatasourceSchemaFromResourceSchema(ResourceBackupDRManagementServer().Schema)
+	tpgresource.AddRequiredFieldsToSchema(dsSchema, "location")
+
+	return &schema.Resource{
+		Read:   dataSourceGoogleCloudBackupDRServiceRead,
+		Schema: dsSchema,
+	}
+}
+func flattenBackupDRManagementServerName(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	return v
+}
+
+func flattenBackupDRManagementServerResourceResp(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) map[string]interface{} {
+	if v == nil {
+		fmt.Printf("Interface is nil: %s", v)
+	}
+	fmt.Printf("Interface is : %s", v)
+	l := v.([]interface{})
+	for _, raw := range l {
+		// Management server is a singleton resource. It is only present in one location per project. Hence returning only resource present.
+		return flattenBackupDRManagementServerResource(raw, d, config)
+	}
+	return nil
+}
+func flattenBackupDRManagementServerResource(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) map[string]interface{} {
+	original := v.(map[string]interface{})
+	if len(original) == 0 {
+		return nil
+	}
+	transformed := make(map[string]interface{})
+	transformed["type"] = flattenBackupDRManagementServerType(original["type"], d, config)
+	transformed["networks"] = flattenBackupDRManagementServerNetworks(original["networks"], d, config)
+	transformed["oauth2ClientId"] = flattenBackupDRManagementServerOauth2ClientId(original["oauth2ClientId"], d, config)
+	transformed["managementUri"] = flattenBackupDRManagementServerManagementUri(original["managementUri"], d, config)
+	transformed["name"] = flattenBackupDRManagementServerName(original["name"], d, config)
+	return transformed
+}
+
+func dataSourceGoogleCloudBackupDRServiceRead(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*transport_tpg.Config)
+	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
+	if err != nil {
+		return err
+	}
+	project, err := tpgresource.GetProject(d, config)
+	if err != nil {
+		return err
+	}
+	billingProject := project
+	url, err := tpgresource.ReplaceVars(d, config, "{{BackupDRBasePath}}projects/{{project}}/locations/{{location}}/managementServers")
+	if err != nil {
+		return err
+	}
+	if bp, err := tpgresource.GetBillingProject(d, config); err == nil {
+		billingProject = bp
+	}
+	res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+		Config:    config,
+		Method:    "GET",
+		Project:   billingProject,
+		RawURL:    url,
+		UserAgent: userAgent,
+	})
+	if err != nil {
+		return fmt.Errorf("Error reading ManagementServer: %s", err)
+	}
+	resourceResponse := flattenBackupDRManagementServerResourceResp(res["managementServers"], d, config)
+	if err := d.Set("project", project); err != nil {
+		return fmt.Errorf("Error reading ManagementServer: %s", err)
+	}
+
+	if err := d.Set("type", resourceResponse["type"]); err != nil {
+		return fmt.Errorf("Error reading ManagementServer: %s", err)
+	}
+	if err := d.Set("networks", resourceResponse["networks"]); err != nil {
+		return fmt.Errorf("Error reading ManagementServer: %s", err)
+	}
+	if err := d.Set("oauth2_client_id", resourceResponse["oauth2ClientId"]); err != nil {
+		return fmt.Errorf("Error reading ManagementServer: %s", err)
+	}
+	if err := d.Set("management_uri", resourceResponse["managementUri"]); err != nil {
+		return fmt.Errorf("Error reading ManagementServer: %s", err)
+	}
+
+	id := fmt.Sprintf("%s", resourceResponse["name"])
+	d.SetId(id)
+	name := id[strings.LastIndex(id, "/")+1:]
+	d.Set("name", name)
+	return nil
+}
+<% end -%>
diff --git a/mmv1/third_party/terraform/services/backupdr/data_source_backup_dr_management_server_test.go.erb b/mmv1/third_party/terraform/services/backupdr/data_source_backup_dr_management_server_test.go.erb
new file mode 100644
index 000000000000..23fcd639a022
--- /dev/null
+++ b/mmv1/third_party/terraform/services/backupdr/data_source_backup_dr_management_server_test.go.erb
@@ -0,0 +1,56 @@
+<% autogen_exception -%>
+package backupdr_test
+<% unless version == 'ga' -%>
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+)
+
+func TestAccDataSourceGoogleBackupDRManagementServer_basic(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "backupdr-managementserver-basic"),
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDataSourceGoogleBackupDRManagementServer_basic(context),
+				Check: resource.ComposeTestCheckFunc(
+					acctest.CheckDataSourceStateMatchesResourceState("data.google_backup_dr_management_server.foo", "google_backup_dr_management_server.foo"),
+				),
+			},
+		},
+	})
+}
+
+func testAccDataSourceGoogleBackupDRManagementServer_basic(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+
+resource "google_backup_dr_management_server" "foo" {
+ location = "us-central1"
+  name     = "tf-test-management-server%{random_suffix}"
+  type     = "BACKUP_RESTORE" 
+  networks {
+    network      = data.google_compute_network.default.id
+    peering_mode = "PRIVATE_SERVICE_ACCESS"
+  }
+}
+
+data "google_backup_dr_management_server" "foo" {
+  location =  "us-central1"
+  depends_on = [ google_backup_dr_management_server.foo ]
+}
+`, context)
+}
+<% end -%>
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/services/beyondcorp/data_source_google_beyondcorp_app_connection.go b/mmv1/third_party/terraform/services/beyondcorp/data_source_google_beyondcorp_app_connection.go
index fef0cf119493..38240dbb8e5f 100644
--- a/mmv1/third_party/terraform/services/beyondcorp/data_source_google_beyondcorp_app_connection.go
+++ b/mmv1/third_party/terraform/services/beyondcorp/data_source_google_beyondcorp_app_connection.go
@@ -38,7 +38,21 @@ func dataSourceGoogleBeyondcorpAppConnectionRead(d *schema.ResourceData, meta in
 		return err
 	}
 
-	d.SetId(fmt.Sprintf("projects/%s/locations/%s/appConnections/%s", project, region, name))
+	id := fmt.Sprintf("projects/%s/locations/%s/appConnections/%s", project, region, name)
+	d.SetId(id)
 
-	return resourceBeyondcorpAppConnectionRead(d, meta)
+	err = resourceBeyondcorpAppConnectionRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if err := tpgresource.SetDataSourceLabels(d); err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/beyondcorp/data_source_google_beyondcorp_app_connection_test.go b/mmv1/third_party/terraform/services/beyondcorp/data_source_google_beyondcorp_app_connection_test.go
index 66a488a29163..44288c2a5eca 100644
--- a/mmv1/third_party/terraform/services/beyondcorp/data_source_google_beyondcorp_app_connection_test.go
+++ b/mmv1/third_party/terraform/services/beyondcorp/data_source_google_beyondcorp_app_connection_test.go
@@ -76,6 +76,9 @@ resource "google_beyondcorp_app_connection" "foo" {
 		port = 8080
 	}
 	connectors = [google_beyondcorp_app_connector.app_connector.id]
+	labels = {
+		my-label = "my-label-value"
+	}
 }
 
 data "google_beyondcorp_app_connection" "foo" {
diff --git a/mmv1/third_party/terraform/services/beyondcorp/data_source_google_beyondcorp_app_connector.go b/mmv1/third_party/terraform/services/beyondcorp/data_source_google_beyondcorp_app_connector.go
index 202941b1448c..1f4132bababc 100644
--- a/mmv1/third_party/terraform/services/beyondcorp/data_source_google_beyondcorp_app_connector.go
+++ b/mmv1/third_party/terraform/services/beyondcorp/data_source_google_beyondcorp_app_connector.go
@@ -38,7 +38,21 @@ func dataSourceGoogleBeyondcorpAppConnectorRead(d *schema.ResourceData, meta int
 		return err
 	}
 
-	d.SetId(fmt.Sprintf("projects/%s/locations/%s/appConnectors/%s", project, region, name))
+	id := fmt.Sprintf("projects/%s/locations/%s/appConnectors/%s", project, region, name)
+	d.SetId(id)
 
-	return resourceBeyondcorpAppConnectorRead(d, meta)
+	err = resourceBeyondcorpAppConnectorRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if err := tpgresource.SetDataSourceLabels(d); err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/beyondcorp/data_source_google_beyondcorp_app_connector_test.go b/mmv1/third_party/terraform/services/beyondcorp/data_source_google_beyondcorp_app_connector_test.go
index 5bf5acf3b67a..4a8274f905bc 100644
--- a/mmv1/third_party/terraform/services/beyondcorp/data_source_google_beyondcorp_app_connector_test.go
+++ b/mmv1/third_party/terraform/services/beyondcorp/data_source_google_beyondcorp_app_connector_test.go
@@ -179,6 +179,9 @@ resource "google_beyondcorp_app_connector" "foo" {
 			email = google_service_account.service_account.email
 		}
 	}
+	labels = {
+		my-label = "my-label-value"
+	}
 }
 
 data "google_beyondcorp_app_connector" "foo" {
diff --git a/mmv1/third_party/terraform/services/beyondcorp/data_source_google_beyondcorp_app_gateway.go b/mmv1/third_party/terraform/services/beyondcorp/data_source_google_beyondcorp_app_gateway.go
index a713c74e6a25..6f31635a2954 100644
--- a/mmv1/third_party/terraform/services/beyondcorp/data_source_google_beyondcorp_app_gateway.go
+++ b/mmv1/third_party/terraform/services/beyondcorp/data_source_google_beyondcorp_app_gateway.go
@@ -38,7 +38,21 @@ func dataSourceGoogleBeyondcorpAppGatewayRead(d *schema.ResourceData, meta inter
 		return err
 	}
 
-	d.SetId(fmt.Sprintf("projects/%s/locations/%s/appGateways/%s", project, region, name))
+	id := fmt.Sprintf("projects/%s/locations/%s/appGateways/%s", project, region, name)
+	d.SetId(id)
 
-	return resourceBeyondcorpAppGatewayRead(d, meta)
+	err = resourceBeyondcorpAppGatewayRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if err := tpgresource.SetDataSourceLabels(d); err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/beyondcorp/data_source_google_beyondcorp_app_gateway_test.go b/mmv1/third_party/terraform/services/beyondcorp/data_source_google_beyondcorp_app_gateway_test.go
index c7c8f943d446..ca345530c263 100644
--- a/mmv1/third_party/terraform/services/beyondcorp/data_source_google_beyondcorp_app_gateway_test.go
+++ b/mmv1/third_party/terraform/services/beyondcorp/data_source_google_beyondcorp_app_gateway_test.go
@@ -101,6 +101,9 @@ resource "google_beyondcorp_app_gateway" "foo" {
 	name      = "tf-test-appgateway-%{random_suffix}"
 	type      = "TCP_PROXY"
 	host_type = "GCP_REGIONAL_MIG"
+	labels = {
+		my-label = "my-label-value"
+	}
 }
 
 data "google_beyondcorp_app_gateway" "foo" {
diff --git a/mmv1/third_party/terraform/services/bigquery/data_source_google_bigquery_dataset.go b/mmv1/third_party/terraform/services/bigquery/data_source_google_bigquery_dataset.go
new file mode 100644
index 000000000000..c2089834a1b8
--- /dev/null
+++ b/mmv1/third_party/terraform/services/bigquery/data_source_google_bigquery_dataset.go
@@ -0,0 +1,46 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+package bigquery
+
+import (
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
+)
+
+func DataSourceGoogleBigqueryDataset() *schema.Resource {
+	dsSchema := tpgresource.DatasourceSchemaFromResourceSchema(ResourceBigQueryDataset().Schema)
+	tpgresource.AddRequiredFieldsToSchema(dsSchema, "dataset_id")
+	tpgresource.AddOptionalFieldsToSchema(dsSchema, "project")
+
+	return &schema.Resource{
+		Read:   dataSourceGoogleBigqueryDatasetRead,
+		Schema: dsSchema,
+	}
+}
+
+func dataSourceGoogleBigqueryDatasetRead(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*transport_tpg.Config)
+
+	dataset_id := d.Get("dataset_id").(string)
+
+	project, err := tpgresource.GetProject(d, config)
+	if err != nil {
+		return fmt.Errorf("Error fetching project: %s", err)
+	}
+
+	id := fmt.Sprintf("projects/%s/datasets/%s", project, dataset_id)
+	d.SetId(id)
+	err = resourceBigQueryDatasetRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+
+	return nil
+}
diff --git a/mmv1/third_party/terraform/services/bigquery/data_source_google_bigquery_dataset_test.go b/mmv1/third_party/terraform/services/bigquery/data_source_google_bigquery_dataset_test.go
new file mode 100644
index 000000000000..a734217b9024
--- /dev/null
+++ b/mmv1/third_party/terraform/services/bigquery/data_source_google_bigquery_dataset_test.go
@@ -0,0 +1,49 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+package bigquery_test
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+)
+
+func TestAccDataSourceGoogleBigqueryDataset_basic(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckBigQueryDatasetDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDataSourceGoogleBigqueryDataset_basic(context),
+				Check: resource.ComposeTestCheckFunc(
+					acctest.CheckDataSourceStateMatchesResourceState("data.google_bigquery_dataset.bar", "google_bigquery_dataset.foo"),
+				),
+			},
+		},
+	})
+}
+
+func testAccDataSourceGoogleBigqueryDataset_basic(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+
+  resource "google_bigquery_dataset" "foo" {
+    dataset_id                  = "tf_test_ds_%{random_suffix}"
+    friendly_name               = "testing"
+    description                 = "This is a test description"
+    location                    = "US"
+    default_table_expiration_ms = 3600000
+  }
+
+  data "google_bigquery_dataset" "bar" {
+    dataset_id    = google_bigquery_dataset.foo.dataset_id
+  }
+`, context)
+}
diff --git a/mmv1/third_party/terraform/services/bigquery/data_source_google_bigquery_default_service_account.go b/mmv1/third_party/terraform/services/bigquery/data_source_google_bigquery_default_service_account.go
index cc1e4f0a6d2a..d25349166440 100644
--- a/mmv1/third_party/terraform/services/bigquery/data_source_google_bigquery_default_service_account.go
+++ b/mmv1/third_party/terraform/services/bigquery/data_source_google_bigquery_default_service_account.go
@@ -43,7 +43,7 @@ func dataSourceGoogleBigqueryDefaultServiceAccountRead(d *schema.ResourceData, m
 
 	projectResource, err := config.NewBigQueryClient(userAgent).Projects.GetServiceAccount(project).Do()
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, "BigQuery service account not found")
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("Project %q BigQuery service account", project), fmt.Sprintf("Project %q BigQuery service account", project))
 	}
 
 	d.SetId(projectResource.Email)
diff --git a/mmv1/third_party/terraform/services/bigquery/resource_bigquery_dataset_test.go b/mmv1/third_party/terraform/services/bigquery/resource_bigquery_dataset_test.go
index 864cc9a7d014..5125403c26f3 100644
--- a/mmv1/third_party/terraform/services/bigquery/resource_bigquery_dataset_test.go
+++ b/mmv1/third_party/terraform/services/bigquery/resource_bigquery_dataset_test.go
@@ -22,7 +22,11 @@ func TestAccBigQueryDataset_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckBigQueryDatasetDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBigQueryDataset(datasetID),
+				Config: testAccBigQueryDataset_withoutLabels(datasetID),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckNoResourceAttr("google_bigquery_dataset.test", "labels.%"),
+					resource.TestCheckNoResourceAttr("google_bigquery_dataset.test", "effective_labels.%"),
+				),
 			},
 			{
 				ResourceName:      "google_bigquery_dataset.test",
@@ -30,16 +34,59 @@ func TestAccBigQueryDataset_basic(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccBigQueryDatasetUpdated(datasetID),
+				Config: testAccBigQueryDataset(datasetID),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_bigquery_dataset.test", "labels.%", "2"),
+					resource.TestCheckResourceAttr("google_bigquery_dataset.test", "labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_bigquery_dataset.test", "labels.default_table_expiration_ms", "3600000"),
+
+					resource.TestCheckResourceAttr("google_bigquery_dataset.test", "effective_labels.%", "2"),
+					resource.TestCheckResourceAttr("google_bigquery_dataset.test", "effective_labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_bigquery_dataset.test", "effective_labels.default_table_expiration_ms", "3600000"),
+				),
 			},
 			{
 				ResourceName:      "google_bigquery_dataset.test",
 				ImportState:       true,
 				ImportStateVerify: true,
+				// The labels field in the state is decided by the configuration.
+				// During importing, the configuration is unavailable, so the labels field in the state after importing is empty.
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
+			},
+			{
+				Config: testAccBigQueryDatasetUpdated(datasetID),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_bigquery_dataset.test", "labels.%", "2"),
+					resource.TestCheckResourceAttr("google_bigquery_dataset.test", "labels.env", "bar"),
+					resource.TestCheckResourceAttr("google_bigquery_dataset.test", "labels.default_table_expiration_ms", "7200000"),
+
+					resource.TestCheckResourceAttr("google_bigquery_dataset.test", "effective_labels.%", "2"),
+					resource.TestCheckResourceAttr("google_bigquery_dataset.test", "effective_labels.env", "bar"),
+					resource.TestCheckResourceAttr("google_bigquery_dataset.test", "effective_labels.default_table_expiration_ms", "7200000"),
+				),
+			},
+			{
+				ResourceName:            "google_bigquery_dataset.test",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccBigQueryDatasetUpdated2(datasetID),
 			},
+			{
+				ResourceName:            "google_bigquery_dataset.test",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
+			},
+			{
+				Config: testAccBigQueryDataset_withoutLabels(datasetID),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckNoResourceAttr("google_bigquery_dataset.test", "labels.%"),
+					resource.TestCheckNoResourceAttr("google_bigquery_dataset.test", "effective_labels.%"),
+				),
+			},
 			{
 				ResourceName:      "google_bigquery_dataset.test",
 				ImportState:       true,
@@ -49,6 +96,90 @@ func TestAccBigQueryDataset_basic(t *testing.T) {
 	})
 }
 
+func TestAccBigQueryDataset_withProvider5(t *testing.T) {
+	acctest.SkipIfVcr(t)
+	t.Parallel()
+
+	datasetID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+	oldVersion := map[string]resource.ExternalProvider{
+		"google": {
+			VersionConstraint: "4.75.0", // a version that doesn't separate user defined labels and system labels
+			Source:            "registry.terraform.io/hashicorp/google",
+		},
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:     func() { acctest.AccTestPreCheck(t) },
+		CheckDestroy: testAccCheckBigQueryDatasetDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config:            testAccBigQueryDataset_withoutLabels(datasetID),
+				ExternalProviders: oldVersion,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckNoResourceAttr("google_bigquery_dataset.test", "labels.%"),
+					resource.TestCheckNoResourceAttr("google_bigquery_dataset.test", "effective_labels.%"),
+				),
+			},
+			{
+				Config:                   testAccBigQueryDataset(datasetID),
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_bigquery_dataset.test", "labels.%", "2"),
+					resource.TestCheckResourceAttr("google_bigquery_dataset.test", "labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_bigquery_dataset.test", "labels.default_table_expiration_ms", "3600000"),
+
+					resource.TestCheckResourceAttr("google_bigquery_dataset.test", "effective_labels.%", "2"),
+					resource.TestCheckResourceAttr("google_bigquery_dataset.test", "effective_labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_bigquery_dataset.test", "effective_labels.default_table_expiration_ms", "3600000"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccBigQueryDataset_withOutOfBandLabels(t *testing.T) {
+	acctest.SkipIfVcr(t)
+	t.Parallel()
+
+	datasetID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckBigQueryDatasetDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBigQueryDataset(datasetID),
+				Check:  addOutOfBandLabels(t, datasetID),
+			},
+			{
+				ResourceName:            "google_bigquery_dataset.test",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"delete_contents_on_destroy", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccBigQueryDatasetUpdated(datasetID),
+			},
+			{
+				ResourceName:            "google_bigquery_dataset.test",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"delete_contents_on_destroy", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccBigQueryDatasetUpdated_withOutOfBandLabels(datasetID),
+			},
+			{
+				ResourceName:            "google_bigquery_dataset.test",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"delete_contents_on_destroy", "labels", "terraform_labels"},
+			},
+		},
+	})
+}
+
 func TestAccBigQueryDataset_datasetWithContents(t *testing.T) {
 	t.Parallel()
 
@@ -68,7 +199,7 @@ func TestAccBigQueryDataset_datasetWithContents(t *testing.T) {
 				ResourceName:            "google_bigquery_dataset.contents_test",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"delete_contents_on_destroy"},
+				ImportStateVerifyIgnore: []string{"delete_contents_on_destroy", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -90,33 +221,37 @@ func TestAccBigQueryDataset_access(t *testing.T) {
 				Config: testAccBigQueryDatasetWithOneAccess(datasetID),
 			},
 			{
-				ResourceName:      "google_bigquery_dataset.access_test",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_bigquery_dataset.access_test",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
-				Config: testAccBigQueryDatasetWithTwoAccess(datasetID),
+				Config: testAccBigQueryDatasetWithThreeAccess(datasetID),
 			},
 			{
-				ResourceName:      "google_bigquery_dataset.access_test",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_bigquery_dataset.access_test",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccBigQueryDatasetWithOneAccess(datasetID),
 			},
 			{
-				ResourceName:      "google_bigquery_dataset.access_test",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_bigquery_dataset.access_test",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccBigQueryDatasetWithViewAccess(datasetID, otherDatasetID, otherTableID),
 			},
 			{
-				ResourceName:      "google_bigquery_dataset.access_test",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_bigquery_dataset.access_test",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -136,9 +271,10 @@ func TestAccBigQueryDataset_regionalLocation(t *testing.T) {
 				Config: testAccBigQueryRegionalDataset(datasetID1, "asia-south1"),
 			},
 			{
-				ResourceName:      "google_bigquery_dataset.test",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_bigquery_dataset.test",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -181,9 +317,10 @@ func TestAccBigQueryDataset_storageBillModel(t *testing.T) {
 				Config: testAccBigQueryDatasetStorageBillingModel(datasetID),
 			},
 			{
-				ResourceName:      "google_bigquery_dataset.test",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_bigquery_dataset.test",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -208,6 +345,38 @@ func testAccAddTable(t *testing.T, datasetID string, tableID string) resource.Te
 	}
 }
 
+func addOutOfBandLabels(t *testing.T, datasetID string) resource.TestCheckFunc {
+	// Not actually a check, but adds labels independently of terraform
+	return func(s *terraform.State) error {
+		config := acctest.GoogleProviderConfig(t)
+
+		dataset, err := config.NewBigQueryClient(config.UserAgent).Datasets.Get(config.Project, datasetID).Do()
+		if err != nil {
+			return fmt.Errorf("Could not get dataset with ID %s", datasetID)
+		}
+
+		dataset.Labels["outband_key"] = "test"
+		_, err = config.NewBigQueryClient(config.UserAgent).Datasets.Patch(config.Project, datasetID, dataset).Do()
+		if err != nil {
+			return fmt.Errorf("Could not update labele for the dataset")
+		}
+		return nil
+	}
+}
+
+func testAccBigQueryDataset_withoutLabels(datasetID string) string {
+	return fmt.Sprintf(`
+resource "google_bigquery_dataset" "test" {
+  dataset_id                      = "%s"
+  friendly_name                   = "foo"
+  description                     = "This is a foo description"
+  location                        = "EU"
+  default_partition_expiration_ms = 3600000
+  default_table_expiration_ms     = 3600000
+}
+`, datasetID)
+}
+
 func testAccBigQueryDataset(datasetID string) string {
 	return fmt.Sprintf(`
 resource "google_bigquery_dataset" "test" {
@@ -244,6 +413,25 @@ resource "google_bigquery_dataset" "test" {
 `, datasetID)
 }
 
+func testAccBigQueryDatasetUpdated_withOutOfBandLabels(datasetID string) string {
+	return fmt.Sprintf(`
+resource "google_bigquery_dataset" "test" {
+  dataset_id                      = "%s"
+  friendly_name                   = "bar"
+  description                     = "This is a bar description"
+  location                        = "EU"
+  default_partition_expiration_ms = 7200000
+  default_table_expiration_ms     = 7200000
+
+  labels = {
+    env                         = "bar"
+    default_table_expiration_ms = 7200000
+	outband_key                 = "test-update"
+  }
+}
+`, datasetID)
+}
+
 func testAccBigQueryDatasetUpdated2(datasetID string) string {
 	return fmt.Sprintf(`
 resource "google_bigquery_dataset" "test" {
@@ -316,7 +504,7 @@ resource "google_bigquery_dataset" "access_test" {
 `, datasetID)
 }
 
-func testAccBigQueryDatasetWithTwoAccess(datasetID string) string {
+func testAccBigQueryDatasetWithThreeAccess(datasetID string) string {
 	return fmt.Sprintf(`
 resource "google_bigquery_dataset" "access_test" {
   dataset_id = "%s"
@@ -329,6 +517,10 @@ resource "google_bigquery_dataset" "access_test" {
     role   = "READER"
     domain = "hashicorp.com"
   }
+  access {
+    role       = "READER"
+    iam_member = "allUsers"
+  }
 
   labels = {
     env                         = "foo"
diff --git a/mmv1/third_party/terraform/services/bigquery/resource_bigquery_job_test.go b/mmv1/third_party/terraform/services/bigquery/resource_bigquery_job_test.go
index 9de93bb6a2f7..3e8b4b832e3f 100644
--- a/mmv1/third_party/terraform/services/bigquery/resource_bigquery_job_test.go
+++ b/mmv1/third_party/terraform/services/bigquery/resource_bigquery_job_test.go
@@ -32,7 +32,7 @@ func TestAccBigQueryJob_withLocation(t *testing.T) {
 				ImportStateId:           importID,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"etag", "status.0.state"},
+				ImportStateVerifyIgnore: []string{"etag", "status.0.state", "labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/bigquery/resource_bigquery_table.go b/mmv1/third_party/terraform/services/bigquery/resource_bigquery_table.go
index 27a83e8c8d1b..52157ec193c7 100644
--- a/mmv1/third_party/terraform/services/bigquery/resource_bigquery_table.go
+++ b/mmv1/third_party/terraform/services/bigquery/resource_bigquery_table.go
@@ -189,10 +189,21 @@ func bigQueryTableConnectionIdSuppress(name, old, new string, _ *schema.Resource
 		return false
 	}
 
-	re := regexp.MustCompile("projects/(.+)/(?:locations|regions)/(.+)/connections/(.+)")
-	if matches := re.FindStringSubmatch(new); matches != nil {
-		return old == matches[1]+"."+matches[2]+"."+matches[3]
+	// Old is in the dot format, and new is in the slash format.
+	// They represent the same connection if the project, locaition, and IDs are
+	// the same.
+	// Location should use a case-insenstive comparison.
+	dotRe := regexp.MustCompile(`(.+)\.(.+)\.(.+)`)
+	slashRe := regexp.MustCompile("projects/(.+)/(?:locations|regions)/(.+)/connections/(.+)")
+	dotMatches := dotRe.FindStringSubmatch(old)
+	slashMatches := slashRe.FindStringSubmatch(new)
+	if dotMatches != nil && slashMatches != nil {
+		sameProject := dotMatches[1] == slashMatches[1]
+		sameLocation := strings.EqualFold(dotMatches[2], slashMatches[2])
+		sameId := dotMatches[3] == slashMatches[3]
+		return sameProject && sameLocation && sameId
 	}
+
 	return false
 }
 
@@ -383,6 +394,32 @@ func resourceBigQueryTableSchemaCustomizeDiff(_ context.Context, d *schema.Resou
 	return resourceBigQueryTableSchemaCustomizeDiffFunc(d)
 }
 
+func validateBigQueryTableSchema(v interface{}, k string) (warnings []string, errs []error) {
+	if v == nil {
+		return
+	}
+
+	if _, e := validation.StringIsJSON(v, k); e != nil {
+		errs = append(errs, e...)
+		return
+	}
+
+	var jsonList []interface{}
+	if err := json.Unmarshal([]byte(v.(string)), &jsonList); err != nil {
+		errs = append(errs, fmt.Errorf("\"schema\" is not a JSON array: %s", err))
+		return
+	}
+
+	for _, v := range jsonList {
+		if v == nil {
+			errs = append(errs, errors.New("\"schema\" contains a nil element"))
+			return
+		}
+	}
+
+	return
+}
+
 func ResourceBigQueryTable() *schema.Resource {
 	return &schema.Resource{
 		Create: resourceBigQueryTableCreate,
@@ -393,7 +430,9 @@ func ResourceBigQueryTable() *schema.Resource {
 			State: resourceBigQueryTableImport,
 		},
 		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
 			resourceBigQueryTableSchemaCustomizeDiff,
+			tpgresource.SetLabelsDiff,
 		),
 		Schema: map[string]*schema.Schema{
 			// TableId: [Required] The ID of the table. The ID must contain only
@@ -497,7 +536,7 @@ func ResourceBigQueryTable() *schema.Resource {
 							Optional:     true,
 							Computed:     true,
 							ForceNew:     true,
-							ValidateFunc: validation.StringIsJSON,
+							ValidateFunc: validateBigQueryTableSchema,
 							StateFunc: func(v interface{}) string {
 								json, _ := structure.NormalizeJsonString(v)
 								return json
@@ -750,7 +789,7 @@ func ResourceBigQueryTable() *schema.Resource {
 			"max_staleness": {
 				Type:        schema.TypeString,
 				Optional:    true,
-				Description: `The maximum staleness of data that could be returned when the table (or stale MV) is queried. Staleness encoded as a string encoding of sql IntervalValue type.`,
+				Description: `The maximum staleness of data that could be returned when the table (or stale MV) is queried. Staleness encoded as a string encoding of [SQL IntervalValue type](https://cloud.google.com/bigquery/docs/reference/standard-sql/data-types#interval_type).`,
 			},
 
 			// Labels: [Experimental] The labels associated with this table. You can
@@ -761,18 +800,32 @@ func ResourceBigQueryTable() *schema.Resource {
 			// start with a letter and each label in the list must have a different
 			// key.
 			"labels": {
+				Type:     schema.TypeMap,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Description: `A mapping of labels to assign to the resource.
+
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+			},
+			"terraform_labels": {
 				Type:        schema.TypeMap,
-				Optional:    true,
+				Computed:    true,
+				Description: `The combination of labels configured directly on the resource and default labels configured on the provider.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+			},
+			"effective_labels": {
+				Type:        schema.TypeMap,
+				Computed:    true,
+				Description: `All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.`,
 				Elem:        &schema.Schema{Type: schema.TypeString},
-				Description: `A mapping of labels to assign to the resource.`,
 			},
-
 			// Schema: [Optional] Describes the schema of this table.
 			"schema": {
 				Type:         schema.TypeString,
 				Optional:     true,
 				Computed:     true,
-				ValidateFunc: validation.StringIsJSON,
+				ValidateFunc: validateBigQueryTableSchema,
 				StateFunc: func(v interface{}) string {
 					json, _ := structure.NormalizeJsonString(v)
 					return json
@@ -837,6 +890,14 @@ func ResourceBigQueryTable() *schema.Resource {
 							Description: `Specifies maximum frequency at which this materialized view will be refreshed. The default is 1800000`,
 						},
 
+						"allow_non_incremental_definition": {
+							Type:        schema.TypeBool,
+							Default:     false,
+							Optional:    true,
+							ForceNew:    true,
+							Description: `Allow non incremental materialized view definition. The default value is false.`,
+						},
+
 						// Query: [Required] A query whose result is persisted
 						"query": {
 							Type:        schema.TypeString,
@@ -857,8 +918,11 @@ func ResourceBigQueryTable() *schema.Resource {
 				Description: `If specified, configures time-based partitioning for this table.`,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
-						// ExpirationMs: [Optional] Number of milliseconds for which to keep the
-						// storage for a partition.
+						// ExpirationMs: [Optional] Number of milliseconds for which to keep the storage for a
+						// partition. If unspecified when the table is created in a dataset that has
+						// `defaultPartitionExpirationMs`, it will inherit the value of
+						// `defaultPartitionExpirationMs` from the dataset.
+						// To specify a unlimited expiration, set the value to 0.
 						"expiration_ms": {
 							Type:        schema.TypeInt,
 							Optional:    true,
@@ -889,9 +953,11 @@ func ResourceBigQueryTable() *schema.Resource {
 						// require a partition filter that can be used for partition elimination to be
 						// specified.
 						"require_partition_filter": {
-							Type:        schema.TypeBool,
-							Optional:    true,
-							Description: `If set to true, queries over this table require a partition filter that can be used for partition elimination to be specified.`,
+							Type:          schema.TypeBool,
+							Optional:      true,
+							Description:   `If set to true, queries over this table require a partition filter that can be used for partition elimination to be specified.`,
+							Deprecated:    `This field is deprecated and will be removed in a future major release; please use the top level field with the same name instead.`,
+							ConflictsWith: []string{"require_partition_filter"},
 						},
 					},
 				},
@@ -950,6 +1016,16 @@ func ResourceBigQueryTable() *schema.Resource {
 				},
 			},
 
+			// RequirePartitionFilter: [Optional] If set to true, queries over this table
+			// require a partition filter that can be used for partition elimination to be
+			// specified.
+			"require_partition_filter": {
+				Type:          schema.TypeBool,
+				Optional:      true,
+				Description:   `If set to true, queries over this table require a partition filter that can be used for partition elimination to be specified.`,
+				ConflictsWith: []string{"time_partitioning.0.require_partition_filter"},
+			},
+
 			// Clustering: [Optional] Specifies column names to use for data clustering.  Up to four
 			// top-level columns are allowed, and should be specified in descending priority order.
 			"clustering": {
@@ -1061,6 +1137,119 @@ func ResourceBigQueryTable() *schema.Resource {
 				Default:     true,
 				Description: `Whether or not to allow Terraform to destroy the instance. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the instance will fail.`,
 			},
+
+			// TableConstraints: [Optional] Defines the primary key and foreign keys.
+			"table_constraints": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				MaxItems:    1,
+				Description: `Defines the primary key and foreign keys.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						// PrimaryKey: [Optional] Represents the primary key constraint
+						// on a table's columns. Present only if the table has a primary key.
+						// The primary key is not enforced.
+						"primary_key": {
+							Type:        schema.TypeList,
+							Optional:    true,
+							MaxItems:    1,
+							Description: `Represents a primary key constraint on a table's columns. Present only if the table has a primary key. The primary key is not enforced.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									//Columns: [Required] The columns that are composed of the primary key constraint.
+									"columns": {
+										Type:        schema.TypeList,
+										Required:    true,
+										Description: `The columns that are composed of the primary key constraint.`,
+										Elem:        &schema.Schema{Type: schema.TypeString},
+									},
+								},
+							},
+						},
+
+						// ForeignKeys: [Optional] Present only if the table has a foreign key.
+						// The foreign key is not enforced.
+						"foreign_keys": {
+							Type:        schema.TypeList,
+							Optional:    true,
+							Description: `Present only if the table has a foreign key. The foreign key is not enforced.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									// Name: [Optional] Set only if the foreign key constraint is named.
+									"name": {
+										Type:        schema.TypeString,
+										Optional:    true,
+										Description: `Set only if the foreign key constraint is named.`,
+									},
+
+									// ReferencedTable: [Required] The table that holds the primary key
+									// and is referenced by this foreign key.
+									"referenced_table": {
+										Type:        schema.TypeList,
+										Required:    true,
+										MaxItems:    1,
+										Description: `The table that holds the primary key and is referenced by this foreign key.`,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												// ProjectId: [Required] The ID of the project containing this table.
+												"project_id": {
+													Type:        schema.TypeString,
+													Required:    true,
+													Description: `The ID of the project containing this table.`,
+												},
+
+												// DatasetId: [Required] The ID of the dataset containing this table.
+												"dataset_id": {
+													Type:        schema.TypeString,
+													Required:    true,
+													Description: `The ID of the dataset containing this table.`,
+												},
+
+												// TableId: [Required] The ID of the table. The ID must contain only
+												// letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum
+												// length is 1,024 characters. Certain operations allow suffixing of
+												// the table ID with a partition decorator, such as
+												// sample_table$20190123.
+												"table_id": {
+													Type:        schema.TypeString,
+													Required:    true,
+													Description: `The ID of the table. The ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum length is 1,024 characters. Certain operations allow suffixing of the table ID with a partition decorator, such as sample_table$20190123.`,
+												},
+											},
+										},
+									},
+
+									// ColumnReferences: [Required] The pair of the foreign key column and primary key column.
+									"column_references": {
+										Type:        schema.TypeList,
+										Required:    true,
+										MaxItems:    1,
+										Description: `The pair of the foreign key column and primary key column.`,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												// ReferencingColumn: [Required] The column that composes the foreign key.
+												"referencing_column": {
+													Type:        schema.TypeString,
+													Required:    true,
+													Description: `The column that composes the foreign key.`,
+												},
+
+												// ReferencedColumn: [Required] The column in the primary key that are
+												// referenced by the referencingColumn
+												"referenced_column": {
+													Type:        schema.TypeString,
+													Required:    true,
+													Description: `The column in the primary key that are referenced by the referencingColumn.`,
+												},
+											},
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
 		},
 		UseJSONNumber: true,
 	}
@@ -1121,7 +1310,7 @@ func resourceTable(d *schema.ResourceData, meta interface{}) (*bigquery.Table, e
 		}
 	}
 
-	if v, ok := d.GetOk("labels"); ok {
+	if v, ok := d.GetOk("effective_labels"); ok {
 		labels := map[string]string{}
 
 		for k, v := range v.(map[string]interface{}) {
@@ -1155,6 +1344,10 @@ func resourceTable(d *schema.ResourceData, meta interface{}) (*bigquery.Table, e
 		table.RangePartitioning = rangePartitioning
 	}
 
+	if v, ok := d.GetOk("require_partition_filter"); ok {
+		table.RequirePartitionFilter = v.(bool)
+	}
+
 	if v, ok := d.GetOk("clustering"); ok {
 		table.Clustering = &bigquery.Clustering{
 			Fields:          tpgresource.ConvertStringArr(v.([]interface{})),
@@ -1162,6 +1355,15 @@ func resourceTable(d *schema.ResourceData, meta interface{}) (*bigquery.Table, e
 		}
 	}
 
+	if v, ok := d.GetOk("table_constraints"); ok {
+		tableConstraints, err := expandTableConstraints(v)
+		if err != nil {
+			return nil, err
+		}
+
+		table.TableConstraints = tableConstraints
+	}
+
 	return table, nil
 }
 
@@ -1259,9 +1461,15 @@ func resourceBigQueryTableRead(d *schema.ResourceData, meta interface{}) error {
 	if err := d.Set("max_staleness", res.MaxStaleness); err != nil {
 		return fmt.Errorf("Error setting max_staleness: %s", err)
 	}
-	if err := d.Set("labels", res.Labels); err != nil {
+	if err := tpgresource.SetLabels(res.Labels, d, "labels"); err != nil {
 		return fmt.Errorf("Error setting labels: %s", err)
 	}
+	if err := tpgresource.SetLabels(res.Labels, d, "terraform_labels"); err != nil {
+		return fmt.Errorf("Error setting terraform_labels: %s", err)
+	}
+	if err := d.Set("effective_labels", res.Labels); err != nil {
+		return fmt.Errorf("Error setting effective_labels: %s", err)
+	}
 	if err := d.Set("creation_time", res.CreationTime); err != nil {
 		return fmt.Errorf("Error setting creation_time: %s", err)
 	}
@@ -1296,6 +1504,14 @@ func resourceBigQueryTableRead(d *schema.ResourceData, meta interface{}) error {
 		return fmt.Errorf("Error setting type: %s", err)
 	}
 
+	// determine whether the deprecated require_partition_filter field is used
+	use_old_rpf := false
+	if _, ok := d.GetOk("time_partitioning.0.require_partition_filter"); ok {
+		use_old_rpf = true
+	} else if err := d.Set("require_partition_filter", res.RequirePartitionFilter); err != nil {
+		return fmt.Errorf("Error setting require_partition_filter: %s", err)
+	}
+
 	if res.ExternalDataConfiguration != nil {
 		externalDataConfiguration, err := flattenExternalDataConfiguration(res.ExternalDataConfiguration)
 		if err != nil {
@@ -1326,7 +1542,7 @@ func resourceBigQueryTableRead(d *schema.ResourceData, meta interface{}) error {
 	}
 
 	if res.TimePartitioning != nil {
-		if err := d.Set("time_partitioning", flattenTimePartitioning(res.TimePartitioning)); err != nil {
+		if err := d.Set("time_partitioning", flattenTimePartitioning(res.TimePartitioning, use_old_rpf)); err != nil {
 			return err
 		}
 	}
@@ -1373,6 +1589,14 @@ func resourceBigQueryTableRead(d *schema.ResourceData, meta interface{}) error {
 		}
 	}
 
+	if res.TableConstraints != nil {
+		table_constraints := flattenTableConstraints(res.TableConstraints)
+
+		if err := d.Set("table_constraints", table_constraints); err != nil {
+			return fmt.Errorf("Error setting table constraints: %s", err)
+		}
+	}
+
 	return nil
 }
 
@@ -1916,7 +2140,7 @@ func flattenEncryptionConfiguration(ec *bigquery.EncryptionConfiguration) []map[
 	return []map[string]interface{}{{"kms_key_name": ec.KmsKeyName, "kms_key_version": ""}}
 }
 
-func flattenTimePartitioning(tp *bigquery.TimePartitioning) []map[string]interface{} {
+func flattenTimePartitioning(tp *bigquery.TimePartitioning, use_old_rpf bool) []map[string]interface{} {
 	result := map[string]interface{}{"type": tp.Type}
 
 	if tp.Field != "" {
@@ -1927,7 +2151,7 @@ func flattenTimePartitioning(tp *bigquery.TimePartitioning) []map[string]interfa
 		result["expiration_ms"] = tp.ExpirationMs
 	}
 
-	if tp.RequirePartitionFilter {
+	if tp.RequirePartitionFilter && use_old_rpf {
 		result["require_partition_filter"] = tp.RequirePartitionFilter
 	}
 
@@ -1982,6 +2206,11 @@ func expandMaterializedView(configured interface{}) *bigquery.MaterializedViewDe
 		mvd.ForceSendFields = append(mvd.ForceSendFields, "RefreshIntervalMs")
 	}
 
+	if v, ok := raw["allow_non_incremental_definition"]; ok {
+		mvd.AllowNonIncrementalDefinition = v.(bool)
+		mvd.ForceSendFields = append(mvd.ForceSendFields, "AllowNonIncrementalDefinition")
+	}
+
 	return mvd
 }
 
@@ -1989,6 +2218,167 @@ func flattenMaterializedView(mvd *bigquery.MaterializedViewDefinition) []map[str
 	result := map[string]interface{}{"query": mvd.Query}
 	result["enable_refresh"] = mvd.EnableRefresh
 	result["refresh_interval_ms"] = mvd.RefreshIntervalMs
+	result["allow_non_incremental_definition"] = mvd.AllowNonIncrementalDefinition
+
+	return []map[string]interface{}{result}
+}
+
+func expandPrimaryKey(configured interface{}) *bigquery.TableConstraintsPrimaryKey {
+	if len(configured.([]interface{})) == 0 {
+		return nil
+	}
+
+	raw := configured.([]interface{})[0].(map[string]interface{})
+	pk := &bigquery.TableConstraintsPrimaryKey{}
+
+	columns := []string{}
+	for _, rawColumn := range raw["columns"].([]interface{}) {
+		columns = append(columns, rawColumn.(string))
+	}
+	if len(columns) > 0 {
+		pk.Columns = columns
+	}
+
+	return pk
+}
+
+func flattenPrimaryKey(edc *bigquery.TableConstraintsPrimaryKey) []map[string]interface{} {
+	result := map[string]interface{}{}
+
+	if edc.Columns != nil {
+		result["columns"] = edc.Columns
+	}
+
+	return []map[string]interface{}{result}
+}
+
+func expandReferencedTable(configured interface{}) *bigquery.TableConstraintsForeignKeysReferencedTable {
+	raw := configured.([]interface{})[0].(map[string]interface{})
+	rt := &bigquery.TableConstraintsForeignKeysReferencedTable{}
+
+	if v, ok := raw["project_id"]; ok {
+		rt.ProjectId = v.(string)
+	}
+	if v, ok := raw["dataset_id"]; ok {
+		rt.DatasetId = v.(string)
+	}
+	if v, ok := raw["table_id"]; ok {
+		rt.TableId = v.(string)
+	}
+
+	return rt
+}
+
+func flattenReferencedTable(edc *bigquery.TableConstraintsForeignKeysReferencedTable) []map[string]interface{} {
+	result := map[string]interface{}{}
+
+	result["project_id"] = edc.ProjectId
+	result["dataset_id"] = edc.DatasetId
+	result["table_id"] = edc.TableId
+
+	return []map[string]interface{}{result}
+}
+
+func expandColumnReference(configured interface{}) *bigquery.TableConstraintsForeignKeysColumnReferences {
+	raw := configured.(map[string]interface{})
+
+	cr := &bigquery.TableConstraintsForeignKeysColumnReferences{}
+
+	if v, ok := raw["referencing_column"]; ok {
+		cr.ReferencingColumn = v.(string)
+	}
+	if v, ok := raw["referenced_column"]; ok {
+		cr.ReferencedColumn = v.(string)
+	}
+
+	return cr
+}
+
+func flattenColumnReferences(edc []*bigquery.TableConstraintsForeignKeysColumnReferences) []map[string]interface{} {
+	results := []map[string]interface{}{}
+
+	for _, cr := range edc {
+		result := map[string]interface{}{}
+		result["referenced_column"] = cr.ReferencedColumn
+		result["referencing_column"] = cr.ReferencingColumn
+		results = append(results, result)
+	}
+
+	return results
+}
+
+func expandForeignKey(configured interface{}) *bigquery.TableConstraintsForeignKeys {
+	raw := configured.(map[string]interface{})
+
+	fk := &bigquery.TableConstraintsForeignKeys{}
+	if v, ok := raw["name"]; ok {
+		fk.Name = v.(string)
+	}
+	if v, ok := raw["referenced_table"]; ok {
+		fk.ReferencedTable = expandReferencedTable(v)
+	}
+	crs := []*bigquery.TableConstraintsForeignKeysColumnReferences{}
+	if v, ok := raw["column_references"]; ok {
+		for _, rawColumnReferences := range v.([]interface{}) {
+			crs = append(crs, expandColumnReference(rawColumnReferences))
+		}
+	}
+
+	if len(crs) > 0 {
+		fk.ColumnReferences = crs
+	}
+
+	return fk
+}
+
+func flattenForeignKeys(edc []*bigquery.TableConstraintsForeignKeys) []map[string]interface{} {
+	results := []map[string]interface{}{}
+
+	for _, fr := range edc {
+		result := map[string]interface{}{}
+		result["name"] = fr.Name
+		result["column_references"] = flattenColumnReferences(fr.ColumnReferences)
+		result["referenced_table"] = flattenReferencedTable(fr.ReferencedTable)
+		results = append(results, result)
+	}
+
+	return results
+}
+
+func expandTableConstraints(cfg interface{}) (*bigquery.TableConstraints, error) {
+	raw := cfg.([]interface{})[0].(map[string]interface{})
+
+	edc := &bigquery.TableConstraints{}
+
+	if v, ok := raw["primary_key"]; ok {
+		edc.PrimaryKey = expandPrimaryKey(v)
+	}
+
+	fks := []*bigquery.TableConstraintsForeignKeys{}
+
+	if v, ok := raw["foreign_keys"]; ok {
+		for _, rawForeignKey := range v.([]interface{}) {
+			fks = append(fks, expandForeignKey(rawForeignKey))
+		}
+	}
+
+	if len(fks) > 0 {
+		edc.ForeignKeys = fks
+	}
+
+	return edc, nil
+
+}
+
+func flattenTableConstraints(edc *bigquery.TableConstraints) []map[string]interface{} {
+	result := map[string]interface{}{}
+
+	if edc.PrimaryKey != nil {
+		result["primary_key"] = flattenPrimaryKey(edc.PrimaryKey)
+	}
+	if edc.ForeignKeys != nil {
+		result["foreign_keys"] = flattenForeignKeys(edc.ForeignKeys)
+	}
 
 	return []map[string]interface{}{result}
 }
diff --git a/mmv1/third_party/terraform/services/bigquery/resource_bigquery_table_test.go b/mmv1/third_party/terraform/services/bigquery/resource_bigquery_table_test.go
index e2b9b2991260..e30a5e05d378 100644
--- a/mmv1/third_party/terraform/services/bigquery/resource_bigquery_table_test.go
+++ b/mmv1/third_party/terraform/services/bigquery/resource_bigquery_table_test.go
@@ -298,6 +298,93 @@ func TestAccBigQueryTable_RangePartitioning(t *testing.T) {
 	})
 }
 
+func TestAccBigQueryTable_PrimaryKey(t *testing.T) {
+	t.Parallel()
+	resourceName := "google_bigquery_table.test"
+	datasetID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+	tableID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckBigQueryTableDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBigQueryTablePrimaryKey(datasetID, tableID),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
+			},
+		},
+	})
+}
+
+func TestAccBigQueryTable_ForeignKey(t *testing.T) {
+	t.Parallel()
+	resourceName := "google_bigquery_table.test"
+	datasetID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+	tableID_pk := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+	tableID_fk := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+
+	projectID := envvar.GetTestProjectFromEnv()
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckBigQueryTableDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBigQueryTableForeignKeys(projectID, datasetID, tableID_pk, tableID_fk),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
+			},
+		},
+	})
+}
+
+func TestAccBigQueryTable_updateTableConstraints(t *testing.T) {
+	t.Parallel()
+	resourceName := "google_bigquery_table.test"
+	datasetID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+	tableID_pk := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+	tableID_fk := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+
+	projectID := envvar.GetTestProjectFromEnv()
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckBigQueryTableDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBigQueryTableForeignKeys(projectID, datasetID, tableID_pk, tableID_fk),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
+			},
+			{
+				Config: testAccBigQueryTableTableConstraintsUpdate(projectID, datasetID, tableID_pk, tableID_fk),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
+			},
+		},
+	})
+}
+
 func TestAccBigQueryTable_View(t *testing.T) {
 	t.Parallel()
 
@@ -487,6 +574,39 @@ func TestAccBigQueryTable_MaterializedView_DailyTimePartioning_Update(t *testing
 	})
 }
 
+func TestAccBigQueryTable_MaterializedView_NonIncremental_basic(t *testing.T) {
+	t.Parallel()
+
+	datasetID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+	tableID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+	materialized_viewID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+	query := fmt.Sprintf("SELECT count(some_string) as count, some_int, ts FROM `%s.%s` WHERE DATE(ts) = '2019-01-01' GROUP BY some_int, ts", datasetID, tableID)
+	maxStaleness := "0-0 0 10:0:0"
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckBigQueryTableDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBigQueryTableWithMatViewNonIncremental_basic(datasetID, tableID, materialized_viewID, query, maxStaleness),
+			},
+			{
+				ResourceName:            "google_bigquery_table.test",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"etag", "last_modified_time", "deletion_protection", "require_partition_filter", "time_partitioning.0.require_partition_filter"},
+			},
+			{
+				ResourceName:            "google_bigquery_table.mv_test",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"etag", "last_modified_time", "deletion_protection", "require_partition_filter", "time_partitioning.0.require_partition_filter"},
+			},
+		},
+	})
+}
+
 func TestAccBigQueryExternalDataTable_parquet(t *testing.T) {
 	t.Parallel()
 
@@ -632,6 +752,131 @@ func TestAccBigQueryExternalDataTable_objectTable(t *testing.T) {
 	})
 }
 
+func TestAccBigQueryExternalDataTable_connectionIdDiff_UseNameReference(t *testing.T) {
+	t.Parallel()
+	// Setup
+	bucketName := acctest.TestBucketName(t)
+	objectName := fmt.Sprintf("tf_test_%s.csv", acctest.RandString(t, 10))
+	datasetID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+	tableID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+	connectionID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+
+	// Feature Under Test.
+	location := "US"
+	connection_id_reference := "google_bigquery_connection.test.name"
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckBigQueryTableDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBigQueryTableExternalDataConfigurationConnectionID(location, connectionID, datasetID, tableID, bucketName, objectName, connection_id_reference),
+			},
+		},
+	})
+}
+
+func TestAccBigQueryExternalDataTable_connectionIdDiff_UseIdReference(t *testing.T) {
+	t.Parallel()
+	// Setup
+	bucketName := acctest.TestBucketName(t)
+	objectName := fmt.Sprintf("tf_test_%s.csv", acctest.RandString(t, 10))
+	datasetID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+	tableID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+	connectionID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+
+	// Feature Under Test.
+	location := "US"
+	connection_id_reference := "google_bigquery_connection.test.id"
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckBigQueryTableDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBigQueryTableExternalDataConfigurationConnectionID(location, connectionID, datasetID, tableID, bucketName, objectName, connection_id_reference),
+			},
+		},
+	})
+}
+
+func TestAccBigQueryExternalDataTable_connectionIdDiff_UseIdReference_UsCentral1LowerCase(t *testing.T) {
+	t.Parallel()
+	// Setup
+	bucketName := acctest.TestBucketName(t)
+	objectName := fmt.Sprintf("tf_test_%s.csv", acctest.RandString(t, 10))
+	datasetID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+	tableID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+	connectionID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+
+	// Feature Under Test.
+	location := "us-central1"
+	connection_id_reference := "google_bigquery_connection.test.id"
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckBigQueryTableDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBigQueryTableExternalDataConfigurationConnectionID(location, connectionID, datasetID, tableID, bucketName, objectName, connection_id_reference),
+			},
+		},
+	})
+}
+
+func TestAccBigQueryExternalDataTable_connectionIdDiff_UseIdReference_UsEast1(t *testing.T) {
+	t.Parallel()
+	// Setup
+	bucketName := acctest.TestBucketName(t)
+	objectName := fmt.Sprintf("tf_test_%s.csv", acctest.RandString(t, 10))
+	datasetID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+	tableID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+	connectionID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+
+	// Feature Under Test.
+	location := "US-EAST1"
+	connection_id_reference := "google_bigquery_connection.test.id"
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckBigQueryTableDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBigQueryTableExternalDataConfigurationConnectionID(location, connectionID, datasetID, tableID, bucketName, objectName, connection_id_reference),
+			},
+		},
+	})
+}
+
+func TestAccBigQueryExternalDataTable_connectionIdDiff_UseIdReference_EuropeWest8(t *testing.T) {
+	t.Parallel()
+	// Setup
+	bucketName := acctest.TestBucketName(t)
+	objectName := fmt.Sprintf("tf_test_%s.csv", acctest.RandString(t, 10))
+	datasetID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+	tableID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+	connectionID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+
+	// Feature Under Test.
+	location := "EUROPE-WEST8"
+	connection_id_reference := "google_bigquery_connection.test.id"
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckBigQueryTableDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBigQueryTableExternalDataConfigurationConnectionID(location, connectionID, datasetID, tableID, bucketName, objectName, connection_id_reference),
+			},
+		},
+	})
+}
+
 func TestAccBigQueryExternalDataTable_CSV(t *testing.T) {
 	t.Parallel()
 
@@ -658,6 +903,36 @@ func TestAccBigQueryExternalDataTable_CSV(t *testing.T) {
 	})
 }
 
+func TestAccBigQueryExternalDataTable_CSV_WithSchema_InvalidSchemas(t *testing.T) {
+	t.Parallel()
+
+	bucketName := acctest.TestBucketName(t)
+	objectName := fmt.Sprintf("tf_test_%s.csv", acctest.RandString(t, 10))
+
+	datasetID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+	tableID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckBigQueryTableDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config:      testAccBigQueryTableFromGCSWithExternalDataConfigSchema(datasetID, tableID, bucketName, objectName, TEST_SIMPLE_CSV, TEST_INVALID_SCHEMA_NOT_JSON),
+				ExpectError: regexp.MustCompile("contains an invalid JSON"),
+			},
+			{
+				Config:      testAccBigQueryTableFromGCSWithExternalDataConfigSchema(datasetID, tableID, bucketName, objectName, TEST_SIMPLE_CSV, TEST_INVALID_SCHEMA_NOT_JSON_LIST),
+				ExpectError: regexp.MustCompile("\"schema\" is not a JSON array"),
+			},
+			{
+				Config:      testAccBigQueryTableFromGCSWithExternalDataConfigSchema(datasetID, tableID, bucketName, objectName, TEST_SIMPLE_CSV, TEST_INVALID_SCHEMA_JSON_LIST_WITH_NULL_ELEMENT),
+				ExpectError: regexp.MustCompile("\"schema\" contains a nil element"),
+			},
+		},
+	})
+}
+
 func TestAccBigQueryExternalDataTable_CSV_WithSchemaAndConnectionID_UpdateNoConnectionID(t *testing.T) {
 	t.Parallel()
 
@@ -782,6 +1057,8 @@ func TestAccBigQueryExternalDataTable_CSV_WithSchema_UpdateAllowQuotedNewlines(t
 }
 
 func TestAccBigQueryDataTable_bigtable(t *testing.T) {
+	// bigtable instance does not use the shared HTTP client, this test creates an instance
+	acctest.SkipIfVcr(t)
 	t.Parallel()
 
 	context := map[string]interface{}{
@@ -850,7 +1127,7 @@ func TestAccBigQueryDataTable_jsonEquivalency(t *testing.T) {
 				ResourceName:            "google_bigquery_table.test",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"etag", "last_modified_time", "deletion_protection"},
+				ImportStateVerifyIgnore: []string{"etag", "last_modified_time", "deletion_protection", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccBigQueryTable_jsonEqModeRemoved(datasetID, tableID),
@@ -859,7 +1136,7 @@ func TestAccBigQueryDataTable_jsonEquivalency(t *testing.T) {
 				ResourceName:            "google_bigquery_table.test",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"etag", "last_modified_time", "deletion_protection"},
+				ImportStateVerifyIgnore: []string{"etag", "last_modified_time", "deletion_protection", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -909,7 +1186,7 @@ func TestAccBigQueryDataTable_expandArray(t *testing.T) {
 				ResourceName:            "google_bigquery_table.test",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"etag", "last_modified_time", "deletion_protection"},
+				ImportStateVerifyIgnore: []string{"etag", "last_modified_time", "deletion_protection", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccBigQueryTable_arrayExpanded(datasetID, tableID),
@@ -918,7 +1195,7 @@ func TestAccBigQueryDataTable_expandArray(t *testing.T) {
 				ResourceName:            "google_bigquery_table.test",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"etag", "last_modified_time", "deletion_protection"},
+				ImportStateVerifyIgnore: []string{"etag", "last_modified_time", "deletion_protection", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -942,7 +1219,7 @@ func TestAccBigQueryTable_allowDestroy(t *testing.T) {
 				ResourceName:            "google_bigquery_table.test",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"deletion_protection"},
+				ImportStateVerifyIgnore: []string{"deletion_protection", "labels", "terraform_labels"},
 			},
 			{
 				Config:      testAccBigQueryTable_noAllowDestroy(datasetID, tableID),
@@ -1125,6 +1402,35 @@ func TestAccBigQueryTable_Update_SchemaWithPolicyTagsToEmptyPolicyTagNames(t *te
 	})
 }
 
+func TestAccBigQueryTable_invalidSchemas(t *testing.T) {
+	t.Parallel()
+	// Pending VCR support in https://github.com/hashicorp/terraform-provider-google/issues/15427.
+	acctest.SkipIfVcr(t)
+
+	datasetID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+	tableID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckBigQueryTableDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config:      testAccBigQueryTableWithSchema(datasetID, tableID, TEST_INVALID_SCHEMA_NOT_JSON),
+				ExpectError: regexp.MustCompile("contains an invalid JSON"),
+			},
+			{
+				Config:      testAccBigQueryTableWithSchema(datasetID, tableID, TEST_INVALID_SCHEMA_NOT_JSON_LIST),
+				ExpectError: regexp.MustCompile("\"schema\" is not a JSON array"),
+			},
+			{
+				Config:      testAccBigQueryTableWithSchema(datasetID, tableID, TEST_INVALID_SCHEMA_JSON_LIST_WITH_NULL_ELEMENT),
+				ExpectError: regexp.MustCompile("\"schema\" contains a nil element"),
+			},
+		},
+	})
+}
+
 func testAccCheckBigQueryExtData(t *testing.T, expectedQuoteChar string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		for _, rs := range s.RootModule().Resources {
@@ -1320,8 +1626,9 @@ resource "google_bigquery_table" "test" {
   time_partitioning {
     type                     = "%s"
     field                    = "ts"
-    require_partition_filter = true
+    expiration_ms            = 1000
   }
+  require_partition_filter = true
   clustering = ["some_int", "some_string"]
   schema     = <<EOH
 [
@@ -1696,8 +2003,8 @@ resource "google_bigquery_table" "test" {
   time_partitioning {
     type                     = "DAY"
     field                    = "ts"
-    require_partition_filter = true
   }
+  require_partition_filter = true
   clustering = ["some_int", "some_string"]
   schema     = <<EOH
 [
@@ -1773,8 +2080,8 @@ resource "google_bigquery_table" "test" {
   time_partitioning {
     type                     = "DAY"
     field                    = "ts"
-    require_partition_filter = true
   }
+  require_partition_filter = true
   clustering = ["some_int", "some_string"]
   schema     = <<EOH
 [
@@ -1838,20 +2145,92 @@ resource "google_bigquery_table" "mv_test" {
 `, datasetID, tableID, mViewID, enable_refresh, refresh_interval, query)
 }
 
-func testAccBigQueryTableUpdated(datasetID, tableID string) string {
+func testAccBigQueryTableWithMatViewNonIncremental_basic(datasetID, tableID, mViewID, query, maxStaleness string) string {
 	return fmt.Sprintf(`
 resource "google_bigquery_dataset" "test" {
   dataset_id = "%s"
 }
-
 resource "google_bigquery_table" "test" {
   deletion_protection = false
   table_id   = "%s"
   dataset_id = google_bigquery_dataset.test.dataset_id
-
   time_partitioning {
-    type = "DAY"
-  }
+    type                     = "DAY"
+    field                    = "ts"
+    require_partition_filter = true
+  }
+  clustering = ["some_int", "some_string"]
+  schema     = <<EOH
+[
+  {
+    "name": "ts",
+    "type": "TIMESTAMP"
+  },
+  {
+    "name": "some_string",
+    "type": "STRING"
+  },
+  {
+    "name": "some_int",
+    "type": "INTEGER"
+  },
+  {
+    "name": "city",
+    "type": "RECORD",
+    "fields": [
+  {
+    "name": "id",
+    "type": "INTEGER"
+  },
+  {
+    "name": "coord",
+    "type": "RECORD",
+    "fields": [
+    {
+    "name": "lon",
+    "type": "FLOAT"
+    }
+    ]
+  }
+    ]
+  }
+]
+EOH
+}
+resource "google_bigquery_table" "mv_test" {
+  deletion_protection = false
+  table_id   = "%s"
+  dataset_id = google_bigquery_dataset.test.dataset_id
+  time_partitioning {
+    type    = "DAY"
+    field   = "ts"
+  }
+  materialized_view {
+    query          = "%s"
+    allow_non_incremental_definition = true
+  }
+  depends_on = [
+    google_bigquery_table.test,
+  ]
+  max_staleness = "%s"
+}
+`, datasetID, tableID, mViewID, query, maxStaleness)
+}
+
+func testAccBigQueryTableUpdated(datasetID, tableID string) string {
+	return fmt.Sprintf(`
+resource "google_bigquery_dataset" "test" {
+  dataset_id = "%s"
+}
+
+resource "google_bigquery_table" "test" {
+  deletion_protection = false
+  table_id   = "%s"
+  dataset_id = google_bigquery_dataset.test.dataset_id
+
+  time_partitioning {
+    type = "DAY"
+  }
 
   schema = <<EOH
 [
@@ -2178,6 +2557,60 @@ resource "google_bigquery_table" "test" {
 `, datasetID, bucketName, manifestName, parquetFileName, tableID)
 }
 
+func testAccBigQueryTableExternalDataConfigurationConnectionID(location, connectionID, datasetID, tableID, bucketName, objectName, connectionIdReference string) string {
+	return fmt.Sprintf(`
+resource "google_bigquery_connection" "test" {
+   connection_id = "%s"
+   location = "%s"
+   cloud_resource {}
+}
+
+data "google_project" "project" {}
+
+resource "google_project_iam_member" "test" {
+   role = "roles/storage.objectViewer"
+   project = data.google_project.project.id
+   member = "serviceAccount:${google_bigquery_connection.test.cloud_resource[0].service_account_id}"
+}
+
+resource "google_bigquery_dataset" "test" {
+  dataset_id = "%s"
+  location = "%s"
+}
+
+resource "google_storage_bucket" "test" {
+  name          = "%s"
+  location      = "%s"
+  force_destroy = true
+}
+
+resource "google_storage_bucket_object" "test" {
+  name    = "%s"
+  source = "./test-fixtures/test.parquet.gzip"
+  bucket = google_storage_bucket.test.name
+}
+
+resource "google_bigquery_table" "test" {
+  deletion_protection = false
+  table_id   = "%s"
+  dataset_id = google_bigquery_dataset.test.dataset_id
+  external_data_configuration {
+
+	# Feature Under Test
+	connection_id   = %s
+
+    autodetect      = false
+	object_metadata = "SIMPLE"
+	metadata_cache_mode = "MANUAL"
+
+    source_uris = [
+      "gs://${google_storage_bucket.test.name}/*",
+    ]
+  }
+}
+`, connectionID, location, datasetID, location, bucketName, location, objectName, tableID, connectionIdReference)
+}
+
 func testAccBigQueryTableFromGCSObjectTable(connectionID, datasetID, tableID, bucketName, objectName, maxStaleness string) string {
 	return fmt.Sprintf(`
 resource "google_bigquery_connection" "test" {
@@ -2492,6 +2925,45 @@ resource "google_bigquery_table" "test" {
 `, datasetID, bucketName, objectName, content, tableID, schema)
 }
 
+func testAccBigQueryTableFromGCSWithExternalDataConfigSchema(datasetID, tableID, bucketName, objectName, content, schema string) string {
+	return fmt.Sprintf(`
+resource "google_bigquery_dataset" "test" {
+  dataset_id = "%s"
+}
+resource "google_storage_bucket" "test" {
+  name          = "%s"
+  location      = "US"
+  force_destroy = true
+}
+resource "google_storage_bucket_object" "test" {
+  name    = "%s"
+  content = <<EOF
+%s
+EOF
+  bucket = google_storage_bucket.test.name
+}
+resource "google_bigquery_table" "test" {
+  deletion_protection = false
+  table_id   = "%s"
+  dataset_id = google_bigquery_dataset.test.dataset_id
+  external_data_configuration {
+    autodetect    = false
+    source_format = "CSV"
+    csv_options {
+      encoding = "UTF-8"
+      quote = ""
+    }
+    source_uris = [
+      "gs://${google_storage_bucket.test.name}/${google_storage_bucket_object.test.name}",
+    ]
+    schema = <<EOF
+    %s
+    EOF
+  }
+}
+`, datasetID, bucketName, objectName, content, tableID, schema)
+}
+
 func testAccBigQueryTableFromGCSWithSchema_UpdatAllowQuotedNewlines(datasetID, tableID, bucketName, objectName, content, schema string) string {
 	return fmt.Sprintf(`
 resource "google_bigquery_dataset" "test" {
@@ -2680,7 +3152,7 @@ resource "google_bigquery_table" "test" {
 
   friendly_name = "bigquerytest"
   labels = {
-    "terrafrom_managed" = "true"
+    "terrafrom_managed" = "false"
   }
 
   schema = jsonencode(
@@ -2944,6 +3416,213 @@ resource "google_bigquery_table" "test" {
 `, datasetID, tableID)
 }
 
+func testAccBigQueryTablePrimaryKey(datasetID, tableID string) string {
+	return fmt.Sprintf(`
+  resource "google_bigquery_dataset" "foo" {
+    dataset_id = "%s"
+  }
+
+  resource "google_bigquery_table" "test" {
+    deletion_protection = false
+    table_id   = "%s"
+    dataset_id = google_bigquery_dataset.foo.dataset_id
+
+    table_constraints {
+      primary_key {
+        columns = ["id"]
+      }
+    }
+
+    schema = <<EOH
+    [
+      {
+        "name": "ts",
+        "type": "TIMESTAMP"
+      },
+      {
+        "name": "id",
+        "type": "INTEGER"
+      }
+    ]
+    EOH
+  }
+  `, datasetID, tableID)
+}
+
+func testAccBigQueryTableForeignKeys(projectID, datasetID, tableID_pk, tableID_fk string) string {
+	return fmt.Sprintf(`
+  resource "google_bigquery_dataset" "foo" {
+    dataset_id = "%s"
+  }
+
+  resource "google_bigquery_table" "table_pk" {
+    deletion_protection = false
+    table_id   	= "%s"
+    dataset_id 	= google_bigquery_dataset.foo.dataset_id
+
+    table_constraints {
+      primary_key {
+        columns = ["id"]
+      }
+    }
+
+    schema = <<EOH
+    [
+      {
+        "name": "ts",
+        "type": "TIMESTAMP"
+      },
+      {
+        "name": "id",
+        "type": "INTEGER"
+      },
+      {
+        "name": "str",
+        "type": "STRING"
+      }
+    ]
+    EOH
+  }
+
+  resource "google_bigquery_table" "test" {
+    deletion_protection = false
+    table_id   	= "%s"
+    dataset_id 	= google_bigquery_dataset.foo.dataset_id
+
+    table_constraints {
+      foreign_keys {
+        name = "test_fk"
+        referenced_table {
+          project_id  	= "%s"
+          dataset_id 	= google_bigquery_dataset.foo.dataset_id
+          table_id   	= google_bigquery_table.table_pk.table_id
+        }
+        column_references {
+          referencing_column 	= "id2"
+          referenced_column 	= "id"
+        }
+      }
+    }
+
+    schema = <<EOH
+    [
+      {
+        "name": "ts2",
+        "type": "TIMESTAMP"
+      },
+      {
+        "name": "id2",
+        "type": "INTEGER"
+      }
+    ]
+    EOH
+  }
+  `, datasetID, tableID_pk, tableID_fk, projectID)
+}
+
+func testAccBigQueryTableTableConstraintsUpdate(projectID, datasetID, tableID_pk, tableID_fk string) string {
+	return fmt.Sprintf(`
+  resource "google_bigquery_dataset" "foo" {
+    dataset_id 	= "%s"
+  }
+
+  resource "google_bigquery_table" "table_pk" {
+	deletion_protection = false
+    table_id   	= "%s"
+    dataset_id 	= google_bigquery_dataset.foo.dataset_id
+
+    table_constraints {
+      primary_key {
+        columns = ["str"]
+      }
+      foreign_keys {
+        name = "test_fk"
+        referenced_table {
+          project_id  	= "%s"
+          dataset_id 	= google_bigquery_dataset.foo.dataset_id
+          table_id   	= google_bigquery_table.test.table_id
+        }
+        column_references {
+        referencing_column = "id"
+        referenced_column = "id2"
+        }
+      }
+      foreign_keys {
+        name = "test_fk2"
+        referenced_table {
+          project_id  	= "%s"
+          dataset_id 	= google_bigquery_dataset.foo.dataset_id
+          table_id   	= google_bigquery_table.test.table_id
+        }
+        column_references {
+          referencing_column 	= "ts"
+          referenced_column 	= "ts2"
+        }
+      }
+    }
+
+    schema = <<EOH
+    [
+      {
+        "name": "ts",
+        "type": "TIMESTAMP"
+      },
+      {
+        "name": "id",
+        "type": "INTEGER"
+      },
+      {
+        "name": "str",
+        "type": "INTEGER"
+      }
+    ]
+    EOH
+  }
+
+  resource "google_bigquery_table" "test" {
+    deletion_protection = false
+    table_id   	= "%s"
+    dataset_id 	= google_bigquery_dataset.foo.dataset_id
+
+    table_constraints {
+      primary_key {
+        columns = ["id2", "ts2"]
+      }
+    }
+
+    schema = <<EOH
+    [
+      {
+        "name": "ts2",
+        "type": "TIMESTAMP"
+      },
+      {
+        "name": "id2",
+        "type": "INTEGER"
+      }
+    ]
+    EOH
+  }
+  `, datasetID, tableID_pk, projectID, projectID, tableID_fk)
+}
+
+func testAccBigQueryTableWithSchema(datasetID, tableID, schema string) string {
+	return fmt.Sprintf(`
+resource "google_bigquery_dataset" "test" {
+  dataset_id = "%s"
+}
+
+resource "google_bigquery_table" "test" {
+  deletion_protection = false
+  table_id   = "%s"
+  dataset_id = google_bigquery_dataset.test.dataset_id
+	schema = <<EOF
+  %s
+  EOF
+}
+`, datasetID, tableID, schema)
+}
+
 var TEST_CSV = `lifelock,LifeLock,,web,Tempe,AZ,1-May-07,6850000,USD,b
 lifelock,LifeLock,,web,Tempe,AZ,1-Oct-06,6000000,USD,a
 lifelock,LifeLock,,web,Tempe,AZ,1-Jan-08,25000000,USD,c
@@ -2972,3 +3651,22 @@ var TEST_SIMPLE_CSV_SCHEMA = `[
       "type": "INT64"
     }
   ]`
+var TEST_INVALID_SCHEMA_NOT_JSON = `
+	not a valid table schema
+	`
+var TEST_INVALID_SCHEMA_NOT_JSON_LIST = `
+    {
+      "name": "country",
+      "type": "STRING"
+    }`
+var TEST_INVALID_SCHEMA_JSON_LIST_WITH_NULL_ELEMENT = `[
+    {
+      "name": "country",
+      "type": "STRING"
+    },
+    null,
+    {
+      "name": "price",
+      "type": "INT64"
+    }
+  ]`
diff --git a/mmv1/third_party/terraform/services/bigqueryconnection/resource_bigquery_connection_test.go b/mmv1/third_party/terraform/services/bigqueryconnection/resource_bigquery_connection_test.go
index f37b71f4b467..16080ebd7cd5 100644
--- a/mmv1/third_party/terraform/services/bigqueryconnection/resource_bigquery_connection_test.go
+++ b/mmv1/third_party/terraform/services/bigqueryconnection/resource_bigquery_connection_test.go
@@ -181,15 +181,15 @@ func TestAccBigqueryConnectionConnection_bigqueryConnectionAwsUpdate(t *testing.
 func testAccBigqueryConnectionConnection_bigqueryConnectionAws(context map[string]interface{}) string {
 	return acctest.Nprintf(`
 resource "google_bigquery_connection" "connection" {
-   connection_id = "tf-test-my-connection%{random_suffix}"
-   location      = "aws-us-east-1"
-   friendly_name = "👋"
-   description   = "a riveting description"
-   aws {
+  connection_id = "tf-test-my-connection%{random_suffix}"
+  location      = "aws-us-east-1"
+  friendly_name = "👋"
+  description   = "a riveting description"
+  aws {
       access_role {
-         iam_role_id =  "arn:aws:iam::999999999999:role/omnirole%{random_suffix}"
+        iam_role_id =  "arn:aws:iam::999999999999:role/omnirole%{random_suffix}"
       }
-   }
+  }
 }
 `, context)
 }
@@ -197,15 +197,141 @@ resource "google_bigquery_connection" "connection" {
 func testAccBigqueryConnectionConnection_bigqueryConnectionAwsUpdate(context map[string]interface{}) string {
 	return acctest.Nprintf(`
 resource "google_bigquery_connection" "connection" {
-   connection_id = "tf-test-my-connection%{random_suffix}"
-   location      = "aws-us-east-1"
-   friendly_name = "👋"
-   description   = "a riveting description"
-   aws {
+  connection_id = "tf-test-my-connection%{random_suffix}"
+  location      = "aws-us-east-1"
+  friendly_name = "👋"
+  description   = "a riveting description"
+  aws {
       access_role {
-         iam_role_id =  "arn:aws:iam::999999999999:role/omnirole%{random_suffix}update"
+        iam_role_id =  "arn:aws:iam::999999999999:role/omnirole%{random_suffix}update"
       }
-   }
+  }
+}
+`, context)
+}
+
+func TestAccBigqueryConnectionConnection_bigqueryConnectionCloudSpannerDataBoostWithParallelism(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckBigqueryConnectionConnectionDestroyProducer(t),
+		ExternalProviders: map[string]resource.ExternalProvider{
+			"random": {},
+		},
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBigqueryConnectionConnection_bigqueryConnectionCloudSpannerDataBoostWithParallelism(context),
+			},
+			{
+				ResourceName:            "google_bigquery_connection.connection",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"location"},
+			},
+			{
+				Config: testAccBigqueryConnectionConnection_bigqueryConnectionCloudSpannerDataBoostWithParallelismUpdate(context),
+			},
+			{
+				ResourceName:            "google_bigquery_connection.connection",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"location"},
+			},
+		},
+	})
+}
+
+func testAccBigqueryConnectionConnection_bigqueryConnectionCloudSpannerDataBoostWithParallelism(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_bigquery_connection" "connection" {
+  connection_id = "tf-test-my-connection%{random_suffix}"
+    location      = "US"
+    friendly_name = "👋"
+    description   = "a riveting description"
+    cloud_spanner { 
+      database        = "projects/project/instances/instance/databases/database"
+      use_parallelism = true
+      use_data_boost  = true
+      max_parallelism = 10
+      database_role   = "database_role"
+    }
+}
+`, context)
+}
+
+func testAccBigqueryConnectionConnection_bigqueryConnectionCloudSpannerDataBoostWithParallelismUpdate(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_bigquery_connection" "connection" {
+  connection_id = "tf-test-my-connection%{random_suffix}"
+    location      = "US"
+    friendly_name = "👋"
+    description   = "a riveting description"
+    cloud_spanner { 
+      database        = "projects/project/instances/instance/databases/databaseUpdate"
+      use_parallelism = true
+      use_data_boost  = true
+      max_parallelism = 20
+      database_role   = "database_role_update"
+    }
+}
+`, context)
+}
+
+func TestAccBigqueryConnectionConnection_bigqueryConnectionCloudSpannerServerlessAnalyticsToDataBoostUpdate(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckBigqueryConnectionConnectionDestroyProducer(t),
+		ExternalProviders: map[string]resource.ExternalProvider{
+			"random": {},
+		},
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBigqueryConnectionConnection_bigqueryConnectionCloudSpannerServerlessAnalytics(context),
+			},
+			{
+				ResourceName:            "google_bigquery_connection.connection",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"location"},
+			},
+			{
+				Config: testAccBigqueryConnectionConnection_bigqueryConnectionCloudSpannerDataBoostWithParallelismUpdate(context),
+			},
+			{
+				ResourceName:            "google_bigquery_connection.connection",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"location"},
+			},
+		},
+	})
+}
+
+func testAccBigqueryConnectionConnection_bigqueryConnectionCloudSpannerServerlessAnalytics(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_bigquery_connection" "connection" {
+  connection_id = "tf-test-my-connection%{random_suffix}"
+    location      = "US"
+    friendly_name = "👋"
+    description   = "a riveting description"
+    cloud_spanner { 
+      database                 = "projects/project/instances/instance/databases/database"
+      use_parallelism          = true
+      use_serverless_analytics = true
+    }
 }
 `, context)
 }
diff --git a/mmv1/third_party/terraform/services/bigtable/resource_bigtable_app_profile_test.go b/mmv1/third_party/terraform/services/bigtable/resource_bigtable_app_profile_test.go
index 5c018eb62f2b..295faf718263 100644
--- a/mmv1/third_party/terraform/services/bigtable/resource_bigtable_app_profile_test.go
+++ b/mmv1/third_party/terraform/services/bigtable/resource_bigtable_app_profile_test.go
@@ -38,6 +38,15 @@ func TestAccBigtableAppProfile_update(t *testing.T) {
 				ImportStateVerify:       true,
 				ImportStateVerifyIgnore: []string{"ignore_warnings"},
 			},
+			{
+				Config: testAccBigtableAppProfile_updatePriority(instanceName),
+			},
+			{
+				ResourceName:            "google_bigtable_app_profile.ap",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"ignore_warnings"},
+			},
 		},
 	})
 }
@@ -229,6 +238,53 @@ resource "google_bigtable_app_profile" "ap" {
 `, instanceName, instanceName, instanceName, instanceName, instanceName)
 }
 
+func testAccBigtableAppProfile_updatePriority(instanceName string) string {
+	return fmt.Sprintf(`
+resource "google_bigtable_instance" "instance" {
+  name = "%s"
+  cluster {
+    cluster_id   = "%s"
+    zone         = "us-central1-b"
+    num_nodes    = 1
+    storage_type = "HDD"
+  }
+
+  cluster {
+    cluster_id   = "%s2"
+    zone         = "us-central1-a"
+    num_nodes    = 1
+    storage_type = "HDD"
+  }
+
+  cluster {
+    cluster_id   = "%s3"
+    zone         = "us-central1-c"
+    num_nodes    = 1
+    storage_type = "HDD"
+  }
+
+  deletion_protection = false
+}
+
+resource "google_bigtable_app_profile" "ap" {
+  instance       = google_bigtable_instance.instance.id
+  app_profile_id = "test"
+  description    = "add a description"
+
+  single_cluster_routing {
+    cluster_id                 = %q
+    allow_transactional_writes = false
+  }
+
+  standard_isolation {
+    priority = "PRIORITY_MEDIUM"
+  }
+
+  ignore_warnings               = true
+}
+`, instanceName, instanceName, instanceName, instanceName, instanceName)
+}
+
 func testAccBigtableAppProfile_warningsProduced(instanceName string) string {
 	return fmt.Sprintf(`
 resource "google_bigtable_instance" "instance" {
diff --git a/mmv1/third_party/terraform/services/bigtable/resource_bigtable_gc_policy_test.go b/mmv1/third_party/terraform/services/bigtable/resource_bigtable_gc_policy_test.go
index 7974b0c82a8a..28a834acd86a 100644
--- a/mmv1/third_party/terraform/services/bigtable/resource_bigtable_gc_policy_test.go
+++ b/mmv1/third_party/terraform/services/bigtable/resource_bigtable_gc_policy_test.go
@@ -166,6 +166,7 @@ func TestAccBigtableGCPolicy_multiplePolicies(t *testing.T) {
 }
 
 func TestAccBigtableGCPolicy_gcRulesPolicy(t *testing.T) {
+	// bigtable instance does not use the shared HTTP client, this test creates an instance
 	acctest.SkipIfVcr(t)
 	t.Parallel()
 
diff --git a/mmv1/third_party/terraform/services/bigtable/resource_bigtable_instance.go b/mmv1/third_party/terraform/services/bigtable/resource_bigtable_instance.go
index ecb97c65aa52..e5a7cef9b16b 100644
--- a/mmv1/third_party/terraform/services/bigtable/resource_bigtable_instance.go
+++ b/mmv1/third_party/terraform/services/bigtable/resource_bigtable_instance.go
@@ -31,11 +31,14 @@ func ResourceBigtableInstance() *schema.Resource {
 		Timeouts: &schema.ResourceTimeout{
 			Create: schema.DefaultTimeout(60 * time.Minute),
 			Update: schema.DefaultTimeout(60 * time.Minute),
+			Read:   schema.DefaultTimeout(60 * time.Minute),
 		},
 
 		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
 			resourceBigtableInstanceClusterReorderTypeList,
 			resourceBigtableInstanceUniqueClusterID,
+			tpgresource.SetLabelsDiff,
 		),
 
 		SchemaVersion: 1,
@@ -126,6 +129,11 @@ func ResourceBigtableInstance() *schema.Resource {
 								},
 							},
 						},
+						"state": {
+							Type:        schema.TypeString,
+							Computed:    true,
+							Description: `The state of the cluster`,
+						},
 					},
 				},
 			},
@@ -153,10 +161,27 @@ func ResourceBigtableInstance() *schema.Resource {
 			},
 
 			"labels": {
+				Type:     schema.TypeMap,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Description: `A mapping of labels to assign to the resource.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+			},
+
+			"terraform_labels": {
 				Type:        schema.TypeMap,
-				Optional:    true,
+				Computed:    true,
+				Description: `The combination of labels configured directly on the resource and default labels configured on the provider.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+			},
+
+			"effective_labels": {
+				Type:        schema.TypeMap,
+				Computed:    true,
+				Description: `All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.`,
 				Elem:        &schema.Schema{Type: schema.TypeString},
-				Description: `A mapping of labels to assign to the resource.`,
 			},
 
 			"project": {
@@ -195,8 +220,8 @@ func resourceBigtableInstanceCreate(d *schema.ResourceData, meta interface{}) er
 	}
 	conf.DisplayName = displayName.(string)
 
-	if _, ok := d.GetOk("labels"); ok {
-		conf.Labels = tpgresource.ExpandLabels(d)
+	if _, ok := d.GetOk("effective_labels"); ok {
+		conf.Labels = tpgresource.ExpandEffectiveLabels(d)
 	}
 
 	switch d.Get("instance_type").(string) {
@@ -255,13 +280,11 @@ func resourceBigtableInstanceRead(d *schema.ResourceData, meta interface{}) erro
 
 	instanceName := d.Get("name").(string)
 
-	instance, err := c.InstanceInfo(ctx, instanceName)
-	if err != nil {
-		if tpgresource.IsNotFoundGrpcError(err) {
-			log.Printf("[WARN] Removing %s because it's gone", instanceName)
-			d.SetId("")
-			return nil
-		}
+	ctxWithTimeout, cancel := context.WithTimeout(ctx, d.Timeout(schema.TimeoutRead))
+	defer cancel()
+	instancesResponse, err := c.Instances(ctxWithTimeout)
+	instance, stop, err := getInstanceFromResponse(instancesResponse, instanceName, err, d)
+	if stop {
 		return err
 	}
 
@@ -269,11 +292,16 @@ func resourceBigtableInstanceRead(d *schema.ResourceData, meta interface{}) erro
 		return fmt.Errorf("Error setting project: %s", err)
 	}
 
-	clusters, err := c.Clusters(ctx, instance.Name)
+	clusters, err := c.Clusters(ctxWithTimeout, instanceName)
 	if err != nil {
 		partiallyUnavailableErr, ok := err.(bigtable.ErrPartiallyUnavailable)
-
 		if !ok {
+			// Clusters() fails with 404 if instance does not exist.
+			if tpgresource.IsNotFoundGrpcError(err) {
+				log.Printf("[WARN] Removing %s because it's gone", instanceName)
+				d.SetId("")
+				return nil
+			}
 			return fmt.Errorf("Error retrieving instance clusters. %s", err)
 		}
 
@@ -301,9 +329,15 @@ func resourceBigtableInstanceRead(d *schema.ResourceData, meta interface{}) erro
 	if err := d.Set("display_name", instance.DisplayName); err != nil {
 		return fmt.Errorf("Error setting display_name: %s", err)
 	}
-	if err := d.Set("labels", instance.Labels); err != nil {
+	if err := tpgresource.SetLabels(instance.Labels, d, "labels"); err != nil {
 		return fmt.Errorf("Error setting labels: %s", err)
 	}
+	if err := tpgresource.SetLabels(instance.Labels, d, "terraform_labels"); err != nil {
+		return fmt.Errorf("Error setting terraform_labels: %s", err)
+	}
+	if err := d.Set("effective_labels", instance.Labels); err != nil {
+		return fmt.Errorf("Error setting effective_labels: %s", err)
+	}
 	// Don't set instance_type: we don't want to detect drift on it because it can
 	// change under-the-hood.
 
@@ -339,8 +373,8 @@ func resourceBigtableInstanceUpdate(d *schema.ResourceData, meta interface{}) er
 	}
 	conf.DisplayName = displayName.(string)
 
-	if d.HasChange("labels") {
-		conf.Labels = tpgresource.ExpandLabels(d)
+	if d.HasChange("effective_labels") {
+		conf.Labels = tpgresource.ExpandEffectiveLabels(d)
 	}
 
 	switch d.Get("instance_type").(string) {
@@ -414,6 +448,7 @@ func flattenBigtableCluster(c *bigtable.ClusterInfo) map[string]interface{} {
 		"cluster_id":   c.Name,
 		"storage_type": storageType,
 		"kms_key_name": c.KMSKeyName,
+		"state":        c.State,
 	}
 	if c.AutoscalingConfig != nil {
 		cluster["autoscaling_config"] = make([]map[string]interface{}, 1)
@@ -427,6 +462,42 @@ func flattenBigtableCluster(c *bigtable.ClusterInfo) map[string]interface{} {
 	return cluster
 }
 
+func getInstanceFromResponse(instances []*bigtable.InstanceInfo, instanceName string, err error, d *schema.ResourceData) (*bigtable.InstanceInfo, bool, error) {
+	// Fail on any error other than ParrtiallyUnavailable.
+	isPartiallyUnavailableError := false
+	if err != nil {
+		_, isPartiallyUnavailableError = err.(bigtable.ErrPartiallyUnavailable)
+
+		if !isPartiallyUnavailableError {
+			return nil, true, fmt.Errorf("Error retrieving instance. %s", err)
+		}
+	}
+
+	// Get instance from response.
+	var instanceInfo *bigtable.InstanceInfo
+	for _, instance := range instances {
+		if instance.Name == instanceName {
+			instanceInfo = instance
+		}
+	}
+
+	// If instance found, it either wasn't affected by the outage, or there is no outage.
+	if instanceInfo != nil {
+		return instanceInfo, false, nil
+	}
+
+	// If instance wasn't found and error is PartiallyUnavailable,
+	// continue to clusters call that will reveal overlap between instance regions and unavailable regions.
+	if isPartiallyUnavailableError {
+		return nil, false, nil
+	}
+
+	// If instance wasn't found and error is not PartiallyUnavailable, instance doesn't exist.
+	log.Printf("[WARN] Removing %s because it's gone", instanceName)
+	d.SetId("")
+	return nil, true, nil
+}
+
 func getUnavailableClusterZones(clusters []interface{}, unavailableZones []string) []string {
 	var zones []string
 
@@ -503,6 +574,10 @@ func resourceBigtableInstanceUniqueClusterID(_ context.Context, diff *schema.Res
 	for i := 0; i < newCount.(int); i++ {
 		_, newId := diff.GetChange(fmt.Sprintf("cluster.%d.cluster_id", i))
 		clusterID := newId.(string)
+		// In case clusterID is empty, it is probably computed and this validation will be wrong.
+		if clusterID == "" {
+			continue
+		}
 		if clusters[clusterID] {
 			return fmt.Errorf("duplicated cluster_id: %q", clusterID)
 		}
@@ -519,7 +594,14 @@ func resourceBigtableInstanceUniqueClusterID(_ context.Context, diff *schema.Res
 // This doesn't use the standard unordered list utility (https://github.com/GoogleCloudPlatform/magic-modules/blob/main/templates/terraform/unordered_list_customize_diff.erb)
 // because some fields can't be modified using the API and we recreate the instance
 // when they're changed.
-func resourceBigtableInstanceClusterReorderTypeList(_ context.Context, diff *schema.ResourceDiff, meta interface{}) error {
+func resourceBigtableInstanceClusterReorderTypeList(_ context.Context, diff *schema.ResourceDiff, _ interface{}) error {
+	// separate func to allow unit testing
+	return resourceBigtableInstanceClusterReorderTypeListFunc(diff, func(orderedClusters []interface{}) error {
+		return diff.SetNew("cluster", orderedClusters)
+	})
+
+}
+func resourceBigtableInstanceClusterReorderTypeListFunc(diff tpgresource.TerraformResourceDiff, setNew func([]interface{}) error) error {
 	oldCount, newCount := diff.GetChange("cluster.#")
 
 	// Simulate Required:true, MinItems:1 for "cluster". This doesn't work
@@ -548,7 +630,9 @@ func resourceBigtableInstanceClusterReorderTypeList(_ context.Context, diff *sch
 	for i := 0; i < newCount.(int); i++ {
 		_, newId := diff.GetChange(fmt.Sprintf("cluster.%d.cluster_id", i))
 		_, c := diff.GetChange(fmt.Sprintf("cluster.%d", i))
-		clusters[newId.(string)] = c
+		typedCluster := c.(map[string]interface{})
+		typedCluster["state"] = "READY"
+		clusters[newId.(string)] = typedCluster
 	}
 
 	// create a list of clusters using the old order when possible to minimise
@@ -584,9 +668,8 @@ func resourceBigtableInstanceClusterReorderTypeList(_ context.Context, diff *sch
 		}
 	}
 
-	err := diff.SetNew("cluster", orderedClusters)
-	if err != nil {
-		return fmt.Errorf("Error setting cluster diff: %s", err)
+	if err := setNew(orderedClusters); err != nil {
+		return err
 	}
 
 	// Clusters can't have their zone, storage_type or kms_key_name updated,
@@ -612,8 +695,9 @@ func resourceBigtableInstanceClusterReorderTypeList(_ context.Context, diff *sch
 			}
 		}
 
+		currentState, _ := diff.GetChange(fmt.Sprintf("cluster.%d.state", i))
 		oST, nST := diff.GetChange(fmt.Sprintf("cluster.%d.storage_type", i))
-		if oST != nST {
+		if oST != nST && currentState.(string) != "CREATING" {
 			err := diff.ForceNew(fmt.Sprintf("cluster.%d.storage_type", i))
 			if err != nil {
 				return fmt.Errorf("Error setting cluster diff: %s", err)
diff --git a/mmv1/third_party/terraform/services/bigtable/resource_bigtable_instance_internal_test.go b/mmv1/third_party/terraform/services/bigtable/resource_bigtable_instance_internal_test.go
new file mode 100644
index 000000000000..acc71d2397bb
--- /dev/null
+++ b/mmv1/third_party/terraform/services/bigtable/resource_bigtable_instance_internal_test.go
@@ -0,0 +1,371 @@
+package bigtable
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+	"testing"
+
+	"cloud.google.com/go/bigtable"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+)
+
+func TestUnitBigtable_getUnavailableClusterZones(t *testing.T) {
+	cases := map[string]struct {
+		clusterZones     []string
+		unavailableZones []string
+		want             []string
+	}{
+		"not unavailalbe": {
+			clusterZones:     []string{"us-central1", "eu-west1"},
+			unavailableZones: []string{"us-central2", "eu-west2"},
+			want:             nil,
+		},
+		"unavailable one to one": {
+			clusterZones:     []string{"us-central2"},
+			unavailableZones: []string{"us-central2"},
+			want:             []string{"us-central2"},
+		},
+		"unavailable one to many": {
+			clusterZones:     []string{"us-central2"},
+			unavailableZones: []string{"us-central2", "us-central1"},
+			want:             []string{"us-central2"},
+		},
+		"unavailable many to one": {
+			clusterZones:     []string{"us-central2", "us-central1"},
+			unavailableZones: []string{"us-central2"},
+			want:             []string{"us-central2"},
+		},
+		"unavailable many to many": {
+			clusterZones:     []string{"us-central2", "us-central1"},
+			unavailableZones: []string{"us-central2", "us-central1"},
+			want:             []string{"us-central2", "us-central1"},
+		},
+	}
+
+	for tn, tc := range cases {
+		var clusters []interface{}
+		for _, zone := range tc.clusterZones {
+			clusters = append(clusters, map[string]interface{}{"zone": zone})
+		}
+		if got := getUnavailableClusterZones(clusters, tc.unavailableZones); !reflect.DeepEqual(got, tc.want) {
+			t.Errorf("bad: %s, got %q, want %q", tn, got, tc.want)
+		}
+	}
+}
+
+func TestUnitBigtable_getInstanceFromResponse(t *testing.T) {
+	instanceName := "test-instance"
+	originalId := "original_value"
+	cases := map[string]struct {
+		instanceNames      []string
+		listInstancesError error
+
+		wantError        string
+		wantInstanceName string
+		wantStop         bool
+		wantId           string
+	}{
+		"not found": {
+			instanceNames:      []string{"wrong", "also_wrong"},
+			listInstancesError: nil,
+
+			wantError:        "",
+			wantStop:         true,
+			wantInstanceName: "",
+			wantId:           "",
+		},
+		"found": {
+			instanceNames:      []string{"wrong", "also_wrong", instanceName},
+			listInstancesError: nil,
+
+			wantError:        "",
+			wantStop:         false,
+			wantInstanceName: instanceName,
+			wantId:           originalId,
+		},
+		"error": {
+			instanceNames:      nil,
+			listInstancesError: fmt.Errorf("some error"),
+
+			wantError:        "Error retrieving instance.",
+			wantStop:         true,
+			wantInstanceName: "",
+			wantId:           originalId,
+		},
+		"unavailble error": {
+			instanceNames:      []string{"wrong", "also_wrong"},
+			listInstancesError: bigtable.ErrPartiallyUnavailable{[]string{"some", "location"}},
+
+			wantError:        "",
+			wantStop:         false,
+			wantInstanceName: "",
+			wantId:           originalId,
+		}}
+	for tn, tc := range cases {
+		instancesResponse := []*bigtable.InstanceInfo{}
+		for _, existingInstance := range tc.instanceNames {
+			instancesResponse = append(instancesResponse, &bigtable.InstanceInfo{Name: existingInstance})
+		}
+		d := &schema.ResourceData{}
+		d.SetId(originalId)
+		gotInstance, gotStop, gotErr := getInstanceFromResponse(instancesResponse, instanceName, tc.listInstancesError, d)
+
+		if gotStop != tc.wantStop {
+			t.Errorf("bad stop: %s, got %v, want %v", tn, gotStop, tc.wantStop)
+		}
+		if (gotErr != nil && tc.wantError == "") ||
+			(gotErr == nil && tc.wantError != "") ||
+			(gotErr != nil && !strings.Contains(gotErr.Error(), tc.wantError)) {
+			t.Errorf("bad error: %s, got %q, want %q", tn, gotErr, tc.wantError)
+		}
+		if (gotInstance == nil && tc.wantInstanceName != "") ||
+			(gotInstance != nil && tc.wantInstanceName == "") ||
+			(gotInstance != nil && gotInstance.Name != tc.wantInstanceName) {
+			t.Errorf("bad instance: %s, got %v, want %q", tn, gotInstance, tc.wantInstanceName)
+		}
+		gotId := d.Id()
+		if gotId != tc.wantId {
+			t.Errorf("bad ID: %s, got %v, want %q", tn, gotId, tc.wantId)
+		}
+	}
+}
+
+func TestUnitBigtable_flattenBigtableCluster(t *testing.T) {
+	cases := map[string]struct {
+		clusterInfo *bigtable.ClusterInfo
+		want        map[string]interface{}
+	}{
+		"SSD auto scaling": {
+			clusterInfo: &bigtable.ClusterInfo{
+				StorageType: bigtable.SSD,
+				Zone:        "zone1",
+				ServeNodes:  5,
+				Name:        "ssd-cluster",
+				KMSKeyName:  "KMS",
+				State:       "CREATING",
+				AutoscalingConfig: &bigtable.AutoscalingConfig{
+					MinNodes:                  3,
+					MaxNodes:                  7,
+					CPUTargetPercent:          50,
+					StorageUtilizationPerNode: 60,
+				},
+			},
+			want: map[string]interface{}{
+				"zone":         "zone1",
+				"num_nodes":    5,
+				"cluster_id":   "ssd-cluster",
+				"storage_type": "SSD",
+				"kms_key_name": "KMS",
+				"state":        "CREATING",
+				"autoscaling_config": []map[string]interface{}{
+					map[string]interface{}{
+						"min_nodes":      3,
+						"max_nodes":      7,
+						"cpu_target":     50,
+						"storage_target": 60,
+					},
+				},
+			},
+		},
+		"HDD manual scaling": {
+			clusterInfo: &bigtable.ClusterInfo{
+				StorageType: bigtable.HDD,
+				Zone:        "zone2",
+				ServeNodes:  7,
+				Name:        "hdd-cluster",
+				KMSKeyName:  "KMS",
+				State:       "READY",
+			},
+			want: map[string]interface{}{
+				"zone":         "zone2",
+				"num_nodes":    7,
+				"cluster_id":   "hdd-cluster",
+				"storage_type": "HDD",
+				"kms_key_name": "KMS",
+				"state":        "READY",
+			},
+		},
+	}
+
+	for tn, tc := range cases {
+		if got := flattenBigtableCluster(tc.clusterInfo); !reflect.DeepEqual(got, tc.want) {
+			t.Errorf("bad: %s, got %q, want %q", tn, got, tc.want)
+		}
+	}
+}
+
+func TestUnitBigtable_resourceBigtableInstanceClusterReorderTypeListFunc_error(t *testing.T) {
+	d := &tpgresource.ResourceDiffMock{
+		After: map[string]interface{}{
+			"cluster.#": 0,
+		},
+	}
+	if err := resourceBigtableInstanceClusterReorderTypeListFunc(d, nil); err == nil {
+		t.Errorf("expected error, got success")
+	}
+}
+
+func TestUnitBigtable_resourceBigtableInstanceClusterReorderTypeListFunc(t *testing.T) {
+	cases := map[string]struct {
+		before           map[string]interface{}
+		after            map[string]interface{}
+		wantClusterOrder []string
+		wantForceNew     bool
+	}{
+		"create": {
+			before: map[string]interface{}{
+				"cluster.#":            1,
+				"cluster.0.cluster_id": "some-id-a",
+			},
+			after: map[string]interface{}{
+				"name":                 "some-name",
+				"cluster.#":            1,
+				"cluster.0.cluster_id": "some-id-a",
+				"cluster.0": map[string]interface{}{
+					"cluster_id": "some-id-a",
+				},
+			},
+			wantClusterOrder: []string{},
+			wantForceNew:     false,
+		},
+		"no force new change": {
+			before: map[string]interface{}{
+				"name":                 "some-name",
+				"cluster.#":            4,
+				"cluster.0.cluster_id": "some-id-a",
+				"cluster.1.cluster_id": "some-id-b",
+				"cluster.2.cluster_id": "some-id-c",
+				"cluster.3.cluster_id": "some-id-e",
+			},
+			after: map[string]interface{}{
+				"name":                 "some-name",
+				"cluster.#":            3,
+				"cluster.0.cluster_id": "some-id-c",
+				"cluster.1.cluster_id": "some-id-a",
+				"cluster.2.cluster_id": "some-id-d",
+				"cluster.0": map[string]interface{}{
+					"cluster_id": "some-id-c",
+				},
+				"cluster.1": map[string]interface{}{
+					"cluster_id": "some-id-a",
+				},
+				"cluster.2": map[string]interface{}{
+					"cluster_id": "some-id-d",
+				},
+			},
+			wantClusterOrder: []string{"some-id-a", "some-id-d", "some-id-c"},
+			wantForceNew:     false,
+		},
+		"force new - zone change": {
+			before: map[string]interface{}{
+				"name":                 "some-name",
+				"cluster.#":            1,
+				"cluster.0.cluster_id": "some-id-a",
+				"cluster.0.zone":       "zone-a",
+			},
+			after: map[string]interface{}{
+				"name":                 "some-name",
+				"cluster.#":            1,
+				"cluster.0.cluster_id": "some-id-a",
+				"cluster.0.zone":       "zone-b",
+				"cluster.0": map[string]interface{}{
+					"cluster_id": "some-id-a",
+					"zone":       "zone-b",
+				},
+			},
+			wantClusterOrder: []string{"some-id-a"},
+			wantForceNew:     true,
+		},
+		"force new - kms_key_name change": {
+			before: map[string]interface{}{
+				"name":                   "some-name",
+				"cluster.#":              1,
+				"cluster.0.cluster_id":   "some-id-a",
+				"cluster.0.kms_key_name": "key-a",
+			},
+			after: map[string]interface{}{
+				"name":                   "some-name",
+				"cluster.#":              1,
+				"cluster.0.cluster_id":   "some-id-a",
+				"cluster.0.kms_key_name": "key-b",
+				"cluster.0": map[string]interface{}{
+					"cluster_id":   "some-id-a",
+					"kms_key_name": "key-b",
+				},
+			},
+			wantClusterOrder: []string{"some-id-a"},
+			wantForceNew:     true,
+		},
+		"force new - storage_type change": {
+			before: map[string]interface{}{
+				"name":                   "some-name",
+				"cluster.#":              1,
+				"cluster.0.cluster_id":   "some-id-a",
+				"cluster.0.storage_type": "HDD",
+				"cluster.0.state":        "READY",
+			},
+			after: map[string]interface{}{
+				"name":                   "some-name",
+				"cluster.#":              1,
+				"cluster.0.cluster_id":   "some-id-a",
+				"cluster.0.storage_type": "SSD",
+				"cluster.0": map[string]interface{}{
+					"cluster_id":   "some-id-a",
+					"storage_type": "SSD",
+				},
+			},
+			wantClusterOrder: []string{"some-id-a"},
+			wantForceNew:     true,
+		},
+		"skip force new - storage_type change for CREATING cluster": {
+			before: map[string]interface{}{
+				"name":                   "some-name",
+				"cluster.#":              1,
+				"cluster.0.cluster_id":   "some-id-a",
+				"cluster.0.storage_type": "SSD",
+				"cluster.0.state":        "CREATING",
+			},
+			after: map[string]interface{}{
+				"name":                   "some-name",
+				"cluster.#":              1,
+				"cluster.0.cluster_id":   "some-id-a",
+				"cluster.0.storage_type": "HDD",
+				"cluster.0": map[string]interface{}{
+					"cluster_id":   "some-id-a",
+					"storage_type": "HDD",
+				},
+			},
+			wantClusterOrder: []string{"some-id-a"},
+			wantForceNew:     false,
+		},
+	}
+	for tn, tc := range cases {
+		t.Run(tn, func(t *testing.T) {
+			d := &tpgresource.ResourceDiffMock{
+				Before: tc.before,
+				After:  tc.after,
+			}
+			var clusters []interface{}
+			err := resourceBigtableInstanceClusterReorderTypeListFunc(d, func(gotClusters []interface{}) error {
+				clusters = gotClusters
+				return nil
+			})
+			if err != nil {
+				t.Fatalf("bad: %s, error: %v", tn, err)
+			}
+			if d.IsForceNew != tc.wantForceNew {
+				t.Errorf("bad: %s, got %v, want %v", tn, d.IsForceNew, tc.wantForceNew)
+			}
+			gotClusterOrder := []string{}
+			for _, cluster := range clusters {
+				clusterResource := cluster.(map[string]interface{})
+				gotClusterOrder = append(gotClusterOrder, clusterResource["cluster_id"].(string))
+			}
+			if !reflect.DeepEqual(gotClusterOrder, tc.wantClusterOrder) {
+				t.Errorf("bad: %s, got %q, want %q", tn, gotClusterOrder, tc.wantClusterOrder)
+			}
+		})
+	}
+}
diff --git a/mmv1/third_party/terraform/services/bigtable/resource_bigtable_instance_test.go b/mmv1/third_party/terraform/services/bigtable/resource_bigtable_instance_test.go
index 195fbd20549a..3e67663e66a9 100644
--- a/mmv1/third_party/terraform/services/bigtable/resource_bigtable_instance_test.go
+++ b/mmv1/third_party/terraform/services/bigtable/resource_bigtable_instance_test.go
@@ -36,7 +36,7 @@ func TestAccBigtableInstance_basic(t *testing.T) {
 				ResourceName:            "google_bigtable_instance.instance",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"deletion_protection", "instance_type"}, // we don't read instance type back
+				ImportStateVerifyIgnore: []string{"deletion_protection", "instance_type", "labels", "terraform_labels"}, // we don't read instance type back
 			},
 			{
 				Config: testAccBigtableInstance(instanceName, 4),
@@ -45,7 +45,7 @@ func TestAccBigtableInstance_basic(t *testing.T) {
 				ResourceName:            "google_bigtable_instance.instance",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"deletion_protection", "instance_type"}, // we don't read instance type back
+				ImportStateVerifyIgnore: []string{"deletion_protection", "instance_type", "labels", "terraform_labels"}, // we don't read instance type back
 			},
 		},
 	})
@@ -89,7 +89,7 @@ func TestAccBigtableInstance_cluster(t *testing.T) {
 				ResourceName:            "google_bigtable_instance.instance",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"deletion_protection", "instance_type", "cluster"}, // we don't read instance type back
+				ImportStateVerifyIgnore: []string{"deletion_protection", "instance_type", "cluster", "labels", "terraform_labels"}, // we don't read instance type back
 			},
 			{
 				Config: testAccBigtableInstance_clusterReordered(instanceName, 5),
@@ -108,7 +108,7 @@ func TestAccBigtableInstance_cluster(t *testing.T) {
 				ResourceName:            "google_bigtable_instance.instance",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"deletion_protection", "instance_type", "cluster"}, // we don't read instance type back
+				ImportStateVerifyIgnore: []string{"deletion_protection", "instance_type", "cluster", "labels", "terraform_labels"}, // we don't read instance type back
 			},
 		},
 	})
@@ -311,7 +311,7 @@ func TestAccBigtableInstance_enableAndDisableAutoscaling(t *testing.T) {
 				ResourceName:            "google_bigtable_instance.instance",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"deletion_protection", "instance_type"}, // we don't read instance type back
+				ImportStateVerifyIgnore: []string{"deletion_protection", "instance_type", "labels", "terraform_labels"}, // we don't read instance type back
 			},
 			{
 				// Enable Autoscaling.
@@ -333,7 +333,7 @@ func TestAccBigtableInstance_enableAndDisableAutoscaling(t *testing.T) {
 				ResourceName:            "google_bigtable_instance.instance",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"deletion_protection", "instance_type"}, // we don't read instance type back
+				ImportStateVerifyIgnore: []string{"deletion_protection", "instance_type", "labels", "terraform_labels"}, // we don't read instance type back
 			},
 		},
 	})
@@ -373,7 +373,7 @@ func TestAccBigtableInstance_enableAndDisableAutoscalingWithoutNumNodes(t *testi
 				ResourceName:            "google_bigtable_instance.instance",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"deletion_protection", "instance_type"}, // we don't read instance type back
+				ImportStateVerifyIgnore: []string{"deletion_protection", "instance_type", "labels", "terraform_labels"}, // we don't read instance type back
 			},
 		},
 	})
@@ -428,7 +428,7 @@ func TestAccBigtableInstance_MultipleClustersSameID(t *testing.T) {
 				ResourceName:            "google_bigtable_instance.instance",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"deletion_protection", "instance_type"}, // we don't read instance type back
+				ImportStateVerifyIgnore: []string{"deletion_protection", "instance_type", "labels", "terraform_labels"}, // we don't read instance type back
 			},
 			{
 				Config:      testAccBigtableInstance_multipleClustersSameID(instanceName),
@@ -644,7 +644,7 @@ resource "google_bigtable_instance" "instance" {
   deletion_protection = false
 
   labels = {
-    env = "default"
+    env = "test"
   }
 }
 `, instanceName, instanceName, numNodes, instanceName, numNodes, instanceName, numNodes, instanceName, numNodes, instanceName, numNodes)
diff --git a/mmv1/third_party/terraform/services/bigtable/resource_bigtable_table.go b/mmv1/third_party/terraform/services/bigtable/resource_bigtable_table.go
index cd5d4f334b70..22dfdb88c53f 100644
--- a/mmv1/third_party/terraform/services/bigtable/resource_bigtable_table.go
+++ b/mmv1/third_party/terraform/services/bigtable/resource_bigtable_table.go
@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"cloud.google.com/go/bigtable"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 
@@ -32,6 +33,9 @@ func ResourceBigtableTable() *schema.Resource {
 			Update: schema.DefaultTimeout(20 * time.Minute),
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+		),
 		// ----------------------------------------------------------------------
 		// IMPORTANT: Do not add any additional ForceNew fields to this resource.
 		// Destroying/recreating tables can lead to data loss for users.
diff --git a/mmv1/third_party/terraform/services/billing/data_source_google_billing_account.go b/mmv1/third_party/terraform/services/billing/data_source_google_billing_account.go
index 35faf461500d..7c47a741c13c 100644
--- a/mmv1/third_party/terraform/services/billing/data_source_google_billing_account.go
+++ b/mmv1/third_party/terraform/services/billing/data_source_google_billing_account.go
@@ -64,7 +64,7 @@ func dataSourceBillingAccountRead(d *schema.ResourceData, meta interface{}) erro
 	if v, ok := d.GetOk("billing_account"); ok {
 		resp, err := config.NewBillingClient(userAgent).BillingAccounts.Get(CanonicalBillingAccountName(v.(string))).Do()
 		if err != nil {
-			return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("Billing Account Not Found : %s", v))
+			return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("Billing Account Not Found : %s", v), CanonicalBillingAccountName(v.(string)))
 		}
 
 		if openOk && resp.Open != open.(bool) {
diff --git a/mmv1/third_party/terraform/services/certificatemanager/data_source_google_certificate_manager_certificate_map.go b/mmv1/third_party/terraform/services/certificatemanager/data_source_google_certificate_manager_certificate_map.go
new file mode 100644
index 000000000000..0c87129f0d06
--- /dev/null
+++ b/mmv1/third_party/terraform/services/certificatemanager/data_source_google_certificate_manager_certificate_map.go
@@ -0,0 +1,44 @@
+package certificatemanager
+
+import (
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
+)
+
+func DataSourceGoogleCertificateManagerCertificateMap() *schema.Resource {
+
+	dsSchema := tpgresource.DatasourceSchemaFromResourceSchema(ResourceCertificateManagerCertificateMap().Schema)
+	tpgresource.AddRequiredFieldsToSchema(dsSchema, "name")
+	tpgresource.AddOptionalFieldsToSchema(dsSchema, "project")
+
+	return &schema.Resource{
+		Read:   dataSourceGoogleCertificateManagerCertificateMapRead,
+		Schema: dsSchema,
+	}
+}
+
+func dataSourceGoogleCertificateManagerCertificateMapRead(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*transport_tpg.Config)
+
+	name := d.Get("name").(string)
+
+	project, err := tpgresource.GetProject(d, config)
+	if err != nil {
+		return err
+	}
+
+	id := fmt.Sprintf("projects/%s/locations/global/certificateMaps/%s", project, name)
+	d.SetId(id)
+	err = resourceCertificateManagerCertificateMapRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
+}
diff --git a/mmv1/third_party/terraform/services/certificatemanager/data_source_google_certificate_manager_certificate_map_test.go b/mmv1/third_party/terraform/services/certificatemanager/data_source_google_certificate_manager_certificate_map_test.go
new file mode 100644
index 000000000000..7ca8c9c1f20d
--- /dev/null
+++ b/mmv1/third_party/terraform/services/certificatemanager/data_source_google_certificate_manager_certificate_map_test.go
@@ -0,0 +1,109 @@
+package certificatemanager_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+	"github.com/hashicorp/terraform-provider-google/google/envvar"
+)
+
+func TestAccDataSourceGoogleCertificateManagerCertificateMap_basic(t *testing.T) {
+	t.Parallel()
+
+	project := envvar.GetTestProjectFromEnv()
+
+	description := "My acceptance data source test certificate map"
+	name := fmt.Sprintf("tf-test-certificate-map-%d", acctest.RandInt(t))
+	id := fmt.Sprintf("projects/%s/locations/global/certificateMaps/%s", project, name)
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDataSourceGoogleCertificateManagerCertificateMap_basic(name, description),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("data.google_certificate_manager_certificate_map.cert_map_data", "id", id),
+					resource.TestCheckResourceAttr("data.google_certificate_manager_certificate_map.cert_map_data", "description", description),
+					resource.TestCheckResourceAttr("data.google_certificate_manager_certificate_map.cert_map_data", "name", name),
+				),
+			},
+		},
+	})
+}
+
+func testAccDataSourceGoogleCertificateManagerCertificateMap_basic(certificateMapName, certificateMapDescription string) string {
+	return fmt.Sprintf(`
+resource "google_certificate_manager_certificate_map" "cert_map" {
+	name        = "%s"
+	description = "%s"
+	labels      = {
+		"terraform" : true,
+		"acc-test"  : true,
+	}
+}
+data "google_certificate_manager_certificate_map" "cert_map_data" {
+	name = google_certificate_manager_certificate_map.cert_map.name
+}
+`, certificateMapName, certificateMapDescription)
+}
+
+func TestAccDataSourceGoogleCertificateManagerCertificateMap_certificateMapEntryUsingMapDatasource(t *testing.T) {
+	t.Parallel()
+
+	project := envvar.GetTestProjectFromEnv()
+
+	certName := fmt.Sprintf("tf-test-certificate-%d", acctest.RandInt(t))
+	mapEntryName := fmt.Sprintf("tf-test-certificate-map-entry-%d", acctest.RandInt(t))
+	mapName := fmt.Sprintf("tf-test-certificate-map-%d", acctest.RandInt(t))
+	id := fmt.Sprintf("projects/%s/locations/global/certificateMaps/%s", project, mapName)
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDataSourceGoogleCertificateManagerCertificateMap_certificateMapEntryUsingMapDatasource(mapName, mapEntryName, certName),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("data.google_certificate_manager_certificate_map.cert_map_data", "id", id),
+					resource.TestCheckResourceAttr("data.google_certificate_manager_certificate_map.cert_map_data", "name", mapName),
+					resource.TestCheckResourceAttr("google_certificate_manager_certificate_map_entry.cert_map_entry", "map", mapName), // check that the certificate map entry is referencing the data source
+
+				),
+			},
+		},
+	})
+}
+
+func testAccDataSourceGoogleCertificateManagerCertificateMap_certificateMapEntryUsingMapDatasource(certificateMapName, certificateMapEntryName, certificateName string) string {
+	return fmt.Sprintf(`
+resource "google_certificate_manager_certificate_map" "cert_map" {
+	name        = "%s"
+	description = "certificate map example created for testing data sources in TF"
+	labels      = {
+		"terraform" : true,
+		"acc-test"  : true,
+	}
+}
+data "google_certificate_manager_certificate_map" "cert_map_data" {
+	name = google_certificate_manager_certificate_map.cert_map.name
+}
+resource "google_certificate_manager_certificate" "certificate" {
+	name        = "%s"
+	description = "Global cert"
+	self_managed {
+	  pem_certificate = file("test-fixtures/cert.pem")
+	  pem_private_key = file("test-fixtures/private-key.pem")
+	}
+}
+resource "google_certificate_manager_certificate_map_entry" "cert_map_entry" {
+	name        = "%s"
+	description = "certificate map entry that reference a data source of certificate map and a self managed certificate"
+	map = data.google_certificate_manager_certificate_map.cert_map_data.name
+	certificates = [google_certificate_manager_certificate.certificate.id]
+	matcher = "PRIMARY"
+}
+`, certificateMapName, certificateName, certificateMapEntryName)
+}
diff --git a/mmv1/third_party/terraform/services/certificatemanager/resource_certificate_manager_dns_authorization_test.go b/mmv1/third_party/terraform/services/certificatemanager/resource_certificate_manager_dns_authorization_test.go
index f824e92ce94c..c25f72515e87 100644
--- a/mmv1/third_party/terraform/services/certificatemanager/resource_certificate_manager_dns_authorization_test.go
+++ b/mmv1/third_party/terraform/services/certificatemanager/resource_certificate_manager_dns_authorization_test.go
@@ -26,7 +26,7 @@ func TestAccCertificateManagerDnsAuthorization_update(t *testing.T) {
 				ResourceName:            "google_certificate_manager_dns_authorization.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name"},
+				ImportStateVerifyIgnore: []string{"name", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccCertificateManagerDnsAuthorization_update1(context),
@@ -35,7 +35,7 @@ func TestAccCertificateManagerDnsAuthorization_update(t *testing.T) {
 				ResourceName:            "google_certificate_manager_dns_authorization.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name"},
+				ImportStateVerifyIgnore: []string{"name", "labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/certificatemanager/resource_certificate_manager_trust_config_test.go b/mmv1/third_party/terraform/services/certificatemanager/resource_certificate_manager_trust_config_test.go
index 89a5d4d0a9ad..b84cbb0530f6 100644
--- a/mmv1/third_party/terraform/services/certificatemanager/resource_certificate_manager_trust_config_test.go
+++ b/mmv1/third_party/terraform/services/certificatemanager/resource_certificate_manager_trust_config_test.go
@@ -23,17 +23,19 @@ func TestAccCertificateManagerTrustConfig_update(t *testing.T) {
 				Config: testAccCertificateManagerTrustConfig_update0(context),
 			},
 			{
-				ResourceName:      "google_certificate_manager_trust_config.default",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_certificate_manager_trust_config.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccCertificateManagerTrustConfig_update1(context),
 			},
 			{
-				ResourceName:      "google_certificate_manager_trust_config.default",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_certificate_manager_trust_config.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/cloudbuild/data_source_google_cloudbuild_trigger.go b/mmv1/third_party/terraform/services/cloudbuild/data_source_google_cloudbuild_trigger.go
index 499f4930dcb4..274a8e6e1dad 100644
--- a/mmv1/third_party/terraform/services/cloudbuild/data_source_google_cloudbuild_trigger.go
+++ b/mmv1/third_party/terraform/services/cloudbuild/data_source_google_cloudbuild_trigger.go
@@ -32,7 +32,16 @@ func dataSourceGoogleCloudBuildTriggerRead(d *schema.ResourceData, meta interfac
 	}
 
 	id = strings.ReplaceAll(id, "/locations/global/", "/")
-
 	d.SetId(id)
-	return resourceCloudBuildTriggerRead(d, meta)
+
+	err = resourceCloudBuildTriggerRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/cloudbuild/resource_cloudbuild_worker_pool_test.go.erb b/mmv1/third_party/terraform/services/cloudbuild/resource_cloudbuild_worker_pool_test.go.erb
index 7500ebf14b2f..2954e203a654 100644
--- a/mmv1/third_party/terraform/services/cloudbuild/resource_cloudbuild_worker_pool_test.go.erb
+++ b/mmv1/third_party/terraform/services/cloudbuild/resource_cloudbuild_worker_pool_test.go.erb
@@ -41,6 +41,7 @@ func TestAccCloudbuildWorkerPool_basic(t *testing.T) {
 			{
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"annotations"},
 				ResourceName:      "google_cloudbuild_worker_pool.pool",
 			},
 			{
@@ -79,6 +80,11 @@ resource "google_cloudbuild_worker_pool" "pool" {
 		machine_type = "e2-standard-4"
 		no_external_ip = false
 	}
+
+	annotations = {
+		env                   = "foo"
+		default_expiration_ms = 3600000
+	}
 }
 `, context)
 }
@@ -98,7 +104,7 @@ func TestAccCloudbuildWorkerPool_withNetwork(t *testing.T) {
 	context := map[string]interface{}{
 		"random_suffix": acctest.RandString(t, 10),
 		"project":       envvar.GetTestProjectFromEnv(),
-		"network_name":  acctest.BootstrapSharedTestNetwork(t, "cloudbuild-workerpool"),
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "cloudbuild-workerpool-1"),
 	}
 
 	acctest.VcrTest(t, resource.TestCase{
@@ -125,20 +131,6 @@ data "google_compute_network" "network" {
   name = "%{network_name}"
 }
 
-resource "google_compute_global_address" "worker_range" {
-  name          = "tf-test-worker-pool-range%{random_suffix}"
-  purpose       = "VPC_PEERING"
-  address_type  = "INTERNAL"
-  prefix_length = 16
-  network       = data.google_compute_network.network.id
-}
-
-resource "google_service_networking_connection" "worker_pool_conn" {
-  network                 = data.google_compute_network.network.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.worker_range.name]
-}
-
 resource "google_cloudbuild_worker_pool" "pool" {
 	name = "pool%{random_suffix}"
 	location = "europe-west1"
@@ -151,7 +143,6 @@ resource "google_cloudbuild_worker_pool" "pool" {
 		peered_network = data.google_compute_network.network.id
 		peered_network_ip_range = "/29"
 	}
-	depends_on = [google_service_networking_connection.worker_pool_conn]
 }
 `, context)
 }
diff --git a/mmv1/third_party/terraform/services/clouddeploy/resource_clouddeploy_target_test.go b/mmv1/third_party/terraform/services/clouddeploy/resource_clouddeploy_target_test.go
new file mode 100644
index 000000000000..e8393b2a09ba
--- /dev/null
+++ b/mmv1/third_party/terraform/services/clouddeploy/resource_clouddeploy_target_test.go
@@ -0,0 +1,278 @@
+package clouddeploy_test
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+	"github.com/hashicorp/terraform-provider-google/google/envvar"
+)
+
+func TestAccClouddeployTarget_withProviderDefaultLabels(t *testing.T) {
+	// The test failed if VCR testing is enabled, because the cached provider config is used.
+	// Any changes in the provider default labels will not be applied.
+	acctest.SkipIfVcr(t)
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"project_name":  envvar.GetTestProjectFromEnv(),
+		"region":        envvar.GetTestRegionFromEnv(),
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckClouddeployTargetDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccClouddeployTarget_withProviderDefaultLabels(context),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "labels.%", "2"),
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "labels.my_first_label", "example-label-1"),
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "labels.my_second_label", "example-label-2"),
+
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "terraform_labels.%", "3"),
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "terraform_labels.my_first_label", "example-label-1"),
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "terraform_labels.my_second_label", "example-label-2"),
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "terraform_labels.default_key1", "default_value1"),
+
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "effective_labels.%", "3"),
+				),
+			},
+			{
+				ResourceName:            "google_clouddeploy_target.primary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels", "annotations"},
+			},
+			{
+				Config: testAccClouddeployTarget_resourceLabelsOverridesProviderDefaultLabels(context),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "labels.%", "3"),
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "labels.my_first_label", "example-label-1"),
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "labels.my_second_label", "example-label-2"),
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "labels.default_key1", "value1"),
+
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "terraform_labels.%", "3"),
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "terraform_labels.my_first_label", "example-label-1"),
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "terraform_labels.my_second_label", "example-label-2"),
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "terraform_labels.default_key1", "value1"),
+
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "effective_labels.%", "3"),
+				),
+			},
+			{
+				ResourceName:            "google_clouddeploy_target.primary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels", "annotations"},
+			},
+			{
+				Config: testAccClouddeployTarget_moveResourceLabelToProviderDefaultLabels(context),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "labels.%", "2"),
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "labels.my_first_label", "example-label-1"),
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "labels.default_key1", "value1"),
+
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "terraform_labels.%", "3"),
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "terraform_labels.my_first_label", "example-label-1"),
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "terraform_labels.my_second_label", "example-label-2"),
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "terraform_labels.default_key1", "value1"),
+
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "effective_labels.%", "3"),
+				),
+			},
+			{
+				ResourceName:            "google_clouddeploy_target.primary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels", "annotations"},
+			},
+			{
+				Config: testAccClouddeployTarget_resourceLabelsOverridesProviderDefaultLabels(context),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "labels.%", "3"),
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "labels.my_first_label", "example-label-1"),
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "labels.my_second_label", "example-label-2"),
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "labels.default_key1", "value1"),
+
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "terraform_labels.%", "3"),
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "terraform_labels.my_first_label", "example-label-1"),
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "terraform_labels.my_second_label", "example-label-2"),
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "terraform_labels.default_key1", "value1"),
+
+					resource.TestCheckResourceAttr("google_clouddeploy_target.primary", "effective_labels.%", "3"),
+				),
+			},
+			{
+				ResourceName:            "google_clouddeploy_target.primary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels", "annotations"},
+			},
+			{
+				Config: testAccClouddeployTarget_withoutLabels(context),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckNoResourceAttr("google_clouddeploy_target.primary", "labels.%"),
+					resource.TestCheckNoResourceAttr("google_clouddeploy_target.primary", "terraform_labels.%"),
+					resource.TestCheckNoResourceAttr("google_clouddeploy_target.primary", "effective_labels.%"),
+				),
+			},
+			{
+				ResourceName:            "google_clouddeploy_target.primary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels", "annotations"},
+			},
+		},
+	})
+}
+
+func testAccClouddeployTarget_withProviderDefaultLabels(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+provider "google" {
+  default_labels = {
+    default_key1 = "default_value1"
+  }
+}
+
+resource "google_clouddeploy_target" "primary" {
+  location = "%{region}"
+  name     = "tf-test-target%{random_suffix}"
+
+  deploy_parameters = {
+    deployParameterKey = "deployParameterValue"
+  }
+
+  description = "basic description"
+
+  gke {
+    cluster = "projects/%{project_name}/locations/%{region}/clusters/example-cluster-name"
+  }
+
+  project          = "%{project_name}"
+  require_approval = false
+
+  annotations = {
+    my_first_annotation = "example-annotation-1"
+
+    my_second_annotation = "example-annotation-2"
+  }
+
+  labels = {
+    my_first_label = "example-label-1"
+    my_second_label = "example-label-2"
+  }
+}
+`, context)
+}
+
+func testAccClouddeployTarget_resourceLabelsOverridesProviderDefaultLabels(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+provider "google" {
+  default_labels = {
+    default_key1 = "default_value1"
+  }
+}
+
+resource "google_clouddeploy_target" "primary" {
+  location = "%{region}"
+  name     = "tf-test-target%{random_suffix}"
+
+  deploy_parameters = {
+    deployParameterKey = "deployParameterValue"
+  }
+
+  description = "basic description"
+
+  gke {
+    cluster = "projects/%{project_name}/locations/%{region}/clusters/example-cluster-name"
+  }
+
+  project          = "%{project_name}"
+  require_approval = false
+
+  annotations = {
+    my_first_annotation = "example-annotation-1"
+
+    my_second_annotation = "example-annotation-2"
+  }
+
+  labels = {
+    my_first_label = "example-label-1"
+    my_second_label = "example-label-2"
+    default_key1 = "value1"
+  }
+}
+`, context)
+}
+
+func testAccClouddeployTarget_moveResourceLabelToProviderDefaultLabels(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+provider "google" {
+  default_labels = {
+    default_key1 = "default_value1"
+    my_second_label = "example-label-2"
+  }
+}
+
+resource "google_clouddeploy_target" "primary" {
+  location = "%{region}"
+  name     = "tf-test-target%{random_suffix}"
+
+  deploy_parameters = {
+    deployParameterKey = "deployParameterValue"
+  }
+
+  description = "basic description"
+
+  gke {
+    cluster = "projects/%{project_name}/locations/%{region}/clusters/example-cluster-name"
+  }
+
+  project          = "%{project_name}"
+  require_approval = false
+
+  annotations = {
+    my_first_annotation = "example-annotation-1"
+
+    my_second_annotation = "example-annotation-2"
+  }
+
+  labels = {
+    my_first_label = "example-label-1"
+    default_key1 = "value1"
+  }
+}
+`, context)
+}
+
+func testAccClouddeployTarget_withoutLabels(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_clouddeploy_target" "primary" {
+  location = "%{region}"
+  name     = "tf-test-target%{random_suffix}"
+
+  deploy_parameters = {
+    deployParameterKey = "deployParameterValue"
+  }
+
+  description = "basic description"
+
+  gke {
+    cluster = "projects/%{project_name}/locations/%{region}/clusters/example-cluster-name"
+  }
+
+  project          = "%{project_name}"
+  require_approval = false
+
+  annotations = {
+    my_first_annotation = "example-annotation-1"
+
+    my_second_annotation = "example-annotation-2"
+  }
+}
+`, context)
+}
diff --git a/mmv1/third_party/terraform/services/cloudfunctions/data_source_google_cloudfunctions_function.go b/mmv1/third_party/terraform/services/cloudfunctions/data_source_google_cloudfunctions_function.go
index 04c0463dbf49..7d019ed5e2f0 100644
--- a/mmv1/third_party/terraform/services/cloudfunctions/data_source_google_cloudfunctions_function.go
+++ b/mmv1/third_party/terraform/services/cloudfunctions/data_source_google_cloudfunctions_function.go
@@ -1,6 +1,8 @@
 package cloudfunctions
 
 import (
+	"fmt"
+
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
@@ -48,5 +50,13 @@ func dataSourceGoogleCloudFunctionsFunctionRead(d *schema.ResourceData, meta int
 		return err
 	}
 
+	if err := tpgresource.SetDataSourceLabels(d); err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", cloudFuncId.CloudFunctionId())
+	}
+
 	return nil
 }
diff --git a/mmv1/third_party/terraform/services/cloudfunctions/data_source_google_cloudfunctions_function_test.go b/mmv1/third_party/terraform/services/cloudfunctions/data_source_google_cloudfunctions_function_test.go
index 68dd233c3584..ee1d0bd66f10 100644
--- a/mmv1/third_party/terraform/services/cloudfunctions/data_source_google_cloudfunctions_function_test.go
+++ b/mmv1/third_party/terraform/services/cloudfunctions/data_source_google_cloudfunctions_function_test.go
@@ -61,6 +61,9 @@ resource "google_cloudfunctions_function" "function_http" {
   trigger_http          = true
   timeout               = 61
   entry_point           = "helloGET"
+  labels = {
+    my-label = "my-label-value"
+  }
 }
 
 data "google_cloudfunctions_function" "function_http" {
diff --git a/mmv1/third_party/terraform/services/cloudfunctions/resource_cloudfunctions_function.go b/mmv1/third_party/terraform/services/cloudfunctions/resource_cloudfunctions_function.go
index f93c8501f0db..ac86bac73dbf 100644
--- a/mmv1/third_party/terraform/services/cloudfunctions/resource_cloudfunctions_function.go
+++ b/mmv1/third_party/terraform/services/cloudfunctions/resource_cloudfunctions_function.go
@@ -3,6 +3,7 @@ package cloudfunctions
 import (
 	"regexp"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 
@@ -141,6 +142,12 @@ func ResourceCloudFunctionsFunction() *schema.Resource {
 			Delete: schema.DefaultTimeout(5 * time.Minute),
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+			tpgresource.DefaultProviderRegion,
+			tpgresource.SetLabelsDiff,
+		),
+
 		Schema: map[string]*schema.Schema{
 			"name": {
 				Type:         schema.TypeString,
@@ -257,7 +264,24 @@ func ResourceCloudFunctionsFunction() *schema.Resource {
 				Type:         schema.TypeMap,
 				ValidateFunc: labelKeyValidator,
 				Optional:     true,
-				Description:  `A set of key/value label pairs to assign to the function. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements.`,
+				Description: `A set of key/value label pairs to assign to the function. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements.
+
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+			},
+
+			"terraform_labels": {
+				Type:        schema.TypeMap,
+				Computed:    true,
+				Description: `The combination of labels configured directly on the resource and default labels configured on the provider.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+			},
+
+			"effective_labels": {
+				Type:        schema.TypeMap,
+				Computed:    true,
+				Description: `All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
 			},
 
 			"runtime": {
@@ -558,8 +582,8 @@ func resourceCloudFunctionsCreate(d *schema.ResourceData, meta interface{}) erro
 		function.IngressSettings = v.(string)
 	}
 
-	if _, ok := d.GetOk("labels"); ok {
-		function.Labels = tpgresource.ExpandLabels(d)
+	if _, ok := d.GetOk("effective_labels"); ok {
+		function.Labels = tpgresource.ExpandEffectiveLabels(d)
 	}
 
 	if _, ok := d.GetOk("environment_variables"); ok {
@@ -670,9 +694,15 @@ func resourceCloudFunctionsRead(d *schema.ResourceData, meta interface{}) error
 	if err := d.Set("ingress_settings", function.IngressSettings); err != nil {
 		return fmt.Errorf("Error setting ingress_settings: %s", err)
 	}
-	if err := d.Set("labels", function.Labels); err != nil {
+	if err := tpgresource.SetLabels(function.Labels, d, "labels"); err != nil {
 		return fmt.Errorf("Error setting labels: %s", err)
 	}
+	if err := tpgresource.SetLabels(function.Labels, d, "terraform_labels"); err != nil {
+		return fmt.Errorf("Error setting terraform_labels: %s", err)
+	}
+	if err := d.Set("effective_labels", function.Labels); err != nil {
+		return fmt.Errorf("Error setting effective_labels: %s", err)
+	}
 	if err := d.Set("runtime", function.Runtime); err != nil {
 		return fmt.Errorf("Error setting runtime: %s", err)
 	}
@@ -839,8 +869,8 @@ func resourceCloudFunctionsUpdate(d *schema.ResourceData, meta interface{}) erro
 		updateMaskArr = append(updateMaskArr, "ingressSettings")
 	}
 
-	if d.HasChange("labels") {
-		function.Labels = tpgresource.ExpandLabels(d)
+	if d.HasChange("effective_labels") {
+		function.Labels = tpgresource.ExpandEffectiveLabels(d)
 		updateMaskArr = append(updateMaskArr, "labels")
 	}
 
diff --git a/mmv1/third_party/terraform/services/cloudfunctions/resource_cloudfunctions_function_test.go.erb b/mmv1/third_party/terraform/services/cloudfunctions/resource_cloudfunctions_function_test.go.erb
index 84e37426b3b7..9bf727547801 100644
--- a/mmv1/third_party/terraform/services/cloudfunctions/resource_cloudfunctions_function_test.go.erb
+++ b/mmv1/third_party/terraform/services/cloudfunctions/resource_cloudfunctions_function_test.go.erb
@@ -80,7 +80,7 @@ func TestAccCloudFunctionsFunction_basic(t *testing.T) {
 				ResourceName:            funcResourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"build_environment_variables"},
+				ImportStateVerifyIgnore: []string{"build_environment_variables", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -117,7 +117,7 @@ func TestAccCloudFunctionsFunction_update(t *testing.T) {
 				ResourceName:            funcResourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"build_environment_variables"},
+				ImportStateVerifyIgnore: []string{"build_environment_variables", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccCloudFunctionsFunction_updated(functionName, bucketName, zipFileUpdatePath, random_suffix),
@@ -150,7 +150,7 @@ func TestAccCloudFunctionsFunction_update(t *testing.T) {
 				ResourceName:            funcResourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"build_environment_variables"},
+				ImportStateVerifyIgnore: []string{"build_environment_variables", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -425,7 +425,7 @@ func TestAccCloudFunctionsFunction_vpcConnector(t *testing.T) {
 				ResourceName:            funcResourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"build_environment_variables"},
+				ImportStateVerifyIgnore: []string{"build_environment_variables", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccCloudFunctionsFunction_vpcConnector(projectNumber, networkName, functionName, bucketName, zipFilePath, "10.20.0.0/28", vpcConnectorName+"-update"),
@@ -434,7 +434,7 @@ func TestAccCloudFunctionsFunction_vpcConnector(t *testing.T) {
 				ResourceName:            funcResourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"build_environment_variables"},
+				ImportStateVerifyIgnore: []string{"build_environment_variables", "labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/cloudfunctions2/data_source_google_cloudfunctions2_function.go b/mmv1/third_party/terraform/services/cloudfunctions2/data_source_google_cloudfunctions2_function.go
index f340b7608cc6..b04f0f692bb9 100644
--- a/mmv1/third_party/terraform/services/cloudfunctions2/data_source_google_cloudfunctions2_function.go
+++ b/mmv1/third_party/terraform/services/cloudfunctions2/data_source_google_cloudfunctions2_function.go
@@ -32,12 +32,21 @@ func dataSourceGoogleCloudFunctions2FunctionRead(d *schema.ResourceData, meta in
 		return err
 	}
 
-	d.SetId(fmt.Sprintf("projects/%s/locations/%s/functions/%s", project, d.Get("location").(string), d.Get("name").(string)))
+	id := fmt.Sprintf("projects/%s/locations/%s/functions/%s", project, d.Get("location").(string), d.Get("name").(string))
+	d.SetId(id)
 
 	err = resourceCloudfunctions2functionRead(d, meta)
 	if err != nil {
 		return err
 	}
 
+	if err := tpgresource.SetDataSourceLabels(d); err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+
 	return nil
 }
diff --git a/mmv1/third_party/terraform/services/cloudfunctions2/data_source_google_cloudfunctions2_function_test.go b/mmv1/third_party/terraform/services/cloudfunctions2/data_source_google_cloudfunctions2_function_test.go
index 3769b961f991..a1f842ea9fc3 100644
--- a/mmv1/third_party/terraform/services/cloudfunctions2/data_source_google_cloudfunctions2_function_test.go
+++ b/mmv1/third_party/terraform/services/cloudfunctions2/data_source_google_cloudfunctions2_function_test.go
@@ -24,9 +24,11 @@ func TestAccDataSourceGoogleCloudFunctions2Function_basic(t *testing.T) {
 			{
 				Config: testAccDataSourceGoogleCloudFunctions2FunctionConfig(functionName,
 					bucketName, zipFilePath),
+				// As the value of "labels" and "terraform_labels" in the state of the data source are all labels,
+				// but the "labels" field in resource are user defined labels, which is the reason for the mismatch.
 				Check: resource.ComposeTestCheckFunc(
 					acctest.CheckDataSourceStateMatchesResourceStateWithIgnores(funcDataNameHttp,
-						"google_cloudfunctions2_function.function_http_v2", map[string]struct{}{"build_config.0.source.0.storage_source.0.bucket": {}, "build_config.0.source.0.storage_source.0.object": {}}),
+						"google_cloudfunctions2_function.function_http_v2", map[string]struct{}{"build_config.0.source.0.storage_source.0.bucket": {}, "build_config.0.source.0.storage_source.0.object": {}, "labels.%": {}, "terraform_labels.%": {}}),
 				),
 			},
 		},
@@ -35,6 +37,12 @@ func TestAccDataSourceGoogleCloudFunctions2Function_basic(t *testing.T) {
 
 func testAccDataSourceGoogleCloudFunctions2FunctionConfig(functionName, bucketName, zipFilePath string) string {
 	return fmt.Sprintf(`
+provider "google" {
+  default_labels = {
+    default_key1 = "default_value1"
+  }
+}
+
 resource "google_storage_bucket" "bucket" {
   name     = "%s"
   location = "US"
@@ -50,7 +58,9 @@ resource "google_cloudfunctions2_function" "function_http_v2" {
   name = "%s"
   location = "us-central1"
   description = "a new function"
-
+  labels = {
+    env = "test"
+  }
   build_config {
     runtime = "nodejs12"
     entry_point = "helloHttp"
diff --git a/mmv1/third_party/terraform/services/cloudfunctions2/resource_cloudfunctions2_function_test.go b/mmv1/third_party/terraform/services/cloudfunctions2/resource_cloudfunctions2_function_test.go
index 443a86fa0e94..ab82a584fbca 100644
--- a/mmv1/third_party/terraform/services/cloudfunctions2/resource_cloudfunctions2_function_test.go
+++ b/mmv1/third_party/terraform/services/cloudfunctions2/resource_cloudfunctions2_function_test.go
@@ -28,7 +28,7 @@ func TestAccCloudFunctions2Function_update(t *testing.T) {
 				ResourceName:            "google_cloudfunctions2_function.terraform-test2",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"location", "build_config.0.source.0.storage_source.0.object", "build_config.0.source.0.storage_source.0.bucket"},
+				ImportStateVerifyIgnore: []string{"location", "build_config.0.source.0.storage_source.0.object", "build_config.0.source.0.storage_source.0.bucket", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccCloudFunctions2Function_test_update(context),
@@ -37,7 +37,7 @@ func TestAccCloudFunctions2Function_update(t *testing.T) {
 				ResourceName:            "google_cloudfunctions2_function.terraform-test2",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"location", "build_config.0.source.0.storage_source.0.object", "build_config.0.source.0.storage_source.0.bucket"},
+				ImportStateVerifyIgnore: []string{"location", "build_config.0.source.0.storage_source.0.object", "build_config.0.source.0.storage_source.0.bucket", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccCloudFunctions2Function_test_redeploy(context),
@@ -46,7 +46,7 @@ func TestAccCloudFunctions2Function_update(t *testing.T) {
 				ResourceName:            "google_cloudfunctions2_function.terraform-test2",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"location", "build_config.0.source.0.storage_source.0.object", "build_config.0.source.0.storage_source.0.bucket"},
+				ImportStateVerifyIgnore: []string{"location", "build_config.0.source.0.storage_source.0.object", "build_config.0.source.0.storage_source.0.bucket", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -70,6 +70,9 @@ resource "google_cloudfunctions2_function" "terraform-test2" {
   name = "tf-test-test-function%{random_suffix}"
   location = "us-central1"
   description = "a new function"
+  labels = {
+    env = "test"
+  }
 
   build_config {
     runtime = "nodejs12"
@@ -109,7 +112,10 @@ resource "google_cloudfunctions2_function" "terraform-test2" {
   name = "tf-test-test-function%{random_suffix}"
   location = "us-central1"
   description = "an updated function"
-
+  labels = {
+    env = "test-update"
+  }
+  
   build_config {
     runtime = "nodejs12"
     entry_point = "helloHttp"
diff --git a/mmv1/third_party/terraform/services/cloudidentity/data_source_cloud_identity_group_lookup.go.erb b/mmv1/third_party/terraform/services/cloudidentity/data_source_cloud_identity_group_lookup.go.erb
new file mode 100644
index 000000000000..cf44f15eb1ee
--- /dev/null
+++ b/mmv1/third_party/terraform/services/cloudidentity/data_source_cloud_identity_group_lookup.go.erb
@@ -0,0 +1,102 @@
+<% autogen_exception -%>
+package cloudidentity
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+func DataSourceGoogleCloudIdentityGroupLookup() *schema.Resource {
+
+	return &schema.Resource{
+		Read: dataSourceGoogleCloudIdentityGroupLookupRead,
+
+		Schema: map[string]*schema.Schema{
+			"name": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: `The [resource name](https://cloud.google.com/apis/design/resource_names) of the looked-up Group.`,
+			},
+			"group_key": {
+				Type:     schema.TypeList,
+				MaxItems: 1,
+				Required: true,
+				Description: `The EntityKey of the Group to lookup. A unique identifier for an entity in the Cloud Identity Groups API.
+An entity can represent either a group with an optional namespace or a user without a namespace.
+The combination of id and namespace must be unique; however, the same id can be used with different namespaces.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"id": {
+							Type:     schema.TypeString,
+							Required: true,
+							Description: `The ID of the entity. For Google-managed entities, the id should be the email address of an existing group or user.
+For external-identity-mapped entities, the id must be a string conforming to the Identity Source's requirements.
+Must be unique within a namespace.`,
+						},
+						"namespace": {
+							Type:     schema.TypeString,
+							Optional: true,
+							Description: `The namespace in which the entity exists. If not specified, the EntityKey represents a Google-managed entity such as a Google user or a Google Group.
+If specified, the EntityKey represents an external-identity-mapped group. The namespace must correspond to an identity source created in Admin Console and must be in the form of identitysources/{identity_source}.`,
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func dataSourceGoogleCloudIdentityGroupLookupRead(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*transport_tpg.Config)
+	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
+	if err != nil {
+		return err
+	}
+
+	gkId, ok := d.GetOk("group_key.0.id")
+	if !ok {
+		return fmt.Errorf("error getting group key id")
+	}
+	id := gkId.(string)
+
+	groupsLookupCall := config.NewCloudIdentityClient(userAgent).Groups.Lookup().GroupKeyId(id)
+
+	gkNamespace, ok := d.GetOk("group_key.0.namespace")
+	if ok {
+		// If optional namespace argument provided, add as param to API call
+		namespace := gkNamespace.(string)
+		groupsLookupCall = groupsLookupCall.GroupKeyNamespace(namespace)
+	}
+
+	if config.UserProjectOverride {
+		billingProject := ""
+		// err may be nil - project isn't required for this resource
+		if project, err := tpgresource.GetProject(d, config); err == nil {
+			billingProject = project
+		}
+
+		// err == nil indicates that the billing_project value was found
+		if bp, err := tpgresource.GetBillingProject(d, config); err == nil {
+			billingProject = bp
+		}
+
+		if billingProject != "" {
+			groupsLookupCall.Header().Set("X-Goog-User-Project", billingProject)
+		}
+	}
+	resp, err := groupsLookupCall.Do()
+	if err != nil {
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("CloudIdentityGroups %q", d.Id()), "Groups")
+	}
+
+	if err := d.Set("name", resp.Name); err != nil {
+		return fmt.Errorf("error setting group lookup name: %s", err)
+	}
+	d.SetId(time.Now().UTC().String())
+	return nil
+}
diff --git a/mmv1/third_party/terraform/services/cloudidentity/data_source_cloud_identity_group_lookup_test.go b/mmv1/third_party/terraform/services/cloudidentity/data_source_cloud_identity_group_lookup_test.go
new file mode 100644
index 000000000000..fd1ca06500c3
--- /dev/null
+++ b/mmv1/third_party/terraform/services/cloudidentity/data_source_cloud_identity_group_lookup_test.go
@@ -0,0 +1,100 @@
+package cloudidentity_test
+
+import (
+	"regexp"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+	"github.com/hashicorp/terraform-provider-google/google/envvar"
+)
+
+func testAccDataSourceCloudIdentityGroupLookup_basicTest(t *testing.T) {
+
+	context := map[string]interface{}{
+		"org_domain":    envvar.GetTestOrgDomainFromEnv(t),
+		"cust_id":       envvar.GetTestCustIdFromEnv(t),
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		Steps: []resource.TestStep{
+			{
+				// Create group and look it up via its group key, i.e. email we set
+				Config: testAccCloudIdentityGroupLookupConfig_groupKeyLookup(context),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestMatchResourceAttr("data.google_cloud_identity_group_lookup.email",
+						"name", regexp.MustCompile("^groups/.*$")),
+					resource.TestCheckResourceAttrPair("data.google_cloud_identity_group_lookup.email", "name",
+						"google_cloud_identity_group.cloud_identity_group_basic", "name"),
+				),
+			},
+			{
+				// Look up group via an API-generated 'additional group key'
+				Config: testAccCloudIdentityGroupLookupConfig_additionalGroupKeyLookup(context),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrPair("data.google_cloud_identity_group_lookup.additional-groupkey", "name",
+						"google_cloud_identity_group.cloud_identity_group_basic", "name"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCloudIdentityGroupLookupConfig_groupKeyLookup(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+# config matching testAccCloudIdentityGroup_cloudIdentityGroupsBasicExample
+resource "google_cloud_identity_group" "cloud_identity_group_basic" {
+  display_name         = "tf-test-my-identity-group%{random_suffix}"
+  initial_group_config = "WITH_INITIAL_OWNER"
+
+  parent = "customers/%{cust_id}"
+
+  group_key {
+    id = "tf-test-my-identity-group%{random_suffix}@%{org_domain}"
+  }
+
+  labels = {
+    "cloudidentity.googleapis.com/groups.discussion_forum" = ""
+  }
+}
+
+data "google_cloud_identity_group_lookup" "email" {
+  group_key {
+    id = google_cloud_identity_group.cloud_identity_group_basic.group_key[0].id
+  }
+}
+`, context)
+}
+
+func testAccCloudIdentityGroupLookupConfig_additionalGroupKeyLookup(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+# config matching testAccCloudIdentityGroup_cloudIdentityGroupsBasicExample
+resource "google_cloud_identity_group" "cloud_identity_group_basic" {
+  display_name         = "tf-test-my-identity-group%{random_suffix}"
+  initial_group_config = "WITH_INITIAL_OWNER"
+
+  parent = "customers/%{cust_id}"
+
+  group_key {
+    id = "tf-test-my-identity-group%{random_suffix}@%{org_domain}"
+  }
+
+  labels = {
+    "cloudidentity.googleapis.com/groups.discussion_forum" = ""
+  }
+}
+
+data "google_cloud_identity_group_lookup" "additional-groupkey" {
+  group_key {
+    # This value is an automatically created 'additionalGroupKeys' value
+    id = "tf-test-my-identity-group%{random_suffix}@%{org_domain}.test-google-a.com"
+  }
+  depends_on = [
+    google_cloud_identity_group.cloud_identity_group_basic,
+  ]
+}
+`, context)
+}
diff --git a/mmv1/third_party/terraform/services/cloudidentity/data_source_cloud_identity_group_memberships.go.erb b/mmv1/third_party/terraform/services/cloudidentity/data_source_cloud_identity_group_memberships.go.erb
index 0035138b50d1..e397219ae527 100644
--- a/mmv1/third_party/terraform/services/cloudidentity/data_source_cloud_identity_group_memberships.go.erb
+++ b/mmv1/third_party/terraform/services/cloudidentity/data_source_cloud_identity_group_memberships.go.erb
@@ -85,7 +85,7 @@ func dataSourceGoogleCloudIdentityGroupMembershipsRead(d *schema.ResourceData, m
 		return nil
 	})
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("CloudIdentityGroupMemberships %q", d.Id()))
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("CloudIdentityGroupMemberships %q", d.Id()), "")
 	}
 
 	if err := d.Set("memberships", result); err != nil {
diff --git a/mmv1/third_party/terraform/services/cloudidentity/data_source_cloud_identity_groups.go.erb b/mmv1/third_party/terraform/services/cloudidentity/data_source_cloud_identity_groups.go.erb
index 848366d3e4eb..24dbc830680d 100644
--- a/mmv1/third_party/terraform/services/cloudidentity/data_source_cloud_identity_groups.go.erb
+++ b/mmv1/third_party/terraform/services/cloudidentity/data_source_cloud_identity_groups.go.erb
@@ -4,6 +4,7 @@ package cloudidentity
 import (
 	"fmt"
 	"time"
+
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 
@@ -84,7 +85,7 @@ func dataSourceGoogleCloudIdentityGroupsRead(d *schema.ResourceData, meta interf
 		return nil
 	})
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("CloudIdentityGroups %q", d.Id()))
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("CloudIdentityGroups %q", d.Id()), "Groups")
 	}
 
 	if err := d.Set("groups", result); err != nil {
diff --git a/mmv1/third_party/terraform/services/cloudidentity/resource_cloud_identity_group_membership_test.go.erb b/mmv1/third_party/terraform/services/cloudidentity/resource_cloud_identity_group_membership_test.go.erb
index ad373a57d9cf..b4fcf66ecea6 100644
--- a/mmv1/third_party/terraform/services/cloudidentity/resource_cloud_identity_group_membership_test.go.erb
+++ b/mmv1/third_party/terraform/services/cloudidentity/resource_cloud_identity_group_membership_test.go.erb
@@ -296,7 +296,7 @@ resource "google_cloud_identity_group" "group" {
   parent = "customers/%{cust_id}"
 
   group_key {
-  	id = "tf-test-my-identity-group%{random_suffix}@%{org_domain}"
+  id = "tf-test-my-identity-group%{random_suffix}@%{org_domain}"
   }
 
   labels = {
@@ -310,7 +310,7 @@ resource "google_cloud_identity_group" "child-group" {
   parent = "customers/%{cust_id}"
 
   group_key {
-  	id = "tf-test-my-identity-group%{random_suffix}-child@%{org_domain}"
+    id = "tf-test-my-identity-group%{random_suffix}-child@%{org_domain}"
   }
 
   labels = {
@@ -326,7 +326,7 @@ resource "google_cloud_identity_group_membership" "cloud_identity_group_membersh
   }
 
   roles {
-  	name = "MEMBER"
+    name = "MEMBER"
   }
 }
 `, context)
@@ -425,7 +425,7 @@ resource "google_cloud_identity_group" "group" {
   parent = "customers/%{cust_id}"
 
   group_key {
-  	id = "tf-test-my-identity-group%{random_suffix}@%{org_domain}"
+    id = "tf-test-my-identity-group%{random_suffix}@%{org_domain}"
   }
 
   labels = {
@@ -439,7 +439,7 @@ resource "google_cloud_identity_group" "child-group" {
   parent = "customers/%{cust_id}"
 
   group_key {
-  	id = "tf-test-my-identity-group%{random_suffix}-child@%{org_domain}"
+    id = "tf-test-my-identity-group%{random_suffix}-child@%{org_domain}"
   }
 
   labels = {
@@ -455,7 +455,7 @@ resource "google_cloud_identity_group_membership" "cloud_identity_group_membersh
   }
 
   roles {
-  	name = "MEMBER"
+    name = "MEMBER"
   }
 }
 `, context)
diff --git a/mmv1/third_party/terraform/services/cloudidentity/resource_cloud_identity_group_test.go.erb b/mmv1/third_party/terraform/services/cloudidentity/resource_cloud_identity_group_test.go.erb
index c49a17fd2c6f..43ea19716b0f 100644
--- a/mmv1/third_party/terraform/services/cloudidentity/resource_cloud_identity_group_test.go.erb
+++ b/mmv1/third_party/terraform/services/cloudidentity/resource_cloud_identity_group_test.go.erb
@@ -34,6 +34,7 @@ func TestAccCloudIdentityGroup(t *testing.T) {
 <% end -%>
 		"data_source_basic":            testAccDataSourceCloudIdentityGroups_basicTest,
 		"data_source_membership_basic": testAccDataSourceCloudIdentityGroupMemberships_basicTest,
+		"data_source_group_lookup":     testAccDataSourceCloudIdentityGroupLookup_basicTest,
 	}
 
 	for name, tc := range testCases {
@@ -104,6 +105,10 @@ func testAccCloudIdentityGroup_cloudIdentityGroupsBasicExampleTest(t *testing.T)
 		Steps: []resource.TestStep{
 			{
 				Config: testAccCloudIdentityGroup_cloudIdentityGroupsBasicExample(context),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet("google_cloud_identity_group.cloud_identity_group_basic",
+						"additional_group_keys.#"),
+				),
 			},
 			{
 				ResourceName:            "google_cloud_identity_group.cloud_identity_group_basic",
@@ -124,7 +129,7 @@ resource "google_cloud_identity_group" "cloud_identity_group_basic" {
   parent = "customers/%{cust_id}"
 
   group_key {
-  	id = "tf-test-my-identity-group%{random_suffix}@%{org_domain}"
+    id = "tf-test-my-identity-group%{random_suffix}@%{org_domain}"
   }
 
   labels = {
diff --git a/mmv1/third_party/terraform/services/cloudids/resource_cloudids_endpoint_test.go b/mmv1/third_party/terraform/services/cloudids/resource_cloudids_endpoint_test.go
index 65153dada11c..9983e66e0feb 100644
--- a/mmv1/third_party/terraform/services/cloudids/resource_cloudids_endpoint_test.go
+++ b/mmv1/third_party/terraform/services/cloudids/resource_cloudids_endpoint_test.go
@@ -18,7 +18,7 @@ func TestAccCloudIdsEndpoint_basic(t *testing.T) {
 
 	context := map[string]interface{}{
 		"random_suffix": acctest.RandString(t, 10),
-		"network_name":  acctest.BootstrapSharedTestNetwork(t, "cloud-ids-endpoint"),
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "cloud-ids-endpoint-1"),
 	}
 
 	acctest.VcrTest(t, resource.TestCase{
@@ -51,18 +51,6 @@ func testCloudIds_basic(context map[string]interface{}) string {
 data "google_compute_network" "default" {
   name = "%{network_name}"
 }
-resource "google_compute_global_address" "service_range" {
-  name          = "tf-test-address%{random_suffix}"
-  purpose       = "VPC_PEERING"
-  address_type  = "INTERNAL"
-  prefix_length = 16
-  network       = data.google_compute_network.default.id
-}
-resource "google_service_networking_connection" "private_service_connection" {
-  network                 = data.google_compute_network.default.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.service_range.name]
-}
   
 resource "google_cloud_ids_endpoint" "endpoint" {
   name              = "cloud-ids-test-%{random_suffix}"
@@ -70,7 +58,6 @@ resource "google_cloud_ids_endpoint" "endpoint" {
   network           = data.google_compute_network.default.id
   severity          = "INFORMATIONAL"
   threat_exceptions = ["12", "67"]
-  depends_on        = [google_service_networking_connection.private_service_connection]
 }
 `, context)
 }
@@ -80,18 +67,6 @@ func testCloudIds_basicUpdate(context map[string]interface{}) string {
 data "google_compute_network" "default" {
   name = "%{network_name}"
 }
-resource "google_compute_global_address" "service_range" {
-  name          = "tf-test-address%{random_suffix}"
-  purpose       = "VPC_PEERING"
-  address_type  = "INTERNAL"
-  prefix_length = 16
-  network       = data.google_compute_network.default.id
-}
-resource "google_service_networking_connection" "private_service_connection" {
-  network                 = data.google_compute_network.default.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.service_range.name]
-}
   
 resource "google_cloud_ids_endpoint" "endpoint" {
   name              = "cloud-ids-test-%{random_suffix}"
@@ -99,7 +74,6 @@ resource "google_cloud_ids_endpoint" "endpoint" {
   network           = data.google_compute_network.default.id
   severity          = "INFORMATIONAL"
   threat_exceptions = ["33"]
-  depends_on        = [google_service_networking_connection.private_service_connection]
 }
 `, context)
 }
diff --git a/mmv1/third_party/terraform/services/cloudiot/resource_cloudiot_device_registry_id_test.go b/mmv1/third_party/terraform/services/cloudiot/resource_cloudiot_device_registry_id_test.go
deleted file mode 100644
index 41d926e421e0..000000000000
--- a/mmv1/third_party/terraform/services/cloudiot/resource_cloudiot_device_registry_id_test.go
+++ /dev/null
@@ -1,33 +0,0 @@
-package cloudiot_test
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/hashicorp/terraform-provider-google/google/services/cloudiot"
-	"github.com/hashicorp/terraform-provider-google/google/verify"
-)
-
-func TestValidateCloudIoTDeviceRegistryId(t *testing.T) {
-	x := []verify.StringValidationTestCase{
-		// No errors
-		{TestName: "basic", Value: "foobar"},
-		{TestName: "with numbers", Value: "foobar123"},
-		{TestName: "short", Value: "foo"},
-		{TestName: "long", Value: "foobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoo"},
-		{TestName: "has a hyphen", Value: "foo-bar"},
-
-		// With errors
-		{TestName: "empty", Value: "", ExpectError: true},
-		{TestName: "starts with a goog", Value: "googfoobar", ExpectError: true},
-		{TestName: "starts with a number", Value: "1foobar", ExpectError: true},
-		{TestName: "has an slash", Value: "foo/bar", ExpectError: true},
-		{TestName: "has an backslash", Value: "foo\bar", ExpectError: true},
-		{TestName: "too long", Value: strings.Repeat("f", 260), ExpectError: true},
-	}
-
-	es := verify.TestStringValidationCases(x, cloudiot.ValidateCloudIotDeviceRegistryID)
-	if len(es) > 0 {
-		t.Errorf("Failed to validate CloudIoT ID names: %v", es)
-	}
-}
diff --git a/mmv1/third_party/terraform/services/cloudiot/resource_cloudiot_device_update_test.go b/mmv1/third_party/terraform/services/cloudiot/resource_cloudiot_device_update_test.go
deleted file mode 100644
index 799b4a58c372..000000000000
--- a/mmv1/third_party/terraform/services/cloudiot/resource_cloudiot_device_update_test.go
+++ /dev/null
@@ -1,104 +0,0 @@
-package cloudiot_test
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-provider-google/google/acctest"
-)
-
-func TestAccCloudIoTDevice_update(t *testing.T) {
-	t.Parallel()
-
-	registryName := fmt.Sprintf("psregistry-test-%s", acctest.RandString(t, 10))
-	deviceName := fmt.Sprintf("psdevice-test-%s", acctest.RandString(t, 10))
-	resourceName := fmt.Sprintf("google_cloudiot_device.%s", deviceName)
-
-	acctest.VcrTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
-		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
-		CheckDestroy:             testAccCheckCloudIotDeviceDestroyProducer(t),
-		Steps: []resource.TestStep{
-			{
-				Config: testAccCloudIoTDeviceBasic(deviceName, registryName),
-			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
-			{
-				Config: testAccCloudIoTDeviceExtended(deviceName, registryName),
-			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
-			{
-				Config: testAccCloudIoTDeviceBasic(deviceName, registryName),
-			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
-		},
-	})
-}
-
-func testAccCloudIoTDeviceBasic(deviceName string, registryName string) string {
-	return fmt.Sprintf(`
-
-resource "google_cloudiot_registry" "%s" {
-  name = "%s"
-}
-
-resource "google_cloudiot_device" "%s" {
-  name     = "%s"
-  registry = google_cloudiot_registry.%s.id
-
-  gateway_config {
-    gateway_auth_method = "DEVICE_AUTH_TOKEN_ONLY"
-    gateway_type = "GATEWAY"
-  }
-}
-
-
-`, registryName, registryName, deviceName, deviceName, registryName)
-}
-
-func testAccCloudIoTDeviceExtended(deviceName string, registryName string) string {
-	return fmt.Sprintf(`
-
-resource "google_cloudiot_registry" "%s" {
-  name = "%s"
-}
-
-resource "google_cloudiot_device" "%s" {
-  name     = "%s"
-  registry = google_cloudiot_registry.%s.id
-
-  credentials {
-    public_key {
-      format = "RSA_PEM"
-      key = file("test-fixtures/rsa_public.pem")
-    }
-  }
-
-  blocked = false
-
-  log_level = "INFO"
-
-  metadata = {
-    test_key_1 = "test_value_1"
-  }
-
-  gateway_config {
-    gateway_auth_method = "ASSOCIATION_AND_DEVICE_AUTH_TOKEN"
-    gateway_type = "GATEWAY"
-  }
-}
-`, registryName, registryName, deviceName, deviceName, registryName)
-}
diff --git a/mmv1/third_party/terraform/services/cloudiot/resource_cloudiot_registry_update_test.go b/mmv1/third_party/terraform/services/cloudiot/resource_cloudiot_registry_update_test.go
deleted file mode 100644
index 9493f26bd4ca..000000000000
--- a/mmv1/third_party/terraform/services/cloudiot/resource_cloudiot_registry_update_test.go
+++ /dev/null
@@ -1,110 +0,0 @@
-package cloudiot_test
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-provider-google/google/acctest"
-)
-
-func TestAccCloudIoTRegistry_update(t *testing.T) {
-	t.Parallel()
-
-	registryName := fmt.Sprintf("psregistry-test-%s", acctest.RandString(t, 10))
-	resourceName := fmt.Sprintf("google_cloudiot_registry.%s", registryName)
-	deviceStatus := fmt.Sprintf("psregistry-test-devicestatus-%s", acctest.RandString(t, 10))
-	defaultTelemetry := fmt.Sprintf("psregistry-test-telemetry-%s", acctest.RandString(t, 10))
-	additionalTelemetry := fmt.Sprintf("psregistry-additional-test-telemetry-%s", acctest.RandString(t, 10))
-
-	acctest.VcrTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
-		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
-		CheckDestroy:             testAccCheckCloudIotDeviceRegistryDestroyProducer(t),
-		Steps: []resource.TestStep{
-			{
-				Config: testAccCloudIoTRegistryBasic(registryName),
-			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
-			{
-				Config: testAccCloudIoTRegistryExtended(registryName, deviceStatus, defaultTelemetry, additionalTelemetry),
-			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
-			{
-				Config: testAccCloudIoTRegistryBasic(registryName),
-			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
-		},
-	})
-}
-
-func testAccCloudIoTRegistryBasic(registryName string) string {
-	return fmt.Sprintf(`
-
-resource "google_cloudiot_registry" "%s" {
-  name = "%s"
-}
-`, registryName, registryName)
-}
-
-func testAccCloudIoTRegistryExtended(registryName string, deviceStatus string, defaultTelemetry string, additionalTelemetry string) string {
-	return fmt.Sprintf(`
-
-resource "google_pubsub_topic" "default-devicestatus" {
-  name = "psregistry-test-devicestatus-%s"
-}
-
-resource "google_pubsub_topic" "default-telemetry" {
-  name = "psregistry-test-telemetry-%s"
-}
-
-resource "google_pubsub_topic" "additional-telemetry" {
-  name = "psregistry-additional-test-telemetry-%s"
-}
-
-resource "google_cloudiot_registry" "%s" {
-  name     = "%s"
-
-  event_notification_configs {
-    pubsub_topic_name = google_pubsub_topic.additional-telemetry.id
-    subfolder_matches = "test/directory"
-  }
-
-  event_notification_configs {
-    pubsub_topic_name = google_pubsub_topic.default-telemetry.id
-    subfolder_matches = ""
-  }
-
-  state_notification_config = {
-    pubsub_topic_name = google_pubsub_topic.default-devicestatus.id
-  }
-
-  mqtt_config = {
-    mqtt_enabled_state = "MQTT_DISABLED"
-  }
-
-  http_config = {
-    http_enabled_state = "HTTP_DISABLED"
-  }
-
-  credentials {
-    public_key_certificate = {
-      format      = "X509_CERTIFICATE_PEM"
-      certificate = file("test-fixtures/rsa_cert.pem")
-    }
-  }
-}
-`, deviceStatus, defaultTelemetry, additionalTelemetry, registryName, registryName)
-}
diff --git a/mmv1/third_party/terraform/services/cloudiot/test-fixtures/rsa_cert.pem b/mmv1/third_party/terraform/services/cloudiot/test-fixtures/rsa_cert.pem
deleted file mode 100644
index d8a834633c91..000000000000
--- a/mmv1/third_party/terraform/services/cloudiot/test-fixtures/rsa_cert.pem
+++ /dev/null
@@ -1,17 +0,0 @@
------BEGIN CERTIFICATE-----
-MIICoDCCAYgCCQDzZ6R7RYs0sTANBgkqhkiG9w0BAQsFADARMQ8wDQYDVQQDDAZ1
-bnVzZWQwIBcNMTgwMTIwMTA0OTIzWhgPNDc1NTEyMTgxMDQ5MjNaMBExDzANBgNV
-BAMMBnVudXNlZDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMXX/5jI
-tvxpst1mFVKVXfyu5S5AOQF+i/ny6Ef+h8py8y42XfsE2AAPSTE3JCIgWemw7NQ/
-xnTQ3f6b7/6+ZsdM4/hoiedwYV8X3LVPB9NRnKe82OHUhzo1psVMJVvHtE3GsD/V
-i40ki/L4Xs64E2GJqQfrkgeNfIyCeKev64fR5aMazqOw1cNrVe34mY3L1hgXpn7e
-SnO0oqnV86pTh+jTT8EKgo9AI7/QuJbPWpJhnj1/Fm8i3DdCdpQqloX9Fc4f6whA
-XlZ2tkma0PsBraxMua5GPglJ7m3RabQIoyAW+4hEYAcu7U0wIhCK+C8WTNgEYZaK
-zvp8vK6vOgBIjE0CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAvVXus7dLikEAM6+I
-6xeN7aHEMJRR0h2rigLiYjfl8R9zG/zxUPUunWPAYaKvWOFviXcX/KqpjDqIIeWx
-Gm0yNfyalHq476nRCf/0t9AH5X4Qy0KJSW5KfhQLG9X2z/UiJxwHKCwaWZtEEzPu
-mGqvwhNXUOL/GuAZCJWPdWrUGM4kHHz3kw5v3UPNS2xA7yMtN9N1b8/pkTQ77XNk
-DA4wngA5zc7Ae72SJDrY8XXqLfL4Nagkrn6AOhGK3/Ewvca6hkThMcHI0WF2AqFo
-mo3iGUJzR5lOUx+4RiEBC5NNEZsE9GMNEiu8kYvCAS0FMKYmxFPGx1U/kiOeeuIw
-W3sOEA==
------END CERTIFICATE-----
diff --git a/mmv1/third_party/terraform/services/cloudiot/test-fixtures/rsa_public.pem b/mmv1/third_party/terraform/services/cloudiot/test-fixtures/rsa_public.pem
deleted file mode 100644
index 2b2acadf6760..000000000000
--- a/mmv1/third_party/terraform/services/cloudiot/test-fixtures/rsa_public.pem
+++ /dev/null
@@ -1,14 +0,0 @@
------BEGIN PUBLIC KEY-----
-MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAv6weC1aT16l2qS6qdYcy
-7BOjzP7TwT9zUAiFhWpL256GRqC8yQRdqMsi68Q//762IUyu/qaHbEgQ8WRmQdVV
-GDlxkBfrA/iXB2dgujq8jh0HWIV2ev3TerV3aUwvYUlrowhq027SX9U1hbufdGCM
-uKsHiF05ErgNvEuR8XAkeJ/YV2DV2+sRq+Wg9y4RwUYbdchdFty1d5SX/s0Yqswg
-yOG9VoCdR7baF22ughVR44aRm+83mgtqAZ4M+Rpe7JGRsUGY/pR391Toi0s8En15
-JGiAhqX2W0Uo/FZZry3yuqRfdHYENB+ADuyTMTrUaKZv7eua0lTBz5oom3jSF3gv
-I7SQoLdK/jhEVOOq41IjB8D60Sgd69bD7yTI516yvZ/s3AyKzW6f6KnjdbCcZKKT
-0GAePNLNhDYfSlA9bwJ8HQS2FenSpSTArKvGiVrsinJuNjbQdPuQHcpWf9x1m3GR
-TMvF+TNYM/lp7IL2VMbJRfWPy1iWxm9F1Yr6dkHVoLP7ocYkNRHoPLut5E6IFJtK
-lVI2NneUYJGnYSO+1xPV9TqlJeMNwr3uFMAN8N/oB3f4WWwuRYgR0L5g2A+Lvx+g
-bbdl+Tb/0CNfslfSuDrFV8Z4n6gVwb9ZPGlNHCvnqRfLUpRFJwmR7UYvzi/E7rXJ
-EDkK+tcnPkz2JtjdLKR7qVcCAwEAAQ==
------END PUBLIC KEY-----
diff --git a/mmv1/third_party/terraform/services/cloudrun/data_source_cloud_run_service.go b/mmv1/third_party/terraform/services/cloudrun/data_source_cloud_run_service.go
index f689e97107e4..c674b097723d 100644
--- a/mmv1/third_party/terraform/services/cloudrun/data_source_cloud_run_service.go
+++ b/mmv1/third_party/terraform/services/cloudrun/data_source_cloud_run_service.go
@@ -28,5 +28,14 @@ func dataSourceGoogleCloudRunServiceRead(d *schema.ResourceData, meta interface{
 		return fmt.Errorf("Error constructing id: %s", err)
 	}
 	d.SetId(id)
-	return resourceCloudRunServiceRead(d, meta)
+	err = resourceCloudRunServiceRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/cloudrun/resource_cloud_run_domain_mapping_test.go b/mmv1/third_party/terraform/services/cloudrun/resource_cloud_run_domain_mapping_test.go
index 743143b46db2..2fe19c6b500b 100644
--- a/mmv1/third_party/terraform/services/cloudrun/resource_cloud_run_domain_mapping_test.go
+++ b/mmv1/third_party/terraform/services/cloudrun/resource_cloud_run_domain_mapping_test.go
@@ -29,7 +29,7 @@ func TestAccCloudRunDomainMapping_foregroundDeletion(t *testing.T) {
 				ResourceName:            "google_cloud_run_domain_mapping.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name", "location", "status", "metadata.0.resource_version"},
+				ImportStateVerifyIgnore: []string{"name", "location", "status", "metadata.0.labels", "metadata.0.terraform_labels", "metadata.0.resource_version"},
 			},
 			{
 				Config: testAccCloudRunDomainMapping_cloudRunDomainMappingUpdated2(context),
@@ -38,7 +38,7 @@ func TestAccCloudRunDomainMapping_foregroundDeletion(t *testing.T) {
 				ResourceName:            "google_cloud_run_domain_mapping.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name", "location", "status", "metadata.0.resource_version"},
+				ImportStateVerifyIgnore: []string{"name", "location", "status", "metadata.0.labels", "metadata.0.terraform_labels", "metadata.0.resource_version"},
 			},
 		},
 	})
@@ -109,3 +109,35 @@ resource "google_cloud_run_domain_mapping" "default" {
 }
 `, context)
 }
+
+func TestAccCloudRunDomainMapping_migration(t *testing.T) {
+	acctest.SkipIfVcr(t)
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"namespace":     envvar.GetTestProjectFromEnv(),
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	oldVersion := map[string]resource.ExternalProvider{
+		"google": {
+			VersionConstraint: "4.84.0", // a version that doesn't separate user defined labels and system labels
+			Source:            "registry.terraform.io/hashicorp/google",
+		},
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:     func() { acctest.AccTestPreCheck(t) },
+		CheckDestroy: testAccCheckCloudRunDomainMappingDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config:            testAccCloudRunDomainMapping_cloudRunDomainMappingUpdated2(context),
+				ExternalProviders: oldVersion,
+			},
+			{
+				Config:                   testAccCloudRunDomainMapping_cloudRunDomainMappingUpdated2(context),
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+			},
+		},
+	})
+}
diff --git a/mmv1/third_party/terraform/services/cloudrun/resource_cloud_run_service_test.go.erb b/mmv1/third_party/terraform/services/cloudrun/resource_cloud_run_service_test.go.erb
index 0556789b6735..7dcd04a4a01c 100644
--- a/mmv1/third_party/terraform/services/cloudrun/resource_cloud_run_service_test.go.erb
+++ b/mmv1/third_party/terraform/services/cloudrun/resource_cloud_run_service_test.go.erb
@@ -27,7 +27,7 @@ func TestAccCloudRunService_cloudRunServiceUpdate(t *testing.T) {
 				ResourceName:            "google_cloud_run_service.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "status.0.conditions"},
+				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "metadata.0.annotations", "metadata.0.labels", "metadata.0.terraform_labels", "status.0.conditions"},
 			},
 			{
 				Config: testAccCloudRunService_cloudRunServiceUpdate(name, project, "50", "300"),
@@ -36,7 +36,7 @@ func TestAccCloudRunService_cloudRunServiceUpdate(t *testing.T) {
 				ResourceName:            "google_cloud_run_service.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "status.0.conditions"},
+				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "metadata.0.annotations", "metadata.0.labels", "metadata.0.terraform_labels", "status.0.conditions"},
 			},
 		},
 	})
@@ -61,7 +61,7 @@ func TestAccCloudRunService_cloudRunServiceCreateHasStatus(t *testing.T) {
 				ResourceName:            "google_cloud_run_service.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "status.0.conditions"},
+				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "status.0.conditions", "metadata.0.annotations", "metadata.0.labels", "metadata.0.terraform_labels"},
 			},
 		},
 	})
@@ -85,7 +85,7 @@ func TestAccCloudRunService_foregroundDeletion(t *testing.T) {
 				ResourceName:            "google_cloud_run_service.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "status.0.conditions"},
+				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "metadata.0.annotations", "metadata.0.labels", "metadata.0.terraform_labels", "status.0.conditions"},
 			},
 			{
 				Config: " ", // very explicitly add a space, as the test runner fails if this is just ""
@@ -97,7 +97,7 @@ func TestAccCloudRunService_foregroundDeletion(t *testing.T) {
 				ResourceName:            "google_cloud_run_service.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "status.0.conditions"},
+				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "metadata.0.annotations", "metadata.0.labels", "metadata.0.terraform_labels", "status.0.conditions"},
 			},
 		},
 	})
@@ -110,10 +110,14 @@ resource "google_cloud_run_service" "default" {
   location = "us-central1"
 
   metadata {
-  namespace = "%s"
-  annotations = {
+    namespace = "%s"
+    annotations = {
       generated-by = "magic-modules"
     }
+    labels = {
+      env                   = "foo"
+      default_expiration_ms = 3600000
+    }
   }
 
   template {
@@ -161,7 +165,7 @@ func TestAccCloudRunService_secretVolume(t *testing.T) {
 				ResourceName:            "google_cloud_run_service.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "status.0.conditions"},
+				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "metadata.0.annotations", "metadata.0.labels", "metadata.0.terraform_labels", "status.0.conditions"},
 			},
 			{
 				Config: testAccCloudRunService_cloudRunServiceUpdateWithSecretVolume(name, project, "secret-"+acctest.RandString(t, 10), "secret-"+acctest.RandString(t, 11), "google_secret_manager_secret.secret2.secret_id"),
@@ -170,7 +174,7 @@ func TestAccCloudRunService_secretVolume(t *testing.T) {
 				ResourceName:            "google_cloud_run_service.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "status.0.conditions"},
+				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "metadata.0.annotations", "metadata.0.labels", "metadata.0.terraform_labels", "status.0.conditions"},
 			},
 		},
 	})
@@ -184,14 +188,14 @@ data "google_project" "project" {
 resource "google_secret_manager_secret" "secret1" {
   secret_id = "%s"
   replication {
-    automatic = true
+    auto {}
   }
 }
 
 resource "google_secret_manager_secret" "secret2" {
   secret_id = "%s"
   replication {
-    automatic = true
+    auto {}
   }
 }
 
@@ -285,7 +289,7 @@ func TestAccCloudRunService_secretEnvironmentVariable(t *testing.T) {
 				ResourceName:            "google_cloud_run_service.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "status.0.conditions"},
+				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "metadata.0.annotations", "metadata.0.labels", "metadata.0.terraform_labels", "status.0.conditions"},
 			},
 			{
 				Config: testAccCloudRunService_cloudRunServiceUpdateWithSecretEnvVar(name, project, "secret-"+acctest.RandString(t, 10), "secret-"+acctest.RandString(t, 11), "google_secret_manager_secret.secret2.secret_id"),
@@ -294,7 +298,7 @@ func TestAccCloudRunService_secretEnvironmentVariable(t *testing.T) {
 				ResourceName:            "google_cloud_run_service.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "status.0.conditions"},
+				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "metadata.0.annotations", "metadata.0.labels", "metadata.0.terraform_labels", "status.0.conditions"},
 			},
 		},
 	})
@@ -308,14 +312,14 @@ data "google_project" "project" {
 resource "google_secret_manager_secret" "secret1" {
   secret_id = "%s"
   replication {
-    automatic = true
+    auto {}
   }
 }
 
 resource "google_secret_manager_secret" "secret2" {
   secret_id = "%s"
   replication {
-    automatic = true
+    auto {}
   }
 }
 
@@ -387,6 +391,314 @@ resource "google_cloud_run_service" "default" {
 `, secretName1, secretName2, name, secretRef, project)
 }
 
+func TestAccCloudRunService_withProviderDefaultLabels(t *testing.T) {
+  // The test failed if VCR testing is enabled, because the cached provider config is used.
+	// With the cached provider config, any changes in the provider default labels will not be applied.
+	acctest.SkipIfVcr(t)
+	t.Parallel()
+
+  context := map[string]interface{}{
+    "project":       envvar.GetTestProjectFromEnv(),
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCloudRunService_withProviderDefaultLabels(context),
+        Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.labels.%", "2"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.labels.default_expiration_ms", "3600000"),
+
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.terraform_labels.%", "3"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.terraform_labels.default_key1", "default_value1"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.terraform_labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.terraform_labels.default_expiration_ms", "3600000"),
+
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.effective_labels.%", "4"),
+
+          resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.annotations.%", "1"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.annotations.generated-by", "magic-modules"),
+          resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.effective_annotations.%", "6"),
+				),
+			},
+			{
+				ResourceName:            "google_cloud_run_service.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "metadata.0.annotations", "metadata.0.labels", "metadata.0.terraform_labels", "status.0.conditions"},
+			},
+			{
+				Config: testAccCloudRunService_resourceLabelsOverridesProviderDefaultLabels(context),
+        Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.labels.%", "3"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.labels.default_expiration_ms", "3600000"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.labels.default_key1", "value1"),
+
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.terraform_labels.%", "3"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.terraform_labels.default_key1", "value1"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.terraform_labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.terraform_labels.default_expiration_ms", "3600000"),
+
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.effective_labels.%", "4"),
+
+          resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.annotations.%", "1"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.annotations.generated-by", "magic-modules-update"),
+          resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.effective_annotations.%", "6"),
+				),
+			},
+			{
+				ResourceName:            "google_cloud_run_service.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "metadata.0.annotations", "metadata.0.labels", "metadata.0.terraform_labels", "status.0.conditions"},
+			},
+      {
+				Config: testAccCloudRunService_moveResourceLabelToProviderDefaultLabels(context),
+        Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.labels.%", "2"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.labels.default_expiration_ms", "3600000"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.labels.default_key1", "value1"),
+
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.terraform_labels.%", "3"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.terraform_labels.default_key1", "value1"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.terraform_labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.terraform_labels.default_expiration_ms", "3600000"),
+
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.effective_labels.%", "4"),
+				),
+			},
+			{
+				ResourceName:            "google_cloud_run_service.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "metadata.0.annotations", "metadata.0.labels", "metadata.0.terraform_labels", "status.0.conditions"},
+			},
+      {
+				Config: testAccCloudRunService_resourceLabelsOverridesProviderDefaultLabels(context),
+        Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.labels.%", "3"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.labels.default_expiration_ms", "3600000"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.labels.default_key1", "value1"),
+
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.terraform_labels.%", "3"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.terraform_labels.default_key1", "value1"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.terraform_labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.terraform_labels.default_expiration_ms", "3600000"),
+
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.effective_labels.%", "4"),
+				),
+			},
+			{
+				ResourceName:            "google_cloud_run_service.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "metadata.0.annotations", "metadata.0.labels", "metadata.0.terraform_labels", "status.0.conditions"},
+			},
+      {
+				Config: testAccCloudRunService_cloudRunServiceBasic(context),
+        Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckNoResourceAttr("google_cloud_run_service.default", "metadata.0.labels.%"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.effective_labels.%", "1"),
+
+          resource.TestCheckNoResourceAttr("google_cloud_run_service.default", "metadata.0.annotations.%"),
+          resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.effective_annotations.%", "5"),
+				),
+			},
+			{
+				ResourceName:            "google_cloud_run_service.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "metadata.0.annotations", "metadata.0.labels", "metadata.0.terraform_labels", "status.0.conditions"},
+			},
+		},
+	})
+}
+
+func TestAccCloudRunServiceMigration_withLabels(t *testing.T) {
+	acctest.SkipIfVcr(t)
+	t.Parallel()
+
+  name := "tftest-cloudrun-" + acctest.RandString(t, 6)
+  project := envvar.GetTestProjectFromEnv()
+	oldVersion := map[string]resource.ExternalProvider{
+		"google": {
+			VersionConstraint: "4.83.0", // a version that doesn't separate user defined labels and system labels
+			Source:            "registry.terraform.io/hashicorp/google",
+		},
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:     func() { acctest.AccTestPreCheck(t) },
+		Steps: []resource.TestStep{
+			{
+				Config:            testAccCloudRunService_cloudRunServiceUpdate(name, project, "10", "600"),
+				ExternalProviders: oldVersion,
+			},
+			{
+				Config:                   testAccCloudRunService_cloudRunServiceUpdate(name, project, "10", "600"),
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.labels.%", "2"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.effective_labels.%", "3"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.annotations.%", "1"),
+					resource.TestCheckResourceAttr("google_cloud_run_service.default", "metadata.0.effective_annotations.%", "6"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCloudRunService_withProviderDefaultLabels(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+provider "google" {
+  default_labels = {
+    default_key1 = "default_value1"
+  }
+}
+
+resource "google_cloud_run_service" "default" {
+  name     = "tf-test-cloudrun-srv%{random_suffix}"
+  location = "us-central1"
+
+  template {
+    spec {
+      containers {
+        image = "us-docker.pkg.dev/cloudrun/container/hello"
+      }
+    }
+  }
+
+  metadata {
+    namespace = "%{project}"
+    annotations = {
+      generated-by = "magic-modules"
+    }
+    labels = {
+      env                   = "foo"
+      default_expiration_ms = 3600000
+    }
+  }
+
+  traffic {
+    percent         = 100
+    latest_revision = true
+  }
+}
+`, context)
+}
+
+func testAccCloudRunService_resourceLabelsOverridesProviderDefaultLabels(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+provider "google" {
+  default_labels = {
+    default_key1 = "default_value1"
+  }
+}
+
+resource "google_cloud_run_service" "default" {
+  name     = "tf-test-cloudrun-srv%{random_suffix}"
+  location = "us-central1"
+
+  template {
+    spec {
+      containers {
+        image = "us-docker.pkg.dev/cloudrun/container/hello"
+      }
+    }
+  }
+
+  metadata {
+    namespace = "%{project}"
+    annotations = {
+      generated-by = "magic-modules-update"
+    }
+    labels = {
+      env                   = "foo"
+      default_expiration_ms = 3600000
+      default_key1          = "value1"
+    }
+  }
+
+  traffic {
+    percent         = 100
+    latest_revision = true
+  }
+}
+`, context)
+}
+
+func testAccCloudRunService_moveResourceLabelToProviderDefaultLabels(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+provider "google" {
+  default_labels = {
+    default_key1 = "default_value1"
+    env          = "foo"
+  }
+}
+
+resource "google_cloud_run_service" "default" {
+  name     = "tf-test-cloudrun-srv%{random_suffix}"
+  location = "us-central1"
+
+  template {
+    spec {
+      containers {
+        image = "us-docker.pkg.dev/cloudrun/container/hello"
+      }
+    }
+  }
+
+  metadata {
+    namespace = "%{project}"
+    annotations = {
+      generated-by = "magic-modules"
+    }
+    labels = {
+      default_expiration_ms = 3600000
+      default_key1          = "value1"
+    }
+  }
+
+  traffic {
+    percent         = 100
+    latest_revision = true
+  }
+}
+`, context)
+}
+
+func testAccCloudRunService_cloudRunServiceBasic(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_cloud_run_service" "default" {
+  name     = "tf-test-cloudrun-srv%{random_suffix}"
+  location = "us-central1"
+
+  template {
+    spec {
+      containers {
+        image = "us-docker.pkg.dev/cloudrun/container/hello"
+      }
+    }
+  }
+
+  metadata {
+    namespace = "%{project}"
+  }
+
+  traffic {
+    percent         = 100
+    latest_revision = true
+  }
+}
+`, context)
+}
+
 <% unless version == 'ga' -%>
 
 func TestAccCloudRunService_probes(t *testing.T) {
@@ -406,7 +718,7 @@ func TestAccCloudRunService_probes(t *testing.T) {
 				ResourceName:            "google_cloud_run_service.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "status.0.conditions"},
+				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "metadata.0.annotations", "metadata.0.labels", "metadata.0.terraform_labels", "status.0.conditions"},
 			},
 			{
 				Config: testAccCloudRunService_cloudRunServiceUpdateWithTCPStartupProbeAndHTTPLivenessProbe(name, project, "2", "1", "5", "2"),
@@ -415,7 +727,7 @@ func TestAccCloudRunService_probes(t *testing.T) {
 				ResourceName:            "google_cloud_run_service.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "status.0.conditions"},
+				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "metadata.0.annotations", "metadata.0.labels", "metadata.0.terraform_labels", "status.0.conditions"},
 			},
       {
 				Config: testAccCloudRunService_cloudRunServiceUpdateWithEmptyHTTPStartupProbe(name, project),
@@ -424,7 +736,7 @@ func TestAccCloudRunService_probes(t *testing.T) {
 				ResourceName:            "google_cloud_run_service.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "status.0.conditions"},
+				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "metadata.0.annotations", "metadata.0.labels", "metadata.0.terraform_labels", "status.0.conditions"},
 			},
       {
 				Config: testAccCloudRunService_cloudRunServiceUpdateWithHTTPStartupProbe(name, project),
@@ -433,7 +745,7 @@ func TestAccCloudRunService_probes(t *testing.T) {
 				ResourceName:            "google_cloud_run_service.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "status.0.conditions"},
+				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "metadata.0.annotations", "metadata.0.labels", "metadata.0.terraform_labels", "status.0.conditions"},
 			},
       {
 				Config: testAccCloudRunService_cloudRunServiceUpdateWithEmptyGRPCLivenessProbe(name, project),
@@ -442,7 +754,7 @@ func TestAccCloudRunService_probes(t *testing.T) {
 				ResourceName:            "google_cloud_run_service.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "status.0.conditions"},
+				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "metadata.0.annotations", "metadata.0.labels", "metadata.0.terraform_labels", "status.0.conditions"},
 			},
       {
 				Config: testAccCloudRunService_cloudRunServiceUpdateWithGRPCLivenessProbe(name, project),
@@ -451,7 +763,7 @@ func TestAccCloudRunService_probes(t *testing.T) {
 				ResourceName:            "google_cloud_run_service.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "status.0.conditions"},
+				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "metadata.0.annotations", "metadata.0.labels", "metadata.0.terraform_labels", "status.0.conditions"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/cloudrunv2/data_source_google_cloud_run_v2_job.go b/mmv1/third_party/terraform/services/cloudrunv2/data_source_google_cloud_run_v2_job.go
new file mode 100644
index 000000000000..3076a9e9d721
--- /dev/null
+++ b/mmv1/third_party/terraform/services/cloudrunv2/data_source_google_cloud_run_v2_job.go
@@ -0,0 +1,52 @@
+package cloudrunv2
+
+import (
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
+)
+
+func DataSourceGoogleCloudRunV2Job() *schema.Resource {
+	dsSchema := tpgresource.DatasourceSchemaFromResourceSchema(ResourceCloudRunV2Job().Schema)
+	tpgresource.AddRequiredFieldsToSchema(dsSchema, "name")
+	tpgresource.AddOptionalFieldsToSchema(dsSchema, "location")
+
+	// Set 'Optional' schema elements
+	tpgresource.AddOptionalFieldsToSchema(dsSchema, "project")
+
+	return &schema.Resource{
+		Read:   dataSourceGoogleCloudRunV2JobRead,
+		Schema: dsSchema,
+	}
+}
+
+func dataSourceGoogleCloudRunV2JobRead(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*transport_tpg.Config)
+
+	id, err := tpgresource.ReplaceVars(d, config, "projects/{{project}}/locations/{{location}}/jobs/{{name}}")
+	if err != nil {
+		return fmt.Errorf("Error constructing id: %s", err)
+	}
+
+	d.SetId(id)
+
+	err = resourceCloudRunV2JobRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if err := tpgresource.SetDataSourceLabels(d); err != nil {
+		return err
+	}
+
+	if err := tpgresource.SetDataSourceAnnotations(d); err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
+}
diff --git a/mmv1/third_party/terraform/services/cloudrunv2/data_source_google_cloud_run_v2_job_test.go b/mmv1/third_party/terraform/services/cloudrunv2/data_source_google_cloud_run_v2_job_test.go
new file mode 100644
index 000000000000..5e2044eb37f1
--- /dev/null
+++ b/mmv1/third_party/terraform/services/cloudrunv2/data_source_google_cloud_run_v2_job_test.go
@@ -0,0 +1,139 @@
+package cloudrunv2_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+	"github.com/hashicorp/terraform-provider-google/google/envvar"
+)
+
+func TestAccDataSourceGoogleCloudRunV2Job_basic(t *testing.T) {
+	t.Parallel()
+
+	project := envvar.GetTestProjectFromEnv()
+
+	name := fmt.Sprintf("tf-test-cloud-run-v2-job-%d", acctest.RandInt(t))
+	location := "us-central1"
+	id := fmt.Sprintf("projects/%s/locations/%s/jobs/%s", project, location, name)
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDataSourceGoogleCloudRunV2Job_basic(name, location),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("data.google_cloud_run_v2_job.hello", "id", id),
+					resource.TestCheckResourceAttr("data.google_cloud_run_v2_job.hello", "name", name),
+					resource.TestCheckResourceAttr("data.google_cloud_run_v2_job.hello", "location", location),
+				),
+			},
+		},
+	})
+}
+
+func testAccDataSourceGoogleCloudRunV2Job_basic(name, location string) string {
+	return fmt.Sprintf(`
+resource "google_cloud_run_v2_job" "hello" {
+  name     = "%s"
+  location = "%s"
+
+  template {
+    template {
+      containers {
+        image = "us-docker.pkg.dev/cloudrun/container/hello"
+      }
+    }
+  }
+
+  labels = {
+    "key" = "value"
+  }
+
+  annotations = {
+    "key" = "value"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      launch_stage,
+    ]
+  }
+}
+
+data "google_cloud_run_v2_job" "hello" {
+  name     = google_cloud_run_v2_job.hello.name
+  location = google_cloud_run_v2_job.hello.location
+}
+`, name, location)
+}
+
+func TestAccDataSourceGoogleCloudRunV2Job_bindIAMPermission(t *testing.T) {
+	t.Parallel()
+
+	project := envvar.GetTestProjectFromEnv()
+
+	name := fmt.Sprintf("tf-test-cloud-run-v2-job-%d", acctest.RandInt(t))
+	location := "us-central1"
+	id := fmt.Sprintf("projects/%s/locations/%s/jobs/%s", project, location, name)
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDataSourceGoogleCloudRunV2Job_bindIAMPermission(name, location),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("data.google_cloud_run_v2_job.hello", "id", id),
+					resource.TestCheckResourceAttr("data.google_cloud_run_v2_job.hello", "name", name),
+					resource.TestCheckResourceAttr("data.google_cloud_run_v2_job.hello", "location", location),
+				),
+			},
+		},
+	})
+}
+
+func testAccDataSourceGoogleCloudRunV2Job_bindIAMPermission(name, location string) string {
+	return fmt.Sprintf(`
+resource "google_cloud_run_v2_job" "hello" {
+  name     = "%s"
+  location = "%s"
+
+  template {
+    template {
+      containers {
+        image = "us-docker.pkg.dev/cloudrun/container/hello"
+      }
+    }
+  }
+
+  lifecycle {
+    ignore_changes = [
+      launch_stage,
+    ]
+  }
+}
+
+data "google_cloud_run_v2_job" "hello" {
+  name     = google_cloud_run_v2_job.hello.name
+  location = google_cloud_run_v2_job.hello.location
+}
+
+resource "google_service_account" "foo" {
+  account_id   = "foo-service-account"
+  display_name = "foo-service-account"
+}
+
+resource "google_cloud_run_v2_job_iam_binding" "foo_run_invoker" {
+  name     = data.google_cloud_run_v2_job.hello.name
+  location = data.google_cloud_run_v2_job.hello.location
+
+  role     = "roles/run.invoker"
+  members = [
+    "serviceAccount:${google_service_account.foo.email}",
+  ]
+}
+`, name, location)
+}
diff --git a/mmv1/third_party/terraform/services/cloudrunv2/data_source_google_cloud_run_v2_service.go b/mmv1/third_party/terraform/services/cloudrunv2/data_source_google_cloud_run_v2_service.go
new file mode 100644
index 000000000000..3eade1bee87f
--- /dev/null
+++ b/mmv1/third_party/terraform/services/cloudrunv2/data_source_google_cloud_run_v2_service.go
@@ -0,0 +1,52 @@
+package cloudrunv2
+
+import (
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
+)
+
+func DataSourceGoogleCloudRunV2Service() *schema.Resource {
+	dsSchema := tpgresource.DatasourceSchemaFromResourceSchema(ResourceCloudRunV2Service().Schema)
+	tpgresource.AddRequiredFieldsToSchema(dsSchema, "name")
+	tpgresource.AddOptionalFieldsToSchema(dsSchema, "location")
+
+	// Set 'Optional' schema elements
+	tpgresource.AddOptionalFieldsToSchema(dsSchema, "project")
+
+	return &schema.Resource{
+		Read:   dataSourceGoogleCloudRunV2ServiceRead,
+		Schema: dsSchema,
+	}
+}
+
+func dataSourceGoogleCloudRunV2ServiceRead(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*transport_tpg.Config)
+
+	id, err := tpgresource.ReplaceVars(d, config, "projects/{{project}}/locations/{{location}}/services/{{name}}")
+	if err != nil {
+		return fmt.Errorf("Error constructing id: %s", err)
+	}
+
+	d.SetId(id)
+
+	err = resourceCloudRunV2ServiceRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if err := tpgresource.SetDataSourceLabels(d); err != nil {
+		return err
+	}
+
+	if err := tpgresource.SetDataSourceAnnotations(d); err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
+}
diff --git a/mmv1/third_party/terraform/services/cloudrunv2/data_source_google_cloud_run_v2_service_test.go b/mmv1/third_party/terraform/services/cloudrunv2/data_source_google_cloud_run_v2_service_test.go
new file mode 100644
index 000000000000..7f7a4d5129c9
--- /dev/null
+++ b/mmv1/third_party/terraform/services/cloudrunv2/data_source_google_cloud_run_v2_service_test.go
@@ -0,0 +1,125 @@
+package cloudrunv2_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+	"github.com/hashicorp/terraform-provider-google/google/envvar"
+)
+
+func TestAccDataSourceGoogleCloudRunV2Service_basic(t *testing.T) {
+	t.Parallel()
+
+	project := envvar.GetTestProjectFromEnv()
+
+	name := fmt.Sprintf("tf-test-cloud-run-v2-service-%d", acctest.RandInt(t))
+	location := "us-central1"
+	id := fmt.Sprintf("projects/%s/locations/%s/services/%s", project, location, name)
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDataSourceGoogleCloudRunV2Service_basic(name, location),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("data.google_cloud_run_v2_service.hello", "id", id),
+					resource.TestCheckResourceAttr("data.google_cloud_run_v2_service.hello", "name", name),
+					resource.TestCheckResourceAttr("data.google_cloud_run_v2_service.hello", "location", location),
+				),
+			},
+		},
+	})
+}
+
+func testAccDataSourceGoogleCloudRunV2Service_basic(name, location string) string {
+	return fmt.Sprintf(`
+resource "google_cloud_run_v2_service" "hello" {
+  name     = "%s"
+  location = "%s"
+  ingress  = "INGRESS_TRAFFIC_ALL"
+  
+  template {
+    containers {
+      image = "us-docker.pkg.dev/cloudrun/container/hello"
+    }
+  }
+
+  labels = {
+    "key" = "value"
+  }
+
+  annotations = {
+    "key" = "value"
+  }
+}
+
+data "google_cloud_run_v2_service" "hello" {
+  name     = google_cloud_run_v2_service.hello.name
+  location = google_cloud_run_v2_service.hello.location
+}
+`, name, location)
+}
+
+func TestAccDataSourceGoogleCloudRunV2Service_bindIAMPermission(t *testing.T) {
+	t.Parallel()
+
+	project := envvar.GetTestProjectFromEnv()
+
+	name := fmt.Sprintf("tf-test-cloud-run-v2-service-%d", acctest.RandInt(t))
+	location := "us-central1"
+	id := fmt.Sprintf("projects/%s/locations/%s/services/%s", project, location, name)
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDataSourceGoogleCloudRunV2Service_bindIAMPermission(name, location),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("data.google_cloud_run_v2_service.hello", "id", id),
+					resource.TestCheckResourceAttr("data.google_cloud_run_v2_service.hello", "name", name),
+					resource.TestCheckResourceAttr("data.google_cloud_run_v2_service.hello", "location", location),
+				),
+			},
+		},
+	})
+}
+
+func testAccDataSourceGoogleCloudRunV2Service_bindIAMPermission(name, location string) string {
+	return fmt.Sprintf(`
+resource "google_cloud_run_v2_service" "hello" {
+  name     = "%s"
+  location = "%s"
+  ingress  = "INGRESS_TRAFFIC_ALL"
+  
+  template {
+    containers {
+      image = "us-docker.pkg.dev/cloudrun/container/hello"
+    }
+  }
+}
+
+data "google_cloud_run_v2_service" "hello" {
+  name     = google_cloud_run_v2_service.hello.name
+  location = google_cloud_run_v2_service.hello.location
+}
+
+resource "google_service_account" "foo" {
+  account_id   = "foo-service-account"
+  display_name = "foo-service-account"
+}
+
+resource "google_cloud_run_v2_service_iam_binding" "foo_run_invoker" {
+  name     = data.google_cloud_run_v2_service.hello.name
+  location = data.google_cloud_run_v2_service.hello.location
+
+  role = "roles/run.invoker"
+  members = [
+    "serviceAccount:${google_service_account.foo.email}",
+  ]
+}
+`, name, location)
+}
diff --git a/mmv1/third_party/terraform/services/cloudrunv2/resource_cloud_run_v2_job_test.go b/mmv1/third_party/terraform/services/cloudrunv2/resource_cloud_run_v2_job_test.go
index a874e89e16ff..5f4ea13f0a54 100644
--- a/mmv1/third_party/terraform/services/cloudrunv2/resource_cloud_run_v2_job_test.go
+++ b/mmv1/third_party/terraform/services/cloudrunv2/resource_cloud_run_v2_job_test.go
@@ -1,6 +1,7 @@
 package cloudrunv2_test
 
 import (
+	"fmt"
 	"testing"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
@@ -26,7 +27,7 @@ func TestAccCloudRunV2Job_cloudrunv2JobFullUpdate(t *testing.T) {
 				ResourceName:            "google_cloud_run_v2_job.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"location", "launch_stage"},
+				ImportStateVerifyIgnore: []string{"location", "launch_stage", "labels", "terraform_labels", "annotations"},
 			},
 			{
 				Config: testAccCloudRunV2Job_cloudrunv2JobFullUpdate(context),
@@ -35,7 +36,7 @@ func TestAccCloudRunV2Job_cloudrunv2JobFullUpdate(t *testing.T) {
 				ResourceName:            "google_cloud_run_v2_job.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"location", "launch_stage"},
+				ImportStateVerifyIgnore: []string{"location", "launch_stage", "labels", "terraform_labels", "annotations"},
 			},
 		},
 	})
@@ -204,3 +205,96 @@ resource "google_compute_network" "custom_test" {
 }
 `, context)
 }
+
+func TestAccCloudRunV2Job_cloudrunv2JobWithDirectVPCUpdate(t *testing.T) {
+	t.Parallel()
+
+	jobName := fmt.Sprintf("tf-test-cloudrun-service%s", acctest.RandString(t, 10))
+	context := map[string]interface{}{
+		"job_name": jobName,
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckCloudRunV2JobDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCloudRunV2Job_cloudrunv2JobWithDirectVPC(context),
+			},
+			{
+				ResourceName:            "google_cloud_run_v2_job.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"location", "launch_stage"},
+			},
+			{
+				Config: testAccCloudRunV2Job_cloudrunv2JobWithDirectVPCUpdate(context),
+			},
+			{
+				ResourceName:            "google_cloud_run_v2_job.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"location", "launch_stage"},
+			},
+		},
+	})
+}
+
+func testAccCloudRunV2Job_cloudrunv2JobWithDirectVPC(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+  resource "google_cloud_run_v2_job" "default" {
+    name     = "%{job_name}"
+    location = "us-central1"
+    launch_stage = "BETA"
+    template {
+      template {
+        containers {
+          image = "us-docker.pkg.dev/cloudrun/container/job"
+        }
+        vpc_access {
+          network_interfaces {
+            network = "default"
+          }
+        }
+      }
+    }
+
+    lifecycle {
+      ignore_changes = [
+        launch_stage,
+      ]
+    }
+  }
+`, context)
+}
+
+func testAccCloudRunV2Job_cloudrunv2JobWithDirectVPCUpdate(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+  resource "google_cloud_run_v2_job" "default" {
+    name     = "%{job_name}"
+    location = "us-central1"
+    launch_stage = "BETA"
+    template {
+      template {
+        containers {
+          image = "us-docker.pkg.dev/cloudrun/container/job"
+        }
+        vpc_access {
+          network_interfaces {
+            network = "my-network"
+            subnetwork = "my-network"
+            tags = ["tag1", "tag2", "tag3"]
+          }
+        }
+      }
+    }
+
+    lifecycle {
+      ignore_changes = [
+        launch_stage,
+      ]
+    }
+  }
+`, context)
+}
diff --git a/mmv1/third_party/terraform/services/cloudrunv2/resource_cloud_run_v2_service_test.go b/mmv1/third_party/terraform/services/cloudrunv2/resource_cloud_run_v2_service_test.go.erb
similarity index 76%
rename from mmv1/third_party/terraform/services/cloudrunv2/resource_cloud_run_v2_service_test.go
rename to mmv1/third_party/terraform/services/cloudrunv2/resource_cloud_run_v2_service_test.go.erb
index 00ddd0472239..15a8c8ee923e 100644
--- a/mmv1/third_party/terraform/services/cloudrunv2/resource_cloud_run_v2_service_test.go
+++ b/mmv1/third_party/terraform/services/cloudrunv2/resource_cloud_run_v2_service_test.go.erb
@@ -1,3 +1,4 @@
+<% autogen_exception -%>
 package cloudrunv2_test
 
 import (
@@ -30,7 +31,7 @@ func TestAccCloudRunV2Service_cloudrunv2ServiceFullUpdate(t *testing.T) {
 				ResourceName:            "google_cloud_run_v2_service.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name", "location"},
+				ImportStateVerifyIgnore: []string{"name", "location", "annotations", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccCloudRunV2Service_cloudrunv2ServiceFullUpdate(context),
@@ -39,7 +40,7 @@ func TestAccCloudRunV2Service_cloudrunv2ServiceFullUpdate(t *testing.T) {
 				ResourceName:            "google_cloud_run_v2_service.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name", "location"},
+				ImportStateVerifyIgnore: []string{"name", "location", "annotations", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -227,7 +228,7 @@ func TestAccCloudRunV2Service_cloudrunv2ServiceTCPProbesUpdate(t *testing.T) {
 				ResourceName:            "google_cloud_run_v2_service.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name", "location"},
+				ImportStateVerifyIgnore: []string{"name", "location", "annotations"},
 			},
 			{
 				Config: testAccCloudRunV2Service_cloudrunv2ServiceUpdateWithTCPStartupProbeAndHTTPLivenessProbe(context),
@@ -236,7 +237,7 @@ func TestAccCloudRunV2Service_cloudrunv2ServiceTCPProbesUpdate(t *testing.T) {
 				ResourceName:            "google_cloud_run_v2_service.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name", "location"},
+				ImportStateVerifyIgnore: []string{"name", "location", "annotations"},
 			},
 		},
 	})
@@ -261,7 +262,7 @@ func TestAccCloudRunV2Service_cloudrunv2ServiceHTTPProbesUpdate(t *testing.T) {
 				ResourceName:            "google_cloud_run_v2_service.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name", "location"},
+				ImportStateVerifyIgnore: []string{"name", "location", "annotations"},
 			},
 			{
 				Config: testAccCloudRunV2Service_cloudrunv2ServiceUpdateWithHTTPStartupProbe(context),
@@ -270,7 +271,7 @@ func TestAccCloudRunV2Service_cloudrunv2ServiceHTTPProbesUpdate(t *testing.T) {
 				ResourceName:            "google_cloud_run_v2_service.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name", "location"},
+				ImportStateVerifyIgnore: []string{"name", "location", "annotations"},
 			},
 		},
 	})
@@ -296,7 +297,7 @@ func TestAccCloudRunV2Service_cloudrunv2ServiceGRPCProbesUpdate(t *testing.T) {
 				ResourceName:            "google_cloud_run_v2_service.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name", "location"},
+				ImportStateVerifyIgnore: []string{"name", "location", "annotations"},
 			},
 			{
 				Config: testAccCloudRunV2Service_cloudRunServiceUpdateWithGRPCLivenessProbe(context),
@@ -305,7 +306,7 @@ func TestAccCloudRunV2Service_cloudrunv2ServiceGRPCProbesUpdate(t *testing.T) {
 				ResourceName:            "google_cloud_run_v2_service.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name", "location"},
+				ImportStateVerifyIgnore: []string{"name", "location", "annotations"},
 			},
 			// The following test steps of gRPC startup probe are expected to fail with startup probe check failures.
 			// This is because, due to the unavailability of ready-to-use container images of a gRPC service that
@@ -590,3 +591,162 @@ resource "google_cloud_run_v2_service" "default" {
 }
 `, context)
 }
+
+func TestAccCloudRunV2Service_cloudrunv2ServiceWithDirectVPCUpdate(t *testing.T) {
+	t.Parallel()
+
+	serviceName := fmt.Sprintf("tf-test-cloudrun-service%s", acctest.RandString(t, 10))
+	context := map[string]interface{}{
+		"service_name": serviceName,
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckCloudRunV2ServiceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCloudRunV2Service_cloudRunServiceWithDirectVPC(context),
+			},
+			{
+				ResourceName:            "google_cloud_run_v2_service.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"name", "location"},
+			},
+			{
+				Config: testAccCloudRunV2Service_cloudRunServiceWithDirectVPCUpdate(context),
+			},
+			{
+				ResourceName:            "google_cloud_run_v2_service.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"name", "location"},
+			},
+		},
+	})
+}
+
+func testAccCloudRunV2Service_cloudRunServiceWithDirectVPC(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_cloud_run_v2_service" "default" {
+  name     = "%{service_name}"
+  location = "us-central1"
+  launch_stage = "BETA"
+  template {
+    containers {
+      image = "us-docker.pkg.dev/cloudrun/container/hello"
+    }
+    vpc_access {
+      network_interfaces {
+        network = "default"
+      }
+    }
+  }
+}
+`, context)
+}
+
+func testAccCloudRunV2Service_cloudRunServiceWithDirectVPCUpdate(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_cloud_run_v2_service" "default" {
+  name     = "%{service_name}"
+  location = "us-central1"
+  launch_stage = "BETA"
+  template {
+    containers {
+      image = "us-docker.pkg.dev/cloudrun/container/hello"
+    }
+    vpc_access {
+      network_interfaces {
+        subnetwork = "default"
+        tags = ["foo", "bar"]
+      }
+    }
+  }
+}
+`, context)
+}
+
+<% unless version == "ga" -%>
+func TestAccCloudRunV2Service_cloudrunv2ServiceCustomAudienceUpdate(t *testing.T) {
+	t.Parallel()
+
+  serviceName := fmt.Sprintf("tf-test-cloudrun-service%s", acctest.RandString(t, 10))
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
+		CheckDestroy:             testAccCheckCloudRunV2ServiceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCloudRunV2Service_cloudRunServiceUpdateWithCustomAudience(serviceName, "test"),
+			},
+			{
+				ResourceName:            "google_cloud_run_v2_service.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"name", "location", "annotations", "launch_stage"},
+			},
+      {
+				Config: testAccCloudRunV2Service_cloudRunServiceUpdateWithCustomAudience(serviceName, "test_update"),
+			},
+			{
+				ResourceName:            "google_cloud_run_v2_service.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"name", "location", "annotations", "launch_stage"},
+			},
+			{
+				Config: testAccCloudRunV2Service_cloudRunServiceUpdateWithoutCustomAudience(serviceName),
+			},
+			{
+				ResourceName:            "google_cloud_run_v2_service.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"name", "location", "annotations", "launch_stage"},
+			},
+		},
+	})
+}
+
+func testAccCloudRunV2Service_cloudRunServiceUpdateWithoutCustomAudience(serviceName string) string {
+	return fmt.Sprintf(`
+resource "google_cloud_run_v2_service" "default" {
+  provider     = google-beta
+  name         = "%s"
+  location     = "us-central1"
+
+  template {
+    containers {
+      image = "us-docker.pkg.dev/cloudrun/container/hello"
+      ports {
+        container_port = 8080
+      }
+    }
+  }
+}
+`, serviceName)
+}
+
+func testAccCloudRunV2Service_cloudRunServiceUpdateWithCustomAudience(serviceName string, customAudience string) string {
+	return fmt.Sprintf(`
+resource "google_cloud_run_v2_service" "default" {
+  provider         = google-beta
+  name             = "%s"
+  location         = "us-central1"
+  launch_stage     = "BETA"
+  custom_audiences = ["%s"]
+
+  template {
+    containers {
+      image = "us-docker.pkg.dev/cloudrun/container/hello"
+      ports {
+        container_port = 8080
+      }
+    }
+  }
+}
+`, serviceName, customAudience)
+}
+<% end -%>
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/services/composer/data_source_google_composer_environment.go b/mmv1/third_party/terraform/services/composer/data_source_google_composer_environment.go
index f536428c6d3c..cf52d32638d6 100644
--- a/mmv1/third_party/terraform/services/composer/data_source_google_composer_environment.go
+++ b/mmv1/third_party/terraform/services/composer/data_source_google_composer_environment.go
@@ -35,7 +35,20 @@ func dataSourceGoogleComposerEnvironmentRead(d *schema.ResourceData, meta interf
 	}
 	envName := d.Get("name").(string)
 
-	d.SetId(fmt.Sprintf("projects/%s/locations/%s/environments/%s", project, region, envName))
+	id := fmt.Sprintf("projects/%s/locations/%s/environments/%s", project, region, envName)
+	d.SetId(id)
+	err = resourceComposerEnvironmentRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if err := tpgresource.SetDataSourceLabels(d); err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
 
-	return resourceComposerEnvironmentRead(d, meta)
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/composer/data_source_google_composer_environment_test.go b/mmv1/third_party/terraform/services/composer/data_source_google_composer_environment_test.go
index b01db3b3e114..a81eff7b2284 100644
--- a/mmv1/third_party/terraform/services/composer/data_source_google_composer_environment_test.go
+++ b/mmv1/third_party/terraform/services/composer/data_source_google_composer_environment_test.go
@@ -25,6 +25,8 @@ func TestAccDataSourceComposerEnvironment_basic(t *testing.T) {
 			{
 				Config: testAccDataSourceComposerEnvironment_basic(context),
 				Check: resource.ComposeTestCheckFunc(
+					acctest.CheckDataSourceStateMatchesResourceState("data.google_composer_environment.test",
+						"google_composer_environment.test"),
 					testAccCheckGoogleComposerEnvironmentMeta("data.google_composer_environment.test"),
 				),
 			},
@@ -91,6 +93,9 @@ resource "google_composer_environment" "test" {
 			image_version = "composer-1-airflow-2"
 		}
 	}
+	labels = {
+		my-label = "my-label-value"
+	}
 }
 
 // use a separate network to avoid conflicts with other tests running in parallel
diff --git a/mmv1/third_party/terraform/services/composer/resource_composer_environment.go.erb b/mmv1/third_party/terraform/services/composer/resource_composer_environment.go.erb
index 82e7ea37ac2c..5f8a44f1842d 100644
--- a/mmv1/third_party/terraform/services/composer/resource_composer_environment.go.erb
+++ b/mmv1/third_party/terraform/services/composer/resource_composer_environment.go.erb
@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/hashicorp/go-version"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 
@@ -72,7 +73,7 @@ var (
 		"config.0.workloads_config",
 		"config.0.environment_size",
 		"config.0.master_authorized_networks_config",
-		"config.0.resilience_mode",	
+		"config.0.resilience_mode",
 	}
 
 	recoveryConfigKeys = []string{
@@ -81,9 +82,7 @@ var (
 
 	workloadsConfigKeys = []string{
 		"config.0.workloads_config.0.scheduler",
-		<% unless version == "ga" -%>
 		"config.0.workloads_config.0.triggerer",
-		<% end -%>
 		"config.0.workloads_config.0.web_server",
 		"config.0.workloads_config.0.worker",
 	}
@@ -156,6 +155,12 @@ func ResourceComposerEnvironment() *schema.Resource {
 			Delete: schema.DefaultTimeout(30 * time.Minute),
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+			tpgresource.DefaultProviderRegion,
+			tpgresource.SetLabelsDiff,
+		),
+
 		Schema: map[string]*schema.Schema{
 			"name": {
 				Type:         schema.TypeString,
@@ -698,7 +703,6 @@ func ResourceComposerEnvironment() *schema.Resource {
 											},
 										},
 									},
-									<% unless version == "ga" -%>
 									"triggerer": {
 										Type:        schema.TypeList,
 										Optional:    true,
@@ -728,7 +732,6 @@ func ResourceComposerEnvironment() *schema.Resource {
 											},
 										},
 									},
-									<% end -%>
 									"web_server": {
 										Type:        schema.TypeList,
 										Optional:    true,
@@ -874,7 +877,42 @@ func ResourceComposerEnvironment() *schema.Resource {
 				Type:        schema.TypeMap,
 				Optional:    true,
 				Elem:        &schema.Schema{Type: schema.TypeString},
-				Description: `User-defined labels for this environment. The labels map can contain no more than 64 entries. Entries of the labels map are UTF8 strings that comply with the following restrictions: Label keys must be between 1 and 63 characters long and must conform to the following regular expression: [a-z]([-a-z0-9]*[a-z0-9])?. Label values must be between 0 and 63 characters long and must conform to the regular expression ([a-z]([-a-z0-9]*[a-z0-9])?)?. No more than 64 labels can be associated with a given environment. Both keys and values must be <= 128 bytes in size.`,
+				Description: `User-defined labels for this environment. The labels map can contain no more than 64 entries. Entries of the labels map are UTF8 strings that comply with the following restrictions: Label keys must be between 1 and 63 characters long and must conform to the following regular expression: [a-z]([-a-z0-9]*[a-z0-9])?. Label values must be between 0 and 63 characters long and must conform to the regular expression ([a-z]([-a-z0-9]*[a-z0-9])?)?. No more than 64 labels can be associated with a given environment. Both keys and values must be <= 128 bytes in size.
+
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+			},
+
+			"terraform_labels": {
+				Type:        schema.TypeMap,
+				Computed:    true,
+				Description: `The combination of labels configured directly on the resource and default labels configured on the provider.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+			},
+
+			"effective_labels": {
+				Type:        schema.TypeMap,
+				Computed:    true,
+				Description: `All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+			},
+
+			"storage_config": {
+				Type:         schema.TypeList,
+				Optional:     true,
+				Computed:     true,
+				MaxItems:     1,
+				Description:  `Configuration options for storage used by Composer environment.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"bucket": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ForceNew:     true,
+							Description: `Optional. Name of an existing Cloud Storage bucket to be used by the environment.`,
+						},
+					},
+				},
 			},
 		},
 		UseJSONNumber: true,
@@ -898,10 +936,16 @@ func resourceComposerEnvironmentCreate(d *schema.ResourceData, meta interface{})
 		return err
 	}
 
+	transformedStorageConfig, err := expandComposerStorageConfig(d.Get("storage_config"), d, config)
+	if err != nil {
+		return err
+	}
+
 	env := &composer.Environment{
 		Name:   envName.ResourceName(),
-		Labels: tpgresource.ExpandLabels(d),
+		Labels: tpgresource.ExpandEffectiveLabels(d),
 		Config: transformedConfig,
+		StorageConfig: transformedStorageConfig,
 	}
 
 	// Some fields cannot be specified during create and must be updated post-creation.
@@ -978,8 +1022,17 @@ func resourceComposerEnvironmentRead(d *schema.ResourceData, meta interface{}) e
 	if err := d.Set("config", flattenComposerEnvironmentConfig(res.Config)); err != nil {
 		return fmt.Errorf("Error setting Environment: %s", err)
 	}
-	if err := d.Set("labels", res.Labels); err != nil {
-		return fmt.Errorf("Error setting Environment: %s", err)
+	if err := tpgresource.SetLabels(res.Labels, d, "labels"); err != nil {
+		return fmt.Errorf("Error setting Environment labels: %s", err)
+	}
+	if err := tpgresource.SetLabels(res.Labels, d, "terraform_labels"); err != nil {
+		return fmt.Errorf("Error setting terraform_labels: %s", err)
+	}
+	if err := d.Set("effective_labels", res.Labels); err != nil {
+		return fmt.Errorf("Error setting Environment effective_labels: %s", err)
+	}
+	if err := d.Set("storage_config", flattenComposerStorageConfig(res.StorageConfig)); err != nil {
+		return fmt.Errorf("Error setting Storage: %s", err)
 	}
 	return nil
 }
@@ -1222,8 +1275,8 @@ func resourceComposerEnvironmentUpdate(d *schema.ResourceData, meta interface{})
 		}
 	}
 
-	if d.HasChange("labels") {
-		patchEnv := &composer.Environment{Labels: tpgresource.ExpandLabels(d)}
+	if d.HasChange("effective_labels") {
+		patchEnv := &composer.Environment{Labels: tpgresource.ExpandEffectiveLabels(d)}
 		err := resourceComposerEnvironmentPatchField("labels", userAgent, patchEnv, d, tfConfig)
 		if err != nil {
 			return err
@@ -1324,6 +1377,17 @@ func resourceComposerEnvironmentImport(d *schema.ResourceData, meta interface{})
 	return []*schema.ResourceData{d}, nil
 }
 
+func flattenComposerStorageConfig(storageConfig *composer.StorageConfig) interface{} {
+	if storageConfig == nil {
+		return nil
+	}
+
+	transformed := make(map[string]interface{})
+	transformed["bucket"] = storageConfig.Bucket
+
+	return []interface{}{transformed}
+}
+
 func flattenComposerEnvironmentConfig(envCfg *composer.EnvironmentConfig) interface{} {
 	if envCfg == nil {
 		return nil
@@ -1451,16 +1515,12 @@ func flattenComposerEnvironmentConfigWorkloadsConfig(workloadsConfig *composer.W
 
 	transformed := make(map[string]interface{})
 	transformedScheduler := make(map[string]interface{})
-	<% unless version == "ga" -%>
 	transformedTriggerer := make(map[string]interface{})
-	<% end -%>
 	transformedWebServer := make(map[string]interface{})
 	transformedWorker := make(map[string]interface{})
 
 	wlCfgScheduler := workloadsConfig.Scheduler
-	<% unless version == "ga" -%>
 	wlCfgTriggerer := workloadsConfig.Triggerer
-	<% end -%>
 	wlCfgWebServer := workloadsConfig.WebServer
 	wlCfgWorker := workloadsConfig.Worker
 
@@ -1473,7 +1533,6 @@ func flattenComposerEnvironmentConfigWorkloadsConfig(workloadsConfig *composer.W
 		transformedScheduler["count"] = wlCfgScheduler.Count
 	}
 
-	<% unless version == "ga" -%>
 	if wlCfgTriggerer == nil {
 		transformedTriggerer = nil
 	} else {
@@ -1481,7 +1540,6 @@ func flattenComposerEnvironmentConfigWorkloadsConfig(workloadsConfig *composer.W
 		transformedTriggerer["memory_gb"] = wlCfgTriggerer.MemoryGb
 		transformedTriggerer["count"] = wlCfgTriggerer.Count
 	}
-	<% end -%>
 
 	if wlCfgWebServer == nil {
 		transformedWebServer = nil
@@ -1502,11 +1560,9 @@ func flattenComposerEnvironmentConfigWorkloadsConfig(workloadsConfig *composer.W
 	}
 
 	transformed["scheduler"] = []interface{}{transformedScheduler}
-	<% unless version == "ga" -%>
 	if transformedTriggerer != nil {
 		transformed["triggerer"] = []interface{}{transformedTriggerer}
 	}
-	<% end -%>
 	transformed["web_server"] = []interface{}{transformedWebServer}
 	transformed["worker"] = []interface{}{transformedWorker}
 
@@ -1716,9 +1772,9 @@ func expandComposerEnvironmentConfig(v interface{}, d *schema.ResourceData, conf
 	if transformedResilienceMode == "STANDARD_RESILIENCE" {
 		transformed.ResilienceMode = "RESILIENCE_MODE_UNSPECIFIED"
 	} else {
-		transformed.ResilienceMode = transformedResilienceMode	
+		transformed.ResilienceMode = transformedResilienceMode
 	}
-  	
+
 
 	transformedMasterAuthorizedNetworksConfig, err := expandComposerEnvironmentConfigMasterAuthorizedNetworksConfig(original["master_authorized_networks_config"], d, config)
 	if err != nil {
@@ -1886,7 +1942,6 @@ func expandComposerEnvironmentConfigWorkloadsConfig(v interface{}, d *schema.Res
 		}
 	}
 
-	<% unless version == "ga" -%>
 	if v, ok := original["triggerer"]; ok {
 		if len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
 			transformedTriggerer := &composer.TriggererResource{}
@@ -1897,7 +1952,6 @@ func expandComposerEnvironmentConfigWorkloadsConfig(v interface{}, d *schema.Res
 			transformed.Triggerer = transformedTriggerer
 		}
 	}
-	<% end -%>
 
 	if v, ok := original["web_server"]; ok {
 		if len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
@@ -2127,7 +2181,22 @@ func expandComposerEnvironmentIPAllocationPolicy(v interface{}, d *schema.Resour
 		transformed.ServicesSecondaryRangeName = v.(string)
 	}
 	return transformed, nil
+}
+
+func expandComposerStorageConfig(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) (*composer.StorageConfig, error) {
+	l := v.([]interface{})
+	if len(l) == 0 || l[0] == nil {
+		return nil, nil
+	}
+	raw := l[0]
+	original := raw.(map[string]interface{})
+	transformed := &composer.StorageConfig{}
 
+	if v, ok := original["bucket"]; ok {
+		transformed.Bucket = v.(string)
+	}
+
+	return transformed, nil
 }
 
 func expandComposerEnvironmentServiceAccount(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) (string, error) {
diff --git a/mmv1/third_party/terraform/services/composer/resource_composer_environment_test.go.erb b/mmv1/third_party/terraform/services/composer/resource_composer_environment_test.go.erb
index 3637d3da4e16..5df49c724ac3 100644
--- a/mmv1/third_party/terraform/services/composer/resource_composer_environment_test.go.erb
+++ b/mmv1/third_party/terraform/services/composer/resource_composer_environment_test.go.erb
@@ -20,6 +20,7 @@ import (
 
 const testComposerEnvironmentPrefix = "tf-test-composer-env"
 const testComposerNetworkPrefix = "tf-test-composer-net"
+const testComposerBucketPrefix = "tf-test-composer-bucket"
 
 func allComposerServiceAgents() []string {
 	return []string{
@@ -100,6 +101,7 @@ func TestAccComposerEnvironment_update(t *testing.T) {
 				ResourceName:			"google_composer_environment.test",
 				ImportState:			 true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			// This is a terrible clean-up step in order to get destroy to succeed,
 			// due to dangling firewall rules left by the Composer Environment blocking network deletion.
@@ -559,7 +561,6 @@ func TestAccComposerEnvironment_ComposerV2HighResilience(t *testing.T) {
 	})
 }
 
-<% unless version == "ga" -%>
 func TestAccComposerEnvironment_UpdateComposerV2WithTriggerer(t *testing.T) {
 	// TODO: This test was seemingly working, but then started to re-run on every gcbrun https://github.com/hashicorp/terraform-provider-google/issues/14160
 	acctest.SkipIfVcr(t)
@@ -597,7 +598,6 @@ func TestAccComposerEnvironment_UpdateComposerV2WithTriggerer(t *testing.T) {
 		},
 	})
 }
-<% end -%>
 
 func TestAccComposerEnvironment_UpdateComposerV2(t *testing.T) {
 	t.Parallel()
@@ -1082,6 +1082,84 @@ func testAccComposerEnvironmentDestroyProducer(t *testing.T) func(s *terraform.S
 	}
 }
 
+// Checks environment creation with custom bucket
+func TestAccComposerEnvironment_customBucket(t *testing.T) {
+	t.Parallel()
+
+	bucketName := fmt.Sprintf("%s-%d", testComposerBucketPrefix, acctest.RandInt(t))
+	envName := fmt.Sprintf("%s-%d", testComposerEnvironmentPrefix, acctest.RandInt(t))
+	network := fmt.Sprintf("%s-%d", testComposerNetworkPrefix, acctest.RandInt(t))
+	subnetwork := network + "-1"
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:	                func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccComposerEnvironmentDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComposerEnvironment_customBucket(bucketName, envName, network, subnetwork),
+			},
+			{
+				ResourceName:      "google_composer_environment.test",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			// This is a terrible clean-up step in order to get destroy to succeed,
+			// due to dangling firewall rules left by the Composer Environment blocking network deletion.
+			// TODO: Remove this check if firewall rules bug gets fixed by Composer.
+			{
+				PlanOnly:           true,
+				ExpectNonEmptyPlan: false,
+				Config:             testAccComposerEnvironment_customBucket(bucketName, envName, network, subnetwork),
+				Check:              testAccCheckClearComposerEnvironmentFirewalls(t, network),
+			},
+		},
+	})
+}
+
+func testAccComposerEnvironment_customBucket(bucketName, envName, network, subnetwork string) string {
+	return fmt.Sprintf(`
+resource "google_storage_bucket" "test" {
+  name   = "%s"
+  location = "us-central1"
+  force_destroy = true
+}
+
+resource "google_composer_environment" "test" {
+  name   = "%s"
+  region = "us-central1"
+  config {
+    node_config {
+      network        = google_compute_network.test.self_link
+      subnetwork     = google_compute_subnetwork.test.self_link
+      ip_allocation_policy {
+        cluster_ipv4_cidr_block = "10.0.0.0/16"
+      }
+    }
+    software_config {
+      image_version = "composer-2.4.2-airflow-2"
+    }
+  }
+  storage_config {
+		bucket = google_storage_bucket.test.name
+	}
+}
+
+// use a separate network to avoid conflicts with other tests running in parallel
+// that use the default network/subnet
+resource "google_compute_network" "test" {
+  name                    = "%s"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "test" {
+  name          = "%s"
+  ip_cidr_range = "10.2.0.0/16"
+  region        = "us-central1"
+  network       = google_compute_network.test.self_link
+}
+`, bucketName, envName, network, subnetwork)
+}
+
 func testAccComposerEnvironment_basic(name, network, subnetwork string) string {
 	return fmt.Sprintf(`
 resource "google_composer_environment" "test" {
@@ -1675,13 +1753,11 @@ resource "google_composer_environment" "test" {
           min_count   = 2
           max_count   = 5
         }
-				<% unless version == "ga" -%>
-				triggerer {
-					cpu         = 0.5
-					memory_gb   = 2.0
-					count   		= 1
-				}
-				<% end -%>
+		triggerer {
+		  cpu         = 0.5
+		  memory_gb   = 2.0
+		  count   		= 1
+		}
       }
       environment_size = "ENVIRONMENT_SIZE_MEDIUM"
       private_environment_config {
@@ -2073,13 +2149,11 @@ resource "google_composer_environment" "test" {
           min_count   = 3
           max_count   = 6
         }
-				<% unless version == "ga" -%>
-				triggerer {
-					cpu         = 2.25
-					memory_gb   = 4
-					count   		= 1
-				}
-				<% end -%>
+		triggerer {
+		  cpu         = 0.75
+		  memory_gb   = 2
+		  count   	  = 1
+		}
       }
       environment_size = "ENVIRONMENT_SIZE_LARGE"
       private_environment_config {
diff --git a/mmv1/third_party/terraform/services/compute/compute_instance_helpers.go.erb b/mmv1/third_party/terraform/services/compute/compute_instance_helpers.go.erb
index 655c4341db21..8357d00c507f 100644
--- a/mmv1/third_party/terraform/services/compute/compute_instance_helpers.go.erb
+++ b/mmv1/third_party/terraform/services/compute/compute_instance_helpers.go.erb
@@ -305,6 +305,11 @@ func flattenAccessConfigs(accessConfigs []*compute.AccessConfig) ([]map[string]i
 		if natIP == "" {
 			natIP = ac.NatIP
 		}
+		<% unless version == 'ga' -%>
+		if ac.SecurityPolicy != "" {
+			flattened[i]["security_policy"] = ac.SecurityPolicy
+		}
+		<% end -%>
 	}
 	return flattened, natIP
 }
@@ -319,6 +324,11 @@ func flattenIpv6AccessConfigs(ipv6AccessConfigs []*compute.AccessConfig) []map[s
 		flattened[i]["external_ipv6"] = ac.ExternalIpv6
 		flattened[i]["external_ipv6_prefix_length"] = strconv.FormatInt(ac.ExternalIpv6PrefixLength, 10)
 		flattened[i]["name"] = ac.Name
+		<% unless version == 'ga' -%>
+		if ac.SecurityPolicy != "" {
+			flattened[i]["security_policy"] = ac.SecurityPolicy
+		}
+		<% end -%>
 	}
 	return flattened
 }
@@ -370,6 +380,15 @@ func flattenNetworkInterfaces(d *schema.ResourceData, config *transport_tpg.Conf
 			flattened[i]["network_attachment"] = networkAttachment
 		}
 		<% end -%>
+
+		<% unless version == 'ga' -%>
+		// the security_policy for a network_interface is found in one of its accessConfigs.
+		if len(iface.AccessConfigs) > 0 && iface.AccessConfigs[0].SecurityPolicy != "" {
+			flattened[i]["security_policy"] = iface.AccessConfigs[0].SecurityPolicy
+		} else if len(iface.Ipv6AccessConfigs) > 0 && iface.Ipv6AccessConfigs[0].SecurityPolicy != "" {
+			flattened[i]["security_policy"] = iface.Ipv6AccessConfigs[0].SecurityPolicy
+		}
+		<% end -%>
 	}
 	return flattened, region, internalIP, externalIP, nil
 }
@@ -440,15 +459,6 @@ func expandNetworkInterfaces(d tpgresource.TerraformResourceData, config *transp
 			return nil, fmt.Errorf("exactly one of network, subnetwork, or network_attachment must be provided")
 		}
 
-
-		if networkAttachment != "" {
-			if network != "" {
-				return nil, fmt.Errorf("Cannot have a network provided with networkAttachment given that networkAttachment is associated with a network already")
-			}
-			if subnetwork != "" {
-				return nil, fmt.Errorf("Cannot have a subnetwork provided with networkAttachment given that networkAttachment is associated with a subnetwork already")
-			}
-		}
 		<% else -%>
 
 		network := data["network"].(string)
diff --git a/mmv1/third_party/terraform/services/compute/compute_instance_network_interface_helpers.go.erb b/mmv1/third_party/terraform/services/compute/compute_instance_network_interface_helpers.go.erb
index b80b47ee7818..2eb3607d7297 100644
--- a/mmv1/third_party/terraform/services/compute/compute_instance_network_interface_helpers.go.erb
+++ b/mmv1/third_party/terraform/services/compute/compute_instance_network_interface_helpers.go.erb
@@ -7,6 +7,10 @@ import (
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 	"github.com/hashicorp/errwrap"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+<% unless version == 'ga' -%>
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+<% end -%>
+
 <% if version == "ga" -%>
 	"google.golang.org/api/compute/v1"
 <% else -%>
@@ -85,3 +89,78 @@ func computeInstanceCreateUpdateWhileStoppedCall(d *schema.ResourceData, config
 		return nil
 	}
 }
+
+<% unless version == 'ga' -%>
+func computeInstanceAddSecurityPolicy(d *schema.ResourceData, config *transport_tpg.Config, securityPolicyWithNics map[string][]string, project, zone, userAgent, instanceName string) error {
+	for sp, nics := range securityPolicyWithNics {
+		req := &compute.InstancesSetSecurityPolicyRequest{
+			NetworkInterfaces: nics,
+			SecurityPolicy:    sp,
+		}
+		op, err := config.NewComputeClient(userAgent).Instances.SetSecurityPolicy(project, zone, instanceName, req).Do()
+		if err != nil {
+			return fmt.Errorf("Error adding security policy: %s", err)
+		}
+		opErr := ComputeOperationWaitTime(config, op, project, "security_policy to add", userAgent, d.Timeout(schema.TimeoutUpdate))
+		if opErr != nil {
+			return opErr
+		}
+	}
+
+	return nil
+}
+
+func computeInstanceMapSecurityPoliciesCreate(d tpgresource.TerraformResourceData, config *transport_tpg.Config) (map[string][]string, error) {
+	securityPolicies := make(map[string][]string)
+	configs := d.Get("network_interface").([]interface{})
+	for i, raw := range configs {
+		data := raw.(map[string]interface{})
+		secPolicy := data["security_policy"].(string)
+		err := validateSecurityPolicy(data)
+		if err != nil {
+			return securityPolicies, err
+		}
+
+		if secPolicy != "" {
+			// Network interfaces use the nicN naming format and is only know after the instance is created.
+			nicName := fmt.Sprintf("nic%d", i)
+			securityPolicies[secPolicy] = append(securityPolicies[secPolicy], nicName)
+		}
+	}
+
+	return securityPolicies, nil
+}
+
+func computeInstanceMapSecurityPoliciesUpdate(d tpgresource.TerraformResourceData, config *transport_tpg.Config) (map[string][]string, error) {
+	securityPolicies := make(map[string][]string)
+	configs := d.Get("network_interface").([]interface{})
+	for i, raw := range configs {
+		data := raw.(map[string]interface{})
+		secPolicy := data["security_policy"].(string)
+		err := validateSecurityPolicy(data)
+		if err != nil {
+			return securityPolicies, err
+		}
+
+		// Network interfaces use the nicN naming format and is only know after the instance is created.
+		nicName := fmt.Sprintf("nic%d", i)
+		// To cleanup the security policy from the interface we should send something like this on the api: {"":[nic0, nic1]}
+		securityPolicies[secPolicy] = append(securityPolicies[secPolicy], nicName)
+	}
+
+	return securityPolicies, nil
+}
+
+func validateSecurityPolicy(rawNetworkInterface map[string]interface{}) error {
+	acessConfigs := expandAccessConfigs(rawNetworkInterface["access_config"].([]interface{}))
+	ipv6AccessConfigs := expandIpv6AccessConfigs(rawNetworkInterface["ipv6_access_config"].([]interface{}))
+	secPolicy := rawNetworkInterface["security_policy"].(string)
+
+	if secPolicy != "" && len(acessConfigs) == 0 && len(ipv6AccessConfigs) == 0 {
+		return fmt.Errorf("Error setting security policy to the instance since at least one access config must exist")
+	}
+
+	return nil
+}
+
+<% end -%>
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/services/compute/data_source_compute_health_check.go b/mmv1/third_party/terraform/services/compute/data_source_compute_health_check.go
index e47066ea9b26..8703c6fcaf7f 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_compute_health_check.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_compute_health_check.go
@@ -1,6 +1,8 @@
 package compute
 
 import (
+	"fmt"
+
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
@@ -29,5 +31,14 @@ func dataSourceGoogleComputeHealthCheckRead(d *schema.ResourceData, meta interfa
 	}
 	d.SetId(id)
 
-	return resourceComputeHealthCheckRead(d, meta)
+	err = resourceComputeHealthCheckRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/compute/data_source_compute_network_endpoint_group.go b/mmv1/third_party/terraform/services/compute/data_source_compute_network_endpoint_group.go
index e12c2958b4d5..bb5d4db55efa 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_compute_network_endpoint_group.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_compute_network_endpoint_group.go
@@ -27,6 +27,7 @@ func DataSourceGoogleComputeNetworkEndpointGroup() *schema.Resource {
 
 func dataSourceComputeNetworkEndpointGroupRead(d *schema.ResourceData, meta interface{}) error {
 	config := meta.(*transport_tpg.Config)
+	id := ""
 	if name, ok := d.GetOk("name"); ok {
 		project, err := tpgresource.GetProject(d, config)
 		if err != nil {
@@ -36,7 +37,8 @@ func dataSourceComputeNetworkEndpointGroupRead(d *schema.ResourceData, meta inte
 		if err != nil {
 			return err
 		}
-		d.SetId(fmt.Sprintf("projects/%s/zones/%s/networkEndpointGroups/%s", project, zone, name.(string)))
+		id = fmt.Sprintf("projects/%s/zones/%s/networkEndpointGroups/%s", project, zone, name.(string))
+		d.SetId(id)
 	} else if selfLink, ok := d.GetOk("self_link"); ok {
 		parsed, err := tpgresource.ParseNetworkEndpointGroupFieldValue(selfLink.(string), d, config)
 		if err != nil {
@@ -51,10 +53,20 @@ func dataSourceComputeNetworkEndpointGroupRead(d *schema.ResourceData, meta inte
 		if err := d.Set("project", parsed.Project); err != nil {
 			return fmt.Errorf("Error setting project: %s", err)
 		}
-		d.SetId(fmt.Sprintf("projects/%s/zones/%s/networkEndpointGroups/%s", parsed.Project, parsed.Zone, parsed.Name))
+		id = fmt.Sprintf("projects/%s/zones/%s/networkEndpointGroups/%s", parsed.Project, parsed.Zone, parsed.Name)
+		d.SetId(id)
 	} else {
 		return errors.New("Must provide either `self_link` or `zone/name`")
 	}
 
-	return resourceComputeNetworkEndpointGroupRead(d, meta)
+	err := resourceComputeNetworkEndpointGroupRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/compute/data_source_compute_network_peering.go b/mmv1/third_party/terraform/services/compute/data_source_compute_network_peering.go
index fed49bd6ba1e..edc7827e5fbf 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_compute_network_peering.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_compute_network_peering.go
@@ -35,7 +35,17 @@ func dataSourceComputeNetworkPeeringRead(d *schema.ResourceData, meta interface{
 	if err != nil {
 		return err
 	}
-	d.SetId(fmt.Sprintf("%s/%s", networkFieldValue.Name, d.Get("name").(string)))
+	id := fmt.Sprintf("%s/%s", networkFieldValue.Name, d.Get("name").(string))
+	d.SetId(id)
 
-	return resourceComputeNetworkPeeringRead(d, meta)
+	err = resourceComputeNetworkPeeringRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_address.go b/mmv1/third_party/terraform/services/compute/data_source_google_compute_address.go
index f987531b05d7..f8faecfec4cd 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_address.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_address.go
@@ -108,9 +108,11 @@ func dataSourceGoogleComputeAddressRead(d *schema.ResourceData, meta interface{}
 	}
 	name := d.Get("name").(string)
 
+	id := fmt.Sprintf("projects/%s/regions/%s/addresses/%s", project, region, name)
+
 	address, err := config.NewComputeClient(userAgent).Addresses.Get(project, region, name).Do()
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("Address Not Found : %s", name))
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("Address Not Found : %s", name), id)
 	}
 
 	if err := d.Set("address", address.Address); err != nil {
@@ -147,7 +149,7 @@ func dataSourceGoogleComputeAddressRead(d *schema.ResourceData, meta interface{}
 		return fmt.Errorf("Error setting region: %s", err)
 	}
 
-	d.SetId(fmt.Sprintf("projects/%s/regions/%s/addresses/%s", project, region, name))
+	d.SetId(id)
 	return nil
 }
 
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_backend_bucket.go b/mmv1/third_party/terraform/services/compute/data_source_google_compute_backend_bucket.go
index b56c80f7c5bc..43e555c17d7b 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_backend_bucket.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_backend_bucket.go
@@ -33,7 +33,17 @@ func dataSourceComputeBackendBucketRead(d *schema.ResourceData, meta interface{}
 		return err
 	}
 
-	d.SetId(fmt.Sprintf("projects/%s/global/backendBuckets/%s", project, backendBucketName))
+	id := fmt.Sprintf("projects/%s/global/backendBuckets/%s", project, backendBucketName)
+	d.SetId(id)
 
-	return resourceComputeBackendBucketRead(d, meta)
+	err = resourceComputeBackendBucketRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_backend_service.go b/mmv1/third_party/terraform/services/compute/data_source_google_compute_backend_service.go
index eac09d83ae6a..284dc85905f9 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_backend_service.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_backend_service.go
@@ -33,7 +33,17 @@ func dataSourceComputeBackendServiceRead(d *schema.ResourceData, meta interface{
 		return err
 	}
 
-	d.SetId(fmt.Sprintf("projects/%s/global/backendServices/%s", project, serviceName))
+	id := fmt.Sprintf("projects/%s/global/backendServices/%s", project, serviceName)
+	d.SetId(id)
 
-	return resourceComputeBackendServiceRead(d, meta)
+	err = resourceComputeBackendServiceRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_default_service_account.go b/mmv1/third_party/terraform/services/compute/data_source_google_compute_default_service_account.go
index 59264ef77c8b..1f6f45a40b76 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_default_service_account.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_default_service_account.go
@@ -33,6 +33,10 @@ func DataSourceGoogleComputeDefaultServiceAccount() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"member": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 		},
 	}
 }
@@ -51,7 +55,7 @@ func dataSourceGoogleComputeDefaultServiceAccountRead(d *schema.ResourceData, me
 
 	projectCompResource, err := config.NewComputeClient(userAgent).Projects.Get(project).Do()
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, "GCE default service account")
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, "GCE default service account", fmt.Sprintf("%q GCE default service account", project))
 	}
 
 	serviceAccountName, err := tpgresource.ServiceAccountFQN(projectCompResource.DefaultServiceAccount, d, config)
@@ -61,7 +65,7 @@ func dataSourceGoogleComputeDefaultServiceAccountRead(d *schema.ResourceData, me
 
 	sa, err := config.NewIamClient(userAgent).Projects.ServiceAccounts.Get(serviceAccountName).Do()
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("Service Account %q", serviceAccountName))
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("Service Account %q", serviceAccountName), serviceAccountName)
 	}
 
 	d.SetId(sa.Name)
@@ -80,6 +84,9 @@ func dataSourceGoogleComputeDefaultServiceAccountRead(d *schema.ResourceData, me
 	if err := d.Set("display_name", sa.DisplayName); err != nil {
 		return fmt.Errorf("Error setting display_name: %s", err)
 	}
+	if err := d.Set("member", "serviceAccount:"+sa.Email); err != nil {
+		return fmt.Errorf("Error setting member: %s", err)
+	}
 
 	return nil
 }
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_disk.go b/mmv1/third_party/terraform/services/compute/data_source_google_compute_disk.go
index 9b660c8989e5..d96674df17d7 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_disk.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_disk.go
@@ -29,5 +29,18 @@ func dataSourceGoogleComputeDiskRead(d *schema.ResourceData, meta interface{}) e
 		return fmt.Errorf("Error constructing id: %s", err)
 	}
 	d.SetId(id)
-	return resourceComputeDiskRead(d, meta)
+	err = resourceComputeDiskRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if err := tpgresource.SetDataSourceLabels(d); err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_disk_test.go b/mmv1/third_party/terraform/services/compute/data_source_google_compute_disk_test.go
index 3ab5cb82b9eb..b978a3834c4c 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_disk_test.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_disk_test.go
@@ -32,7 +32,10 @@ func TestAccDataSourceGoogleComputeDisk_basic(t *testing.T) {
 func testAccDataSourceGoogleComputeDisk_basic(context map[string]interface{}) string {
 	return acctest.Nprintf(`
 resource "google_compute_disk" "foo" {
-  name     = "tf-test-compute-disk-%{random_suffix}"
+  name   = "tf-test-compute-disk-%{random_suffix}"
+  labels = {
+    my-label = "my-label-value"
+  }
 }
 
 data "google_compute_disk" "foo" {
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_forwarding_rule.go b/mmv1/third_party/terraform/services/compute/data_source_google_compute_forwarding_rule.go
index 9dc06385eb78..3e7abe2278d1 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_forwarding_rule.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_forwarding_rule.go
@@ -39,7 +39,21 @@ func dataSourceGoogleComputeForwardingRuleRead(d *schema.ResourceData, meta inte
 		return err
 	}
 
-	d.SetId(fmt.Sprintf("projects/%s/regions/%s/forwardingRules/%s", project, region, name))
+	id := fmt.Sprintf("projects/%s/regions/%s/forwardingRules/%s", project, region, name)
+	d.SetId(id)
 
-	return resourceComputeForwardingRuleRead(d, meta)
+	err = resourceComputeForwardingRuleRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if err := tpgresource.SetDataSourceLabels(d); err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_forwarding_rule_test.go b/mmv1/third_party/terraform/services/compute/data_source_google_compute_forwarding_rule_test.go
index 1238648064a5..b30bb8ce3056 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_forwarding_rule_test.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_forwarding_rule_test.go
@@ -40,6 +40,9 @@ resource "google_compute_forwarding_rule" "foobar-fr" {
   name        = "%s"
   port_range  = "80-81"
   target      = google_compute_target_pool.foobar-tp.self_link
+  labels      = {
+    my-label  = "my-label-value"
+  }
 }
 
 data "google_compute_forwarding_rule" "my_forwarding_rule" {
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_global_address.go b/mmv1/third_party/terraform/services/compute/data_source_google_compute_global_address.go
index 14e6a8d1a8e0..44239ffdb887 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_global_address.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_global_address.go
@@ -89,9 +89,11 @@ func dataSourceGoogleComputeGlobalAddressRead(d *schema.ResourceData, meta inter
 		return err
 	}
 	name := d.Get("name").(string)
+	id := fmt.Sprintf("projects/%s/global/addresses/%s", project, name)
+
 	address, err := config.NewComputeClient(userAgent).GlobalAddresses.Get(project, name).Do()
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("Global Address Not Found : %s", name))
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("Global Address Not Found : %s", name), id)
 	}
 
 	if err := d.Set("address", address.Address); err != nil {
@@ -124,6 +126,6 @@ func dataSourceGoogleComputeGlobalAddressRead(d *schema.ResourceData, meta inter
 	if err := d.Set("project", project); err != nil {
 		return fmt.Errorf("Error setting project: %s", err)
 	}
-	d.SetId(fmt.Sprintf("projects/%s/global/addresses/%s", project, name))
+	d.SetId(id)
 	return nil
 }
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_ha_vpn_gateway.go b/mmv1/third_party/terraform/services/compute/data_source_google_compute_ha_vpn_gateway.go
index a5408b608dea..c658e4cdf376 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_ha_vpn_gateway.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_ha_vpn_gateway.go
@@ -39,7 +39,17 @@ func dataSourceGoogleComputeHaVpnGatewayRead(d *schema.ResourceData, meta interf
 		return err
 	}
 
-	d.SetId(fmt.Sprintf("projects/%s/regions/%s/vpnGateways/%s", project, region, name))
+	id := fmt.Sprintf("projects/%s/regions/%s/vpnGateways/%s", project, region, name)
+	d.SetId(id)
 
-	return resourceComputeHaVpnGatewayRead(d, meta)
+	err = resourceComputeHaVpnGatewayRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_instance.go.erb b/mmv1/third_party/terraform/services/compute/data_source_google_compute_instance.go.erb
index 19a49a5b4410..7b0734cf6455 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_instance.go.erb
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_instance.go.erb
@@ -34,9 +34,11 @@ func dataSourceGoogleComputeInstanceRead(d *schema.ResourceData, meta interface{
 		return err
 	}
 
+	id := fmt.Sprintf("projects/%s/zones/%s/instances/%s", project, zone, name)
+
 	instance, err := config.NewComputeClient(userAgent).Instances.Get(project, zone, name).Do()
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("Instance %s", name))
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("Instance %s", name), id)
 	}
 
 	md := flattenMetadataBeta(instance.Metadata)
@@ -96,6 +98,10 @@ func dataSourceGoogleComputeInstanceRead(d *schema.ResourceData, meta interface{
 		return err
 	}
 
+	if err := d.Set("terraform_labels", instance.Labels); err != nil {
+		return err
+	}
+
 	if instance.LabelFingerprint != "" {
 		if err := d.Set("label_fingerprint", instance.LabelFingerprint); err != nil {
 			return fmt.Errorf("Error setting label_fingerprint: %s", err)
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_instance_group.go b/mmv1/third_party/terraform/services/compute/data_source_google_compute_instance_group.go
index 7be1e9c072fe..bbe683b335dd 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_instance_group.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_instance_group.go
@@ -84,6 +84,7 @@ func DataSourceGoogleComputeInstanceGroup() *schema.Resource {
 
 func dataSourceComputeInstanceGroupRead(d *schema.ResourceData, meta interface{}) error {
 	config := meta.(*transport_tpg.Config)
+	id := ""
 	if name, ok := d.GetOk("name"); ok {
 		zone, err := tpgresource.GetZone(d, config)
 		if err != nil {
@@ -93,7 +94,7 @@ func dataSourceComputeInstanceGroupRead(d *schema.ResourceData, meta interface{}
 		if err != nil {
 			return err
 		}
-		d.SetId(fmt.Sprintf("projects/%s/zones/%s/instanceGroups/%s", project, zone, name.(string)))
+		id = fmt.Sprintf("projects/%s/zones/%s/instanceGroups/%s", project, zone, name.(string))
 	} else if selfLink, ok := d.GetOk("self_link"); ok {
 		parsed, err := tpgresource.ParseInstanceGroupFieldValue(selfLink.(string), d, config)
 		if err != nil {
@@ -108,10 +109,20 @@ func dataSourceComputeInstanceGroupRead(d *schema.ResourceData, meta interface{}
 		if err := d.Set("project", parsed.Project); err != nil {
 			return fmt.Errorf("Error setting project: %s", err)
 		}
-		d.SetId(fmt.Sprintf("projects/%s/zones/%s/instanceGroups/%s", parsed.Project, parsed.Zone, parsed.Name))
+		id = fmt.Sprintf("projects/%s/zones/%s/instanceGroups/%s", parsed.Project, parsed.Zone, parsed.Name)
 	} else {
 		return errors.New("Must provide either `self_link` or `zone/name`")
 	}
+	d.SetId(id)
 
-	return resourceComputeInstanceGroupRead(d, meta)
+	err := resourceComputeInstanceGroupRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_instance_template.go.erb b/mmv1/third_party/terraform/services/compute/data_source_google_compute_instance_template.go.erb
index ee82da732187..bd0cdca09643 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_instance_template.go.erb
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_instance_template.go.erb
@@ -92,7 +92,10 @@ func datasourceComputeInstanceTemplateRead(d *schema.ResourceData, meta interfac
 func retrieveInstance(d *schema.ResourceData, meta interface{}, project, name string) error {
 	d.SetId("projects/" + project + "/global/instanceTemplates/" + name)
 
-	return resourceComputeInstanceTemplateRead(d, meta)
+	if err := resourceComputeInstanceTemplateRead(d, meta); err != nil {
+		return err
+	}
+	return tpgresource.SetDataSourceLabels(d)
 }
 
 func retrieveInstanceFromUniqueId(d *schema.ResourceData, meta interface{}, project, self_link_unique string) error {
@@ -100,7 +103,10 @@ func retrieveInstanceFromUniqueId(d *schema.ResourceData, meta interface{}, proj
 	d.SetId(normalId)
 	d.Set("self_link_unique", self_link_unique)
 
-	return resourceComputeInstanceTemplateRead(d, meta)
+	if err := resourceComputeInstanceTemplateRead(d, meta); err != nil {
+		return err
+	}
+	return tpgresource.SetDataSourceLabels(d)
 }
 
 // ByCreationTimestamp implements sort.Interface for []*InstanceTemplate based on
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_instance_template_test.go b/mmv1/third_party/terraform/services/compute/data_source_google_compute_instance_template_test.go
index 9ed0dffc7f67..ef8e82a26180 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_instance_template_test.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_instance_template_test.go
@@ -115,6 +115,9 @@ resource "google_compute_instance_template" "default" {
   network_interface {
     network = "default"
   }
+  labels = {
+    my-label = "my-label-value"
+  }
 }
 
 data "google_compute_instance_template" "default" {
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_network.go b/mmv1/third_party/terraform/services/compute/data_source_google_compute_network.go
index aa12f0b8423e..f879884a931d 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_network.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_network.go
@@ -28,6 +28,11 @@ func DataSourceGoogleComputeNetwork() *schema.Resource {
 				Computed: true,
 			},
 
+			"internal_ipv6_range": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+
 			"self_link": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -59,13 +64,19 @@ func dataSourceGoogleComputeNetworkRead(d *schema.ResourceData, meta interface{}
 		return err
 	}
 	name := d.Get("name").(string)
+
+	id := fmt.Sprintf("projects/%s/global/networks/%s", project, name)
+
 	network, err := config.NewComputeClient(userAgent).Networks.Get(project, name).Do()
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("Network Not Found : %s", name))
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("Network Not Found : %s", name), id)
 	}
 	if err := d.Set("gateway_ipv4", network.GatewayIPv4); err != nil {
 		return fmt.Errorf("Error setting gateway_ipv4: %s", err)
 	}
+	if err := d.Set("internal_ipv6_range", network.InternalIpv6Range); err != nil {
+		return fmt.Errorf("Error setting internal_ipv6_range: %s", err)
+	}
 	if err := d.Set("self_link", network.SelfLink); err != nil {
 		return fmt.Errorf("Error setting self_link: %s", err)
 	}
@@ -75,6 +86,6 @@ func dataSourceGoogleComputeNetworkRead(d *schema.ResourceData, meta interface{}
 	if err := d.Set("subnetworks_self_links", network.Subnetworks); err != nil {
 		return fmt.Errorf("Error setting subnetworks_self_links: %s", err)
 	}
-	d.SetId(fmt.Sprintf("projects/%s/global/networks/%s", project, network.Name))
+	d.SetId(id)
 	return nil
 }
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_network_test.go b/mmv1/third_party/terraform/services/compute/data_source_google_compute_network_test.go
index 6018f5f83e93..6ef6a7c59f50 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_network_test.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_network_test.go
@@ -46,6 +46,7 @@ func testAccDataSourceGoogleNetworkCheck(data_source_name string, resource_name
 			"id",
 			"name",
 			"description",
+			"internal_ipv6_range",
 		}
 
 		for _, attr_to_check := range network_attrs_to_test {
@@ -70,8 +71,10 @@ func testAccDataSourceGoogleNetworkCheck(data_source_name string, resource_name
 func testAccDataSourceGoogleNetworkConfig(name string) string {
 	return fmt.Sprintf(`
 resource "google_compute_network" "foobar" {
-  name        = "%s"
-  description = "my-description"
+  name                     = "%s"
+  description              = "my-description"
+  enable_ula_internal_ipv6 = true
+  auto_create_subnetworks  = false
 }
 
 data "google_compute_network" "my_network" {
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_networks.go b/mmv1/third_party/terraform/services/compute/data_source_google_compute_networks.go
new file mode 100644
index 000000000000..0ac6d4c2ff7a
--- /dev/null
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_networks.go
@@ -0,0 +1,73 @@
+package compute
+
+import (
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
+)
+
+func DataSourceGoogleComputeNetworks() *schema.Resource {
+	return &schema.Resource{
+		Read: dataSourceGoogleComputeNetworksRead,
+
+		Schema: map[string]*schema.Schema{
+
+			"self_link": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+
+			"project": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+
+			"networks": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+		},
+	}
+}
+
+func dataSourceGoogleComputeNetworksRead(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*transport_tpg.Config)
+	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
+	if err != nil {
+		return err
+	}
+
+	project, err := tpgresource.GetProject(d, config)
+	if err != nil {
+		return err
+	}
+
+	networkList, err := config.NewComputeClient(userAgent).Networks.List(project).Do()
+	if err != nil {
+		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("Network Not Found : %s", project))
+	}
+
+	var networks = make([]string, len(networkList.Items))
+
+	for i := 0; i < len(networkList.Items); i++ {
+		networks[i] = networkList.Items[i].Name
+	}
+
+	if err := d.Set("networks", networks); err != nil {
+		return fmt.Errorf("Error setting the network names: %s", err)
+	}
+
+	if err := d.Set("project", project); err != nil {
+		return fmt.Errorf("Error setting the network names: %s", err)
+	}
+
+	if err := d.Set("self_link", networkList.SelfLink); err != nil {
+		return fmt.Errorf("Error setting self_link: %s", err)
+	}
+
+	d.SetId(fmt.Sprintf("projects/%s/global/networks", project))
+	return nil
+}
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_networks_test.go b/mmv1/third_party/terraform/services/compute/data_source_google_compute_networks_test.go
new file mode 100644
index 000000000000..52f6cf10ac9b
--- /dev/null
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_networks_test.go
@@ -0,0 +1,79 @@
+package compute_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+)
+
+func TestAccDataSourceGoogleNetworks(t *testing.T) {
+	t.Parallel()
+
+	networkName := fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10))
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDataSourceGoogleNetworksConfig(networkName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccDataSourceGoogleNetworksCheck("data.google_compute_networks.my_networks", "google_compute_network.foobar"),
+				),
+			},
+		},
+	})
+}
+
+func testAccDataSourceGoogleNetworksCheck(data_source_name string, resource_name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		ds, ok := s.RootModule().Resources[data_source_name]
+		if !ok {
+			return fmt.Errorf("root module has no resource called %s", data_source_name)
+		}
+
+		rs, ok := s.RootModule().Resources[resource_name]
+		if !ok {
+			return fmt.Errorf("can't find %s in state", resource_name)
+		}
+
+		ds_attr := ds.Primary.Attributes
+		rs_attr := rs.Primary.Attributes
+
+		containsNetwork := false
+
+		for _, itm := range ds_attr {
+			if string(itm) == rs_attr["name"] {
+				containsNetwork = true
+				break
+			}
+		}
+
+		if !containsNetwork {
+			return fmt.Errorf(
+				"Was expecting %s in %v",
+				rs_attr["name"],
+				ds_attr["networks"],
+			)
+		}
+
+		return nil
+	}
+}
+
+func testAccDataSourceGoogleNetworksConfig(name string) string {
+	return fmt.Sprintf(`
+resource "google_compute_network" "foobar" {
+  name        = "%s"
+  description = "my-description"
+}
+
+data "google_compute_networks" "my_networks" {
+	depends_on = [
+		google_compute_network.foobar
+	]
+}
+`, name)
+}
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_region_instance_group.go.erb b/mmv1/third_party/terraform/services/compute/data_source_google_compute_region_instance_group.go.erb
index 43c8499ce26b..b4820f426979 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_region_instance_group.go.erb
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_region_instance_group.go.erb
@@ -104,11 +104,11 @@ func dataSourceComputeRegionInstanceGroupRead(d *schema.ResourceData, meta inter
 	if err != nil {
 		return err
 	}
-
+	id := fmt.Sprintf("projects/%s/regions/%s/instanceGroups/%s", project, region, name)
 	instanceGroup, err := config.NewComputeClient(userAgent).RegionInstanceGroups.Get(
 		project, region, name).Do()
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("Region Instance Group %q", name))
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("Region Instance Group %q", name), id)
 	}
 
 	members, err := config.NewComputeClient(userAgent).RegionInstanceGroups.ListInstances(
@@ -129,7 +129,7 @@ func dataSourceComputeRegionInstanceGroupRead(d *schema.ResourceData, meta inter
 			return fmt.Errorf("Error setting instances: %s", err)
 		}
 	}
-	d.SetId(fmt.Sprintf("projects/%s/regions/%s/instanceGroups/%s", project, region, name))
+	d.SetId(id)
 	if err := d.Set("self_link", instanceGroup.SelfLink); err != nil {
 		return fmt.Errorf("Error setting self_link: %s", err)
 	}
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_region_instance_template.go.erb b/mmv1/third_party/terraform/services/compute/data_source_google_compute_region_instance_template.go.erb
index 6ebe245ba3ae..e69a2857ff38 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_region_instance_template.go.erb
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_region_instance_template.go.erb
@@ -124,5 +124,8 @@ func datasourceComputeRegionInstanceTemplateRead(d *schema.ResourceData, meta in
 func retrieveInstances(d *schema.ResourceData, meta interface{}, project, region, name string) error {
 	d.SetId("projects/" + project + "/regions/" + region + "/instanceTemplates/" + name)
 
-	return resourceComputeRegionInstanceTemplateRead(d, meta)
+	if err := resourceComputeRegionInstanceTemplateRead(d, meta); err != nil {
+		return err
+	}
+	return tpgresource.SetDataSourceLabels(d)
 }
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_region_instance_template_test.go.erb b/mmv1/third_party/terraform/services/compute/data_source_google_compute_region_instance_template_test.go.erb
index 6c32fddcb0d6..73a4d1fa09f0 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_region_instance_template_test.go.erb
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_region_instance_template_test.go.erb
@@ -91,6 +91,9 @@ resource "google_compute_region_instance_template" "default" {
   network_interface {
     network = "default"
   }
+  labels = {
+    my-label = "my-label-value"
+  }
 }
 data "google_compute_region_instance_template" "default" {
   project = "%{project}"
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_region_network_endpoint_group.go b/mmv1/third_party/terraform/services/compute/data_source_google_compute_region_network_endpoint_group.go
index 0147cd280d3d..3834a12ce9bf 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_region_network_endpoint_group.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_region_network_endpoint_group.go
@@ -26,6 +26,7 @@ func DataSourceGoogleComputeRegionNetworkEndpointGroup() *schema.Resource {
 
 func dataSourceComputeRegionNetworkEndpointGroupRead(d *schema.ResourceData, meta interface{}) error {
 	config := meta.(*transport_tpg.Config)
+	id := ""
 	if name, ok := d.GetOk("name"); ok {
 		project, err := tpgresource.GetProject(d, config)
 		if err != nil {
@@ -36,7 +37,7 @@ func dataSourceComputeRegionNetworkEndpointGroupRead(d *schema.ResourceData, met
 			return err
 		}
 
-		d.SetId(fmt.Sprintf("projects/%s/regions/%s/networkEndpointGroups/%s", project, region, name.(string)))
+		id = fmt.Sprintf("projects/%s/regions/%s/networkEndpointGroups/%s", project, region, name.(string))
 	} else if selfLink, ok := d.GetOk("self_link"); ok {
 		parsed, err := tpgresource.ParseNetworkEndpointGroupRegionalFieldValue(selfLink.(string), d, config)
 		if err != nil {
@@ -52,10 +53,19 @@ func dataSourceComputeRegionNetworkEndpointGroupRead(d *schema.ResourceData, met
 			return fmt.Errorf("Error setting region: %s", err)
 		}
 
-		d.SetId(fmt.Sprintf("projects/%s/regions/%s/networkEndpointGroups/%s", parsed.Project, parsed.Region, parsed.Name))
+		id = fmt.Sprintf("projects/%s/regions/%s/networkEndpointGroups/%s", parsed.Project, parsed.Region, parsed.Name)
 	} else {
 		return errors.New("Must provide either `self_link` or `region/name`")
 	}
+	d.SetId(id)
+	err := resourceComputeRegionNetworkEndpointGroupRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
 
-	return resourceComputeRegionNetworkEndpointGroupRead(d, meta)
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_region_ssl_certificate.go b/mmv1/third_party/terraform/services/compute/data_source_google_compute_region_ssl_certificate.go
index a42e9bc85491..17305595d0a6 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_region_ssl_certificate.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_region_ssl_certificate.go
@@ -33,7 +33,16 @@ func dataSourceComputeRegionSslCertificateRead(d *schema.ResourceData, meta inte
 		return err
 	}
 
-	d.SetId(fmt.Sprintf("projects/%s/regions/%s/sslCertificates/%s", project, region, name))
+	id := fmt.Sprintf("projects/%s/regions/%s/sslCertificates/%s", project, region, name)
+	d.SetId(id)
 
-	return resourceComputeRegionSslCertificateRead(d, meta)
+	err = resourceComputeRegionSslCertificateRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_resource_policy.go.erb b/mmv1/third_party/terraform/services/compute/data_source_google_compute_resource_policy.go.erb
index 3485a7051fe3..ae8d93646032 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_resource_policy.go.erb
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_resource_policy.go.erb
@@ -36,7 +36,17 @@ func dataSourceGoogleComputeResourcePolicyRead(d *schema.ResourceData, meta inte
 		return err
 	}
 
-	d.SetId(fmt.Sprintf("projects/%s/regions/%s/resourcePolicies/%s", project, region, name))
+	id := fmt.Sprintf("projects/%s/regions/%s/resourcePolicies/%s", project, region, name)
+	d.SetId(id)
 
-	return resourceComputeResourcePolicyRead(d, meta)
+	err = resourceComputeResourcePolicyRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_router.go b/mmv1/third_party/terraform/services/compute/data_source_google_compute_router.go
index 01f1ab0218e6..af235d576544 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_router.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_router.go
@@ -1,6 +1,8 @@
 package compute
 
 import (
+	"fmt"
+
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 )
@@ -22,5 +24,13 @@ func dataSourceComputeRouterRead(d *schema.ResourceData, meta interface{}) error
 	routerName := d.Get("name").(string)
 
 	d.SetId(routerName)
-	return resourceComputeRouterRead(d, meta)
+	err := resourceComputeRouterRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", routerName)
+	}
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_router_nat.go b/mmv1/third_party/terraform/services/compute/data_source_google_compute_router_nat.go
index b9f8fd1dae48..b74823b94b21 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_router_nat.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_router_nat.go
@@ -31,5 +31,14 @@ func dataSourceGoogleComputeRouterNatRead(d *schema.ResourceData, meta interface
 	}
 	d.SetId(id)
 
-	return resourceComputeRouterNatRead(d, meta)
+	err = resourceComputeRouterNatRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_snapshot.go.erb b/mmv1/third_party/terraform/services/compute/data_source_google_compute_snapshot.go.erb
index ea1d893715c2..a226612788c3 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_snapshot.go.erb
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_snapshot.go.erb
@@ -107,7 +107,10 @@ func dataSourceGoogleComputeSnapshotRead(d *schema.ResourceData, meta interface{
 func retrieveSnapshot(d *schema.ResourceData, meta interface{}, project, name string) error {
 	d.SetId("projects/" + project + "/global/snapshots/" + name)
 	d.Set("name", name)
-	return resourceComputeSnapshotRead(d, meta)
+	if err := resourceComputeSnapshotRead(d, meta); err != nil {
+		return err
+	}
+	return tpgresource.SetDataSourceLabels(d)
 }
 
 // ByCreationTimestamp implements sort.Interface for []*Snapshot based on
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_ssl_certificate.go b/mmv1/third_party/terraform/services/compute/data_source_google_compute_ssl_certificate.go
index 20e9bf9d4110..31cc3426988d 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_ssl_certificate.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_ssl_certificate.go
@@ -33,7 +33,17 @@ func dataSourceComputeSslCertificateRead(d *schema.ResourceData, meta interface{
 	}
 	certificateName := d.Get("name").(string)
 
-	d.SetId(fmt.Sprintf("projects/%s/global/sslCertificates/%s", project, certificateName))
+	id := fmt.Sprintf("projects/%s/global/sslCertificates/%s", project, certificateName)
+	d.SetId(id)
 
-	return resourceComputeSslCertificateRead(d, meta)
+	err = resourceComputeSslCertificateRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_ssl_policy.go b/mmv1/third_party/terraform/services/compute/data_source_google_compute_ssl_policy.go
index 8710928be8e4..1266e7370867 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_ssl_policy.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_ssl_policy.go
@@ -33,7 +33,17 @@ func datasourceComputeSslPolicyRead(d *schema.ResourceData, meta interface{}) er
 	}
 	policyName := d.Get("name").(string)
 
-	d.SetId(fmt.Sprintf("projects/%s/global/sslPolicies/%s", project, policyName))
+	id := fmt.Sprintf("projects/%s/global/sslPolicies/%s", project, policyName)
+	d.SetId(id)
 
-	return resourceComputeSslPolicyRead(d, meta)
+	err = resourceComputeSslPolicyRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_subnetwork.go.erb b/mmv1/third_party/terraform/services/compute/data_source_google_compute_subnetwork.go.erb
index 5652ba319f87..ad5ece651826 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_subnetwork.go.erb
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_subnetwork.go.erb
@@ -36,6 +36,10 @@ func DataSourceGoogleComputeSubnetwork() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"internal_ipv6_prefix": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"private_ip_google_access": {
 				Type:     schema.TypeBool,
 				Computed: true,
@@ -90,15 +94,19 @@ func dataSourceGoogleComputeSubnetworkRead(d *schema.ResourceData, meta interfac
 	if err != nil {
 		return err
 	}
+	id := fmt.Sprintf("projects/%s/regions/%s/subnetworks/%s", project, region, name)
 
 	subnetwork, err := config.NewComputeClient(userAgent).Subnetworks.Get(project, region, name).Do()
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("Subnetwork Not Found : %s", name))
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("Subnetwork Not Found : %s", name), id)
 	}
 
 	if err := d.Set("ip_cidr_range", subnetwork.IpCidrRange); err != nil {
 		return fmt.Errorf("Error setting ip_cidr_range: %s", err)
 	}
+	if err := d.Set("internal_ipv6_prefix", subnetwork.InternalIpv6Prefix); err != nil {
+		return fmt.Errorf("Error setting internal_ipv6_prefix: %s", err)
+	}
 	if err := d.Set("private_ip_google_access", subnetwork.PrivateIpGoogleAccess); err != nil {
 		return fmt.Errorf("Error setting private_ip_google_access: %s", err)
 	}
@@ -127,7 +135,7 @@ func dataSourceGoogleComputeSubnetworkRead(d *schema.ResourceData, meta interfac
 		return fmt.Errorf("Error setting secondary_ip_range: %s", err)
 	}
 
-	d.SetId(fmt.Sprintf("projects/%s/regions/%s/subnetworks/%s", project, region, name))
+	d.SetId(id)
 	return nil
 }
 
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_subnetwork_test.go b/mmv1/third_party/terraform/services/compute/data_source_google_compute_subnetwork_test.go
index dade57dd4ad5..0017d287ea90 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_subnetwork_test.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_subnetwork_test.go
@@ -49,6 +49,7 @@ func testAccDataSourceGoogleSubnetworkCheck(data_source_name string, resource_na
 			"description",
 			"ip_cidr_range",
 			"private_ip_google_access",
+			"internal_ipv6_prefix",
 			"secondary_ip_range",
 		}
 
@@ -80,6 +81,8 @@ func testAccDataSourceGoogleSubnetwork(networkName, subnetName string) string {
 resource "google_compute_network" "foobar" {
   name        = "%s"
   description = "my-description"
+  enable_ula_internal_ipv6 = true
+  auto_create_subnetworks = false
 }
 
 resource "google_compute_subnetwork" "foobar" {
@@ -87,6 +90,8 @@ resource "google_compute_subnetwork" "foobar" {
   description              = "my-description"
   ip_cidr_range            = "10.0.0.0/24"
   network                  = google_compute_network.foobar.self_link
+  stack_type               = "IPV4_IPV6"
+  ipv6_access_type         = "INTERNAL"
   private_ip_google_access = true
   secondary_ip_range {
     range_name    = "tf-test-secondary-range"
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_compute_vpn_gateway.go.erb b/mmv1/third_party/terraform/services/compute/data_source_google_compute_vpn_gateway.go.erb
index e11c1711211b..ba7f79403e9d 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_compute_vpn_gateway.go.erb
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_compute_vpn_gateway.go.erb
@@ -72,12 +72,13 @@ func dataSourceGoogleComputeVpnGatewayRead(d *schema.ResourceData, meta interfac
 	}
 
 	name := d.Get("name").(string)
+	id := fmt.Sprintf("projects/%s/regions/%s/targetVpnGateways/%s", project, region, name)
 
 	vpnGatewaysService := compute.NewTargetVpnGatewaysService(config.NewComputeClient(userAgent))
 
 	gateway, err := vpnGatewaysService.Get(project, region, name).Do()
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("VPN Gateway Not Found : %s", name))
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("VPN Gateway Not Found : %s", name), id)
 	}
 	if err := d.Set("network", tpgresource.ConvertSelfLinkToV1(gateway.Network)); err != nil {
 		return fmt.Errorf("Error setting network: %s", err)
@@ -94,6 +95,6 @@ func dataSourceGoogleComputeVpnGatewayRead(d *schema.ResourceData, meta interfac
 	if err := d.Set("project", project); err != nil {
 		return fmt.Errorf("Error setting project: %s", err)
 	}
-	d.SetId(fmt.Sprintf("projects/%s/regions/%s/targetVpnGateways/%s", project, region, name))
+	d.SetId(id)
 	return nil
 }
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_global_compute_forwarding_rule.go b/mmv1/third_party/terraform/services/compute/data_source_google_global_compute_forwarding_rule.go
index 1b25c01babef..24b840a9383e 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_global_compute_forwarding_rule.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_global_compute_forwarding_rule.go
@@ -33,7 +33,21 @@ func dataSourceGoogleComputeGlobalForwardingRuleRead(d *schema.ResourceData, met
 		return err
 	}
 
-	d.SetId(fmt.Sprintf("projects/%s/global/forwardingRules/%s", project, name))
+	id := fmt.Sprintf("projects/%s/global/forwardingRules/%s", project, name)
+	d.SetId(id)
 
-	return resourceComputeGlobalForwardingRuleRead(d, meta)
+	err = resourceComputeGlobalForwardingRuleRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if err := tpgresource.SetDataSourceLabels(d); err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/compute/data_source_google_global_compute_forwarding_rule_test.go b/mmv1/third_party/terraform/services/compute/data_source_google_global_compute_forwarding_rule_test.go
index 70e2f3e6099d..bfb94ba7d822 100644
--- a/mmv1/third_party/terraform/services/compute/data_source_google_global_compute_forwarding_rule_test.go
+++ b/mmv1/third_party/terraform/services/compute/data_source_google_global_compute_forwarding_rule_test.go
@@ -32,6 +32,9 @@ resource "google_compute_global_forwarding_rule" "foobar-fr" {
   name       = "%s"
   target     = google_compute_target_http_proxy.default.id
   port_range = "80"
+  labels     = {
+    my-label = "my-label-value"
+  }
 }
 
 resource "google_compute_target_http_proxy" "default" {
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_address_test.go b/mmv1/third_party/terraform/services/compute/resource_compute_address_test.go
index c9b07ec7579c..3417327ddc03 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_address_test.go
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_address_test.go
@@ -18,11 +18,10 @@ func TestAccComputeAddress_networkTier(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccComputeAddress_networkTier(acctest.RandString(t, 10)),
-			},
-			{
-				ResourceName:      "google_compute_address.foobar",
-				ImportState:       true,
-				ImportStateVerify: true,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckNoResourceAttr("google_compute_address.foobar", "labels.%"),
+					resource.TestCheckNoResourceAttr("google_compute_address.foobar", "effective_labels.%"),
+				),
 			},
 		},
 	})
@@ -58,6 +57,316 @@ func TestAccComputeAddress_internal(t *testing.T) {
 	})
 }
 
+func TestAccComputeAddress_networkTier_withLabels(t *testing.T) {
+	t.Parallel()
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeAddressDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeAddress_networkTier(acctest.RandString(t, 10)),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckNoResourceAttr("google_compute_address.foobar", "labels.%"),
+					resource.TestCheckNoResourceAttr("google_compute_address.foobar", "effective_labels.%"),
+				),
+			},
+			{
+				ResourceName:      "google_compute_address.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeAddress_networkTier_withLabels(acctest.RandString(t, 10)),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "labels.%", "2"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "labels.default_expiration_ms", "3600000"),
+
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "effective_labels.%", "2"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "effective_labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "effective_labels.default_expiration_ms", "3600000"),
+				),
+			},
+			{
+				ResourceName:      "google_compute_address.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+				// The labels field in the state is decided by the configuration.
+				// During importing, the configuration is unavailable, so the labels field in the state after importing is empty.
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
+			},
+			{
+				Config: testAccComputeAddress_networkTier_withLabelsUpdate(acctest.RandString(t, 10)),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "labels.%", "2"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "labels.env", "bar"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "labels.default_expiration_ms", "7200000"),
+
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "effective_labels.%", "2"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "effective_labels.env", "bar"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "effective_labels.default_expiration_ms", "7200000"),
+				),
+			},
+			{
+				ResourceName:            "google_compute_address.foobar",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
+			},
+			{
+				Config: testAccComputeAddress_networkTier(acctest.RandString(t, 10)),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckNoResourceAttr("google_compute_address.foobar", "labels.%"),
+					resource.TestCheckNoResourceAttr("google_compute_address.foobar", "effective_labels.%"),
+				),
+			},
+			{
+				ResourceName:      "google_compute_address.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccComputeAddress_networkTier_withProvider5(t *testing.T) {
+	acctest.SkipIfVcr(t)
+	t.Parallel()
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeAddress_networkTier(acctest.RandString(t, 10)),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckNoResourceAttr("google_compute_address.foobar", "labels.%"),
+					resource.TestCheckNoResourceAttr("google_compute_address.foobar", "effective_labels.%"),
+				),
+			},
+			{
+				Config: testAccComputeAddress_networkTier_withLabels(acctest.RandString(t, 10)),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "labels.%", "2"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "labels.default_expiration_ms", "3600000"),
+
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "effective_labels.%", "2"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "effective_labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "effective_labels.default_expiration_ms", "3600000"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccComputeAddress_withProviderDefaultLabels(t *testing.T) {
+	// The test failed if VCR testing is enabled, because the cached provider config is used.
+	// With the cached provider config, any changes in the provider default labels will not be applied.
+	acctest.SkipIfVcr(t)
+	t.Parallel()
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeAddressDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeAddress_withProviderDefaultLabels(acctest.RandString(t, 10)),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "labels.%", "2"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "labels.default_expiration_ms", "3600000"),
+
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "terraform_labels.%", "3"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "terraform_labels.default_key1", "default_value1"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "terraform_labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "terraform_labels.default_expiration_ms", "3600000"),
+
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "effective_labels.%", "3"),
+				),
+			},
+			{
+				ResourceName:            "google_compute_address.foobar",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
+			},
+			{
+				Config: testAccComputeAddress_resourceLabelsOverridesProviderDefaultLabels(acctest.RandString(t, 10)),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "labels.%", "3"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "labels.default_expiration_ms", "3600000"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "labels.default_key1", "value1"),
+
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "terraform_labels.%", "3"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "terraform_labels.default_key1", "value1"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "terraform_labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "terraform_labels.default_expiration_ms", "3600000"),
+
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "effective_labels.%", "3"),
+				),
+			},
+			{
+				ResourceName:      "google_compute_address.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+				// The labels field in the state is decided by the configuration.
+				// During importing, the configuration is unavailable, so the labels field in the state after importing is empty.
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
+			},
+			{
+				Config: testAccComputeAddress_moveResourceLabelToProviderDefaultLabels(acctest.RandString(t, 10)),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "labels.%", "2"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "labels.default_expiration_ms", "3600000"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "labels.default_key1", "value1"),
+
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "terraform_labels.%", "3"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "terraform_labels.default_key1", "value1"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "terraform_labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "terraform_labels.default_expiration_ms", "3600000"),
+
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "effective_labels.%", "3"),
+				),
+			},
+			{
+				ResourceName:            "google_compute_address.foobar",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
+			},
+			{
+				Config: testAccComputeAddress_resourceLabelsOverridesProviderDefaultLabels(acctest.RandString(t, 10)),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "labels.%", "3"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "labels.default_expiration_ms", "3600000"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "labels.default_key1", "value1"),
+
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "terraform_labels.%", "3"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "terraform_labels.default_key1", "value1"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "terraform_labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "terraform_labels.default_expiration_ms", "3600000"),
+
+					resource.TestCheckResourceAttr("google_compute_address.foobar", "effective_labels.%", "3"),
+				),
+			},
+			{
+				ResourceName:            "google_compute_address.foobar",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
+			},
+			{
+				Config: testAccComputeAddress_networkTier(acctest.RandString(t, 10)),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckNoResourceAttr("google_compute_address.foobar", "labels.%"),
+					resource.TestCheckNoResourceAttr("google_compute_address.foobar", "effective_labels.%"),
+				),
+			},
+			{
+				ResourceName:      "google_compute_address.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccComputeAddress_networkTier_withLabels(i string) string {
+	return fmt.Sprintf(`
+resource "google_compute_address" "foobar" {
+  name         = "tf-test-address-%s"
+  network_tier = "STANDARD"
+
+  labels = {
+    env                   = "foo"
+    default_expiration_ms = 3600000
+  }
+}
+`, i)
+}
+
+func testAccComputeAddress_networkTier_withLabelsUpdate(i string) string {
+	return fmt.Sprintf(`
+resource "google_compute_address" "foobar" {
+  name         = "tf-test-address-%s"
+  network_tier = "STANDARD"
+
+  labels = {
+    env                   = "bar"
+    default_expiration_ms = 7200000
+  }
+}
+`, i)
+}
+
+func testAccComputeAddress_withProviderDefaultLabels(i string) string {
+	return fmt.Sprintf(`
+provider "google" {
+  default_labels = {
+    default_key1 = "default_value1"
+  }
+}
+
+resource "google_compute_address" "foobar" {
+  name         = "tf-test-address-%s"
+  network_tier = "STANDARD"
+
+  labels = {
+    env                   = "foo"
+    default_expiration_ms = 3600000
+  }
+}
+`, i)
+}
+
+func testAccComputeAddress_resourceLabelsOverridesProviderDefaultLabels(i string) string {
+	return fmt.Sprintf(`
+provider "google" {
+  default_labels = {
+    default_key1 = "default_value1"
+  }
+}
+
+resource "google_compute_address" "foobar" {
+  name         = "tf-test-address-%s"
+  network_tier = "STANDARD"
+
+  labels = {
+    env                   = "foo"
+    default_expiration_ms = 3600000
+    default_key1          = "value1"
+  }
+}
+`, i)
+}
+
+func testAccComputeAddress_moveResourceLabelToProviderDefaultLabels(i string) string {
+	return fmt.Sprintf(`
+provider "google" {
+  default_labels = {
+    default_key1 = "default_value1"
+    env          = "foo"
+  }
+}
+
+resource "google_compute_address" "foobar" {
+  name         = "tf-test-address-%s"
+  network_tier = "STANDARD"
+
+  labels = {
+    default_expiration_ms = 3600000
+    default_key1          = "value1"
+  }
+}
+`, i)
+}
+
 func testAccComputeAddress_internal(i string) string {
 	return fmt.Sprintf(`
 resource "google_compute_address" "internal" {
@@ -136,7 +445,6 @@ resource "google_compute_network" "default" {
   enable_ula_internal_ipv6 = true
   auto_create_subnetworks  = false
 }
-
 resource "google_compute_subnetwork" "foo" {
   name             = "subnetwork-test-%s"
   ip_cidr_range    = "10.0.0.0/16"
@@ -145,7 +453,6 @@ resource "google_compute_subnetwork" "foo" {
   stack_type       = "IPV4_IPV6"
   ipv6_access_type = "INTERNAL"
 }
-
 resource "google_compute_address" "ipv6" {
   name         = "tf-test-address-internal-ipv6-%s"
   subnetwork   = google_compute_subnetwork.foo.self_link
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_attached_disk.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_attached_disk.go.erb
index cec13a19f1da..c03e4399ac3a 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_attached_disk.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_attached_disk.go.erb
@@ -2,6 +2,7 @@
 package compute
 
 import (
+	"context"
 	"fmt"
 	"log"
 	"strings"
@@ -10,6 +11,8 @@ import (
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 
+	"github.com/hashicorp/go-cty/cty"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 
@@ -35,6 +38,11 @@ func ResourceComputeAttachedDisk() *schema.Resource {
 			Delete: schema.DefaultTimeout(300 * time.Second),
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+			computeAttachedDiskDefaultProviderZone,
+		),
+
 		Schema: map[string]*schema.Schema{
 			"disk": {
 				Type:             schema.TypeString,
@@ -260,3 +268,19 @@ func FindDiskByName(disks []*compute.AttachedDisk, id string) *compute.AttachedD
 
 	return nil
 }
+
+func computeAttachedDiskDefaultProviderZone(_ context.Context, diff *schema.ResourceDiff, meta interface{}) error {
+	if diff.GetRawConfig().GetAttr("instance") == cty.UnknownVal(cty.String) {
+		return nil
+	}
+	config := meta.(*transport_tpg.Config)
+	zv, err := tpgresource.ParseZonalFieldValueDiff("instances", diff.Get("instance").(string), "project", "zone", diff, config, false)
+	if err != nil {
+		return err
+	}
+	if err := diff.SetNew("zone", zv.Zone); err != nil {
+		return fmt.Errorf("Failed to retrieve zone: %s", err)
+	}
+
+	return nil
+}
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_attached_disk_test.go b/mmv1/third_party/terraform/services/compute/resource_compute_attached_disk_test.go
index 90b0bbd45f5b..f4ba45548e78 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_attached_disk_test.go
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_attached_disk_test.go
@@ -120,6 +120,37 @@ func TestAccComputeAttachedDisk_count(t *testing.T) {
 
 }
 
+func TestAccComputeAttachedDisk_zoneless(t *testing.T) {
+	t.Setenv("GOOGLE_ZONE", "")
+
+	diskName := fmt.Sprintf("tf-test-disk-%d", acctest.RandInt(t))
+	instanceName := fmt.Sprintf("tf-test-inst-%d", acctest.RandInt(t))
+	importID := fmt.Sprintf("%s/us-central1-a/%s/%s", envvar.GetTestProjectFromEnv(), instanceName, diskName)
+
+	acctest.VcrTest(t, resource.TestCase{
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		// Check destroy isn't a good test here, see comment on testCheckAttachedDiskIsNowDetached
+		CheckDestroy: nil,
+		Steps: []resource.TestStep{
+			{
+				Config: testAttachedDiskResource(diskName, instanceName) + testAttachedDiskResourceAttachment(),
+			},
+			{
+				ResourceName:      "google_compute_attached_disk.test",
+				ImportStateId:     importID,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAttachedDiskResource(diskName, instanceName),
+				Check: resource.ComposeTestCheckFunc(
+					testCheckAttachedDiskIsNowDetached(t, instanceName, diskName),
+				),
+			},
+		},
+	})
+}
+
 // testCheckAttachedDiskIsNowDetached queries a compute instance and iterates through the attached
 // disks to confirm that a specific disk is no longer attached to the instance
 //
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_backend_service_test.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_backend_service_test.go.erb
index 88ddbbda6b04..c27ee1637e96 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_backend_service_test.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_backend_service_test.go.erb
@@ -257,7 +257,6 @@ func TestAccComputeBackendService_withHttpsHealthCheck(t *testing.T) {
 	})
 }
 
-<% unless version == 'ga' -%>
 func TestAccComputeBackendService_withCdnPolicy(t *testing.T) {
 	t.Parallel()
 
@@ -301,10 +300,17 @@ func TestAccComputeBackendService_withCdnPolicy(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
+			{
+				Config: testAccComputeBackendService_withCdnPolicyUseOriginHeaders(serviceName, checkName),
+			},
+			{
+				ResourceName:      "google_compute_backend_service.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
-<% end -%>
 
 func TestAccComputeBackendService_withSecurityPolicy(t *testing.T) {
 	t.Parallel()
@@ -1373,7 +1379,6 @@ resource "google_compute_https_health_check" "zero" {
 `, serviceName, checkName)
 }
 
-<% unless version == 'ga' -%>
 func testAccComputeBackendService_withCdnPolicy(serviceName, checkName string) string {
 	return fmt.Sprintf(`
 resource "google_compute_backend_service" "foobar" {
@@ -1456,7 +1461,30 @@ resource "google_compute_http_health_check" "zero" {
 `, serviceName, headerName, checkName)
 }
 
-<% end -%>
+func testAccComputeBackendService_withCdnPolicyUseOriginHeaders(serviceName, checkName string) string {
+	return fmt.Sprintf(`
+resource "google_compute_backend_service" "foobar" {
+  name          = "%s"
+  health_checks = [google_compute_http_health_check.zero.self_link]
+
+  cdn_policy {
+    cache_mode = "USE_ORIGIN_HEADERS"
+    cache_key_policy {
+      include_protocol       = true
+      include_host           = true
+      include_query_string   = true
+    }
+  }
+}
+
+resource "google_compute_http_health_check" "zero" {
+  name               = "%s"
+  request_path       = "/"
+  check_interval_sec = 1
+  timeout_sec        = 1
+}
+`, serviceName, checkName)
+}
 
 func testAccComputeBackendService_withSecurityPolicy(serviceName, checkName, polName, edgePolName, polLink string, edgePolLink string) string {
 	return fmt.Sprintf(`
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_disk_test.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_disk_test.go.erb
index fb144f76c5bf..30ced5e341ec 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_disk_test.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_disk_test.go.erb
@@ -310,7 +310,11 @@ func TestAccComputeDisk_imageDiffSuppressPublicVendorsFamilyNames(t *testing.T)
 
 	for _, publicImageProject := range tpgcompute.ImageMap {
 		token := ""
-		for paginate := true; paginate; {
+		// Hard limit on number of pages to prevent infinite loops
+		// caused by the API always returning a pagination token
+		page := 0
+		maxPages := 10
+		for paginate := true; paginate && page < maxPages; {
 			resp, err := config.NewComputeClient(config.UserAgent).Images.List(publicImageProject).Filter("deprecated.replacement ne .*images.*").PageToken(token).Do()
 			if err != nil {
 				t.Fatalf("Can't list public images for project %q", publicImageProject)
@@ -323,6 +327,7 @@ func TestAccComputeDisk_imageDiffSuppressPublicVendorsFamilyNames(t *testing.T)
 			}
 			token := resp.NextPageToken
 			paginate = token != ""
+			page++
 		}
 	}
 }
@@ -343,6 +348,7 @@ func TestAccComputeDisk_update(t *testing.T) {
 				ResourceName:      "google_compute_disk.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccComputeDisk_updated(diskName),
@@ -351,6 +357,7 @@ func TestAccComputeDisk_update(t *testing.T) {
 				ResourceName:      "google_compute_disk.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -820,6 +827,7 @@ func TestAccComputeDisk_cloneDisk(t *testing.T) {
 				ResourceName:      "google_compute_disk.disk-clone",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -841,6 +849,7 @@ func TestAccComputeDisk_featuresUpdated(t *testing.T) {
 				ResourceName:      "google_compute_disk.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccComputeDisk_featuresUpdated(diskName),
@@ -849,6 +858,7 @@ func TestAccComputeDisk_featuresUpdated(t *testing.T) {
 				ResourceName:      "google_compute_disk.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_external_vpn_gateway_test.go b/mmv1/third_party/terraform/services/compute/resource_compute_external_vpn_gateway_test.go
index 5f34bac1a1d4..808c39b5c08d 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_external_vpn_gateway_test.go
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_external_vpn_gateway_test.go
@@ -26,9 +26,10 @@ func TestAccComputeExternalVPNGateway_updateLabels(t *testing.T) {
 				),
 			},
 			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccComputeExternalVPNGateway_updateLabels(rnd, "test-updated", "test-updated"),
@@ -38,9 +39,10 @@ func TestAccComputeExternalVPNGateway_updateLabels(t *testing.T) {
 				),
 			},
 			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_forwarding_rule_test.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_forwarding_rule_test.go.erb
index c1445b640f3c..d31b00d97263 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_forwarding_rule_test.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_forwarding_rule_test.go.erb
@@ -27,6 +27,7 @@ func TestAccComputeForwardingRule_update(t *testing.T) {
 				ResourceName:      "google_compute_forwarding_rule.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+        ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			resource.TestStep{
 				Config: testAccComputeForwardingRule_update(poolName, ruleName),
@@ -35,6 +36,7 @@ func TestAccComputeForwardingRule_update(t *testing.T) {
 				ResourceName:      "google_compute_forwarding_rule.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+        ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -203,6 +205,51 @@ func TestAccComputeForwardingRule_forwardingRuleVpcPscExampleUpdate(t *testing.T
 	})
 }
 
+func TestAccComputeForwardingRule_forwardingRulePscRecreate(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeForwardingRuleDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeForwardingRule_forwardingRulePscRecreate(context),
+			},
+			{
+				ResourceName:      "google_compute_forwarding_rule.default",
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"recreate_closed_psc"},
+			},
+			{
+				Config: testAccComputeForwardingRule_forwardingRulePscRecreate(context),
+			},
+			{
+				ResourceName:      "google_compute_forwarding_rule.default",
+				ImportState:       true,
+				ImportStateVerify: true,
+				ExpectNonEmptyPlan: true,
+        ImportStateVerifyIgnore: []string{"recreate_closed_psc"},
+			},
+			{
+				Config: testAccComputeForwardingRule_forwardingRulePscRecreate(context),
+			},
+			{
+				ResourceName:      "google_compute_forwarding_rule.default",
+				ImportState:       true,
+				ImportStateVerify: true,
+				ExpectNonEmptyPlan: true,
+        ImportStateVerifyIgnore: []string{"recreate_closed_psc"},
+			},
+		},
+	})
+}
+
 func TestAccComputeForwardingRule_forwardingRuleRegionalSteeringExampleUpdate(t *testing.T) {
 	t.Parallel()
 
@@ -237,6 +284,31 @@ func TestAccComputeForwardingRule_forwardingRuleRegionalSteeringExampleUpdate(t
 	})
 }
 
+func TestAccComputeForwardingRule_forwardingRuleIpAddressIpv6(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeForwardingRuleDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeForwardingRule_forwardingRuleIpAddressIpv6(context),
+			},
+			{
+				ResourceName:            "google_compute_forwarding_rule.external",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"backend_service", "network", "subnetwork", "region"},
+			},
+		},
+	})
+}
+
 func testAccComputeForwardingRule_basic(poolName, ruleName string) string {
 	return fmt.Sprintf(`
 resource "google_compute_target_pool" "foo-tp" {
@@ -445,7 +517,7 @@ resource "google_compute_firewall" "fw_hc" {
   target_tags = ["allow-health-check"]
 }
 
-# allow communication within the subnet 
+# allow communication within the subnet
 resource "google_compute_firewall" "fw_ilb_to_backends" {
   name          = "tf-test-l4-ilb-fw-allow-ilb-to-backends%{random_suffix}"
   provider      = google-beta
@@ -601,6 +673,107 @@ resource "google_compute_address" "consumer_address" {
 }
 
 
+// Producer service attachment
+
+resource "google_compute_network" "producer_net" {
+  name                    = "tf-test-producer-net%{random_suffix}"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "producer_subnet" {
+  name          = "tf-test-producer-net%{random_suffix}"
+  ip_cidr_range = "10.0.0.0/16"
+  region        = "us-central1"
+  network       = google_compute_network.producer_net.id
+}
+
+resource "google_compute_subnetwork" "psc_producer_subnet" {
+  name          = "tf-test-producer-psc-net%{random_suffix}"
+  ip_cidr_range = "10.1.0.0/16"
+  region        = "us-central1"
+
+  purpose       = "PRIVATE_SERVICE_CONNECT"
+  network       = google_compute_network.producer_net.id
+}
+
+resource "google_compute_service_attachment" "producer_service_attachment" {
+  name        = "tf-test-producer-service%{random_suffix}"
+  region      = "us-central1"
+  description = "A service attachment configured with Terraform"
+
+  enable_proxy_protocol = true
+  connection_preference = "ACCEPT_AUTOMATIC"
+  nat_subnets           = [google_compute_subnetwork.psc_producer_subnet.name]
+  target_service        = google_compute_forwarding_rule.producer_target_service.id
+}
+
+resource "google_compute_forwarding_rule" "producer_target_service" {
+  name     = "tf-test-producer-forwarding-rule%{random_suffix}"
+  region   = "us-central1"
+
+  load_balancing_scheme = "INTERNAL"
+  backend_service       = google_compute_region_backend_service.producer_service_backend.id
+  all_ports             = true
+  network               = google_compute_network.producer_net.name
+  subnetwork            = google_compute_subnetwork.producer_subnet.name
+}
+
+resource "google_compute_region_backend_service" "producer_service_backend" {
+  name     = "tf-test-producer-service-backend%{random_suffix}"
+  region   = "us-central1"
+
+  health_checks = [google_compute_health_check.producer_service_health_check.id]
+}
+
+resource "google_compute_health_check" "producer_service_health_check" {
+  name     = "tf-test-producer-service-health-check%{random_suffix}"
+
+  check_interval_sec = 1
+  timeout_sec        = 1
+  tcp_health_check {
+    port = "80"
+  }
+}
+`, context)
+}
+
+func testAccComputeForwardingRule_forwardingRulePscRecreate(context map[string]interface{}) string {
+
+	return acctest.Nprintf(`
+// Forwarding rule for VPC private service connect
+resource "google_compute_forwarding_rule" "default" {
+  name                    = "tf-test-psc-endpoint%{random_suffix}"
+  region                  = "us-central1"
+  load_balancing_scheme   = ""
+  target                  = google_compute_service_attachment.producer_service_attachment.id
+  network                 = google_compute_network.consumer_net.name
+  ip_address              = google_compute_address.consumer_address.id
+  allow_psc_global_access = true
+  recreate_closed_psc     = true
+}
+
+// Consumer service endpoint
+
+resource "google_compute_network" "consumer_net" {
+  name                    = "tf-test-consumer-net%{random_suffix}"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "consumer_subnet" {
+  name          = "tf-test-consumer-net%{random_suffix}"
+  ip_cidr_range = "10.0.0.0/16"
+  region        = "us-central1"
+  network       = google_compute_network.consumer_net.id
+}
+
+resource "google_compute_address" "consumer_address" {
+  name         = "tf-test-website-ip%{random_suffix}-1"
+  region       = "us-central1"
+  subnetwork   = google_compute_subnetwork.consumer_subnet.id
+  address_type = "INTERNAL"
+}
+
+
 // Producer service attachment
 
 resource "google_compute_network" "producer_net" {
@@ -697,3 +870,45 @@ resource "google_compute_forwarding_rule" "external" {
 }
 `, context)
 }
+
+func testAccComputeForwardingRule_forwardingRuleIpAddressIpv6(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_compute_address" "basic" {
+	name = "tf-test-address%{random_suffix}"
+	region = "us-central1"
+
+	address_type       = "EXTERNAL"
+	ipv6_endpoint_type = "NETLB"
+	ip_version         = "IPV6"
+	subnetwork         = google_compute_subnetwork.subnetwork-ipv6.id
+}
+
+resource "google_compute_region_backend_service" "external" {
+	name = "tf-test-backend%{random_suffix}"
+	region = "us-central1"
+	load_balancing_scheme = "EXTERNAL"
+}
+
+resource "google_compute_forwarding_rule" "external" {
+	name = "tf-test-forwarding-rule%{random_suffix}"
+	region = "us-central1"
+	ip_address = google_compute_address.basic.self_link
+	backend_service = google_compute_region_backend_service.external.self_link
+	load_balancing_scheme = "EXTERNAL"
+}
+
+resource "google_compute_subnetwork" "subnetwork-ipv6" {
+		name          = "tf-test-subnetwork%{random_suffix}"
+		ip_cidr_range = "10.0.0.0/22"
+		region        = "us-central1"
+		stack_type       = "IPV4_IPV6"
+		ipv6_access_type = "EXTERNAL"
+		network       = google_compute_network.custom-test.id
+}
+
+resource "google_compute_network" "custom-test" {
+	name                    = "tf-test-network%{random_suffix}"
+	auto_create_subnetworks = false
+}
+`, context)
+}
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_global_forwarding_rule_test.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_global_forwarding_rule_test.go.erb
index 364a2583e48c..e4f0036ae180 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_global_forwarding_rule_test.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_global_forwarding_rule_test.go.erb
@@ -108,7 +108,7 @@ func TestAccComputeGlobalForwardingRule_labels(t *testing.T) {
 				ResourceName:      "google_compute_global_forwarding_rule.forwarding_rule",
 				ImportState:       true,
 				ImportStateVerify: true,
-                                ImportStateVerifyIgnore: []string{"port_range", "target"},
+				ImportStateVerifyIgnore: []string{"port_range", "target", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccComputeGlobalForwardingRule_labelsUpdated(fr, proxy, backend, hc, urlmap),
@@ -117,7 +117,7 @@ func TestAccComputeGlobalForwardingRule_labels(t *testing.T) {
 				ResourceName:      "google_compute_global_forwarding_rule.forwarding_rule",
 				ImportState:       true,
 				ImportStateVerify: true,
-                                ImportStateVerifyIgnore: []string{"port_range", "target"},
+				ImportStateVerifyIgnore: []string{"port_range", "target", "labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_image_test.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_image_test.go.erb
index 1bc622d85561..c75321a445c8 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_image_test.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_image_test.go.erb
@@ -34,6 +34,7 @@ func TestAccComputeImage_withLicense(t *testing.T) {
 				ResourceName:      "google_compute_image.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -57,7 +58,6 @@ func TestAccComputeImage_update(t *testing.T) {
 					testAccCheckComputeImageExists(
 						t, "google_compute_image.foobar", &image),
 					testAccCheckComputeImageContainsLabel(&image, "my-label", "my-label-value"),
-					testAccCheckComputeImageContainsLabel(&image, "empty-label", ""),
 				),
 			},
 			{
@@ -74,7 +74,7 @@ func TestAccComputeImage_update(t *testing.T) {
 				ResourceName:            "google_compute_image.foobar",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"raw_disk"},
+				ImportStateVerifyIgnore: []string{"raw_disk", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -370,7 +370,6 @@ resource "google_compute_image" "foobar" {
   }
   labels = {
     my-label    = "my-label-value"
-    empty-label = ""
   }
 }
 `, name)
@@ -396,7 +395,6 @@ resource "google_compute_image" "foobar" {
 
   labels = {
     my-label    = "my-label-value"
-    empty-label = ""
   }
   licenses = [
     "https://www.googleapis.com/compute/v1/projects/debian-cloud/global/licenses/debian-11-bullseye",
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_instance.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_instance.go.erb
index 9ade334d7099..d0e8b81c8d0f 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_instance.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_instance.go.erb
@@ -46,6 +46,9 @@ var (
 		"boot_disk.0.initialize_params.0.image",
 		"boot_disk.0.initialize_params.0.labels",
 		"boot_disk.0.initialize_params.0.resource_manager_tags",
+<% unless version == 'ga' -%>
+		"boot_disk.0.initialize_params.0.enable_confidential_compute",
+<% end -%>
 	}
 
 	schedulingKeys = []string{
@@ -241,6 +244,15 @@ func ResourceComputeInstance() *schema.Resource {
 										ForceNew:     true,
 										Description:  `A map of resource manager tags. Resource manager tag keys and values have the same definition as resource manager tags. Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/456. The field is ignored (both PUT & PATCH) when empty.`,
 									},
+<% unless version == 'ga' -%>
+									"enable_confidential_compute": {
+										Type:             schema.TypeBool,
+										Optional:         true,
+										AtLeastOneOf: initializeParamsKeys,
+										ForceNew:         true,
+										Description:      `A flag to enable confidential compute mode on boot disk`,
+									},
+<% end -%>
 								},
 							},
 						},
@@ -305,6 +317,17 @@ func ResourceComputeInstance() *schema.Resource {
 							Description:      `The name or self_link of the subnetwork attached to this interface.`,
 						},
 
+						<% if version == "beta" -%>
+						"network_attachment": {
+							Type:             schema.TypeString,
+							Optional:         true,
+							Computed:         true,
+							ForceNew:     	  true,
+							DiffSuppressFunc: tpgresource.CompareSelfLinkOrResourceName,
+							Description:      `The URL of the network attachment that this interface should connect to in the following format: projects/{projectNumber}/regions/{region_name}/networkAttachments/{network_attachment_name}.`,
+						},
+						<% end %>
+
 						"subnetwork_project": {
 							Type:        schema.TypeString,
 							Optional:    true,
@@ -356,6 +379,13 @@ func ResourceComputeInstance() *schema.Resource {
 										Optional:    true,
 										Description: `The DNS domain name for the public PTR record.`,
 									},
+									<% unless version == 'ga' -%>
+									"security_policy": {
+										Type:        schema.TypeString,
+										Computed:    true,
+										Description: `A full or partial URL to a security policy to add to this instance. If this field is set to an empty string it will remove the associated security policy.`,
+									},
+									<% end -%>
 								},
 							},
 						},
@@ -433,6 +463,13 @@ func ResourceComputeInstance() *schema.Resource {
 										ForceNew:    true,
 										Description: `The name of this access configuration. In ipv6AccessConfigs, the recommended name is External IPv6.`,
 									},
+									<% unless version == 'ga' -%>
+									"security_policy": {
+										Type:        schema.TypeString,
+										Computed:    true,
+										Description: `A full or partial URL to a security policy to add to this instance. If this field is set to an empty string it will remove the associated security policy.`,
+									},
+									<% end -%>
 								},
 							},
 						},
@@ -458,6 +495,14 @@ func ResourceComputeInstance() *schema.Resource {
 							ForceNew:    true,
 							Description: `The networking queue count that's specified by users for the network interface. Both Rx and Tx queues will be set to this number. It will be empty if not specified.`,
 						},
+
+						<% unless version == 'ga' -%>
+						"security_policy": {
+							Type:        schema.TypeString,
+							Optional:    true,
+							Description: `A full or partial URL to a security policy to add to this instance. If this field is set to an empty string it will remove the associated security policy.`,
+						},
+						<% end -%>
 					},
 				},
 			},
@@ -613,7 +658,24 @@ func ResourceComputeInstance() *schema.Resource {
 				Type:        schema.TypeMap,
 				Optional:    true,
 				Elem:        &schema.Schema{Type: schema.TypeString},
-				Description: `A set of key/value label pairs assigned to the instance.`,
+				Description: `A set of key/value label pairs assigned to the instance.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+			},
+
+			"terraform_labels": {
+				Type:        schema.TypeMap,
+				Computed:    true,
+				Description: `The combination of labels configured directly on the resource and default labels configured on the provider.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+			},
+
+			"effective_labels": {
+				Type:        schema.TypeMap,
+				Computed:    true,
+				Description: `All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
 			},
 
 			"metadata": {
@@ -789,6 +851,12 @@ be from 0 to 999,999,999 inclusive.`,
 				Description: `The scratch disks attached to the instance.`,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
+						"device_name": {
+							Type:        schema.TypeString,
+							Optional:    true,
+							Computed:    true,
+							Description: `Name with which the attached disk is accessible under /dev/disk/by-id/`,
+						},
 						"interface": {
 							Type:         schema.TypeString,
 							Required:     true,
@@ -1049,6 +1117,8 @@ be from 0 to 999,999,999 inclusive.`,
 			},
 		},
 		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+			tpgresource.DefaultProviderZone,
 			customdiff.If(
 				func(_ context.Context, d *schema.ResourceDiff, meta interface{}) bool {
 					return d.HasChange("guest_accelerator")
@@ -1057,6 +1127,7 @@ be from 0 to 999,999,999 inclusive.`,
 			),
 			desiredStatusDiff,
 			forceNewIfNetworkIPNotUpdatable,
+			tpgresource.SetLabelsDiff,
 		),
 		UseJSONNumber: true,
 	}
@@ -1190,7 +1261,7 @@ func expandComputeInstance(project string, d *schema.ResourceData, config *trans
 		NetworkPerformanceConfig:   networkPerformanceConfig,
 		Tags:                       resourceInstanceTags(d),
 		Params:                     params,
-		Labels:                     tpgresource.ExpandLabels(d),
+		Labels:                     tpgresource.ExpandEffectiveLabels(d),
 		ServiceAccounts:            expandServiceAccounts(d.Get("service_account").([]interface{})),
 		GuestAccelerators:          accels,
 		MinCpuPlatform:             d.Get("min_cpu_platform").(string),
@@ -1289,6 +1360,13 @@ func resourceComputeInstanceCreate(d *schema.ResourceData, meta interface{}) err
 		return err
 	}
 
+	<% unless version == 'ga' -%>
+	securityPolicies, err := computeInstanceMapSecurityPoliciesCreate(d, config)
+	if err != nil {
+		return err
+	}
+	<% end -%>
+
 	log.Printf("[INFO] Requesting instance creation")
 	op, err := config.NewComputeClient(userAgent).Instances.Insert(project, zone.Name, instance).Do()
 	if err != nil {
@@ -1306,6 +1384,13 @@ func resourceComputeInstanceCreate(d *schema.ResourceData, meta interface{}) err
 		return waitErr
 	}
 
+	<% unless version == 'ga' -%>
+	err = computeInstanceAddSecurityPolicy(d, config, securityPolicies, project, z, userAgent, instance.Name)
+	if err != nil {
+		return fmt.Errorf("Error creating instance while setting the security policies: %s", err)
+	}
+	<% end -%>
+	
 	err = waitUntilInstanceHasDesiredStatus(config, d)
 	if err != nil {
 		return fmt.Errorf("Error waiting for status: %s", err)
@@ -1390,7 +1475,15 @@ func resourceComputeInstanceRead(d *schema.ResourceData, meta interface{}) error
 		}
 	}
 
-	if err := d.Set("labels", instance.Labels); err != nil {
+	if err := tpgresource.SetLabels(instance.Labels, d, "labels"); err != nil {
+		return err
+	}
+
+	if err := tpgresource.SetLabels(instance.Labels, d, "terraform_labels"); err != nil {
+		return err
+	}
+
+	if err := d.Set("effective_labels", instance.Labels); err != nil {
 		return err
 	}
 
@@ -1509,7 +1602,7 @@ func resourceComputeInstanceRead(d *schema.ResourceData, meta interface{}) error
 	}
 <% unless version == 'ga' -%>
 	// Add extra check on Scheduling to prevent STOP instance setting MaxRunDuration.
-	// When Instance being stopped, GCE will wipe out the MaxRunDuration field. 
+	// When Instance being stopped, GCE will wipe out the MaxRunDuration field.
 	// And Terraform has no visiblity on this field after then. Given the infrastructure
 	// constraint, MaxRunDuration will only be supported with instance has
 	// DELETE InstanceTerminationAction
@@ -1669,8 +1762,8 @@ func resourceComputeInstanceUpdate(d *schema.ResourceData, meta interface{}) err
 		}
 	}
 
-	if d.HasChange("labels") {
-		labels := tpgresource.ExpandLabels(d)
+	if d.HasChange("effective_labels") {
+		labels := tpgresource.ExpandEffectiveLabels(d)
 		labelFingerprint := d.Get("label_fingerprint").(string)
 		req := compute.InstancesSetLabelsRequest{Labels: labels, LabelFingerprint: labelFingerprint}
 
@@ -1748,6 +1841,30 @@ func resourceComputeInstanceUpdate(d *schema.ResourceData, meta interface{}) err
 		return fmt.Errorf("Instance had unexpected number of network interfaces: %d", len(instance.NetworkInterfaces))
 	}
 
+	<% unless version == 'ga' -%>	
+	updateSecurityPolicy := false
+	for i := 0; i < len(instance.NetworkInterfaces); i++ {
+		prefix := fmt.Sprintf("network_interface.%d", i)
+		// check if sec policy has been changed
+		// check if access config has been changed because it may be deleted and needs to be re-created.
+		if d.HasChange(prefix+".security_policy") || d.HasChange(prefix+".access_config") || d.HasChange(prefix+".ipv6_access_config") {
+			if instance.Status != "RUNNING" {
+				return fmt.Errorf("Error to update security policy because the current instance status must be \"RUNNING\". The security policy or some access config may have changed which requires the security policy to be re-applied")
+			}
+			updateSecurityPolicy = true
+		}
+	}
+
+	securityPolicies := make(map[string][]string)
+	if updateSecurityPolicy {
+		// map the security policies to call SetSecurityPolicy because the next section of the code removes and re-creates the access_config which ends up removing the security_policy.
+		securityPolicies, err = computeInstanceMapSecurityPoliciesUpdate(d, config)
+		if err != nil {
+			return err
+		}
+	}
+	<% end -%>
+
 	var updatesToNIWhileStopped []func(inst *compute.Instance) error
 	for i := 0; i < len(networkInterfaces); i++ {
 		prefix := fmt.Sprintf("network_interface.%d", i)
@@ -2289,6 +2406,14 @@ func resourceComputeInstanceUpdate(d *schema.ResourceData, meta interface{}) err
 		}
 	}
 
+	<% unless version == 'ga' -%>
+	// The access config must be updated only if the machine is still RUNNING and after each access_config for each interface has been re-created.
+	err = computeInstanceAddSecurityPolicy(d, config, securityPolicies, project, zone, userAgent, instance.Name)
+	if err != nil {
+		return fmt.Errorf("Error updating instance while setting the security policies: %s", err)
+	}
+	<% end -%>
+
 	// We made it, disable partial mode
 	d.Partial(false)
 
@@ -2616,6 +2741,12 @@ func expandBootDisk(d *schema.ResourceData, config *transport_tpg.Config, projec
 			disk.InitializeParams.DiskSizeGb = int64(v.(int))
 		}
 
+		<% unless version == 'ga' -%>
+		if v, ok := d.GetOk("boot_disk.0.initialize_params.0.enable_confidential_compute"); ok {
+			disk.InitializeParams.EnableConfidentialCompute = v.(bool)
+		}
+		<% end -%>
+
 		if v, ok := d.GetOk("boot_disk.0.initialize_params.0.type"); ok {
 			diskTypeName := v.(string)
 			diskType, err := readDiskType(config, d, diskTypeName)
@@ -2681,6 +2812,9 @@ func flattenBootDisk(d *schema.ResourceData, disk *compute.AttachedDisk, config
 			"size":   diskDetails.SizeGb,
 			"labels": diskDetails.Labels,
 			"resource_manager_tags": d.Get("boot_disk.0.initialize_params.0.resource_manager_tags"),
+<% unless version == 'ga' -%>
+			"enable_confidential_compute": diskDetails.EnableConfidentialCompute,
+<% end -%>
 		}}
 	}
 
@@ -2710,6 +2844,7 @@ func expandScratchDisks(d *schema.ResourceData, config *transport_tpg.Config, pr
 		scratchDisks = append(scratchDisks, &compute.AttachedDisk{
 			AutoDelete: true,
 			Type:       "SCRATCH",
+			DeviceName: d.Get(fmt.Sprintf("scratch_disk.%d.device_name", i)).(string),
 			Interface:  d.Get(fmt.Sprintf("scratch_disk.%d.interface", i)).(string),
 			DiskSizeGb: int64(d.Get(fmt.Sprintf("scratch_disk.%d.size", i)).(int)),
 			InitializeParams: &compute.AttachedDiskInitializeParams{
@@ -2723,6 +2858,7 @@ func expandScratchDisks(d *schema.ResourceData, config *transport_tpg.Config, pr
 
 func flattenScratchDisk(disk *compute.AttachedDisk) map[string]interface{} {
 	result := map[string]interface{}{
+		"device_name": disk.DeviceName,
 		"interface": disk.Interface,
 		"size": disk.DiskSizeGb,
 	}
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_instance_from_template.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_instance_from_template.go.erb
index 5d624b4b797e..fc61dd0c02c5 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_instance_from_template.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_instance_from_template.go.erb
@@ -7,6 +7,7 @@ import (
 	"log"
 	"strings"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
@@ -32,7 +33,10 @@ func ResourceComputeInstanceFromTemplate() *schema.Resource {
 		Timeouts: ResourceComputeInstance().Timeouts,
 
 		Schema:        computeInstanceFromTemplateSchema(),
-		CustomizeDiff: ResourceComputeInstance().CustomizeDiff,
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+			ResourceComputeInstance().CustomizeDiff,
+		),
 		UseJSONNumber: true,
 	}
 }
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_instance_from_template_test.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_instance_from_template_test.go.erb
index 5a4031afb6ff..e5358ed72163 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_instance_from_template_test.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_instance_from_template_test.go.erb
@@ -244,8 +244,10 @@ func TestAccComputeInstanceFromTemplate_overrideScratchDisk(t *testing.T) {
 					testAccCheckComputeInstanceExists(t, resourceName, &instance),
 
 					// Check that fields were set based on the template
-					resource.TestCheckResourceAttr(resourceName, "scratch_disk.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "scratch_disk.#", "2"),
 					resource.TestCheckResourceAttr(resourceName, "scratch_disk.0.interface", "NVME"),
+          resource.TestCheckResourceAttr(resourceName, "scratch_disk.1.interface", "NVME"),
+          resource.TestCheckResourceAttr(resourceName, "scratch_disk.1.device_name", "override-local-ssd"),
 				),
 			},
 		},
@@ -394,6 +396,14 @@ resource "google_compute_instance_template" "foobar" {
     disk_size_gb = 375
   }
 
+  disk {
+    device_name  = "test-local-ssd"
+    disk_type    = "local-ssd"
+    type         = "SCRATCH"
+    interface    = "NVME"
+    disk_size_gb = 375
+  }
+
   disk {
     source_image = data.google_compute_image.my_image.self_link
     auto_delete  = true
@@ -468,6 +478,14 @@ resource "google_compute_instance_template" "foobar" {
     disk_size_gb = 375
   }
 
+  disk {
+    device_name  = "test-local-ssd"
+    disk_type    = "local-ssd"
+    type         = "SCRATCH"
+    interface    = "NVME"
+    disk_size_gb = 375
+  }
+
   disk {
     source_image = data.google_compute_image.my_image.self_link
     auto_delete  = true
@@ -546,6 +564,14 @@ resource "google_compute_instance_template" "foobar" {
     disk_size_gb = 375
   }
 
+  disk {
+    device_name  = "test-local-ssd"
+    disk_type    = "local-ssd"
+    type         = "SCRATCH"
+    interface    = "NVME"
+    disk_size_gb = 375
+  }
+
   disk {
     source_image = data.google_compute_image.my_image.self_link
     auto_delete  = true
@@ -640,6 +666,14 @@ resource "google_compute_region_instance_template" "foobar" {
     disk_size_gb = 375
   }
 
+  disk {
+    device_name  = "test-local-ssd"
+    disk_type    = "local-ssd"
+    type         = "SCRATCH"
+    interface    = "NVME"
+    disk_size_gb = 375
+  }
+
   network_interface {
     network = "default"
   }
@@ -707,6 +741,14 @@ resource "google_compute_instance_template" "foobar" {
     disk_size_gb = 375
   }
 
+  disk {
+    device_name  = "test-local-ssd"
+    disk_type    = "local-ssd"
+    type         = "SCRATCH"
+    interface    = "NVME"
+    disk_size_gb = 375
+  }
+
   disk {
     source_image = data.google_compute_image.my_image.self_link
     auto_delete  = true
@@ -922,6 +964,16 @@ resource "google_compute_instance_template" "template" {
     boot         = false
   }
 
+  disk {
+    device_name  = "test-local-ssd"
+    type         = "SCRATCH"
+    disk_type    = "local-ssd"
+    disk_size_gb = 375
+    interface    = "SCSI"
+    auto_delete  = true
+    boot         = false
+  }
+
   network_interface {
     network = "default"
   }
@@ -937,6 +989,11 @@ resource "google_compute_instance_from_template" "inst" {
   scratch_disk {
     interface = "NVME"
   }
+
+  scratch_disk {
+    device_name = "override-local-ssd"
+    interface   = "NVME"
+  }
 }
 `, templateDisk, overrideDisk, template, instance)
 }
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_instance_group.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_instance_group.go.erb
index 856c24d3b6aa..e577bf497906 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_instance_group.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_instance_group.go.erb
@@ -12,6 +12,7 @@ import (
 
 	"google.golang.org/api/googleapi"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 
 <% if version == "ga" -%>
@@ -36,6 +37,11 @@ func ResourceComputeInstanceGroup() *schema.Resource {
 			Update: schema.DefaultTimeout(6 * time.Minute),
 			Delete: schema.DefaultTimeout(6 * time.Minute),
 		},
+		
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+			tpgresource.DefaultProviderZone,
+		),
 
 		SchemaVersion: 2,
 		MigrateState:  resourceComputeInstanceGroupMigrateState,
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_instance_group_manager.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_instance_group_manager.go.erb
index ff22d40c0662..724bc0ce8fd1 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_instance_group_manager.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_instance_group_manager.go.erb
@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 
@@ -36,6 +37,10 @@ func ResourceComputeInstanceGroupManager() *schema.Resource {
 			Update: schema.DefaultTimeout(15 * time.Minute),
 			Delete: schema.DefaultTimeout(15 * time.Minute),
 		},
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+			tpgresource.DefaultProviderZone,
+		),
 		Schema: map[string]*schema.Schema{
 			"base_instance_name": {
 				Type:        schema.TypeString,
@@ -349,7 +354,6 @@ func ResourceComputeInstanceGroupManager() *schema.Resource {
 				Description: `When used with wait_for_instances specifies the status to wait for. When STABLE is specified this resource will wait until the instances are stable before returning. When UPDATED is set, it will wait for the version target to be reached and any per instance configs to be effective and all instances configs to be effective as well as all instances to be stable before returning.`,
 				<% end -%>
 			},
-			<% unless version == "ga" -%>
 			"stateful_internal_ip": {
 				Type:        schema.TypeList,
 				Optional:    true,
@@ -392,7 +396,6 @@ func ResourceComputeInstanceGroupManager() *schema.Resource {
 					},
 				},
 			},
-			<% end -%>
 			"stateful_disk": {
 				Type:        schema.TypeSet,
 				Optional:    true,
@@ -775,14 +778,12 @@ func resourceComputeInstanceGroupManagerRead(d *schema.ResourceData, meta interf
 	if err = d.Set("stateful_disk", flattenStatefulPolicy(manager.StatefulPolicy)); err != nil {
 		return fmt.Errorf("Error setting stateful_disk in state: %s", err.Error())
 	}
-	<% unless version == "ga" -%>
 	if err = d.Set("stateful_internal_ip", flattenStatefulPolicyStatefulInternalIps(manager.StatefulPolicy)); err != nil {
 		return fmt.Errorf("Error setting stateful_internal_ip in state: %s", err.Error())
 	}
 	if err = d.Set("stateful_external_ip", flattenStatefulPolicyStatefulExternalIps(manager.StatefulPolicy)); err != nil {
 		return fmt.Errorf("Error setting stateful_external_ip in state: %s", err.Error())
 	}
-	<% end -%>
 	if err := d.Set("fingerprint", manager.Fingerprint); err != nil {
 		return fmt.Errorf("Error setting fingerprint: %s", err)
 	}
@@ -1120,7 +1121,6 @@ func expandStatefulPolicy(d *schema.ResourceData) *compute.StatefulPolicy {
 		preservedState.Disks = disks
 	}
 
-	<% unless version == "ga" -%>
 	if d.HasChange("stateful_internal_ip") {
 		oldInternalIps, newInternalIps := d.GetChange("stateful_internal_ip")
 		preservedState.InternalIPs = expandStatefulIps(newInternalIps.([]interface{}))
@@ -1149,7 +1149,6 @@ func expandStatefulPolicy(d *schema.ResourceData) *compute.StatefulPolicy {
 		preservedState.ForceSendFields = append(preservedState.ForceSendFields, "ExternalIPs")
 	}
 
-	<% end -%>
 	statefulPolicy := &compute.StatefulPolicy{PreservedState: preservedState}
 	statefulPolicy.ForceSendFields = append(statefulPolicy.ForceSendFields, "PreservedState")
 
@@ -1169,7 +1168,6 @@ func expandStatefulDisks(statefulDisk []interface{}) map[string]compute.Stateful
 	return statefulDisksMap
 }
 
-<% unless version == "ga" -%>
 func expandStatefulIps(statefulIP []interface{}) map[string]compute.StatefulPolicyPreservedStateNetworkIp {
 	statefulIpsMap :=	make(map[string]compute.StatefulPolicyPreservedStateNetworkIp)
 
@@ -1182,7 +1180,6 @@ func expandStatefulIps(statefulIP []interface{}) map[string]compute.StatefulPoli
 	}
 	return statefulIpsMap
 }
-<% end -%>
 
 func expandVersions(configured []interface{}) []*compute.InstanceGroupManagerVersion {
 	versions := make([]*compute.InstanceGroupManagerVersion, 0, len(configured))
@@ -1308,7 +1305,7 @@ func flattenStatefulPolicy(statefulPolicy *compute.StatefulPolicy) []map[string]
 	}
 	return result
 }
-<% unless version == "ga" -%>
+
 func flattenStatefulPolicyStatefulInternalIps(statefulPolicy *compute.StatefulPolicy) []map[string]interface{} {
 	if statefulPolicy == nil || statefulPolicy.PreservedState == nil || statefulPolicy.PreservedState.InternalIPs == nil {
 		return make([]map[string]interface{}, 0, 0)
@@ -1340,7 +1337,7 @@ func flattenStatefulPolicyStatefulExternalIps(statefulPolicy *compute.StatefulPo
 	}
 	return result
 }
-<% end -%>
+
 func flattenUpdatePolicy(updatePolicy *compute.InstanceGroupManagerUpdatePolicy) []map[string]interface{} {
 	results := []map[string]interface{}{}
 	if updatePolicy != nil {
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_instance_group_manager_test.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_instance_group_manager_test.go.erb
index ed4b2e2fef97..2bef96288443 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_instance_group_manager_test.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_instance_group_manager_test.go.erb
@@ -1483,7 +1483,7 @@ resource "google_compute_instance_group_manager" "igm-basic" {
     device_name = "my-stateful-disk"
     delete_rule = "ON_PERMANENT_INSTANCE_DELETION"
   }
-<% unless version == "ga" -%>
+
   stateful_internal_ip {
     interface_name = "nic0"
     delete_rule = "ON_PERMANENT_INSTANCE_DELETION"
@@ -1493,7 +1493,6 @@ resource "google_compute_instance_group_manager" "igm-basic" {
     interface_name = "nic0"
     delete_rule = "NEVER"
   }
-<% end -%>
 }
 
 resource "google_compute_http_health_check" "zero" {
@@ -1579,7 +1578,6 @@ resource "google_compute_instance_group_manager" "igm-basic" {
     delete_rule = "ON_PERMANENT_INSTANCE_DELETION"
   }
 
-<% unless version == "ga" -%>
   stateful_internal_ip {
     interface_name = "nic0"
     delete_rule = "ON_PERMANENT_INSTANCE_DELETION"
@@ -1589,7 +1587,6 @@ resource "google_compute_instance_group_manager" "igm-basic" {
     interface_name = "nic0"
     delete_rule = "NEVER"
   }
-<% end -%>
 }
 
 resource "google_compute_http_health_check" "zero" {
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_instance_settings_test.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_instance_settings_test.go.erb
new file mode 100644
index 000000000000..87db91bd798e
--- /dev/null
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_instance_settings_test.go.erb
@@ -0,0 +1,107 @@
+<% autogen_exception -%>
+
+package compute_test
+
+import (
+<% if version == "beta" -%>
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+<% end -%>
+
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+)
+
+<% unless version == 'ga' -%>
+func TestAccComputeInstanceSettings_update(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix":   acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
+		CheckDestroy:             testAccCheckComputeInstanceSettingsDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeInstanceSettings_basic(context),
+			},
+			{
+				ResourceName:            "google_compute_instance_settings.gce_instance_settings",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"zone"},
+			},
+			{
+				Config: testAccComputeInstanceSettings_update(context),
+			},
+			{
+				ResourceName:            "google_compute_instance_settings.gce_instance_settings",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"zone"},
+			},
+			{
+				Config: testAccComputeInstanceSettings_delete(context),
+			},
+			{
+				ResourceName:            "google_compute_instance_settings.gce_instance_settings",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"zone"},
+			},
+		},
+	})
+}
+<% end -%>
+
+func testAccComputeInstanceSettings_basic(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+
+resource "google_compute_instance_settings" "gce_instance_settings" {
+  provider = google-beta
+  zone = "us-east7-b"
+  metadata {
+    items = {
+      foo = "baz"
+    }
+  }
+}
+
+`, context)
+}
+
+func testAccComputeInstanceSettings_update(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+
+resource "google_compute_instance_settings" "gce_instance_settings" {
+  provider = google-beta
+  zone = "us-east7-b"
+  metadata {
+    items = {
+      foo = "bar"
+      baz = "qux"
+    }
+  }
+}
+
+`, context)
+}
+
+func testAccComputeInstanceSettings_delete(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+
+resource "google_compute_instance_settings" "gce_instance_settings" {
+  provider = google-beta
+  zone = "us-east7-b"
+  metadata {
+    items = {
+      baz = "qux"
+    }
+  }
+}
+
+`, context)
+}
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_instance_template.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_instance_template.go.erb
index c12cecaec2d9..a3175c9ccbac 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_instance_template.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_instance_template.go.erb
@@ -56,15 +56,18 @@ func ResourceComputeInstanceTemplate() *schema.Resource {
 	return &schema.Resource{
 		Create: resourceComputeInstanceTemplateCreate,
 		Read:   resourceComputeInstanceTemplateRead,
+		Update: resourceComputeInstanceTemplateUpdate,
 		Delete: resourceComputeInstanceTemplateDelete,
 		Importer: &schema.ResourceImporter{
 			State: resourceComputeInstanceTemplateImportState,
 		},
 		SchemaVersion: 1,
 		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
 			resourceComputeInstanceTemplateSourceImageCustomizeDiff,
 			resourceComputeInstanceTemplateScratchDiskCustomizeDiff,
 			resourceComputeInstanceTemplateBootDiskCustomizeDiff,
+			tpgresource.SetLabelsDiff,
 		),
 		MigrateState: resourceComputeInstanceTemplateMigrateState,
 
@@ -373,6 +376,7 @@ Google Cloud KMS.`,
 			"metadata_fingerprint": {
 				Type:        schema.TypeString,
 				Computed:    true,
+				ForceNew:    true,
 				Description: `The unique fingerprint of the metadata.`,
 			},
 			"network_performance_config": {
@@ -447,6 +451,7 @@ Google Cloud KMS.`,
 						"name": {
 							Type:        schema.TypeString,
 							Computed:    true,
+							ForceNew:    true,
 							Description: `The name of the network_interface.`,
 						},
 						"nic_type": {
@@ -481,6 +486,7 @@ Google Cloud KMS.`,
 									"public_ptr_domain_name": {
 										Type:        schema.TypeString,
 										Computed:    true,
+										ForceNew:    true,
 										Description: `The DNS domain name for the public PTR record.The DNS domain name for the public PTR record.`,
 									},
 								},
@@ -515,6 +521,7 @@ Google Cloud KMS.`,
 							Type:         schema.TypeString,
 							Optional:     true,
 							Computed:     true,
+							ForceNew:    true,
 							ValidateFunc: validation.StringInSlice([]string{"IPV4_ONLY", "IPV4_IPV6", ""}, false),
 							Description: `The stack type for this network interface to identify whether the IPv6 feature is enabled or not. If not specified, IPV4_ONLY will be used.`,
 						},
@@ -522,18 +529,21 @@ Google Cloud KMS.`,
 						"ipv6_access_type": {
 							Type:        schema.TypeString,
 							Computed:    true,
+							ForceNew:    true,
 							Description: `One of EXTERNAL, INTERNAL to indicate whether the IP can be accessed from the Internet. This field is always inherited from its subnetwork.`,
 						},
 
 						"ipv6_access_config": {
 							Type:        schema.TypeList,
 							Optional:    true,
+							ForceNew:    true,
 							Description: `An array of IPv6 access configurations for this interface. Currently, only one IPv6 access config, DIRECT_IPV6, is supported. If there is no ipv6AccessConfig specified, then this instance will have no external IPv6 Internet access.`,
 							Elem: &schema.Resource{
 								Schema: map[string]*schema.Schema{
 									"network_tier": {
 										Type:         schema.TypeString,
 										Required:     true,
+										ForceNew:    true,
 										Description:  `The service-level to be provided for IPv6 traffic when the subnet has an external subnet. Only PREMIUM tier is valid for IPv6`,
 									},
 									// Possibly configurable- this was added so we don't break if it's inadvertently set
@@ -541,21 +551,25 @@ Google Cloud KMS.`,
 									"public_ptr_domain_name": {
 										Type:        schema.TypeString,
 										Computed:    true,
+										ForceNew:    true,
 										Description: `The domain name to be used when creating DNSv6 records for the external IPv6 ranges.`,
 									},
 									"external_ipv6": {
 										Type:        schema.TypeString,
 										Computed:    true,
+										ForceNew:    true,
 										Description: `The first IPv6 address of the external IPv6 range associated with this instance, prefix length is stored in externalIpv6PrefixLength in ipv6AccessConfig. The field is output only, an IPv6 address from a subnetwork associated with the instance will be allocated dynamically.`,
 									},
 									"external_ipv6_prefix_length": {
 										Type:         schema.TypeString,
 										Computed:     true,
+										ForceNew:    true,
 										Description:  `The prefix length of the external IPv6 range.`,
 									},
 									"name": {
 										Type:        schema.TypeString,
 										Computed:    true,
+										ForceNew:    true,
 										Description: `The name of this access configuration.`,
 									},
 								},
@@ -565,12 +579,14 @@ Google Cloud KMS.`,
 							Type:        schema.TypeInt,
 							Optional:    true,
 							Computed:    true,
+							ForceNew:    true,
 							Description: `The prefix length of the primary internal IPv6 range.`,
 						},
 						"ipv6_address": {
 							Type:        schema.TypeString,
 							Optional:    true,
 							Computed:    true,
+							ForceNew:    true,
 							DiffSuppressFunc: ipv6RepresentationDiffSuppress,
 							Description: `An IPv6 internal network address for this network interface. If not specified, Google Cloud will automatically assign an internal IPv6 address from the instance's subnetwork.`,
 						},
@@ -648,6 +664,7 @@ Google Cloud KMS.`,
 						"min_node_cpus": {
 							Type:         schema.TypeInt,
 							Optional:     true,
+							ForceNew:     true,
 							AtLeastOneOf: schedulingInstTemplateKeys,
 							Description:  `Minimum number of cpus for the instance.`,
 						},
@@ -685,7 +702,7 @@ Must be from 0 to 315,576,000,000 inclusive.`,
 									"nanos": {
 										Type:     schema.TypeInt,
 										Optional:    true,
-									        ForceNew:    true,
+										ForceNew:    true,
 										Description: `Span of time that's a fraction of a second at nanosecond
 resolution. Durations less than one second are represented
 with a 0 seconds field and a positive nanos field. Must
@@ -697,12 +714,14 @@ be from 0 to 999,999,999 inclusive.`,
 						"maintenance_interval" : {
 							Type:        schema.TypeString,
 							Optional:    true,
+							ForceNew:    true,
 							Description: `Specifies the frequency of planned maintenance events. The accepted values are: PERIODIC`,
 						},
 <% end -%>
 						"local_ssd_recovery_timeout" : {
 							Type:        schema.TypeList,
 							Optional:    true,
+							ForceNew:    true,
 							Description: `Specifies the maximum amount of time a Local Ssd Vm should wait while
   recovery of the Local Ssd state is attempted. Its value should be in
   between 0 and 168 hours with hour granularity and the default value being 1
@@ -736,12 +755,14 @@ be from 0 to 999,999,999 inclusive.`,
 			"self_link": {
 				Type:        schema.TypeString,
 				Computed:    true,
+				ForceNew:    true,
 				Description: `The URI of the created resource.`,
 			},
 
 			"self_link_unique": {
 				Type:        schema.TypeString,
 				Computed:    true,
+				ForceNew:    true,
 				Description: `A special URI of the created resource that uniquely identifies this instance template.`,
 			},
 
@@ -911,16 +932,36 @@ be from 0 to 999,999,999 inclusive.`,
 			"tags_fingerprint": {
 				Type:        schema.TypeString,
 				Computed:    true,
+				ForceNew:    true,
 				Description: `The unique fingerprint of the tags.`,
 			},
 
 			"labels": {
 				Type:        schema.TypeMap,
 				Optional:    true,
-				ForceNew:    true,
 				Elem:        &schema.Schema{Type: schema.TypeString},
 				Set:         schema.HashString,
-				Description: `A set of key/value label pairs to assign to instances created from this template,`,
+				Description: `A set of key/value label pairs to assign to instances created from this template.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+			},
+
+			"terraform_labels": {
+				Type:        schema.TypeMap,
+				Computed:    true,
+				Set:         schema.HashString,
+				Description: `The combination of labels configured directly on the resource and default labels configured on the provider.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+			},
+
+			"effective_labels": {
+				Type:        schema.TypeMap,
+				Computed:    true,
+				ForceNew:    true,
+				Set:         schema.HashString,
+				Description: `All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
 			},
 
 			"resource_policies": {
@@ -1309,8 +1350,8 @@ func resourceComputeInstanceTemplateCreate(d *schema.ResourceData, meta interfac
 		ReservationAffinity:        reservationAffinity,
 	}
 
-	if _, ok := d.GetOk("labels"); ok {
-		instanceProperties.Labels = tpgresource.ExpandLabels(d)
+	if _, ok := d.GetOk("effective_labels"); ok {
+		instanceProperties.Labels = tpgresource.ExpandEffectiveLabels(d)
 	}
 
 	var itName string
@@ -1345,6 +1386,11 @@ func resourceComputeInstanceTemplateCreate(d *schema.ResourceData, meta interfac
 	return resourceComputeInstanceTemplateRead(d, meta)
 }
 
+func resourceComputeInstanceTemplateUpdate(d *schema.ResourceData, meta interface{}) error {
+	// Only the field "labels" and "terraform_labels" is mutable
+	return resourceComputeInstanceTemplateRead(d, meta)
+}
+
 type diskCharacteristics struct {
 	mode        string
 	diskType    string
@@ -1634,10 +1680,16 @@ func resourceComputeInstanceTemplateRead(d *schema.ResourceData, meta interface{
 		}
 	}
 	if instanceTemplate.Properties.Labels != nil {
-		if err := d.Set("labels", instanceTemplate.Properties.Labels); err != nil {
+		if err := tpgresource.SetLabels(instanceTemplate.Properties.Labels, d, "labels"); err != nil {
 			return fmt.Errorf("Error setting labels: %s", err)
 		}
 	}
+	if err := tpgresource.SetLabels(instanceTemplate.Properties.Labels, d, "terraform_labels"); err != nil {
+		return fmt.Errorf("Error setting terraform_labels: %s", err)
+	}
+	if err := d.Set("effective_labels", instanceTemplate.Properties.Labels); err != nil {
+		return fmt.Errorf("Error setting effective_labels: %s", err)
+	}
 	if err = d.Set("self_link", instanceTemplate.SelfLink); err != nil {
 		return fmt.Errorf("Error setting self_link: %s", err)
 	}
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_instance_template_test.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_instance_template_test.go.erb
index 97125daf0409..7518d6b70131 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_instance_template_test.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_instance_template_test.go.erb
@@ -51,6 +51,7 @@ func TestAccComputeInstanceTemplate_basic(t *testing.T) {
 				ResourceName:      "google_compute_instance_template.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -77,6 +78,7 @@ func TestAccComputeInstanceTemplate_imageShorthand(t *testing.T) {
 				ResourceName:      "google_compute_instance_template.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -133,6 +135,7 @@ func TestAccComputeInstanceTemplate_maintenance_interval(t *testing.T) {
 				ResourceName:      "google_compute_instance_template.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccComputeInstanceTemplate_basic(acctest.RandString(t, 10)),
@@ -609,6 +612,7 @@ func TestAccComputeInstanceTemplate_EncryptKMS(t *testing.T) {
 				ResourceName:      "google_compute_instance_template.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -940,6 +944,7 @@ func TestAccComputeInstanceTemplate_diskResourcePolicies(t *testing.T) {
 				ResourceName:      "google_compute_instance_template.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -1017,6 +1022,7 @@ func TestAccComputeInstanceTemplate_managedEnvoy(t *testing.T) {
 				ResourceName:      "google_compute_instance_template.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		}, 
 	})
@@ -1229,6 +1235,109 @@ func TestAccComputeInstanceTemplate_NetworkAttachment(t *testing.T) {
 }
 <% end -%>
 
+func TestAccComputeInstanceTemplate_migration(t *testing.T) {
+	acctest.SkipIfVcr(t)
+	t.Parallel()
+
+	var instanceTemplate compute.InstanceTemplate
+	var instanceTemplateUpdate compute.InstanceTemplate
+
+	suffix := acctest.RandString(t, 10)
+	oldVersion := map[string]resource.ExternalProvider{
+		"google": {
+			VersionConstraint: "4.84.0", // a version that doesn't separate user defined labels and system labels
+			Source:            "registry.terraform.io/hashicorp/google",
+		},
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		CheckDestroy:             testAccCheckComputeInstanceTemplateDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config:            testAccComputeInstanceTemplate_basic(suffix),
+				ExternalProviders: oldVersion,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeInstanceTemplateExists(
+						t, "google_compute_instance_template.foobar", &instanceTemplate),
+				),
+			},
+			{
+				Config: testAccComputeInstanceTemplate_basic(suffix),
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeInstanceTemplateExists(
+						t, "google_compute_instance_template.foobar", &instanceTemplateUpdate),
+					testAccCheckComputeInstanceTemplateNotRecreated(&instanceTemplate, &instanceTemplateUpdate),
+					testAccCheckComputeInstanceTemplateTag(&instanceTemplateUpdate, "foo"),
+					testAccCheckComputeInstanceTemplateMetadata(&instanceTemplateUpdate, "foo", "bar"),
+					testAccCheckComputeInstanceTemplateContainsLabel(&instanceTemplateUpdate, "my_label", "foobar"),
+					testAccCheckComputeInstanceTemplateLacksShieldedVmConfig(&instanceTemplateUpdate),
+				),
+			},
+		},
+	})
+}
+
+func TestAccComputeInstanceTemplate_withLabels(t *testing.T) {
+	acctest.SkipIfVcr(t)
+	t.Parallel()
+
+	var instanceTemplate compute.InstanceTemplate
+	var instanceTemplateUpdate compute.InstanceTemplate
+	suffix := acctest.RandString(t, 10)
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		CheckDestroy:             testAccCheckComputeInstanceTemplateDestroyProducer(t),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeInstanceTemplate_withProviderDefaultLabels(suffix),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeInstanceTemplateExists(
+						t, "google_compute_instance_template.foobar", &instanceTemplate),
+					testAccCheckComputeInstanceTemplateContainsLabel(&instanceTemplate, "my_label", "foobar"),
+					testAccCheckComputeInstanceTemplateContainsLabel(&instanceTemplate, "env", "test"),
+					testAccCheckComputeInstanceTemplateContainsLabel(&instanceTemplate, "default_key1", "default_value1"),
+					resource.TestCheckResourceAttr("google_compute_instance_template.foobar", "labels.my_label", "foobar"),
+					resource.TestCheckResourceAttr("google_compute_instance_template.foobar", "labels.env", "test"),
+					resource.TestCheckResourceAttr("google_compute_instance_template.foobar", "terraform_labels.my_label", "foobar"),
+					resource.TestCheckResourceAttr("google_compute_instance_template.foobar", "terraform_labels.env", "test"),
+					resource.TestCheckResourceAttr("google_compute_instance_template.foobar", "terraform_labels.default_key1", "default_value1"),
+				),
+			},
+			{
+				ResourceName:            "google_compute_instance_template.foobar",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
+			},
+			{
+				Config: testAccComputeInstanceTemplate_moveLabelToProvderDefaultLabels(suffix),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeInstanceTemplateExists(
+						t, "google_compute_instance_template.foobar", &instanceTemplateUpdate),
+					testAccCheckComputeInstanceTemplateNotRecreated(&instanceTemplate, &instanceTemplateUpdate),
+					testAccCheckComputeInstanceTemplateContainsLabel(&instanceTemplateUpdate, "my_label", "foobar"),
+					testAccCheckComputeInstanceTemplateContainsLabel(&instanceTemplateUpdate, "env", "test"),
+					testAccCheckComputeInstanceTemplateContainsLabel(&instanceTemplateUpdate, "default_key1", "default_value1"),
+					resource.TestCheckResourceAttr("google_compute_instance_template.foobar", "labels.my_label", "foobar"),
+					resource.TestCheckResourceAttr("google_compute_instance_template.foobar", "terraform_labels.my_label", "foobar"),
+					resource.TestCheckResourceAttr("google_compute_instance_template.foobar", "terraform_labels.env", "test"),
+					resource.TestCheckResourceAttr("google_compute_instance_template.foobar", "terraform_labels.default_key1", "default_value1"),
+				),
+			},
+			{
+				ResourceName:            "google_compute_instance_template.foobar",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
+			},
+		},
+	})
+}
+
 func testAccCheckComputeInstanceTemplateDestroyProducer(t *testing.T) func(s *terraform.State) error {
 	return func(s *terraform.State) error {
 		config := acctest.GoogleProviderConfig(t)
@@ -1672,6 +1781,16 @@ func testAccCheckComputeInstanceTemplateHasDiskResourcePolicy(instanceTemplate *
 	}
 }
 
+func testAccCheckComputeInstanceTemplateNotRecreated(instanceTemplate *compute.InstanceTemplate, instanceTemplateUpdate *compute.InstanceTemplate) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if instanceTemplate.Id != instanceTemplateUpdate.Id {
+			return fmt.Errorf("The resource has been recreated: expected %d, got %d", instanceTemplate.Id, instanceTemplateUpdate.Id)
+		}
+
+		return nil
+	}
+}
+
 func testAccComputeInstanceTemplate_basic(suffix string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
@@ -1715,6 +1834,106 @@ resource "google_compute_instance_template" "foobar" {
 `, suffix)
 }
 
+func testAccComputeInstanceTemplate_withProviderDefaultLabels(suffix string) string {
+	return fmt.Sprintf(`
+provider "google" {
+  default_labels = {
+    default_key1 = "default_value1"
+  }
+}
+
+data "google_compute_image" "my_image" {
+  family  = "debian-11"
+  project = "debian-cloud"
+}
+
+resource "google_compute_instance_template" "foobar" {
+  name           = "tf-test-instance-template-%s"
+  machine_type   = "e2-medium"
+  can_ip_forward = false
+  tags           = ["foo", "bar"]
+
+  disk {
+    source_image = data.google_compute_image.my_image.self_link
+    auto_delete  = true
+    boot         = true
+  }
+
+  network_interface {
+    network = "default"
+  }
+
+  scheduling {
+    preemptible       = false
+    automatic_restart = true
+  }
+
+  metadata = {
+    foo = "bar"
+  }
+
+  service_account {
+    scopes = ["userinfo-email", "compute-ro", "storage-ro"]
+  }
+
+  labels = {
+    my_label = "foobar"
+	env = "test"
+  }
+}
+`, suffix)
+}
+
+func testAccComputeInstanceTemplate_moveLabelToProvderDefaultLabels(suffix string) string {
+	return fmt.Sprintf(`
+provider "google" {
+  default_labels = {
+    default_key1 = "default_value1"
+    env = "test"
+  }
+}
+
+data "google_compute_image" "my_image" {
+  family  = "debian-11"
+  project = "debian-cloud"
+}
+
+resource "google_compute_instance_template" "foobar" {
+  name           = "tf-test-instance-template-%s"
+  machine_type   = "e2-medium"
+  can_ip_forward = false
+  tags           = ["foo", "bar"]
+
+  disk {
+    source_image = data.google_compute_image.my_image.self_link
+    auto_delete  = true
+    boot         = true
+  }
+
+  network_interface {
+    network = "default"
+  }
+
+  scheduling {
+    preemptible       = false
+    automatic_restart = true
+  }
+
+  metadata = {
+    foo = "bar"
+  }
+
+  service_account {
+    scopes = ["userinfo-email", "compute-ro", "storage-ro"]
+  }
+
+  labels = {
+    my_label = "foobar"
+  }
+}
+`, suffix)
+}
+
 func testAccComputeInstanceTemplate_imageShorthand(suffix string) string {
 	return fmt.Sprintf(`
 resource "google_compute_image" "foobar" {
@@ -1726,7 +1945,6 @@ resource "google_compute_image" "foobar" {
   }
   labels = {
     my-label    = "my-label-value"
-    empty-label = ""
   }
   timeouts {
     create = "5m"
@@ -2120,7 +2338,7 @@ data "google_compute_image" "my_image" {
 }
 resource "google_compute_instance_template" "foobar" {
   name           = "tf-test-instance-template-%s"
-  machine_type   = "e2-medium"
+  machine_type   = "n1-standard-1"   // can't be e2 because of local-ssd
   can_ip_forward = false
   disk {
     source_image = data.google_compute_image.my_image.name
@@ -2133,6 +2351,13 @@ resource "google_compute_instance_template" "foobar" {
     type         = "SCRATCH"
     disk_type    = "local-ssd"
   }
+  disk {
+    auto_delete  = true
+	device_name  = "test-local-ssd"
+    disk_size_gb = 375
+    type         = "SCRATCH"
+    disk_type    = "local-ssd"
+  }
   network_interface {
     network = "default"
   }
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_instance_test.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_instance_test.go.erb
index bdd25e99ac0e..6d747946cef6 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_instance_test.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_instance_test.go.erb
@@ -139,7 +139,7 @@ func TestAccComputeInstance_basic1(t *testing.T) {
 					testAccCheckComputeInstanceHasConfiguredDeletionProtection(&instance, false),
 				),
 			},
-			computeInstanceImportStep("us-central1-a", instanceName, []string{"metadata.baz", "metadata.foo", "desired_status", "current_status"}),
+			computeInstanceImportStep("us-central1-a", instanceName, []string{"metadata.baz", "metadata.foo", "desired_status", "current_status", "labels", "terraform_labels"}),
 		},
 	})
 }
@@ -838,7 +838,22 @@ func TestAccComputeInstance_with375GbScratchDisk(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckComputeInstanceExists(
 						t, "google_compute_instance.foobar", &instance),
-					testAccCheckComputeInstanceScratchDisk(&instance, []string{"NVME", "SCSI"}),
+					testAccCheckComputeInstanceScratchDisk(&instance, []map[string]string{
+						map[string]string{
+							"interface": "NVME",
+						},
+						map[string]string{
+							"interface": "SCSI",
+						},
+						map[string]string{
+							"interface": "NVME",
+							"deviceName": "nvme-local-ssd",
+						},
+						map[string]string{
+							"interface": "SCSI",
+							"deviceName": "scsi-local-ssd",
+						},
+					}),
 				),
 			},
 			computeInstanceImportStep("us-central1-a", instanceName, []string{}),
@@ -865,7 +880,26 @@ func TestAccComputeInstance_with18TbScratchDisk(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckComputeInstanceExists(
 						t, "google_compute_instance.foobar", &instance),
-					testAccCheckComputeInstanceScratchDisk(&instance, []string{"NVME", "NVME", "NVME", "NVME", "NVME", "NVME"}),
+					testAccCheckComputeInstanceScratchDisk(&instance, []map[string]string{
+						map[string]string{
+							"interface": "NVME",
+						},
+						map[string]string{
+							"interface": "NVME",
+						},
+						map[string]string{
+							"interface": "NVME",
+						},
+						map[string]string{
+							"interface": "NVME",
+						},
+						map[string]string{
+							"interface": "NVME",
+						},
+						map[string]string{
+							"interface": "NVME",
+						},
+					}),
 				),
 			},
 			computeInstanceImportStep("us-central1-a", instanceName, []string{}),
@@ -1426,7 +1460,7 @@ func TestAccComputeInstance_forceChangeMachineTypeManually(t *testing.T) {
 				),
 				ExpectNonEmptyPlan: true,
 			},
-			computeInstanceImportStep("us-central1-a", instanceName, []string{"metadata.baz", "metadata.foo", "desired_status", "current_status"}),
+			computeInstanceImportStep("us-central1-a", instanceName, []string{"metadata.baz", "metadata.foo", "desired_status", "current_status", "labels", "terraform_labels"}),
 		},
 	})
 }
@@ -1751,6 +1785,48 @@ func TestAccComputeInstanceConfidentialInstanceConfigMain(t *testing.T) {
 	})
 }
 
+
+<% unless version == 'ga' -%>
+func TestAccComputeInstance_confidentialHyperDiskBootDisk(t *testing.T) {
+	t.Parallel()
+	kms := acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", "us-central1", "tf-bootstrap-hyperdisk-key1")
+
+	context_1 := map[string]interface{}{
+		"instance_name":         fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10)),
+		"confidential_compute":  true,
+		"key_ring":              kms.KeyRing.Name,
+		"key_name":              kms.CryptoKey.Name,
+		"zone":                  "us-central1-a",
+
+	}
+
+	context_2 := map[string]interface{}{
+		"instance_name":         context_1["instance_name"],
+		"confidential_compute":  false,
+		"key_ring" :             context_1["key_ring"],
+		"key_name":              context_1["key_name"],
+		"zone":                  context_1["zone"],
+	}
+
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeInstanceConfidentialHyperDiskBootDisk(context_1),
+			},
+			computeInstanceImportStep(context_1["zone"].(string), context_1["instance_name"].(string), []string{"allow_stopping_for_update"}),
+			{
+				Config: testAccComputeInstanceConfidentialHyperDiskBootDisk(context_2),
+			},
+			computeInstanceImportStep(context_2["zone"].(string), context_2["instance_name"].(string), []string{"allow_stopping_for_update"}),
+		},
+	})
+}
+<% end -%>
+
 func TestAccComputeInstance_enableDisplay(t *testing.T) {
 	t.Parallel()
 
@@ -2587,531 +2663,584 @@ func TestAccComputeInstance_regionBootDisk(t *testing.T) {
 	})
 }
 
-func testAccCheckComputeInstanceUpdateMachineType(t *testing.T, n string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[n]
-		if !ok {
-			return fmt.Errorf("Not found: %s", n)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No ID is set")
-		}
-
-		config := acctest.GoogleProviderConfig(t)
-
-		op, err := config.NewComputeClient(config.UserAgent).Instances.Stop(config.Project, rs.Primary.Attributes["zone"], rs.Primary.Attributes["name"]).Do()
-		if err != nil {
-			return fmt.Errorf("Could not stop instance: %s", err)
-		}
-		err = tpgcompute.ComputeOperationWaitTime(config, op, config.Project, "Waiting on stop", config.UserAgent, 20*time.Minute)
-		if err != nil {
-			return fmt.Errorf("Could not stop instance: %s", err)
-		}
-
-		machineType := compute.InstancesSetMachineTypeRequest{
-			MachineType: "zones/us-central1-a/machineTypes/f1-micro",
-		}
-
-		op, err = config.NewComputeClient(config.UserAgent).Instances.SetMachineType(
-			config.Project, rs.Primary.Attributes["zone"], rs.Primary.Attributes["name"], &machineType).Do()
-		if err != nil {
-			return fmt.Errorf("Could not change machine type: %s", err)
-		}
-		err = tpgcompute.ComputeOperationWaitTime(config, op, config.Project, "Waiting machine type change", config.UserAgent, 20*time.Minute)
-		if err != nil {
-			return fmt.Errorf("Could not change machine type: %s", err)
-		}
-		return nil
+<% unless version == 'ga' -%>
+// The tests related to security_policy use network_edge_security_service resource
+// which can only exist one per region. Because of that, all the following tests must run serially.
+func TestAccComputeInstanceNetworkIntefaceWithSecurityPolicy(t *testing.T) {
+	testCases := map[string]func(t *testing.T){
+		"two_access_config": testAccComputeInstance_nic_securityPolicyCreateWithTwoAccessConfigs,
+		"two_nics_access_config_with_empty_nil_security_policy":   testAccComputeInstance_nic_securityPolicyCreateWithEmptyAndNullSecurityPolicies,
+		"two_nics_two_access_configs_update_one_policy":           testAccComputeInstance_nic_securityPolicyCreateWithTwoNicsAndTwoAccessConfigsUpdateOnlyOnePolicy,
+		"two_access_config_update_policy_with_stopped_machine":    testAccComputeInstance_nic_securityPolicyCreateWithTwoAccessConfigsUpdateSecurityPoliciesWithStoppedMachine,
+		"two_nics_two_access_configs_update_remove_access_config": testAccComputeInstance_nic_securityPolicyCreateWithTwoNicsAndTwoAccessConfigsUpdateRemoveAccessConfig,
+		"two_nics_two_access_configs_update_two_policies":         testAccComputeInstance_nic_securityPolicyCreateWithTwoNicsAndTwoAccessConfigsUpdateSwapPolicies,
+		"access_config_update_access_config":                      testAccComputeInstance_nic_securityPolicyCreateWithAccessConfigUpdateAccessConfig,
+		"wit_no_access_config":                                    testAccComputeInstance_nic_securityPolicyCreateWithoutAccessConfig,
 	}
-}
-
-func testAccCheckComputeInstanceDestroyProducer(t *testing.T) func(s *terraform.State) error {
-	return func(s *terraform.State) error {
-		config := acctest.GoogleProviderConfig(t)
-
-		for _, rs := range s.RootModule().Resources {
-			if rs.Type != "google_compute_instance" {
-				continue
-			}
-
-			_, err := config.NewComputeClient(config.UserAgent).Instances.Get(
-				config.Project, rs.Primary.Attributes["zone"], rs.Primary.Attributes["name"]).Do()
-			if err == nil {
-				return fmt.Errorf("Instance still exists")
-			}
-		}
 
-		return nil
+	for name, tc := range testCases {
+		// shadow the tc variable into scope so that when
+		// the loop continues, if t.Run hasn't executed tc(t)
+		// yet, we don't have a race condition
+		// see https://github.com/golang/go/wiki/CommonMistakes#using-goroutines-on-loop-iterator-variables
+		tc := tc
+		t.Run(name, func(t *testing.T) {
+			tc(t)
+		})
 	}
 }
 
-func testAccCheckComputeInstanceExists(t *testing.T, n string, instance interface{}) resource.TestCheckFunc {
-	if instance == nil {
-		panic("Attempted to check existence of Instance that was nil.")
-	}
+func testAccComputeInstance_nic_securityPolicyCreateWithTwoAccessConfigs(t *testing.T) {
+	var instance compute.Instance
+	var instanceName = fmt.Sprintf("tf-test-instance-%s", acctest.RandString(t, 10))
+	var policyName = fmt.Sprintf("tf-test-policy-%s", acctest.RandString(t, 10))
+	var suffix = acctest.RandString(t, 10)
 
-	return testAccCheckComputeInstanceExistsInProject(t, n, envvar.GetTestProjectFromEnv(), instance.(*compute.Instance))
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeInstance_nic_securityPolicyCreateWithOneNicAndTwoAccessConfigs(suffix, policyName, instanceName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeInstanceExists(
+						t, "google_compute_instance.foobar", &instance),
+					testAccCheckComputeInstanceNicAccessConfigHasSecurityPolicy(&instance, policyName),
+				),
+			},
+			{
+				ResourceName:      "google_compute_instance.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
 }
 
-func testAccCheckComputeInstanceExistsInProject(t *testing.T, n, p string, instance *compute.Instance) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[n]
-		if !ok {
-			return fmt.Errorf("Not found: %s", n)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No ID is set")
-		}
-
-		config := acctest.GoogleProviderConfig(t)
-
-		found, err := config.NewComputeClient(config.UserAgent).Instances.Get(
-			p, rs.Primary.Attributes["zone"], rs.Primary.Attributes["name"]).Do()
-		if err != nil {
-			return err
-		}
-
-		if found.Name != rs.Primary.Attributes["name"] {
-			return fmt.Errorf("Instance not found")
-		}
-
-		*instance = *found
+func testAccComputeInstance_nic_securityPolicyCreateWithEmptyAndNullSecurityPolicies(t *testing.T) {
+	var instance compute.Instance
+	var instanceName = fmt.Sprintf("tf-test-instance-%s", acctest.RandString(t, 10))
+	var suffix = acctest.RandString(t, 10)
 
-		return nil
-	}
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeInstance_nic_securityPolicyCreateWithTwoNicsAndAccessConfigsWithEmptyAndNullSecurityPolicies(suffix, instanceName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeInstanceExists(
+						t, "google_compute_instance.foobar", &instance),
+					testAccCheckComputeInstanceNicAccessConfigHasNoSecurityPolicy(&instance),
+				),
+			},
+			{
+				ResourceName:      "google_compute_instance.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
 }
 
-func testAccCheckComputeInstanceMetadata(
-	instance *compute.Instance,
-	k string, v string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if instance.Metadata == nil {
-			return fmt.Errorf("no metadata")
-		}
-
-		for _, item := range instance.Metadata.Items {
-			if k != item.Key {
-				continue
-			}
-
-			if item.Value != nil && v == *item.Value {
-				return nil
-			}
-
-			return fmt.Errorf("bad value for %s: %s", k, *item.Value)
-		}
+func testAccComputeInstance_nic_securityPolicyCreateWithTwoNicsAndTwoAccessConfigsUpdateOnlyOnePolicy(t *testing.T) {
+	var instance compute.Instance
+	var instanceName = fmt.Sprintf("tf-test-instance-%s", acctest.RandString(t, 10))
+	var policyName = fmt.Sprintf("tf-test-policy-%s", acctest.RandString(t, 10))
+	var policyName2 = fmt.Sprintf("tf-test-policy2-%s", acctest.RandString(t, 10))
+	var suffix = acctest.RandString(t, 10)
 
-		return fmt.Errorf("metadata not found: %s", k)
-	}
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeInstance_nic_securityPolicyCreateWithTwoNicsAndTwoAccessConfigsUpdateTwoPolicies(suffix, policyName, policyName2, instanceName, "google_compute_region_security_policy.policyforinstance.self_link", "google_compute_region_security_policy.policyforinstance.self_link"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeInstanceExists(
+						t, "google_compute_instance.foobar", &instance),
+					testAccCheckComputeInstanceNicAccessConfigHasSecurityPolicy(&instance, policyName),
+				),
+			},
+			{
+				ResourceName:      "google_compute_instance.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeInstance_nic_securityPolicyCreateWithTwoNicsAndTwoAccessConfigsUpdateTwoPolicies(suffix, policyName, policyName2, instanceName, "google_compute_region_security_policy.policyforinstance.self_link", "google_compute_region_security_policy.policyforinstance2.self_link"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeInstanceExists(
+						t, "google_compute_instance.foobar", &instance),
+					testAccCheckComputeInstanceNicAccessConfigHasSecurityPolicy(&instance, policyName2),
+				),
+			},
+			{
+				ResourceName:      "google_compute_instance.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
 }
 
-func testAccCheckComputeInstanceAccessConfig(instance *compute.Instance) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		for _, i := range instance.NetworkInterfaces {
-			if len(i.AccessConfigs) == 0 {
-				return fmt.Errorf("no access_config")
-			}
-		}
+func testAccComputeInstance_nic_securityPolicyCreateWithTwoAccessConfigsUpdateSecurityPoliciesWithStoppedMachine(t *testing.T) {
+	var instance compute.Instance
+	var instanceName = fmt.Sprintf("tf-test-instance-%s", acctest.RandString(t, 10))
+	var policyName = fmt.Sprintf("tf-test-policy-%s", acctest.RandString(t, 10))
+	var suffix = acctest.RandString(t, 10)
 
-		return nil
-	}
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeInstance_nic_securityPolicyCreateWithTwoAccessConfigsWithTwoSecurityPoliciesAndStatus(suffix, policyName, instanceName, "\"\"", "RUNNING"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeInstanceExists(
+						t, "google_compute_instance.foobar", &instance),
+					testAccCheckComputeInstanceHasStatus(&instance, "RUNNING"),
+				),
+			},
+			{
+				Config: testAccComputeInstance_nic_securityPolicyCreateWithTwoAccessConfigsWithTwoSecurityPoliciesAndStatus(suffix, policyName, instanceName, "\"\"", "TERMINATED"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeInstanceExists(
+						t, "google_compute_instance.foobar", &instance),
+					testAccCheckComputeInstanceHasStatus(&instance, "TERMINATED"),
+				),
+			},
+			{
+				Config:      testAccComputeInstance_nic_securityPolicyCreateWithTwoAccessConfigsWithTwoSecurityPoliciesAndStatus(suffix, policyName, instanceName, "google_compute_region_security_policy.policyforinstance.self_link", "TERMINATED"),
+				ExpectError: regexp.MustCompile("Error to update security policy because the current instance status must be \"RUNNING\". The security policy or some access config may have changed which requires the security policy to be re-applied"),
+			},
+		},
+	})
 }
 
-func testAccCheckComputeInstanceAccessConfigHasNatIP(instance *compute.Instance) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		for _, i := range instance.NetworkInterfaces {
-			for _, c := range i.AccessConfigs {
-				if c.NatIP == "" {
-					return fmt.Errorf("no NAT IP")
-				}
-			}
-		}
-
-		return nil
-	}
-}
+func testAccComputeInstance_nic_securityPolicyCreateWithTwoNicsAndTwoAccessConfigsUpdateRemoveAccessConfig(t *testing.T) {
+	var instance compute.Instance
+	var instanceName = fmt.Sprintf("tf-test-instance-%s", acctest.RandString(t, 10))
+	var policyName = fmt.Sprintf("tf-test-policy-%s", acctest.RandString(t, 10))
+	var policyName2 = fmt.Sprintf("tf-test-policy2-%s", acctest.RandString(t, 10))
+	var suffix = acctest.RandString(t, 10)
 
-func testAccCheckComputeInstanceIpv6AccessConfigHasExternalIPv6(instance *compute.Instance) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		for _, i := range instance.NetworkInterfaces {
-			for _, c := range i.Ipv6AccessConfigs {
-				if c.ExternalIpv6 == "" {
-					return fmt.Errorf("no External IPv6")
-				}
-			}
-		}
-
-		return nil
-	}
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeInstance_nic_securityPolicyCreateWithTwoNicsAndTwoAccessConfigsUpdateTwoPolicies(suffix, policyName, policyName2, instanceName, "google_compute_region_security_policy.policyforinstance.self_link", "google_compute_region_security_policy.policyforinstance.self_link"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeInstanceExists(
+						t, "google_compute_instance.foobar", &instance),
+					testAccCheckComputeInstanceNicAccessConfigHasSecurityPolicy(&instance, policyName),
+				),
+			},
+			{
+				ResourceName:      "google_compute_instance.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeInstance_nic_securityPolicyCreateWithTwoNicsAndTwoAccessConfigsUpdateTwoPoliciesRemoveAccessConfig(suffix, policyName, policyName2, instanceName, "google_compute_region_security_policy.policyforinstance.self_link", "google_compute_region_security_policy.policyforinstance.self_link"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeInstanceExists(
+						t, "google_compute_instance.foobar", &instance),
+					testAccCheckComputeInstanceNicAccessConfigHasSecurityPolicy(&instance, policyName),
+				),
+			},
+			{
+				ResourceName:      "google_compute_instance.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
 }
 
-func testAccCheckComputeInstanceIpv6AccessConfigHasInternalIPv6(instance *compute.Instance) resource.TestCheckFunc {
-  return func(s *terraform.State) error {
-    for _, i := range instance.NetworkInterfaces {
-      if i.Ipv6Address == "" {
-        return fmt.Errorf("no internal IPv6 address")
-      }
-    }
+func testAccComputeInstance_nic_securityPolicyCreateWithTwoNicsAndTwoAccessConfigsUpdateSwapPolicies(t *testing.T) {
+	var instance compute.Instance
+	var instanceName = fmt.Sprintf("tf-test-instance-%s", acctest.RandString(t, 10))
+	var policyName = fmt.Sprintf("tf-test-policy-%s", acctest.RandString(t, 10))
+	var policyName2 = fmt.Sprintf("tf-test-policy2-%s", acctest.RandString(t, 10))
+	var suffix = acctest.RandString(t, 10)
 
-    return nil
-  }
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeInstance_nic_securityPolicyCreateWithTwoNicsAndTwoAccessConfigsUpdateTwoPolicies(suffix, policyName, policyName2, instanceName, "\"\"", "\"\""),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeInstanceExists(
+						t, "google_compute_instance.foobar", &instance),
+				),
+			},
+			{
+				ResourceName:      "google_compute_instance.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeInstance_nic_securityPolicyCreateWithTwoNicsAndTwoAccessConfigsUpdateTwoPolicies(suffix, policyName, policyName2, instanceName, "google_compute_region_security_policy.policyforinstance.self_link", "google_compute_region_security_policy.policyforinstance2.self_link"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeInstanceExists(
+						t, "google_compute_instance.foobar", &instance),
+					testAccCheckComputeInstanceNicAccessConfigHasSecurityPolicy(&instance, policyName),
+					testAccCheckComputeInstanceNicAccessConfigHasSecurityPolicy(&instance, policyName2),
+				),
+			},
+			{
+				ResourceName:      "google_compute_instance.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeInstance_nic_securityPolicyCreateWithTwoNicsAndTwoAccessConfigsUpdateTwoPolicies(suffix, policyName, policyName2, instanceName, "google_compute_region_security_policy.policyforinstance2.self_link", "google_compute_region_security_policy.policyforinstance.self_link"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeInstanceExists(
+						t, "google_compute_instance.foobar", &instance),
+					testAccCheckComputeInstanceNicAccessConfigHasSecurityPolicy(&instance, policyName2),
+					testAccCheckComputeInstanceNicAccessConfigHasSecurityPolicy(&instance, policyName),
+				),
+			},
+			{
+				ResourceName:      "google_compute_instance.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeInstance_nic_securityPolicyCreateWithTwoNicsAndTwoAccessConfigsUpdateTwoPolicies(suffix, policyName, policyName2, instanceName, "\"\"", "\"\""),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeInstanceExists(
+						t, "google_compute_instance.foobar", &instance),
+					testAccCheckComputeInstanceNicAccessConfigHasNoSecurityPolicy(&instance),
+				),
+			},
+			{
+				ResourceName:      "google_compute_instance.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
 }
 
-func testAccCheckComputeInstanceAccessConfigHasPTR(instance *compute.Instance) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		for _, i := range instance.NetworkInterfaces {
-			for _, c := range i.AccessConfigs {
-				if c.PublicPtrDomainName == "" {
-					return fmt.Errorf("no PTR Record")
-				}
-			}
-		}
+func testAccComputeInstance_nic_securityPolicyCreateWithAccessConfigUpdateAccessConfig(t *testing.T) {
+	var instance compute.Instance
+	var instanceName = fmt.Sprintf("tf-test-instance-%s", acctest.RandString(t, 10))
+	var policyName = fmt.Sprintf("tf-test-policy-%s", acctest.RandString(t, 10))
+	var suffix = acctest.RandString(t, 10)
 
-		return nil
-	}
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeInstance_nic_securityPolicyCreateWithOneNicAndTwoAccessConfigs(suffix, policyName, instanceName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeInstanceExists(
+						t, "google_compute_instance.foobar", &instance),
+					testAccCheckComputeInstanceNicAccessConfigHasSecurityPolicy(&instance, policyName),
+				),
+			},
+			{
+				ResourceName:      "google_compute_instance.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeInstance_nic_securityPolicyCreateWithTwoAccessConfigsUpdateAccessConfig(suffix, policyName, instanceName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeInstanceExists(
+						t, "google_compute_instance.foobar", &instance),
+					testAccCheckComputeInstanceNicAccessConfigHasSecurityPolicy(&instance, policyName),
+				),
+			},
+			{
+				ResourceName:      "google_compute_instance.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config:      testAccComputeInstance_nic_securityPolicyCreateWithTwoAccessConfigsRemoveAccessConfig(suffix, policyName, instanceName),
+				ExpectError: regexp.MustCompile("Error setting security policy to the instance since at least one access config must exist"),
+			},
+		},
+	})
 }
 
-func testAccCheckComputeResourcePolicy(instance *compute.Instance, scheduleName string, resourcePolicyCountWant int) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		resourcePoliciesCountHave := len(instance.ResourcePolicies)
-		if resourcePoliciesCountHave != resourcePolicyCountWant {
-			return fmt.Errorf("number of resource polices does not match: have: %d; want: %d", resourcePoliciesCountHave, resourcePolicyCountWant)
-		}
-
-		if resourcePoliciesCountHave == 1 && !strings.Contains(instance.ResourcePolicies[0], scheduleName) {
-			return fmt.Errorf("got the wrong schedule: have: %s; want: %s", instance.ResourcePolicies[0], scheduleName)
-		}
+func testAccComputeInstance_nic_securityPolicyCreateWithoutAccessConfig(t *testing.T) {
+	var instanceName = fmt.Sprintf("tf-test-instance-%s", acctest.RandString(t, 10))
+	var policyName = fmt.Sprintf("tf-test-policy-%s", acctest.RandString(t, 10))
+	var suffix = acctest.RandString(t, 10)
 
-		return nil
-	}
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config:      testAccComputeInstance_nic_securityPolicyCreateWithTwoAccessConfigsRemoveAccessConfig(suffix, policyName, instanceName),
+				ExpectError: regexp.MustCompile("Error setting security policy to the instance since at least one access config must exist"),
+			},
+		},
+	})
 }
 
-<% unless version == 'ga' -%>
-func testAccCheckComputeInstanceMaxRunDuration(instance *compute.Instance, instanceMaxRunDurationWant compute.Duration) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if instance == nil {
-			return fmt.Errorf("instance is nil")
-		}
-		if instance.Scheduling == nil {
-			return fmt.Errorf("no scheduling")
-		}
-
-		if !reflect.DeepEqual(*instance.Scheduling.MaxRunDuration, instanceMaxRunDurationWant) {
-			return fmt.Errorf("got the wrong instance max run duration action: have: %#v; want: %#v",instance.Scheduling.MaxRunDuration, instanceMaxRunDurationWant)
-		}
-
-		return nil
-	}
-}
 <% end -%>
 
-func testAccCheckComputeInstanceLocalSsdRecoveryTimeout(instance *compute.Instance, instanceLocalSsdRecoveryTiemoutWant compute.Duration) resource.TestCheckFunc {
+func testAccCheckComputeInstanceUpdateMachineType(t *testing.T, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		if instance == nil {
-			return fmt.Errorf("instance is nil")
-		}
-		if instance.Scheduling == nil {
-			return fmt.Errorf("no scheduling")
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if !reflect.DeepEqual(*instance.Scheduling.LocalSsdRecoveryTimeout, instanceLocalSsdRecoveryTiemoutWant) {
-			return fmt.Errorf("got the wrong instance local ssd recovery timeout action: have: %#v; want: %#v",instance.Scheduling.LocalSsdRecoveryTimeout, instanceLocalSsdRecoveryTiemoutWant)
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No ID is set")
 		}
 
-		return nil
-	}
-}
+		config := acctest.GoogleProviderConfig(t)
 
-func testAccCheckComputeInstanceTerminationAction(instance *compute.Instance, instanceTerminationActionWant string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if instance == nil {
-			return fmt.Errorf("instance is nil")
+		op, err := config.NewComputeClient(config.UserAgent).Instances.Stop(config.Project, rs.Primary.Attributes["zone"], rs.Primary.Attributes["name"]).Do()
+		if err != nil {
+			return fmt.Errorf("Could not stop instance: %s", err)
 		}
-		if instance.Scheduling == nil {
-			return fmt.Errorf("no scheduling")
+		err = tpgcompute.ComputeOperationWaitTime(config, op, config.Project, "Waiting on stop", config.UserAgent, 20*time.Minute)
+		if err != nil {
+			return fmt.Errorf("Could not stop instance: %s", err)
 		}
 
-		if instance.Scheduling.InstanceTerminationAction != instanceTerminationActionWant {
-			return fmt.Errorf("got the wrong instance termniation action: have: %s; want: %s",instance.Scheduling.InstanceTerminationAction, instanceTerminationActionWant)
+		machineType := compute.InstancesSetMachineTypeRequest{
+			MachineType: "zones/us-central1-a/machineTypes/f1-micro",
 		}
 
-		return nil
-	}
-}
-
-func testAccCheckComputeInstanceDisk(instance *compute.Instance, source string, delete bool, boot bool) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if instance.Disks == nil {
-			return fmt.Errorf("no disks")
+		op, err = config.NewComputeClient(config.UserAgent).Instances.SetMachineType(
+			config.Project, rs.Primary.Attributes["zone"], rs.Primary.Attributes["name"], &machineType).Do()
+		if err != nil {
+			return fmt.Errorf("Could not change machine type: %s", err)
 		}
-
-		for _, disk := range instance.Disks {
-			if strings.HasSuffix(disk.Source, "/"+source) && disk.AutoDelete == delete && disk.Boot == boot {
-				return nil
-			}
+		err = tpgcompute.ComputeOperationWaitTime(config, op, config.Project, "Waiting machine type change", config.UserAgent, 20*time.Minute)
+		if err != nil {
+			return fmt.Errorf("Could not change machine type: %s", err)
 		}
-
-		return fmt.Errorf("Disk not found: %s", source)
+		return nil
 	}
 }
 
-func testAccCheckComputeInstanceHasInstanceId(instance *compute.Instance, n string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[n]
-		if !ok {
-			return fmt.Errorf("Not found: %s", n)
-		}
+<% if version == "beta"%>
+func TestAccComputeInstance_NetworkAttachment(t *testing.T) {
+	t.Parallel()
+	suffix := fmt.Sprintf("%s", acctest.RandString(t, 10))
+	var instance compute.Instance
 
-		remote := fmt.Sprintf("%d", instance.Id)
-		local := rs.Primary.Attributes["instance_id"]
+	testNetworkAttachmentName := fmt.Sprintf("tf-test-network-attachment-%s", suffix)
 
-		if remote != local {
-			return fmt.Errorf("Instance id stored does not match: remote has %#v but local has %#v", remote,
-				local)
-		}
+	// Need to have the full network attachment name in the format project/{project_id}/regions/{region_id}/networkAttachments/{testNetworkAttachmentName}
+	fullFormNetworkAttachmentName := fmt.Sprintf("projects/%s/regions/%s/networkAttachments/%s", envvar.GetTestProjectFromEnv(), envvar.GetTestRegionFromEnv(), testNetworkAttachmentName)
 
-		return nil
+	context := map[string]interface{}{
+		"suffix":                  (acctest.RandString(t, 10)),
+		"network_attachment_name": testNetworkAttachmentName,
 	}
-}
 
-func testAccCheckComputeInstanceBootDisk(instance *compute.Instance, source string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if instance.Disks == nil {
-			return fmt.Errorf("no disks")
-		}
-
-		for _, disk := range instance.Disks {
-			if disk.Boot == true {
-				if strings.HasSuffix(disk.Source, source) {
-					return nil
-				}
-			}
-		}
-
-		return fmt.Errorf("Boot disk not found with source %q", source)
-	}
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeInstance_networkAttachment(context),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeInstanceExists(
+						t, "google_compute_instance.foobar", &instance),
+					testAccCheckComputeInstanceHasNetworkAttachment(&instance, fmt.Sprintf("https://www.googleapis.com/compute/beta/%s", fullFormNetworkAttachmentName)),
+				),
+			},
+		},
+	})
 }
 
-func testAccCheckComputeInstanceBootDiskType(t *testing.T, instanceName string, diskType string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		config := acctest.GoogleProviderConfig(t)
+func TestAccComputeInstance_NetworkAttachmentUpdate(t *testing.T) {
+	t.Parallel()
+	suffix := acctest.RandString(t, 10)
+	envRegion := envvar.GetTestRegionFromEnv()
+	instanceName := fmt.Sprintf("tf-test-compute-instance-%s", suffix)
 
-		// boot disk is named the same as the Instance
-		disk, err := config.NewComputeClient(config.UserAgent).Disks.Get(config.Project, "us-central1-a", instanceName).Do()
-		if err != nil {
-			return err
-		}
-		if strings.Contains(disk.Type, diskType) {
-			return nil
-		}
+	networkAttachmentSelflink1 := "google_compute_network_attachment.test_network_attachment_1.self_link"
+	networkAttachmentSelflink2 := "google_compute_network_attachment.test_network_attachment_2.self_link"
 
-		return fmt.Errorf("Boot disk not found with type %q", diskType)
-	}
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeInstance_networkAttachmentUpdate(networkAttachmentSelflink1, envRegion, suffix),
+			},
+			computeInstanceImportStep("us-central1-a", instanceName, []string{"allow_stopping_for_update"}),
+			{
+				Config: testAccComputeInstance_networkAttachmentUpdate(networkAttachmentSelflink2, envRegion, suffix),
+			},
+			computeInstanceImportStep("us-central1-a", instanceName, []string{"allow_stopping_for_update"}),
+			{
+				Config: testAccComputeInstance_networkAttachmentUpdate(networkAttachmentSelflink1, envRegion, suffix),
+			},
+			computeInstanceImportStep("us-central1-a", instanceName, []string{"allow_stopping_for_update"}),
+		},
+	})
 }
+<% end %>
 
-func testAccCheckComputeInstanceScratchDisk(instance *compute.Instance, interfaces []string) resource.TestCheckFunc {
+func testAccCheckComputeInstanceDestroyProducer(t *testing.T) func(s *terraform.State) error {
 	return func(s *terraform.State) error {
-		if instance.Disks == nil {
-			return fmt.Errorf("no disks")
-		}
+		config := acctest.GoogleProviderConfig(t)
 
-		i := 0
-		for _, disk := range instance.Disks {
-			if disk.Type == "SCRATCH" {
-				if i >= len(interfaces) {
-					return fmt.Errorf("Expected %d scratch disks, found more", len(interfaces))
-				}
-				if disk.Interface != interfaces[i] {
-					return fmt.Errorf("Mismatched interface on scratch disk #%d, expected: %q, found: %q",
-						i, interfaces[i], disk.Interface)
-				}
-				i++
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "google_compute_instance" {
+				continue
 			}
-		}
 
-		if i != len(interfaces) {
-			return fmt.Errorf("Expected %d scratch disks, found %d", len(interfaces), i)
+			_, err := config.NewComputeClient(config.UserAgent).Instances.Get(
+				config.Project, rs.Primary.Attributes["zone"], rs.Primary.Attributes["name"]).Do()
+			if err == nil {
+				return fmt.Errorf("Instance still exists")
+			}
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckComputeInstanceDiskEncryptionKey(n string, instance *compute.Instance, bootDiskEncryptionKey string, diskNameToEncryptionKey map[string]*compute.CustomerEncryptionKey) resource.TestCheckFunc {
+func testAccCheckComputeInstanceExists(t *testing.T, n string, instance interface{}) resource.TestCheckFunc {
+	if instance == nil {
+		panic("Attempted to check existence of Instance that was nil.")
+	}
+
+	return testAccCheckComputeInstanceExistsInProject(t, n, envvar.GetTestProjectFromEnv(), instance.(*compute.Instance))
+}
+
+func testAccCheckComputeInstanceExistsInProject(t *testing.T, n, p string, instance *compute.Instance) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		for i, disk := range instance.Disks {
-			if disk.Boot {
-				attr := rs.Primary.Attributes["boot_disk.0.disk_encryption_key_sha256"]
-				if attr != bootDiskEncryptionKey {
-					return fmt.Errorf("Boot disk has wrong encryption key in state.\nExpected: %s\nActual: %s", bootDiskEncryptionKey, attr)
-				}
-				if disk.DiskEncryptionKey == nil && attr != "" {
-					return fmt.Errorf("Disk %d has mismatched encryption key.\nTF State: %+v\nGCP State: <empty>", i, attr)
-				}
-				if disk.DiskEncryptionKey != nil && attr != disk.DiskEncryptionKey.Sha256 {
-					return fmt.Errorf("Disk %d has mismatched encryption key.\nTF State: %+v\nGCP State: %+v",
-						i, attr, disk.DiskEncryptionKey.Sha256)
-				}
-			} else {
-				if disk.DiskEncryptionKey != nil {
-					expectedKey := diskNameToEncryptionKey[tpgresource.GetResourceNameFromSelfLink(disk.Source)].Sha256
-					if disk.DiskEncryptionKey.Sha256 != expectedKey {
-						return fmt.Errorf("Disk %d has unexpected encryption key in GCP.\nExpected: %s\nActual: %s", i, expectedKey, disk.DiskEncryptionKey.Sha256)
-					}
-				}
-			}
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No ID is set")
 		}
 
-		numAttachedDisks, err := strconv.Atoi(rs.Primary.Attributes["attached_disk.#"])
+		config := acctest.GoogleProviderConfig(t)
+
+		found, err := config.NewComputeClient(config.UserAgent).Instances.Get(
+			p, rs.Primary.Attributes["zone"], rs.Primary.Attributes["name"]).Do()
 		if err != nil {
-			return fmt.Errorf("Error converting value of attached_disk.#")
+			return err
 		}
-		for i := 0; i < numAttachedDisks; i++ {
-			diskName := tpgresource.GetResourceNameFromSelfLink(rs.Primary.Attributes[fmt.Sprintf("attached_disk.%d.source", i)])
-			encryptionKey := rs.Primary.Attributes[fmt.Sprintf("attached_disk.%d.disk_encryption_key_sha256", i)]
-			if key, ok := diskNameToEncryptionKey[diskName]; ok {
-				expectedEncryptionKey := key.Sha256
-				if encryptionKey != expectedEncryptionKey {
-					return fmt.Errorf("Attached disk %d has unexpected encryption key in state.\nExpected: %s\nActual: %s", i, expectedEncryptionKey, encryptionKey)
-				}
-			}
+
+		if found.Name != rs.Primary.Attributes["name"] {
+			return fmt.Errorf("Instance not found")
 		}
+
+		*instance = *found
+
 		return nil
 	}
 }
 
-func testAccCheckComputeInstanceDiskKmsEncryptionKey(n string, instance *compute.Instance, bootDiskEncryptionKey string, diskNameToEncryptionKey map[string]*compute.CustomerEncryptionKey) resource.TestCheckFunc {
+func testAccCheckComputeInstanceMetadata(
+	instance *compute.Instance,
+	k string, v string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[n]
-		if !ok {
-			return fmt.Errorf("Not found: %s", n)
+		if instance.Metadata == nil {
+			return fmt.Errorf("no metadata")
 		}
 
-		for i, disk := range instance.Disks {
-			if disk.Boot {
-				attr := rs.Primary.Attributes["boot_disk.0.kms_key_self_link"]
-				if attr != bootDiskEncryptionKey {
-					return fmt.Errorf("Boot disk has wrong encryption key in state.\nExpected: %s\nActual: %s", bootDiskEncryptionKey, attr)
-				}
-				if disk.DiskEncryptionKey == nil && attr != "" {
-					return fmt.Errorf("Disk %d has mismatched encryption key.\nTF State: %+v\nGCP State: <empty>", i, attr)
-				}
-			} else {
-				if disk.DiskEncryptionKey != nil {
-					expectedKey := diskNameToEncryptionKey[tpgresource.GetResourceNameFromSelfLink(disk.Source)].KmsKeyName
-					// The response for crypto keys often includes the version of the key which needs to be removed
-					// format: projects/<project>/locations/<region>/keyRings/<keyring>/cryptoKeys/<key>/cryptoKeyVersions/1
-					actualKey := strings.Split(disk.DiskEncryptionKey.KmsKeyName, "/cryptoKeyVersions")[0]
-					if actualKey != expectedKey {
-						return fmt.Errorf("Disk %d has unexpected encryption key in GCP.\nExpected: %s\nActual: %s", i, expectedKey, actualKey)
-					}
-				}
+		for _, item := range instance.Metadata.Items {
+			if k != item.Key {
+				continue
 			}
-		}
 
-		numAttachedDisks, err := strconv.Atoi(rs.Primary.Attributes["attached_disk.#"])
-		if err != nil {
-			return fmt.Errorf("Error converting value of attached_disk.#")
-		}
-		for i := 0; i < numAttachedDisks; i++ {
-			diskName := tpgresource.GetResourceNameFromSelfLink(rs.Primary.Attributes[fmt.Sprintf("attached_disk.%d.source", i)])
-			kmsKeyName := rs.Primary.Attributes[fmt.Sprintf("attached_disk.%d.kms_key_self_link", i)]
-			if key, ok := diskNameToEncryptionKey[diskName]; ok {
-				expectedEncryptionKey := key.KmsKeyName
-				if kmsKeyName != expectedEncryptionKey {
-					return fmt.Errorf("Attached disk %d has unexpected encryption key in state.\nExpected: %s\nActual: %s", i, expectedEncryptionKey, kmsKeyName)
-				}
+			if item.Value != nil && v == *item.Value {
+				return nil
 			}
+
+			return fmt.Errorf("bad value for %s: %s", k, *item.Value)
 		}
-		return nil
+
+		return fmt.Errorf("metadata not found: %s", k)
 	}
 }
 
-func testAccCheckComputeInstanceTag(instance *compute.Instance, n string) resource.TestCheckFunc {
+func testAccCheckComputeInstanceAccessConfig(instance *compute.Instance) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		if instance.Tags == nil {
-			return fmt.Errorf("no tags")
-		}
-
-		for _, k := range instance.Tags.Items {
-			if k == n {
-				return nil
+		for _, i := range instance.NetworkInterfaces {
+			if len(i.AccessConfigs) == 0 {
+				return fmt.Errorf("no access_config")
 			}
 		}
 
-		return fmt.Errorf("tag not found: %s", n)
+		return nil
 	}
 }
 
-func testAccCheckComputeInstanceLabel(instance *compute.Instance, key string, value string) resource.TestCheckFunc {
+func testAccCheckComputeInstanceAccessConfigHasNatIP(instance *compute.Instance) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		if instance.Labels == nil {
-			return fmt.Errorf("no labels found on instance %s", instance.Name)
-		}
-
-		v, ok := instance.Labels[key]
-		if !ok {
-			return fmt.Errorf("No label found with key %s on instance %s", key, instance.Name)
-		}
-		if v != value {
-			return fmt.Errorf("Expected value '%s' but found value '%s' for label '%s' on instance %s", value, v, key, instance.Name)
+		for _, i := range instance.NetworkInterfaces {
+			for _, c := range i.AccessConfigs {
+				if c.NatIP == "" {
+					return fmt.Errorf("no NAT IP")
+				}
+			}
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckComputeInstanceServiceAccount(instance *compute.Instance, scope string) resource.TestCheckFunc {
+func testAccCheckComputeInstanceIpv6AccessConfigHasExternalIPv6(instance *compute.Instance) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		if count := len(instance.ServiceAccounts); count != 1 {
-			return fmt.Errorf("Wrong number of ServiceAccounts: expected 1, got %d", count)
-		}
-
-		for _, val := range instance.ServiceAccounts[0].Scopes {
-			if val == scope {
-				return nil
+		for _, i := range instance.NetworkInterfaces {
+			for _, c := range i.Ipv6AccessConfigs {
+				if c.ExternalIpv6 == "" {
+					return fmt.Errorf("no External IPv6")
+				}
 			}
 		}
 
-		return fmt.Errorf("Scope not found: %s", scope)
+		return nil
 	}
 }
 
-func testAccCheckComputeInstanceScopes(instance *compute.Instance, scopeCount int) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
+func testAccCheckComputeInstanceIpv6AccessConfigHasInternalIPv6(instance *compute.Instance) resource.TestCheckFunc {
+  return func(s *terraform.State) error {
+    for _, i := range instance.NetworkInterfaces {
+      if i.Ipv6Address == "" {
+        return fmt.Errorf("no internal IPv6 address")
+      }
+    }
 
-		if count := len(instance.ServiceAccounts); count == 0 {
-			if scopeCount == 0 {
-				return nil
-			} else {
-				return fmt.Errorf("Scope count expected: %s, but got %s", fmt.Sprint(scopeCount), fmt.Sprint(count))
-			}
-		} else {
-			if count := len(instance.ServiceAccounts); count != 1 {
-				return fmt.Errorf("Wrong number of ServiceAccounts: expected 1, got %d", count)
-			}
-
-			if scount := len(instance.ServiceAccounts[0].Scopes); scount == scopeCount {
-				return nil
-			} else {
-				return fmt.Errorf("Scope count expected: %s, but got %s", fmt.Sprint(scopeCount), fmt.Sprint(scount))
-			}
-		}
-	}
+    return nil
+  }
 }
 
-func testAccCheckComputeInstanceHasSubnet(instance *compute.Instance) resource.TestCheckFunc {
+func testAccCheckComputeInstanceAccessConfigHasPTR(instance *compute.Instance) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		for _, i := range instance.NetworkInterfaces {
-			if i.Subnetwork == "" {
-				return fmt.Errorf("no subnet")
+			for _, c := range i.AccessConfigs {
+				if c.PublicPtrDomainName == "" {
+					return fmt.Errorf("no PTR Record")
+				}
 			}
 		}
 
@@ -3119,216 +3248,933 @@ func testAccCheckComputeInstanceHasSubnet(instance *compute.Instance) resource.T
 	}
 }
 
-func testAccCheckComputeInstanceHasAnyNetworkIP(instance *compute.Instance) resource.TestCheckFunc {
+func testAccCheckComputeResourcePolicy(instance *compute.Instance, scheduleName string, resourcePolicyCountWant int) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		for _, i := range instance.NetworkInterfaces {
-			if i.NetworkIP == "" {
-				return fmt.Errorf("no network_ip")
-			}
+		resourcePoliciesCountHave := len(instance.ResourcePolicies)
+		if resourcePoliciesCountHave != resourcePolicyCountWant {
+			return fmt.Errorf("number of resource polices does not match: have: %d; want: %d", resourcePoliciesCountHave, resourcePolicyCountWant)
 		}
 
-		return nil
-	}
-}
-
-func testAccCheckComputeInstanceHasNetworkIP(instance *compute.Instance, networkIP string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		for _, i := range instance.NetworkInterfaces {
-			if i.NetworkIP != networkIP {
-				return fmt.Errorf("Wrong network_ip found: expected %v, got %v", networkIP, i.NetworkIP)
-			}
+		if resourcePoliciesCountHave == 1 && !strings.Contains(instance.ResourcePolicies[0], scheduleName) {
+			return fmt.Errorf("got the wrong schedule: have: %s; want: %s", instance.ResourcePolicies[0], scheduleName)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckComputeInstanceHasNetworkPerformanceConfig(instance *compute.Instance, bandwidthTier string) resource.TestCheckFunc {
+<% unless version == 'ga' -%>
+func testAccCheckComputeInstanceMaxRunDuration(instance *compute.Instance, instanceMaxRunDurationWant compute.Duration) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		if instance.NetworkPerformanceConfig == nil {
-			return fmt.Errorf("Expected instance to have network performance config, but it was nil")
+		if instance == nil {
+			return fmt.Errorf("instance is nil")
 		}
-		if instance.NetworkPerformanceConfig.TotalEgressBandwidthTier != bandwidthTier {
-			return fmt.Errorf("Incorrect network_performance_config.total_egress_bandwidth_tier found: expected %v, got %v", bandwidthTier, instance.NetworkPerformanceConfig.TotalEgressBandwidthTier)
+		if instance.Scheduling == nil {
+			return fmt.Errorf("no scheduling")
+		}
+
+		if !reflect.DeepEqual(*instance.Scheduling.MaxRunDuration, instanceMaxRunDurationWant) {
+			return fmt.Errorf("got the wrong instance max run duration action: have: %#v; want: %#v",instance.Scheduling.MaxRunDuration, instanceMaxRunDurationWant)
 		}
 
 		return nil
 	}
 }
+<% end -%>
 
-func testAccCheckComputeInstanceHasMultiNic(instance *compute.Instance) resource.TestCheckFunc {
+func testAccCheckComputeInstanceLocalSsdRecoveryTimeout(instance *compute.Instance, instanceLocalSsdRecoveryTiemoutWant compute.Duration) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		if len(instance.NetworkInterfaces) < 2 {
-			return fmt.Errorf("only saw %d nics", len(instance.NetworkInterfaces))
+		if instance == nil {
+			return fmt.Errorf("instance is nil")
+		}
+		if instance.Scheduling == nil {
+			return fmt.Errorf("no scheduling")
+		}
+
+		if !reflect.DeepEqual(*instance.Scheduling.LocalSsdRecoveryTimeout, instanceLocalSsdRecoveryTiemoutWant) {
+			return fmt.Errorf("got the wrong instance local ssd recovery timeout action: have: %#v; want: %#v",instance.Scheduling.LocalSsdRecoveryTimeout, instanceLocalSsdRecoveryTiemoutWant)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckComputeInstanceHasGuestAccelerator(instance *compute.Instance, acceleratorType string, acceleratorCount int64) resource.TestCheckFunc {
+func testAccCheckComputeInstanceTerminationAction(instance *compute.Instance, instanceTerminationActionWant string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		if len(instance.GuestAccelerators) != 1 {
-			return fmt.Errorf("Expected only one guest accelerator")
+		if instance == nil {
+			return fmt.Errorf("instance is nil")
 		}
-
-		if !strings.HasSuffix(instance.GuestAccelerators[0].AcceleratorType, acceleratorType) {
-			return fmt.Errorf("Wrong accelerator type: expected %v, got %v", acceleratorType, instance.GuestAccelerators[0].AcceleratorType)
+		if instance.Scheduling == nil {
+			return fmt.Errorf("no scheduling")
 		}
 
-		if instance.GuestAccelerators[0].AcceleratorCount != acceleratorCount {
-			return fmt.Errorf("Wrong accelerator acceleratorCount: expected %d, got %d", acceleratorCount, instance.GuestAccelerators[0].AcceleratorCount)
+		if instance.Scheduling.InstanceTerminationAction != instanceTerminationActionWant {
+			return fmt.Errorf("got the wrong instance termniation action: have: %s; want: %s",instance.Scheduling.InstanceTerminationAction, instanceTerminationActionWant)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckComputeInstanceLacksGuestAccelerator(instance *compute.Instance) resource.TestCheckFunc {
+func testAccCheckComputeInstanceDisk(instance *compute.Instance, source string, delete bool, boot bool) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		if len(instance.GuestAccelerators) > 0 {
-			return fmt.Errorf("Expected no guest accelerators")
+		if instance.Disks == nil {
+			return fmt.Errorf("no disks")
 		}
 
-		return nil
+		for _, disk := range instance.Disks {
+			if strings.HasSuffix(disk.Source, "/"+source) && disk.AutoDelete == delete && disk.Boot == boot {
+				return nil
+			}
+		}
+
+		return fmt.Errorf("Disk not found: %s", source)
 	}
 }
 
-func testAccCheckComputeInstanceHasMinCpuPlatform(instance *compute.Instance, minCpuPlatform string) resource.TestCheckFunc {
+func testAccCheckComputeInstanceHasInstanceId(instance *compute.Instance, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		if instance.MinCpuPlatform != minCpuPlatform {
-			return fmt.Errorf("Wrong minimum CPU platform: expected %s, got %s", minCpuPlatform, instance.MinCpuPlatform)
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
 		}
 
-		return nil
-	}
-}
+		remote := fmt.Sprintf("%d", instance.Id)
+		local := rs.Primary.Attributes["instance_id"]
 
-func testAccCheckComputeInstanceHasMachineType(instance *compute.Instance, machineType string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		instanceMachineType := tpgresource.GetResourceNameFromSelfLink(instance.MachineType)
-		if instanceMachineType != machineType {
-			return fmt.Errorf("Wrong machine type: expected %s, got %s", machineType, instanceMachineType)
+		if remote != local {
+			return fmt.Errorf("Instance id stored does not match: remote has %#v but local has %#v", remote,
+				local)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckComputeInstanceHasAliasIpRange(instance *compute.Instance, subnetworkRangeName, iPCidrRange string) resource.TestCheckFunc {
+func testAccCheckComputeInstanceBootDisk(instance *compute.Instance, source string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		for _, networkInterface := range instance.NetworkInterfaces {
-			for _, aliasIpRange := range networkInterface.AliasIpRanges {
-				if aliasIpRange.SubnetworkRangeName == subnetworkRangeName && (aliasIpRange.IpCidrRange == iPCidrRange || tpgresource.IpCidrRangeDiffSuppress("ip_cidr_range", aliasIpRange.IpCidrRange, iPCidrRange, nil)) {
+		if instance.Disks == nil {
+			return fmt.Errorf("no disks")
+		}
+
+		for _, disk := range instance.Disks {
+			if disk.Boot == true {
+				if strings.HasSuffix(disk.Source, source) {
 					return nil
 				}
 			}
 		}
 
-		return fmt.Errorf("Alias ip range with name %s and cidr %s not present", subnetworkRangeName, iPCidrRange)
+		return fmt.Errorf("Boot disk not found with source %q", source)
 	}
 }
 
-func testAccCheckComputeInstanceHasAssignedNatIP(s *terraform.State) error {
-	for _, rs := range s.RootModule().Resources {
-		if rs.Type != "google_compute_instance" {
-			continue
+func testAccCheckComputeInstanceBootDiskType(t *testing.T, instanceName string, diskType string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		config := acctest.GoogleProviderConfig(t)
+
+		// boot disk is named the same as the Instance
+		disk, err := config.NewComputeClient(config.UserAgent).Disks.Get(config.Project, "us-central1-a", instanceName).Do()
+		if err != nil {
+			return err
 		}
-		ip := rs.Primary.Attributes["network_interface.0.access_config.0.nat_ip"]
-		if ip == "" {
-			return fmt.Errorf("No assigned NatIP for instance %s", rs.Primary.Attributes["name"])
+		if strings.Contains(disk.Type, diskType) {
+			return nil
 		}
+
+		return fmt.Errorf("Boot disk not found with type %q", diskType)
 	}
-	return nil
 }
 
-func testAccCheckComputeInstanceHasConfiguredDeletionProtection(instance *compute.Instance, configuredDeletionProtection bool) resource.TestCheckFunc {
+func testAccCheckComputeInstanceScratchDisk(instance *compute.Instance, interfaces []map[string]string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		if instance.DeletionProtection != configuredDeletionProtection {
-			return fmt.Errorf("Wrong deletion protection flag: expected %t, got %t", configuredDeletionProtection, instance.DeletionProtection)
+		if instance.Disks == nil {
+			return fmt.Errorf("no disks")
+		}
+
+		i := 0
+		for _, disk := range instance.Disks {
+			if disk.Type == "SCRATCH" {
+				if i >= len(interfaces) {
+					return fmt.Errorf("Expected %d scratch disks, found more", len(interfaces))
+				}
+				if disk.Interface != interfaces[i]["interface"] {
+					return fmt.Errorf("Mismatched interface on scratch disk #%d, expected: %q, found: %q",
+						i, interfaces[i], disk.Interface)
+				}
+				if deviceName, ok := interfaces[i]["deviceName"]; ok {
+					if disk.DeviceName != deviceName {
+						return fmt.Errorf("Mismatched device name on scratch disk #%d, expected: %q, found: %q",
+						i, deviceName, disk.DeviceName)
+					}
+				}
+				
+				i++
+			}
+		}
+
+		if i != len(interfaces) {
+			return fmt.Errorf("Expected %d scratch disks, found %d", len(interfaces), i)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckComputeInstanceHasReservationAffinity(instance *compute.Instance, reservationType string, specificReservationNames ...string) resource.TestCheckFunc {
-	if len(specificReservationNames) > 1 {
-		panic("too many specificReservationNames provided in test")
+func testAccCheckComputeInstanceDiskEncryptionKey(n string, instance *compute.Instance, bootDiskEncryptionKey string, diskNameToEncryptionKey map[string]*compute.CustomerEncryptionKey) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		for i, disk := range instance.Disks {
+			if disk.Boot {
+				attr := rs.Primary.Attributes["boot_disk.0.disk_encryption_key_sha256"]
+				if attr != bootDiskEncryptionKey {
+					return fmt.Errorf("Boot disk has wrong encryption key in state.\nExpected: %s\nActual: %s", bootDiskEncryptionKey, attr)
+				}
+				if disk.DiskEncryptionKey == nil && attr != "" {
+					return fmt.Errorf("Disk %d has mismatched encryption key.\nTF State: %+v\nGCP State: <empty>", i, attr)
+				}
+				if disk.DiskEncryptionKey != nil && attr != disk.DiskEncryptionKey.Sha256 {
+					return fmt.Errorf("Disk %d has mismatched encryption key.\nTF State: %+v\nGCP State: %+v",
+						i, attr, disk.DiskEncryptionKey.Sha256)
+				}
+			} else {
+				if disk.DiskEncryptionKey != nil {
+					expectedKey := diskNameToEncryptionKey[tpgresource.GetResourceNameFromSelfLink(disk.Source)].Sha256
+					if disk.DiskEncryptionKey.Sha256 != expectedKey {
+						return fmt.Errorf("Disk %d has unexpected encryption key in GCP.\nExpected: %s\nActual: %s", i, expectedKey, disk.DiskEncryptionKey.Sha256)
+					}
+				}
+			}
+		}
+
+		numAttachedDisks, err := strconv.Atoi(rs.Primary.Attributes["attached_disk.#"])
+		if err != nil {
+			return fmt.Errorf("Error converting value of attached_disk.#")
+		}
+		for i := 0; i < numAttachedDisks; i++ {
+			diskName := tpgresource.GetResourceNameFromSelfLink(rs.Primary.Attributes[fmt.Sprintf("attached_disk.%d.source", i)])
+			encryptionKey := rs.Primary.Attributes[fmt.Sprintf("attached_disk.%d.disk_encryption_key_sha256", i)]
+			if key, ok := diskNameToEncryptionKey[diskName]; ok {
+				expectedEncryptionKey := key.Sha256
+				if encryptionKey != expectedEncryptionKey {
+					return fmt.Errorf("Attached disk %d has unexpected encryption key in state.\nExpected: %s\nActual: %s", i, expectedEncryptionKey, encryptionKey)
+				}
+			}
+		}
+		return nil
 	}
+}
 
-	return func(*terraform.State) error {
-		if instance.ReservationAffinity == nil {
-			return fmt.Errorf("expected instance to have reservation affinity, but it was nil")
+func testAccCheckComputeInstanceDiskKmsEncryptionKey(n string, instance *compute.Instance, bootDiskEncryptionKey string, diskNameToEncryptionKey map[string]*compute.CustomerEncryptionKey) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		for i, disk := range instance.Disks {
+			if disk.Boot {
+				attr := rs.Primary.Attributes["boot_disk.0.kms_key_self_link"]
+				if attr != bootDiskEncryptionKey {
+					return fmt.Errorf("Boot disk has wrong encryption key in state.\nExpected: %s\nActual: %s", bootDiskEncryptionKey, attr)
+				}
+				if disk.DiskEncryptionKey == nil && attr != "" {
+					return fmt.Errorf("Disk %d has mismatched encryption key.\nTF State: %+v\nGCP State: <empty>", i, attr)
+				}
+			} else {
+				if disk.DiskEncryptionKey != nil {
+					expectedKey := diskNameToEncryptionKey[tpgresource.GetResourceNameFromSelfLink(disk.Source)].KmsKeyName
+					// The response for crypto keys often includes the version of the key which needs to be removed
+					// format: projects/<project>/locations/<region>/keyRings/<keyring>/cryptoKeys/<key>/cryptoKeyVersions/1
+					actualKey := strings.Split(disk.DiskEncryptionKey.KmsKeyName, "/cryptoKeyVersions")[0]
+					if actualKey != expectedKey {
+						return fmt.Errorf("Disk %d has unexpected encryption key in GCP.\nExpected: %s\nActual: %s", i, expectedKey, actualKey)
+					}
+				}
+			}
 		}
 
-		if instance.ReservationAffinity.ConsumeReservationType != reservationType {
-			return fmt.Errorf("Wrong reservationAffinity consumeReservationType: expected %s, got, %s", reservationType, instance.ReservationAffinity.ConsumeReservationType)
-		}
+		numAttachedDisks, err := strconv.Atoi(rs.Primary.Attributes["attached_disk.#"])
+		if err != nil {
+			return fmt.Errorf("Error converting value of attached_disk.#")
+		}
+		for i := 0; i < numAttachedDisks; i++ {
+			diskName := tpgresource.GetResourceNameFromSelfLink(rs.Primary.Attributes[fmt.Sprintf("attached_disk.%d.source", i)])
+			kmsKeyName := rs.Primary.Attributes[fmt.Sprintf("attached_disk.%d.kms_key_self_link", i)]
+			if key, ok := diskNameToEncryptionKey[diskName]; ok {
+				expectedEncryptionKey := key.KmsKeyName
+				if kmsKeyName != expectedEncryptionKey {
+					return fmt.Errorf("Attached disk %d has unexpected encryption key in state.\nExpected: %s\nActual: %s", i, expectedEncryptionKey, kmsKeyName)
+				}
+			}
+		}
+		return nil
+	}
+}
+
+func testAccCheckComputeInstanceTag(instance *compute.Instance, n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if instance.Tags == nil {
+			return fmt.Errorf("no tags")
+		}
+
+		for _, k := range instance.Tags.Items {
+			if k == n {
+				return nil
+			}
+		}
+
+		return fmt.Errorf("tag not found: %s", n)
+	}
+}
+
+func testAccCheckComputeInstanceLabel(instance *compute.Instance, key string, value string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if instance.Labels == nil {
+			return fmt.Errorf("no labels found on instance %s", instance.Name)
+		}
+
+		v, ok := instance.Labels[key]
+		if !ok {
+			return fmt.Errorf("No label found with key %s on instance %s", key, instance.Name)
+		}
+		if v != value {
+			return fmt.Errorf("Expected value '%s' but found value '%s' for label '%s' on instance %s", value, v, key, instance.Name)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckComputeInstanceServiceAccount(instance *compute.Instance, scope string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if count := len(instance.ServiceAccounts); count != 1 {
+			return fmt.Errorf("Wrong number of ServiceAccounts: expected 1, got %d", count)
+		}
+
+		for _, val := range instance.ServiceAccounts[0].Scopes {
+			if val == scope {
+				return nil
+			}
+		}
+
+		return fmt.Errorf("Scope not found: %s", scope)
+	}
+}
+
+func testAccCheckComputeInstanceScopes(instance *compute.Instance, scopeCount int) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+
+		if count := len(instance.ServiceAccounts); count == 0 {
+			if scopeCount == 0 {
+				return nil
+			} else {
+				return fmt.Errorf("Scope count expected: %s, but got %s", fmt.Sprint(scopeCount), fmt.Sprint(count))
+			}
+		} else {
+			if count := len(instance.ServiceAccounts); count != 1 {
+				return fmt.Errorf("Wrong number of ServiceAccounts: expected 1, got %d", count)
+			}
+
+			if scount := len(instance.ServiceAccounts[0].Scopes); scount == scopeCount {
+				return nil
+			} else {
+				return fmt.Errorf("Scope count expected: %s, but got %s", fmt.Sprint(scopeCount), fmt.Sprint(scount))
+			}
+		}
+	}
+}
+
+func testAccCheckComputeInstanceHasSubnet(instance *compute.Instance) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		for _, i := range instance.NetworkInterfaces {
+			if i.Subnetwork == "" {
+				return fmt.Errorf("no subnet")
+			}
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckComputeInstanceHasAnyNetworkIP(instance *compute.Instance) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		for _, i := range instance.NetworkInterfaces {
+			if i.NetworkIP == "" {
+				return fmt.Errorf("no network_ip")
+			}
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckComputeInstanceHasNetworkIP(instance *compute.Instance, networkIP string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		for _, i := range instance.NetworkInterfaces {
+			if i.NetworkIP != networkIP {
+				return fmt.Errorf("Wrong network_ip found: expected %v, got %v", networkIP, i.NetworkIP)
+			}
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckComputeInstanceHasNetworkPerformanceConfig(instance *compute.Instance, bandwidthTier string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if instance.NetworkPerformanceConfig == nil {
+			return fmt.Errorf("Expected instance to have network performance config, but it was nil")
+		}
+		if instance.NetworkPerformanceConfig.TotalEgressBandwidthTier != bandwidthTier {
+			return fmt.Errorf("Incorrect network_performance_config.total_egress_bandwidth_tier found: expected %v, got %v", bandwidthTier, instance.NetworkPerformanceConfig.TotalEgressBandwidthTier)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckComputeInstanceHasMultiNic(instance *compute.Instance) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if len(instance.NetworkInterfaces) < 2 {
+			return fmt.Errorf("only saw %d nics", len(instance.NetworkInterfaces))
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckComputeInstanceHasGuestAccelerator(instance *compute.Instance, acceleratorType string, acceleratorCount int64) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if len(instance.GuestAccelerators) != 1 {
+			return fmt.Errorf("Expected only one guest accelerator")
+		}
+
+		if !strings.HasSuffix(instance.GuestAccelerators[0].AcceleratorType, acceleratorType) {
+			return fmt.Errorf("Wrong accelerator type: expected %v, got %v", acceleratorType, instance.GuestAccelerators[0].AcceleratorType)
+		}
+
+		if instance.GuestAccelerators[0].AcceleratorCount != acceleratorCount {
+			return fmt.Errorf("Wrong accelerator acceleratorCount: expected %d, got %d", acceleratorCount, instance.GuestAccelerators[0].AcceleratorCount)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckComputeInstanceLacksGuestAccelerator(instance *compute.Instance) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if len(instance.GuestAccelerators) > 0 {
+			return fmt.Errorf("Expected no guest accelerators")
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckComputeInstanceHasMinCpuPlatform(instance *compute.Instance, minCpuPlatform string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if instance.MinCpuPlatform != minCpuPlatform {
+			return fmt.Errorf("Wrong minimum CPU platform: expected %s, got %s", minCpuPlatform, instance.MinCpuPlatform)
+		}
+
+		return nil
+	}
+}
+
+<% if version == "beta"%>
+func testAccCheckComputeInstanceHasNetworkAttachment(instance *compute.Instance, networkAttachmentName string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		for _, networkInterface := range instance.NetworkInterfaces {
+			if networkInterface.NetworkAttachment != "" && networkInterface.NetworkAttachment == networkAttachmentName {
+				return nil
+			}
+		}
+		return fmt.Errorf("Network Attachment %s, was not found in the instance template", networkAttachmentName)
+	}
+}
+<% end %>
+
+func testAccCheckComputeInstanceHasMachineType(instance *compute.Instance, machineType string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		instanceMachineType := tpgresource.GetResourceNameFromSelfLink(instance.MachineType)
+		if instanceMachineType != machineType {
+			return fmt.Errorf("Wrong machine type: expected %s, got %s", machineType, instanceMachineType)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckComputeInstanceHasAliasIpRange(instance *compute.Instance, subnetworkRangeName, iPCidrRange string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		for _, networkInterface := range instance.NetworkInterfaces {
+			for _, aliasIpRange := range networkInterface.AliasIpRanges {
+				if aliasIpRange.SubnetworkRangeName == subnetworkRangeName && (aliasIpRange.IpCidrRange == iPCidrRange || tpgresource.IpCidrRangeDiffSuppress("ip_cidr_range", aliasIpRange.IpCidrRange, iPCidrRange, nil)) {
+					return nil
+				}
+			}
+		}
+
+		return fmt.Errorf("Alias ip range with name %s and cidr %s not present", subnetworkRangeName, iPCidrRange)
+	}
+}
+
+func testAccCheckComputeInstanceHasAssignedNatIP(s *terraform.State) error {
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "google_compute_instance" {
+			continue
+		}
+		ip := rs.Primary.Attributes["network_interface.0.access_config.0.nat_ip"]
+		if ip == "" {
+			return fmt.Errorf("No assigned NatIP for instance %s", rs.Primary.Attributes["name"])
+		}
+	}
+	return nil
+}
+
+func testAccCheckComputeInstanceHasConfiguredDeletionProtection(instance *compute.Instance, configuredDeletionProtection bool) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if instance.DeletionProtection != configuredDeletionProtection {
+			return fmt.Errorf("Wrong deletion protection flag: expected %t, got %t", configuredDeletionProtection, instance.DeletionProtection)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckComputeInstanceHasReservationAffinity(instance *compute.Instance, reservationType string, specificReservationNames ...string) resource.TestCheckFunc {
+	if len(specificReservationNames) > 1 {
+		panic("too many specificReservationNames provided in test")
+	}
+
+	return func(*terraform.State) error {
+		if instance.ReservationAffinity == nil {
+			return fmt.Errorf("expected instance to have reservation affinity, but it was nil")
+		}
+
+		if instance.ReservationAffinity.ConsumeReservationType != reservationType {
+			return fmt.Errorf("Wrong reservationAffinity consumeReservationType: expected %s, got, %s", reservationType, instance.ReservationAffinity.ConsumeReservationType)
+		}
+
+		if len(specificReservationNames) > 0 {
+			const reservationNameKey = "compute.googleapis.com/reservation-name"
+			if instance.ReservationAffinity.Key != reservationNameKey {
+				return fmt.Errorf("Wrong reservationAffinity key: expected %s, got, %s", reservationNameKey, instance.ReservationAffinity.Key)
+			}
+			if len(instance.ReservationAffinity.Values) != 1 || instance.ReservationAffinity.Values[0] != specificReservationNames[0] {
+				return fmt.Errorf("Wrong reservationAffinity values: expected %s, got, %s", specificReservationNames, instance.ReservationAffinity.Values)
+			}
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckComputeInstanceHasShieldedVmConfig(instance *compute.Instance, enableSecureBoot bool, enableVtpm bool, enableIntegrityMonitoring bool) resource.TestCheckFunc {
+
+	return func(s *terraform.State) error {
+		if instance.ShieldedInstanceConfig.EnableSecureBoot != enableSecureBoot {
+			return fmt.Errorf("Wrong shieldedVmConfig enableSecureBoot: expected %t, got, %t", enableSecureBoot, instance.ShieldedInstanceConfig.EnableSecureBoot)
+		}
+
+		if instance.ShieldedInstanceConfig.EnableVtpm != enableVtpm {
+			return fmt.Errorf("Wrong shieldedVmConfig enableVtpm: expected %t, got, %t", enableVtpm, instance.ShieldedInstanceConfig.EnableVtpm)
+		}
+
+		if instance.ShieldedInstanceConfig.EnableIntegrityMonitoring != enableIntegrityMonitoring {
+			return fmt.Errorf("Wrong shieldedVmConfig enableIntegrityMonitoring: expected %t, got, %t", enableIntegrityMonitoring, instance.ShieldedInstanceConfig.EnableIntegrityMonitoring)
+		}
+		return nil
+	}
+}
+
+func testAccCheckComputeInstanceHasConfidentialInstanceConfig(instance *compute.Instance, EnableConfidentialCompute bool) resource.TestCheckFunc {
+
+	return func(s *terraform.State) error {
+		if instance.ConfidentialInstanceConfig.EnableConfidentialCompute != EnableConfidentialCompute {
+			return fmt.Errorf("Wrong ConfidentialInstanceConfig EnableConfidentialCompute: expected %t, got, %t", EnableConfidentialCompute, instance.ConfidentialInstanceConfig.EnableConfidentialCompute)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckComputeInstanceLacksShieldedVmConfig(instance *compute.Instance) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if instance.ShieldedInstanceConfig != nil {
+			return fmt.Errorf("Expected no shielded vm config")
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckComputeInstanceHasStatus(instance *compute.Instance, status string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if instance.Status != status {
+			return fmt.Errorf("Instance has not status %s, status: %s", status, instance.Status)
+		}
+		return nil
+	}
+}
+
+<% unless version == 'ga' -%>
+func testAccCheckComputeInstanceNicAccessConfigHasSecurityPolicy(instance *compute.Instance, securityPolicy string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		for _, networkInterface := range instance.NetworkInterfaces {
+			for _, accessConfig := range networkInterface.AccessConfigs {
+				if strings.Contains(accessConfig.SecurityPolicy, securityPolicy) {
+					return nil
+				}
+			}
+
+			for _, accessConfigIpv6 := range networkInterface.Ipv6AccessConfigs {
+				if strings.Contains(accessConfigIpv6.SecurityPolicy, securityPolicy) {
+					return nil
+				}
+			}
+		}
+
+		return fmt.Errorf("Security Policy with name %s not present", securityPolicy)
+	}
+}
+
+func testAccCheckComputeInstanceNicAccessConfigHasNoSecurityPolicy(instance *compute.Instance) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		for _, networkInterface := range instance.NetworkInterfaces {
+			for _, accessConfig := range networkInterface.AccessConfigs {
+				if accessConfig.SecurityPolicy != "" {
+					return fmt.Errorf("Security Policy with name %s is present", accessConfig.SecurityPolicy)
+				}
+
+			}
+
+			for _, accessConfigIpv6 := range networkInterface.Ipv6AccessConfigs {
+				if accessConfigIpv6.SecurityPolicy != "" {
+					return fmt.Errorf("Security Policy with name %s is present", accessConfigIpv6.SecurityPolicy)
+				}
+			}
+		}
+
+		return nil
+	}
+}
+<% end -%>
+
+func testAccComputeInstance_basic(instance string) string {
+	return fmt.Sprintf(`
+data "google_compute_image" "my_image" {
+  family  = "debian-11"
+  project = "debian-cloud"
+}
+
+resource "google_compute_instance" "foobar" {
+  name           = "%s"
+  machine_type   = "e2-medium"
+  zone           = "us-central1-a"
+  can_ip_forward = false
+  tags           = ["foo", "bar"]
+  desired_status  = "RUNNING"
+
+  //deletion_protection = false is implicit in this config due to default value
+
+  boot_disk {
+    initialize_params {
+      image = data.google_compute_image.my_image.self_link
+    }
+  }
+
+  network_interface {
+    network = "default"
+  }
+
+  metadata = {
+    foo            = "bar"
+    baz            = "qux"
+    startup-script = "echo Hello"
+  }
+
+  labels = {
+    my_key       = "my_value"
+    my_other_key = "my_other_value"
+  }
+}
+`, instance)
+}
+
+func testAccComputeInstance_basic2(instance string) string {
+	return fmt.Sprintf(`
+data "google_compute_image" "my_image" {
+  family  = "debian-11"
+  project = "debian-cloud"
+}
+
+resource "google_compute_instance" "foobar" {
+  name           = "%s"
+  machine_type   = "e2-medium"
+  zone           = "us-central1-a"
+  can_ip_forward = false
+  tags           = ["foo", "bar"]
+
+  boot_disk {
+    initialize_params {
+      image = data.google_compute_image.my_image.self_link
+    }
+  }
+
+  network_interface {
+    network = "default"
+  }
+
+  metadata = {
+    foo = "bar"
+  }
+}
+`, instance)
+}
+
+func testAccComputeInstance_basic3(instance string) string {
+	return fmt.Sprintf(`
+data "google_compute_image" "my_image" {
+  family  = "debian-11"
+  project = "debian-cloud"
+}
+
+resource "google_compute_instance" "foobar" {
+  name           = "%s"
+  machine_type   = "e2-medium"
+  zone           = "us-central1-a"
+  can_ip_forward = false
+  tags           = ["foo", "bar"]
+
+  boot_disk {
+    initialize_params {
+      image = data.google_compute_image.my_image.self_link
+    }
+  }
+
+  network_interface {
+    network = "default"
+  }
+
+  metadata = {
+    foo = "bar"
+  }
+}
+`, instance)
+}
+
+func testAccComputeInstance_basic4(instance string) string {
+	return fmt.Sprintf(`
+data "google_compute_image" "my_image" {
+  family  = "debian-11"
+  project = "debian-cloud"
+}
+
+resource "google_compute_instance" "foobar" {
+  name           = "%s"
+  machine_type   = "e2-medium"
+  zone           = "us-central1-a"
+  can_ip_forward = false
+  tags           = ["foo", "bar"]
+
+  boot_disk {
+    initialize_params {
+      image = data.google_compute_image.my_image.self_link
+    }
+  }
+
+  network_interface {
+    network = "default"
+  }
+
+  metadata = {
+    foo = "bar"
+  }
+}
+`, instance)
+}
+
+func testAccComputeInstance_basic5(instance string) string {
+	return fmt.Sprintf(`
+data "google_compute_image" "my_image" {
+  family  = "debian-11"
+  project = "debian-cloud"
+}
+
+resource "google_compute_instance" "foobar" {
+  name           = "%s"
+  machine_type   = "e2-medium"
+  zone           = "us-central1-a"
+  can_ip_forward = false
+  tags           = ["foo", "bar"]
+
+  boot_disk {
+    initialize_params {
+      image = data.google_compute_image.my_image.self_link
+    }
+  }
+
+  network_interface {
+    network = "default"
+  }
+
+  metadata = {
+    foo = "bar"
+  }
+}
+`, instance)
+}
+
+func testAccComputeInstance_resourceManagerTags(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_tags_tag_key" "key" {
+  parent = "projects/%{project}"
+  short_name = "foobarbaz%{random_suffix}"
+  description = "For foo/bar resources."
+}
+
+resource "google_tags_tag_value" "value" {
+  parent = "tagKeys/${google_tags_tag_key.key.name}"
+  short_name = "foo%{random_suffix}"
+  description = "For foo resources."
+}
+
+data "google_compute_image" "my_image" {
+  family  = "debian-11"
+  project = "debian-cloud"
+}
+
+resource "google_compute_instance" "foobar" {
+  name           = "%{instance_name}"
+  machine_type   = "e2-medium"
+  zone           = "us-central1-a"
+  can_ip_forward = false
+  tags           = ["tag-key", "tag-value"]
+
+  boot_disk {
+    initialize_params {
+      image = data.google_compute_image.my_image.self_link
+      resource_manager_tags = {
+        "tagKeys/${google_tags_tag_key.key.name}" = "tagValues/${google_tags_tag_value.value.name}"
+      }
+    }
+  }
+
+  params {
+    resource_manager_tags = {
+      "tagKeys/${google_tags_tag_key.key.name}" = "tagValues/${google_tags_tag_value.value.name}"
+    }
+  }
+
+  network_interface {
+    network = "default"
+  }
+
+  metadata = {
+    foo = "bar"
+  }
+}
+`, context)
+}
+
+func testAccComputeInstance_basic_deletionProtectionFalse(instance string) string {
+	return fmt.Sprintf(`
+data "google_compute_image" "my_image" {
+  family  = "debian-11"
+  project = "debian-cloud"
+}
 
-		if len(specificReservationNames) > 0 {
-			const reservationNameKey = "compute.googleapis.com/reservation-name"
-			if instance.ReservationAffinity.Key != reservationNameKey {
-				return fmt.Errorf("Wrong reservationAffinity key: expected %s, got, %s", reservationNameKey, instance.ReservationAffinity.Key)
-			}
-			if len(instance.ReservationAffinity.Values) != 1 || instance.ReservationAffinity.Values[0] != specificReservationNames[0] {
-				return fmt.Errorf("Wrong reservationAffinity values: expected %s, got, %s", specificReservationNames, instance.ReservationAffinity.Values)
-			}
-		}
+resource "google_compute_instance" "foobar" {
+  name                = "%s"
+  machine_type        = "e2-medium"
+  zone                = "us-central1-a"
+  can_ip_forward      = false
+  tags                = ["foo", "bar"]
+  deletion_protection = false
 
-		return nil
-	}
+  boot_disk {
+    initialize_params {
+      image = data.google_compute_image.my_image.self_link
+    }
+  }
+
+  network_interface {
+    network = "default"
+  }
+}
+`, instance)
 }
 
-func testAccCheckComputeInstanceHasShieldedVmConfig(instance *compute.Instance, enableSecureBoot bool, enableVtpm bool, enableIntegrityMonitoring bool) resource.TestCheckFunc {
+func testAccComputeInstance_basic_deletionProtectionTrue(instance string) string {
+	return fmt.Sprintf(`
+data "google_compute_image" "my_image" {
+  family  = "debian-11"
+  project = "debian-cloud"
+}
 
-	return func(s *terraform.State) error {
-		if instance.ShieldedInstanceConfig.EnableSecureBoot != enableSecureBoot {
-			return fmt.Errorf("Wrong shieldedVmConfig enableSecureBoot: expected %t, got, %t", enableSecureBoot, instance.ShieldedInstanceConfig.EnableSecureBoot)
-		}
+resource "google_compute_instance" "foobar" {
+  name                = "%s"
+  machine_type        = "e2-medium"
+  zone                = "us-central1-a"
+  can_ip_forward      = false
+  tags                = ["foo", "bar"]
+  deletion_protection = true
 
-		if instance.ShieldedInstanceConfig.EnableVtpm != enableVtpm {
-			return fmt.Errorf("Wrong shieldedVmConfig enableVtpm: expected %t, got, %t", enableVtpm, instance.ShieldedInstanceConfig.EnableVtpm)
-		}
+  boot_disk {
+    initialize_params {
+      image = data.google_compute_image.my_image.self_link
+    }
+  }
 
-		if instance.ShieldedInstanceConfig.EnableIntegrityMonitoring != enableIntegrityMonitoring {
-			return fmt.Errorf("Wrong shieldedVmConfig enableIntegrityMonitoring: expected %t, got, %t", enableIntegrityMonitoring, instance.ShieldedInstanceConfig.EnableIntegrityMonitoring)
-		}
-		return nil
-	}
+  network_interface {
+    network = "default"
+  }
+}
+`, instance)
 }
 
-func testAccCheckComputeInstanceHasConfidentialInstanceConfig(instance *compute.Instance, EnableConfidentialCompute bool) resource.TestCheckFunc {
+// Update zone to ForceNew, and change metadata k/v entirely
+// Generates diff mismatch
+func testAccComputeInstance_forceNewAndChangeMetadata(instance string) string {
+	return fmt.Sprintf(`
+data "google_compute_image" "my_image" {
+  family  = "debian-11"
+  project = "debian-cloud"
+}
 
-	return func(s *terraform.State) error {
-		if instance.ConfidentialInstanceConfig.EnableConfidentialCompute != EnableConfidentialCompute {
-			return fmt.Errorf("Wrong ConfidentialInstanceConfig EnableConfidentialCompute: expected %t, got, %t", EnableConfidentialCompute, instance.ConfidentialInstanceConfig.EnableConfidentialCompute)
-		}
+resource "google_compute_instance" "foobar" {
+  name         = "%s"
+  machine_type = "e2-medium"
+  zone         = "us-central1-b"
+  tags         = ["baz"]
 
-		return nil
-	}
-}
+  boot_disk {
+    initialize_params {
+      image = data.google_compute_image.my_image.self_link
+    }
+  }
 
-func testAccCheckComputeInstanceLacksShieldedVmConfig(instance *compute.Instance) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if instance.ShieldedInstanceConfig != nil {
-			return fmt.Errorf("Expected no shielded vm config")
-		}
+  network_interface {
+    network = "default"
+    access_config {
+    }
+  }
 
-		return nil
-	}
+  metadata = {
+    qux = "true"
+  }
 }
-
-func testAccCheckComputeInstanceHasStatus(instance *compute.Instance, status string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if instance.Status != status {
-			return fmt.Errorf("Instance has not status %s, status: %s", status, instance.Status)
-		}
-		return nil
-	}
+`, instance)
 }
 
-func testAccComputeInstance_basic(instance string) string {
+// Update metadata, tags, and network_interface
+func testAccComputeInstance_update(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
@@ -3339,11 +4185,8 @@ resource "google_compute_instance" "foobar" {
   name           = "%s"
   machine_type   = "e2-medium"
   zone           = "us-central1-a"
-  can_ip_forward = false
-  tags           = ["foo", "bar"]
-  desired_status  = "RUNNING"
-
-  //deletion_protection = false is implicit in this config due to default value
+  can_ip_forward = true
+  tags           = ["baz"]
 
   boot_disk {
     initialize_params {
@@ -3353,35 +4196,38 @@ resource "google_compute_instance" "foobar" {
 
   network_interface {
     network = "default"
+    access_config {
+    }
   }
 
   metadata = {
-    foo            = "bar"
-    baz            = "qux"
+    bar            = "baz"
     startup-script = "echo Hello"
   }
 
   labels = {
-    my_key       = "my_value"
-    my_other_key = "my_other_value"
+    only_me = "nothing_else"
   }
 }
 `, instance)
 }
 
-func testAccComputeInstance_basic2(instance string) string {
+func testAccComputeInstance_ip(ip, instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
+resource "google_compute_address" "foo" {
+  name = "%s"
+}
+
 resource "google_compute_instance" "foobar" {
-  name           = "%s"
-  machine_type   = "e2-medium"
-  zone           = "us-central1-a"
-  can_ip_forward = false
-  tags           = ["foo", "bar"]
+  name         = "%s"
+  machine_type = "e2-medium"
+  zone         = "us-central1-a"
+  tags         = ["foo", "bar"]
 
   boot_disk {
     initialize_params {
@@ -3391,28 +4237,51 @@ resource "google_compute_instance" "foobar" {
 
   network_interface {
     network = "default"
+    access_config {
+      nat_ip = google_compute_address.foo.address
+    }
   }
 
   metadata = {
     foo = "bar"
   }
 }
-`, instance)
+`, ip, instance)
 }
 
-func testAccComputeInstance_basic3(instance string) string {
+func testAccComputeInstance_ipv6(ip, instance, record string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
+resource "google_compute_subnetwork" "subnetwork-ipv6" {
+  name          = "%s-subnetwork"
+
+  ip_cidr_range = "10.0.0.0/22"
+  region        = "us-west2"
+
+  stack_type       = "IPV4_IPV6"
+  ipv6_access_type = "EXTERNAL"
+
+  network       = google_compute_network.custom-test.id
+}
+
+resource "google_compute_network" "custom-test" {
+  name                    = "%s-network"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_address" "foo" {
+  name = "%s"
+}
+
 resource "google_compute_instance" "foobar" {
-  name           = "%s"
-  machine_type   = "e2-medium"
-  zone           = "us-central1-a"
-  can_ip_forward = false
-  tags           = ["foo", "bar"]
+  name         = "%s"
+  machine_type = "e2-medium"
+  zone         = "us-west2-a"
+  tags         = ["foo", "bar"]
 
   boot_disk {
     initialize_params {
@@ -3420,61 +4289,119 @@ resource "google_compute_instance" "foobar" {
     }
   }
 
-  network_interface {
-    network = "default"
-  }
+  network_interface {
+    subnetwork = google_compute_subnetwork.subnetwork-ipv6.name
+    stack_type = "IPV4_IPV6"
+    ipv6_access_config {
+      network_tier = "PREMIUM"
+      public_ptr_domain_name = "%s.gcp.tfacc.hashicorptest.com."
+    }
+  }
+
+  metadata = {
+    foo = "bar"
+  }
+}
+`, instance, instance, ip, instance, record)
+}
+
+func testAccComputeInstance_internalIpv6(ip, instance string) string {
+  return fmt.Sprintf(`
+  data "google_compute_image" "my_image" {
+    family  = "debian-11"
+    project = "debian-cloud"
+  }
+
+  resource "google_compute_subnetwork" "subnetwork_ipv6" {
+    name          = "%s-subnetwork"
+
+    ip_cidr_range = "10.0.0.0/22"
+    region        = "us-west2"
+
+    stack_type       = "IPV4_IPV6"
+    ipv6_access_type = "INTERNAL"
+
+    network       = google_compute_network.custom-test.id
+  }
+
+  resource "google_compute_network" "custom-test" {
+    name                     = "%s-network"
+    enable_ula_internal_ipv6 = true
+    auto_create_subnetworks  = false
+  }
+
+  resource "google_compute_address" "ipv6" {
+    name         = "%s"
+    region       = "us-west2"
+    address_type = "INTERNAL"
+    purpose      = "GCE_ENDPOINT"
+    subnetwork   = google_compute_subnetwork.subnetwork_ipv6.id
+    ip_version   = "IPV6"
+  }
+
+  resource "google_compute_instance" "foobar" {
+    name         = "%s"
+    machine_type = "e2-medium"
+    zone         = "us-west2-a"
+    tags         = ["foo", "bar"]
+
+    boot_disk {
+      initialize_params {
+        image = data.google_compute_image.my_image.self_link
+      }
+    }
+
+    network_interface {
+      subnetwork = google_compute_subnetwork.subnetwork_ipv6.name
+      stack_type = "IPV4_IPV6"
+      ipv6_address = google_compute_address.ipv6.address
+    }
 
-  metadata = {
-    foo = "bar"
+    metadata = {
+      foo = "bar"
+    }
   }
-}
-`, instance)
+  `, instance, instance, ip, instance)
 }
 
-func testAccComputeInstance_basic4(instance string) string {
+func testAccComputeInstance_ipv6ExternalReservation(instance string) string {
 	return fmt.Sprintf(`
+resource "google_compute_address" "ipv6-address" {
+  region             = "us-west2"
+  name               = "%s-address"
+  address_type       = "EXTERNAL"
+  ip_version         = "IPV6"
+  network_tier       = "PREMIUM"
+  ipv6_endpoint_type = "VM"
+  subnetwork         = google_compute_subnetwork.subnetwork-ipv6.name
+}
+
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
-resource "google_compute_instance" "foobar" {
-  name           = "%s"
-  machine_type   = "e2-medium"
-  zone           = "us-central1-a"
-  can_ip_forward = false
-  tags           = ["foo", "bar"]
+resource "google_compute_subnetwork" "subnetwork-ipv6" {
+  name          = "%s-subnetwork"
 
-  boot_disk {
-    initialize_params {
-      image = data.google_compute_image.my_image.self_link
-    }
-  }
+  ip_cidr_range = "10.0.0.0/22"
+  region        = "us-west2"
 
-  network_interface {
-    network = "default"
-  }
+  stack_type       = "IPV4_IPV6"
+  ipv6_access_type = "EXTERNAL"
 
-  metadata = {
-    foo = "bar"
-  }
-}
-`, instance)
+  network       = google_compute_network.custom-test.id
 }
 
-func testAccComputeInstance_basic5(instance string) string {
-	return fmt.Sprintf(`
-data "google_compute_image" "my_image" {
-  family  = "debian-11"
-  project = "debian-cloud"
+resource "google_compute_network" "custom-test" {
+  name                    = "%s-network"
+  auto_create_subnetworks = false
 }
 
 resource "google_compute_instance" "foobar" {
-  name           = "%s"
-  machine_type   = "e2-medium"
-  zone           = "us-central1-a"
-  can_ip_forward = false
-  tags           = ["foo", "bar"]
+  name         = "%s"
+  machine_type = "e2-medium"
+  zone         = "us-west2-a"
 
   boot_disk {
     initialize_params {
@@ -3483,69 +4410,53 @@ resource "google_compute_instance" "foobar" {
   }
 
   network_interface {
-    network = "default"
-  }
-
-  metadata = {
-    foo = "bar"
+    subnetwork                    = google_compute_subnetwork.subnetwork-ipv6.name
+    stack_type                    = "IPV4_IPV6"
+    ipv6_access_config {
+      external_ipv6               = google_compute_address.ipv6-address.address
+      external_ipv6_prefix_length = 96
+      name                        = "external-ipv6-access-config"
+      network_tier                = "PREMIUM"
+    }
   }
 }
-`, instance)
-}
-
-func testAccComputeInstance_resourceManagerTags(context map[string]interface{}) string {
-	return acctest.Nprintf(`
-resource "google_tags_tag_key" "key" {
-  parent = "projects/%{project}"
-  short_name = "foobarbaz%{random_suffix}"
-  description = "For foo/bar resources."
-}
-
-resource "google_tags_tag_value" "value" {
-  parent = "tagKeys/${google_tags_tag_key.key.name}"
-  short_name = "foo%{random_suffix}"
-  description = "For foo resources."
+`, instance, instance, instance, instance)
 }
 
+func testAccComputeInstance_PTRRecord(record, instance string) string {
+	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
 resource "google_compute_instance" "foobar" {
-  name           = "%{instance_name}"
-  machine_type   = "e2-medium"
-  zone           = "us-central1-a"
-  can_ip_forward = false
-  tags           = ["tag-key", "tag-value"]
+  name         = "%s"
+  machine_type = "e2-medium"
+  zone         = "us-central1-a"
+  tags         = ["foo", "bar"]
 
   boot_disk {
     initialize_params {
       image = data.google_compute_image.my_image.self_link
-      resource_manager_tags = {
-        "tagKeys/${google_tags_tag_key.key.name}" = "tagValues/${google_tags_tag_value.value.name}"
-      }
-    }
-  }
-
-  params {
-    resource_manager_tags = {
-      "tagKeys/${google_tags_tag_key.key.name}" = "tagValues/${google_tags_tag_value.value.name}"
     }
   }
 
   network_interface {
     network = "default"
+    access_config {
+      public_ptr_domain_name = "%s.gcp.tfacc.hashicorptest.com."
+    }
   }
 
   metadata = {
     foo = "bar"
   }
 }
-`, context)
+`, instance, record)
 }
 
-func testAccComputeInstance_basic_deletionProtectionFalse(instance string) string {
+func testAccComputeInstance_networkTier(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
@@ -3553,12 +4464,9 @@ data "google_compute_image" "my_image" {
 }
 
 resource "google_compute_instance" "foobar" {
-  name                = "%s"
-  machine_type        = "e2-medium"
-  zone                = "us-central1-a"
-  can_ip_forward      = false
-  tags                = ["foo", "bar"]
-  deletion_protection = false
+  name         = "%s"
+  machine_type = "e2-medium"
+  zone         = "us-central1-a"
 
   boot_disk {
     initialize_params {
@@ -3568,302 +4476,412 @@ resource "google_compute_instance" "foobar" {
 
   network_interface {
     network = "default"
+    access_config {
+      network_tier = "STANDARD"
+    }
   }
 }
 `, instance)
 }
 
-func testAccComputeInstance_basic_deletionProtectionTrue(instance string) string {
+func testAccComputeInstance_disks_encryption(bootEncryptionKey string, diskNameToEncryptionKey map[string]*compute.CustomerEncryptionKey, instance, suffix string) string {
+	diskNames := []string{}
+	for k := range diskNameToEncryptionKey {
+		diskNames = append(diskNames, k)
+	}
+	sort.Strings(diskNames)
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
-resource "google_compute_instance" "foobar" {
-  name                = "%s"
-  machine_type        = "e2-medium"
-  zone                = "us-central1-a"
-  can_ip_forward      = false
-  tags                = ["foo", "bar"]
-  deletion_protection = true
+resource "google_compute_disk" "foobar" {
+  name = "%s"
+  size = 10
+  type = "pd-ssd"
+  zone = "us-central1-a"
 
-  boot_disk {
-    initialize_params {
-      image = data.google_compute_image.my_image.self_link
-    }
+  disk_encryption_key {
+    raw_key = "%s"
   }
+}
 
-  network_interface {
-    network = "default"
+resource "google_compute_disk" "foobar2" {
+  name = "%s"
+  size = 10
+  type = "pd-ssd"
+  zone = "us-central1-a"
+
+  disk_encryption_key {
+    raw_key = "%s"
   }
 }
-`, instance)
+
+resource "google_compute_disk" "foobar3" {
+  name = "%s"
+  size = 10
+  type = "pd-ssd"
+  zone = "us-central1-a"
+
+  disk_encryption_key {
+    raw_key = "%s"
+  }
 }
 
-// Update zone to ForceNew, and change metadata k/v entirely
-// Generates diff mismatch
-func testAccComputeInstance_forceNewAndChangeMetadata(instance string) string {
-	return fmt.Sprintf(`
-data "google_compute_image" "my_image" {
-  family  = "debian-11"
-  project = "debian-cloud"
+resource "google_compute_disk" "foobar4" {
+  name = "%s"
+  size = 10
+  type = "pd-ssd"
+  zone = "us-central1-a"
 }
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
-  zone         = "us-central1-b"
-  tags         = ["baz"]
+  zone         = "us-central1-a"
 
   boot_disk {
     initialize_params {
       image = data.google_compute_image.my_image.self_link
     }
+    disk_encryption_key_raw = "%s"
+  }
+
+  attached_disk {
+    source                  = google_compute_disk.foobar.self_link
+    disk_encryption_key_raw = "%s"
+  }
+
+  attached_disk {
+    source                  = google_compute_disk.foobar2.self_link
+    disk_encryption_key_raw = "%s"
+  }
+
+  attached_disk {
+    source = google_compute_disk.foobar4.self_link
+  }
+
+  attached_disk {
+    source                  = google_compute_disk.foobar3.self_link
+    disk_encryption_key_raw = "%s"
   }
 
   network_interface {
     network = "default"
-    access_config {
-    }
   }
 
   metadata = {
-    qux = "true"
+    foo = "bar"
   }
+
+  allow_stopping_for_update = true
 }
-`, instance)
+`, diskNames[0], diskNameToEncryptionKey[diskNames[0]].RawKey,
+		diskNames[1], diskNameToEncryptionKey[diskNames[1]].RawKey,
+		diskNames[2], diskNameToEncryptionKey[diskNames[2]].RawKey,
+		"tf-testd-"+suffix,
+		instance, bootEncryptionKey,
+		diskNameToEncryptionKey[diskNames[0]].RawKey, diskNameToEncryptionKey[diskNames[1]].RawKey, diskNameToEncryptionKey[diskNames[2]].RawKey)
 }
 
-// Update metadata, tags, and network_interface
-func testAccComputeInstance_update(instance string) string {
+func testAccComputeInstance_disks_encryption_restart(bootEncryptionKey string, diskNameToEncryptionKey map[string]*compute.CustomerEncryptionKey, instance string) string {
+	diskNames := []string{}
+	for k := range diskNameToEncryptionKey {
+		diskNames = append(diskNames, k)
+	}
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
-resource "google_compute_instance" "foobar" {
-  name           = "%s"
-  machine_type   = "e2-medium"
-  zone           = "us-central1-a"
-  can_ip_forward = true
-  tags           = ["baz"]
+resource "google_compute_disk" "foobar" {
+  name = "%s"
+  size = 10
+  type = "pd-ssd"
+  zone = "us-central1-a"
+
+  disk_encryption_key {
+    raw_key = "%s"
+  }
+}
+
+resource "google_compute_instance" "foobar" {
+  name         = "%s"
+  machine_type = "e2-medium"
+  zone         = "us-central1-a"
 
   boot_disk {
     initialize_params {
       image = data.google_compute_image.my_image.self_link
     }
+    disk_encryption_key_raw = "%s"
+  }
+
+  attached_disk {
+    source                  = google_compute_disk.foobar.self_link
+    disk_encryption_key_raw = "%s"
   }
 
   network_interface {
     network = "default"
-    access_config {
-    }
   }
 
   metadata = {
-    bar            = "baz"
-    startup-script = "echo Hello"
+    foo = "bar"
   }
 
-  labels = {
-    only_me = "nothing_else"
-  }
+  allow_stopping_for_update = true
 }
-`, instance)
+`, diskNames[0], diskNameToEncryptionKey[diskNames[0]].RawKey,
+		instance, bootEncryptionKey,
+		diskNameToEncryptionKey[diskNames[0]].RawKey)
 }
 
-func testAccComputeInstance_ip(ip, instance string) string {
+func testAccComputeInstance_disks_encryption_restartUpdate(bootEncryptionKey string, diskNameToEncryptionKey map[string]*compute.CustomerEncryptionKey, instance string) string {
+	diskNames := []string{}
+	for k := range diskNameToEncryptionKey {
+		diskNames = append(diskNames, k)
+	}
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
-resource "google_compute_address" "foo" {
+resource "google_compute_disk" "foobar" {
   name = "%s"
+  size = 10
+  type = "pd-ssd"
+  zone = "us-central1-a"
+
+  disk_encryption_key {
+    raw_key = "%s"
+  }
 }
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
-  machine_type = "e2-medium"
+  machine_type = "e2-standard-2"
   zone         = "us-central1-a"
-  tags         = ["foo", "bar"]
 
   boot_disk {
     initialize_params {
       image = data.google_compute_image.my_image.self_link
     }
+    disk_encryption_key_raw = "%s"
+  }
+
+  attached_disk {
+    source                  = google_compute_disk.foobar.self_link
+    disk_encryption_key_raw = "%s"
   }
 
   network_interface {
     network = "default"
-    access_config {
-      nat_ip = google_compute_address.foo.address
-    }
   }
 
   metadata = {
     foo = "bar"
   }
+
+  allow_stopping_for_update = true
 }
-`, ip, instance)
+`, diskNames[0], diskNameToEncryptionKey[diskNames[0]].RawKey,
+		instance, bootEncryptionKey,
+		diskNameToEncryptionKey[diskNames[0]].RawKey)
 }
 
-func testAccComputeInstance_ipv6(ip, instance, record string) string {
+func testAccComputeInstance_disks_kms(bootEncryptionKey string, diskNameToEncryptionKey map[string]*compute.CustomerEncryptionKey, instance, suffix string) string {
+	diskNames := []string{}
+	for k := range diskNameToEncryptionKey {
+		diskNames = append(diskNames, k)
+	}
+	sort.Strings(diskNames)
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
-resource "google_compute_subnetwork" "subnetwork-ipv6" {
-  name          = "%s-subnetwork"
+resource "google_compute_disk" "foobar" {
+  name = "%s"
+  size = 10
+  type = "pd-ssd"
+  zone = "us-central1-a"
 
-  ip_cidr_range = "10.0.0.0/22"
-  region        = "us-west2"
+  disk_encryption_key {
+    kms_key_self_link = "%s"
+  }
+}
 
-  stack_type       = "IPV4_IPV6"
-  ipv6_access_type = "EXTERNAL"
+resource "google_compute_disk" "foobar2" {
+  name = "%s"
+  size = 10
+  type = "pd-ssd"
+  zone = "us-central1-a"
 
-  network       = google_compute_network.custom-test.id
+  disk_encryption_key {
+    kms_key_self_link = "%s"
+  }
 }
 
-resource "google_compute_network" "custom-test" {
-  name                    = "%s-network"
-  auto_create_subnetworks = false
+resource "google_compute_disk" "foobar3" {
+  name = "%s"
+  size = 10
+  type = "pd-ssd"
+  zone = "us-central1-a"
+
+  disk_encryption_key {
+    kms_key_self_link = "%s"
+  }
 }
 
-resource "google_compute_address" "foo" {
+resource "google_compute_disk" "foobar4" {
   name = "%s"
+  size = 10
+  type = "pd-ssd"
+  zone = "us-central1-a"
 }
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
-  zone         = "us-west2-a"
-  tags         = ["foo", "bar"]
+  zone         = "us-central1-a"
 
   boot_disk {
     initialize_params {
       image = data.google_compute_image.my_image.self_link
     }
+    kms_key_self_link = "%s"
+  }
+
+  attached_disk {
+    source            = google_compute_disk.foobar.self_link
+    kms_key_self_link = "%s"
+  }
+
+  attached_disk {
+    source            = google_compute_disk.foobar2.self_link
+    kms_key_self_link = "%s"
+  }
+
+  attached_disk {
+    source = google_compute_disk.foobar4.self_link
+  }
+
+  attached_disk {
+    source = google_compute_disk.foobar3.self_link
   }
 
   network_interface {
-    subnetwork = google_compute_subnetwork.subnetwork-ipv6.name
-    stack_type = "IPV4_IPV6"
-    ipv6_access_config {
-      network_tier = "PREMIUM"
-      public_ptr_domain_name = "%s.gcp.tfacc.hashicorptest.com."
-    }
+    network = "default"
   }
 
   metadata = {
     foo = "bar"
   }
 }
-`, instance, instance, ip, instance, record)
+`, diskNames[0], diskNameToEncryptionKey[diskNames[0]].KmsKeyName,
+		diskNames[1], diskNameToEncryptionKey[diskNames[1]].KmsKeyName,
+		diskNames[2], diskNameToEncryptionKey[diskNames[2]].KmsKeyName,
+		"tf-testd-"+suffix,
+		instance, bootEncryptionKey,
+		diskNameToEncryptionKey[diskNames[0]].KmsKeyName, diskNameToEncryptionKey[diskNames[1]].KmsKeyName)
 }
 
-func testAccComputeInstance_internalIpv6(ip, instance string) string {
-  return fmt.Sprintf(`
-  data "google_compute_image" "my_image" {
-    family  = "debian-11"
-    project = "debian-cloud"
-  }
-
-  resource "google_compute_subnetwork" "subnetwork_ipv6" {
-    name          = "%s-subnetwork"
-
-    ip_cidr_range = "10.0.0.0/22"
-    region        = "us-west2"
+func testAccComputeInstance_instanceSchedule(instance, schedule string) string {
+	return fmt.Sprintf(`
+data "google_compute_image" "my_image" {
+  family  = "debian-11"
+  project = "debian-cloud"
+}
 
-    stack_type       = "IPV4_IPV6"
-    ipv6_access_type = "INTERNAL"
+resource "google_compute_instance" "foobar" {
+  name         = "%s"
+  machine_type = "e2-medium"
+  zone         = "us-central1-a"
 
-    network       = google_compute_network.custom-test.id
+  boot_disk {
+    initialize_params {
+      image = data.google_compute_image.my_image.self_link
+    }
   }
 
-  resource "google_compute_network" "custom-test" {
-    name                     = "%s-network"
-    enable_ula_internal_ipv6 = true
-    auto_create_subnetworks  = false
+  network_interface {
+    network = "default"
   }
+}
 
-  resource "google_compute_address" "ipv6" {
-    name         = "%s"
-    region       = "us-west2"
-    address_type = "INTERNAL"
-    purpose      = "GCE_ENDPOINT"
-    subnetwork   = google_compute_subnetwork.subnetwork_ipv6.id
-    ip_version   = "IPV6"
+resource "google_compute_resource_policy" "instance_schedule" {
+  name        = "%s"
+  region      = "us-central1"
+  instance_schedule_policy {
+    vm_start_schedule {
+      schedule = "1 1 1 1 1"
+    }
+    vm_stop_schedule {
+      schedule = "2 2 2 2 2"
+    }
+    time_zone = "UTC"
   }
+}
+`, instance, schedule)
+}
 
-  resource "google_compute_instance" "foobar" {
-    name         = "%s"
-    machine_type = "e2-medium"
-    zone         = "us-west2-a"
-    tags         = ["foo", "bar"]
+func testAccComputeInstance_addResourcePolicy(instance, schedule string) string {
+	return fmt.Sprintf(`
+data "google_compute_image" "my_image" {
+  family  = "debian-11"
+  project = "debian-cloud"
+}
 
-    boot_disk {
-      initialize_params {
-        image = data.google_compute_image.my_image.self_link
-      }
-    }
+resource "google_compute_instance" "foobar" {
+  name         = "%s"
+  machine_type = "e2-medium"
+  zone         = "us-central1-a"
 
-    network_interface {
-      subnetwork = google_compute_subnetwork.subnetwork_ipv6.name
-      stack_type = "IPV4_IPV6"
-      ipv6_address = google_compute_address.ipv6.address
+  boot_disk {
+    initialize_params {
+      image = data.google_compute_image.my_image.self_link
     }
+  }
 
-    metadata = {
-      foo = "bar"
-    }
+  network_interface {
+    network = "default"
   }
-  `, instance, instance, ip, instance)
+
+  resource_policies = [google_compute_resource_policy.instance_schedule.self_link]
 }
 
-func testAccComputeInstance_ipv6ExternalReservation(instance string) string {
-	return fmt.Sprintf(`
-resource "google_compute_address" "ipv6-address" {
-  region             = "us-west2"
-  name               = "%s-address"
-  address_type       = "EXTERNAL"
-  ip_version         = "IPV6"
-  network_tier       = "PREMIUM"
-  ipv6_endpoint_type = "VM"
-  subnetwork         = google_compute_subnetwork.subnetwork-ipv6.name
+resource "google_compute_resource_policy" "instance_schedule" {
+  name        = "%s"
+  region      = "us-central1"
+  instance_schedule_policy {
+    vm_start_schedule {
+      schedule = "1 1 1 1 1"
+    }
+    vm_stop_schedule {
+      schedule = "2 2 2 2 2"
+    }
+    time_zone = "UTC"
+  }
+}
+`, instance, schedule)
 }
 
+func testAccComputeInstance_updateResourcePolicy(instance, schedule1, schedule2 string) string {
+	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
-resource "google_compute_subnetwork" "subnetwork-ipv6" {
-  name          = "%s-subnetwork"
-
-  ip_cidr_range = "10.0.0.0/22"
-  region        = "us-west2"
-
-  stack_type       = "IPV4_IPV6"
-  ipv6_access_type = "EXTERNAL"
-
-  network       = google_compute_network.custom-test.id
-}
-
-resource "google_compute_network" "custom-test" {
-  name                    = "%s-network"
-  auto_create_subnetworks = false
-}
-
 resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
-  zone         = "us-west2-a"
+  zone         = "us-central1-a"
 
   boot_disk {
     initialize_params {
@@ -3872,20 +4890,43 @@ resource "google_compute_instance" "foobar" {
   }
 
   network_interface {
-    subnetwork                    = google_compute_subnetwork.subnetwork-ipv6.name
-    stack_type                    = "IPV4_IPV6"
-    ipv6_access_config {
-      external_ipv6               = google_compute_address.ipv6-address.address
-      external_ipv6_prefix_length = 96
-      name                        = "external-ipv6-access-config"
-      network_tier                = "PREMIUM"
+    network = "default"
+  }
+
+  resource_policies = [google_compute_resource_policy.instance_schedule2.self_link]
+}
+
+resource "google_compute_resource_policy" "instance_schedule" {
+  name        = "%s"
+  region      = "us-central1"
+  instance_schedule_policy {
+    vm_start_schedule {
+      schedule = "1 1 1 1 1"
+    }
+    vm_stop_schedule {
+      schedule = "2 2 2 2 2"
     }
+    time_zone = "UTC"
   }
 }
-`, instance, instance, instance, instance)
+
+resource "google_compute_resource_policy" "instance_schedule2" {
+  name        = "%s"
+  region      = "us-central1"
+  instance_schedule_policy {
+    vm_start_schedule {
+      schedule = "2 2 2 2 2"
+    }
+    vm_stop_schedule {
+      schedule = "3 3 3 3 3"
+    }
+    time_zone = "UTC"
+  }
+}
+`, instance, schedule1, schedule2)
 }
 
-func testAccComputeInstance_PTRRecord(record, instance string) string {
+func testAccComputeInstance_removeResourcePolicy(instance, schedule1, schedule2 string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
@@ -3896,7 +4937,6 @@ resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
   zone         = "us-central1-a"
-  tags         = ["foo", "bar"]
 
   boot_disk {
     initialize_params {
@@ -3906,25 +4946,55 @@ resource "google_compute_instance" "foobar" {
 
   network_interface {
     network = "default"
-    access_config {
-      public_ptr_domain_name = "%s.gcp.tfacc.hashicorptest.com."
+  }
+
+  resource_policies = null
+}
+
+resource "google_compute_resource_policy" "instance_schedule" {
+  name        = "%s"
+  region      = "us-central1"
+  instance_schedule_policy {
+    vm_start_schedule {
+      schedule = "1 1 1 1 1"
+    }
+    vm_stop_schedule {
+      schedule = "2 2 2 2 2"
     }
+    time_zone = "UTC"
   }
+}
 
-  metadata = {
-    foo = "bar"
+resource "google_compute_resource_policy" "instance_schedule2" {
+  name        = "%s"
+  region      = "us-central1"
+  instance_schedule_policy {
+    vm_start_schedule {
+      schedule = "2 2 2 2 2"
+    }
+    vm_stop_schedule {
+      schedule = "3 3 3 3 3"
+    }
+    time_zone = "UTC"
   }
 }
-`, instance, record)
+`, instance, schedule1, schedule2)
 }
 
-func testAccComputeInstance_networkTier(instance string) string {
+func testAccComputeInstance_attachedDisk(disk, instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
+resource "google_compute_disk" "foobar" {
+  name = "%s"
+  size = 10
+  type = "pd-ssd"
+  zone = "us-central1-a"
+}
+
 resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
@@ -3936,22 +5006,18 @@ resource "google_compute_instance" "foobar" {
     }
   }
 
+  attached_disk {
+    source = google_compute_disk.foobar.name
+  }
+
   network_interface {
     network = "default"
-    access_config {
-      network_tier = "STANDARD"
-    }
   }
 }
-`, instance)
+`, disk, instance)
 }
 
-func testAccComputeInstance_disks_encryption(bootEncryptionKey string, diskNameToEncryptionKey map[string]*compute.CustomerEncryptionKey, instance, suffix string) string {
-	diskNames := []string{}
-	for k := range diskNameToEncryptionKey {
-		diskNames = append(diskNames, k)
-	}
-	sort.Strings(diskNames)
+func testAccComputeInstance_attachedDisk_sourceUrl(disk, instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
@@ -3963,35 +5029,82 @@ resource "google_compute_disk" "foobar" {
   size = 10
   type = "pd-ssd"
   zone = "us-central1-a"
+}
 
-  disk_encryption_key {
-    raw_key = "%s"
+resource "google_compute_instance" "foobar" {
+  name         = "%s"
+  machine_type = "e2-medium"
+  zone         = "us-central1-a"
+
+  boot_disk {
+    initialize_params {
+      image = data.google_compute_image.my_image.self_link
+    }
+  }
+
+  attached_disk {
+    source = google_compute_disk.foobar.self_link
+  }
+
+  network_interface {
+    network = "default"
   }
 }
+`, disk, instance)
+}
 
-resource "google_compute_disk" "foobar2" {
+func testAccComputeInstance_attachedDisk_modeRo(disk, instance string) string {
+	return fmt.Sprintf(`
+data "google_compute_image" "my_image" {
+  family  = "debian-11"
+  project = "debian-cloud"
+}
+
+resource "google_compute_disk" "foobar" {
   name = "%s"
   size = 10
   type = "pd-ssd"
   zone = "us-central1-a"
+}
 
-  disk_encryption_key {
-    raw_key = "%s"
+resource "google_compute_instance" "foobar" {
+  name         = "%s"
+  machine_type = "e2-medium"
+  zone         = "us-central1-a"
+
+  boot_disk {
+    initialize_params {
+      image = data.google_compute_image.my_image.self_link
+    }
+  }
+
+  attached_disk {
+    source = google_compute_disk.foobar.self_link
+    mode   = "READ_ONLY"
+  }
+
+  network_interface {
+    network = "default"
   }
 }
+`, disk, instance)
+}
 
-resource "google_compute_disk" "foobar3" {
+func testAccComputeInstance_addAttachedDisk(disk, disk2, instance string) string {
+	return fmt.Sprintf(`
+data "google_compute_image" "my_image" {
+  family  = "debian-11"
+  project = "debian-cloud"
+}
+
+resource "google_compute_disk" "foobar" {
   name = "%s"
   size = 10
   type = "pd-ssd"
   zone = "us-central1-a"
-
-  disk_encryption_key {
-    raw_key = "%s"
-  }
 }
 
-resource "google_compute_disk" "foobar4" {
+resource "google_compute_disk" "foobar2" {
   name = "%s"
   size = 10
   type = "pd-ssd"
@@ -4007,51 +5120,24 @@ resource "google_compute_instance" "foobar" {
     initialize_params {
       image = data.google_compute_image.my_image.self_link
     }
-    disk_encryption_key_raw = "%s"
-  }
-
-  attached_disk {
-    source                  = google_compute_disk.foobar.self_link
-    disk_encryption_key_raw = "%s"
-  }
-
-  attached_disk {
-    source                  = google_compute_disk.foobar2.self_link
-    disk_encryption_key_raw = "%s"
   }
 
   attached_disk {
-    source = google_compute_disk.foobar4.self_link
+    source = google_compute_disk.foobar.name
   }
 
   attached_disk {
-    source                  = google_compute_disk.foobar3.self_link
-    disk_encryption_key_raw = "%s"
+    source = google_compute_disk.foobar2.self_link
   }
 
   network_interface {
     network = "default"
   }
-
-  metadata = {
-    foo = "bar"
-  }
-
-  allow_stopping_for_update = true
 }
-`, diskNames[0], diskNameToEncryptionKey[diskNames[0]].RawKey,
-		diskNames[1], diskNameToEncryptionKey[diskNames[1]].RawKey,
-		diskNames[2], diskNameToEncryptionKey[diskNames[2]].RawKey,
-		"tf-testd-"+suffix,
-		instance, bootEncryptionKey,
-		diskNameToEncryptionKey[diskNames[0]].RawKey, diskNameToEncryptionKey[diskNames[1]].RawKey, diskNameToEncryptionKey[diskNames[2]].RawKey)
+`, disk, disk2, instance)
 }
 
-func testAccComputeInstance_disks_encryption_restart(bootEncryptionKey string, diskNameToEncryptionKey map[string]*compute.CustomerEncryptionKey, instance string) string {
-	diskNames := []string{}
-	for k := range diskNameToEncryptionKey {
-		diskNames = append(diskNames, k)
-	}
+func testAccComputeInstance_detachDisk(disk, disk2, instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
@@ -4063,10 +5149,13 @@ resource "google_compute_disk" "foobar" {
   size = 10
   type = "pd-ssd"
   zone = "us-central1-a"
+}
 
-  disk_encryption_key {
-    raw_key = "%s"
-  }
+resource "google_compute_disk" "foobar2" {
+  name = "%s"
+  size = 10
+  type = "pd-ssd"
+  zone = "us-central1-a"
 }
 
 resource "google_compute_instance" "foobar" {
@@ -4078,34 +5167,20 @@ resource "google_compute_instance" "foobar" {
     initialize_params {
       image = data.google_compute_image.my_image.self_link
     }
-    disk_encryption_key_raw = "%s"
   }
 
   attached_disk {
-    source                  = google_compute_disk.foobar.self_link
-    disk_encryption_key_raw = "%s"
+    source = google_compute_disk.foobar.name
   }
 
   network_interface {
     network = "default"
   }
-
-  metadata = {
-    foo = "bar"
-  }
-
-  allow_stopping_for_update = true
-}
-`, diskNames[0], diskNameToEncryptionKey[diskNames[0]].RawKey,
-		instance, bootEncryptionKey,
-		diskNameToEncryptionKey[diskNames[0]].RawKey)
 }
-
-func testAccComputeInstance_disks_encryption_restartUpdate(bootEncryptionKey string, diskNameToEncryptionKey map[string]*compute.CustomerEncryptionKey, instance string) string {
-	diskNames := []string{}
-	for k := range diskNameToEncryptionKey {
-		diskNames = append(diskNames, k)
-	}
+`, disk, disk2, instance)
+}
+
+func testAccComputeInstance_updateAttachedDiskEncryptionKey(disk, instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
@@ -4117,50 +5192,35 @@ resource "google_compute_disk" "foobar" {
   size = 10
   type = "pd-ssd"
   zone = "us-central1-a"
-
   disk_encryption_key {
-    raw_key = "%s"
+    raw_key = "c2Vjb25kNzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI"
   }
 }
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
-  machine_type = "e2-standard-2"
+  machine_type = "e2-medium"
   zone         = "us-central1-a"
 
   boot_disk {
     initialize_params {
       image = data.google_compute_image.my_image.self_link
     }
-    disk_encryption_key_raw = "%s"
   }
 
   attached_disk {
-    source                  = google_compute_disk.foobar.self_link
-    disk_encryption_key_raw = "%s"
+    source                  = google_compute_disk.foobar.name
+    disk_encryption_key_raw = "c2Vjb25kNzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI"
   }
 
   network_interface {
     network = "default"
   }
-
-  metadata = {
-    foo = "bar"
-  }
-
-  allow_stopping_for_update = true
 }
-`, diskNames[0], diskNameToEncryptionKey[diskNames[0]].RawKey,
-		instance, bootEncryptionKey,
-		diskNameToEncryptionKey[diskNames[0]].RawKey)
+`, disk, instance)
 }
 
-func testAccComputeInstance_disks_kms(bootEncryptionKey string, diskNameToEncryptionKey map[string]*compute.CustomerEncryptionKey, instance, suffix string) string {
-	diskNames := []string{}
-	for k := range diskNameToEncryptionKey {
-		diskNames = append(diskNames, k)
-	}
-	sort.Strings(diskNames)
+func testAccComputeInstance_bootDisk_source(disk, instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
@@ -4168,43 +5228,38 @@ data "google_compute_image" "my_image" {
 }
 
 resource "google_compute_disk" "foobar" {
-  name = "%s"
-  size = 10
-  type = "pd-ssd"
-  zone = "us-central1-a"
-
-  disk_encryption_key {
-    kms_key_self_link = "%s"
-  }
+  name  = "%s"
+  zone  = "us-central1-a"
+  image = data.google_compute_image.my_image.self_link
 }
 
-resource "google_compute_disk" "foobar2" {
-  name = "%s"
-  size = 10
-  type = "pd-ssd"
-  zone = "us-central1-a"
+resource "google_compute_instance" "foobar" {
+  name         = "%s"
+  machine_type = "e2-medium"
+  zone         = "us-central1-a"
 
-  disk_encryption_key {
-    kms_key_self_link = "%s"
+  boot_disk {
+    source = google_compute_disk.foobar.name
   }
-}
 
-resource "google_compute_disk" "foobar3" {
-  name = "%s"
-  size = 10
-  type = "pd-ssd"
-  zone = "us-central1-a"
-
-  disk_encryption_key {
-    kms_key_self_link = "%s"
+  network_interface {
+    network = "default"
   }
 }
+`, disk, instance)
+}
 
-resource "google_compute_disk" "foobar4" {
-  name = "%s"
-  size = 10
-  type = "pd-ssd"
-  zone = "us-central1-a"
+func testAccComputeInstance_bootDisk_sourceUrl(disk, instance string) string {
+	return fmt.Sprintf(`
+data "google_compute_image" "my_image" {
+  family  = "debian-11"
+  project = "debian-cloud"
+}
+
+resource "google_compute_disk" "foobar" {
+  name  = "%s"
+  zone  = "us-central1-a"
+  image = data.google_compute_image.my_image.self_link
 }
 
 resource "google_compute_instance" "foobar" {
@@ -4213,47 +5268,17 @@ resource "google_compute_instance" "foobar" {
   zone         = "us-central1-a"
 
   boot_disk {
-    initialize_params {
-      image = data.google_compute_image.my_image.self_link
-    }
-    kms_key_self_link = "%s"
-  }
-
-  attached_disk {
-    source            = google_compute_disk.foobar.self_link
-    kms_key_self_link = "%s"
-  }
-
-  attached_disk {
-    source            = google_compute_disk.foobar2.self_link
-    kms_key_self_link = "%s"
-  }
-
-  attached_disk {
-    source = google_compute_disk.foobar4.self_link
-  }
-
-  attached_disk {
-    source = google_compute_disk.foobar3.self_link
+    source = google_compute_disk.foobar.self_link
   }
 
   network_interface {
     network = "default"
   }
-
-  metadata = {
-    foo = "bar"
-  }
 }
-`, diskNames[0], diskNameToEncryptionKey[diskNames[0]].KmsKeyName,
-		diskNames[1], diskNameToEncryptionKey[diskNames[1]].KmsKeyName,
-		diskNames[2], diskNameToEncryptionKey[diskNames[2]].KmsKeyName,
-		"tf-testd-"+suffix,
-		instance, bootEncryptionKey,
-		diskNameToEncryptionKey[diskNames[0]].KmsKeyName, diskNameToEncryptionKey[diskNames[1]].KmsKeyName)
+`, disk, instance)
 }
 
-func testAccComputeInstance_instanceSchedule(instance, schedule string) string {
+func testAccComputeInstance_bootDisk_type(instance string, diskType string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
@@ -4268,6 +5293,7 @@ resource "google_compute_instance" "foobar" {
   boot_disk {
     initialize_params {
       image = data.google_compute_image.my_image.self_link
+      type  = "%s"
     }
   }
 
@@ -4275,24 +5301,10 @@ resource "google_compute_instance" "foobar" {
     network = "default"
   }
 }
-
-resource "google_compute_resource_policy" "instance_schedule" {
-  name        = "%s"
-  region      = "us-central1"
-  instance_schedule_policy {
-    vm_start_schedule {
-      schedule = "1 1 1 1 1"
-    }
-    vm_stop_schedule {
-      schedule = "2 2 2 2 2"
-    }
-    time_zone = "UTC"
-  }
-}
-`, instance, schedule)
+`, instance, diskType)
 }
 
-func testAccComputeInstance_addResourcePolicy(instance, schedule string) string {
+func testAccComputeInstance_bootDisk_mode(instance string, diskMode string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
@@ -4307,33 +5319,20 @@ resource "google_compute_instance" "foobar" {
   boot_disk {
     initialize_params {
       image = data.google_compute_image.my_image.self_link
+      type  = "pd-ssd"
     }
+
+    mode = "%s"
   }
 
   network_interface {
     network = "default"
   }
-
-  resource_policies = [google_compute_resource_policy.instance_schedule.self_link]
-}
-
-resource "google_compute_resource_policy" "instance_schedule" {
-  name        = "%s"
-  region      = "us-central1"
-  instance_schedule_policy {
-    vm_start_schedule {
-      schedule = "1 1 1 1 1"
-    }
-    vm_stop_schedule {
-      schedule = "2 2 2 2 2"
-    }
-    time_zone = "UTC"
-  }
 }
-`, instance, schedule)
+`, instance, diskMode)
 }
 
-func testAccComputeInstance_updateResourcePolicy(instance, schedule1, schedule2 string) string {
+func testAccComputeInstance_with375GbScratchDisk(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
@@ -4342,7 +5341,7 @@ data "google_compute_image" "my_image" {
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
-  machine_type = "e2-medium"
+  machine_type = "n1-standard-1"   // can't be e2 because of local-ssd
   zone         = "us-central1-a"
 
   boot_disk {
@@ -4351,44 +5350,32 @@ resource "google_compute_instance" "foobar" {
     }
   }
 
-  network_interface {
-    network = "default"
+  scratch_disk {
+    interface = "NVME"
   }
 
-  resource_policies = [google_compute_resource_policy.instance_schedule2.self_link]
-}
+  scratch_disk {
+    interface = "SCSI"
+  }
 
-resource "google_compute_resource_policy" "instance_schedule" {
-  name        = "%s"
-  region      = "us-central1"
-  instance_schedule_policy {
-    vm_start_schedule {
-      schedule = "1 1 1 1 1"
-    }
-    vm_stop_schedule {
-      schedule = "2 2 2 2 2"
-    }
-    time_zone = "UTC"
+  scratch_disk {
+    interface   = "NVME"
+	device_name = "nvme-local-ssd"
   }
-}
 
-resource "google_compute_resource_policy" "instance_schedule2" {
-  name        = "%s"
-  region      = "us-central1"
-  instance_schedule_policy {
-    vm_start_schedule {
-      schedule = "2 2 2 2 2"
-    }
-    vm_stop_schedule {
-      schedule = "3 3 3 3 3"
-    }
-    time_zone = "UTC"
+  scratch_disk {
+    interface   = "SCSI"
+	device_name = "scsi-local-ssd"
+  }
+
+  network_interface {
+    network = "default"
   }
 }
-`, instance, schedule1, schedule2)
+`, instance)
 }
 
-func testAccComputeInstance_removeResourcePolicy(instance, schedule1, schedule2 string) string {
+func testAccComputeInstance_with18TbScratchDisk(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
@@ -4397,7 +5384,7 @@ data "google_compute_image" "my_image" {
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
-  machine_type = "e2-medium"
+  machine_type = "n2-standard-64"   // must be a large n2 to be paired with 18Tb local-ssd
   zone         = "us-central1-a"
 
   boot_disk {
@@ -4406,57 +5393,49 @@ resource "google_compute_instance" "foobar" {
     }
   }
 
-  network_interface {
-    network = "default"
+  scratch_disk {
+    interface = "NVME"
+    size      = 3000
   }
 
-  resource_policies = null
-}
+  scratch_disk {
+    interface = "NVME"
+    size      = 3000
+  }
 
-resource "google_compute_resource_policy" "instance_schedule" {
-  name        = "%s"
-  region      = "us-central1"
-  instance_schedule_policy {
-    vm_start_schedule {
-      schedule = "1 1 1 1 1"
-    }
-    vm_stop_schedule {
-      schedule = "2 2 2 2 2"
-    }
-    time_zone = "UTC"
+  scratch_disk {
+    interface = "NVME"
+    size      = 3000
   }
-}
 
-resource "google_compute_resource_policy" "instance_schedule2" {
-  name        = "%s"
-  region      = "us-central1"
-  instance_schedule_policy {
-    vm_start_schedule {
-      schedule = "2 2 2 2 2"
-    }
-    vm_stop_schedule {
-      schedule = "3 3 3 3 3"
-    }
-    time_zone = "UTC"
+  scratch_disk {
+    interface = "NVME"
+    size      = 3000
+  }
+
+  scratch_disk {
+    interface = "NVME"
+    size      = 3000
+  }
+
+  scratch_disk {
+    interface = "NVME"
+    size      = 3000
   }
-}
-`, instance, schedule1, schedule2)
+
+  network_interface {
+    network = "default"
+  }
+}`, instance)
 }
 
-func testAccComputeInstance_attachedDisk(disk, instance string) string {
+func testAccComputeInstance_serviceAccount(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
-resource "google_compute_disk" "foobar" {
-  name = "%s"
-  size = 10
-  type = "pd-ssd"
-  zone = "us-central1-a"
-}
-
 resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
@@ -4468,31 +5447,28 @@ resource "google_compute_instance" "foobar" {
     }
   }
 
-  attached_disk {
-    source = google_compute_disk.foobar.name
-  }
-
   network_interface {
     network = "default"
   }
+
+  service_account {
+    scopes = [
+      "userinfo-email",
+      "compute-ro",
+      "storage-ro",
+    ]
+  }
 }
-`, disk, instance)
+`, instance)
 }
 
-func testAccComputeInstance_attachedDisk_sourceUrl(disk, instance string) string {
+func testAccComputeInstance_serviceAccount_update0(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
-resource "google_compute_disk" "foobar" {
-  name = "%s"
-  size = 10
-  type = "pd-ssd"
-  zone = "us-central1-a"
-}
-
 resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
@@ -4504,31 +5480,21 @@ resource "google_compute_instance" "foobar" {
     }
   }
 
-  attached_disk {
-    source = google_compute_disk.foobar.self_link
-  }
-
   network_interface {
     network = "default"
   }
+  allow_stopping_for_update = true
 }
-`, disk, instance)
+`, instance)
 }
 
-func testAccComputeInstance_attachedDisk_modeRo(disk, instance string) string {
+func testAccComputeInstance_serviceAccount_update01(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
-resource "google_compute_disk" "foobar" {
-  name = "%s"
-  size = 10
-  type = "pd-ssd"
-  zone = "us-central1-a"
-}
-
 resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
@@ -4540,39 +5506,28 @@ resource "google_compute_instance" "foobar" {
     }
   }
 
-  attached_disk {
-    source = google_compute_disk.foobar.self_link
-    mode   = "READ_ONLY"
-  }
-
   network_interface {
     network = "default"
   }
+
+  service_account {
+    scopes = []
+  }
+  allow_stopping_for_update = true
 }
-`, disk, instance)
+
+data "google_compute_default_service_account" "default" {
+}
+`, instance)
 }
 
-func testAccComputeInstance_addAttachedDisk(disk, disk2, instance string) string {
+func testAccComputeInstance_serviceAccount_update02(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
-resource "google_compute_disk" "foobar" {
-  name = "%s"
-  size = 10
-  type = "pd-ssd"
-  zone = "us-central1-a"
-}
-
-resource "google_compute_disk" "foobar2" {
-  name = "%s"
-  size = 10
-  type = "pd-ssd"
-  zone = "us-central1-a"
-}
-
 resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
@@ -4584,42 +5539,29 @@ resource "google_compute_instance" "foobar" {
     }
   }
 
-  attached_disk {
-    source = google_compute_disk.foobar.name
+  network_interface {
+    network = "default"
   }
 
-  attached_disk {
-    source = google_compute_disk.foobar2.self_link
+  service_account {
+    email = data.google_compute_default_service_account.default.email
+    scopes = []
   }
+  allow_stopping_for_update = true
+}
 
-  network_interface {
-    network = "default"
-  }
+data "google_compute_default_service_account" "default" {
 }
-`, disk, disk2, instance)
+`, instance)
 }
 
-func testAccComputeInstance_detachDisk(disk, disk2, instance string) string {
+func testAccComputeInstance_serviceAccount_update3(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
-resource "google_compute_disk" "foobar" {
-  name = "%s"
-  size = 10
-  type = "pd-ssd"
-  zone = "us-central1-a"
-}
-
-resource "google_compute_disk" "foobar2" {
-  name = "%s"
-  size = 10
-  type = "pd-ssd"
-  zone = "us-central1-a"
-}
-
 resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
@@ -4631,32 +5573,56 @@ resource "google_compute_instance" "foobar" {
     }
   }
 
-  attached_disk {
-    source = google_compute_disk.foobar.name
-  }
-
   network_interface {
     network = "default"
   }
+
+  service_account {
+    scopes = [
+      "userinfo-email",
+      "compute-ro",
+      "storage-ro",
+    ]
+  }
+
+  allow_stopping_for_update = true
 }
-`, disk, disk2, instance)
+`, instance)
 }
 
-func testAccComputeInstance_updateAttachedDiskEncryptionKey(disk, instance string) string {
+func testAccComputeInstance_serviceAccount_update4(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
-
-resource "google_compute_disk" "foobar" {
-  name = "%s"
-  size = 10
-  type = "pd-ssd"
-  zone = "us-central1-a"
-  disk_encryption_key {
-    raw_key = "c2Vjb25kNzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI"
+resource "google_compute_instance" "foobar" {
+  name         = "%s"
+  machine_type = "e2-medium"
+  zone         = "us-central1-a"
+  boot_disk {
+    initialize_params {
+      image = data.google_compute_image.my_image.self_link
+    }
+  }
+  network_interface {
+    network = "default"
+  }
+  service_account {
+    scopes = [
+      "userinfo-email",
+    ]
   }
+  allow_stopping_for_update = true
+}
+`, instance)
+}
+
+func testAccComputeInstance_scheduling(instance string) string {
+	return fmt.Sprintf(`
+data "google_compute_image" "my_image" {
+  family  = "debian-11"
+  project = "debian-cloud"
 }
 
 resource "google_compute_instance" "foobar" {
@@ -4670,109 +5636,119 @@ resource "google_compute_instance" "foobar" {
     }
   }
 
-  attached_disk {
-    source                  = google_compute_disk.foobar.name
-    disk_encryption_key_raw = "c2Vjb25kNzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI"
-  }
-
   network_interface {
     network = "default"
   }
+
+  scheduling {
+    automatic_restart = false
+  }
 }
-`, disk, instance)
+`, instance)
 }
 
-func testAccComputeInstance_bootDisk_source(disk, instance string) string {
+func testAccComputeInstance_schedulingUpdated(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
-resource "google_compute_disk" "foobar" {
-  name  = "%s"
-  zone  = "us-central1-a"
-  image = data.google_compute_image.my_image.self_link
-}
-
 resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
   zone         = "us-central1-a"
 
   boot_disk {
-    source = google_compute_disk.foobar.name
+    initialize_params {
+      image = data.google_compute_image.my_image.self_link
+    }
   }
 
   network_interface {
     network = "default"
   }
+
+  scheduling {
+    automatic_restart = false
+    preemptible       = true
+  }
 }
-`, disk, instance)
+`, instance)
 }
 
-func testAccComputeInstance_bootDisk_sourceUrl(disk, instance string) string {
+func testAccComputeInstance_advancedMachineFeatures(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
-  family  = "debian-11"
+  family  = "debian-10"
   project = "debian-cloud"
 }
 
-resource "google_compute_disk" "foobar" {
-  name  = "%s"
-  zone  = "us-central1-a"
-  image = data.google_compute_image.my_image.self_link
-}
-
 resource "google_compute_instance" "foobar" {
   name         = "%s"
-  machine_type = "e2-medium"
+  machine_type = "n1-standard-2" // Nested Virt isn't supported on E2 and N2Ds https://cloud.google.com/compute/docs/instances/nested-virtualization/overview#restrictions and https://cloud.google.com/compute/docs/instances/disabling-smt#limitations
   zone         = "us-central1-a"
 
   boot_disk {
-    source = google_compute_disk.foobar.self_link
+    initialize_params {
+      image = data.google_compute_image.my_image.self_link
+    }
   }
 
   network_interface {
     network = "default"
   }
+
+  allow_stopping_for_update = true
+
 }
-`, disk, instance)
+`, instance)
 }
 
-func testAccComputeInstance_bootDisk_type(instance string, diskType string) string {
+func testAccComputeInstance_advancedMachineFeaturesUpdated(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
-  family  = "debian-11"
+  family  = "debian-10"
   project = "debian-cloud"
 }
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
-  machine_type = "e2-medium"
+  machine_type = "n1-standard-2" // Nested Virt isn't supported on E2 and N2Ds https://cloud.google.com/compute/docs/instances/nested-virtualization/overview#restrictions and https://cloud.google.com/compute/docs/instances/disabling-smt#limitations
   zone         = "us-central1-a"
 
   boot_disk {
     initialize_params {
       image = data.google_compute_image.my_image.self_link
-      type  = "%s"
     }
   }
 
   network_interface {
     network = "default"
   }
+  advanced_machine_features {
+	threads_per_core = 1
+	enable_nested_virtualization = true
+	visible_core_count = 1
+  }
+  allow_stopping_for_update = true
 }
-`, instance, diskType)
+`, instance)
 }
 
-func testAccComputeInstance_bootDisk_mode(instance string, diskMode string) string {
+func testAccComputeInstance_subnet_auto(suffix, instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
+resource "google_compute_network" "inst-test-network" {
+  name = "tf-test-network-%s"
+
+  auto_create_subnetworks = true
+}
+
 resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
@@ -4781,29 +5757,41 @@ resource "google_compute_instance" "foobar" {
   boot_disk {
     initialize_params {
       image = data.google_compute_image.my_image.self_link
-      type  = "pd-ssd"
     }
-
-    mode = "%s"
   }
 
   network_interface {
-    network = "default"
+    network = google_compute_network.inst-test-network.name
+    access_config {
+    }
   }
 }
-`, instance, diskMode)
+`, suffix, instance)
 }
 
-func testAccComputeInstance_with375GbScratchDisk(instance string) string {
+func testAccComputeInstance_subnet_custom(suffix, instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
+resource "google_compute_network" "inst-test-network" {
+  name = "tf-test-network-%s"
+
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "inst-test-subnetwork" {
+  name          = "inst-test-subnetwork-%s"
+  ip_cidr_range = "10.0.0.0/16"
+  region        = "us-central1"
+  network       = google_compute_network.inst-test-network.self_link
+}
+
 resource "google_compute_instance" "foobar" {
   name         = "%s"
-  machine_type = "n1-standard-1"   // can't be e2 because of local-ssd
+  machine_type = "e2-medium"
   zone         = "us-central1-a"
 
   boot_disk {
@@ -4812,86 +5800,75 @@ resource "google_compute_instance" "foobar" {
     }
   }
 
-  scratch_disk {
-    interface = "NVME"
-  }
-
-  scratch_disk {
-    interface = "SCSI"
-  }
-
   network_interface {
-    network = "default"
+    subnetwork = google_compute_subnetwork.inst-test-subnetwork.self_link
+    access_config {
+    }
   }
 }
-`, instance)
+`, suffix, suffix, instance)
 }
 
-func testAccComputeInstance_with18TbScratchDisk(instance string) string {
+func testAccComputeInstance_subnet_xpn(org, billingId, projectName, instance, suffix string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
-resource "google_compute_instance" "foobar" {
-  name         = "%s"
-  machine_type = "n2-standard-64"   // must be a large n2 to be paired with 18Tb local-ssd
-  zone         = "us-central1-a"
-
-  boot_disk {
-    initialize_params {
-      image = data.google_compute_image.my_image.self_link
-    }
-  }
+resource "google_project" "host_project" {
+  name            = "Test Project XPN Host"
+  project_id      = "%s-host"
+  org_id          = "%s"
+  billing_account = "%s"
+}
 
-  scratch_disk {
-    interface = "NVME"
-    size      = 3000
-  }
+resource "google_project_service" "host_project" {
+  project = google_project.host_project.project_id
+  service = "compute.googleapis.com"
+}
 
-  scratch_disk {
-    interface = "NVME"
-    size      = 3000
-  }
+resource "google_compute_shared_vpc_host_project" "host_project" {
+  project = google_project_service.host_project.project
+}
 
-  scratch_disk {
-    interface = "NVME"
-    size      = 3000
-  }
+resource "google_project" "service_project" {
+  name            = "Test Project XPN Service"
+  project_id      = "%s-service"
+  org_id          = "%s"
+  billing_account = "%s"
+}
 
-  scratch_disk {
-    interface = "NVME"
-    size      = 3000
-  }
+resource "google_project_service" "service_project" {
+  project = google_project.service_project.project_id
+  service = "compute.googleapis.com"
+}
 
-  scratch_disk {
-    interface = "NVME"
-    size      = 3000
-  }
+resource "google_compute_shared_vpc_service_project" "service_project" {
+  host_project    = google_compute_shared_vpc_host_project.host_project.project
+  service_project = google_project_service.service_project.project
+}
 
-  scratch_disk {
-    interface = "NVME"
-    size      = 3000
-  }
+resource "google_compute_network" "inst-test-network" {
+  name    = "tf-test-network-%s"
+  project = google_compute_shared_vpc_host_project.host_project.project
 
-  network_interface {
-    network = "default"
-  }
-}`, instance)
+  auto_create_subnetworks = false
 }
 
-func testAccComputeInstance_serviceAccount(instance string) string {
-	return fmt.Sprintf(`
-data "google_compute_image" "my_image" {
-  family  = "debian-11"
-  project = "debian-cloud"
+resource "google_compute_subnetwork" "inst-test-subnetwork" {
+  name          = "tf-test-subnetwork-%s"
+  ip_cidr_range = "10.0.0.0/16"
+  region        = "us-central1"
+  network       = google_compute_network.inst-test-network.self_link
+  project       = google_compute_shared_vpc_host_project.host_project.project
 }
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
   zone         = "us-central1-a"
+  project      = google_compute_shared_vpc_service_project.service_project.service_project
 
   boot_disk {
     initialize_params {
@@ -4900,27 +5877,33 @@ resource "google_compute_instance" "foobar" {
   }
 
   network_interface {
-    network = "default"
-  }
-
-  service_account {
-    scopes = [
-      "userinfo-email",
-      "compute-ro",
-      "storage-ro",
-    ]
+    subnetwork         = google_compute_subnetwork.inst-test-subnetwork.name
+    subnetwork_project = google_compute_subnetwork.inst-test-subnetwork.project
+    access_config {
+    }
   }
 }
-`, instance)
+`, projectName, org, billingId, projectName, org, billingId, suffix, suffix, instance)
 }
 
-func testAccComputeInstance_serviceAccount_update0(instance string) string {
+func testAccComputeInstance_networkIPAuto(suffix, instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
+resource "google_compute_network" "inst-test-network" {
+  name = "tf-test-network-%s"
+}
+
+resource "google_compute_subnetwork" "inst-test-subnetwork" {
+  name          = "tf-test-subnetwork-%s"
+  ip_cidr_range = "10.0.0.0/16"
+  region        = "us-central1"
+  network       = google_compute_network.inst-test-network.self_link
+}
+
 resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
@@ -4933,20 +5916,32 @@ resource "google_compute_instance" "foobar" {
   }
 
   network_interface {
-    network = "default"
+    subnetwork = google_compute_subnetwork.inst-test-subnetwork.name
+    access_config {
+    }
   }
-  allow_stopping_for_update = true
 }
-`, instance)
+`, suffix, suffix, instance)
 }
 
-func testAccComputeInstance_serviceAccount_update01(instance string) string {
+func testAccComputeInstance_network_ip_custom(suffix, instance, ipAddress string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
+resource "google_compute_network" "inst-test-network" {
+  name = "tf-test-network-%s"
+}
+
+resource "google_compute_subnetwork" "inst-test-subnetwork" {
+  name          = "tf-test-subnetwork-%s"
+  ip_cidr_range = "10.0.0.0/16"
+  region        = "us-central1"
+  network       = google_compute_network.inst-test-network.self_link
+}
+
 resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
@@ -4959,27 +5954,34 @@ resource "google_compute_instance" "foobar" {
   }
 
   network_interface {
-    network = "default"
-  }
-
-  service_account {
-    scopes = []
+    subnetwork = google_compute_subnetwork.inst-test-subnetwork.name
+    network_ip = "%s"
+    access_config {
+    }
   }
-  allow_stopping_for_update = true
 }
-
-data "google_compute_default_service_account" "default" {
-}
-`, instance)
+`, suffix, suffix, instance, ipAddress)
 }
 
-func testAccComputeInstance_serviceAccount_update02(instance string) string {
+func testAccComputeInstance_private_image_family(disk, family, instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
+resource "google_compute_disk" "foobar" {
+  name  = "%s"
+  zone  = "us-central1-a"
+  image = data.google_compute_image.my_image.self_link
+}
+
+resource "google_compute_image" "foobar" {
+  name        = "%s-1"
+  source_disk = google_compute_disk.foobar.self_link
+  family      = "%s"
+}
+
 resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
@@ -4987,7 +5989,7 @@ resource "google_compute_instance" "foobar" {
 
   boot_disk {
     initialize_params {
-      image = data.google_compute_image.my_image.self_link
+      image = google_compute_image.foobar.family
     }
   }
 
@@ -4995,111 +5997,166 @@ resource "google_compute_instance" "foobar" {
     network = "default"
   }
 
-  service_account {
-    email = data.google_compute_default_service_account.default.email
-    scopes = []
+  metadata = {
+    foo = "bar"
   }
-  allow_stopping_for_update = true
-}
-
-data "google_compute_default_service_account" "default" {
 }
-`, instance)
+`, disk, family, family, instance)
 }
 
-func testAccComputeInstance_serviceAccount_update3(instance string) string {
+func testAccComputeInstance_networkPerformanceConfig(disk string, image string, instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
+resource "google_compute_disk" "foobar" {
+  name  = "%s"
+  zone  = "us-central1-a"
+  image = data.google_compute_image.my_image.self_link
+}
+
+resource "google_compute_image" "foobar" {
+  name              = "%s"
+  source_disk       = google_compute_disk.foobar.self_link
+  guest_os_features {
+    type = "GVNIC"
+  }
+  guest_os_features {
+    type = "VIRTIO_SCSI_MULTIQUEUE"
+  }
+  guest_os_features {
+    type = "UEFI_COMPATIBLE"
+  }
+  guest_os_features {
+    type = "SEV_CAPABLE"
+  }
+}
+
 resource "google_compute_instance" "foobar" {
   name         = "%s"
-  machine_type = "e2-medium"
+  machine_type = "n2-standard-2"
   zone         = "us-central1-a"
 
   boot_disk {
     initialize_params {
-      image = data.google_compute_image.my_image.self_link
+      image = google_compute_image.foobar.self_link
     }
   }
 
   network_interface {
     network = "default"
+    access_config {
+      // Ephemeral IP
+    }
   }
 
-  service_account {
-    scopes = [
-      "userinfo-email",
-      "compute-ro",
-      "storage-ro",
-    ]
+  network_performance_config {
+    total_egress_bandwidth_tier = "DEFAULT"
   }
-
-  allow_stopping_for_update = true
 }
-`, instance)
+`, disk, image, instance)
 }
 
-func testAccComputeInstance_serviceAccount_update4(instance string) string {
+func testAccComputeInstance_multiNic(instance, network, subnetwork string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
+
 resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
   zone         = "us-central1-a"
+
   boot_disk {
     initialize_params {
       image = data.google_compute_image.my_image.self_link
     }
   }
+
+  network_interface {
+    subnetwork = google_compute_subnetwork.inst-test-subnetwork.name
+    access_config {
+    }
+  }
+
   network_interface {
     network = "default"
   }
-  service_account {
-    scopes = [
-      "userinfo-email",
-    ]
-  }
-  allow_stopping_for_update = true
 }
-`, instance)
+
+resource "google_compute_network" "inst-test-network" {
+  name = "%s"
 }
 
-func testAccComputeInstance_scheduling(instance string) string {
+resource "google_compute_subnetwork" "inst-test-subnetwork" {
+  name          = "%s"
+  ip_cidr_range = "10.0.0.0/16"
+  region        = "us-central1"
+  network       = google_compute_network.inst-test-network.self_link
+}
+`, instance, network, subnetwork)
+}
+
+func testAccComputeInstance_nictype(image, instance, nictype string) string {
 	return fmt.Sprintf(`
-data "google_compute_image" "my_image" {
-  family  = "debian-11"
-  project = "debian-cloud"
+resource "google_compute_image" "example" {
+	name = "%s"
+	raw_disk {
+		source = "https://storage.googleapis.com/bosh-gce-raw-stemcells/bosh-stemcell-97.98-google-kvm-ubuntu-xenial-go_agent-raw-1557960142.tar.gz"
+	}
+
+	guest_os_features {
+		type = "SECURE_BOOT"
+	}
+
+	guest_os_features {
+		type = "MULTI_IP_SUBNET"
+	}
+
+	guest_os_features {
+		type = "GVNIC"
+	}
 }
 
 resource "google_compute_instance" "foobar" {
-  name         = "%s"
-  machine_type = "e2-medium"
-  zone         = "us-central1-a"
+  name           = "%s"
+  machine_type   = "e2-medium"
+  zone           = "us-central1-a"
+  can_ip_forward = false
+  tags           = ["foo", "bar"]
+
+  //deletion_protection = false is implicit in this config due to default value
 
   boot_disk {
     initialize_params {
-      image = data.google_compute_image.my_image.self_link
+	  image = google_compute_image.example.id
     }
   }
 
   network_interface {
-    network = "default"
+	network = "default"
+	nic_type = "%s"
   }
 
-  scheduling {
-    automatic_restart = false
+  metadata = {
+    foo            = "bar"
+    baz            = "qux"
+    startup-script = "echo Hello"
+  }
+
+  labels = {
+    my_key       = "my_value"
+    my_other_key = "my_other_value"
   }
 }
-`, instance)
+`, image, instance, nictype)
 }
 
-func testAccComputeInstance_schedulingUpdated(instance string) string {
+func testAccComputeInstance_guestAccelerator(instance string, count uint8) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
@@ -5108,8 +6165,8 @@ data "google_compute_image" "my_image" {
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
-  machine_type = "e2-medium"
-  zone         = "us-central1-a"
+  machine_type = "n1-standard-1"   // can't be e2 because of guest_accelerator
+  zone         = "us-east1-d"
 
   boot_disk {
     initialize_params {
@@ -5122,24 +6179,29 @@ resource "google_compute_instance" "foobar" {
   }
 
   scheduling {
-    automatic_restart = false
-    preemptible       = true
+    # Instances with guest accelerators do not support live migration.
+    on_host_maintenance = "TERMINATE"
+  }
+
+  guest_accelerator {
+    count = %d
+    type  = "nvidia-tesla-k80"
   }
 }
-`, instance)
+`, instance, count)
 }
 
-func testAccComputeInstance_advancedMachineFeatures(instance string) string {
+func testAccComputeInstance_minCpuPlatform(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
-  family  = "debian-10"
+  family  = "debian-11"
   project = "debian-cloud"
 }
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
-  machine_type = "n1-standard-2" // Nested Virt isn't supported on E2 and N2Ds https://cloud.google.com/compute/docs/instances/nested-virtualization/overview#restrictions and https://cloud.google.com/compute/docs/instances/disabling-smt#limitations
-  zone         = "us-central1-a"
+  machine_type = "n1-standard-1"   // can't be e2 because of min_cpu_platform
+  zone         = "us-east1-d"
 
   boot_disk {
     initialize_params {
@@ -5151,23 +6213,23 @@ resource "google_compute_instance" "foobar" {
     network = "default"
   }
 
+  min_cpu_platform = "Intel Haswell"
   allow_stopping_for_update = true
-
 }
 `, instance)
 }
 
-func testAccComputeInstance_advancedMachineFeaturesUpdated(instance string) string {
+func testAccComputeInstance_minCpuPlatform_remove(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
-  family  = "debian-10"
+  family  = "debian-11"
   project = "debian-cloud"
 }
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
-  machine_type = "n1-standard-2" // Nested Virt isn't supported on E2 and N2Ds https://cloud.google.com/compute/docs/instances/nested-virtualization/overview#restrictions and https://cloud.google.com/compute/docs/instances/disabling-smt#limitations
-  zone         = "us-central1-a"
+  machine_type = "e2-micro"
+  zone         = "us-east1-d"
 
   boot_disk {
     initialize_params {
@@ -5178,33 +6240,24 @@ resource "google_compute_instance" "foobar" {
   network_interface {
     network = "default"
   }
-  advanced_machine_features {
-	threads_per_core = 1
-	enable_nested_virtualization = true
-	visible_core_count = 1
-  }
+
+  min_cpu_platform = "AuToMaTiC"
   allow_stopping_for_update = true
 }
 `, instance)
 }
 
-func testAccComputeInstance_subnet_auto(suffix, instance string) string {
+func testAccComputeInstance_primaryAliasIpRange(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
-resource "google_compute_network" "inst-test-network" {
-  name = "tf-test-network-%s"
-
-  auto_create_subnetworks = true
-}
-
 resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
-  zone         = "us-central1-a"
+  zone         = "us-east1-d"
 
   boot_disk {
     initialize_params {
@@ -5213,15 +6266,17 @@ resource "google_compute_instance" "foobar" {
   }
 
   network_interface {
-    network = google_compute_network.inst-test-network.name
-    access_config {
+    network = "default"
+
+    alias_ip_range {
+      ip_cidr_range = "/24"
     }
   }
 }
-`, suffix, instance)
+`, instance)
 }
 
-func testAccComputeInstance_subnet_custom(suffix, instance string) string {
+func testAccComputeInstance_secondaryAliasIpRange(network, subnet, instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
@@ -5229,22 +6284,28 @@ data "google_compute_image" "my_image" {
 }
 
 resource "google_compute_network" "inst-test-network" {
-  name = "tf-test-network-%s"
-
-  auto_create_subnetworks = false
+  name = "%s"
 }
 
 resource "google_compute_subnetwork" "inst-test-subnetwork" {
-  name          = "inst-test-subnetwork-%s"
+  name          = "%s"
   ip_cidr_range = "10.0.0.0/16"
-  region        = "us-central1"
+  region        = "us-east1"
   network       = google_compute_network.inst-test-network.self_link
+  secondary_ip_range {
+    range_name    = "inst-test-secondary"
+    ip_cidr_range = "172.16.0.0/20"
+  }
+  secondary_ip_range {
+    range_name    = "inst-test-tertiary"
+    ip_cidr_range = "10.1.0.0/16"
+  }
 }
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
-  zone         = "us-central1-a"
+  zone         = "us-east1-d"
 
   boot_disk {
     initialize_params {
@@ -5254,73 +6315,51 @@ resource "google_compute_instance" "foobar" {
 
   network_interface {
     subnetwork = google_compute_subnetwork.inst-test-subnetwork.self_link
-    access_config {
+
+    alias_ip_range {
+      subnetwork_range_name = google_compute_subnetwork.inst-test-subnetwork.secondary_ip_range[0].range_name
+      ip_cidr_range         = "172.16.0.0/24"
+    }
+
+    alias_ip_range {
+      subnetwork_range_name = google_compute_subnetwork.inst-test-subnetwork.secondary_ip_range[1].range_name
+      ip_cidr_range         = "10.1.0.0/20"
     }
   }
 }
-`, suffix, suffix, instance)
+`, network, subnet, instance)
 }
 
-func testAccComputeInstance_subnet_xpn(org, billingId, projectName, instance, suffix string) string {
+func testAccComputeInstance_secondaryAliasIpRangeUpdate(network, subnet, instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
-resource "google_project" "host_project" {
-  name            = "Test Project XPN Host"
-  project_id      = "%s-host"
-  org_id          = "%s"
-  billing_account = "%s"
-}
-
-resource "google_project_service" "host_project" {
-  project = google_project.host_project.project_id
-  service = "compute.googleapis.com"
-}
-
-resource "google_compute_shared_vpc_host_project" "host_project" {
-  project = google_project_service.host_project.project
-}
-
-resource "google_project" "service_project" {
-  name            = "Test Project XPN Service"
-  project_id      = "%s-service"
-  org_id          = "%s"
-  billing_account = "%s"
-}
-
-resource "google_project_service" "service_project" {
-  project = google_project.service_project.project_id
-  service = "compute.googleapis.com"
-}
-
-resource "google_compute_shared_vpc_service_project" "service_project" {
-  host_project    = google_compute_shared_vpc_host_project.host_project.project
-  service_project = google_project_service.service_project.project
-}
-
 resource "google_compute_network" "inst-test-network" {
-  name    = "tf-test-network-%s"
-  project = google_compute_shared_vpc_host_project.host_project.project
-
-  auto_create_subnetworks = false
+  name = "%s"
 }
 
 resource "google_compute_subnetwork" "inst-test-subnetwork" {
-  name          = "tf-test-subnetwork-%s"
+  name          = "%s"
   ip_cidr_range = "10.0.0.0/16"
-  region        = "us-central1"
+  region        = "us-east1"
   network       = google_compute_network.inst-test-network.self_link
-  project       = google_compute_shared_vpc_host_project.host_project.project
+  secondary_ip_range {
+    range_name    = "inst-test-secondary"
+    ip_cidr_range = "172.16.0.0/20"
+  }
+  secondary_ip_range {
+    range_name    = "inst-test-tertiary"
+    ip_cidr_range = "10.1.0.0/16"
+  }
 }
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
-  zone         = "us-central1-a"
-  project      = google_compute_shared_vpc_service_project.service_project.service_project
+  zone         = "us-east1-d"
 
   boot_disk {
     initialize_params {
@@ -5329,37 +6368,27 @@ resource "google_compute_instance" "foobar" {
   }
 
   network_interface {
-    subnetwork         = google_compute_subnetwork.inst-test-subnetwork.name
-    subnetwork_project = google_compute_subnetwork.inst-test-subnetwork.project
-    access_config {
+    subnetwork = google_compute_subnetwork.inst-test-subnetwork.self_link
+    alias_ip_range {
+      ip_cidr_range = "10.0.1.0/24"
     }
   }
 }
-`, projectName, org, billingId, projectName, org, billingId, suffix, suffix, instance)
+`, network, subnet, instance)
 }
 
-func testAccComputeInstance_networkIPAuto(suffix, instance string) string {
+func testAccComputeInstance_hostname(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
-resource "google_compute_network" "inst-test-network" {
-  name = "tf-test-network-%s"
-}
-
-resource "google_compute_subnetwork" "inst-test-subnetwork" {
-  name          = "tf-test-subnetwork-%s"
-  ip_cidr_range = "10.0.0.0/16"
-  region        = "us-central1"
-  network       = google_compute_network.inst-test-network.self_link
-}
-
 resource "google_compute_instance" "foobar" {
-  name         = "%s"
-  machine_type = "e2-medium"
-  zone         = "us-central1-a"
+  name           = "%s"
+  machine_type   = "e2-medium"
+  zone           = "us-central1-a"
+  can_ip_forward = false
 
   boot_disk {
     initialize_params {
@@ -5368,35 +6397,25 @@ resource "google_compute_instance" "foobar" {
   }
 
   network_interface {
-    subnetwork = google_compute_subnetwork.inst-test-subnetwork.name
-    access_config {
-    }
+    network = "default"
   }
+
+  hostname = "%s.test"
 }
-`, suffix, suffix, instance)
+`, instance, instance)
 }
 
-func testAccComputeInstance_network_ip_custom(suffix, instance, ipAddress string) string {
+// Set fields that require stopping the instance: machine_type, min_cpu_platform, and service_account
+func testAccComputeInstance_stopInstanceToUpdate(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
-resource "google_compute_network" "inst-test-network" {
-  name = "tf-test-network-%s"
-}
-
-resource "google_compute_subnetwork" "inst-test-subnetwork" {
-  name          = "tf-test-subnetwork-%s"
-  ip_cidr_range = "10.0.0.0/16"
-  region        = "us-central1"
-  network       = google_compute_network.inst-test-network.self_link
-}
-
 resource "google_compute_instance" "foobar" {
   name         = "%s"
-  machine_type = "e2-medium"
+  machine_type = "n1-standard-1"   // can't be e2 because of min_cpu_platform
   zone         = "us-central1-a"
 
   boot_disk {
@@ -5406,42 +6425,39 @@ resource "google_compute_instance" "foobar" {
   }
 
   network_interface {
-    subnetwork = google_compute_subnetwork.inst-test-subnetwork.name
-    network_ip = "%s"
-    access_config {
-    }
+    network = "default"
+  }
+
+  min_cpu_platform = "Intel Broadwell"
+  service_account {
+    scopes = [
+      "userinfo-email",
+      "compute-ro",
+      "storage-ro",
+    ]
   }
+
+  allow_stopping_for_update = true
 }
-`, suffix, suffix, instance, ipAddress)
+`, instance)
 }
 
-func testAccComputeInstance_private_image_family(disk, family, instance string) string {
+// Update fields that require stopping the instance: machine_type, min_cpu_platform, and service_account
+func testAccComputeInstance_stopInstanceToUpdate2(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
-resource "google_compute_disk" "foobar" {
-  name  = "%s"
-  zone  = "us-central1-a"
-  image = data.google_compute_image.my_image.self_link
-}
-
-resource "google_compute_image" "foobar" {
-  name        = "%s-1"
-  source_disk = google_compute_disk.foobar.self_link
-  family      = "%s"
-}
-
 resource "google_compute_instance" "foobar" {
   name         = "%s"
-  machine_type = "e2-medium"
+  machine_type = "n1-standard-2"   // can't be e2 because of min_cpu_platform
   zone         = "us-central1-a"
 
   boot_disk {
     initialize_params {
-      image = google_compute_image.foobar.family
+      image = data.google_compute_image.my_image.self_link
     }
   }
 
@@ -5449,66 +6465,48 @@ resource "google_compute_instance" "foobar" {
     network = "default"
   }
 
-  metadata = {
-    foo = "bar"
+  min_cpu_platform = "Intel Skylake"
+  service_account {
+    scopes = [
+      "userinfo-email",
+      "compute-ro",
+    ]
   }
+
+  allow_stopping_for_update = true
 }
-`, disk, family, family, instance)
+`, instance)
 }
 
-func testAccComputeInstance_networkPerformanceConfig(disk string, image string, instance string) string {
+// Remove fields that require stopping the instance: min_cpu_platform and service_account (machine_type is Required)
+func testAccComputeInstance_stopInstanceToUpdate3(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
-resource "google_compute_disk" "foobar" {
-  name  = "%s"
-  zone  = "us-central1-a"
-  image = data.google_compute_image.my_image.self_link
-}
-
-resource "google_compute_image" "foobar" {
-  name              = "%s"
-  source_disk       = google_compute_disk.foobar.self_link
-  guest_os_features {
-    type = "GVNIC"
-  }
-  guest_os_features {
-    type = "VIRTIO_SCSI_MULTIQUEUE"
-  }
-	guest_os_features {
-    type = "UEFI_COMPATIBLE"
-   }
-}
-
 resource "google_compute_instance" "foobar" {
   name         = "%s"
-  machine_type = "n2-standard-2"
+  machine_type = "n1-standard-2"   // can't be e2 because of min_cpu_platform
   zone         = "us-central1-a"
 
   boot_disk {
     initialize_params {
-      image = google_compute_image.foobar.self_link
+      image = data.google_compute_image.my_image.self_link
     }
   }
 
   network_interface {
     network = "default"
-    access_config {
-      // Ephemeral IP
-    }
   }
 
-  network_performance_config {
-    total_egress_bandwidth_tier = "DEFAULT"
-  }
+  allow_stopping_for_update = true
 }
-`, disk, image, instance)
+`, instance)
 }
 
-func testAccComputeInstance_multiNic(instance, network, subnetwork string) string {
+func testAccComputeInstance_withoutNodeAffinities(instance, nodeTemplate, nodeGroup string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
@@ -5517,8 +6515,9 @@ data "google_compute_image" "my_image" {
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
-  machine_type = "e2-medium"
+  machine_type = "n1-standard-8"   // can't be e2 because of sole tenancy
   zone         = "us-central1-a"
+  allow_stopping_for_update = true
 
   boot_disk {
     initialize_params {
@@ -5527,85 +6526,103 @@ resource "google_compute_instance" "foobar" {
   }
 
   network_interface {
-    subnetwork = google_compute_subnetwork.inst-test-subnetwork.name
-    access_config {
-    }
+    network = "default"
   }
+}
 
-  network_interface {
-    network = "default"
+resource "google_compute_node_template" "nodetmpl" {
+  name   = "%s"
+  region = "us-central1"
+
+  node_affinity_labels = {
+    tfacc = "test"
   }
+
+  node_type = "n1-node-96-624"
+
+  cpu_overcommit_type = "ENABLED"
 }
 
-resource "google_compute_network" "inst-test-network" {
+resource "google_compute_node_group" "nodes" {
   name = "%s"
-}
+  zone = "us-central1-a"
 
-resource "google_compute_subnetwork" "inst-test-subnetwork" {
-  name          = "%s"
-  ip_cidr_range = "10.0.0.0/16"
-  region        = "us-central1"
-  network       = google_compute_network.inst-test-network.self_link
+  initial_size          = 1
+  node_template = google_compute_node_template.nodetmpl.self_link
 }
-`, instance, network, subnetwork)
+`, instance, nodeTemplate, nodeGroup)
 }
 
-func testAccComputeInstance_nictype(image, instance, nictype string) string {
+func testAccComputeInstance_soleTenantNodeAffinities(instance, nodeTemplate, nodeGroup string) string {
 	return fmt.Sprintf(`
-resource "google_compute_image" "example" {
-	name = "%s"
-	raw_disk {
-		source = "https://storage.googleapis.com/bosh-gce-raw-stemcells/bosh-stemcell-97.98-google-kvm-ubuntu-xenial-go_agent-raw-1557960142.tar.gz"
-	}
-
-	guest_os_features {
-		type = "SECURE_BOOT"
-	}
-
-	guest_os_features {
-		type = "MULTI_IP_SUBNET"
-	}
-
-	guest_os_features {
-		type = "GVNIC"
-	}
+data "google_compute_image" "my_image" {
+  family  = "debian-11"
+  project = "debian-cloud"
 }
 
 resource "google_compute_instance" "foobar" {
-  name           = "%s"
-  machine_type   = "e2-medium"
-  zone           = "us-central1-a"
-  can_ip_forward = false
-  tags           = ["foo", "bar"]
-
-  //deletion_protection = false is implicit in this config due to default value
+  name         = "%s"
+  machine_type = "n1-standard-8"   // can't be e2 because of sole tenancy
+  zone         = "us-central1-a"
+  allow_stopping_for_update = true
 
   boot_disk {
     initialize_params {
-	  image = google_compute_image.example.id
+      image = data.google_compute_image.my_image.self_link
     }
   }
 
   network_interface {
-	network = "default"
-	nic_type = "%s"
+    network = "default"
   }
 
-  metadata = {
-    foo            = "bar"
-    baz            = "qux"
-    startup-script = "echo Hello"
+  scheduling {
+    node_affinities {
+      key      = "tfacc"
+      operator = "IN"
+      values   = ["test"]
+    }
+
+    node_affinities {
+      key      = "tfacc"
+      operator = "NOT_IN"
+      values   = ["not_here"]
+    }
+
+    node_affinities {
+      key      = "compute.googleapis.com/node-group-name"
+      operator = "IN"
+      values   = [google_compute_node_group.nodes.name]
+    }
+
+    min_node_cpus = 4
   }
+}
 
-  labels = {
-    my_key       = "my_value"
-    my_other_key = "my_other_value"
+resource "google_compute_node_template" "nodetmpl" {
+  name   = "%s"
+  region = "us-central1"
+
+  node_affinity_labels = {
+    tfacc = "test"
   }
+
+  node_type = "n1-node-96-624"
+
+  cpu_overcommit_type = "ENABLED"
 }
-`, image, instance, nictype)
+
+resource "google_compute_node_group" "nodes" {
+  name = "%s"
+  zone = "us-central1-a"
+
+  initial_size          = 1
+  node_template = google_compute_node_template.nodetmpl.self_link
+}
+`, instance, nodeTemplate, nodeGroup)
 }
 
-func testAccComputeInstance_guestAccelerator(instance string, count uint8) string {
+func testAccComputeInstance_soleTenantNodeAffinitiesUpdated(instance, nodeTemplate, nodeGroup string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
@@ -5614,8 +6631,9 @@ data "google_compute_image" "my_image" {
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
-  machine_type = "n1-standard-1"   // can't be e2 because of guest_accelerator
-  zone         = "us-east1-d"
+  machine_type = "n1-standard-8"   // can't be e2 because of sole tenancy
+  zone         = "us-central1-a"
+  allow_stopping_for_update = true
 
   boot_disk {
     initialize_params {
@@ -5628,19 +6646,52 @@ resource "google_compute_instance" "foobar" {
   }
 
   scheduling {
-    # Instances with guest accelerators do not support live migration.
-    on_host_maintenance = "TERMINATE"
+    node_affinities {
+      key      = "tfacc"
+      operator = "IN"
+      values   = ["test", "updatedlabel"]
+    }
+
+    node_affinities {
+      key      = "tfacc"
+      operator = "NOT_IN"
+      values   = ["not_here"]
+    }
+
+    node_affinities {
+      key      = "compute.googleapis.com/node-group-name"
+      operator = "IN"
+      values   = [google_compute_node_group.nodes.name]
+    }
+
+    min_node_cpus = 6
   }
+}
 
-  guest_accelerator {
-    count = %d
-    type  = "nvidia-tesla-k80"
+resource "google_compute_node_template" "nodetmpl" {
+  name   = "%s"
+  region = "us-central1"
+
+  node_affinity_labels = {
+    tfacc = "test"
   }
+
+  node_type = "n1-node-96-624"
+
+  cpu_overcommit_type = "ENABLED"
 }
-`, instance, count)
+
+resource "google_compute_node_group" "nodes" {
+  name = "%s"
+  zone = "us-central1-a"
+
+  initial_size          = 1
+  node_template = google_compute_node_template.nodetmpl.self_link
+}
+`, instance, nodeTemplate, nodeGroup)
 }
 
-func testAccComputeInstance_minCpuPlatform(instance string) string {
+func testAccComputeInstance_soleTenantNodeAffinitiesReduced(instance, nodeTemplate, nodeGroup string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
@@ -5649,8 +6700,9 @@ data "google_compute_image" "my_image" {
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
-  machine_type = "n1-standard-1"   // can't be e2 because of min_cpu_platform
-  zone         = "us-east1-d"
+  machine_type = "n1-standard-8"   // can't be e2 because of sole tenancy
+  zone         = "us-central1-a"
+  allow_stopping_for_update = true
 
   boot_disk {
     initialize_params {
@@ -5662,41 +6714,47 @@ resource "google_compute_instance" "foobar" {
     network = "default"
   }
 
-  min_cpu_platform = "Intel Haswell"
-  allow_stopping_for_update = true
-}
-`, instance)
-}
+  scheduling {
+    node_affinities {
+      key      = "tfacc"
+      operator = "IN"
+      values   = ["test", "updatedlabel"]
+    }
 
-func testAccComputeInstance_minCpuPlatform_remove(instance string) string {
-	return fmt.Sprintf(`
-data "google_compute_image" "my_image" {
-  family  = "debian-11"
-  project = "debian-cloud"
+    node_affinities {
+      key      = "compute.googleapis.com/node-group-name"
+      operator = "IN"
+      values   = [google_compute_node_group.nodes.name]
+    }
+
+    min_node_cpus = 6
+  }
 }
 
-resource "google_compute_instance" "foobar" {
-  name         = "%s"
-  machine_type = "e2-micro"
-  zone         = "us-east1-d"
+resource "google_compute_node_template" "nodetmpl" {
+  name   = "%s"
+  region = "us-central1"
 
-  boot_disk {
-    initialize_params {
-      image = data.google_compute_image.my_image.self_link
-    }
+  node_affinity_labels = {
+    tfacc = "test"
   }
 
-  network_interface {
-    network = "default"
-  }
+  node_type = "n1-node-96-624"
 
-  min_cpu_platform = "AuToMaTiC"
-  allow_stopping_for_update = true
+  cpu_overcommit_type = "ENABLED"
 }
-`, instance)
+
+resource "google_compute_node_group" "nodes" {
+  name = "%s"
+  zone = "us-central1-a"
+
+  initial_size          = 1
+  node_template = google_compute_node_template.nodetmpl.self_link
+}
+`, instance, nodeTemplate, nodeGroup)
 }
 
-func testAccComputeInstance_primaryAliasIpRange(instance string) string {
+func testAccComputeInstance_reservationAffinity_nonSpecificReservationConfig(instanceName, reservationType string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
@@ -5705,8 +6763,8 @@ data "google_compute_image" "my_image" {
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
-  machine_type = "e2-medium"
-  zone         = "us-east1-d"
+  machine_type = "n1-standard-1"
+  zone         = "us-central1-a"
 
   boot_disk {
     initialize_params {
@@ -5716,45 +6774,38 @@ resource "google_compute_instance" "foobar" {
 
   network_interface {
     network = "default"
+  }
 
-    alias_ip_range {
-      ip_cidr_range = "/24"
-    }
+  reservation_affinity {
+    type = "%s"
   }
-}
-`, instance)
+}`, instanceName, reservationType)
 }
 
-func testAccComputeInstance_secondaryAliasIpRange(network, subnet, instance string) string {
+func testAccComputeInstance_reservationAffinity_specificReservationConfig(instanceName string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
-resource "google_compute_network" "inst-test-network" {
+resource "google_compute_reservation" "reservation" {
   name = "%s"
-}
+  zone = "us-central1-a"
 
-resource "google_compute_subnetwork" "inst-test-subnetwork" {
-  name          = "%s"
-  ip_cidr_range = "10.0.0.0/16"
-  region        = "us-east1"
-  network       = google_compute_network.inst-test-network.self_link
-  secondary_ip_range {
-    range_name    = "inst-test-secondary"
-    ip_cidr_range = "172.16.0.0/20"
-  }
-  secondary_ip_range {
-    range_name    = "inst-test-tertiary"
-    ip_cidr_range = "10.1.0.0/16"
+  specific_reservation {
+    count = 1
+    instance_properties {
+      machine_type = "n1-standard-1"
+    }
   }
+  specific_reservation_required = true
 }
 
 resource "google_compute_instance" "foobar" {
-  name         = "%s"
-  machine_type = "e2-medium"
-  zone         = "us-east1-d"
+  name         = "%[1]s"
+  machine_type = "n1-standard-1"
+  zone         = "us-central1-a"
 
   boot_disk {
     initialize_params {
@@ -5763,52 +6814,31 @@ resource "google_compute_instance" "foobar" {
   }
 
   network_interface {
-    subnetwork = google_compute_subnetwork.inst-test-subnetwork.self_link
+    network = "default"
+  }
 
-    alias_ip_range {
-      subnetwork_range_name = google_compute_subnetwork.inst-test-subnetwork.secondary_ip_range[0].range_name
-      ip_cidr_range         = "172.16.0.0/24"
-    }
+  reservation_affinity {
+    type = "SPECIFIC_RESERVATION"
 
-    alias_ip_range {
-      subnetwork_range_name = google_compute_subnetwork.inst-test-subnetwork.secondary_ip_range[1].range_name
-      ip_cidr_range         = "10.1.0.0/20"
-    }
+	specific_reservation {
+		key    = "compute.googleapis.com/reservation-name"
+		values = ["%[1]s"]
+	}
   }
-}
-`, network, subnet, instance)
+}`, instanceName)
 }
 
-func testAccComputeInstance_secondaryAliasIpRangeUpdate(network, subnet, instance string) string {
+func testAccComputeInstance_shieldedVmConfig(instance string, enableSecureBoot bool, enableVtpm bool, enableIntegrityMonitoring bool) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
-  family  = "debian-11"
-  project = "debian-cloud"
-}
-
-resource "google_compute_network" "inst-test-network" {
-  name = "%s"
-}
-
-resource "google_compute_subnetwork" "inst-test-subnetwork" {
-  name          = "%s"
-  ip_cidr_range = "10.0.0.0/16"
-  region        = "us-east1"
-  network       = google_compute_network.inst-test-network.self_link
-  secondary_ip_range {
-    range_name    = "inst-test-secondary"
-    ip_cidr_range = "172.16.0.0/20"
-  }
-  secondary_ip_range {
-    range_name    = "inst-test-tertiary"
-    ip_cidr_range = "10.1.0.0/16"
-  }
+  family  = "centos-7"
+  project = "centos-cloud"
 }
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
-  zone         = "us-east1-d"
+  zone         = "us-central1-a"
 
   boot_disk {
     initialize_params {
@@ -5817,54 +6847,30 @@ resource "google_compute_instance" "foobar" {
   }
 
   network_interface {
-    subnetwork = google_compute_subnetwork.inst-test-subnetwork.self_link
-    alias_ip_range {
-      ip_cidr_range = "10.0.1.0/24"
-    }
-  }
-}
-`, network, subnet, instance)
-}
-
-func testAccComputeInstance_hostname(instance string) string {
-	return fmt.Sprintf(`
-data "google_compute_image" "my_image" {
-  family  = "debian-11"
-  project = "debian-cloud"
-}
-
-resource "google_compute_instance" "foobar" {
-  name           = "%s"
-  machine_type   = "e2-medium"
-  zone           = "us-central1-a"
-  can_ip_forward = false
-
-  boot_disk {
-    initialize_params {
-      image = data.google_compute_image.my_image.self_link
-    }
+    network = "default"
   }
 
-  network_interface {
-    network = "default"
+  shielded_instance_config {
+    enable_secure_boot          = %t
+    enable_vtpm                 = %t
+    enable_integrity_monitoring = %t
   }
 
-  hostname = "%s.test"
+  allow_stopping_for_update = true
 }
-`, instance, instance)
+`, instance, enableSecureBoot, enableVtpm, enableIntegrityMonitoring)
 }
 
-// Set fields that require stopping the instance: machine_type, min_cpu_platform, and service_account
-func testAccComputeInstance_stopInstanceToUpdate(instance string) string {
+func testAccComputeInstanceConfidentialInstanceConfig(instance string, enableConfidentialCompute bool) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
-  family  = "debian-11"
-  project = "debian-cloud"
+  family    = "ubuntu-2004-lts"
+  project   = "ubuntu-os-cloud"
 }
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
-  machine_type = "n1-standard-1"   // can't be e2 because of min_cpu_platform
+  machine_type = "n2d-standard-2"
   zone         = "us-central1-a"
 
   boot_disk {
@@ -5877,67 +6883,72 @@ resource "google_compute_instance" "foobar" {
     network = "default"
   }
 
-  min_cpu_platform = "Intel Broadwell"
-  service_account {
-    scopes = [
-      "userinfo-email",
-      "compute-ro",
-      "storage-ro",
-    ]
+  confidential_instance_config {
+    enable_confidential_compute       = %t
+  }
+
+  scheduling {
+	  on_host_maintenance = "TERMINATE"
   }
 
-  allow_stopping_for_update = true
 }
-`, instance)
+`, instance, enableConfidentialCompute)
 }
 
-// Update fields that require stopping the instance: machine_type, min_cpu_platform, and service_account
-func testAccComputeInstance_stopInstanceToUpdate2(instance string) string {
-	return fmt.Sprintf(`
+<% unless version == 'ga' -%>
+func testAccComputeInstanceConfidentialHyperDiskBootDisk(context map[string]interface{}) string {
+	return acctest.Nprintf(`
 data "google_compute_image" "my_image" {
-  family  = "debian-11"
-  project = "debian-cloud"
+  family    = "ubuntu-2204-lts"
+  project   = "ubuntu-os-cloud"
+}
+
+data "google_project" "project" {}
+
+resource "google_kms_crypto_key_iam_binding" "crypto_key" {
+  crypto_key_id = "%{key_name}"
+  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+  members = [
+    "serviceAccount:${data.google_project.project.number}-compute@developer.gserviceaccount.com",
+  ]
 }
 
 resource "google_compute_instance" "foobar" {
-  name         = "%s"
-  machine_type = "n1-standard-2"   // can't be e2 because of min_cpu_platform
-  zone         = "us-central1-a"
+  name         = "%{instance_name}"
+  machine_type = "n2-standard-2"
+  zone         = "%{zone}"
 
   boot_disk {
+
     initialize_params {
       image = data.google_compute_image.my_image.self_link
+      enable_confidential_compute = %{confidential_compute}
+      type  = "hyperdisk-balanced"
     }
+
+    kms_key_self_link = "%{key_name}"
   }
 
   network_interface {
     network = "default"
   }
+  depends_on = [google_kms_crypto_key_iam_binding.crypto_key]
 
-  min_cpu_platform = "Intel Skylake"
-  service_account {
-    scopes = [
-      "userinfo-email",
-      "compute-ro",
-    ]
-  }
-
-  allow_stopping_for_update = true
 }
-`, instance)
+`, context)
 }
+<% end -%>
 
-// Remove fields that require stopping the instance: min_cpu_platform and service_account (machine_type is Required)
-func testAccComputeInstance_stopInstanceToUpdate3(instance string) string {
+func testAccComputeInstance_enableDisplay(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
-  family  = "debian-11"
-  project = "debian-cloud"
+  family  = "centos-7"
+  project = "centos-cloud"
 }
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
-  machine_type = "n1-standard-2"   // can't be e2 because of min_cpu_platform
+  machine_type = "e2-medium"
   zone         = "us-central1-a"
 
   boot_disk {
@@ -5950,23 +6961,24 @@ resource "google_compute_instance" "foobar" {
     network = "default"
   }
 
+  enable_display = true
+
   allow_stopping_for_update = true
 }
 `, instance)
 }
 
-func testAccComputeInstance_withoutNodeAffinities(instance, nodeTemplate, nodeGroup string) string {
+func testAccComputeInstance_enableDisplayUpdated(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
-  family  = "debian-11"
-  project = "debian-cloud"
+  family  = "centos-7"
+  project = "centos-cloud"
 }
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
-  machine_type = "n1-standard-8"   // can't be e2 because of sole tenancy
+  machine_type = "e2-medium"
   zone         = "us-central1-a"
-  allow_stopping_for_update = true
 
   boot_disk {
     initialize_params {
@@ -5977,32 +6989,98 @@ resource "google_compute_instance" "foobar" {
   network_interface {
     network = "default"
   }
+
+  enable_display = false
+
+  allow_stopping_for_update = true
+}
+`, instance)
 }
 
-resource "google_compute_node_template" "nodetmpl" {
-  name   = "%s"
-  region = "us-central1"
+func testAccComputeInstance_machineType_desiredStatus_allowStoppingForUpdate(
+	instance, machineType, desiredStatus string,
+	allowStoppingForUpdate bool,
+) string {
+	desiredStatusConfigSection := ""
+	if desiredStatus != "" {
+		desiredStatusConfigSection = fmt.Sprintf(
+			"desired_status = \"%s\"",
+			desiredStatus,
+		)
+	}
 
-  node_affinity_labels = {
-    tfacc = "test"
-  }
+	return fmt.Sprintf(`
+data "google_compute_image" "my_image" {
+	family  = "debian-11"
+	project = "debian-cloud"
+}
 
-  node_type = "n1-node-96-624"
+resource "google_compute_instance" "foobar" {
+	name           = "%s"
+	machine_type   = "%s"
+	zone           = "us-central1-a"
+	can_ip_forward = false
+	tags           = ["foo", "bar"]
 
-  cpu_overcommit_type = "ENABLED"
+	boot_disk {
+		initialize_params{
+			image = "${data.google_compute_image.my_image.self_link}"
+		}
+	}
+
+	network_interface {
+		network = "default"
+	}
+
+	%s
+
+	metadata = {
+		foo = "bar"
+	}
+
+	allow_stopping_for_update = %t
+}
+`, instance, machineType, desiredStatusConfigSection, allowStoppingForUpdate)
 }
 
-resource "google_compute_node_group" "nodes" {
-  name = "%s"
-  zone = "us-central1-a"
+func testAccComputeInstance_desiredStatusTerminatedUpdate(instance string) string {
+	return fmt.Sprintf(`
+data "google_compute_image" "my_image" {
+	family  = "debian-11"
+	project = "debian-cloud"
+}
 
-  size          = 1
-  node_template = google_compute_node_template.nodetmpl.self_link
+resource "google_compute_instance" "foobar" {
+	name           = "%s"
+	machine_type   = "e2-medium"
+	zone           = "us-central1-a"
+	can_ip_forward = false
+	tags           = ["baz"]
+
+	boot_disk {
+		initialize_params{
+			image = "${data.google_compute_image.my_image.self_link}"
+		}
+	}
+
+	network_interface {
+		network = "default"
+	}
+
+	desired_status = "TERMINATED"
+
+	metadata = {
+		bar = "baz"
+	}
+
+	labels = {
+		only_me = "nothing_else"
+	}
 }
-`, instance, nodeTemplate, nodeGroup)
+`, instance)
 }
 
-func testAccComputeInstance_soleTenantNodeAffinities(instance, nodeTemplate, nodeGroup string) string {
+func testAccComputeInstance_resourcePolicyCollocate(instance, suffix string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
@@ -6010,10 +7088,13 @@ data "google_compute_image" "my_image" {
 }
 
 resource "google_compute_instance" "foobar" {
-  name         = "%s"
-  machine_type = "n1-standard-8"   // can't be e2 because of sole tenancy
-  zone         = "us-central1-a"
-  allow_stopping_for_update = true
+  name           = "%s"
+  machine_type   = "c2-standard-4"
+  zone           = "us-east4-b"
+  can_ip_forward = false
+  tags           = ["foo", "bar"]
+
+  //deletion_protection = false is implicit in this config due to default value
 
   boot_disk {
     initialize_params {
@@ -6026,193 +7107,243 @@ resource "google_compute_instance" "foobar" {
   }
 
   scheduling {
-    node_affinities {
-      key      = "tfacc"
-      operator = "IN"
-      values   = ["test"]
-    }
+    # Instances with resource policies do not support live migration.
+    on_host_maintenance = "TERMINATE"
+    automatic_restart = false
+  }
 
-    node_affinities {
-      key      = "tfacc"
-      operator = "NOT_IN"
-      values   = ["not_here"]
-    }
+  resource_policies = [google_compute_resource_policy.foo.self_link]
+}
 
-    node_affinities {
-      key      = "compute.googleapis.com/node-group-name"
-      operator = "IN"
-      values   = [google_compute_node_group.nodes.name]
-    }
+resource "google_compute_instance" "second" {
+  name           = "%s-2"
+  machine_type   = "c2-standard-4"
+  zone           = "us-east4-b"
+  can_ip_forward = false
+  tags           = ["foo", "bar"]
 
-    min_node_cpus = 4
-  }
-}
+  //deletion_protection = false is implicit in this config due to default value
 
-resource "google_compute_node_template" "nodetmpl" {
-  name   = "%s"
-  region = "us-central1"
+  boot_disk {
+    initialize_params {
+      image = data.google_compute_image.my_image.self_link
+    }
+  }
 
-  node_affinity_labels = {
-    tfacc = "test"
+  network_interface {
+    network = "default"
   }
 
-  node_type = "n1-node-96-624"
+  scheduling {
+    # Instances with resource policies do not support live migration.
+    on_host_maintenance = "TERMINATE"
+    automatic_restart = false
+  }
 
-  cpu_overcommit_type = "ENABLED"
+  resource_policies = [google_compute_resource_policy.foo.self_link]
 }
 
-resource "google_compute_node_group" "nodes" {
-  name = "%s"
-  zone = "us-central1-a"
-
-  size          = 1
-  node_template = google_compute_node_template.nodetmpl.self_link
+resource "google_compute_resource_policy" "foo" {
+  name   = "tf-test-policy-%s"
+  region = "us-east4"
+  group_placement_policy {
+    vm_count = 2
+    collocation = "COLLOCATED"
+  }
 }
-`, instance, nodeTemplate, nodeGroup)
+
+`, instance, instance, suffix)
 }
 
-func testAccComputeInstance_soleTenantNodeAffinitiesUpdated(instance, nodeTemplate, nodeGroup string) string {
+func testAccComputeInstance_subnetworkUpdate(suffix, instance string) string {
 	return fmt.Sprintf(`
-data "google_compute_image" "my_image" {
-  family  = "debian-11"
-  project = "debian-cloud"
-}
+	data "google_compute_image" "my_image" {
+		family  = "debian-11"
+		project = "debian-cloud"
+	}
 
-resource "google_compute_instance" "foobar" {
-  name         = "%s"
-  machine_type = "n1-standard-8"   // can't be e2 because of sole tenancy
-  zone         = "us-central1-a"
-  allow_stopping_for_update = true
+	resource "google_compute_network" "inst-test-network" {
+		name = "tf-test-network-%s"
+		auto_create_subnetworks = false
+	}
 
-  boot_disk {
-    initialize_params {
-      image = data.google_compute_image.my_image.self_link
-    }
-  }
+	resource "google_compute_network" "inst-test-network2" {
+		name = "tf-test-network2-%s"
+		auto_create_subnetworks = false
+	}
+
+	resource "google_compute_subnetwork" "inst-test-subnetwork" {
+		name          = "tf-test-compute-subnet-%s"
+		ip_cidr_range = "10.0.0.0/16"
+		region        = "us-east1"
+		network       = google_compute_network.inst-test-network.id
+		secondary_ip_range {
+			range_name    = "inst-test-secondary"
+			ip_cidr_range = "172.16.0.0/20"
+		}
+		secondary_ip_range {
+			range_name    = "inst-test-tertiary"
+			ip_cidr_range = "10.1.0.0/16"
+		}
+	}
+
+	resource "google_compute_subnetwork" "inst-test-subnetwork2" {
+		name          = "tf-test-compute-subnet2-%s"
+		ip_cidr_range = "10.3.0.0/16"
+		region        = "us-east1"
+		network       = google_compute_network.inst-test-network2.id
+		secondary_ip_range {
+			range_name    = "inst-test-secondary2"
+			ip_cidr_range = "173.16.0.0/20"
+		}
+		secondary_ip_range {
+			range_name    = "inst-test-tertiary2"
+			ip_cidr_range = "10.4.0.0/16"
+		}
+	}
+
+	resource "google_compute_instance" "foobar" {
+		name         = "%s"
+		machine_type = "e2-medium"
+		zone         = "us-east1-d"
+		allow_stopping_for_update = true
 
-  network_interface {
-    network = "default"
-  }
+		boot_disk {
+			initialize_params {
+				image = data.google_compute_image.my_image.id
+			}
+		}
 
-  scheduling {
-    node_affinities {
-      key      = "tfacc"
-      operator = "IN"
-      values   = ["test", "updatedlabel"]
-    }
+		network_interface {
+			subnetwork = google_compute_subnetwork.inst-test-subnetwork.id
+			access_config {
+				network_tier = "STANDARD"
+			}
+			alias_ip_range {
+				subnetwork_range_name = google_compute_subnetwork.inst-test-subnetwork.secondary_ip_range[0].range_name
+				ip_cidr_range         = "172.16.0.0/24"
+			}
 
-    node_affinities {
-      key      = "tfacc"
-      operator = "NOT_IN"
-      values   = ["not_here"]
-    }
+			alias_ip_range {
+				subnetwork_range_name = google_compute_subnetwork.inst-test-subnetwork.secondary_ip_range[1].range_name
+				ip_cidr_range         = "10.1.0.0/20"
+			}
+		}
+	}
+`, suffix, suffix, suffix, suffix, instance)
+}
 
-    node_affinities {
-      key      = "compute.googleapis.com/node-group-name"
-      operator = "IN"
-      values   = [google_compute_node_group.nodes.name]
-    }
+func testAccComputeInstance_subnetworkUpdateTwo(suffix, instance string) string {
+	return fmt.Sprintf(`
+	data "google_compute_image" "my_image" {
+		family  = "debian-11"
+		project = "debian-cloud"
+	}
 
-    min_node_cpus = 6
-  }
-}
+	resource "google_compute_network" "inst-test-network" {
+		name = "tf-test-network-%s"
+		auto_create_subnetworks = false
+	}
 
-resource "google_compute_node_template" "nodetmpl" {
-  name   = "%s"
-  region = "us-central1"
+	resource "google_compute_network" "inst-test-network2" {
+		name = "tf-test-network2-%s"
+		auto_create_subnetworks = false
+	}
 
-  node_affinity_labels = {
-    tfacc = "test"
-  }
+	resource "google_compute_subnetwork" "inst-test-subnetwork" {
+		name          = "tf-test-compute-subnet-%s"
+		ip_cidr_range = "10.0.0.0/16"
+		region        = "us-east1"
+		network       = google_compute_network.inst-test-network.id
+		secondary_ip_range {
+			range_name    = "inst-test-secondary"
+			ip_cidr_range = "172.16.0.0/20"
+		}
+		secondary_ip_range {
+			range_name    = "inst-test-tertiary"
+			ip_cidr_range = "10.1.0.0/16"
+		}
+	}
 
-  node_type = "n1-node-96-624"
+	resource "google_compute_subnetwork" "inst-test-subnetwork2" {
+		name          = "tf-test-compute-subnet2-%s"
+		ip_cidr_range = "10.3.0.0/16"
+		region        = "us-east1"
+		network       = google_compute_network.inst-test-network2.id
+		secondary_ip_range {
+			range_name    = "inst-test-secondary2"
+			ip_cidr_range = "173.16.0.0/20"
+		}
+		secondary_ip_range {
+			range_name    = "inst-test-tertiary2"
+			ip_cidr_range = "10.4.0.0/16"
+		}
+	}
 
-  cpu_overcommit_type = "ENABLED"
-}
+	resource "google_compute_instance" "foobar" {
+		name         = "%s"
+		machine_type = "e2-medium"
+		zone         = "us-east1-d"
+		allow_stopping_for_update = true
 
-resource "google_compute_node_group" "nodes" {
-  name = "%s"
-  zone = "us-central1-a"
+		boot_disk {
+			initialize_params {
+				image = data.google_compute_image.my_image.id
+			}
+		}
 
-  size          = 1
-  node_template = google_compute_node_template.nodetmpl.self_link
-}
-`, instance, nodeTemplate, nodeGroup)
+		network_interface {
+			subnetwork = google_compute_subnetwork.inst-test-subnetwork2.id
+			network_ip = "10.3.0.3"
+			access_config {
+				network_tier = "STANDARD"
+			}
+			alias_ip_range {
+				subnetwork_range_name = google_compute_subnetwork.inst-test-subnetwork2.secondary_ip_range[0].range_name
+				ip_cidr_range         = "173.16.0.0/24"
+			}
+		}
+	}
+`, suffix, suffix, suffix, suffix, instance)
 }
 
-func testAccComputeInstance_soleTenantNodeAffinitiesReduced(instance, nodeTemplate, nodeGroup string) string {
+func testAccComputeInstance_queueCountSet(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
-  family  = "debian-11"
-  project = "debian-cloud"
+	family  = "debian-11"
+	project = "debian-cloud"
 }
 
 resource "google_compute_instance" "foobar" {
-  name         = "%s"
-  machine_type = "n1-standard-8"   // can't be e2 because of sole tenancy
-  zone         = "us-central1-a"
-  allow_stopping_for_update = true
+	name         = "%s"
+	machine_type = "e2-medium"
+	zone         = "us-east1-d"
+	allow_stopping_for_update = true
 
-  boot_disk {
-    initialize_params {
-      image = data.google_compute_image.my_image.self_link
-    }
-  }
+	boot_disk {
+		initialize_params {
+			image = data.google_compute_image.my_image.id
+		}
+	}
 
   network_interface {
     network = "default"
+    queue_count = 2
   }
-
-  scheduling {
-    node_affinities {
-      key      = "tfacc"
-      operator = "IN"
-      values   = ["test", "updatedlabel"]
-    }
-
-    node_affinities {
-      key      = "compute.googleapis.com/node-group-name"
-      operator = "IN"
-      values   = [google_compute_node_group.nodes.name]
-    }
-
-    min_node_cpus = 6
-  }
-}
-
-resource "google_compute_node_template" "nodetmpl" {
-  name   = "%s"
-  region = "us-central1"
-
-  node_affinity_labels = {
-    tfacc = "test"
-  }
-
-  node_type = "n1-node-96-624"
-
-  cpu_overcommit_type = "ENABLED"
-}
-
-resource "google_compute_node_group" "nodes" {
-  name = "%s"
-  zone = "us-central1-a"
-
-  size          = 1
-  node_template = google_compute_node_template.nodetmpl.self_link
 }
-`, instance, nodeTemplate, nodeGroup)
+`, instance)
 }
 
-func testAccComputeInstance_reservationAffinity_nonSpecificReservationConfig(instanceName, reservationType string) string {
+func testAccComputeInstance_spotVM(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
-  family  = "debian-11"
-  project = "debian-cloud"
+  family    = "ubuntu-2004-lts"
+  project   = "ubuntu-os-cloud"
 }
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
-  machine_type = "n1-standard-1"
+  machine_type = "e2-medium"
   zone         = "us-central1-a"
 
   boot_disk {
@@ -6225,35 +7356,27 @@ resource "google_compute_instance" "foobar" {
     network = "default"
   }
 
-  reservation_affinity {
-    type = "%s"
+  scheduling {
+    provisioning_model = "SPOT"
+    automatic_restart = false
+    preemptible = true
+		instance_termination_action = "STOP"
   }
-}`, instanceName, reservationType)
 }
-
-func testAccComputeInstance_reservationAffinity_specificReservationConfig(instanceName string) string {
-	return fmt.Sprintf(`
-data "google_compute_image" "my_image" {
-  family  = "debian-11"
-  project = "debian-cloud"
+`, instance)
 }
 
-resource "google_compute_reservation" "reservation" {
-  name = "%s"
-  zone = "us-central1-a"
 
-  specific_reservation {
-    count = 1
-    instance_properties {
-      machine_type = "n1-standard-1"
-    }
-  }
-  specific_reservation_required = true
+func testAccComputeInstance_spotVM_maxRunDuration(instance string) string {
+	return fmt.Sprintf(`
+data "google_compute_image" "my_image" {
+  family    = "ubuntu-2004-lts"
+  project   = "ubuntu-os-cloud"
 }
 
 resource "google_compute_instance" "foobar" {
-  name         = "%[1]s"
-  machine_type = "n1-standard-1"
+  name         = "%s"
+  machine_type = "e2-medium"
   zone         = "us-central1-a"
 
   boot_disk {
@@ -6266,22 +7389,27 @@ resource "google_compute_instance" "foobar" {
     network = "default"
   }
 
-  reservation_affinity {
-    type = "SPECIFIC_RESERVATION"
-
-	specific_reservation {
-		key    = "compute.googleapis.com/reservation-name"
-		values = ["%[1]s"]
-	}
+  scheduling {
+    provisioning_model = "SPOT"
+    automatic_restart = false
+    preemptible = true
+    instance_termination_action = "DELETE"
+<% unless version == 'ga' -%>
+    max_run_duration {
+        nanos = 123
+        seconds = 60
+    }
+<% end -%>
   }
-}`, instanceName)
+}
+`, instance)
 }
 
-func testAccComputeInstance_shieldedVmConfig(instance string, enableSecureBoot bool, enableVtpm bool, enableIntegrityMonitoring bool) string {
+func testAccComputeInstance_localSsdRecoveryTimeout(instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
-  family  = "centos-7"
-  project = "centos-cloud"
+  family    = "ubuntu-2004-lts"
+  project   = "ubuntu-os-cloud"
 }
 
 resource "google_compute_instance" "foobar" {
@@ -6299,28 +7427,30 @@ resource "google_compute_instance" "foobar" {
     network = "default"
   }
 
-  shielded_instance_config {
-    enable_secure_boot          = %t
-    enable_vtpm                 = %t
-    enable_integrity_monitoring = %t
+  scheduling {
+    local_ssd_recovery_timeout {
+        nanos = 0
+        seconds = 3600
+    }
   }
 
-  allow_stopping_for_update = true
 }
-`, instance, enableSecureBoot, enableVtpm, enableIntegrityMonitoring)
+`, instance)
 }
 
-func testAccComputeInstanceConfidentialInstanceConfig(instance string, enableConfidentialCompute bool) string {
+func testAccComputeInstance_metadataStartupScript(instance, machineType, metadata string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
-  family    = "ubuntu-2004-lts"
-  project   = "ubuntu-os-cloud"
+  family  = "debian-11"
+  project = "debian-cloud"
 }
 
 resource "google_compute_instance" "foobar" {
-  name         = "%s"
-  machine_type = "n2d-standard-2"
-  zone         = "us-central1-a"
+  name           = "%s"
+  machine_type   = "%s"
+  zone           = "us-central1-a"
+  can_ip_forward = false
+  tags           = ["foo", "bar"]
 
   boot_disk {
     initialize_params {
@@ -6332,58 +7462,138 @@ resource "google_compute_instance" "foobar" {
     network = "default"
   }
 
-  confidential_instance_config {
-    enable_confidential_compute       = %t
-  }
-
-  scheduling {
-	  on_host_maintenance = "TERMINATE"
+  metadata = {
+    foo = "%s"
   }
-
+  metadata_startup_script = "echo hi > /test.txt"
+  allow_stopping_for_update = true
 }
-`, instance, enableConfidentialCompute)
+`, instance, machineType, metadata)
 }
 
-func testAccComputeInstance_enableDisplay(instance string) string {
-	return fmt.Sprintf(`
-data "google_compute_image" "my_image" {
-  family  = "centos-7"
-  project = "centos-cloud"
-}
 
-resource "google_compute_instance" "foobar" {
+func testAccComputeInstance_regionBootDisk(instance, diskName, suffix string) string {
+	return fmt.Sprintf(`
+resource "google_compute_instance" "regional_vm_instance" {
   name         = "%s"
   machine_type = "e2-medium"
-  zone         = "us-central1-a"
+  zone = "us-central1-c"
 
   boot_disk {
-    initialize_params {
-      image = data.google_compute_image.my_image.self_link
-    }
+    source = google_compute_region_disk.regionaldisk.self_link
   }
-
   network_interface {
-    network = "default"
+    network = google_compute_network.vpc_network.name
+    access_config {}
   }
+}
 
-  enable_display = true
+resource "google_compute_region_disk" "regionaldisk" {
+  name          = "%s"
+  type          = "pd-ssd"
+  region        = "us-central1"
+  replica_zones = ["us-central1-c", "us-central1-a"]
+  size          = 50
+  snapshot      = google_compute_snapshot.debian.id
+}
 
-  allow_stopping_for_update = true
+resource "google_compute_network" "vpc_network" {
+  name = "tf-test-%s"
 }
-`, instance)
+
+data "google_compute_image" "debian" {
+  family  = "debian-11"
+  project = "debian-cloud"
 }
 
-func testAccComputeInstance_enableDisplayUpdated(instance string) string {
+resource "google_compute_snapshot" "debian" {
+  name        = "tf-test-%s"
+  source_disk = google_compute_disk.debian.id
+}
+
+resource "google_compute_disk" "debian" {
+  name  = "tf-test-%s"
+  image = data.google_compute_image.debian.self_link
+  size  = 10
+  type  = "pd-ssd"
+  zone  = "us-central1-c"
+}
+`, instance, diskName, suffix, suffix, suffix)
+}
+
+<% unless version == 'ga' -%>
+func testAccComputeInstance_nic_securityPolicyCreateWithOneNicAndTwoAccessConfigs(suffix, policy, instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
-  family  = "centos-7"
-  project = "centos-cloud"
+  family  = "debian-11"
+  project = "debian-cloud"
+}
+
+# First activate advanced network DDoS protection for the desired region
+resource "google_compute_region_security_policy" "policyddosprotection" {
+  region      = "europe-west1"
+  name        = "tf-test-policyddosprotection-%s"
+  description = "region security policy for instance"
+  type        = "CLOUD_ARMOR_NETWORK"
+  ddos_protection_config {
+    ddos_protection = "ADVANCED_PREVIEW"
+  }
+}
+
+resource "google_compute_network_edge_security_service" "edge_sec_service" {
+  region          = "europe-west1"
+  name            = "tf-test-edgesecservice-%s"
+  description     = "My basic resource using security policy"
+  security_policy = google_compute_region_security_policy.policyddosprotection.self_link
+}
+
+resource "google_compute_network" "net" {
+  name                    = "tf-test-network-%s"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "subnet" {
+  region                     = "europe-west1"
+  name                       = "tf-test-subnet-%s"
+  ip_cidr_range              = "192.168.0.0/16"
+  purpose                    = "PRIVATE"
+  stack_type                 = "IPV4_ONLY"
+  network                    = google_compute_network.net.id
+}
+
+resource "google_compute_subnetwork" "subnet-ipv6" {
+  region                     = "europe-west1"
+  name                       = "tf-test-subnet-ip6-%s"
+  ip_cidr_range              = "10.0.0.0/22"
+  purpose                    = "PRIVATE"
+  stack_type                 = "IPV4_IPV6"
+  ipv6_access_type           = "EXTERNAL"
+  network                    = google_compute_network.net.id
+}
+
+resource "google_compute_address" "ipv6-address" {
+  region             = "europe-west1"
+  name               = "tf-test-addr-ipv6-%s"
+  address_type       = "EXTERNAL"
+  ip_version         = "IPV6"
+  network_tier       = "PREMIUM"
+  ipv6_endpoint_type = "VM"
+  subnetwork         = google_compute_subnetwork.subnet-ipv6.name
+}
+
+resource "google_compute_region_security_policy" "policyforinstance" {
+  region      = "europe-west1"
+  name        = "%s"
+  description = "region security policy to set to instance"
+  type        = "CLOUD_ARMOR_NETWORK"
+  depends_on  = [google_compute_network_edge_security_service.edge_sec_service]
 }
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
-  zone         = "us-central1-a"
+  zone         = "europe-west1-b"
+  tags         = ["foo", "bar"]
 
   boot_disk {
     initialize_params {
@@ -6392,142 +7602,229 @@ resource "google_compute_instance" "foobar" {
   }
 
   network_interface {
-    network = "default"
+    network = google_compute_network.net.self_link
+    subnetwork = google_compute_subnetwork.subnet-ipv6.self_link
+    stack_type = "IPV4_IPV6"
+    ipv6_access_config {
+      external_ipv6               = google_compute_address.ipv6-address.address
+      external_ipv6_prefix_length = 96
+      name                        = "external-ipv6-access-config"
+      network_tier                = "PREMIUM"
+    }
+    access_config {
+      network_tier = "STANDARD"
+    }
+    security_policy = google_compute_region_security_policy.policyforinstance.self_link
   }
 
-  enable_display = false
-
-  allow_stopping_for_update = true
+  metadata = {
+    foo = "bar"
+  }
 }
-`, instance)
+`, suffix, suffix, suffix, suffix, suffix, suffix, policy, instance)
 }
 
-func testAccComputeInstance_machineType_desiredStatus_allowStoppingForUpdate(
-	instance, machineType, desiredStatus string,
-	allowStoppingForUpdate bool,
-) string {
-	desiredStatusConfigSection := ""
-	if desiredStatus != "" {
-		desiredStatusConfigSection = fmt.Sprintf(
-			"desired_status = \"%s\"",
-			desiredStatus,
-		)
-	}
-
+func testAccComputeInstance_nic_securityPolicyCreateWithTwoAccessConfigsWithTwoSecurityPoliciesAndStatus(suffix, policy, instance, policyToSetOne, desiredStatus string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
-	family  = "debian-11"
-	project = "debian-cloud"
+  family  = "debian-11"
+  project = "debian-cloud"
 }
 
-resource "google_compute_instance" "foobar" {
-	name           = "%s"
-	machine_type   = "%s"
-	zone           = "us-central1-a"
-	can_ip_forward = false
-	tags           = ["foo", "bar"]
-
-	boot_disk {
-		initialize_params{
-			image = "${data.google_compute_image.my_image.self_link}"
-		}
-	}
-
-	network_interface {
-		network = "default"
-	}
-
-	%s
+# First activate advanced network DDoS protection for the desired region
+resource "google_compute_region_security_policy" "policyddosprotection" {
+  region      = "europe-west1"
+  name        = "tf-test-policyddosprotection-%s"
+  description = "region security policy for instance"
+  type        = "CLOUD_ARMOR_NETWORK"
+  ddos_protection_config {
+    ddos_protection = "ADVANCED_PREVIEW"
+  }
+}
 
-	metadata = {
-		foo = "bar"
-	}
+resource "google_compute_network_edge_security_service" "edge_sec_service" {
+  region          = "europe-west1"
+  name            = "tf-test-edgesecservice-%s"
+  description     = "My basic resource using security policy"
+  security_policy = google_compute_region_security_policy.policyddosprotection.self_link
+}
 
-	allow_stopping_for_update = %t
+resource "google_compute_network" "net" {
+  name                    = "tf-test-network-%s"
+  auto_create_subnetworks = false
 }
-`, instance, machineType, desiredStatusConfigSection, allowStoppingForUpdate)
+
+resource "google_compute_subnetwork" "subnet" {
+  region                     = "europe-west1"
+  name                       = "tf-test-subnet-%s"
+  ip_cidr_range              = "192.168.0.0/16"
+  purpose                    = "PRIVATE"
+  stack_type                 = "IPV4_ONLY"
+  network                    = google_compute_network.net.id
 }
 
-func testAccComputeInstance_desiredStatusTerminatedUpdate(instance string) string {
-	return fmt.Sprintf(`
-data "google_compute_image" "my_image" {
-	family  = "debian-11"
-	project = "debian-cloud"
+resource "google_compute_region_security_policy" "policyforinstance" {
+  region      = "europe-west1"
+  name        = "%s"
+  description = "region security policy to set to instance"
+  type        = "CLOUD_ARMOR_NETWORK"
+  depends_on  = [google_compute_network_edge_security_service.edge_sec_service]
 }
 
 resource "google_compute_instance" "foobar" {
-	name           = "%s"
-	machine_type   = "e2-medium"
-	zone           = "us-central1-a"
-	can_ip_forward = false
-	tags           = ["baz"]
-
-	boot_disk {
-		initialize_params{
-			image = "${data.google_compute_image.my_image.self_link}"
-		}
-	}
+  name         = "%s"
+  machine_type = "e2-medium"
+  zone         = "europe-west1-b"
+  tags         = ["foo", "bar"]
 
-	network_interface {
-		network = "default"
-	}
+  boot_disk {
+    initialize_params {
+      image = data.google_compute_image.my_image.self_link
+    }
+  }
 
-	desired_status = "TERMINATED"
+  network_interface {
+    network    = google_compute_network.net.self_link
+    subnetwork = google_compute_subnetwork.subnet.self_link
+	access_config {
+	  network_tier = "STANDARD"
+    }
+	security_policy = %s
+  }
 
-	metadata = {
-		bar = "baz"
-	}
+  metadata = {
+    foo = "bar"
+  }
 
-	labels = {
-		only_me = "nothing_else"
-	}
+  desired_status = "%s"
 }
-`, instance)
+`, suffix, suffix, suffix, suffix, policy, instance, policyToSetOne, desiredStatus)
 }
 
-func testAccComputeInstance_resourcePolicyCollocate(instance, suffix string) string {
+func testAccComputeInstance_nic_securityPolicyCreateWithTwoNicsAndTwoAccessConfigsUpdateTwoPolicies(suffix, policy, policy2, instance, policyToSetOne, policyToSetTwo string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
-resource "google_compute_instance" "foobar" {
-  name           = "%s"
-  machine_type   = "c2-standard-4"
-  zone           = "us-east4-b"
-  can_ip_forward = false
-  tags           = ["foo", "bar"]
+# First activate advanced network DDoS protection for the desired region
+resource "google_compute_region_security_policy" "policyddosprotection" {
+  region      = "europe-west1"
+  name        = "tf-test-policyddosprotection-%s"
+  description = "region security policy for instance"
+  type        = "CLOUD_ARMOR_NETWORK"
+  ddos_protection_config {
+    ddos_protection = "ADVANCED_PREVIEW"
+  }
+}
 
-  //deletion_protection = false is implicit in this config due to default value
+resource "google_compute_network_edge_security_service" "edge_sec_service" {
+  region          = "europe-west1"
+  name            = "tf-test-edgesecservice-%s"
+  description     = "My basic resource using security policy"
+  security_policy = google_compute_region_security_policy.policyddosprotection.self_link
+}
 
-  boot_disk {
-    initialize_params {
-      image = data.google_compute_image.my_image.self_link
-    }
-  }
+resource "google_compute_network" "net" {
+  name                    = "tf-test-network-%s"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "subnet" {
+  region                     = "europe-west1"
+  name                       = "tf-test-subnet-%s"
+  ip_cidr_range              = "192.168.0.0/16"
+  purpose                    = "PRIVATE"
+  stack_type                 = "IPV4_ONLY"
+  network                    = google_compute_network.net.id
+}
+
+resource "google_compute_subnetwork" "subnet-ipv6" {
+  region                     = "europe-west1"
+  name                       = "tf-test-subnet-ip6-%s"
+  ip_cidr_range              = "10.0.0.0/22"
+  purpose                    = "PRIVATE"
+  stack_type                 = "IPV4_IPV6"
+  ipv6_access_type           = "EXTERNAL"
+  network                    = google_compute_network.net.id
+}
+
+resource "google_compute_address" "normal-address" {
+  region   = "europe-west1"
+  name     = "tf-test-addr-normal-%s"
+}
+
+resource "google_compute_address" "ipv6-address" {
+  region             = "europe-west1"
+  name               = "tf-test-addr-ipv6-%s"
+  address_type       = "EXTERNAL"
+  ip_version         = "IPV6"
+  network_tier       = "PREMIUM"
+  ipv6_endpoint_type = "VM"
+  subnetwork         = google_compute_subnetwork.subnet-ipv6.name
+}
 
-  network_interface {
-    network = "default"
-  }
+resource "google_compute_network" "net2" {
+  name                    = "tf-test-network2-%s"
+  auto_create_subnetworks = false
+}
 
-  scheduling {
-    # Instances with resource policies do not support live migration.
-    on_host_maintenance = "TERMINATE"
-    automatic_restart = false
-  }
+resource "google_compute_subnetwork" "subnet2" {
+  region                     = "europe-west1"
+  name                       = "tf-test-subnet2-%s"
+  ip_cidr_range              = "192.170.0.0/20"
+  purpose                    = "PRIVATE"
+  stack_type                 = "IPV4_ONLY"
+  network                    = google_compute_network.net2.id
+}
+  
+resource "google_compute_subnetwork" "subnet-ipv62" {
+  region                     = "europe-west1"
+  name                       = "tf-test-subnet-ip62-%s"
+  ip_cidr_range              = "10.10.0.0/20"
+  purpose                    = "PRIVATE"
+  stack_type                 = "IPV4_IPV6"
+  ipv6_access_type           = "EXTERNAL"
+  network                    = google_compute_network.net2.id
+}
+
+resource "google_compute_address" "normal-address2" {
+  region   = "europe-west1"
+  name     = "tf-test-addr-normal2-%s"
+}
+  
+resource "google_compute_address" "ipv6-address2" {
+  region             = "europe-west1"
+  name               = "tf-test-addr-ipv62-%s"
+  address_type       = "EXTERNAL"
+  ip_version         = "IPV6"
+  network_tier       = "PREMIUM"
+  ipv6_endpoint_type = "VM"
+  subnetwork         = google_compute_subnetwork.subnet-ipv62.name
+}
 
-  resource_policies = [google_compute_resource_policy.foo.self_link]
+resource "google_compute_region_security_policy" "policyforinstance" {
+  region      = "europe-west1"
+  name        = "%s"
+  description = "region security policy to set to instance"
+  type        = "CLOUD_ARMOR_NETWORK"
+  depends_on  = [google_compute_network_edge_security_service.edge_sec_service]
 }
 
-resource "google_compute_instance" "second" {
-  name           = "%s-2"
-  machine_type   = "c2-standard-4"
-  zone           = "us-east4-b"
-  can_ip_forward = false
-  tags           = ["foo", "bar"]
+resource "google_compute_region_security_policy" "policyforinstance2" {
+  region      = "europe-west1"
+  name        = "%s"
+  description = "region security policy 2 to set to instance"
+  type        = "CLOUD_ARMOR_NETWORK"
+  depends_on  = [google_compute_network_edge_security_service.edge_sec_service]
+}
 
-  //deletion_protection = false is implicit in this config due to default value
+resource "google_compute_instance" "foobar" {
+  name         = "%s"
+  machine_type = "e2-medium"
+  zone         = "europe-west1-b"
+  tags         = ["foo", "bar"]
 
   boot_disk {
     initialize_params {
@@ -6536,220 +7833,170 @@ resource "google_compute_instance" "second" {
   }
 
   network_interface {
-    network = "default"
+    network    = google_compute_network.net.self_link
+    subnetwork = google_compute_subnetwork.subnet-ipv6.self_link
+    stack_type = "IPV4_IPV6"
+    ipv6_access_config {
+      external_ipv6               = google_compute_address.ipv6-address.address
+      external_ipv6_prefix_length = 96
+      name                        = "external-ipv6-access-config"
+      network_tier                = "PREMIUM"
+    }
+	access_config {
+	  network_tier = "PREMIUM"
+      nat_ip = google_compute_address.normal-address.address
+    }
+	security_policy = %s
   }
 
-  scheduling {
-    # Instances with resource policies do not support live migration.
-    on_host_maintenance = "TERMINATE"
-    automatic_restart = false
+  network_interface {
+    network    = google_compute_network.net2.self_link
+    subnetwork = google_compute_subnetwork.subnet-ipv62.self_link
+    stack_type = "IPV4_IPV6"
+    ipv6_access_config {
+      external_ipv6               = google_compute_address.ipv6-address2.address
+      external_ipv6_prefix_length = 96
+      name                        = "external-ipv6-access-config"
+      network_tier                = "PREMIUM"
+    }
+	access_config {
+	  network_tier = "PREMIUM"
+      nat_ip = google_compute_address.normal-address2.address
+    }
+	security_policy = %s
   }
 
-  resource_policies = [google_compute_resource_policy.foo.self_link]
-}
-
-resource "google_compute_resource_policy" "foo" {
-  name   = "tf-test-policy-%s"
-  region = "us-east4"
-  group_placement_policy {
-    vm_count = 2
-    collocation = "COLLOCATED"
+  metadata = {
+    foo = "bar"
   }
 }
-
-`, instance, instance, suffix)
+`, suffix, suffix, suffix, suffix, suffix, suffix, suffix, suffix, suffix, suffix, suffix, suffix, policy, policy2, instance, policyToSetOne, policyToSetTwo)
 }
 
-func testAccComputeInstance_subnetworkUpdate(suffix, instance string) string {
+func testAccComputeInstance_nic_securityPolicyCreateWithTwoNicsAndTwoAccessConfigsUpdateTwoPoliciesRemoveAccessConfig(suffix, policy, policy2, instance, policyToSetOne, policyToSetTwo string) string {
 	return fmt.Sprintf(`
-	data "google_compute_image" "my_image" {
-		family  = "debian-11"
-		project = "debian-cloud"
-	}
-
-	resource "google_compute_network" "inst-test-network" {
-		name = "tf-test-network-%s"
-		auto_create_subnetworks = false
-	}
-
-	resource "google_compute_network" "inst-test-network2" {
-		name = "tf-test-network2-%s"
-		auto_create_subnetworks = false
-	}
-
-	resource "google_compute_subnetwork" "inst-test-subnetwork" {
-		name          = "tf-test-compute-subnet-%s"
-		ip_cidr_range = "10.0.0.0/16"
-		region        = "us-east1"
-		network       = google_compute_network.inst-test-network.id
-		secondary_ip_range {
-			range_name    = "inst-test-secondary"
-			ip_cidr_range = "172.16.0.0/20"
-		}
-		secondary_ip_range {
-			range_name    = "inst-test-tertiary"
-			ip_cidr_range = "10.1.0.0/16"
-		}
-	}
-
-	resource "google_compute_subnetwork" "inst-test-subnetwork2" {
-		name          = "tf-test-compute-subnet2-%s"
-		ip_cidr_range = "10.3.0.0/16"
-		region        = "us-east1"
-		network       = google_compute_network.inst-test-network2.id
-		secondary_ip_range {
-			range_name    = "inst-test-secondary2"
-			ip_cidr_range = "173.16.0.0/20"
-		}
-		secondary_ip_range {
-			range_name    = "inst-test-tertiary2"
-			ip_cidr_range = "10.4.0.0/16"
-		}
-	}
-
-	resource "google_compute_instance" "foobar" {
-		name         = "%s"
-		machine_type = "e2-medium"
-		zone         = "us-east1-d"
-		allow_stopping_for_update = true
-
-		boot_disk {
-			initialize_params {
-				image = data.google_compute_image.my_image.id
-			}
-		}
-
-		network_interface {
-			subnetwork = google_compute_subnetwork.inst-test-subnetwork.id
-			access_config {
-				network_tier = "STANDARD"
-			}
-			alias_ip_range {
-				subnetwork_range_name = google_compute_subnetwork.inst-test-subnetwork.secondary_ip_range[0].range_name
-				ip_cidr_range         = "172.16.0.0/24"
-			}
-
-			alias_ip_range {
-				subnetwork_range_name = google_compute_subnetwork.inst-test-subnetwork.secondary_ip_range[1].range_name
-				ip_cidr_range         = "10.1.0.0/20"
-			}
-		}
-	}
-`, suffix, suffix, suffix, suffix, instance)
+data "google_compute_image" "my_image" {
+  family  = "debian-11"
+  project = "debian-cloud"
 }
 
-func testAccComputeInstance_subnetworkUpdateTwo(suffix, instance string) string {
-	return fmt.Sprintf(`
-	data "google_compute_image" "my_image" {
-		family  = "debian-11"
-		project = "debian-cloud"
-	}
-
-	resource "google_compute_network" "inst-test-network" {
-		name = "tf-test-network-%s"
-		auto_create_subnetworks = false
-	}
-
-	resource "google_compute_network" "inst-test-network2" {
-		name = "tf-test-network2-%s"
-		auto_create_subnetworks = false
-	}
-
-	resource "google_compute_subnetwork" "inst-test-subnetwork" {
-		name          = "tf-test-compute-subnet-%s"
-		ip_cidr_range = "10.0.0.0/16"
-		region        = "us-east1"
-		network       = google_compute_network.inst-test-network.id
-		secondary_ip_range {
-			range_name    = "inst-test-secondary"
-			ip_cidr_range = "172.16.0.0/20"
-		}
-		secondary_ip_range {
-			range_name    = "inst-test-tertiary"
-			ip_cidr_range = "10.1.0.0/16"
-		}
-	}
-
-	resource "google_compute_subnetwork" "inst-test-subnetwork2" {
-		name          = "tf-test-compute-subnet2-%s"
-		ip_cidr_range = "10.3.0.0/16"
-		region        = "us-east1"
-		network       = google_compute_network.inst-test-network2.id
-		secondary_ip_range {
-			range_name    = "inst-test-secondary2"
-			ip_cidr_range = "173.16.0.0/20"
-		}
-		secondary_ip_range {
-			range_name    = "inst-test-tertiary2"
-			ip_cidr_range = "10.4.0.0/16"
-		}
-	}
+# First activate advanced network DDoS protection for the desired region
+resource "google_compute_region_security_policy" "policyddosprotection" {
+  region      = "europe-west1"
+  name        = "tf-test-policyddosprotection-%s"
+  description = "region security policy for instance"
+  type        = "CLOUD_ARMOR_NETWORK"
+  ddos_protection_config {
+    ddos_protection = "ADVANCED_PREVIEW"
+  }
+}
 
-	resource "google_compute_instance" "foobar" {
-		name         = "%s"
-		machine_type = "e2-medium"
-		zone         = "us-east1-d"
-		allow_stopping_for_update = true
+resource "google_compute_network_edge_security_service" "edge_sec_service" {
+  region          = "europe-west1"
+  name            = "tf-test-edgesecservice-%s"
+  description     = "My basic resource using security policy"
+  security_policy = google_compute_region_security_policy.policyddosprotection.self_link
+}
 
-		boot_disk {
-			initialize_params {
-				image = data.google_compute_image.my_image.id
-			}
-		}
+resource "google_compute_network" "net" {
+  name                    = "tf-test-network-%s"
+  auto_create_subnetworks = false
+}
 
-		network_interface {
-			subnetwork = google_compute_subnetwork.inst-test-subnetwork2.id
-			network_ip = "10.3.0.3"
-			access_config {
-				network_tier = "STANDARD"
-			}
-			alias_ip_range {
-				subnetwork_range_name = google_compute_subnetwork.inst-test-subnetwork2.secondary_ip_range[0].range_name
-				ip_cidr_range         = "173.16.0.0/24"
-			}
-		}
-	}
-`, suffix, suffix, suffix, suffix, instance)
+resource "google_compute_subnetwork" "subnet" {
+  region                     = "europe-west1"
+  name                       = "tf-test-subnet-%s"
+  ip_cidr_range              = "192.168.0.0/16"
+  purpose                    = "PRIVATE"
+  stack_type                 = "IPV4_ONLY"
+  network                    = google_compute_network.net.id
 }
 
-func testAccComputeInstance_queueCountSet(instance string) string {
-	return fmt.Sprintf(`
-data "google_compute_image" "my_image" {
-	family  = "debian-11"
-	project = "debian-cloud"
+resource "google_compute_subnetwork" "subnet-ipv6" {
+  region                     = "europe-west1"
+  name                       = "tf-test-subnet-ip6-%s"
+  ip_cidr_range              = "10.0.0.0/22"
+  purpose                    = "PRIVATE"
+  stack_type                 = "IPV4_IPV6"
+  ipv6_access_type           = "EXTERNAL"
+  network                    = google_compute_network.net.id
 }
 
-resource "google_compute_instance" "foobar" {
-	name         = "%s"
-	machine_type = "e2-medium"
-	zone         = "us-east1-d"
-	allow_stopping_for_update = true
+resource "google_compute_address" "normal-address" {
+  region   = "europe-west1"
+  name     = "tf-test-addr-normal-%s"
+}
 
-	boot_disk {
-		initialize_params {
-			image = data.google_compute_image.my_image.id
-		}
-	}
+resource "google_compute_address" "ipv6-address" {
+  region             = "europe-west1"
+  name               = "tf-test-addr-ipv6-%s"
+  address_type       = "EXTERNAL"
+  ip_version         = "IPV6"
+  network_tier       = "PREMIUM"
+  ipv6_endpoint_type = "VM"
+  subnetwork         = google_compute_subnetwork.subnet-ipv6.name
+}
 
-  network_interface {
-    network = "default"
-    queue_count = 2
-  }
+resource "google_compute_network" "net2" {
+  name                    = "tf-test-network2-%s"
+  auto_create_subnetworks = false
 }
-`, instance)
+
+resource "google_compute_subnetwork" "subnet2" {
+  region                     = "europe-west1"
+  name                       = "tf-test-subnet2-%s"
+  ip_cidr_range              = "192.170.0.0/20"
+  purpose                    = "PRIVATE"
+  stack_type                 = "IPV4_ONLY"
+  network                    = google_compute_network.net2.id
+}
+  
+resource "google_compute_subnetwork" "subnet-ipv62" {
+  region                     = "europe-west1"
+  name                       = "tf-test-subnet-ip62-%s"
+  ip_cidr_range              = "10.10.0.0/20"
+  purpose                    = "PRIVATE"
+  stack_type                 = "IPV4_IPV6"
+  ipv6_access_type           = "EXTERNAL"
+  network                    = google_compute_network.net2.id
+}
+
+resource "google_compute_address" "normal-address2" {
+  region   = "europe-west1"
+  name     = "tf-test-addr-normal2-%s"
+}
+  
+resource "google_compute_address" "ipv6-address2" {
+  region             = "europe-west1"
+  name               = "tf-test-addr-ipv62-%s"
+  address_type       = "EXTERNAL"
+  ip_version         = "IPV6"
+  network_tier       = "PREMIUM"
+  ipv6_endpoint_type = "VM"
+  subnetwork         = google_compute_subnetwork.subnet-ipv62.name
 }
 
-func testAccComputeInstance_spotVM(instance string) string {
-	return fmt.Sprintf(`
-data "google_compute_image" "my_image" {
-  family    = "ubuntu-2004-lts"
-  project   = "ubuntu-os-cloud"
+resource "google_compute_region_security_policy" "policyforinstance" {
+  region      = "europe-west1"
+  name        = "%s"
+  description = "region security policy to set to instance"
+  type        = "CLOUD_ARMOR_NETWORK"
+  depends_on  = [google_compute_network_edge_security_service.edge_sec_service]
+}
+
+resource "google_compute_region_security_policy" "policyforinstance2" {
+  region      = "europe-west1"
+  name        = "%s"
+  description = "region security policy 2 to set to instance"
+  type        = "CLOUD_ARMOR_NETWORK"
+  depends_on  = [google_compute_network_edge_security_service.edge_sec_service]
 }
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
-  zone         = "us-central1-a"
+  zone         = "europe-west1-b"
+  tags         = ["foo", "bar"]
 
   boot_disk {
     initialize_params {
@@ -6758,31 +8005,80 @@ resource "google_compute_instance" "foobar" {
   }
 
   network_interface {
-    network = "default"
+    network    = google_compute_network.net.self_link
+    subnetwork = google_compute_subnetwork.subnet-ipv6.self_link
+    stack_type = "IPV4_IPV6"
+    ipv6_access_config {
+      external_ipv6               = google_compute_address.ipv6-address.address
+      external_ipv6_prefix_length = 96
+      name                        = "external-ipv6-access-config"
+      network_tier                = "PREMIUM"
+    }
+	# access config removed
+	security_policy = %s
   }
 
-  scheduling {
-    provisioning_model = "SPOT"
-    automatic_restart = false
-    preemptible = true
-		instance_termination_action = "STOP"
+  network_interface {
+    network    = google_compute_network.net2.self_link
+    subnetwork = google_compute_subnetwork.subnet-ipv62.self_link
+    stack_type = "IPV4_IPV6"
+    ipv6_access_config {
+      external_ipv6               = google_compute_address.ipv6-address2.address
+      external_ipv6_prefix_length = 96
+      name                        = "external-ipv6-access-config"
+      network_tier                = "PREMIUM"
+    }
+	# access config removed
+	security_policy = %s
+  }
+
+  metadata = {
+    foo = "bar"
   }
 }
-`, instance)
+`, suffix, suffix, suffix, suffix, suffix, suffix, suffix, suffix, suffix, suffix, suffix, suffix, policy, policy2, instance, policyToSetOne, policyToSetTwo)
 }
 
-
-func testAccComputeInstance_spotVM_maxRunDuration(instance string) string {
+func testAccComputeInstance_nic_securityPolicyCreateWithTwoNicsAndAccessConfigsWithEmptyAndNullSecurityPolicies(suffix, instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
-  family    = "ubuntu-2004-lts"
-  project   = "ubuntu-os-cloud"
+  family  = "debian-11"
+  project = "debian-cloud"
+}
+
+resource "google_compute_network" "net" {
+  name                    = "tf-test-network-%s"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "subnet" {
+  region                     = "europe-west1"
+  name                       = "tf-test-subnet-%s"
+  ip_cidr_range              = "192.168.0.0/16"
+  purpose                    = "PRIVATE"
+  stack_type                 = "IPV4_ONLY"
+  network                    = google_compute_network.net.id
+}
+
+resource "google_compute_network" "net2" {
+  name                    = "tf-test-network2-%s"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "subnet2" {
+  region                     = "europe-west1"
+  name                       = "tf-test-subnet2-%s"
+  ip_cidr_range              = "192.170.0.0/20"
+  purpose                    = "PRIVATE"
+  stack_type                 = "IPV4_ONLY"
+  network                    = google_compute_network.net2.id
 }
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
-  zone         = "us-central1-a"
+  zone         = "europe-west1-b"
+  tags         = ["foo", "bar"]
 
   boot_disk {
     initialize_params {
@@ -6791,36 +8087,107 @@ resource "google_compute_instance" "foobar" {
   }
 
   network_interface {
-    network = "default"
+    network    = google_compute_network.net.self_link
+    subnetwork = google_compute_subnetwork.subnet.self_link
+	access_config {
+	  network_tier = "STANDARD"
+    }
+	security_policy = ""
   }
 
-  scheduling {
-    provisioning_model = "SPOT"
-    automatic_restart = false
-    preemptible = true
-    instance_termination_action = "DELETE"
-<% unless version == 'ga' -%>
-    max_run_duration {
-        nanos = 123
-        seconds = 60
+  network_interface {
+    network    = google_compute_network.net2.self_link
+    subnetwork = google_compute_subnetwork.subnet2.self_link
+	access_config {
+	  network_tier = "STANDARD"
     }
-<% end -%>
+	security_policy = null
+  }
+
+  metadata = {
+    foo = "bar"
   }
 }
-`, instance)
+`, suffix, suffix, suffix, suffix, instance)
 }
 
-func testAccComputeInstance_localSsdRecoveryTimeout(instance string) string {
+func testAccComputeInstance_nic_securityPolicyCreateWithTwoAccessConfigsUpdateAccessConfig(suffix, policy, instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
-  family    = "ubuntu-2004-lts"
-  project   = "ubuntu-os-cloud"
+  family  = "debian-11"
+  project = "debian-cloud"
+}
+
+# First activate advanced network DDoS protection for the desired region
+resource "google_compute_region_security_policy" "policyddosprotection" {
+  region      = "europe-west1"
+  name        = "tf-test-policyddosprotection-%s"
+  description = "region security policy for instance"
+  type        = "CLOUD_ARMOR_NETWORK"
+  ddos_protection_config {
+    ddos_protection = "ADVANCED_PREVIEW"
+  }
+}
+
+resource "google_compute_network_edge_security_service" "edge_sec_service" {
+  region          = "europe-west1"
+  name            = "tf-test-edgesecservice-%s"
+  description     = "My basic resource using security policy"
+  security_policy = google_compute_region_security_policy.policyddosprotection.self_link
+}
+
+resource "google_compute_network" "net" {
+  name                    = "tf-test-network-%s"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "subnet" {
+  region                     = "europe-west1"
+  name                       = "tf-test-subnet-%s"
+  ip_cidr_range              = "192.168.0.0/16"
+  purpose                    = "PRIVATE"
+  stack_type                 = "IPV4_ONLY"
+  network                    = google_compute_network.net.id
+}
+
+resource "google_compute_subnetwork" "subnet-ipv6" {
+  region                     = "europe-west1"
+  name                       = "tf-test-subnet-ip6-%s"
+  ip_cidr_range              = "10.0.0.0/22"
+  purpose                    = "PRIVATE"
+  stack_type                 = "IPV4_IPV6"
+  ipv6_access_type           = "EXTERNAL"
+  network                    = google_compute_network.net.id
+}
+
+resource "google_compute_address" "normal-address" {
+  region   = "europe-west1"
+  name     = "tf-test-addr-normal-%s"
+}
+
+resource "google_compute_address" "ipv6-address" {
+  region             = "europe-west1"
+  name               = "tf-test-addr-ipv6-%s"
+  address_type       = "EXTERNAL"
+  ip_version         = "IPV6"
+  network_tier       = "PREMIUM"
+  ipv6_endpoint_type = "VM"
+  subnetwork         = google_compute_subnetwork.subnet-ipv6.name
+}
+
+resource "google_compute_region_security_policy" "policyforinstance" {
+  region      = "europe-west1"
+  name        = "%s"
+  description = "region security policy to set to instance"
+  type        = "CLOUD_ARMOR_NETWORK"
+  depends_on  = [google_compute_network_edge_security_service.edge_sec_service]
 }
 
 resource "google_compute_instance" "foobar" {
   name         = "%s"
   machine_type = "e2-medium"
-  zone         = "us-central1-a"
+  zone         = "europe-west1-b"
+  tags         = ["foo", "bar"]
 
   boot_disk {
     initialize_params {
@@ -6829,33 +8196,106 @@ resource "google_compute_instance" "foobar" {
   }
 
   network_interface {
-    network = "default"
-  }
-
-  scheduling {
-    local_ssd_recovery_timeout {
-        nanos = 0
-        seconds = 3600
+    network = google_compute_network.net.self_link
+    subnetwork = google_compute_subnetwork.subnet-ipv6.self_link
+    stack_type = "IPV4_IPV6"
+    ipv6_access_config {
+      external_ipv6               = google_compute_address.ipv6-address.address
+      external_ipv6_prefix_length = 96
+      name                        = "external-ipv6-access-config"
+      network_tier                = "PREMIUM"
+    }
+	access_config {
+	  network_tier = "PREMIUM"
+      nat_ip = google_compute_address.normal-address.address
     }
+	security_policy = google_compute_region_security_policy.policyforinstance.self_link
   }
 
+  metadata = {
+    foo = "bar"
+  }
 }
-`, instance)
+`, suffix, suffix, suffix, suffix, suffix, suffix, suffix, policy, instance)
 }
 
-func testAccComputeInstance_metadataStartupScript(instance, machineType, metadata string) string {
+func testAccComputeInstance_nic_securityPolicyCreateWithTwoAccessConfigsRemoveAccessConfig(suffix, policy, instance string) string {
 	return fmt.Sprintf(`
 data "google_compute_image" "my_image" {
   family  = "debian-11"
   project = "debian-cloud"
 }
 
+# First activate advanced network DDoS protection for the desired region
+resource "google_compute_region_security_policy" "policyddosprotection" {
+  region      = "europe-west1"
+  name        = "tf-test-policyddosprotection-%s"
+  description = "region security policy for instance"
+  type        = "CLOUD_ARMOR_NETWORK"
+  ddos_protection_config {
+    ddos_protection = "ADVANCED_PREVIEW"
+  }
+}
+
+resource "google_compute_network_edge_security_service" "edge_sec_service" {
+  region          = "europe-west1"
+  name            = "tf-test-edgesecservice-%s"
+  description     = "My basic resource using security policy"
+  security_policy = google_compute_region_security_policy.policyddosprotection.self_link
+}
+
+resource "google_compute_network" "net" {
+  name                    = "tf-test-network-%s"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "subnet" {
+  region                     = "europe-west1"
+  name                       = "tf-test-subnet-%s"
+  ip_cidr_range              = "192.168.0.0/16"
+  purpose                    = "PRIVATE"
+  stack_type                 = "IPV4_ONLY"
+  network                    = google_compute_network.net.id
+}
+
+resource "google_compute_subnetwork" "subnet-ipv6" {
+  region                     = "europe-west1"
+  name                       = "tf-test-subnet-ip6-%s"
+  ip_cidr_range              = "10.0.0.0/22"
+  purpose                    = "PRIVATE"
+  stack_type                 = "IPV4_IPV6"
+  ipv6_access_type           = "EXTERNAL"
+  network                    = google_compute_network.net.id
+}
+
+resource "google_compute_address" "normal-address" {
+  region   = "europe-west1"
+  name     = "tf-test-addr-normal-%s"
+}
+
+resource "google_compute_address" "ipv6-address" {
+  region             = "europe-west1"
+  name               = "tf-test-addr-ipv6-%s"
+  address_type       = "EXTERNAL"
+  ip_version         = "IPV6"
+  network_tier       = "PREMIUM"
+  ipv6_endpoint_type = "VM"
+  subnetwork         = google_compute_subnetwork.subnet-ipv6.name
+}
+
+resource "google_compute_region_security_policy" "policyforinstance" {
+  region      = "europe-west1"
+  name        = "%s"
+  description = "region security policy to set to instance"
+  type        = "CLOUD_ARMOR_NETWORK"
+  depends_on  = [google_compute_network_edge_security_service.edge_sec_service]
+}
+
 resource "google_compute_instance" "foobar" {
-  name           = "%s"
-  machine_type   = "%s"
-  zone           = "us-central1-a"
-  can_ip_forward = false
-  tags           = ["foo", "bar"]
+  name         = "%s"
+  machine_type = "e2-medium"
+  zone         = "europe-west1-b"
+  tags         = ["foo", "bar"]
 
   boot_disk {
     initialize_params {
@@ -6864,64 +8304,156 @@ resource "google_compute_instance" "foobar" {
   }
 
   network_interface {
-    network = "default"
+    network = google_compute_network.net.self_link
+    subnetwork = google_compute_subnetwork.subnet-ipv6.self_link
+    stack_type = "IPV4_IPV6"
+    # remove all access config
+	security_policy = google_compute_region_security_policy.policyforinstance.self_link
   }
 
   metadata = {
-    foo = "%s"
+    foo = "bar"
   }
-  metadata_startup_script = "echo hi > /test.txt"
-  allow_stopping_for_update = true
 }
-`, instance, machineType, metadata)
+`, suffix, suffix, suffix, suffix, suffix, suffix, suffix, policy, instance)
 }
 
+<% end -%>
 
-func testAccComputeInstance_regionBootDisk(instance, diskName, suffix string) string {
-	return fmt.Sprintf(`
-resource "google_compute_instance" "regional_vm_instance" {
-  name         = "%s"
+<% if version =="beta"%>
+func testAccComputeInstance_networkAttachment(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+data "google_compute_image" "my_image" {
+  family  = "debian-11"
+  project = "debian-cloud"
+}
+
+resource "google_compute_network" "test-network"{
+	name = "tf-test-network-%{suffix}"
+	auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "test-subnetwork" {
+	name          = "tf-test-compute-subnet-%{suffix}"
+	ip_cidr_range = "10.0.0.0/16"
+	region        = "us-central1"
+	network       = google_compute_network.test-network.id
+}
+
+resource "google_compute_network_attachment" "test_network_attachment" {
+	name = "%{network_attachment_name}"
+    region = "us-central1"
+    description = "network attachment description"
+    connection_preference = "ACCEPT_AUTOMATIC"
+
+    subnetworks = [
+        google_compute_subnetwork.test-subnetwork.self_link
+    ]
+}
+
+resource "google_compute_instance" "foobar" {
+  name         = "tf-test-instance-%{suffix}"
   machine_type = "e2-medium"
-  zone = "us-central1-c"
 
-  boot_disk {
-    source = google_compute_region_disk.regionaldisk.self_link
-  }
-  network_interface {
-    network = google_compute_network.vpc_network.name
-    access_config {}
-  }
+	boot_disk {
+		initialize_params {
+			image = data.google_compute_image.my_image.id
+		}
+	}
+
+	network_interface {
+		network = "default"
+	}
+
+	network_interface{
+		network_attachment = google_compute_network_attachment.test_network_attachment.self_link
+	}
+
+	metadata = {
+		foo = "bar"
+	}
+}
+`, context)
 }
 
-resource "google_compute_region_disk" "regionaldisk" {
-  name          = "%s"
-  type          = "pd-ssd"
-  region        = "us-central1"
-  replica_zones = ["us-central1-c", "us-central1-a"]
-  size          = 50
-  snapshot      = google_compute_snapshot.debian.id
+func testAccComputeInstance_networkAttachmentUpdate(networkAttachment, region, suffix string) string {
+	return fmt.Sprintf(`
+data "google_compute_image" "my_image" {
+	family  = "debian-11"
+	project = "debian-cloud"
 }
 
-resource "google_compute_network" "vpc_network" {
-  name = "tf-test-%s"
+resource "google_compute_network" "consumer_vpc_1" {
+	name = "tf-test-consumer-net-1-%s"
+	auto_create_subnetworks = false
 }
 
-data "google_compute_image" "debian" {
-  family  = "debian-11"
-  project = "debian-cloud"
+resource "google_compute_network" "consumer_vpc_2" {
+	name = "tf-test-consumer-net-2-%s"
+	auto_create_subnetworks = false
 }
 
-resource "google_compute_snapshot" "debian" {
-  name        = "tf-test-%s"
-  source_disk = google_compute_disk.debian.id
+resource "google_compute_subnetwork" "consumer_subnet_1" {
+	name          = "tf-test-consumer-subnet-1-%s"
+	ip_cidr_range = "10.0.0.0/16"
+	region        = "%s"
+	network       = google_compute_network.consumer_vpc_1.id
 }
 
-resource "google_compute_disk" "debian" {
-  name  = "tf-test-%s"
-  image = data.google_compute_image.debian.self_link
-  size  = 10
-  type  = "pd-ssd"
-  zone  = "us-central1-c"
+resource "google_compute_subnetwork" "consumer_subnet_2" {
+	name          = "tf-test-consumer-subnet-2-%s"
+	ip_cidr_range = "10.3.0.0/16"
+	region        = "%s"
+	network       = google_compute_network.consumer_vpc_2.id
 }
-`, instance, diskName, suffix, suffix, suffix)
+
+resource "google_compute_network_attachment" "test_network_attachment_1" {
+	name = "tf-test-network-attachment-1-%s"
+    region = "%s"
+    description = "network attachment 1 description"
+    connection_preference = "ACCEPT_AUTOMATIC"
+
+    subnetworks = [
+        google_compute_subnetwork.consumer_subnet_1.self_link
+    ]
+}
+
+resource "google_compute_network_attachment" "test_network_attachment_2" {
+	name = "tf-test-network-attachment-2-%s"
+    region = "%s"
+    description = "network attachment 2 description"
+    connection_preference = "ACCEPT_AUTOMATIC"
+
+    subnetworks = [
+        google_compute_subnetwork.consumer_subnet_2.self_link
+    ]
+}
+
+resource "google_compute_instance" "foobar" {
+	name         = "tf-test-compute-instance-%s"
+	machine_type = "e2-medium"
+	zone         = "%s-a"
+	allow_stopping_for_update = true
+
+	boot_disk {
+		initialize_params {
+			image = data.google_compute_image.my_image.self_link
+		}
+	}
+
+	network_interface {
+		network = "default"
+	}
+
+	network_interface{
+		network_attachment = %s
+	}
+
+	metadata = {
+		foo = "bar"
+	}
 }
+`, suffix, suffix, suffix, region, suffix, region, suffix, region, suffix, region, suffix, region, networkAttachment)
+}
+<% end %>
+
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_network_endpoints_test.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_network_endpoints_test.go.erb
index a9cefd1a4699..5675e5dc8d7c 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_network_endpoints_test.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_network_endpoints_test.go.erb
@@ -44,6 +44,7 @@ func TestAccComputeNetworkEndpoints_networkEndpointsBasic(t *testing.T) {
 				ResourceName:      "google_compute_network_endpoints.default",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateId:     negId,
 			},
 			{
 				// Force-recreate old endpoint
@@ -56,6 +57,7 @@ func TestAccComputeNetworkEndpoints_networkEndpointsBasic(t *testing.T) {
 				ResourceName:      "google_compute_network_endpoints.default",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateId:     negId,
 			},
 			{
 				// Add four new endpoints
@@ -65,6 +67,7 @@ func TestAccComputeNetworkEndpoints_networkEndpointsBasic(t *testing.T) {
 				ResourceName:      "google_compute_network_endpoints.default",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateId:     negId,
 			},
 			{
 				// Add enough endpoints to trigger pagination
@@ -74,6 +77,7 @@ func TestAccComputeNetworkEndpoints_networkEndpointsBasic(t *testing.T) {
 				ResourceName:      "google_compute_network_endpoints.default",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateId:     negId,
 			},
 			{
 				// Remove enough endpoints to trigger pagination
@@ -83,6 +87,7 @@ func TestAccComputeNetworkEndpoints_networkEndpointsBasic(t *testing.T) {
 				ResourceName:      "google_compute_network_endpoints.default",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateId:     negId,
 			},
 			{
 				// delete all endpoints
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_node_group_test.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_node_group_test.go.erb
index a09008450907..a713c5e78e49 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_node_group_test.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_node_group_test.go.erb
@@ -8,12 +8,14 @@ import (
 	"strings"
 	"time"
 
+	"regexp"
+
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 	"github.com/hashicorp/terraform-provider-google/google/acctest"
 )
 
-func TestAccComputeNodeGroup_updateNodeTemplate(t *testing.T) {
+func TestAccComputeNodeGroup_update(t *testing.T) {
 	t.Parallel()
 
 	groupName := fmt.Sprintf("group--%d", acctest.RandInt(t))
@@ -26,26 +28,47 @@ func TestAccComputeNodeGroup_updateNodeTemplate(t *testing.T) {
 		CheckDestroy:             testAccCheckComputeNodeGroupDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccComputeNodeGroup_updateNodeTemplate(groupName, tmplPrefix, "tmpl1"),
+				Config: testAccComputeNodeGroup_update(groupName, tmplPrefix, "tmpl1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckComputeNodeGroupCreationTimeBefore(&timeCreated),
 				),
 			},
 			{
-				ResourceName:      "google_compute_node_group.nodes",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_compute_node_group.nodes",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_size"},
 			},
 			{
-				Config: testAccComputeNodeGroup_updateNodeTemplate(groupName, tmplPrefix, "tmpl2"),
+				Config: testAccComputeNodeGroup_update2(groupName, tmplPrefix, "tmpl2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckComputeNodeGroupCreationTimeBefore(&timeCreated),
 				),
 			},
 			{
-				ResourceName:      "google_compute_node_group.nodes",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_compute_node_group.nodes",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initial_size"},
+			},
+		},
+	})
+}
+
+func TestAccComputeNodeGroup_fail(t *testing.T) {
+	t.Parallel()
+
+	groupName := fmt.Sprintf("group--%d", acctest.RandInt(t))
+	tmplPrefix := fmt.Sprintf("tmpl--%d", acctest.RandInt(t))
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeNodeGroupDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config:      testAccComputeNodeGroup_fail(groupName, tmplPrefix, "tmpl1"),
+				ExpectError: regexp.MustCompile("An initial_size or autoscaling_policy must be configured on node group creation."),
 			},
 		},
 	})
@@ -86,7 +109,7 @@ func testAccCheckComputeNodeGroupCreationTimeBefore(prevTimeCreated *time.Time)
 	}
 }
 
-func testAccComputeNodeGroup_updateNodeTemplate(groupName, tmplPrefix, tmplToUse string) string {
+func testAccComputeNodeGroup_update(groupName, tmplPrefix, tmplToUse string) string {
 	return fmt.Sprintf(`
 resource "google_compute_node_template" "tmpl1" {
   name      = "%s-first"
@@ -105,8 +128,58 @@ resource "google_compute_node_group" "nodes" {
   zone        = "us-central1-a"
   description = "example google_compute_node_group for Terraform Google Provider"
 
-  size          = 0
+  initial_size = 1
   node_template = google_compute_node_template.%s.self_link
 }
+
 `, tmplPrefix, tmplPrefix, groupName, tmplToUse)
 }
+
+func testAccComputeNodeGroup_update2(groupName, tmplPrefix, tmplToUse string) string {
+	return fmt.Sprintf(`
+resource "google_compute_node_template" "tmpl1" {
+  name      = "%s-first"
+  region    = "us-central1"
+  node_type = "n1-node-96-624"
+}
+
+resource "google_compute_node_template" "tmpl2" {
+  name      = "%s-second"
+  region    = "us-central1"
+  node_type = "n1-node-96-624"
+}
+
+resource "google_compute_node_group" "nodes" {
+  name        = "%s"
+  zone        = "us-central1-a"
+  description = "example google_compute_node_group for Terraform Google Provider"
+
+  autoscaling_policy {
+    mode      = "ONLY_SCALE_OUT"
+    min_nodes = 1
+    max_nodes = 10
+  }
+  node_template = google_compute_node_template.%s.self_link
+}
+
+`, tmplPrefix, tmplPrefix, groupName, tmplToUse)
+}
+
+func testAccComputeNodeGroup_fail(groupName, tmplPrefix, tmplToUse string) string {
+	return fmt.Sprintf(`
+resource "google_compute_node_template" "tmpl1" {
+  name      = "%s-first"
+  region    = "us-central1"
+  node_type = "n1-node-96-624"
+}
+
+resource "google_compute_node_group" "nodes" {
+  name        = "%s"
+  zone        = "us-central1-a"
+  description = "example google_compute_node_group for Terraform Google Provider"
+
+  node_template = google_compute_node_template.%s.self_link
+}
+
+`, tmplPrefix, groupName, tmplToUse)
+}
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_per_instance_config_test.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_per_instance_config_test.go.erb
index 6845a651d0af..0b947748e85d 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_per_instance_config_test.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_per_instance_config_test.go.erb
@@ -129,7 +129,6 @@ func TestAccComputePerInstanceConfig_update(t *testing.T) {
 	})
 }
 
-<% unless version == 'ga' -%>
 func TestAccComputePerInstanceConfig_statefulIps(t *testing.T) {
 	t.Parallel()
 
@@ -170,7 +169,6 @@ func TestAccComputePerInstanceConfig_statefulIps(t *testing.T) {
 		},
 	})
 }
-<% end -%>
 
 func testAccComputePerInstanceConfig_statefulBasic(context map[string]interface{}) string {
 	return acctest.Nprintf(`
@@ -342,7 +340,6 @@ resource "google_compute_instance_group_manager" "igm" {
 `, context)
 }
 
-<% unless version == 'ga' -%>
 func testAccComputePerInstanceConfig_statefulIpsBasic(context map[string]interface{}) string {
 	return acctest.Nprintf(`
 resource "google_compute_network" "default" {
@@ -492,7 +489,6 @@ resource "google_compute_disk" "disk1" {
 }
 `, context) + testAccComputePerInstanceConfig_igm(context)
 }
-<% end -%>
 
 // Checks that the per instance config with the given name was destroyed
 func testAccCheckComputePerInstanceConfigDestroyed(t *testing.T, igmId, configName string) resource.TestCheckFunc {
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_project_default_network_tier.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_project_default_network_tier.go.erb
index 2b838cd1bcad..3f1830c4c210 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_project_default_network_tier.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_project_default_network_tier.go.erb
@@ -11,6 +11,7 @@ import (
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 
 <% if version == "ga" -%>
@@ -34,6 +35,10 @@ func ResourceComputeProjectDefaultNetworkTier() *schema.Resource {
 			Create: schema.DefaultTimeout(4 * time.Minute),
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+		),
+
 		SchemaVersion: 0,
 
 		Schema: map[string]*schema.Schema{
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_project_metadata.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_project_metadata.go.erb
index 8186762eb938..8e8560b592f2 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_project_metadata.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_project_metadata.go.erb
@@ -9,6 +9,7 @@ import (
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 
 <% if version == "ga" -%>
@@ -33,6 +34,10 @@ func ResourceComputeProjectMetadata() *schema.Resource {
 			Delete: schema.DefaultTimeout(4 * time.Minute),
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+		),
+
 		SchemaVersion: 0,
 
 		Schema: map[string]*schema.Schema{
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_project_metadata_item.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_project_metadata_item.go.erb
index 5cf62dc29590..957476bb24fb 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_project_metadata_item.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_project_metadata_item.go.erb
@@ -9,6 +9,7 @@ import (
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 
 <% if version == "ga" -%>
@@ -35,6 +36,10 @@ func ResourceComputeProjectMetadataItem() *schema.Resource {
 			State: schema.ImportStatePassthrough,
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+		),
+
 		Schema: map[string]*schema.Schema{
 			"key": {
 				Type:        schema.TypeString,
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_region_disk_test.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_region_disk_test.go.erb
index 56b630b12777..f59bb99bcd46 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_region_disk_test.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_region_disk_test.go.erb
@@ -44,6 +44,7 @@ func TestAccComputeRegionDisk_basic(t *testing.T) {
 				ResourceName:      "google_compute_region_disk.regiondisk",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccComputeRegionDisk_basic(diskName, "name"),
@@ -56,6 +57,7 @@ func TestAccComputeRegionDisk_basic(t *testing.T) {
 				ResourceName:      "google_compute_region_disk.regiondisk",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -84,6 +86,7 @@ func TestAccComputeRegionDisk_basicUpdate(t *testing.T) {
 				ResourceName:      "google_compute_region_disk.regiondisk",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccComputeRegionDisk_basicUpdated(diskName, "self_link"),
@@ -100,6 +103,7 @@ func TestAccComputeRegionDisk_basicUpdate(t *testing.T) {
 				ResourceName:      "google_compute_region_disk.regiondisk",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_region_instance_group_manager.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_region_instance_group_manager.go.erb
index 9ac36c5455a8..4f6360bc42e0 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_region_instance_group_manager.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_region_instance_group_manager.go.erb
@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 
@@ -37,6 +38,11 @@ func ResourceComputeRegionInstanceGroupManager() *schema.Resource {
 			Delete: schema.DefaultTimeout(15 * time.Minute),
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+			tpgresource.DefaultProviderRegion,
+		),
+
 		Schema: map[string]*schema.Schema{
 			"base_instance_name": {
 				Type:        schema.TypeString,
@@ -380,7 +386,6 @@ func ResourceComputeRegionInstanceGroupManager() *schema.Resource {
 				},
 			},
 			<% end -%>
-			<% unless version == "ga" -%>
 			"stateful_internal_ip": {
 				Type:        schema.TypeList,
 				Optional:    true,
@@ -423,7 +428,6 @@ func ResourceComputeRegionInstanceGroupManager() *schema.Resource {
 					},
 				},
 			},
-			<% end -%>
 			"stateful_disk": {
 				Type:        schema.TypeSet,
 				Optional:    true,
@@ -764,14 +768,12 @@ func resourceComputeRegionInstanceGroupManagerRead(d *schema.ResourceData, meta
 	if err = d.Set("status", flattenStatus(manager.Status)); err != nil {
 		return fmt.Errorf("Error setting status in state: %s", err.Error())
 	}
-	<% unless version == "ga" -%>
 	if err = d.Set("stateful_internal_ip", flattenStatefulPolicyStatefulInternalIps(manager.StatefulPolicy)); err != nil {
 		return fmt.Errorf("Error setting stateful_internal_ip in state: %s", err.Error())
 	}
 	if err = d.Set("stateful_external_ip", flattenStatefulPolicyStatefulExternalIps(manager.StatefulPolicy)); err != nil {
 		return fmt.Errorf("Error setting stateful_external_ip in state: %s", err.Error())
 	}
-	<% end -%>
 	// If unset in state set to default value
 	if d.Get("wait_for_instances_status").(string) == "" {
 		if err = d.Set("wait_for_instances_status", "STABLE"); err != nil {
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_region_instance_group_manager_test.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_region_instance_group_manager_test.go.erb
index d3fc79583860..2394050ec57c 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_region_instance_group_manager_test.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_region_instance_group_manager_test.go.erb
@@ -1424,7 +1424,6 @@ resource "google_compute_region_instance_group_manager" "igm-basic" {
     device_name = "stateful-disk"
     delete_rule = "NEVER"
   }
-  <% unless version == "ga" -%>
   stateful_internal_ip {
     interface_name = "nic0"
     delete_rule = "ON_PERMANENT_INSTANCE_DELETION"
@@ -1439,7 +1438,6 @@ resource "google_compute_region_instance_group_manager" "igm-basic" {
     interface_name = "nic1"
     delete_rule = "NEVER"
   }
-  <% end -%>
 }
 `, network, template, igm)
 }
@@ -1505,7 +1503,6 @@ resource "google_compute_region_instance_group_manager" "igm-basic" {
     device_name = "stateful-disk2"
     delete_rule = "ON_PERMANENT_INSTANCE_DELETION"
   }
-  <% unless version == "ga" -%>
   stateful_internal_ip {
     interface_name = "nic0"
     delete_rule = "ON_PERMANENT_INSTANCE_DELETION"
@@ -1515,8 +1512,6 @@ resource "google_compute_region_instance_group_manager" "igm-basic" {
     interface_name = "nic0"
     delete_rule = "NEVER"
   }
-
-  <% end -%>
 }
 `, network, template, igm)
 }
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_region_instance_template.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_region_instance_template.go.erb
index 9b34e90d6462..05dda6979214 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_region_instance_template.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_region_instance_template.go.erb
@@ -28,15 +28,19 @@ func ResourceComputeRegionInstanceTemplate() *schema.Resource {
 	return &schema.Resource{
 		Create: resourceComputeRegionInstanceTemplateCreate,
 		Read:   resourceComputeRegionInstanceTemplateRead,
+		Update: resourceComputeRegionInstanceTemplateUpdate,
 		Delete: resourceComputeRegionInstanceTemplateDelete,
 		Importer: &schema.ResourceImporter{
 			State: resourceComputeRegionInstanceTemplateImportState,
 		},
 		SchemaVersion: 1,
 		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+			tpgresource.DefaultProviderRegion,
 			resourceComputeInstanceTemplateSourceImageCustomizeDiff,
 			resourceComputeInstanceTemplateScratchDiskCustomizeDiff,
 			resourceComputeInstanceTemplateBootDiskCustomizeDiff,
+			tpgresource.SetLabelsDiff,
 		),
 
 		Timeouts: &schema.ResourceTimeout{
@@ -351,6 +355,7 @@ Google Cloud KMS.`,
 			"metadata_fingerprint": {
 				Type:        schema.TypeString,
 				Computed:    true,
+				ForceNew:    true,
 				Description: `The unique fingerprint of the metadata.`,
 			},
 
@@ -416,6 +421,7 @@ Google Cloud KMS.`,
 						"name": {
 							Type:        schema.TypeString,
 							Computed:    true,
+							ForceNew:    true,
 							Description: `The name of the network_interface.`,
 						},
 						"nic_type": {
@@ -450,6 +456,7 @@ Google Cloud KMS.`,
 									"public_ptr_domain_name": {
 										Type:        schema.TypeString,
 										Computed:    true,
+										ForceNew:    true,
 										Description: `The DNS domain name for the public PTR record.The DNS domain name for the public PTR record.`,
 									},
 								},
@@ -484,6 +491,7 @@ Google Cloud KMS.`,
 							Type:         schema.TypeString,
 							Optional:     true,
 							Computed:     true,
+							ForceNew:     true,
 							ValidateFunc: validation.StringInSlice([]string{"IPV4_ONLY", "IPV4_IPV6", ""}, false),
 							Description:  `The stack type for this network interface to identify whether the IPv6 feature is enabled or not. If not specified, IPV4_ONLY will be used.`,
 						},
@@ -491,18 +499,21 @@ Google Cloud KMS.`,
 						"ipv6_access_type": {
 							Type:        schema.TypeString,
 							Computed:    true,
+							ForceNew:    true,
 							Description: `One of EXTERNAL, INTERNAL to indicate whether the IP can be accessed from the Internet. This field is always inherited from its subnetwork.`,
 						},
 
 						"ipv6_access_config": {
 							Type:        schema.TypeList,
 							Optional:    true,
+							ForceNew:    true,
 							Description: `An array of IPv6 access configurations for this interface. Currently, only one IPv6 access config, DIRECT_IPV6, is supported. If there is no ipv6AccessConfig specified, then this instance will have no external IPv6 Internet access.`,
 							Elem: &schema.Resource{
 								Schema: map[string]*schema.Schema{
 									"network_tier": {
 										Type:        schema.TypeString,
 										Required:    true,
+										ForceNew:    true,
 										Description: `The service-level to be provided for IPv6 traffic when the subnet has an external subnet. Only PREMIUM tier is valid for IPv6`,
 									},
 									// Possibly configurable- this was added so we don't break if it's inadvertently set
@@ -510,21 +521,25 @@ Google Cloud KMS.`,
 									"public_ptr_domain_name": {
 										Type:        schema.TypeString,
 										Computed:    true,
+										ForceNew:    true,
 										Description: `The domain name to be used when creating DNSv6 records for the external IPv6 ranges.`,
 									},
 									"external_ipv6": {
 										Type:        schema.TypeString,
 										Computed:    true,
+										ForceNew:    true,
 										Description: `The first IPv6 address of the external IPv6 range associated with this instance, prefix length is stored in externalIpv6PrefixLength in ipv6AccessConfig. The field is output only, an IPv6 address from a subnetwork associated with the instance will be allocated dynamically.`,
 									},
 									"external_ipv6_prefix_length": {
 										Type:        schema.TypeString,
 										Computed:    true,
+										ForceNew:    true,
 										Description: `The prefix length of the external IPv6 range.`,
 									},
 									"name": {
 										Type:        schema.TypeString,
 										Computed:    true,
+										ForceNew:    true,
 										Description: `The name of this access configuration.`,
 									},
 								},
@@ -534,12 +549,14 @@ Google Cloud KMS.`,
 							Type:        schema.TypeInt,
 							Optional:    true,
 							Computed:    true,
+							ForceNew:    true,
 							Description: `The prefix length of the primary internal IPv6 range.`,
 						},
 						"ipv6_address": {
 							Type:        schema.TypeString,
 							Optional:    true,
 							Computed:    true,
+							ForceNew:    true,
 							DiffSuppressFunc: ipv6RepresentationDiffSuppress,
 							Description: `An IPv6 internal network address for this network interface. If not specified, Google Cloud will automatically assign an internal IPv6 address from the instance's subnetwork.`,
 						},
@@ -609,6 +626,7 @@ Google Cloud KMS.`,
 						"min_node_cpus": {
 							Type:         schema.TypeInt,
 							Optional:     true,
+							ForceNew:     true,
 							AtLeastOneOf: schedulingInstTemplateKeys,
 							Description:  `Minimum number of cpus for the instance.`,
 						},
@@ -646,7 +664,7 @@ Must be from 0 to 315,576,000,000 inclusive.`,
 									"nanos": {
 										Type:     schema.TypeInt,
 										Optional:    true,
-									        ForceNew:    true,
+										ForceNew:    true,
 										Description: `Span of time that's a fraction of a second at nanosecond
 resolution. Durations less than one second are represented
 with a 0 seconds field and a positive nanos field. Must
@@ -658,12 +676,14 @@ be from 0 to 999,999,999 inclusive.`,
 						"maintenance_interval" : {
 							Type:        schema.TypeString,
 							Optional:    true,
+							ForceNew:    true,
 							Description: `Specifies the frequency of planned maintenance events. The accepted values are: PERIODIC`,
 						},
 <% end -%>
 						"local_ssd_recovery_timeout" : {
 							Type:        schema.TypeList,
 							Optional:    true,
+							ForceNew:    true,
 							Description: `Specifies the maximum amount of time a Local Ssd Vm should wait while
   recovery of the Local Ssd state is attempted. Its value should be in
   between 0 and 168 hours with hour granularity and the default value being 1
@@ -697,6 +717,7 @@ be from 0 to 999,999,999 inclusive.`,
 			"self_link": {
 				Type:        schema.TypeString,
 				Computed:    true,
+				ForceNew:    true,
 				Description: `The URI of the created resource.`,
 			},
 
@@ -866,16 +887,36 @@ be from 0 to 999,999,999 inclusive.`,
 			"tags_fingerprint": {
 				Type:        schema.TypeString,
 				Computed:    true,
+				ForceNew:    true,
 				Description: `The unique fingerprint of the tags.`,
 			},
 
 			"labels": {
 				Type:        schema.TypeMap,
 				Optional:    true,
-				ForceNew:    true,
 				Elem:        &schema.Schema{Type: schema.TypeString},
 				Set:         schema.HashString,
-				Description: `A set of key/value label pairs to assign to instances created from this template,`,
+				Description: `A set of key/value label pairs to assign to instances created from this template,
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+			},
+
+			"terraform_labels": {
+				Type:        schema.TypeMap,
+				Computed:    true,
+				Set:         schema.HashString,
+				Description: `The combination of labels configured directly on the resource and default labels configured on the provider.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+			},
+
+			"effective_labels": {
+				Type:        schema.TypeMap,
+				Computed:    true,
+				ForceNew:    true,
+				Set:         schema.HashString,
+				Description: `All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
 			},
 
 			"resource_policies": {
@@ -1008,8 +1049,8 @@ func resourceComputeRegionInstanceTemplateCreate(d *schema.ResourceData, meta in
 		ReservationAffinity:        reservationAffinity,
 	}
 
-	if _, ok := d.GetOk("labels"); ok {
-		instanceProperties.Labels = tpgresource.ExpandLabels(d)
+	if _, ok := d.GetOk("effective_labels"); ok {
+		instanceProperties.Labels = tpgresource.ExpandEffectiveLabels(d)
 	}
 
 	var itName string
@@ -1055,6 +1096,11 @@ func resourceComputeRegionInstanceTemplateCreate(d *schema.ResourceData, meta in
 	return resourceComputeRegionInstanceTemplateRead(d, meta)
 }
 
+func resourceComputeRegionInstanceTemplateUpdate(d *schema.ResourceData, meta interface{}) error {
+	// Only the field "labels" and "terraform_labels" is mutable
+	return resourceComputeRegionInstanceTemplateRead(d, meta)
+}
+
 func resourceComputeRegionInstanceTemplateRead(d *schema.ResourceData, meta interface{}) error {
 	config := meta.(*transport_tpg.Config)
 	userAgent, err :=  tpgresource.GenerateUserAgentString(d, config.UserAgent)
@@ -1135,10 +1181,16 @@ func resourceComputeRegionInstanceTemplateRead(d *schema.ResourceData, meta inte
 		}
 	}
 	if instanceProperties.Labels != nil {
-		if err := d.Set("labels", instanceProperties.Labels); err != nil {
+		if err := tpgresource.SetLabels(instanceProperties.Labels, d, "labels"); err != nil {
 			return fmt.Errorf("Error setting labels: %s", err)
 		}
 	}
+	if err := tpgresource.SetLabels(instanceProperties.Labels, d, "terraform_labels"); err != nil {
+		return fmt.Errorf("Error setting terraform_labels: %s", err)
+	}
+	if err := d.Set("effective_labels", instanceProperties.Labels); err != nil {
+		return fmt.Errorf("Error setting effective_labels: %s", err)
+	}
 	if err = d.Set("self_link", instanceTemplate["selfLink"]); err != nil {
 		return fmt.Errorf("Error setting self_link: %s", err)
 	}
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_region_instance_template_test.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_region_instance_template_test.go.erb
index 1f05349a2411..bef9e29f4526 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_region_instance_template_test.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_region_instance_template_test.go.erb
@@ -50,6 +50,7 @@ func TestAccComputeRegionInstanceTemplate_basic(t *testing.T) {
 				ResourceName:      "google_compute_region_instance_template.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -76,6 +77,7 @@ func TestAccComputeRegionInstanceTemplate_imageShorthand(t *testing.T) {
 				ResourceName:      "google_compute_region_instance_template.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -767,6 +769,7 @@ func TestAccComputeRegionInstanceTemplate_maintenance_interval(t *testing.T) {
 				ResourceName:      "google_compute_region_instance_template.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccComputeRegionInstanceTemplate_basic(acctest.RandString(t, 10)),
@@ -894,6 +897,7 @@ func TestAccComputeRegionInstanceTemplate_diskResourcePolicies(t *testing.T) {
 				ResourceName:      "google_compute_region_instance_template.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -971,6 +975,7 @@ func TestAccComputeRegionInstanceTemplate_managedEnvoy(t *testing.T) {
 				ResourceName:      "google_compute_region_instance_template.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -1657,7 +1662,6 @@ resource "google_compute_image" "foobar" {
   }
   labels = {
     my-label    = "my-label-value"
-    empty-label = ""
   }
   timeouts {
     create = "5m"
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_region_per_instance_config_test.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_region_per_instance_config_test.go.erb
index 65b57187ddc9..e12d5291e6a7 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_region_per_instance_config_test.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_region_per_instance_config_test.go.erb
@@ -127,7 +127,7 @@ func TestAccComputeRegionPerInstanceConfig_update(t *testing.T) {
 		},
 	})
 }
-<% unless version == 'ga' -%>
+
 func TestAccComputeRegionPerInstanceConfig_statefulIps(t *testing.T) {
 	t.Parallel()
 
@@ -168,7 +168,6 @@ func TestAccComputeRegionPerInstanceConfig_statefulIps(t *testing.T) {
 		},
 	})
 }
-<% end -%>
 
 func testAccComputeRegionPerInstanceConfig_statefulBasic(context map[string]interface{}) string {
 	return acctest.Nprintf(`
@@ -347,7 +346,7 @@ resource "google_compute_region_instance_group_manager" "rigm" {
 }
 `, context)
 }
-<% unless version == 'ga' -%>
+
 func testAccComputeRegionPerInstanceConfig_statefulIpsBasic(context map[string]interface{}) string {
 	return acctest.Nprintf(`
 resource "google_compute_network" "default" {
@@ -499,7 +498,6 @@ resource "google_compute_disk" "disk1" {
 }
 `, context) + testAccComputeRegionPerInstanceConfig_rigm(context)
 }
-<% end -%>
 
 // Checks that the per instance config with the given name was destroyed
 func testAccCheckComputeRegionPerInstanceConfigDestroyed(t *testing.T, rigmId, configName string) resource.TestCheckFunc {
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_router_interface.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_router_interface.go.erb
index b8f48d98cffc..807a9c443d4d 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_router_interface.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_router_interface.go.erb
@@ -11,6 +11,7 @@ import (
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"google.golang.org/api/googleapi"
 
@@ -35,6 +36,11 @@ func ResourceComputeRouterInterface() *schema.Resource {
 			Delete: schema.DefaultTimeout(4 * time.Minute),
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+			tpgresource.DefaultProviderRegion,
+		),
+
 		Schema: map[string]*schema.Schema{
 			"name": {
 				Type:        schema.TypeString,
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_router_nat_test.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_router_nat_test.go.erb
index 5ecc97a8da16..b1c17157506f 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_router_nat_test.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_router_nat_test.go.erb
@@ -410,6 +410,211 @@ func TestAccComputeRouterNat_withNatRules(t *testing.T) {
 	})
 }
 
+<% unless version == 'ga' -%>
+func TestAccComputeRouterNat_withPrivateNat(t *testing.T) {
+	t.Parallel()
+
+	project := envvar.GetTestProjectFromEnv()
+	region := envvar.GetTestRegionFromEnv()
+
+	testId := acctest.RandString(t, 10)
+	routerName := fmt.Sprintf("tf-test-router-nat-%s", testId)
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeRouterNatDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeRouterNatPrivateType(routerName),
+			},
+			{
+				// implicitly full ImportStateId
+				ResourceName:      "google_compute_router_nat.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				ResourceName:      "google_compute_router_nat.foobar",
+				ImportStateId:     fmt.Sprintf("%s/%s/%s/%s", project, region, routerName, routerName),
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				ResourceName:      "google_compute_router_nat.foobar",
+				ImportStateId:     fmt.Sprintf("%s/%s/%s", region, routerName, routerName),
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				ResourceName:      "google_compute_router_nat.foobar",
+				ImportStateId:     fmt.Sprintf("%s/%s", routerName, routerName),
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeRouterNatKeepRouter(routerName),
+				Check: testAccCheckComputeRouterNatDelete(
+					t, "google_compute_router_nat.foobar"),
+			},
+		},
+	})
+}
+
+func TestAccComputeRouterNat_withPrivateNatAndRules(t *testing.T) {
+	t.Parallel()
+
+	testId := acctest.RandString(t, 10)
+	routerName := fmt.Sprintf("tf-test-router-private-nat-%s", testId)
+	hubName := fmt.Sprintf("%s-hub", routerName)
+	pEnv := envvar.GetTestProjectFromEnv()
+	ruleDescription := acctest.RandString(t, 10)
+	match := fmt.Sprintf("nexthop.hub == '//networkconnectivity.googleapis.com/projects/%s/locations/global/hubs/%s'", pEnv, hubName)
+	activeRangesNetworkOne := "google_compute_subnetwork.subnet1.self_link"
+	drainRangesEmpty := ""
+	activeRangesNetworkTwoAndThree := "google_compute_subnetwork.subnet2.self_link,google_compute_subnetwork.subnet3.self_link"
+	activeRangesNetworkThreeAndFour := "google_compute_subnetwork.subnet3.self_link,google_compute_subnetwork.subnet4.self_link"
+	drainRangesNetworkOne := "google_compute_subnetwork.subnet1.self_link"
+	drainRangesNetworkOneAndTwo := "google_compute_subnetwork.subnet1.self_link,google_compute_subnetwork.subnet2.self_link"
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeRouterNatDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeRouterNatRulesBasic_privateNatOmitRules(routerName, hubName),
+			},
+			{
+				ResourceName:      "google_compute_router_nat.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeRouterNatRulesBasic_privateNatWithRuleAndActiveDrainRange(routerName, hubName, 100, ruleDescription, match, activeRangesNetworkOne, drainRangesEmpty),
+			},
+			{
+				ResourceName:      "google_compute_router_nat.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeRouterNatRulesBasic_privateNatWithRuleAndActiveDrainRange(routerName, hubName, 100, ruleDescription, match, activeRangesNetworkTwoAndThree, drainRangesNetworkOne),
+			},
+			{
+				ResourceName:      "google_compute_router_nat.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeRouterNatRulesBasic_privateNatWithRuleAndActiveDrainRange(routerName, hubName, 100, ruleDescription, match, activeRangesNetworkThreeAndFour, drainRangesNetworkOneAndTwo),
+			},
+			{
+				ResourceName:      "google_compute_router_nat.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeRouterNatRulesBasic_privateNatWithRuleAndActiveDrainRange(routerName, hubName, 100, ruleDescription, match, activeRangesNetworkOne, drainRangesEmpty),
+			},
+			{
+				ResourceName:      "google_compute_router_nat.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeRouterNatRulesBasic_privateNatOmitRules(routerName, hubName),
+			},
+			{
+				ResourceName:      "google_compute_router_nat.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccComputeRouterNat_withPrivateNatAndEmptyAction(t *testing.T) {
+	t.Parallel()
+
+	testId := acctest.RandString(t, 10)
+	routerName := fmt.Sprintf("tf-test-router-private-nat-%s", testId)
+	hubName := fmt.Sprintf("%s-hub", routerName)
+	pEnv := envvar.GetTestProjectFromEnv()
+	ruleDescription := acctest.RandString(t, 10)
+	match := fmt.Sprintf("nexthop.hub == '//networkconnectivity.googleapis.com/projects/%s/locations/global/hubs/%s'", pEnv, hubName)
+	activeRangesNetworkOne := "google_compute_subnetwork.subnet1.self_link"
+	drainRangesEmpty := ""
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeRouterNatDestroyProducer(t),
+		Steps: []resource.TestStep{
+			// (ERROR): Creation with empty action should fail
+			{
+				Config:      testAccComputeRouterNatRulesBasic_privateNatWithRuleAndEmptyAction(routerName, hubName, 100, ruleDescription, match),
+				ExpectError: regexp.MustCompile("The rule for PRIVATE nat type must contain an action with source_nat_active_ranges set"),
+			},
+			// Create NAT with action and active ranges set
+			{
+				Config: testAccComputeRouterNatRulesBasic_privateNatWithRuleAndActiveDrainRange(routerName, hubName, 100, ruleDescription, match, activeRangesNetworkOne, drainRangesEmpty),
+			},
+			{
+				ResourceName:      "google_compute_router_nat.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			// (ERROR) - Updating the rule by removing the action should fail
+			{
+				Config:      testAccComputeRouterNatRulesBasic_privateNatWithRuleAndEmptyAction(routerName, hubName, 100, ruleDescription, match),
+				ExpectError: regexp.MustCompile("The rule for PRIVATE nat type must contain an action with source_nat_active_ranges set"),
+			},
+		},
+	})
+}
+
+func TestAccComputeRouterNat_withPrivateNatAndEmptyActionActiveRanges(t *testing.T) {
+	t.Parallel()
+
+	testId := acctest.RandString(t, 10)
+	routerName := fmt.Sprintf("tf-test-router-private-nat-%s", testId)
+	hubName := fmt.Sprintf("%s-hub", routerName)
+	pEnv := envvar.GetTestProjectFromEnv()
+	ruleDescription := acctest.RandString(t, 10)
+	match := fmt.Sprintf("nexthop.hub == '//networkconnectivity.googleapis.com/projects/%s/locations/global/hubs/%s'", pEnv, hubName)
+	activeRangesNetworkOne := "google_compute_subnetwork.subnet1.self_link"
+	drainRangesEmpty := ""
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeRouterNatDestroyProducer(t),
+		Steps: []resource.TestStep{
+			// (ERROR): Creation with empty action active ranges should fail
+			{
+				Config:      testAccComputeRouterNatRulesBasic_privateNatWithRuleAndEmptyActionActiveRanges(routerName, hubName, 100, ruleDescription, match),
+				ExpectError: regexp.MustCompile("The rule for PRIVATE nat type must contain an action with source_nat_active_ranges set"),
+			},
+			// Create NAT with action and active ranges set
+			{
+				Config: testAccComputeRouterNatRulesBasic_privateNatWithRuleAndActiveDrainRange(routerName, hubName, 100, ruleDescription, match, activeRangesNetworkOne, drainRangesEmpty),
+			},
+			{
+				ResourceName:      "google_compute_router_nat.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			// (ERROR) - Updating the rule by erasing the action active ranges should fail
+			{
+				Config:      testAccComputeRouterNatRulesBasic_privateNatWithRuleAndEmptyActionActiveRanges(routerName, hubName, 100, ruleDescription, match),
+				ExpectError: regexp.MustCompile("The rule for PRIVATE nat type must contain an action with source_nat_active_ranges set"),
+			},
+		},
+	})
+}
+<% end -%>
+
 func testAccCheckComputeRouterNatDestroyProducer(t *testing.T) func(s *terraform.State) error {
 	return func(s *terraform.State) error {
 		config := acctest.GoogleProviderConfig(t)
@@ -1372,4 +1577,220 @@ resource "google_compute_router_nat" "foobar" {
   source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"
 }
 `, routerName, routerName, routerName, routerName)
-}
\ No newline at end of file
+}
+
+<% unless version == "ga" -%>
+func testAccComputeRouterNatPrivateType(routerName string) string {
+	return fmt.Sprintf(`
+resource "google_compute_network" "foobar" {
+  name                    = "%s-net"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "foobar" {
+  name          = "%s-subnet"
+  network       = google_compute_network.foobar.self_link
+  ip_cidr_range = "10.0.0.0/16"
+  region        = "us-central1"
+  purpose          = "PRIVATE_NAT"
+}
+
+resource "google_compute_router" "foobar" {
+  name    = "%s"
+  region  = google_compute_subnetwork.foobar.region
+  network = google_compute_network.foobar.self_link
+}
+
+resource "google_compute_router_nat" "foobar" {
+  name                               = "%s"
+  router                             = google_compute_router.foobar.name
+  region                             = google_compute_router.foobar.region
+  source_subnetwork_ip_ranges_to_nat = "LIST_OF_SUBNETWORKS"
+  type = "PRIVATE" 
+  enable_dynamic_port_allocation = false
+  enable_endpoint_independent_mapping = false
+  min_ports_per_vm = 32
+  subnetwork {
+    name                    = google_compute_subnetwork.foobar.id
+    source_ip_ranges_to_nat = ["ALL_IP_RANGES"]
+  }
+}
+`, routerName, routerName, routerName, routerName)
+}
+
+func testAccComputeRouterNatBaseResourcesWithPrivateNatSubnetworks(routerName, hubName string) string {
+	return fmt.Sprintf(`
+resource "google_compute_network" "foobar" {
+  name                    = "%s-net"
+  auto_create_subnetworks = "false"
+}
+
+resource "google_compute_subnetwork" "subnet1" {
+  name          = "%s-subnet1"
+  network       = google_compute_network.foobar.self_link
+  ip_cidr_range = "10.0.0.0/16"
+  region        = "us-central1"
+  purpose       = "PRIVATE_NAT"
+}
+
+resource "google_compute_subnetwork" "subnet2" {
+  name          = "%s-subnet2"
+  network       = google_compute_network.foobar.self_link
+  ip_cidr_range = "10.10.1.0/24"
+  region        = "us-central1"
+  purpose       = "PRIVATE_NAT"
+}
+
+resource "google_compute_subnetwork" "subnet3" {
+  name          = "%s-subnet3"
+  network       = google_compute_network.foobar.self_link
+  ip_cidr_range = "10.158.1.0/24"
+  region        = "us-central1"
+  purpose       = "PRIVATE_NAT"
+}
+
+resource "google_compute_subnetwork" "subnet4" {
+  name          = "%s-subnet4"
+  network       = google_compute_network.foobar.self_link
+  ip_cidr_range = "10.168.1.0/24"
+  region        = "us-central1"
+  purpose       = "PRIVATE_NAT"
+}
+
+resource "google_network_connectivity_hub" "foobar" {
+  name        = "%s"
+  description = "vpc hub for inter vpc nat"
+}
+
+resource "google_network_connectivity_spoke" "primary" {
+  name        = "%s-spoke"
+  location    = "global"
+  description = "vpc spoke for inter vpc nat"
+  hub =  google_network_connectivity_hub.foobar.id
+  linked_vpc_network {
+    exclude_export_ranges = [
+      "10.10.0.0/16"
+    ]
+    uri = google_compute_network.foobar.self_link
+  }
+}
+
+resource "google_compute_router" "foobar" {
+  name     = "%s"
+  region   = google_compute_subnetwork.subnet1.region
+  network  = google_compute_network.foobar.self_link
+}
+`, routerName, routerName, routerName, routerName, routerName, hubName, routerName, routerName)
+}
+
+func testAccComputeRouterNatRulesBasic_privateNatOmitRules(routerName, hubName string) string {
+	return fmt.Sprintf(`
+%s
+
+resource "google_compute_router_nat" "foobar" {
+  name                                = "%s"
+  router                              = google_compute_router.foobar.name
+  region                              = google_compute_router.foobar.region
+  source_subnetwork_ip_ranges_to_nat  = "LIST_OF_SUBNETWORKS"
+  type                                = "PRIVATE" 
+  enable_dynamic_port_allocation      = false
+  enable_endpoint_independent_mapping = false
+  min_ports_per_vm = 32
+  subnetwork {
+    name                    = google_compute_subnetwork.subnet1.id
+    source_ip_ranges_to_nat = ["ALL_IP_RANGES"]
+  }
+}
+`, testAccComputeRouterNatBaseResourcesWithPrivateNatSubnetworks(routerName, hubName), routerName)
+}
+
+func testAccComputeRouterNatRulesBasic_privateNatWithRuleAndActiveDrainRange(routerName, hubName string, ruleNumber int, ruleDescription, match, activeRanges, drainRanges string) string {
+	return fmt.Sprintf(`
+%s
+
+resource "google_compute_router_nat" "foobar" {
+  name                                = "%s"
+  router                              = google_compute_router.foobar.name
+  region                              = google_compute_router.foobar.region
+  source_subnetwork_ip_ranges_to_nat  = "LIST_OF_SUBNETWORKS"
+  type                                = "PRIVATE" 
+  enable_dynamic_port_allocation      = false
+  enable_endpoint_independent_mapping = false
+  min_ports_per_vm = 32
+  subnetwork {
+    name                    = google_compute_subnetwork.subnet1.id
+    source_ip_ranges_to_nat = ["ALL_IP_RANGES"]
+  }
+
+  rules {
+    rule_number = %d
+    description = "%s"
+    match       = "%s"
+    action {
+      source_nat_active_ranges = [%s]
+      source_nat_drain_ranges = [%s]
+    }
+  }
+}
+`, testAccComputeRouterNatBaseResourcesWithPrivateNatSubnetworks(routerName, hubName), routerName, ruleNumber, ruleDescription, match, activeRanges, drainRanges)
+}
+
+func testAccComputeRouterNatRulesBasic_privateNatWithRuleAndEmptyAction(routerName, hubName string, ruleNumber int, ruleDescription, match string) string {
+	return fmt.Sprintf(`
+%s
+
+resource "google_compute_router_nat" "foobar" {
+  name                                = "%s"
+  router                              = google_compute_router.foobar.name
+  region                              = google_compute_router.foobar.region
+  source_subnetwork_ip_ranges_to_nat  = "LIST_OF_SUBNETWORKS"
+  type                                = "PRIVATE" 
+  enable_dynamic_port_allocation      = false
+  enable_endpoint_independent_mapping = false
+  min_ports_per_vm = 32
+  subnetwork {
+    name                    = google_compute_subnetwork.subnet1.id
+    source_ip_ranges_to_nat = ["ALL_IP_RANGES"]
+  }
+
+  rules {
+    rule_number = %d
+    description = "%s"
+    match       = "%s"
+    # action is missing
+  }
+}
+`, testAccComputeRouterNatBaseResourcesWithPrivateNatSubnetworks(routerName, hubName), routerName, ruleNumber, ruleDescription, match)
+}
+
+func testAccComputeRouterNatRulesBasic_privateNatWithRuleAndEmptyActionActiveRanges(routerName, hubName string, ruleNumber int, ruleDescription, match string) string {
+	return fmt.Sprintf(`
+%s
+
+resource "google_compute_router_nat" "foobar" {
+  name                                = "%s"
+  router                              = google_compute_router.foobar.name
+  region                              = google_compute_router.foobar.region
+  source_subnetwork_ip_ranges_to_nat  = "LIST_OF_SUBNETWORKS"
+  type                                = "PRIVATE" 
+  enable_dynamic_port_allocation      = false
+  enable_endpoint_independent_mapping = false
+  min_ports_per_vm = 32
+  subnetwork {
+    name                    = google_compute_subnetwork.subnet1.id
+    source_ip_ranges_to_nat = ["ALL_IP_RANGES"]
+  }
+
+  rules {
+    rule_number = %d
+    description = "%s"
+    match       = "%s"
+    action {
+      source_nat_active_ranges = []
+    }
+  }
+}
+`, testAccComputeRouterNatBaseResourcesWithPrivateNatSubnetworks(routerName, hubName), routerName, ruleNumber, ruleDescription, match)
+}
+
+<% end -%>
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_security_policy.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_security_policy.go.erb
index a96ca1fe6a8e..c284ef3db203 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_security_policy.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_security_policy.go.erb
@@ -5,13 +5,14 @@ import (
 	"context"
 	"fmt"
 	"log"
-<% if version != 'ga' -%>
+<% unless version == 'ga' -%>
 	"strings"
 <% end -%>
 
 	"time"
 
 	"github.com/hashicorp/errwrap"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 
@@ -35,7 +36,10 @@ func ResourceComputeSecurityPolicy() *schema.Resource {
 		Importer: &schema.ResourceImporter{
 			State: resourceSecurityPolicyStateImporter,
 		},
-		CustomizeDiff: rulesCustomizeDiff,
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+			rulesCustomizeDiff,
+		),
 
 		Timeouts: &schema.ResourceTimeout{
 			Create: schema.DefaultTimeout(8 * time.Minute),
@@ -268,7 +272,6 @@ func ResourceComputeSecurityPolicy() *schema.Resource {
 									"enforce_on_key": {
 										Type:         schema.TypeString,
 										Optional:     true,
-										Default:      "ALL",
 										Description:  `Determines the key to enforce the rateLimitThreshold on`,
 										ValidateFunc: validation.StringInSlice([]string{"ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", ""}, false),
 									},
@@ -739,6 +742,10 @@ func resourceComputeSecurityPolicyUpdate(d *schema.ResourceData, meta interface{
 		Fingerprint: d.Get("fingerprint").(string),
 	}
 
+	<% unless version == 'ga' -%>
+	updateMask := []string{}
+	<% end -%>
+
 	if d.HasChange("type") {
 		securityPolicy.Type = d.Get("type").(string)
 		securityPolicy.ForceSendFields = append(securityPolicy.ForceSendFields, "Type")
@@ -752,6 +759,13 @@ func resourceComputeSecurityPolicyUpdate(d *schema.ResourceData, meta interface{
 	if d.HasChange("advanced_options_config") {
 		securityPolicy.AdvancedOptionsConfig = expandSecurityPolicyAdvancedOptionsConfig(d.Get("advanced_options_config").([]interface{}))
 		securityPolicy.ForceSendFields = append(securityPolicy.ForceSendFields, "AdvancedOptionsConfig", "advancedOptionsConfig.jsonParsing", "advancedOptionsConfig.jsonCustomConfig", "advancedOptionsConfig.logLevel")
+		<% unless version == 'ga' -%>
+		securityPolicy.ForceSendFields = append(securityPolicy.ForceSendFields, "advanceOptionConfig.userIpRequestHeaders")
+		if len(securityPolicy.AdvancedOptionsConfig.UserIpRequestHeaders) == 0 {
+			// to clean this list we must send the updateMask of this field on the request.
+			updateMask = append(updateMask, "advanced_options_config.user_ip_request_headers")
+		}
+		<% end -%>
 	}
 
 	if d.HasChange("adaptive_protection_config") {
@@ -770,7 +784,11 @@ func resourceComputeSecurityPolicyUpdate(d *schema.ResourceData, meta interface{
 	if len(securityPolicy.ForceSendFields) > 0 {
 		client := config.NewComputeClient(userAgent)
 
+		<% if version == 'ga' -%>
 		op, err := client.SecurityPolicies.Patch(project, sp, securityPolicy).Do()
+		<% else -%>
+		op, err := client.SecurityPolicies.Patch(project, sp, securityPolicy).UpdateMask(strings.Join(updateMask, ",")).Do()
+		<% end -%>
 
 		if err != nil {
 			return errwrap.Wrapf(fmt.Sprintf("Error updating SecurityPolicy %q: {{err}}", sp), err)
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_security_policy_test.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_security_policy_test.go.erb
index fcbfd5e80d98..3305581b2aa5 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_security_policy_test.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_security_policy_test.go.erb
@@ -198,6 +198,15 @@ func TestAccComputeSecurityPolicy_withAdvancedOptionsConfig(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
+			// change all AdvancedOptionConfig values.
+			{
+				Config: testAccComputeSecurityPolicy_withAdvancedOptionsConfig_update2(spName),
+			},
+			{
+				ResourceName:      "google_compute_security_policy.policy",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
 			<% end -%>
 			{
 				Config: testAccComputeSecurityPolicy_basic(spName),
@@ -1120,9 +1129,31 @@ resource "google_compute_security_policy" "policy" {
       ]
     }
     log_level    = "VERBOSE"
-	user_ip_request_headers = [
-	  "x-custom-ip",
-	]
+    user_ip_request_headers = [
+      "x-custom-ip",
+    ]
+  }
+}
+`, spName)
+}
+
+func testAccComputeSecurityPolicy_withAdvancedOptionsConfig_update2(spName string) string {
+	return fmt.Sprintf(`
+resource "google_compute_security_policy" "policy" {
+  name        = "%s"
+  description = "updated description changing all advancedOptionsConfig values"
+
+  advanced_options_config {
+    json_parsing = "DISABLED"
+    json_custom_config {
+      content_types = [
+        "application/json",
+        "application/vnd.hyper+json"
+      ]
+    }
+    log_level    = "NORMAL"
+    user_ip_request_headers = [
+    ]
   }
 }
 `, spName)
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_shared_vpc_service_project.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_shared_vpc_service_project.go.erb
index 2ce95299eb93..3f5f9d7f74d2 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_shared_vpc_service_project.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_shared_vpc_service_project.go.erb
@@ -10,6 +10,7 @@ import (
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"google.golang.org/api/googleapi"
@@ -36,6 +37,10 @@ func ResourceComputeSharedVpcServiceProject() *schema.Resource {
 			Delete: schema.DefaultTimeout(4 * time.Minute),
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+		),
+
 		Schema: map[string]*schema.Schema{
 			"host_project": {
 				Type:        schema.TypeString,
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_subnetwork_test.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_subnetwork_test.go.erb
index ad8d6dcd2003..a20a1b44d6fd 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_subnetwork_test.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_subnetwork_test.go.erb
@@ -369,6 +369,29 @@ func TestAccComputeSubnetwork_ipv6(t *testing.T) {
 	})
 }
 
+func TestAccComputeSubnetwork_internal_ipv6(t *testing.T) {
+	t.Parallel()
+
+	cnName := fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10))
+	subnetworkName := fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10))
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeSubnetworkDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeSubnetwork_internal_ipv6(cnName, subnetworkName),
+			},
+			{
+				ResourceName:      "google_compute_subnetwork.subnetwork",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func testAccCheckComputeSubnetworkExists(t *testing.T, n string, subnetwork *compute.Subnetwork) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
@@ -800,3 +823,22 @@ resource "google_compute_subnetwork" "subnetwork" {
 }
 `, cnName, subnetworkName)
 }
+
+func testAccComputeSubnetwork_internal_ipv6(cnName, subnetworkName string) string {
+	return fmt.Sprintf(`
+resource "google_compute_network" "custom-test" {
+  name                     = "%s"
+  auto_create_subnetworks  = false
+  enable_ula_internal_ipv6 = true
+}
+
+resource "google_compute_subnetwork" "subnetwork" {
+  name             = "%s"
+  ip_cidr_range    = "10.0.0.0/16"
+  region           = "us-central1"
+  network          = google_compute_network.custom-test.self_link
+  stack_type       = "IPV4_IPV6"
+  ipv6_access_type = "INTERNAL"
+}
+`, cnName, subnetworkName)
+}
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_target_pool.go.erb b/mmv1/third_party/terraform/services/compute/resource_compute_target_pool.go.erb
index 7a0bb638024f..ceb79c114082 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_target_pool.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_target_pool.go.erb
@@ -11,6 +11,7 @@ import (
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"google.golang.org/api/googleapi"
 
@@ -39,6 +40,11 @@ func ResourceComputeTargetPool() *schema.Resource {
 			Delete: schema.DefaultTimeout(4 * time.Minute),
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+			tpgresource.DefaultProviderRegion,
+		),
+
 		Schema: map[string]*schema.Schema{
 			"name": {
 				Type:        schema.TypeString,
diff --git a/mmv1/third_party/terraform/services/compute/resource_compute_vpn_tunnel_test.go b/mmv1/third_party/terraform/services/compute/resource_compute_vpn_tunnel_test.go
index 5c23da0895eb..1f67d5adf3b5 100644
--- a/mmv1/third_party/terraform/services/compute/resource_compute_vpn_tunnel_test.go
+++ b/mmv1/third_party/terraform/services/compute/resource_compute_vpn_tunnel_test.go
@@ -31,7 +31,6 @@ func TestAccComputeVpnTunnel_regionFromGateway(t *testing.T) {
 				ResourceName:            "google_compute_vpn_tunnel.foobar",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateIdPrefix:     fmt.Sprintf("%s/%s/", envvar.GetTestProjectFromEnv(), region),
 				ImportStateVerifyIgnore: []string{"shared_secret", "detailed_status"},
 			},
 		},
diff --git a/mmv1/third_party/terraform/services/compute/resource_usage_export_bucket.go.erb b/mmv1/third_party/terraform/services/compute/resource_usage_export_bucket.go.erb
index e15258a3cc79..da1205fc1dca 100644
--- a/mmv1/third_party/terraform/services/compute/resource_usage_export_bucket.go.erb
+++ b/mmv1/third_party/terraform/services/compute/resource_usage_export_bucket.go.erb
@@ -9,6 +9,7 @@ import (
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 
 <% if version == "ga" -%>
@@ -32,6 +33,10 @@ func ResourceProjectUsageBucket() *schema.Resource {
 			Delete: schema.DefaultTimeout(4 * time.Minute),
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+		),
+
 		Schema: map[string]*schema.Schema{
 			"bucket_name": {
 				Type:        schema.TypeString,
diff --git a/mmv1/third_party/terraform/services/compute/test-fixtures/ca_cert.pem b/mmv1/third_party/terraform/services/compute/test-fixtures/ca_cert.pem
new file mode 100644
index 000000000000..ac1e36438259
--- /dev/null
+++ b/mmv1/third_party/terraform/services/compute/test-fixtures/ca_cert.pem
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDDzCCAfegAwIBAgIUDOiCLH9QNMMYnjPZVf4VwO9blsEwDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAwwLZXhhbXBsZS5jb20wIBcNMjIwODI0MDg0MDUxWhgPMzAy
+MTEyMjUwODQwNTFaMBYxFDASBgNVBAMMC2V4YW1wbGUuY29tMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvOT925GG4lKV9HvAHsbecMhGPAqjhVRC26iZ
+UJC8oSWOu95lWJSX5ZhbiF6Nz192wDGV/VAh3Lxj8RYtcn75eDxQKTcKouDld+To
+CGIStPFWbR6rbysLuZqFVEXVOTvp2QIegInfrvnGC4j7Qpic7zrFB9HzJx+0HpeE
+yO4gkdzJfEK/gMmolUgJrKX59o+0+Rj+Jq3EtcQxL1fVBVJSx0NvpoR1eYpnHMr/
+rJKZkUUZ2xE86hrtpiP6OEYQTi00rmf4GnZF5QfGGD0xuoQXtR7Tu+XhKibXIhxc
+D4RzPLX1QS040PXvmMPLDb4YlUQ6V3Rs42JDvkkDwIMXZvn8awIDAQABo1MwUTAd
+BgNVHQ4EFgQURuo1CCZZAUv7xi02f2nC5tRbf18wHwYDVR0jBBgwFoAURuo1CCZZ
+AUv7xi02f2nC5tRbf18wDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC
+AQEAqx3tDxurnYr9EUPhF5/LlDPYM+VI7EgrKdRnuIqUlZI0tm3vOGME0te6dBTC
+YLNaHLW3m/4Tm4M2eg0Kpz6CxJfn3109G31dCi0xwzSDHf5TPUWvqIVhq5WRgMIf
+n8KYBlQSmqdJBRztUIQH/UPFnSbxymlS4s5qwDgTH5ag9EEBcnWsQ2LZjKi0eqve
+MaqAvvB+j8RGZzYY4re94bSJI42zIZ6nMWPtXwRuDc30xl/u+E0jWIgWbPwSd6Km
+3wnJnGiU2ezPGq3zEU+Rc39VVIFKQpciNeYuF3neHPJvYOf58qW2Z8s0VH0MR1x3
+3DoO/e30FIr9j+PRD+s5BPKF2A==
+-----END CERTIFICATE-----
diff --git a/mmv1/third_party/terraform/services/compute/test-fixtures/cert.pem b/mmv1/third_party/terraform/services/compute/test-fixtures/cert.pem
new file mode 100644
index 000000000000..ac1e36438259
--- /dev/null
+++ b/mmv1/third_party/terraform/services/compute/test-fixtures/cert.pem
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDDzCCAfegAwIBAgIUDOiCLH9QNMMYnjPZVf4VwO9blsEwDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAwwLZXhhbXBsZS5jb20wIBcNMjIwODI0MDg0MDUxWhgPMzAy
+MTEyMjUwODQwNTFaMBYxFDASBgNVBAMMC2V4YW1wbGUuY29tMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvOT925GG4lKV9HvAHsbecMhGPAqjhVRC26iZ
+UJC8oSWOu95lWJSX5ZhbiF6Nz192wDGV/VAh3Lxj8RYtcn75eDxQKTcKouDld+To
+CGIStPFWbR6rbysLuZqFVEXVOTvp2QIegInfrvnGC4j7Qpic7zrFB9HzJx+0HpeE
+yO4gkdzJfEK/gMmolUgJrKX59o+0+Rj+Jq3EtcQxL1fVBVJSx0NvpoR1eYpnHMr/
+rJKZkUUZ2xE86hrtpiP6OEYQTi00rmf4GnZF5QfGGD0xuoQXtR7Tu+XhKibXIhxc
+D4RzPLX1QS040PXvmMPLDb4YlUQ6V3Rs42JDvkkDwIMXZvn8awIDAQABo1MwUTAd
+BgNVHQ4EFgQURuo1CCZZAUv7xi02f2nC5tRbf18wHwYDVR0jBBgwFoAURuo1CCZZ
+AUv7xi02f2nC5tRbf18wDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC
+AQEAqx3tDxurnYr9EUPhF5/LlDPYM+VI7EgrKdRnuIqUlZI0tm3vOGME0te6dBTC
+YLNaHLW3m/4Tm4M2eg0Kpz6CxJfn3109G31dCi0xwzSDHf5TPUWvqIVhq5WRgMIf
+n8KYBlQSmqdJBRztUIQH/UPFnSbxymlS4s5qwDgTH5ag9EEBcnWsQ2LZjKi0eqve
+MaqAvvB+j8RGZzYY4re94bSJI42zIZ6nMWPtXwRuDc30xl/u+E0jWIgWbPwSd6Km
+3wnJnGiU2ezPGq3zEU+Rc39VVIFKQpciNeYuF3neHPJvYOf58qW2Z8s0VH0MR1x3
+3DoO/e30FIr9j+PRD+s5BPKF2A==
+-----END CERTIFICATE-----
diff --git a/mmv1/third_party/terraform/services/compute/test-fixtures/private-key.pem b/mmv1/third_party/terraform/services/compute/test-fixtures/private-key.pem
new file mode 100644
index 000000000000..b5d085cff078
--- /dev/null
+++ b/mmv1/third_party/terraform/services/compute/test-fixtures/private-key.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC85P3bkYbiUpX0
+e8Aext5wyEY8CqOFVELbqJlQkLyhJY673mVYlJflmFuIXo3PX3bAMZX9UCHcvGPx
+Fi1yfvl4PFApNwqi4OV35OgIYhK08VZtHqtvKwu5moVURdU5O+nZAh6Aid+u+cYL
+iPtCmJzvOsUH0fMnH7Qel4TI7iCR3Ml8Qr+AyaiVSAmspfn2j7T5GP4mrcS1xDEv
+V9UFUlLHQ2+mhHV5imccyv+skpmRRRnbETzqGu2mI/o4RhBOLTSuZ/gadkXlB8YY
+PTG6hBe1HtO75eEqJtciHFwPhHM8tfVBLTjQ9e+Yw8sNvhiVRDpXdGzjYkO+SQPA
+gxdm+fxrAgMBAAECggEAV4/A24TQpV4KFBw/WSTvnRFBeXinB1mhamhztWR6hCrA
+SPcVPKQY632eRI8sJmpGxl3V/Ogl4khT/cA9jfstEl7G++v/WrRsupCaPLSVnlnX
+KdsTNgOauk1WK9P5PMA4rPcuA4Cl91riQpubeWn8KWsxRWg90i+Ak8PB8lBsOaB1
+QzjigWlrRWSpodaw0MBIMZFDL2BYK8HEr+wyATYIyGvDQc9zCnMQIQIZyEPYepLO
+04Dw17YcjgnoJ5gLAFiTvDrCpTMewud1RQzvW5TAvG2piw34sf3QMGPM7aXNrfuZ
+4ZPC/MwVQgq9Nc+jeDsjApQmJKJ+3a8OdIPU89ArTQKBgQDCpHHQe1RzpHmIx47/
+9N5r+NPBhh8flDYmvgi6zPeBfrAaLWhidS8c7Voa6HwvMxbhryDEvc0YqI3vllfy
+xnRF+DfSryozW0gjrkXDGoOzqOJ3EuQwLSJnyX6La2lmufqsRFazwYJ5sxcjoGHK
+/sbwZkIUj1ejuH44ve+ZJQFfpwKBgQD4cLJrJhqImUDhHZRx9jBvxyeHy/RjmHK6
+70xQVDi9ZqeExHwtoSbolhXKLB1RtBnw+t5Csy7IDNBDsbUg9fXU8KyCTIdmsyws
+bDb5hdKsUF76rkKzlpttiXMRVWGS3CMKWahBpnL3lFB3tdtmskemkBTXVn4VgKAH
+xk9XnZ11nQKBgDbQSJ0FnkrSzscOK984/ko50Kh3NNyXyIgwjBTPFASLwNweXX8c
+sR/cV7usLQy9vnvf7cJ6EQAYt5/5Httnt+bceBwE6EV+N1qVAWBoXx6BOQV/dHN8
+wmun+tMYdJ5RUZ6hwCjvHedX3/RQfjnEdhHNOl6/31Zj5mfkVU0zdqeRAoGAcvIh
+erXMfPr7K6y16+xOCMmKHqhc0F/OZXMmSdxNzEPcqe8GzU3MZLxcJIg4oH7FqdtI
+Tm/86w4Spd9owHFMZlNcXYTu+LNZcsw2u0gRayxcZXuO3OyHySxZEuIAHSTBCZ7l
+3EoY0zfJ6zk249MEl6n+GouoFmbGpBI6z3zbR3kCgYEAlCNZVH4uJrP5beTOZTTR
+VJRk7BXvEC6HsM140YtIN7NHy2GtzrgmmY/ZAFB/hX8Ft4ex2MxbIp3hvxroTqGn
+bfu7uv97NoPQqbjtc3Mz8h2IaXTVDUnWYY5gDu6rM2w+Z75/sWIGiTWrsdYX4ohb
+ujngzJ7Ew7GgKSboj6mtlVM=
+-----END PRIVATE KEY-----
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/services/container/data_source_google_container_cluster_test.go b/mmv1/third_party/terraform/services/container/data_source_google_container_cluster_test.go
index a4725f5c2a61..5389d6f15bb0 100644
--- a/mmv1/third_party/terraform/services/container/data_source_google_container_cluster_test.go
+++ b/mmv1/third_party/terraform/services/container/data_source_google_container_cluster_test.go
@@ -11,12 +11,15 @@ import (
 func TestAccContainerClusterDatasource_zonal(t *testing.T) {
 	t.Parallel()
 
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerClusterDatasource_zonal(acctest.RandString(t, 10)),
+				Config: testAccContainerClusterDatasource_zonal(acctest.RandString(t, 10), networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					acctest.CheckDataSourceStateMatchesResourceStateWithIgnores(
 						"data.google_container_cluster.kubes",
@@ -26,6 +29,7 @@ func TestAccContainerClusterDatasource_zonal(t *testing.T) {
 							"enable_autopilot":             {},
 							"enable_tpu":                   {},
 							"pod_security_policy_config.#": {},
+							"deletion_protection":          {},
 						},
 					),
 				),
@@ -37,12 +41,15 @@ func TestAccContainerClusterDatasource_zonal(t *testing.T) {
 func TestAccContainerClusterDatasource_regional(t *testing.T) {
 	t.Parallel()
 
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerClusterDatasource_regional(acctest.RandString(t, 10)),
+				Config: testAccContainerClusterDatasource_regional(acctest.RandString(t, 10), networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					acctest.CheckDataSourceStateMatchesResourceStateWithIgnores(
 						"data.google_container_cluster.kubes",
@@ -52,6 +59,7 @@ func TestAccContainerClusterDatasource_regional(t *testing.T) {
 							"enable_autopilot":             {},
 							"enable_tpu":                   {},
 							"pod_security_policy_config.#": {},
+							"deletion_protection":          {},
 						},
 					),
 				),
@@ -60,32 +68,40 @@ func TestAccContainerClusterDatasource_regional(t *testing.T) {
 	})
 }
 
-func testAccContainerClusterDatasource_zonal(suffix string) string {
+func testAccContainerClusterDatasource_zonal(suffix, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "kubes" {
   name               = "tf-test-cluster-%s"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
+
 }
 
 data "google_container_cluster" "kubes" {
   name     = google_container_cluster.kubes.name
   location = google_container_cluster.kubes.location
 }
-`, suffix)
+`, suffix, networkName, subnetworkName)
 }
 
-func testAccContainerClusterDatasource_regional(suffix string) string {
+func testAccContainerClusterDatasource_regional(suffix, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "kubes" {
   name               = "tf-test-cluster-%s"
   location           = "us-central1"
   initial_node_count = 1
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
+
 }
 
 data "google_container_cluster" "kubes" {
   name     = google_container_cluster.kubes.name
   location = google_container_cluster.kubes.location
 }
-`, suffix)
+`, suffix, networkName, subnetworkName)
 }
diff --git a/mmv1/third_party/terraform/services/container/node_config.go.erb b/mmv1/third_party/terraform/services/container/node_config.go.erb
index d331c4205b0b..b5ce9e2e29bc 100644
--- a/mmv1/third_party/terraform/services/container/node_config.go.erb
+++ b/mmv1/third_party/terraform/services/container/node_config.go.erb
@@ -32,8 +32,8 @@ func schemaLoggingVariant() *schema.Schema {
 	return &schema.Schema{
 		Type: schema.TypeString,
 		Optional: true,
+		Computed: true,
 		Description: `Type of logging agent that is used as the default value for node pools in the cluster. Valid values include DEFAULT and MAX_THROUGHPUT.`,
-		Default: "DEFAULT",
 		ValidateFunc: validation.StringInSlice([]string{"DEFAULT", "MAX_THROUGHPUT"}, false),
 	}
 }
@@ -411,36 +411,24 @@ func schemaNodeConfig() *schema.Schema {
 				},
 
 				"taint": {
-					Type:             schema.TypeList,
-					Optional:         true,
-					// Computed=true because GKE Sandbox will automatically add taints to nodes that can/cannot run sandboxed pods.
-					Computed:         true,
-					ForceNew:         true,
-					// Legacy config mode allows explicitly defining an empty taint.
-					// See https://www.terraform.io/docs/configuration/attr-as-blocks.html
-					ConfigMode: schema.SchemaConfigModeAttr,
+					Type:        schema.TypeList,
+					Optional:    true,
 					Description: `List of Kubernetes taints to be applied to each node.`,
-	<% unless version.nil? || version == 'ga' -%>
-					DiffSuppressFunc: containerNodePoolTaintSuppress,
-	<% end -%>
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
 							"key": {
 								Type:     schema.TypeString,
 								Required: true,
-								ForceNew: true,
 								Description: `Key for taint.`,
 							},
 							"value": {
 								Type:     schema.TypeString,
 								Required: true,
-								ForceNew: true,
 								Description: `Value for taint.`,
 							},
 							"effect": {
 								Type:         schema.TypeString,
 								Required:     true,
-								ForceNew:     true,
 								ValidateFunc: validation.StringInSlice([]string{"NO_SCHEDULE", "PREFER_NO_SCHEDULE", "NO_EXECUTE"}, false),
 								Description: `Effect for taint.`,
 							},
@@ -448,6 +436,31 @@ func schemaNodeConfig() *schema.Schema {
 					},
 				},
 
+				"effective_taints": {
+					Type:             schema.TypeList,
+					Computed:         true,
+					Description: `List of kubernetes taints applied to each node.`,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"key": {
+								Type:     schema.TypeString,
+								Computed: true,
+								Description: `Key for taint.`,
+							},
+							"value": {
+								Type:     schema.TypeString,
+								Computed: true,
+								Description: `Value for taint.`,
+							},
+							"effect": {
+								Type:         schema.TypeString,
+								Computed:     true,
+								Description: `Effect for taint.`,
+							},
+						},
+					},
+				},
+
 				"workload_metadata_config": {
 					Computed:   true,
 					Type:       schema.TypeList,
@@ -534,10 +547,18 @@ func schemaNodeConfig() *schema.Schema {
 						Schema: map[string]*schema.Schema{
 							"sysctls": {
 								Type:     schema.TypeMap,
-								Required: true,
+								Optional: true,
 								Elem:     &schema.Schema{Type: schema.TypeString},
 								Description: `The Linux kernel parameters to be applied to the nodes and all pods running on the nodes.`,
 							},
+							"cgroup_mode": {
+								Type:             schema.TypeString,
+								Optional:         true,
+								Computed:         true,
+								ValidateFunc:     validation.StringInSlice([]string{"CGROUP_MODE_UNSPECIFIED", "CGROUP_MODE_V1", "CGROUP_MODE_V2"}, false),
+								Description:      `cgroupMode specifies the cgroup mode to be used on the node.`,
+								DiffSuppressFunc: tpgresource.EmptyOrDefaultStringSuppress("CGROUP_MODE_UNSPECIFIED"),
+							},
 						},
 					},
 				},
@@ -642,6 +663,29 @@ func schemaNodeConfig() *schema.Schema {
 						},
 					},
 				},
+				"fast_socket": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Description: `Enable or disable NCCL Fast Socket in the node pool.`,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"enabled": {
+								Type:        schema.TypeBool,
+								Required:    true,
+								Description: `Whether or not NCCL Fast Socket is enabled`,
+							},
+						},
+					},
+				},
+				<% unless version == 'ga' -%>
+				"enable_confidential_storage": {
+						Type:     schema.TypeBool,
+						Optional: true,
+						ForceNew: true,
+						Description: `If enabled boot disks are configured with confidential mode.`,
+				},
+				<% end -%>
 			},
 		},
 	}
@@ -779,6 +823,13 @@ func expandNodeConfig(v interface{}) *container.NodeConfig {
 		}
 	}
 
+	if v, ok := nodeConfig["fast_socket"]; ok && len(v.([]interface{})) > 0 {
+		conf := v.([]interface{})[0].(map[string]interface{})
+		nc.FastSocket = &container.FastSocket{
+			Enabled: conf["enabled"].(bool),
+		}
+	}
+
 	if v, ok := nodeConfig["reservation_affinity"]; ok && len(v.([]interface{})) > 0 {
 		conf := v.([]interface{})[0].(map[string]interface{})
 		valuesSet := conf["values"].(*schema.Set)
@@ -875,12 +926,13 @@ func expandNodeConfig(v interface{}) *container.NodeConfig {
 				Value:  data["value"].(string),
 				Effect: data["effect"].(string),
 			}
+
 			nodeTaints = append(nodeTaints, taint)
 		}
+
 		nc.Taints = nodeTaints
 	}
 
-
 	if v, ok := nodeConfig["workload_metadata_config"]; ok {
 		nc.WorkloadMetadataConfig = expandWorkloadMetadataConfig(v)
 	}
@@ -920,6 +972,12 @@ func expandNodeConfig(v interface{}) *container.NodeConfig {
 		nc.SoleTenantConfig = expandSoleTenantConfig(v)
 	}
 
+	<% unless version == 'ga' -%>
+	if v,ok := nodeConfig["enable_confidential_storage"]; ok {
+		nc.EnableConfidentialStorage = v.(bool)
+	}
+	<% end -%>
+	
 	<% unless version == "ga" -%>
 	if v, ok := nodeConfig["host_maintenance_policy"]; ok {
 		nc.HostMaintenancePolicy = expandHostMaintenancePolicy(v)
@@ -986,18 +1044,43 @@ func expandLinuxNodeConfig(v interface{}) *container.LinuxNodeConfig {
 	if len(ls) == 0 {
 		return nil
 	}
+	if ls[0] == nil {
+		return &container.LinuxNodeConfig{}
+	}
 	cfg := ls[0].(map[string]interface{})
+
+	linuxNodeConfig := &container.LinuxNodeConfig{}
+	sysctls := expandSysctls(cfg)
+	if sysctls != nil {
+		linuxNodeConfig.Sysctls = sysctls
+	}
+	cgroupMode := expandCgroupMode(cfg)
+	if len(cgroupMode) != 0 {
+		linuxNodeConfig.CgroupMode = cgroupMode
+	}
+
+	return linuxNodeConfig
+}
+
+func expandSysctls(cfg map[string]interface{}) map[string]string {
 	sysCfgRaw, ok := cfg["sysctls"]
 	if !ok {
 		return nil
 	}
-	m := make(map[string]string)
+	sysctls := make(map[string]string)
 	for k, v := range sysCfgRaw.(map[string]interface{}) {
-		m[k] = v.(string)
+		sysctls[k] = v.(string)
 	}
-	return &container.LinuxNodeConfig{
-		Sysctls: m,
+	return sysctls
+}
+
+func expandCgroupMode(cfg map[string]interface{}) string {
+	cgroupMode, ok := cfg["cgroup_mode"]
+	if !ok {
+		return ""
 	}
+
+	return cgroupMode.(string)
 }
 
 func expandSoleTenantConfig(v interface{}) *container.SoleTenantConfig {
@@ -1059,11 +1142,11 @@ func expandConfidentialNodes(configured interface{}) *container.ConfidentialNode
 }
 
 func flattenNodeConfigDefaults(c *container.NodeConfigDefaults) []map[string]interface{} {
-        result := make([]map[string]interface{}, 0, 1)
+	result := make([]map[string]interface{}, 0, 1)
 
-        if c == nil {
-                return result
-        }
+	if c == nil {
+		return result
+	}
 
 	result = append(result, map[string]interface{}{})
 
@@ -1072,16 +1155,27 @@ func flattenNodeConfigDefaults(c *container.NodeConfigDefaults) []map[string]int
 <% unless version == 'ga' -%>
 	result[0]["gcfs_config"] = flattenGcfsConfig(c.GcfsConfig)
 <% end -%>
-        return result
+	return result
 }
 
-func flattenNodeConfig(c *container.NodeConfig) []map[string]interface{} {
+// v == old state of `node_config`
+func flattenNodeConfig(c *container.NodeConfig, v interface{}) []map[string]interface{} {
 	config := make([]map[string]interface{}, 0, 1)
 
 	if c == nil {
 		return config
 	}
 
+	// default to no prior taint state if there are any issues
+	oldTaints := []interface{}{}
+	oldNodeConfigSchemaContainer := v.([]interface{})
+	if len(oldNodeConfigSchemaContainer) != 0 {
+		oldNodeConfigSchema := oldNodeConfigSchemaContainer[0].(map[string]interface{})
+		if vt, ok := oldNodeConfigSchema["taint"]; ok && len(vt.([]interface{})) > 0 {
+			oldTaints = vt.([]interface{})
+		}
+	}
+
 	config = append(config, map[string]interface{}{
 		"machine_type":             c.MachineType,
 		"disk_size_gb":             c.DiskSizeGb,
@@ -1101,25 +1195,30 @@ func flattenNodeConfig(c *container.NodeConfig) []map[string]interface{} {
 		"metadata":                 c.Metadata,
 		"image_type":               c.ImageType,
 		"labels":                   c.Labels,
-		"resource_labels": 			c.ResourceLabels,
+		"resource_labels":          c.ResourceLabels,
 		"tags":                     c.Tags,
 		"preemptible":              c.Preemptible,
 		"spot":                     c.Spot,
 		"min_cpu_platform":         c.MinCpuPlatform,
 		"shielded_instance_config": flattenShieldedInstanceConfig(c.ShieldedInstanceConfig),
-		"taint":                    flattenTaints(c.Taints),
+		"taint":                    flattenTaints(c.Taints, oldTaints),
+		"effective_taints":         flattenEffectiveTaints(c.Taints),
 		"workload_metadata_config": flattenWorkloadMetadataConfig(c.WorkloadMetadataConfig),
 <% unless version == 'ga' -%>
-		"sandbox_config": 			 flattenSandboxConfig(c.SandboxConfig),
+		"sandbox_config": 			    flattenSandboxConfig(c.SandboxConfig),
 		"host_maintenance_policy":  flattenHostMaintenancePolicy(c.HostMaintenancePolicy),
 <% end -%>
 		"confidential_nodes":       flattenConfidentialNodes(c.ConfidentialNodes),
-		"boot_disk_kms_key": 		c.BootDiskKmsKey,
-		"kubelet_config":            flattenKubeletConfig(c.KubeletConfig),
-		"linux_node_config":         flattenLinuxNodeConfig(c.LinuxNodeConfig),
-                "node_group":                c.NodeGroup,
+		"boot_disk_kms_key":        c.BootDiskKmsKey,
+		"kubelet_config":           flattenKubeletConfig(c.KubeletConfig),
+		"linux_node_config":        flattenLinuxNodeConfig(c.LinuxNodeConfig),
+		"node_group":               c.NodeGroup,
 		"advanced_machine_features": flattenAdvancedMachineFeaturesConfig(c.AdvancedMachineFeatures),
-		"sole_tenant_config":                 flattenSoleTenantConfig(c.SoleTenantConfig),
+		"sole_tenant_config":        flattenSoleTenantConfig(c.SoleTenantConfig),
+		"fast_socket":               flattenFastSocket(c.FastSocket),
+	<% unless version == 'ga' -%>		
+		"enable_confidential_storage": c.EnableConfidentialStorage,
+	<% end -%>
 	})
 
 	if len(c.OauthScopes) > 0 {
@@ -1250,7 +1349,31 @@ func flattenGKEReservationAffinity(c *container.ReservationAffinity) []map[strin
 	return result
 }
 
-func flattenTaints(c []*container.NodeTaint) []map[string]interface{} {
+// flattenTaints records the set of taints already present in state.
+func flattenTaints(c []*container.NodeTaint, oldTaints []interface{}) []map[string]interface{} {
+	taintKeys := map[string]struct{}{}
+	for _, raw := range oldTaints {
+		data := raw.(map[string]interface{})
+		taintKey := data["key"].(string)
+		taintKeys[taintKey] = struct{}{}
+	}
+
+	result := []map[string]interface{}{}
+	for _, taint := range c {
+		if _, ok := taintKeys[taint.Key]; ok {
+			result = append(result, map[string]interface{}{
+				"key":    taint.Key,
+				"value":  taint.Value,
+				"effect": taint.Effect,
+			})
+		}
+	}
+
+	return result
+}
+
+// flattenEffectiveTaints records the complete set of taints returned from GKE.
+func flattenEffectiveTaints(c []*container.NodeTaint) []map[string]interface{} {
 	result := []map[string]interface{}{}
 	for _, taint := range c {
 		result = append(result, map[string]interface{}{
@@ -1259,10 +1382,10 @@ func flattenTaints(c []*container.NodeTaint) []map[string]interface{} {
 			"effect": taint.Effect,
 		})
 	}
+
 	return result
 }
 
-
 func flattenWorkloadMetadataConfig(c *container.WorkloadMetadataConfig) []map[string]interface{} {
 	result := []map[string]interface{}{}
 	if c != nil {
@@ -1329,74 +1452,6 @@ func containerNodePoolLabelsSuppress(k, old, new string, d *schema.ResourceData)
 
 	return true
 }
-
-func containerNodePoolTaintSuppress(k, old, new string, d *schema.ResourceData) bool {
-	// Node configs are embedded into multiple resources (container cluster and
-	// container node pool) so we determine the node config key dynamically.
-	idx := strings.Index(k, ".taint.")
-	if idx < 0 {
-		return false
-	}
-
-	root := k[:idx]
-
-	// Right now, GKE only applies its own out-of-band labels when you enable
-	// Sandbox. We only need to perform diff suppression in this case;
-	// otherwise, the default Terraform behavior is fine.
-	o, n := d.GetChange(root + ".sandbox_config.0.sandbox_type")
-	if o == nil || n == nil {
-		return false
-	}
-
-	// Pull the entire changeset as a list rather than trying to deal with each
-	// element individually.
-	o, n = d.GetChange(root + ".taint")
-	if o == nil || n == nil {
-		return false
-	}
-
-	type taintType struct {
-		Key, Value, Effect string
-	}
-
-	taintSet := make(map[taintType]struct{})
-
-	// Add all new taints to set.
-	for _, raw := range n.([]interface{}) {
-		data := raw.(map[string]interface{})
-		taint := taintType{
-			Key:    data["key"].(string),
-			Value:  data["value"].(string),
-			Effect: data["effect"].(string),
-		}
-		taintSet[taint] = struct{}{}
-	}
-
-	// Remove all current taints, skipping GKE-managed keys if not present in
-	// the new configuration.
-	for _, raw := range o.([]interface{}) {
-		data := raw.(map[string]interface{})
-		taint := taintType{
-			Key:    data["key"].(string),
-			Value:  data["value"].(string),
-			Effect: data["effect"].(string),
-		}
-		if _, ok := taintSet[taint]; ok {
-			delete(taintSet, taint)
-		} else if !strings.HasPrefix(taint.Key, "sandbox.gke.io/") && taint.Key != "kubernetes.io/arch" {
-			// User-provided taint removed in new configuration.
-			return false
-		}
-	}
-
-	// If, at this point, the set still has elements, the new configuration
-	// added an additional taint.
-	if len(taintSet) > 0 {
-		return false
-	}
-
-	return true
-}
 <% end -%>
 
 func flattenKubeletConfig(c *container.NodeKubeletConfig) []map[string]interface{} {
@@ -1416,7 +1471,8 @@ func flattenLinuxNodeConfig(c *container.LinuxNodeConfig) []map[string]interface
 	result := []map[string]interface{}{}
 	if c != nil {
 		result = append(result, map[string]interface{}{
-			"sysctls": c.Sysctls,
+			"sysctls":     c.Sysctls,
+			"cgroup_mode": c.CgroupMode,
 		})
 	}
 	return result
@@ -1450,6 +1506,16 @@ func flattenSoleTenantConfig(c *container.SoleTenantConfig) []map[string]interfa
 	})
 }
 
+func flattenFastSocket(c *container.FastSocket) []map[string]interface{} {
+	result := []map[string]interface{}{}
+	if c != nil {
+		result = append(result, map[string]interface{}{
+			"enabled": c.Enabled,
+		})
+	}
+	return result
+}
+
 <% unless version == 'ga' -%>
 func flattenHostMaintenancePolicy(c *container.HostMaintenancePolicy) []map[string]interface{} {
 	result := []map[string]interface{}{}
@@ -1461,4 +1527,4 @@ func flattenHostMaintenancePolicy(c *container.HostMaintenancePolicy) []map[stri
 
 	return result
 }
-<% end -%>
\ No newline at end of file
+<% end -%>
diff --git a/mmv1/third_party/terraform/services/container/resource_container_cluster.go.erb b/mmv1/third_party/terraform/services/container/resource_container_cluster.go.erb
index da88cbb5421d..58ea973c8eda 100644
--- a/mmv1/third_party/terraform/services/container/resource_container_cluster.go.erb
+++ b/mmv1/third_party/terraform/services/container/resource_container_cluster.go.erb
@@ -105,6 +105,14 @@ var (
 		}
 		return false
 	})
+
+	suppressDiffForPreRegisteredFleet = schema.SchemaDiffSuppressFunc(func(k, oldValue, newValue string, d *schema.ResourceData) bool {
+		if v, _ := d.Get("fleet.0.pre_registered").(bool); v {
+			log.Printf("[DEBUG] fleet suppress pre_registered: %v\n", v)
+			return true
+		}
+		return false
+	})
 )
 
 // This uses the node pool nodeConfig schema but sets
@@ -205,8 +213,15 @@ func ResourceContainerCluster() *schema.Resource {
 			Delete: schema.DefaultTimeout(40 * time.Minute),
 		},
 
-		SchemaVersion: 1,
+		SchemaVersion: 2,
 		MigrateState:  resourceContainerClusterMigrateState,
+		StateUpgraders: []schema.StateUpgrader{
+			{
+				Type:    resourceContainerClusterResourceV1().CoreConfigSchema().ImpliedType(),
+				Upgrade: ResourceContainerClusterUpgradeV1,
+				Version: 1,
+			},
+		},
 
 		Importer: &schema.ResourceImporter{
 			State: resourceContainerClusterStateImporter,
@@ -262,6 +277,13 @@ func ResourceContainerCluster() *schema.Resource {
 				Description: `The list of zones in which the cluster's nodes are located. Nodes must be in the region of their regional cluster or in the same region as their cluster's zone for zonal clusters. If this is specified for a zonal cluster, omit the cluster's zone.`,
 			},
 
+			"deletion_protection": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Default:     true,
+				Description: `Whether or not to allow Terraform to destroy the instance. Defaults to true. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the cluster will fail.`,
+			},
+
 			"addons_config": {
 				Type:        schema.TypeList,
 				Optional:    true,
@@ -380,7 +402,7 @@ func ResourceContainerCluster() *schema.Resource {
 							Computed:     true,
 							AtLeastOneOf: addonsConfigKeys,
 							MaxItems:     1,
-							Description:  `Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. Defaults to enabled; set disabled = true to disable.`,
+							Description:  `Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. Set enabled = true to enable. The Compute Engine persistent disk CSI Driver is enabled by default on newly created clusters for the following versions: Linux clusters: GKE version 1.18.10-gke.2100 or later, or 1.19.3-gke.2100 or later.`,
 							Elem: &schema.Resource{
 								Schema: map[string]*schema.Schema{
 									"enabled": {
@@ -407,13 +429,12 @@ func ResourceContainerCluster() *schema.Resource {
 							},
 						},
 						"gcs_fuse_csi_driver_config": {
-							Type:          schema.TypeList,
-							Optional:      true,
-							Computed:      true,
-							AtLeastOneOf:  addonsConfigKeys,
-							MaxItems:      1,
-							Description:   `The status of the GCS Fuse CSI driver addon, which allows the usage of gcs bucket as volumes. Defaults to disabled; set enabled = true to enable.`,
-							ConflictsWith: []string{"enable_autopilot"},
+							Type:         schema.TypeList,
+							Optional:     true,
+							Computed:     true,
+							AtLeastOneOf: addonsConfigKeys,
+							MaxItems:     1,
+							Description:  `The status of the GCS Fuse CSI driver addon, which allows the usage of gcs bucket as volumes. Defaults to disabled; set enabled = true to enable.`,
 							Elem: &schema.Resource{
 								Schema: map[string]*schema.Schema{
 									"enabled": {
@@ -780,40 +801,32 @@ func ResourceContainerCluster() *schema.Resource {
 				Description: ` Description of the cluster.`,
 			},
 
-                        "enable_binary_authorization": {
-				Type:        schema.TypeBool,
-				Optional:    true,
-                                Default:     false,
-                                Deprecated:  "Deprecated in favor of binary_authorization.",
-				Description: `Enable Binary Authorization for this cluster. If enabled, all container images will be validated by Google Binary Authorization.`,
-				ConflictsWith: []string{"enable_autopilot", "binary_authorization"},
-			},
-                        "binary_authorization": {
-                                Type:             schema.TypeList,
-                                Optional:         true,
-                                DiffSuppressFunc: BinaryAuthorizationDiffSuppress,
-                                MaxItems:         1,
-                                Description:      "Configuration options for the Binary Authorization feature.",
-                                ConflictsWith:    []string{"enable_binary_authorization"},
-                                Elem: &schema.Resource{
-                                        Schema: map[string]*schema.Schema{
-                                                "enabled": {
-                                                        Type:          schema.TypeBool,
-                                                        Optional:      true,
-                                                        Deprecated:    "Deprecated in favor of evaluation_mode.",
-                                                        Description:   "Enable Binary Authorization for this cluster.",
-                                                        ConflictsWith: []string{"enable_autopilot", "binary_authorization.0.evaluation_mode"},
-                                                },
-                                                "evaluation_mode": {
-                                                        Type:          schema.TypeString,
-                                                        Optional:      true,
-                                                        ValidateFunc:  validation.StringInSlice([]string{"DISABLED", "PROJECT_SINGLETON_POLICY_ENFORCE"}, false),
-                                                        Description:   "Mode of operation for Binary Authorization policy evaluation.",
-                                                        ConflictsWith: []string{"binary_authorization.0.enabled"},
-                                                },
-                                        },
-                                },
-                        },
+			"binary_authorization": {
+					Type:             schema.TypeList,
+					Optional:         true,
+					DiffSuppressFunc: BinaryAuthorizationDiffSuppress,
+					MaxItems:         1,
+					Description:      "Configuration options for the Binary Authorization feature.",
+					Elem: &schema.Resource{
+							Schema: map[string]*schema.Schema{
+									"enabled": {
+											Type:          schema.TypeBool,
+											Optional:      true,
+											Deprecated:    "Deprecated in favor of evaluation_mode.",
+											Description:   "Enable Binary Authorization for this cluster.",
+											ConflictsWith: []string{"enable_autopilot", "binary_authorization.0.evaluation_mode"},
+									},
+									"evaluation_mode": {
+											Type:          schema.TypeString,
+											Optional:      true,
+                     									Computed:      true,
+											ValidateFunc:  validation.StringInSlice([]string{"DISABLED", "PROJECT_SINGLETON_POLICY_ENFORCE"}, false),
+											Description:   "Mode of operation for Binary Authorization policy evaluation.",
+											ConflictsWith: []string{"binary_authorization.0.enabled"},
+									},
+							},
+					},
+			},
 
 			"enable_kubernetes_alpha": {
 				Type:        schema.TypeBool,
@@ -1137,8 +1150,8 @@ func ResourceContainerCluster() *schema.Resource {
 							Type:             schema.TypeString,
 							Optional:         true,
 							Computed:         true,
-							ValidateFunc:     validation.StringInSlice([]string{"VULNERABILITY_DISABLED", "VULNERABILITY_BASIC", "VULNERABILITY_MODE_UNSPECIFIED"}, false),
-							Description:      `Sets the mode of the Kubernetes security posture API's workload vulnerability scanning. Available options include VULNERABILITY_DISABLED and VULNERABILITY_BASIC.`,
+							ValidateFunc:     validation.StringInSlice([]string{"VULNERABILITY_DISABLED", "VULNERABILITY_BASIC", "VULNERABILITY_ENTERPRISE", "VULNERABILITY_MODE_UNSPECIFIED"}, false),
+							Description:      `Sets the mode of the Kubernetes security posture API's workload vulnerability scanning. Available options include VULNERABILITY_DISABLED, VULNERABILITY_BASIC and VULNERABILITY_ENTERPRISE.`,
 							DiffSuppressFunc: tpgresource.EmptyOrDefaultStringSuppress("VULNERABILITY_MODE_UNSPECIFIED"),
 						},
 					},
@@ -1377,11 +1390,10 @@ func ResourceContainerCluster() *schema.Resource {
 						},
 						"provider": {
 							Type:             schema.TypeString,
-							Default:          "PROVIDER_UNSPECIFIED",
 							Optional:         true,
 							ValidateFunc:     validation.StringInSlice([]string{"PROVIDER_UNSPECIFIED", "CALICO"}, false),
 							DiffSuppressFunc: tpgresource.EmptyOrDefaultStringSuppress("PROVIDER_UNSPECIFIED"),
-							Description:      `The selected network policy provider. Defaults to PROVIDER_UNSPECIFIED.`,
+							Description:      `The selected network policy provider.`,
 						},
 					},
 				},
@@ -1403,7 +1415,6 @@ func ResourceContainerCluster() *schema.Resource {
 
 			"node_pool_defaults": clusterSchemaNodePoolDefaults(),
 
-<% unless version == "ga" -%>
 			"node_pool_auto_config": {
 				Type:             schema.TypeList,
 				Optional:         true,
@@ -1431,7 +1442,6 @@ func ResourceContainerCluster() *schema.Resource {
 					},
 				},
 			},
-<% end -%>
 
 			"node_version": {
 				Type:        schema.TypeString,
@@ -1595,13 +1605,14 @@ func ResourceContainerCluster() *schema.Resource {
 				},
 			},
 
+			// Defaults to "VPC_NATIVE" during create only
 			"networking_mode": {
 				Type:         schema.TypeString,
 				Optional:     true,
 				Computed:     true,
 				ForceNew:     true,
 				ValidateFunc: validation.StringInSlice([]string{"VPC_NATIVE", "ROUTES"}, false),
-				Description:  `Determines whether alias IPs or routes will be used for pod IPs in the cluster.`,
+				Description:  `Determines whether alias IPs or routes will be used for pod IPs in the cluster. Defaults to VPC_NATIVE for new clusters.`,
 			},
 
 			"remove_default_node_pool": {
@@ -1752,7 +1763,6 @@ func ResourceContainerCluster() *schema.Resource {
 				},
 			},
 
-<% unless version == 'ga' -%>
 			"identity_service_config": {
 				Type:     schema.TypeList,
 				MaxItems: 1,
@@ -1769,7 +1779,6 @@ func ResourceContainerCluster() *schema.Resource {
 					},
 				},
 			},
-<% end -%>
 
 	"service_external_ips_config": {
 		Type:        schema.TypeList,
@@ -2040,6 +2049,32 @@ func ResourceContainerCluster() *schema.Resource {
 					},
 				},
 			},
+			"fleet": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				MaxItems:    1,
+				Description: `Fleet configuration of the cluster.`,
+				DiffSuppressFunc: suppressDiffForPreRegisteredFleet,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"project": {
+							Type:              schema.TypeString,
+							Optional:          true,
+							Description:       `The Fleet host project of the cluster.`,
+						},
+                                          	"membership": {
+                                                	Type:             schema.TypeString,
+                                                	Computed:         true,
+                                                	Description:      `Full resource name of the registered fleet membership of the cluster.`,
+                                          	},
+                                          	"pre_registered": {
+                                                	Type:             schema.TypeBool,
+                                                	Computed:         true,
+                                                	Description:      `Whether the cluster has been registered via the fleet API.`,
+                                          	},
+					},
+				},
+			},
 		},
 	}
 }
@@ -2120,6 +2155,21 @@ func resourceContainerClusterCreate(d *schema.ResourceData, meta interface{}) er
 
 	clusterName := d.Get("name").(string)
 
+	// Default to VPC_NATIVE mode during initial creation
+	// This solution (a conditional default) should not be considered to set a precedent on its own.
+	// If you're considering a similar approach on a different resource, strongly weigh making the field required.
+	// GKE tends to require exceptional handling in general- and this default was a breaking change in their API
+	// that was compounded on by numerous product developments afterwards. We have not seen a similar case
+	// since, after several years.
+	networkingMode := d.Get("networking_mode").(string)
+	clusterIpv4Cidr := d.Get("cluster_ipv4_cidr").(string)
+	if networkingMode == "" && clusterIpv4Cidr == "" {
+		err := d.Set("networking_mode", "VPC_NATIVE")
+		if err != nil {
+			return fmt.Errorf("Error setting networking mode during creation: %s", err)
+		}
+	}
+
 	ipAllocationBlock, err := expandIPAllocationPolicy(d.Get("ip_allocation_policy"), d.Get("networking_mode").(string), d.Get("enable_autopilot").(bool))
 	if err != nil {
 		return err
@@ -2154,7 +2204,7 @@ func resourceContainerClusterCreate(d *schema.ResourceData, meta interface{}) er
 		PodSecurityPolicyConfig: expandPodSecurityPolicyConfig(d.Get("pod_security_policy_config")),
 <% end -%>
 		Autoscaling:             expandClusterAutoscaling(d.Get("cluster_autoscaling"), d),
-		BinaryAuthorization:     expandBinaryAuthorization(d.Get("binary_authorization"), d.Get("enable_binary_authorization").(bool)),
+		BinaryAuthorization:     expandBinaryAuthorization(d.Get("binary_authorization")),
 		Autopilot: &container.Autopilot{
 			Enabled:         d.Get("enable_autopilot").(bool),
 			WorkloadPolicyConfig: workloadPolicyConfig,
@@ -2182,8 +2232,8 @@ func resourceContainerClusterCreate(d *schema.ResourceData, meta interface{}) er
 		NotificationConfig: expandNotificationConfig(d.Get("notification_config")),
 		ConfidentialNodes: expandConfidentialNodes(d.Get("confidential_nodes")),
 		ResourceLabels: tpgresource.ExpandStringMap(d, "resource_labels"),
-<% unless version == 'ga' -%>
 		NodePoolAutoConfig: expandNodePoolAutoConfig(d.Get("node_pool_auto_config")),
+<% unless version == 'ga' -%>
 		ProtectConfig: expandProtectConfig(d.Get("protect_config")),
 <% end -%>
 		CostManagementConfig: expandCostManagementConfig(d.Get("cost_management_config")),
@@ -2296,16 +2346,16 @@ func resourceContainerClusterCreate(d *schema.ResourceData, meta interface{}) er
 		cluster.WorkloadIdentityConfig = expandWorkloadIdentityConfig(v)
 	}
 
-<% unless version == 'ga' -%>
 	if v, ok := d.GetOk("identity_service_config"); ok {
 		cluster.IdentityServiceConfig = expandIdentityServiceConfig(v)
 	}
 
+<% unless version == 'ga' -%>
 	if v, ok := d.GetOk("tpu_config"); ok {
 		cluster.TpuConfig = expandContainerClusterTpuConfig(v)
 	}
-
 <% end -%>
+
 	if v, ok := d.GetOk("resource_usage_export_config"); ok {
 		cluster.ResourceUsageExportConfig = expandResourceUsageExportConfig(v)
 	}
@@ -2318,11 +2368,13 @@ func resourceContainerClusterCreate(d *schema.ResourceData, meta interface{}) er
 		cluster.MonitoringConfig = expandMonitoringConfig(v)
 	}
 
-<% unless version == 'ga' -%>
+	if v, ok := d.GetOk("fleet"); ok {
+		cluster.Fleet = expandFleet(v)
+	}
+
 	if err := validateNodePoolAutoConfig(cluster); err != nil {
 		return err
 	}
-<% end -%>
 
 	if err := validatePrivateClusterConfig(cluster); err != nil {
 		return err
@@ -2333,12 +2385,11 @@ func resourceContainerClusterCreate(d *schema.ResourceData, meta interface{}) er
 	}
 
 	// For now PSC based cluster don't support `enable_private_endpoint` on `create`, but only on `update` API call.
-    // If cluster is PSC based and enable_private_endpoint is set to true we will ignore it on `create` call and update cluster right after creation.
+	// If cluster is PSC based and enable_private_endpoint is set to true we will ignore it on `create` call and update cluster right after creation.
 	enablePrivateEndpointPSCCluster := isEnablePrivateEndpointPSCCluster(cluster)
 	if enablePrivateEndpointPSCCluster {
 		cluster.PrivateClusterConfig.EnablePrivateEndpoint = false
 	}
-	
 
 	req := &container.CreateClusterRequest{
 		Cluster: cluster,
@@ -2378,29 +2429,26 @@ func resourceContainerClusterCreate(d *schema.ResourceData, meta interface{}) er
 			if err := d.Set("operation", op.Name); err != nil {
 				return fmt.Errorf("Error setting operation: %s", err)
 			}
+
 			return nil
 		default:
 			// leaving default case to ensure this is non blocking
 		}
+
 		// Try a GET on the cluster so we can see the state in debug logs. This will help classify error states.
 		clusterGetCall := config.NewContainerClient(userAgent).Projects.Locations.Clusters.Get(containerClusterFullName(project, location, clusterName))
 		if config.UserProjectOverride {
 			clusterGetCall.Header().Add("X-Goog-User-Project", project)
 		}
+
 		_, getErr := clusterGetCall.Do()
 		if getErr != nil {
 			log.Printf("[WARN] Cluster %s was created in an error state and not found", clusterName)
 			d.SetId("")
 		}
 
-		if deleteErr := cleanFailedContainerCluster(d, meta); deleteErr != nil {
-			log.Printf("[WARN] Unable to clean up cluster from failed creation: %s", deleteErr)
-			// Leave ID set as the cluster likely still exists and should not be removed from state yet.
-		} else {
-			log.Printf("[WARN] Verified failed creation of cluster %s was cleaned up", d.Id())
-			d.SetId("")
-		}
-		// The resource didn't actually create
+		// Don't clear cluster id, this will taint the resource
+		log.Printf("[WARN] GKE cluster %s was created in an error state, and has been marked as tainted", clusterName)
 		return waitErr
 	}
 
@@ -2545,14 +2593,8 @@ func resourceContainerClusterRead(d *schema.ResourceData, meta interface{}) erro
 				d.SetId("")
 			}
 
-			if deleteErr := cleanFailedContainerCluster(d, meta); deleteErr != nil {
-				log.Printf("[WARN] Unable to clean up cluster from failed creation: %s", deleteErr)
-				// Leave ID set as the cluster likely still exists and should not be removed from state yet.
-			} else {
-				log.Printf("[WARN] Verified failed creation of cluster %s was cleaned up", d.Id())
-				d.SetId("")
-			}
-			// The resource didn't actually create
+			// Don't clear cluster id, this will taint the resource
+			log.Printf("[WARN] GKE cluster %s was created in an error state, and has been marked as tainted", clusterName)
 			return waitErr
 		}
 	}
@@ -2638,19 +2680,10 @@ func resourceContainerClusterRead(d *schema.ResourceData, meta interface{}) erro
 	}
 	if err := d.Set("cluster_autoscaling", flattenClusterAutoscaling(cluster.Autoscaling)); err != nil {
 		return err
-        }
-        binauthz_enabled := d.Get("binary_authorization.0.enabled").(bool)
-        legacy_binauthz_enabled := d.Get("enable_binary_authorization").(bool)
-        if !binauthz_enabled {
- 	        if err := d.Set("enable_binary_authorization", cluster.BinaryAuthorization != nil && cluster.BinaryAuthorization.Enabled); err != nil {
-	                return fmt.Errorf("Error setting enable_binary_authorization: %s", err)
-                }
-        }
-        if !legacy_binauthz_enabled {
-                if err := d.Set("binary_authorization", flattenBinaryAuthorization(cluster.BinaryAuthorization)); err != nil {
-                        return err
-                }
-        }
+	}
+	if err := d.Set("binary_authorization", flattenBinaryAuthorization(cluster.BinaryAuthorization)); err != nil {
+		return err
+	}
 	if autopilot := cluster.Autopilot; autopilot != nil {
 		if err := d.Set("enable_autopilot", autopilot.Enabled); err != nil {
 			return fmt.Errorf("Error setting enable_autopilot: %s", err)
@@ -2715,7 +2748,7 @@ func resourceContainerClusterRead(d *schema.ResourceData, meta interface{}) erro
 			return fmt.Errorf("Error setting default_max_pods_per_node: %s", err)
 		}
 	}
-	if err := d.Set("node_config", flattenNodeConfig(cluster.NodeConfig)); err != nil {
+	if err := d.Set("node_config", flattenNodeConfig(cluster.NodeConfig, d.Get("node_config"))); err != nil {
 		return err
 	}
 	if err := d.Set("project", project); err != nil {
@@ -2752,11 +2785,9 @@ func resourceContainerClusterRead(d *schema.ResourceData, meta interface{}) erro
 		return err
 	}
 
-<% unless version == 'ga' -%>
 	if err := d.Set("identity_service_config", flattenIdentityServiceConfig(cluster.IdentityServiceConfig, d, config)); err != nil {
 		return err
 	}
-<% end -%>
 
 	if err := d.Set("service_external_ips_config", flattenServiceExternalIpsConfig(cluster.NetworkConfig.ServiceExternalIpsConfig)); err != nil {
 		return err
@@ -2796,6 +2827,9 @@ func resourceContainerClusterRead(d *schema.ResourceData, meta interface{}) erro
 	if err := d.Set("gateway_api_config", flattenGatewayApiConfig(cluster.NetworkConfig.GatewayApiConfig)); err != nil {
 		return err
 	}
+	if err := d.Set("fleet", flattenFleet(cluster.Fleet)); err != nil {
+		return err
+	}
 	if err := d.Set("enable_k8s_beta_apis", flattenEnableK8sBetaApis(cluster.EnableK8sBetaApis)); err != nil {
 		return err
 	}
@@ -2807,11 +2841,9 @@ func resourceContainerClusterRead(d *schema.ResourceData, meta interface{}) erro
 		return err
 	}
 
-<% unless version == 'ga' -%>
 	if err := d.Set("node_pool_auto_config", flattenNodePoolAutoConfig(cluster.NodePoolAutoConfig)); err != nil {
 		return err
 	}
-<% end -%>
 
         if err := d.Set("node_pool_defaults", flattenNodePoolDefaults(cluster.NodePoolDefaults)); err != nil {
                 return err
@@ -2933,13 +2965,13 @@ func resourceContainerClusterUpdate(d *schema.ResourceData, meta interface{}) er
 				},
 		    },
 		}
-		
+
 	    updateF := updateFunc(req, "updating net admin for GKE autopilot workload policy config")
 		// Call update serially.
 		if err := transport_tpg.LockedCall(lockKey, updateF); err != nil {
 		    return err
 	    }
-		
+
 		log.Printf("[INFO] GKE cluster %s's autopilot workload policy config allow_net_admin has been set to %v", d.Id(), allowed)
 	}
 
@@ -3004,7 +3036,7 @@ func resourceContainerClusterUpdate(d *schema.ResourceData, meta interface{}) er
     if d.HasChange("binary_authorization") {
 		req := &container.UpdateClusterRequest{
 			Update: &container.ClusterUpdate{
-				DesiredBinaryAuthorization: expandBinaryAuthorization(d.Get("binary_authorization"), d.Get("enable_binary_authorization").(bool)),
+				DesiredBinaryAuthorization: expandBinaryAuthorization(d.Get("binary_authorization")),
 			},
 		}
 
@@ -3435,7 +3467,7 @@ func resourceContainerClusterUpdate(d *schema.ResourceData, meta interface{}) er
 		o, n := d.GetChange("ip_allocation_policy.0.additional_pod_ranges_config.0.pod_range_names")
 		old_names := o.(*schema.Set)
 		new_names := n.(*schema.Set)
-		
+
 		// Filter unchanged names.
 		removed_names := old_names.Difference(new_names)
 		added_names := new_names.Difference(old_names)
@@ -3772,7 +3804,6 @@ func resourceContainerClusterUpdate(d *schema.ResourceData, meta interface{}) er
 		log.Printf("[INFO] GKE cluster %s workload identity config has been updated", d.Id())
 	}
 
-<% unless version == 'ga' -%>
 	if d.HasChange("identity_service_config") {
 		req := &container.UpdateClusterRequest{}
 		if v, ok := d.GetOk("identity_service_config"); !ok {
@@ -3795,7 +3826,6 @@ func resourceContainerClusterUpdate(d *schema.ResourceData, meta interface{}) er
 
 		log.Printf("[INFO] GKE cluster %s identity service config has been updated", d.Id())
 	}
-<% end -%>
 
 	if d.HasChange("logging_config") {
 		req := &container.UpdateClusterRequest{
@@ -3920,6 +3950,30 @@ func resourceContainerClusterUpdate(d *schema.ResourceData, meta interface{}) er
 		}
 	}
 
+	if d.HasChange("fleet") {
+		// Because GKE uses a non-RESTful update function, when removing the
+		// feature you need to specify a fairly full request body or it fails:
+		// "update": {"desiredFleet": {"project": ""}}
+		req := &container.UpdateClusterRequest{}
+		if v, ok := d.GetOk("fleet"); !ok {
+			req.Update = &container.ClusterUpdate{
+				DesiredFleet: &container.Fleet{
+					Project: "",
+				},
+			}
+		} else {
+			req.Update = &container.ClusterUpdate{
+				DesiredFleet:  expandFleet(v),
+			}
+		}
+		updateF := updateFunc(req, "updating GKE cluster fleet config")
+		// Call update serially.
+		if err := transport_tpg.LockedCall(lockKey, updateF); err != nil {
+			return err
+		}
+		log.Printf("[INFO] GKE cluster %s fleet config has been updated", d.Id())
+	}
+
 	if d.HasChange("enable_k8s_beta_apis") {
 		log.Print("[INFO] Enable Kubernetes Beta APIs")
 		if v, ok := d.GetOk("enable_k8s_beta_apis"); ok {
@@ -4018,7 +4072,6 @@ func resourceContainerClusterUpdate(d *schema.ResourceData, meta interface{}) er
 		log.Printf("[INFO] GKE cluster %s Security Posture Config has been updated to %#v", d.Id(), req.Update.DesiredSecurityPostureConfig)
 	}
 
-<% unless version == 'ga' -%>
 	if d.HasChange("node_pool_auto_config.0.network_tags.0.tags") {
 		tags := d.Get("node_pool_auto_config.0.network_tags.0.tags").([]interface{})
 
@@ -4039,7 +4092,6 @@ func resourceContainerClusterUpdate(d *schema.ResourceData, meta interface{}) er
 
 		log.Printf("[INFO] GKE cluster %s node pool auto config network tags have been updated", d.Id())
 	}
-<% end -%>
 
 	d.Partial(false)
 
@@ -4101,6 +4153,9 @@ func resourceContainerClusterUpdate(d *schema.ResourceData, meta interface{}) er
 }
 
 func resourceContainerClusterDelete(d *schema.ResourceData, meta interface{}) error {
+	if d.Get("deletion_protection").(bool) {
+		return fmt.Errorf("Cannot destroy cluster because deletion_protection is set to true. Set it to false to proceed with cluster deletion.")
+	}
 	config := meta.(*transport_tpg.Config)
 	userAgent, err :=  tpgresource.GenerateUserAgentString(d, config.UserAgent)
 	if err != nil {
@@ -4171,52 +4226,6 @@ func resourceContainerClusterDelete(d *schema.ResourceData, meta interface{}) er
 	return nil
 }
 
-// cleanFailedContainerCluster deletes clusters that failed but were
-// created in an error state. Similar to resourceContainerClusterDelete
-// but implemented in separate function as it doesn't try to lock already
-// locked cluster state, does different error handling, and doesn't do retries.
-func cleanFailedContainerCluster(d *schema.ResourceData, meta interface{}) error {
-	config := meta.(*transport_tpg.Config)
-
-	project, err := tpgresource.GetProject(d, config)
-	if err != nil {
-		return err
-	}
-
-	location, err := tpgresource.GetLocation(d, config)
-	if err != nil {
-		return err
-	}
-
-	userAgent, err :=  tpgresource.GenerateUserAgentString(d, config.UserAgent)
-	if err != nil {
-		return err
-	}
-
-	clusterName := d.Get("name").(string)
-	fullName := containerClusterFullName(project, location, clusterName)
-
-	log.Printf("[DEBUG] Cleaning up failed GKE cluster %s", d.Get("name").(string))
-	clusterDeleteCall := config.NewContainerClient(userAgent).Projects.Locations.Clusters.Delete(fullName)
-	if config.UserProjectOverride {
-		clusterDeleteCall.Header().Add("X-Goog-User-Project", project)
-	}
-	op, err := clusterDeleteCall.Do()
-	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("Container Cluster %q", d.Get("name").(string)))
-	}
-
-	// Wait until it's deleted
-	waitErr := ContainerOperationWait(config, op, project, location, "deleting GKE cluster", userAgent, d.Timeout(schema.TimeoutDelete))
-	if waitErr != nil {
-		return waitErr
-	}
-
-	log.Printf("[INFO] GKE cluster %s has been deleted", d.Id())
-	d.SetId("")
-	return nil
-}
-
 var containerClusterRestingStates = RestingStates{
 	"RUNNING":  ReadyState,
 	"DEGRADED": ErrorState,
@@ -4380,10 +4389,7 @@ func expandIPAllocationPolicy(configured interface{}, networkingMode string, aut
 	l := configured.([]interface{})
 	if len(l) == 0 || l[0] == nil {
 		if networkingMode == "VPC_NATIVE" {
-			if autopilot {
-				return nil, nil
-			}
-			return nil, fmt.Errorf("`ip_allocation_policy` block is required for VPC_NATIVE clusters.")
+			return nil, nil
 		}
 		return &container.IPAllocationPolicy{
 			UseIpAliases:    false,
@@ -4830,11 +4836,11 @@ func expandNotificationConfig(configured interface{}) *container.NotificationCon
 	}
 }
 
-func expandBinaryAuthorization(configured interface{}, legacy_enabled bool) *container.BinaryAuthorization {
+func expandBinaryAuthorization(configured interface{}) *container.BinaryAuthorization {
 	l := configured.([]interface{})
 	if len(l) == 0 || l[0] == nil {
 		return &container.BinaryAuthorization{
-			Enabled:         legacy_enabled,
+			Enabled:         false,
 			ForceSendFields: []string{"Enabled"},
 		}
 	}
@@ -5058,7 +5064,6 @@ func expandWorkloadIdentityConfig(configured interface{}) *container.WorkloadIde
 	return v
 }
 
-<% unless version == 'ga' -%>
 func expandIdentityServiceConfig(configured interface{}) *container.IdentityServiceConfig {
 	l := configured.([]interface{})
 	v := &container.IdentityServiceConfig{}
@@ -5068,7 +5073,6 @@ func expandIdentityServiceConfig(configured interface{}) *container.IdentityServ
 
 	return v
 }
-<% end -%>
 
 <% unless version == 'ga' -%>
 func expandPodSecurityPolicyConfig(configured interface{}) *container.PodSecurityPolicyConfig {
@@ -5164,6 +5168,18 @@ func expandGatewayApiConfig(configured interface{}) *container.GatewayAPIConfig
 	}
 }
 
+func expandFleet(configured interface{}) *container.Fleet {
+	l := configured.([]interface{})
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
+
+	config := l[0].(map[string]interface{})
+	return &container.Fleet{
+		Project: config["project"].(string),
+	}
+}  
+
 func expandEnableK8sBetaApis(configured interface{}, enabledAPIs []string) *container.K8sBetaAPIConfig {
 	l := configured.([]interface{})
 	if len(l) == 0 || l[0] == nil {
@@ -5298,7 +5314,6 @@ func flattenNodePoolDefaults(c *container.NodePoolDefaults) []map[string]interfa
 	return []map[string]interface{}{result}
 }
 
-<% unless version == 'ga' -%>
 func expandNodePoolAutoConfig(configured interface{}) *container.NodePoolAutoConfig {
 	l := configured.([]interface{})
 	if len(l) == 0 || l[0] == nil {
@@ -5326,7 +5341,6 @@ func expandNodePoolAutoConfigNetworkTags(configured interface{}) *container.Netw
 	}
 	return nt
 }
-<% end -%>
 
 func flattenNotificationConfig(c *container.NotificationConfig) []map[string]interface{} {
 	if c == nil {
@@ -5614,7 +5628,6 @@ func flattenWorkloadIdentityConfig(c *container.WorkloadIdentityConfig, d *schem
 	}
 }
 
-<% unless version == 'ga' -%>
 func flattenIdentityServiceConfig(c *container.IdentityServiceConfig, d *schema.ResourceData, config *transport_tpg.Config) []map[string]interface{} {
 	if c == nil {
 		return nil
@@ -5626,7 +5639,6 @@ func flattenIdentityServiceConfig(c *container.IdentityServiceConfig, d *schema.
 		},
 	}
 }
-<% end -%>
 
 func flattenPodCidrOverprovisionConfig(c *container.PodCIDROverprovisionConfig) []map[string]interface{} {
 	if c == nil {
@@ -5993,6 +6005,19 @@ func flattenGatewayApiConfig(c *container.GatewayAPIConfig) []map[string]interfa
 	}
 }
 
+func flattenFleet(c *container.Fleet) []map[string]interface{} {
+      if c == nil {
+                return nil
+      }         
+      return []map[string]interface{}{
+                {
+                      "project": c.Project,
+                      "membership": c.Membership,
+		      "pre_registered": c.PreRegistered,
+                },
+      }       
+}
+
 func flattenEnableK8sBetaApis(c *container.K8sBetaAPIConfig) []map[string]interface{} {
 	if c == nil {
 		return nil
@@ -6052,7 +6077,6 @@ func flattenManagedPrometheusConfig(c *container.ManagedPrometheusConfig) []map[
 	}
 }
 
-<% unless version == 'ga' -%>
 func flattenNodePoolAutoConfig(c *container.NodePoolAutoConfig) []map[string]interface{} {
 	if c == nil {
 		return nil
@@ -6077,7 +6101,6 @@ func flattenNodePoolAutoConfigNetworkTags(c *container.NetworkTags) []map[string
 	}
 	return []map[string]interface{}{result}
 }
-<% end -%>
 
 func resourceContainerClusterStateImporter(d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
 	config := meta.(*transport_tpg.Config)
@@ -6105,6 +6128,11 @@ func resourceContainerClusterStateImporter(d *schema.ResourceData, meta interfac
 	if err := d.Set("location", location); err != nil {
 		return nil, fmt.Errorf("Error setting location: %s", err)
 	}
+
+	if err := d.Set("deletion_protection", true); err != nil {
+		return nil, fmt.Errorf("Error setting deletion_protection: %s", err)
+	}
+
 	if _, err := containerClusterAwaitRestingState(config, project, location, clusterName, userAgent, d.Timeout(schema.TimeoutCreate)); err != nil {
 		return nil, err
 	}
@@ -6301,7 +6329,6 @@ func BinaryAuthorizationDiffSuppress(k, old, new string, r *schema.ResourceData)
 	return false
 }
 
-<% unless version == 'ga' -%>
 func validateNodePoolAutoConfig(cluster *container.Cluster) error {
 	if cluster == nil || cluster.NodePoolAutoConfig == nil {
 		return nil
@@ -6314,7 +6341,6 @@ func validateNodePoolAutoConfig(cluster *container.Cluster) error {
 
 	return nil
 }
-<% end -%>
 
 func containerClusterSurgeSettingsCustomizeDiff(_ context.Context, d *schema.ResourceDiff, meta interface{}) error {
 	if v, ok := d.GetOk("cluster_autoscaling.0.auto_provisioning_defaults.0.upgrade_settings.0.strategy"); ok {
diff --git a/mmv1/third_party/terraform/services/container/resource_container_cluster_migrate.go b/mmv1/third_party/terraform/services/container/resource_container_cluster_migrate.go
index 2b088ce0321f..58f986e29309 100644
--- a/mmv1/third_party/terraform/services/container/resource_container_cluster_migrate.go
+++ b/mmv1/third_party/terraform/services/container/resource_container_cluster_migrate.go
@@ -21,6 +21,9 @@ func resourceContainerClusterMigrateState(
 	case 0:
 		log.Println("[INFO] Found Container Cluster State v0; migrating to v1")
 		return migrateClusterStateV0toV1(is)
+	case 1:
+		log.Println("[INFO] Found Container Cluster State v1 in legacy migration function; returning as non-op")
+		return is, nil
 	default:
 		return is, fmt.Errorf("Unexpected schema version: %d", v)
 	}
diff --git a/mmv1/third_party/terraform/services/container/resource_container_cluster_migratev1.go.erb b/mmv1/third_party/terraform/services/container/resource_container_cluster_migratev1.go.erb
new file mode 100644
index 000000000000..5e536d8b591b
--- /dev/null
+++ b/mmv1/third_party/terraform/services/container/resource_container_cluster_migratev1.go.erb
@@ -0,0 +1,1842 @@
+<% autogen_exception -%>
+package container
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"regexp"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+	"github.com/hashicorp/terraform-provider-google/google/verify"
+)
+
+func ResourceContainerClusterUpgradeV1(_ context.Context, rawState map[string]interface{}, meta interface{}) (map[string]interface{}, error) {
+	log.Printf("[DEBUG] Applying container cluster migration to schema version V2.")
+
+	rawState["deletion_protection"] = true
+	return rawState, nil
+}
+
+
+func resourceContainerClusterResourceV1() *schema.Resource {
+	return &schema.Resource{
+		Schema: map[string]*schema.Schema{
+			"name": {
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: `The name of the cluster, unique within the project and location.`,
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					value := v.(string)
+
+					if len(value) > 40 {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot be longer than 40 characters", k))
+					}
+					if !regexp.MustCompile("^[a-z0-9-]+$").MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q can only contain lowercase letters, numbers and hyphens", k))
+					}
+					if !regexp.MustCompile("^[a-z]").MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q must start with a letter", k))
+					}
+					if !regexp.MustCompile("[a-z0-9]$").MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q must end with a number or a letter", k))
+					}
+					return
+				},
+			},
+
+			"operation": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+
+			"location": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Computed:    true,
+				ForceNew:    true,
+				Description: `The location (region or zone) in which the cluster master will be created, as well as the default node location. If you specify a zone (such as us-central1-a), the cluster will be a zonal cluster with a single cluster master. If you specify a region (such as us-west1), the cluster will be a regional cluster with multiple masters spread across zones in the region, and with default node locations in those zones as well.`,
+			},
+
+			"node_locations": {
+				Type:        schema.TypeSet,
+				Optional:    true,
+				Computed:    true,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+				Description: `The list of zones in which the cluster's nodes are located. Nodes must be in the region of their regional cluster or in the same region as their cluster's zone for zonal clusters. If this is specified for a zonal cluster, omit the cluster's zone.`,
+			},
+
+			"addons_config": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				Computed:    true,
+				MaxItems:    1,
+				Description: `The configuration for addons supported by GKE.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"http_load_balancing": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							Computed:     true,
+							AtLeastOneOf: addonsConfigKeys,
+							MaxItems:     1,
+							Description:  `The status of the HTTP (L7) load balancing controller addon, which makes it easy to set up HTTP load balancers for services in a cluster. It is enabled by default; set disabled = true to disable.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"disabled": {
+										Type:     schema.TypeBool,
+										Required: true,
+									},
+								},
+							},
+						},
+						"horizontal_pod_autoscaling": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							Computed:     true,
+							AtLeastOneOf: addonsConfigKeys,
+							MaxItems:     1,
+							Description:  `The status of the Horizontal Pod Autoscaling addon, which increases or decreases the number of replica pods a replication controller has based on the resource usage of the existing pods. It ensures that a Heapster pod is running in the cluster, which is also used by the Cloud Monitoring service. It is enabled by default; set disabled = true to disable.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"disabled": {
+										Type:     schema.TypeBool,
+										Required: true,
+									},
+								},
+							},
+						},
+						"network_policy_config": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							Computed:     true,
+							AtLeastOneOf: addonsConfigKeys,
+							MaxItems:     1,
+							Description:  `Whether we should enable the network policy addon for the master. This must be enabled in order to enable network policy for the nodes. To enable this, you must also define a network_policy block, otherwise nothing will happen. It can only be disabled if the nodes already do not have network policies enabled. Defaults to disabled; set disabled = false to enable.`,
+							ConflictsWith: []string{"enable_autopilot"},
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"disabled": {
+										Type:     schema.TypeBool,
+										Required: true,
+									},
+								},
+							},
+						},
+						"gcp_filestore_csi_driver_config": {
+							Type:          schema.TypeList,
+							Optional:      true,
+							Computed:      true,
+							AtLeastOneOf:  addonsConfigKeys,
+							MaxItems:      1,
+							Description:   `The status of the Filestore CSI driver addon, which allows the usage of filestore instance as volumes. Defaults to disabled; set enabled = true to enable.`,
+							ConflictsWith: []string{"enable_autopilot"},
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"enabled": {
+										Type:     schema.TypeBool,
+										Required: true,
+									},
+								},
+							},
+						},
+						"cloudrun_config": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							Computed:     true,
+							AtLeastOneOf: addonsConfigKeys,
+							MaxItems:     1,
+							Description:  `The status of the CloudRun addon. It is disabled by default. Set disabled = false to enable.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"disabled": {
+										Type:     schema.TypeBool,
+										Required: true,
+									},
+									"load_balancer_type": {
+										Type:         schema.TypeString,
+										ValidateFunc: validation.StringInSlice([]string{"LOAD_BALANCER_TYPE_INTERNAL"}, false),
+										Optional:     true,
+									},
+								},
+							},
+						},
+						"dns_cache_config": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							Computed:     true,
+							AtLeastOneOf: addonsConfigKeys,
+							MaxItems:     1,
+							Description:  `The status of the NodeLocal DNSCache addon. It is disabled by default. Set enabled = true to enable.`,
+							ConflictsWith: []string{"enable_autopilot"},
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"enabled": {
+										Type:     schema.TypeBool,
+										Required: true,
+									},
+								},
+							},
+						},
+						"gce_persistent_disk_csi_driver_config": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							Computed:     true,
+							AtLeastOneOf: addonsConfigKeys,
+							MaxItems:     1,
+							Description:  `Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. Set enabled = true to enable. The Compute Engine persistent disk CSI Driver is enabled by default on newly created clusters for the following versions: Linux clusters: GKE version 1.18.10-gke.2100 or later, or 1.19.3-gke.2100 or later.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"enabled": {
+										Type:     schema.TypeBool,
+										Required: true,
+									},
+								},
+							},
+						},
+						"gke_backup_agent_config": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							Computed:     true,
+							AtLeastOneOf: addonsConfigKeys,
+							MaxItems:     1,
+							Description:  `The status of the Backup for GKE Agent addon. It is disabled by default. Set enabled = true to enable.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"enabled": {
+										Type:     schema.TypeBool,
+										Required: true,
+									},
+								},
+							},
+						},
+						"gcs_fuse_csi_driver_config": {
+							Type:          schema.TypeList,
+							Optional:      true,
+							Computed:      true,
+							AtLeastOneOf:  addonsConfigKeys,
+							MaxItems:      1,
+							Description:   `The status of the GCS Fuse CSI driver addon, which allows the usage of gcs bucket as volumes. Defaults to disabled; set enabled = true to enable.`,
+							ConflictsWith: []string{"enable_autopilot"},
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"enabled": {
+										Type:     schema.TypeBool,
+										Required: true,
+									},
+								},
+							},
+						},
+						<% unless version == 'ga' -%>
+						"istio_config": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							Computed:     true,
+							AtLeastOneOf: addonsConfigKeys,
+							MaxItems:     1,
+							Description:  `The status of the Istio addon.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"disabled": {
+										Type:        schema.TypeBool,
+										Required:    true,
+										Description: `The status of the Istio addon, which makes it easy to set up Istio for services in a cluster. It is disabled by default. Set disabled = false to enable.`,
+									},
+									"auth": {
+										Type:     schema.TypeString,
+										Optional: true,
+										// We can't use a Terraform-level default because it won't be true when the block is disabled: true
+										DiffSuppressFunc: tpgresource.EmptyOrDefaultStringSuppress("AUTH_NONE"),
+										ValidateFunc:     validation.StringInSlice([]string{"AUTH_NONE", "AUTH_MUTUAL_TLS"}, false),
+										Description:      `The authentication type between services in Istio. Available options include AUTH_MUTUAL_TLS.`,
+									},
+								},
+							},
+						},
+						"kalm_config": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							Computed:     true,
+							AtLeastOneOf: addonsConfigKeys,
+							MaxItems:     1,
+							Description:  `Configuration for the KALM addon, which manages the lifecycle of k8s. It is disabled by default; Set enabled = true to enable.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"enabled": {
+										Type:     schema.TypeBool,
+										Required: true,
+									},
+								},
+							},
+						},
+						<% end -%>
+						"config_connector_config": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							Computed:     true,
+							AtLeastOneOf: addonsConfigKeys,
+							MaxItems:     1,
+							Description:  `The of the Config Connector addon.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"enabled": {
+										Type:     schema.TypeBool,
+										Required: true,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+
+			"cluster_autoscaling": {
+				Type:     schema.TypeList,
+				MaxItems: 1,
+				// This field is Optional + Computed because we automatically set the
+				// enabled value to false if the block is not returned in API responses.
+				Optional:    true,
+				Computed:    true,
+				Description: `Per-cluster configuration of Node Auto-Provisioning with Cluster Autoscaler to automatically adjust the size of the cluster and create/delete node pools based on the current needs of the cluster's workload. See the guide to using Node Auto-Provisioning for more details.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"enabled": {
+							Type:          schema.TypeBool,
+							Optional:      true,
+							Computed:      true,
+							ConflictsWith: []string{"enable_autopilot"},
+							Description: `Whether node auto-provisioning is enabled. Resource limits for cpu and memory must be defined to enable node auto-provisioning.`,
+						},
+						"resource_limits": {
+							Type:             schema.TypeList,
+							Optional:         true,
+							ConflictsWith:    []string{"enable_autopilot"},
+							DiffSuppressFunc: suppressDiffForAutopilot,
+							Description:      `Global constraints for machine resources in the cluster. Configuring the cpu and memory types is required if node auto-provisioning is enabled. These limits will apply to node pool autoscaling in addition to node auto-provisioning.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"resource_type": {
+										Type:        schema.TypeString,
+										Required:    true,
+										Description: `The type of the resource. For example, cpu and memory. See the guide to using Node Auto-Provisioning for a list of types.`,
+									},
+									"minimum": {
+										Type:        schema.TypeInt,
+										Optional:    true,
+										Description: `Minimum amount of the resource in the cluster.`,
+									},
+									"maximum": {
+										Type:        schema.TypeInt,
+										Optional:    true,
+										Description: `Maximum amount of the resource in the cluster.`,
+									},
+								},
+							},
+						},
+						"auto_provisioning_defaults": {
+							Type:        schema.TypeList,
+							MaxItems:    1,
+							Optional:    true,
+							Computed:    true,
+							Description: `Contains defaults for a node pool created by NAP.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"oauth_scopes": {
+										Type:             schema.TypeList,
+										Optional:         true,
+										Computed:         true,
+										Elem:             &schema.Schema{Type: schema.TypeString},
+										DiffSuppressFunc: containerClusterAddedScopesSuppress,
+										Description:      `Scopes that are used by NAP when creating node pools.`,
+									},
+									"service_account": {
+										Type:        schema.TypeString,
+										Optional:    true,
+										Default:     "default",
+										Description: `The Google Cloud Platform Service Account to be used by the node VMs.`,
+									},
+									"disk_size": {
+										Type:             schema.TypeInt,
+										Optional:         true,
+										Default:          100,
+										Description:      `Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB.`,
+										DiffSuppressFunc: suppressDiffForAutopilot,
+										ValidateFunc: validation.IntAtLeast(10),
+									},
+									"disk_type": {
+										Type:             schema.TypeString,
+										Optional:         true,
+										Default:          "pd-standard",
+										Description:      `Type of the disk attached to each node.`,
+										DiffSuppressFunc: suppressDiffForAutopilot,
+										ValidateFunc: validation.StringInSlice([]string{"pd-standard", "pd-ssd", "pd-balanced"}, false),
+									},
+									"image_type": {
+										Type:             schema.TypeString,
+										Optional:         true,
+										Default:          "COS_CONTAINERD",
+										Description:      `The default image type used by NAP once a new node pool is being created.`,
+										DiffSuppressFunc: suppressDiffForAutopilot,
+										ValidateFunc: validation.StringInSlice([]string{"COS_CONTAINERD", "COS", "UBUNTU_CONTAINERD", "UBUNTU"}, false),
+									},
+									"min_cpu_platform": {
+										Type:             schema.TypeString,
+										Optional:         true,
+										DiffSuppressFunc: tpgresource.EmptyOrDefaultStringSuppress("automatic"),
+										Description:      `Minimum CPU platform to be used by this instance. The instance may be scheduled on the specified or newer CPU platform. Applicable values are the friendly names of CPU platforms, such as Intel Haswell.`,
+									},
+									"boot_disk_kms_key": {
+										Type:        schema.TypeString,
+										Optional:    true,
+										ForceNew:    true,
+										Description: `The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool.`,
+									},
+									"shielded_instance_config": &schema.Schema{
+										Type:        schema.TypeList,
+										Optional:    true,
+										Description: `Shielded Instance options.`,
+										MaxItems:    1,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"enable_secure_boot": {
+													Type:         schema.TypeBool,
+													Optional:     true,
+													Default:      false,
+													Description:  `Defines whether the instance has Secure Boot enabled.`,
+													AtLeastOneOf: []string{
+														"cluster_autoscaling.0.auto_provisioning_defaults.0.shielded_instance_config.0.enable_secure_boot",
+														"cluster_autoscaling.0.auto_provisioning_defaults.0.shielded_instance_config.0.enable_integrity_monitoring",
+													},
+												},
+												"enable_integrity_monitoring": {
+													Type:         schema.TypeBool,
+													Optional:     true,
+													Default:      true,
+													Description:  `Defines whether the instance has integrity monitoring enabled.`,
+													AtLeastOneOf: []string{
+														"cluster_autoscaling.0.auto_provisioning_defaults.0.shielded_instance_config.0.enable_secure_boot",
+														"cluster_autoscaling.0.auto_provisioning_defaults.0.shielded_instance_config.0.enable_integrity_monitoring",
+													},
+												},
+											},
+										},
+									},
+									"management": {
+										Type:        schema.TypeList,
+										Optional:    true,
+										Computed:    true,
+										MaxItems:    1,
+										Description: `NodeManagement configuration for this NodePool.`,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"auto_upgrade": {
+													Type:        schema.TypeBool,
+													Optional:    true,
+													Computed:    true,
+													Description: `Specifies whether node auto-upgrade is enabled for the node pool. If enabled, node auto-upgrade helps keep the nodes in your node pool up to date with the latest release version of Kubernetes.`,
+												},
+												"auto_repair": {
+													Type:        schema.TypeBool,
+													Optional:    true,
+													Computed:    true,
+													Description: `Specifies whether the node auto-repair is enabled for the node pool. If enabled, the nodes in this node pool will be monitored and, if they fail health checks too many times, an automatic repair action will be triggered.`,
+												},
+												"upgrade_options": {
+													Type:        schema.TypeList,
+													Computed:    true,
+													Description: `Specifies the Auto Upgrade knobs for the node pool.`,
+													Elem: &schema.Resource{
+														Schema: map[string]*schema.Schema{
+															"auto_upgrade_start_time": {
+																Type:        schema.TypeString,
+																Computed:    true,
+																Description: `This field is set when upgrades are about to commence with the approximate start time for the upgrades, in RFC3339 text format.`,
+															},
+															"description": {
+																Type:        schema.TypeString,
+																Computed:    true,
+																Description: `This field is set when upgrades are about to commence with the description of the upgrade.`,
+															},
+														},
+													},
+												},
+											},
+										},
+									},
+									"upgrade_settings": {
+										Type:             schema.TypeList,
+										Optional:         true,
+										Description:      `Specifies the upgrade settings for NAP created node pools`,
+										Computed:         true,
+										MaxItems:         1,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"max_surge": {
+													Type:        schema.TypeInt,
+													Optional:    true,
+													Description: `The maximum number of nodes that can be created beyond the current size of the node pool during the upgrade process.`,
+												},
+												"max_unavailable": {
+													Type:        schema.TypeInt,
+													Optional:    true,
+													Description: `The maximum number of nodes that can be simultaneously unavailable during the upgrade process.`,
+												},
+												"strategy": {
+													Type:         schema.TypeString,
+													Optional:     true,
+													Computed:     true,
+													Description:  `Update strategy of the node pool.`,
+													ValidateFunc: validation.StringInSlice([]string{"NODE_POOL_UPDATE_STRATEGY_UNSPECIFIED", "BLUE_GREEN", "SURGE"}, false),
+												},
+												"blue_green_settings": {
+													Type:        schema.TypeList,
+													Optional:    true,
+													Computed:    true,
+													MaxItems:    1,
+													Description: `Settings for blue-green upgrade strategy.`,
+													Elem: &schema.Resource{
+														Schema: map[string]*schema.Schema{
+															"node_pool_soak_duration": {
+																Type:     schema.TypeString,
+																Optional: true,
+																Computed: true,
+																Description: `Time needed after draining entire blue pool. After this period, blue pool will be cleaned up.
+
+																A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".`,
+															},
+															"standard_rollout_policy": {
+																Type:        schema.TypeList,
+																Optional:    true,
+																Computed:    true,
+																MaxItems:    1,
+																Description: `Standard policy for the blue-green upgrade.`,
+																Elem: &schema.Resource{
+																	Schema: map[string]*schema.Schema{
+																		"batch_percentage": {
+																			Type:         schema.TypeFloat,
+																			Optional:     true,
+																			Computed:     true,
+																			ValidateFunc: validation.FloatBetween(0.0, 1.0),
+																			ExactlyOneOf: []string{
+																				"cluster_autoscaling.0.auto_provisioning_defaults.0.upgrade_settings.0.blue_green_settings.0.standard_rollout_policy.0.batch_percentage",
+																				"cluster_autoscaling.0.auto_provisioning_defaults.0.upgrade_settings.0.blue_green_settings.0.standard_rollout_policy.0.batch_node_count",
+																			},
+																			Description: `Percentage of the bool pool nodes to drain in a batch. The range of this field should be (0.0, 1.0].`,
+																		},
+																		"batch_node_count": {
+																			Type:     schema.TypeInt,
+																			Optional: true,
+																			Computed: true,
+																			ExactlyOneOf: []string{
+																				"cluster_autoscaling.0.auto_provisioning_defaults.0.upgrade_settings.0.blue_green_settings.0.standard_rollout_policy.0.batch_percentage",
+																				"cluster_autoscaling.0.auto_provisioning_defaults.0.upgrade_settings.0.blue_green_settings.0.standard_rollout_policy.0.batch_node_count",
+																			},
+																			Description: `Number of blue nodes to drain in a batch.`,
+																		},
+																		"batch_soak_duration": {
+																			Type:     schema.TypeString,
+																			Optional: true,
+																			Default:  "0s",
+																			Description: `Soak time after each batch gets drained.
+
+																			A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".`,
+																		},
+																	},
+																},
+															},
+														},
+													},
+												},
+											},
+										},
+									},
+								},
+							},
+						},
+						<% unless version == 'ga' -%>
+						"autoscaling_profile": {
+							Type:             schema.TypeString,
+							Default:          "BALANCED",
+							Optional:         true,
+							DiffSuppressFunc: suppressDiffForAutopilot,
+							ValidateFunc:     validation.StringInSlice([]string{"BALANCED", "OPTIMIZE_UTILIZATION"}, false),
+							Description:      `Configuration options for the Autoscaling profile feature, which lets you choose whether the cluster autoscaler should optimize for resource utilization or resource availability when deciding to remove nodes from a cluster. Can be BALANCED or OPTIMIZE_UTILIZATION. Defaults to BALANCED.`,
+						},
+						<% end -%>
+					},
+				},
+			},
+
+			"cluster_ipv4_cidr": {
+				Type:          schema.TypeString,
+				Optional:      true,
+				Computed:      true,
+				ForceNew:      true,
+				ValidateFunc:  verify.OrEmpty(verify.ValidateRFC1918Network(8, 32)),
+				ConflictsWith: []string{"ip_allocation_policy"},
+				Description:   `The IP address range of the Kubernetes pods in this cluster in CIDR notation (e.g. 10.96.0.0/14). Leave blank to have one automatically chosen or specify a /14 block in 10.0.0.0/8. This field will only work for routes-based clusters, where ip_allocation_policy is not defined.`,
+			},
+
+			"description": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				ForceNew:    true,
+				Description: ` Description of the cluster.`,
+			},
+
+			"binary_authorization": {
+					Type:             schema.TypeList,
+					Optional:         true,
+					DiffSuppressFunc: BinaryAuthorizationDiffSuppress,
+					MaxItems:         1,
+					Description:      "Configuration options for the Binary Authorization feature.",
+					Elem: &schema.Resource{
+							Schema: map[string]*schema.Schema{
+									"enabled": {
+											Type:          schema.TypeBool,
+											Optional:      true,
+											Deprecated:    "Deprecated in favor of evaluation_mode.",
+											Description:   "Enable Binary Authorization for this cluster.",
+											ConflictsWith: []string{"enable_autopilot", "binary_authorization.0.evaluation_mode"},
+									},
+									"evaluation_mode": {
+											Type:          schema.TypeString,
+											Optional:      true,
+											ValidateFunc:  validation.StringInSlice([]string{"DISABLED", "PROJECT_SINGLETON_POLICY_ENFORCE"}, false),
+											Description:   "Mode of operation for Binary Authorization policy evaluation.",
+											ConflictsWith: []string{"binary_authorization.0.enabled"},
+									},
+							},
+					},
+			},
+
+			"enable_kubernetes_alpha": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				ForceNew:    true,
+				Default:     false,
+				Description: `Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days.`,
+			},
+
+			"enable_k8s_beta_apis": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				MaxItems:    1,
+				Description: `Configuration for Kubernetes Beta APIs.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"enabled_apis": {
+							Type:        schema.TypeSet,
+							Required:    true,
+							Elem:        &schema.Schema{Type: schema.TypeString},
+							Description: `Enabled Kubernetes Beta APIs.`,
+						},
+					},
+				},
+			},
+
+			"enable_tpu": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				ForceNew:    true,
+				Description: `Whether to enable Cloud TPU resources in this cluster.`,
+<% unless version == 'ga' -%>
+				ConflictsWith: []string{"tpu_config"},
+				Computed: true,
+				// TODO: deprecate when tpu_config is correctly returned by the API
+				// Deprecated: "Deprecated in favor of tpu_config",
+<% end -%>
+			},
+
+<% unless version == 'ga' -%>
+			"tpu_config": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				Computed:    true,
+				MaxItems:    1,
+				Description: `TPU configuration for the cluster.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"enabled": {
+							Type:        schema.TypeBool,
+							Required:    true,
+							ForceNew:    true,
+							Description: `Whether Cloud TPU integration is enabled or not`,
+						},
+						"ipv4_cidr_block": {
+							Type:        schema.TypeString,
+							Computed:    true,
+							Description: `IPv4 CIDR block reserved for Cloud TPU in the VPC.`,
+						},
+						"use_service_networking": {
+							Type:        schema.TypeBool,
+							Optional:    true,
+							ForceNew:    true,
+							Description: `Whether to use service networking for Cloud TPU or not`,
+						},
+					},
+				},
+			},
+<% end -%>
+
+			"enable_legacy_abac": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Default:     false,
+				Description: `Whether the ABAC authorizer is enabled for this cluster. When enabled, identities in the system, including service accounts, nodes, and controllers, will have statically granted permissions beyond those provided by the RBAC configuration or IAM. Defaults to false.`,
+			},
+
+			"enable_shielded_nodes": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Default:     true,
+				Description: `Enable Shielded Nodes features on all nodes in this cluster. Defaults to true.`,
+				ConflictsWith: []string{"enable_autopilot"},
+			},
+
+			"enable_autopilot": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				ForceNew:    true,
+				Description: `Enable Autopilot for this cluster.`,
+				// ConflictsWith: many fields, see https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-overview#comparison. The conflict is only set one-way, on other fields w/ this field.
+			},
+
+			"allow_net_admin": {
+				Type: schema.TypeBool,
+				Optional: true,
+				Description: `Enable NET_ADMIN for this cluster.`,
+            },
+
+			"authenticator_groups_config": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				Computed:    true,
+				MaxItems:    1,
+				Description: `Configuration for the Google Groups for GKE feature.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"security_group": {
+							Type:        schema.TypeString,
+							Required:    true,
+							Description: `The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format gke-security-groups@yourdomain.com.`,
+						},
+					},
+				},
+			},
+
+			"initial_node_count": {
+				Type:        schema.TypeInt,
+				Optional:    true,
+				ForceNew:    true,
+				Description: `The number of nodes to create in this cluster's default node pool. In regional or multi-zonal clusters, this is the number of nodes per zone. Must be set if node_pool is not set. If you're using google_container_node_pool objects with no default node pool, you'll need to set this to a value of at least 1, alongside setting remove_default_node_pool to true.`,
+			},
+
+			"logging_config": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				Computed:    true,
+				MaxItems:    1,
+				Description: `Logging configuration for the cluster.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"enable_components": {
+							Type:        schema.TypeList,
+							Required:    true,
+							Description: `GKE components exposing logs. Valid values include SYSTEM_COMPONENTS, APISERVER, CONTROLLER_MANAGER, SCHEDULER, and WORKLOADS.`,
+							Elem: &schema.Schema{
+								Type: schema.TypeString,
+								ValidateFunc: validation.StringInSlice([]string{"SYSTEM_COMPONENTS", "APISERVER", "CONTROLLER_MANAGER", "SCHEDULER", "WORKLOADS"}, false),
+							},
+						},
+					},
+				},
+			},
+
+			"logging_service": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Computed:     true,
+<% unless version == 'ga' -%>
+				ConflictsWith: []string{"cluster_telemetry"},
+<% end -%>
+				ValidateFunc: validation.StringInSlice([]string{"logging.googleapis.com", "logging.googleapis.com/kubernetes", "none"}, false),
+				Description:  `The logging service that the cluster should write logs to. Available options include logging.googleapis.com(Legacy Stackdriver), logging.googleapis.com/kubernetes(Stackdriver Kubernetes Engine Logging), and none. Defaults to logging.googleapis.com/kubernetes.`,
+			},
+
+			"maintenance_policy": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				MaxItems:    1,
+				Description: `The maintenance policy to use for the cluster.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"daily_maintenance_window": {
+							Type:     schema.TypeList,
+							Optional: true,
+							ExactlyOneOf: []string{
+								"maintenance_policy.0.daily_maintenance_window",
+								"maintenance_policy.0.recurring_window",
+							},
+							MaxItems:    1,
+							Description: `Time window specified for daily maintenance operations. Specify start_time in RFC3339 format "HH:MM”, where HH : [00-23] and MM : [00-59] GMT.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"start_time": {
+										Type:             schema.TypeString,
+										Required:         true,
+										ValidateFunc:     verify.ValidateRFC3339Time,
+										DiffSuppressFunc: tpgresource.Rfc3339TimeDiffSuppress,
+									},
+									"duration": {
+										Type:     schema.TypeString,
+										Computed: true,
+									},
+								},
+							},
+						},
+						"recurring_window": {
+							Type:     schema.TypeList,
+							Optional: true,
+							MaxItems: 1,
+							ExactlyOneOf: []string{
+								"maintenance_policy.0.daily_maintenance_window",
+								"maintenance_policy.0.recurring_window",
+							},
+							Description: `Time window for recurring maintenance operations.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"start_time": {
+										Type:         schema.TypeString,
+										Required:     true,
+										ValidateFunc: verify.ValidateRFC3339Date,
+									},
+									"end_time": {
+										Type:         schema.TypeString,
+										Required:     true,
+										ValidateFunc: verify.ValidateRFC3339Date,
+									},
+									"recurrence": {
+										Type:             schema.TypeString,
+										Required:         true,
+										DiffSuppressFunc: rfc5545RecurrenceDiffSuppress,
+									},
+								},
+							},
+						},
+						"maintenance_exclusion": {
+							Type:        schema.TypeSet,
+							Optional:    true,
+							MaxItems:    20,
+							Description: `Exceptions to maintenance window. Non-emergency maintenance should not occur in these windows.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"exclusion_name": {
+										Type:         schema.TypeString,
+										Required:     true,
+									},
+									"start_time": {
+										Type:         schema.TypeString,
+										Required:     true,
+										ValidateFunc: verify.ValidateRFC3339Date,
+									},
+									"end_time": {
+										Type:         schema.TypeString,
+										Required:     true,
+										ValidateFunc: verify.ValidateRFC3339Date,
+									},
+									"exclusion_options": {
+										Type:        schema.TypeList,
+										Optional:    true,
+										MaxItems:    1,
+										Description: `Maintenance exclusion related options.`,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"scope": {
+													Type:         schema.TypeString,
+													Required:     true,
+													ValidateFunc: validation.StringInSlice([]string{"NO_UPGRADES", "NO_MINOR_UPGRADES", "NO_MINOR_OR_NODE_UPGRADES"}, false),
+													Description: `The scope of automatic upgrades to restrict in the exclusion window.`,
+												},
+											},
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+
+<% unless version == 'ga' -%>
+			"protect_config": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				Computed:    true,
+				MaxItems:    1,
+				Description: `Enable/Disable Protect API features for the cluster.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"workload_config": {
+							Type:        schema.TypeList,
+							Optional:    true,
+							Computed:    true,
+							MaxItems:    1,
+							Description: `WorkloadConfig defines which actions are enabled for a cluster's workload configurations.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"audit_mode": {
+										Type:        schema.TypeString,
+										Required:    true,
+										Description: `Sets which mode of auditing should be used for the cluster's workloads. Accepted values are DISABLED, BASIC.`,
+									},
+								},
+							},
+							AtLeastOneOf: []string{
+								"protect_config.0.workload_config",
+								"protect_config.0.workload_vulnerability_mode",
+							},
+						},
+						"workload_vulnerability_mode": {
+										Type:             schema.TypeString,
+										Optional:         true,
+										Computed:    true,
+										Description: `Sets which mode to use for Protect workload vulnerability scanning feature. Accepted values are DISABLED, BASIC.`,
+										AtLeastOneOf: []string{
+											"protect_config.0.workload_config",
+											"protect_config.0.workload_vulnerability_mode",
+										},
+									},
+					},
+				},
+			},
+<% end -%>
+
+			"security_posture_config": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				MaxItems:    1,
+				Computed:    true,
+				Description: `Defines the config needed to enable/disable features for the Security Posture API`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"mode": {
+							Type:             schema.TypeString,
+							Optional:         true,
+							Computed:         true,
+							ValidateFunc:     validation.StringInSlice([]string{"DISABLED", "BASIC", "MODE_UNSPECIFIED"}, false),
+							Description:      `Sets the mode of the Kubernetes security posture API's off-cluster features. Available options include DISABLED and BASIC.`,
+							DiffSuppressFunc: tpgresource.EmptyOrDefaultStringSuppress("MODE_UNSPECIFIED"),
+						},
+						"vulnerability_mode": {
+							Type:             schema.TypeString,
+							Optional:         true,
+							Computed:         true,
+							ValidateFunc:     validation.StringInSlice([]string{"VULNERABILITY_DISABLED", "VULNERABILITY_BASIC", "VULNERABILITY_ENTERPRISE", "VULNERABILITY_MODE_UNSPECIFIED"}, false),
+							Description:      `Sets the mode of the Kubernetes security posture API's workload vulnerability scanning. Available options include VULNERABILITY_DISABLED, VULNERABILITY_BASIC and VULNERABILITY_ENTERPRISE.`,
+							DiffSuppressFunc: tpgresource.EmptyOrDefaultStringSuppress("VULNERABILITY_MODE_UNSPECIFIED"),
+						},
+					},
+				},
+			},
+			"monitoring_config": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				Computed:    true,
+				MaxItems:    1,
+				Description: `Monitoring configuration for the cluster.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"enable_components": {
+							Type:        schema.TypeList,
+							Optional:    true,
+							Computed:    true,
+<% if version == "ga" -%>
+							Description: `GKE components exposing metrics. Valid values include SYSTEM_COMPONENTS, APISERVER, SCHEDULER, CONTROLLER_MANAGER, STORAGE, HPA, POD, DAEMONSET, DEPLOYMENT and STATEFULSET.`,
+<% else -%>
+							Description: `GKE components exposing metrics. Valid values include SYSTEM_COMPONENTS, APISERVER, SCHEDULER, CONTROLLER_MANAGER, STORAGE, HPA, POD, DAEMONSET, DEPLOYMENT, STATEFULSET and WORKLOADS.`,
+<% end -%>
+							Elem: &schema.Schema{
+								Type: schema.TypeString,
+							},
+						},
+						"managed_prometheus": {
+							Type:        schema.TypeList,
+							Optional:    true,
+							Computed:    true,
+							MaxItems:    1,
+							Description: `Configuration for Google Cloud Managed Services for Prometheus.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"enabled": {
+										Type:        schema.TypeBool,
+										Required:    true,
+										Description: `Whether or not the managed collection is enabled.`,
+									},
+								},
+							},
+						},
+						"advanced_datapath_observability_config": {
+							Type:        schema.TypeList,
+							Optional:    true,
+							Computed:    true,
+							MaxItems:    2,
+							Description: `Configuration of Advanced Datapath Observability features.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"enable_metrics": {
+										Type:        schema.TypeBool,
+										Required:    true,
+										Description: `Whether or not the advanced datapath metrics are enabled.`,
+									},
+									"relay_mode": {
+										Type:         schema.TypeString,
+										Optional:     true,
+										Computed:     true,
+										Description:  `Mode used to make Relay available.`,
+										ValidateFunc: validation.StringInSlice([]string{"DISABLED", "INTERNAL_VPC_LB", "EXTERNAL_LB"}, false),
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+
+			"notification_config": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				Computed:    true,
+				MaxItems: 	 1,
+				Description: `The notification config for sending cluster upgrade notifications`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"pubsub": {
+							Type:        schema.TypeList,
+							Required:    true,
+							MaxItems:    1,
+							Description: `Notification config for Cloud Pub/Sub`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"enabled": {
+										Type:        schema.TypeBool,
+										Required:    true,
+										Description: `Whether or not the notification config is enabled`,
+									},
+									"topic": {
+										Type:        schema.TypeString,
+										Optional:    true,
+										Description: `The pubsub topic to push upgrade notifications to. Must be in the same project as the cluster. Must be in the format: projects/{project}/topics/{topic}.`,
+									},
+									"filter": {
+										Type:        schema.TypeList,
+										Optional:    true,
+										MaxItems:    1,
+										Description: `Allows filtering to one or more specific event types. If event types are present, those and only those event types will be transmitted to the cluster. Other types will be skipped. If no filter is specified, or no event types are present, all event types will be sent`,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"event_type": {
+													Type:        schema.TypeList,
+													Required:    true,
+													Description: `Can be used to filter what notifications are sent. Valid values include include UPGRADE_AVAILABLE_EVENT, UPGRADE_EVENT and SECURITY_BULLETIN_EVENT`,
+													Elem: &schema.Schema{
+														Type:         schema.TypeString,
+														ValidateFunc: validation.StringInSlice([]string{"UPGRADE_AVAILABLE_EVENT", "UPGRADE_EVENT", "SECURITY_BULLETIN_EVENT"}, false),
+													},
+												},
+											},
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+
+			"confidential_nodes": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				Computed:    true,
+				ForceNew:    true,
+				MaxItems:    1,
+				Description: `Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can't be changed (or added/removed) after cluster creation without deleting and recreating the entire cluster.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"enabled": {
+							Type:        schema.TypeBool,
+							Required:    true,
+							ForceNew:    true,
+							Description: `Whether Confidential Nodes feature is enabled for all nodes in this cluster.`,
+						},
+					},
+				},
+			},
+
+			"master_auth": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				MaxItems:    1,
+				Computed:    true,
+				Description: `The authentication information for accessing the Kubernetes master. Some values in this block are only returned by the API if your service account has permission to get credentials for your GKE cluster. If you see an unexpected diff unsetting your client cert, ensure you have the container.clusters.getCredentials permission.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"client_certificate_config": {
+							Type:         schema.TypeList,
+							MaxItems:     1,
+							Required:     true,
+							ForceNew:     true,
+							Description:  `Whether client certificate authorization is enabled for this cluster.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"issue_client_certificate": {
+										Type:        schema.TypeBool,
+										Required:    true,
+										ForceNew:    true,
+										Description: `Whether client certificate authorization is enabled for this cluster.`,
+									},
+								},
+							},
+						},
+
+						"client_certificate": {
+							Type:        schema.TypeString,
+							Computed:    true,
+							Description: `Base64 encoded public certificate used by clients to authenticate to the cluster endpoint.`,
+						},
+
+						"client_key": {
+							Type:        schema.TypeString,
+							Computed:    true,
+							Sensitive:   true,
+							Description: `Base64 encoded private key used by clients to authenticate to the cluster endpoint.`,
+						},
+
+						"cluster_ca_certificate": {
+							Type:        schema.TypeString,
+							Computed:    true,
+							Description: `Base64 encoded public certificate that is the root of trust for the cluster.`,
+						},
+					},
+				},
+			},
+
+			"master_authorized_networks_config": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				Computed:    true,
+				MaxItems:    1,
+				Elem:        masterAuthorizedNetworksConfig,
+				Description: `The desired configuration options for master authorized networks. Omit the nested cidr_blocks attribute to disallow external access (except the cluster node IPs, which GKE automatically whitelists).`,
+			},
+
+			"min_master_version": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: `The minimum version of the master. GKE will auto-update the master to new versions, so this does not guarantee the current master version--use the read-only master_version field to obtain that. If unset, the cluster's version will be set by GKE to the version of the most recent official release (which is not necessarily the latest version).`,
+			},
+
+			"monitoring_service": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Computed:     true,
+<% unless version == 'ga' -%>
+				ConflictsWith: []string{"cluster_telemetry"},
+<% end -%>
+				ValidateFunc: validation.StringInSlice([]string{"monitoring.googleapis.com", "monitoring.googleapis.com/kubernetes", "none"}, false),
+				Description:  `The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com(Legacy Stackdriver), monitoring.googleapis.com/kubernetes(Stackdriver Kubernetes Engine Monitoring), and none. Defaults to monitoring.googleapis.com/kubernetes.`,
+			},
+
+			"network": {
+				Type:             schema.TypeString,
+				Optional:         true,
+				Default:          "default",
+				ForceNew:         true,
+				DiffSuppressFunc: tpgresource.CompareSelfLinkOrResourceName,
+				Description:      `The name or self_link of the Google Compute Engine network to which the cluster is connected. For Shared VPC, set this to the self link of the shared network.`,
+			},
+
+			"network_policy": {
+				Type:             schema.TypeList,
+				Optional:         true,
+				MaxItems:         1,
+				Description:      `Configuration options for the NetworkPolicy feature.`,
+				ConflictsWith:    []string{"enable_autopilot"},
+				DiffSuppressFunc: containerClusterNetworkPolicyDiffSuppress,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"enabled": {
+							Type:        schema.TypeBool,
+							Required:    true,
+							Description: `Whether network policy is enabled on the cluster.`,
+						},
+						"provider": {
+							Type:             schema.TypeString,
+							Optional:         true,
+							ValidateFunc:     validation.StringInSlice([]string{"PROVIDER_UNSPECIFIED", "CALICO"}, false),
+							DiffSuppressFunc: tpgresource.EmptyOrDefaultStringSuppress("PROVIDER_UNSPECIFIED"),
+							Description:      `The selected network policy provider.`,
+						},
+					},
+				},
+			},
+
+			"node_config": clusterSchemaNodeConfig(),
+
+			"node_pool": {
+				Type:     schema.TypeList,
+				Optional: true,
+				Computed: true,
+				ForceNew: true, // TODO: Add ability to add/remove nodePools
+				Elem: &schema.Resource{
+					Schema: schemaNodePool,
+				},
+				Description: `List of node pools associated with this cluster. See google_container_node_pool for schema. Warning: node pools defined inside a cluster can't be changed (or added/removed) after cluster creation without deleting and recreating the entire cluster. Unless you absolutely need the ability to say "these are the only node pools associated with this cluster", use the google_container_node_pool resource instead of this property.`,
+				ConflictsWith: []string{"enable_autopilot"},
+			},
+
+			"node_pool_defaults": clusterSchemaNodePoolDefaults(),
+
+			"node_pool_auto_config": {
+				Type:             schema.TypeList,
+				Optional:         true,
+				Computed:         true,
+				MaxItems:         1,
+				Description:      `Node pool configs that apply to all auto-provisioned node pools in autopilot clusters and node auto-provisioning enabled clusters.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"network_tags": {
+							Type:        schema.TypeList,
+							Optional:    true,
+							MaxItems:    1,
+							Description: `Collection of Compute Engine network tags that can be applied to a node's underlying VM instance.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"tags": {
+										Type:        schema.TypeList,
+										Optional:    true,
+										Elem:        &schema.Schema{Type: schema.TypeString},
+										Description: `List of network tags applied to auto-provisioned node pools.`,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+
+			"node_version": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Computed:    true,
+				Description: `The Kubernetes version on the nodes. Must either be unset or set to the same value as min_master_version on create. Defaults to the default version set by GKE which is not necessarily the latest version. This only affects nodes in the default node pool. While a fuzzy version can be specified, it's recommended that you specify explicit versions as Terraform will see spurious diffs when fuzzy versions are used. See the google_container_engine_versions data source's version_prefix field to approximate fuzzy versions in a Terraform-compatible way. To update nodes in other node pools, use the version attribute on the node pool.`,
+			},
+
+<% unless version == "ga" -%>
+			"pod_security_policy_config": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				Description: `Configuration for the PodSecurityPolicy feature.`,
+				MaxItems:    1,
+				DiffSuppressFunc: podSecurityPolicyCfgSuppress,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"enabled": {
+							Type:        schema.TypeBool,
+							Required:    true,
+							Description: `Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created.`,
+						},
+					},
+				},
+			},
+<% end -%>
+
+			"project": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Computed:    true,
+				ForceNew:    true,
+				Description: `The ID of the project in which the resource belongs. If it is not provided, the provider project is used.`,
+			},
+
+			"subnetwork": {
+				Type:             schema.TypeString,
+				Optional:         true,
+				Computed:         true,
+				ForceNew:         true,
+				DiffSuppressFunc: tpgresource.CompareSelfLinkOrResourceName,
+				Description:      `The name or self_link of the Google Compute Engine subnetwork in which the cluster's instances are launched.`,
+			},
+
+			"self_link": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: `Server-defined URL for the resource.`,
+			},
+
+			"endpoint": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: `The IP address of this cluster's Kubernetes master.`,
+			},
+
+			"master_version": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: `The current version of the master in the cluster. This may be different than the min_master_version set in the config if the master has been updated by GKE.`,
+			},
+
+			"services_ipv4_cidr": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: `The IP address range of the Kubernetes services in this cluster, in CIDR notation (e.g. 1.2.3.4/29). Service addresses are typically put in the last /16 from the container CIDR.`,
+			},
+
+			"ip_allocation_policy": {
+				Type:          schema.TypeList,
+				MaxItems:      1,
+				ForceNew:      true,
+				Computed:      true,
+				Optional:      true,
+				ConflictsWith: []string{"cluster_ipv4_cidr"},
+				Description:   `Configuration of cluster IP allocation for VPC-native clusters. Adding this block enables IP aliasing, making the cluster VPC-native instead of routes-based.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						// GKE creates/deletes secondary ranges in VPC
+						"cluster_ipv4_cidr_block": {
+							Type:             schema.TypeString,
+							Optional:         true,
+							Computed:         true,
+							ForceNew:         true,
+							ConflictsWith:    ipAllocationRangeFields,
+							DiffSuppressFunc: tpgresource.CidrOrSizeDiffSuppress,
+							Description:      `The IP address range for the cluster pod IPs. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. /14) to have a range chosen with a specific netmask. Set to a CIDR notation (e.g. 10.96.0.0/14) from the RFC-1918 private networks (e.g. 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) to pick a specific range to use.`,
+						},
+
+						"services_ipv4_cidr_block": {
+							Type:             schema.TypeString,
+							Optional:         true,
+							Computed:         true,
+							ForceNew:         true,
+							ConflictsWith:    ipAllocationRangeFields,
+							DiffSuppressFunc: tpgresource.CidrOrSizeDiffSuppress,
+							Description:      `The IP address range of the services IPs in this cluster. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. /14) to have a range chosen with a specific netmask. Set to a CIDR notation (e.g. 10.96.0.0/14) from the RFC-1918 private networks (e.g. 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) to pick a specific range to use.`,
+						},
+
+						// User manages secondary ranges manually
+						"cluster_secondary_range_name": {
+							Type:          schema.TypeString,
+							Optional:      true,
+							Computed:      true,
+							ForceNew:      true,
+							ConflictsWith: ipAllocationCidrBlockFields,
+							Description:   `The name of the existing secondary range in the cluster's subnetwork to use for pod IP addresses. Alternatively, cluster_ipv4_cidr_block can be used to automatically create a GKE-managed one.`,
+						},
+
+						"services_secondary_range_name": {
+							Type:          schema.TypeString,
+							Optional:      true,
+							Computed:      true,
+							ForceNew:      true,
+							ConflictsWith: ipAllocationCidrBlockFields,
+							Description:   `The name of the existing secondary range in the cluster's subnetwork to use for service ClusterIPs. Alternatively, services_ipv4_cidr_block can be used to automatically create a GKE-managed one.`,
+						},
+
+						"stack_type": {
+							Type:             schema.TypeString,
+							Optional:    	  true,
+							ForceNew:         true,
+							Default:          "IPV4",
+							ValidateFunc:     validation.StringInSlice([]string{"IPV4", "IPV4_IPV6"}, false),
+							Description: 	  `The IP Stack type of the cluster. Choose between IPV4 and IPV4_IPV6. Default type is IPV4 Only if not set`,
+						},
+						"pod_cidr_overprovision_config": {
+							Type:     schema.TypeList,
+							Optional: true,
+							Computed: true,
+							ForceNew: true,
+							MaxItems: 1,
+							Description: `Configuration for cluster level pod cidr overprovision. Default is disabled=false.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"disabled": {
+										Type:     schema.TypeBool,
+										Required: true,
+									},
+								},
+							},
+						},
+						"additional_pod_ranges_config": {
+							Type:        schema.TypeList,
+							MaxItems:    1,
+							Optional:    true,
+							Description: `AdditionalPodRangesConfig is the configuration for additional pod secondary ranges supporting the ClusterUpdate message.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"pod_range_names": {
+										Type:        schema.TypeSet,
+										MinItems:    1,
+										Required:    true,
+										Elem:        &schema.Schema{Type: schema.TypeString},
+										Description: `Name for pod secondary ipv4 range which has the actual range defined ahead.`,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+
+			"networking_mode": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Computed:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringInSlice([]string{"VPC_NATIVE", "ROUTES"}, false),
+				Description:  `Determines whether alias IPs or routes will be used for pod IPs in the cluster.`,
+			},
+
+			"remove_default_node_pool": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Description: `If true, deletes the default node pool upon cluster creation. If you're using google_container_node_pool resources with no default node pool, this should be set to true, alongside setting initial_node_count to at least 1.`,
+				ConflictsWith: []string{"enable_autopilot"},
+			},
+
+			"private_cluster_config": {
+				Type:             schema.TypeList,
+				MaxItems:         1,
+				Optional:         true,
+				Computed:         true,
+				DiffSuppressFunc: containerClusterPrivateClusterConfigSuppress,
+				Description:      `Configuration for private clusters, clusters with private nodes.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						// enable_private_endpoint is orthogonal to private_endpoint_subnetwork.
+						// User can create a private_cluster_config block without including
+						// either one of those two fields. Both fields are optional.
+						// At the same time, we use 'AtLeastOneOf' to prevent an empty block
+						// like 'private_cluster_config{}'
+						"enable_private_endpoint": {
+							Type:             schema.TypeBool,
+							Optional:         true,
+							AtLeastOneOf:     privateClusterConfigKeys,
+							DiffSuppressFunc: containerClusterPrivateClusterConfigSuppress,
+							Description:      `When true, the cluster's private endpoint is used as the cluster endpoint and access through the public endpoint is disabled. When false, either endpoint can be used.`,
+						},
+						"enable_private_nodes": {
+							Type:             schema.TypeBool,
+							Optional:         true,
+							ForceNew:         true,
+							AtLeastOneOf:     privateClusterConfigKeys,
+							DiffSuppressFunc: containerClusterPrivateClusterConfigSuppress,
+							Description:      `Enables the private cluster feature, creating a private endpoint on the cluster. In a private cluster, nodes only have RFC 1918 private addresses and communicate with the master's private endpoint via private networking.`,
+						},
+						"master_ipv4_cidr_block": {
+							Type:         schema.TypeString,
+							Computed:     true,
+							Optional:     true,
+							ForceNew:     true,
+							AtLeastOneOf: privateClusterConfigKeys,
+							ValidateFunc: verify.OrEmpty(validation.IsCIDRNetwork(28, 28)),
+							Description:  `The IP range in CIDR notation to use for the hosted master network. This range will be used for assigning private IP addresses to the cluster master(s) and the ILB VIP. This range must not overlap with any other ranges in use within the cluster's network, and it must be a /28 subnet. See Private Cluster Limitations for more details. This field only applies to private clusters, when enable_private_nodes is true.`,
+						},
+						"peering_name": {
+							Type:         schema.TypeString,
+							Computed:     true,
+							Description: `The name of the peering between this cluster and the Google owned VPC.`,
+						},
+						"private_endpoint": {
+							Type:         schema.TypeString,
+							Computed:     true,
+							Description: `The internal IP address of this cluster's master endpoint.`,
+						},
+						"private_endpoint_subnetwork": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							ForceNew:     true,
+							AtLeastOneOf: privateClusterConfigKeys,
+							DiffSuppressFunc: tpgresource.CompareSelfLinkOrResourceName,
+							Description: `Subnetwork in cluster's network where master's endpoint will be provisioned.`,
+						},
+						"public_endpoint": {
+							Type:         schema.TypeString,
+							Computed:     true,
+							Description: `The external IP address of this cluster's master endpoint.`,
+						},
+						"master_global_access_config": {
+							Type:         schema.TypeList,
+							MaxItems:     1,
+							Optional:     true,
+							Computed:     true,
+							AtLeastOneOf: privateClusterConfigKeys,
+							Description: "Controls cluster master global access settings.",
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"enabled": {
+										Type:        schema.TypeBool,
+										Required:    true,
+										Description: `Whether the cluster master is accessible globally or not.`,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+
+			"resource_labels": {
+				Type:        schema.TypeMap,
+				Optional:    true,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+				Description: `The GCE resource labels (a map of key/value pairs) to be applied to the cluster.`,
+			},
+
+			"label_fingerprint": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: `The fingerprint of the set of labels for this cluster.`,
+			},
+
+			"default_max_pods_per_node": {
+				Type:        schema.TypeInt,
+				Optional:    true,
+				ForceNew:    true,
+				Computed:    true,
+				Description: `The default maximum number of pods per node in this cluster. This doesn't work on "routes-based" clusters, clusters that don't have IP Aliasing enabled.`,
+				ConflictsWith: []string{"enable_autopilot"},
+			},
+
+			"vertical_pod_autoscaling": {
+				Type:        schema.TypeList,
+				MaxItems:    1,
+				Optional:    true,
+				Computed:    true,
+				Description: `Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"enabled": {
+							Type:        schema.TypeBool,
+							Required:    true,
+							Description: `Enables vertical pod autoscaling.`,
+						},
+					},
+				},
+			},
+			"workload_identity_config": {
+				Type:     schema.TypeList,
+				MaxItems: 1,
+				Optional: true,
+				// Computed is unsafe to remove- this API may return `"workloadIdentityConfig": {},` or omit the key entirely
+				// and both will be valid. Note that we don't handle the case where the API returns nothing & the user has defined
+				// workload_identity_config today.
+				Computed: true,
+				Description: `Configuration for the use of Kubernetes Service Accounts in GCP IAM policies.`,
+				ConflictsWith: []string{"enable_autopilot"},
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"workload_pool": {
+							Type:     schema.TypeString,
+							Optional: true,
+							Description: "The workload pool to attach all Kubernetes service accounts to.",
+						},
+					},
+				},
+			},
+
+			"identity_service_config": {
+				Type:     schema.TypeList,
+				MaxItems: 1,
+				Optional: true,
+				Computed: true,
+				Description: `Configuration for Identity Service which allows customers to use external identity providers with the K8S API.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"enabled": {
+							Type:     schema.TypeBool,
+							Optional: true,
+							Description: "Whether to enable the Identity Service component.",
+						},
+					},
+				},
+			},
+
+	"service_external_ips_config": {
+		Type:        schema.TypeList,
+		MaxItems:    1,
+		Optional:    true,
+		Computed:    true,
+		Description: `If set, and enabled=true, services with external ips field will not be blocked`,
+		Elem: &schema.Resource{
+			Schema: map[string]*schema.Schema{
+				"enabled": {
+					Type:        schema.TypeBool,
+					Required:    true,
+					Description: `When enabled, services with exterenal ips specified will be allowed.`,
+				},
+			},
+		},
+	},
+
+	"mesh_certificates": {
+			Type:        schema.TypeList,
+			MaxItems:    1,
+			Optional:    true,
+			Computed:    true,
+			Description: `If set, and enable_certificates=true, the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster.`,
+			Elem: &schema.Resource{
+				Schema: map[string]*schema.Schema{
+					"enable_certificates": {
+						Type:        schema.TypeBool,
+						Required:    true,
+						Description: `When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster.`,
+					},
+				},
+			},
+		},
+
+      "database_encryption": {
+        Type:        schema.TypeList,
+        MaxItems:    1,
+        Optional:    true,
+        Computed:    true,
+        Description: `Application-layer Secrets Encryption settings. The object format is {state = string, key_name = string}. Valid values of state are: "ENCRYPTED"; "DECRYPTED". key_name is the name of a CloudKMS key.`,
+        Elem: &schema.Resource{
+          Schema: map[string]*schema.Schema{
+            "state": {
+              Type:         schema.TypeString,
+              Required:     true,
+              ValidateFunc: validation.StringInSlice([]string{"ENCRYPTED", "DECRYPTED"}, false),
+              Description:  `ENCRYPTED or DECRYPTED.`,
+            },
+            "key_name": {
+              Type:        schema.TypeString,
+              Optional:    true,
+              Description: `The key to use to encrypt/decrypt secrets.`,
+            },
+          },
+        },
+      },
+
+			"release_channel": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				Computed:    true,
+				MaxItems:    1,
+				Description: `Configuration options for the Release channel feature, which provide more control over automatic upgrades of your GKE clusters. Note that removing this field from your config will not unenroll it. Instead, use the "UNSPECIFIED" channel.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"channel": {
+							Type:             schema.TypeString,
+							Required:         true,
+							ValidateFunc:     validation.StringInSlice([]string{"UNSPECIFIED", "RAPID", "REGULAR", "STABLE"}, false),
+							Description:      `The selected release channel. Accepted values are:
+* UNSPECIFIED: Not set.
+* RAPID: Weekly upgrade cadence; Early testers and developers who requires new features.
+* REGULAR: Multiple per month upgrade cadence; Production users who need features not yet offered in the Stable channel.
+* STABLE: Every few months upgrade cadence; Production users who need stability above all else, and for whom frequent upgrades are too risky.`,
+						},
+					},
+				},
+			},
+
+			"tpu_ipv4_cidr_block": {
+				Computed:    true,
+				Type:        schema.TypeString,
+				Description: `The IP address range of the Cloud TPUs in this cluster, in CIDR notation (e.g. 1.2.3.4/29).`,
+			},
+
+<% unless version == 'ga' -%>
+			"cluster_telemetry": {
+				Type:     schema.TypeList,
+				Optional: true,
+				Computed: true,
+				Description: `Telemetry integration for the cluster.`,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"type": {
+							Type:             schema.TypeString,
+							Required:         true,
+							ValidateFunc:     validation.StringInSlice([]string{"DISABLED","ENABLED","SYSTEM_ONLY"}, false),
+							Description:      `Type of the integration.`,
+						},
+					},
+				},
+			},
+<% end -%>
+
+			"default_snat_status": {
+				Type: schema.TypeList,
+				MaxItems: 1,
+				Optional: true,
+				Computed: true,
+				Description: `Whether the cluster disables default in-node sNAT rules. In-node sNAT rules will be disabled when defaultSnatStatus is disabled.`,
+				Elem: &schema.Resource {
+					Schema: map[string]*schema.Schema {
+						"disabled": {
+							Type: schema.TypeBool,
+							Required: true,
+							Description: `When disabled is set to false, default IP masquerade rules will be applied to the nodes to prevent sNAT on cluster internal traffic.`,
+						},
+					},
+				},
+			},
+
+			"datapath_provider": {
+				Type:             schema.TypeString,
+				Optional:         true,
+				ForceNew:         true,
+				Computed:         true,
+				Description:      `The desired datapath provider for this cluster. By default, uses the IPTables-based kube-proxy implementation.`,
+				ValidateFunc:     validation.StringInSlice([]string{"DATAPATH_PROVIDER_UNSPECIFIED", "LEGACY_DATAPATH", "ADVANCED_DATAPATH"}, false),
+				DiffSuppressFunc: tpgresource.EmptyOrDefaultStringSuppress("DATAPATH_PROVIDER_UNSPECIFIED"),
+			},
+
+			"enable_intranode_visibility": {
+			   Type: schema.TypeBool,
+			   Optional: true,
+			   Computed: true,
+			   Description: `Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network.`,
+			   ConflictsWith: []string{"enable_autopilot"},
+			},
+			"enable_l4_ilb_subsetting": {
+			   Type: schema.TypeBool,
+			   Optional: true,
+			   Description: `Whether L4ILB Subsetting is enabled for this cluster.`,
+			   Default: false,
+			},
+<% unless version == 'ga' -%>
+			"enable_multi_networking": {
+			   Type: schema.TypeBool,
+			   Optional: true,
+			   ForceNew: true,
+			   Description: `Whether multi-networking is enabled for this cluster.`,
+			   Default: false,
+			},
+			"enable_fqdn_network_policy": {
+			   Type: schema.TypeBool,
+			   Optional: true,
+			   Description: `Whether FQDN Network Policy is enabled on this cluster.`,
+			   Default: false,
+			},
+<% end -%>
+			"private_ipv6_google_access": {
+			   Type: schema.TypeString,
+			   Optional: true,
+			   Description: `The desired state of IPv6 connectivity to Google Services. By default, no private IPv6 access to or from Google Services (all access will be via IPv4).`,
+			   Computed: true,
+			},
+
+			"cost_management_config": {
+				Type:        schema.TypeList,
+				MaxItems:    1,
+				Optional:    true,
+				Computed:    true,
+				Description: `Cost management configuration for the cluster.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"enabled": {
+							Type:        schema.TypeBool,
+							Required:    true,
+							Description: `Whether to enable GKE cost allocation. When you enable GKE cost allocation, the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery. Defaults to false.`,
+						},
+					},
+				},
+			},
+
+			"resource_usage_export_config": {
+				Type:        schema.TypeList,
+				MaxItems:    1,
+				Optional:    true,
+				Description: `Configuration for the ResourceUsageExportConfig feature.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"enable_network_egress_metering": {
+							Type:        schema.TypeBool,
+							Optional:    true,
+							Default:     false,
+							Description: `Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic.`,
+						},
+						"enable_resource_consumption_metering": {
+							Type:        schema.TypeBool,
+							Optional:    true,
+							Default:     true,
+							Description: `Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. Defaults to true.`,
+						},
+						"bigquery_destination": {
+							Type:        schema.TypeList,
+							MaxItems:    1,
+							Required:    true,
+							Description: `Parameters for using BigQuery as the destination of resource usage export.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"dataset_id": {
+										Type:        schema.TypeString,
+										Required:    true,
+										Description: `The ID of a BigQuery Dataset.`,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			"dns_config": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				MaxItems:    1,
+				ForceNew:    true,
+				DiffSuppressFunc: suppressDiffForAutopilot,
+				Description: `Configuration for Cloud DNS for Kubernetes Engine.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"cluster_dns": {
+							Type:         schema.TypeString,
+							Default:      "PROVIDER_UNSPECIFIED",
+							ValidateFunc: validation.StringInSlice([]string{"PROVIDER_UNSPECIFIED", "PLATFORM_DEFAULT", "CLOUD_DNS"}, false),
+							Description:  `Which in-cluster DNS provider should be used.`,
+							Optional:     true,
+						},
+						"cluster_dns_scope": {
+							Type:         schema.TypeString,
+							Default:      "DNS_SCOPE_UNSPECIFIED",
+							ValidateFunc: validation.StringInSlice([]string{"DNS_SCOPE_UNSPECIFIED", "CLUSTER_SCOPE", "VPC_SCOPE"}, false),
+							Description:  `The scope of access to cluster DNS records.`,
+							Optional:     true,
+						},
+						"cluster_dns_domain": {
+							Type:        schema.TypeString,
+							Description: `The suffix used for all cluster service records.`,
+							Optional:    true,
+						},
+					},
+				},
+			},
+			"gateway_api_config": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				Computed:    true,
+				MaxItems:    1,
+				Description: `Configuration for GKE Gateway API controller.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"channel": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ValidateFunc: validation.StringInSlice([]string{"CHANNEL_DISABLED", "CHANNEL_EXPERIMENTAL", "CHANNEL_STANDARD"}, false),
+							Description:  `The Gateway API release channel to use for Gateway API.`,
+						},
+					},
+				},
+			},
+		},
+	}
+}
diff --git a/mmv1/third_party/terraform/services/container/resource_container_cluster_test.go.erb b/mmv1/third_party/terraform/services/container/resource_container_cluster_test.go.erb
index 91f4c3b4e3ea..8bb072c5bcae 100644
--- a/mmv1/third_party/terraform/services/container/resource_container_cluster_test.go.erb
+++ b/mmv1/third_party/terraform/services/container/resource_container_cluster_test.go.erb
@@ -17,16 +17,19 @@ func TestAccContainerCluster_basic(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_basic(clusterName),
+				Config: testAccContainerCluster_basic(clusterName, networkName, subnetworkName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					resource.TestCheckResourceAttrSet("google_container_cluster.primary", "services_ipv4_cidr"),
 					resource.TestCheckResourceAttrSet("google_container_cluster.primary", "self_link"),
+					resource.TestCheckResourceAttr("google_container_cluster.primary", "networking_mode", "VPC_NATIVE"),
 				),
 			},
 			{
@@ -34,17 +37,20 @@ func TestAccContainerCluster_basic(t *testing.T) {
 				ImportStateId:     fmt.Sprintf("us-central1-a/%s", clusterName),
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
 				ResourceName:	     "google_container_cluster.primary",
 				ImportStateId:     fmt.Sprintf("%s/us-central1-a/%s", envvar.GetTestProjectFromEnv(), clusterName),
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
 				ResourceName:	     "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -53,19 +59,30 @@ func TestAccContainerCluster_basic(t *testing.T) {
 func TestAccContainerCluster_networkingModeRoutes(t *testing.T) {
 	t.Parallel()
 
-	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	firstClusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	secondClusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_networkingModeRoutes(clusterName),
+				Config: testAccContainerCluster_networkingModeRoutes(firstClusterName, secondClusterName),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_container_cluster.primary", "networking_mode", "ROUTES"),
+					resource.TestCheckResourceAttr("google_container_cluster.secondary", "networking_mode", "ROUTES"),				),
 			},
 			{
 				ResourceName:	     "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
+			},
+			{
+				ResourceName:	     "google_container_cluster.secondary",
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -75,13 +92,16 @@ func TestAccContainerCluster_misc(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_misc(clusterName),
+				Config: testAccContainerCluster_misc(clusterName, networkName, subnetworkName),
 				// Explicitly check removing the default node pool since we won't
 				// catch it by just importing.
 				Check: resource.TestCheckResourceAttr(
@@ -91,25 +111,28 @@ func TestAccContainerCluster_misc(t *testing.T) {
 				ResourceName:            "google_container_cluster.primary",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"remove_default_node_pool"},
+				ImportStateVerifyIgnore: []string{"remove_default_node_pool", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_misc_update(clusterName),
+				Config: testAccContainerCluster_misc_update(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.primary",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"remove_default_node_pool"},
+				ImportStateVerifyIgnore: []string{"remove_default_node_pool", "deletion_protection"},
 			},
 		},
 	})
 }
 
 func TestAccContainerCluster_withAddons(t *testing.T) {
+	t.Skipf("Skipping test %s due to https://github.com/hashicorp/terraform-provider-google/issues/16114", t.Name())
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 	pid := envvar.GetTestProjectFromEnv()
 
 	acctest.VcrTest(t, resource.TestCase{
@@ -118,44 +141,78 @@ func TestAccContainerCluster_withAddons(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withAddons(pid, clusterName),
+				Config: testAccContainerCluster_withAddons(pid, clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.primary",
 				ImportState:             true,
 				ImportStateVerify:       true,
 				// TODO: clean up this list in `4.0.0`, remove both `workload_identity_config` fields (same for below)
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_updateAddons(pid, clusterName),
+				Config: testAccContainerCluster_updateAddons(pid, clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.primary",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			// Issue with cloudrun_config addon: https://github.com/hashicorp/terraform-provider-google/issues/11943
 			// {
-			// 	Config: testAccContainerCluster_withInternalLoadBalancer(pid, clusterName),
+			// 	Config: testAccContainerCluster_withInternalLoadBalancer(pid, clusterName, networkName, subnetworkName),
 			// },
 			// {
 			// 	ResourceName:            "google_container_cluster.primary",
 			// 	ImportState:             true,
 			// 	ImportStateVerify:       true,
-			// 	ImportStateVerifyIgnore: []string{"min_master_version"},
+			// 	ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			// },
 		},
 	})
 }
 
+func TestAccContainerCluster_withDeletionProtection(t *testing.T) {
+	t.Parallel()
+	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:     func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccContainerCluster_withDeletionProtection(clusterName, "false"),
+			},
+			{
+				ResourceName:            "google_container_cluster.primary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
+			},
+			{
+				Config: testAccContainerCluster_withDeletionProtection(clusterName, "true"),
+			},
+			{
+				Config: testAccContainerCluster_withDeletionProtection(clusterName, "true"),
+				Destroy:     true,
+				ExpectError: regexp.MustCompile("Cannot destroy cluster because deletion_protection is set to true. Set it to false to proceed with cluster deletion."),
+			},
+			{
+				Config: testAccContainerCluster_withDeletionProtection(clusterName, "false"),
+			},
+		},
+	})
+}
+
 func TestAccContainerCluster_withNotificationConfig(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	topic := fmt.Sprintf("tf-test-topic-%s", acctest.RandString(t, 10))
 	newTopic := fmt.Sprintf("tf-test-topic-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
@@ -163,36 +220,40 @@ func TestAccContainerCluster_withNotificationConfig(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withNotificationConfig(clusterName, topic),
+				Config: testAccContainerCluster_withNotificationConfig(clusterName, topic, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.notification_config",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withNotificationConfig(clusterName, newTopic),
+				Config: testAccContainerCluster_withNotificationConfig(clusterName, newTopic, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.notification_config",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_disableNotificationConfig(clusterName),
+				Config: testAccContainerCluster_disableNotificationConfig(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.notification_config",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withNotificationConfig(clusterName, newTopic),
+				Config: testAccContainerCluster_withNotificationConfig(clusterName, newTopic, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.notification_config",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -204,6 +265,8 @@ func TestAccContainerCluster_withFilteredNotificationConfig(t *testing.T) {
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	topic := fmt.Sprintf("tf-test-topic-%s", acctest.RandString(t, 10))
 	newTopic := fmt.Sprintf("tf-test-topic-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
@@ -211,28 +274,31 @@ func TestAccContainerCluster_withFilteredNotificationConfig(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withFilteredNotificationConfig(clusterName, topic),
+				Config: testAccContainerCluster_withFilteredNotificationConfig(clusterName, topic, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.filtered_notification_config",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withFilteredNotificationConfigUpdate(clusterName, newTopic),
+				Config: testAccContainerCluster_withFilteredNotificationConfigUpdate(clusterName, newTopic, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.filtered_notification_config",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_disableFilteredNotificationConfig(clusterName, newTopic),
+				Config: testAccContainerCluster_disableFilteredNotificationConfig(clusterName, newTopic, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.filtered_notification_config",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -243,6 +309,8 @@ func TestAccContainerCluster_withConfidentialNodes(t *testing.T) {
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	npName := fmt.Sprintf("tf-test-cluster-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -250,28 +318,31 @@ func TestAccContainerCluster_withConfidentialNodes(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withConfidentialNodes(clusterName, npName),
+				Config: testAccContainerCluster_withConfidentialNodes(clusterName, npName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.confidential_nodes",
 				ImportState:             true,
 				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_disableConfidentialNodes(clusterName, npName),
+				Config: testAccContainerCluster_disableConfidentialNodes(clusterName, npName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.confidential_nodes",
 				ImportState:             true,
 				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withConfidentialNodes(clusterName, npName),
+				Config: testAccContainerCluster_withConfidentialNodes(clusterName, npName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.confidential_nodes",
 				ImportState:             true,
 				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -282,6 +353,8 @@ func TestAccContainerCluster_withILBSubsetting(t *testing.T) {
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	npName := fmt.Sprintf("tf-test-cluster-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
@@ -289,28 +362,31 @@ func TestAccContainerCluster_withILBSubsetting(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_disableILBSubSetting(clusterName, npName),
+				Config: testAccContainerCluster_disableILBSubSetting(clusterName, npName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.confidential_nodes",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withILBSubSetting(clusterName, npName),
+				Config: testAccContainerCluster_withILBSubSetting(clusterName, npName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.confidential_nodes",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_disableILBSubSetting(clusterName, npName),
+				Config: testAccContainerCluster_disableILBSubSetting(clusterName, npName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.confidential_nodes",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -334,6 +410,7 @@ func TestAccContainerCluster_withMultiNetworking(t *testing.T) {
 				ResourceName:      "google_container_cluster.cluster",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -358,7 +435,7 @@ func TestAccContainerCluster_withFQDNNetworkPolicy(t *testing.T) {
 				ResourceName:      "google_container_cluster.cluster",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
 				Config: testAccContainerCluster_withFQDNNetworkPolicy(clusterName, true),
@@ -367,7 +444,7 @@ func TestAccContainerCluster_withFQDNNetworkPolicy(t *testing.T) {
 				ResourceName:      "google_container_cluster.cluster",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -378,6 +455,8 @@ func TestAccContainerCluster_withMasterAuthConfig_NoCert(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
@@ -385,7 +464,7 @@ func TestAccContainerCluster_withMasterAuthConfig_NoCert(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withMasterAuthNoCert(clusterName),
+				Config: testAccContainerCluster_withMasterAuthNoCert(clusterName, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_master_auth_no_cert", "master_auth.0.client_certificate", ""),
 				),
@@ -394,6 +473,7 @@ func TestAccContainerCluster_withMasterAuthConfig_NoCert(t *testing.T) {
 				ResourceName:      "google_container_cluster.with_master_auth_no_cert",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -403,13 +483,15 @@ func TestAccContainerCluster_withAuthenticatorGroupsConfig(t *testing.T) {
 	t.Parallel()
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	orgDomain := envvar.GetTestOrgDomainFromEnv(t)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_basic(clusterName),
+				Config: testAccContainerCluster_basic(clusterName, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckNoResourceAttr("google_container_cluster.primary",
 						"authenticator_groups_config.0.enabled"),
@@ -419,9 +501,10 @@ func TestAccContainerCluster_withAuthenticatorGroupsConfig(t *testing.T) {
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withAuthenticatorGroupsConfigUpdate(clusterName, orgDomain),
+				Config: testAccContainerCluster_withAuthenticatorGroupsConfigUpdate(clusterName, orgDomain, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.primary",
 						"authenticator_groups_config.0.security_group", fmt.Sprintf("gke-security-groups@%s", orgDomain)),
@@ -431,9 +514,10 @@ func TestAccContainerCluster_withAuthenticatorGroupsConfig(t *testing.T) {
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withAuthenticatorGroupsConfigUpdate2(clusterName),
+				Config: testAccContainerCluster_withAuthenticatorGroupsConfigUpdate2(clusterName, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckNoResourceAttr("google_container_cluster.primary",
 						"authenticator_groups_config.0.enabled"),
@@ -443,6 +527,7 @@ func TestAccContainerCluster_withAuthenticatorGroupsConfig(t *testing.T) {
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -502,6 +587,7 @@ resource "google_container_cluster" "cluster" {
   }
   enable_multi_networking = true
   datapath_provider = "ADVANCED_DATAPATH"
+  deletion_protection = false
 }
 `, clusterName, clusterName)
 }
@@ -565,6 +651,7 @@ resource "google_container_cluster" "cluster" {
 
   enable_fqdn_network_policy = %t
   datapath_provider          = "ADVANCED_DATAPATH"
+  deletion_protection = false
 }
 `, clusterName, clusterName, enabled)
 }
@@ -574,6 +661,8 @@ func TestAccContainerCluster_withNetworkPolicyEnabled(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -581,7 +670,7 @@ func TestAccContainerCluster_withNetworkPolicyEnabled(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withNetworkPolicyEnabled(clusterName),
+				Config: testAccContainerCluster_withNetworkPolicyEnabled(clusterName, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_network_policy_enabled",
 						"network_policy.#", "1"),
@@ -591,10 +680,10 @@ func TestAccContainerCluster_withNetworkPolicyEnabled(t *testing.T) {
 				ResourceName:            "google_container_cluster.with_network_policy_enabled",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"remove_default_node_pool"},
+				ImportStateVerifyIgnore: []string{"remove_default_node_pool", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_removeNetworkPolicy(clusterName),
+				Config: testAccContainerCluster_removeNetworkPolicy(clusterName, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_network_policy_enabled",
 						"network_policy.0.enabled", "false"),
@@ -604,10 +693,10 @@ func TestAccContainerCluster_withNetworkPolicyEnabled(t *testing.T) {
 				ResourceName:            "google_container_cluster.with_network_policy_enabled",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"remove_default_node_pool"},
+				ImportStateVerifyIgnore: []string{"remove_default_node_pool", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withNetworkPolicyDisabled(clusterName),
+				Config: testAccContainerCluster_withNetworkPolicyDisabled(clusterName, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_network_policy_enabled",
 						"network_policy.0.enabled", "false"),
@@ -617,10 +706,10 @@ func TestAccContainerCluster_withNetworkPolicyEnabled(t *testing.T) {
 				ResourceName:            "google_container_cluster.with_network_policy_enabled",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"remove_default_node_pool"},
+				ImportStateVerifyIgnore: []string{"remove_default_node_pool", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withNetworkPolicyConfigDisabled(clusterName),
+				Config: testAccContainerCluster_withNetworkPolicyConfigDisabled(clusterName, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_network_policy_enabled",
 						"addons_config.0.network_policy_config.0.disabled", "true"),
@@ -630,10 +719,10 @@ func TestAccContainerCluster_withNetworkPolicyEnabled(t *testing.T) {
 				ResourceName:            "google_container_cluster.with_network_policy_enabled",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"remove_default_node_pool"},
+				ImportStateVerifyIgnore: []string{"remove_default_node_pool", "deletion_protection"},
 			},
 			{
-				Config:				testAccContainerCluster_withNetworkPolicyConfigDisabled(clusterName),
+				Config:				testAccContainerCluster_withNetworkPolicyConfigDisabled(clusterName, networkName, subnetworkName),
 				PlanOnly:			true,
 				ExpectNonEmptyPlan: false,
 			},
@@ -645,30 +734,33 @@ func TestAccContainerCluster_withNetworkPolicyEnabled(t *testing.T) {
 func TestAccContainerCluster_withReleaseChannelEnabled(t *testing.T) {
 	t.Parallel()
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withReleaseChannelEnabled(clusterName, "STABLE"),
+				Config: testAccContainerCluster_withReleaseChannelEnabled(clusterName, "STABLE", networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_release_channel",
 				ImportStateIdPrefix:     "us-central1-a/",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withReleaseChannelEnabled(clusterName, "UNSPECIFIED"),
+				Config: testAccContainerCluster_withReleaseChannelEnabled(clusterName, "UNSPECIFIED", networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_release_channel",
 				ImportStateIdPrefix:     "us-central1-a/",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -677,40 +769,43 @@ func TestAccContainerCluster_withReleaseChannelEnabled(t *testing.T) {
 func TestAccContainerCluster_withReleaseChannelEnabledDefaultVersion(t *testing.T) {
 	t.Parallel()
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withReleaseChannelEnabledDefaultVersion(clusterName, "REGULAR"),
+				Config: testAccContainerCluster_withReleaseChannelEnabledDefaultVersion(clusterName, "REGULAR", networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_release_channel",
 				ImportStateIdPrefix:     "us-central1-a/",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withReleaseChannelEnabled(clusterName, "REGULAR"),
+				Config: testAccContainerCluster_withReleaseChannelEnabled(clusterName, "REGULAR", networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_release_channel",
 				ImportStateIdPrefix:     "us-central1-a/",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withReleaseChannelEnabled(clusterName, "UNSPECIFIED"),
+				Config: testAccContainerCluster_withReleaseChannelEnabled(clusterName, "UNSPECIFIED", networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_release_channel",
 				ImportStateIdPrefix:     "us-central1-a/",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -721,13 +816,16 @@ func TestAccContainerCluster_withInvalidReleaseChannel(t *testing.T) {
 	acctest.SkipIfVcr(t)
 	t.Parallel()
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withReleaseChannelEnabled(clusterName, "CANARY"),
+				Config: testAccContainerCluster_withReleaseChannelEnabled(clusterName, "CANARY", networkName, subnetworkName),
 				ExpectError: regexp.MustCompile(`expected release_channel\.0\.channel to be one of \[UNSPECIFIED RAPID REGULAR STABLE\], got CANARY`),
 			},
 		},
@@ -738,40 +836,43 @@ func TestAccContainerCluster_withInvalidReleaseChannel(t *testing.T) {
 func TestAccContainerCluster_withTelemetryEnabled(t *testing.T) {
 	t.Parallel()
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withTelemetryEnabled(clusterName, "ENABLED"),
+				Config: testAccContainerCluster_withTelemetryEnabled(clusterName, "ENABLED", networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_cluster_telemetry",
 				ImportStateIdPrefix:     "us-central1-a/",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withTelemetryEnabled(clusterName, "DISABLED"),
+				Config: testAccContainerCluster_withTelemetryEnabled(clusterName, "DISABLED", networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_cluster_telemetry",
 				ImportStateIdPrefix:     "us-central1-a/",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withTelemetryEnabled(clusterName, "SYSTEM_ONLY"),
+				Config: testAccContainerCluster_withTelemetryEnabled(clusterName, "SYSTEM_ONLY", networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_cluster_telemetry",
 				ImportStateIdPrefix:     "us-central1-a/",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -805,17 +906,19 @@ func TestAccContainerCluster_withMasterAuthorizedNetworksConfig(t *testing.T) {
 				),
 			},
 			{
-				ResourceName:		 "google_container_cluster.with_master_authorized_networks",
-				ImportState:		 true,
-				ImportStateVerify:	 true,
+				ResourceName:		     "google_container_cluster.with_master_authorized_networks",
+				ImportState:		     true,
+				ImportStateVerify:	     true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
 				Config: testAccContainerCluster_withMasterAuthorizedNetworksConfig(clusterName, []string{"10.0.0.0/8", "8.8.8.8/32"}, ""),
 			},
 			{
-				ResourceName:		 "google_container_cluster.with_master_authorized_networks",
-				ImportState:		 true,
-				ImportStateVerify:	 true,
+				ResourceName:		     "google_container_cluster.with_master_authorized_networks",
+				ImportState:		     true,
+				ImportStateVerify:	     true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
 				Config: testAccContainerCluster_withMasterAuthorizedNetworksConfig(clusterName, []string{}, ""),
@@ -825,17 +928,19 @@ func TestAccContainerCluster_withMasterAuthorizedNetworksConfig(t *testing.T) {
 				),
 			},
 			{
-				ResourceName:		 "google_container_cluster.with_master_authorized_networks",
-				ImportState:		 true,
-				ImportStateVerify:	 true,
+				ResourceName:		     "google_container_cluster.with_master_authorized_networks",
+				ImportState:		     true,
+				ImportStateVerify:	     true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
 				Config: testAccContainerCluster_removeMasterAuthorizedNetworksConfig(clusterName),
 			},
 			{
-				ResourceName:        "google_container_cluster.with_master_authorized_networks",
-				ImportState:         true,
-				ImportStateVerify:   true,
+				ResourceName:		     "google_container_cluster.with_master_authorized_networks",
+				ImportState:		     true,
+				ImportStateVerify:	     true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -845,6 +950,8 @@ func TestAccContainerCluster_withGcpPublicCidrsAccessEnabledToggle(t *testing.T)
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -852,7 +959,7 @@ func TestAccContainerCluster_withGcpPublicCidrsAccessEnabledToggle(t *testing.T)
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withoutGcpPublicCidrsAccessEnabled(clusterName),
+				Config: testAccContainerCluster_withoutGcpPublicCidrsAccessEnabled(clusterName, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_gcp_public_cidrs_access_enabled",
 						"master_authorized_networks_config.#", "0"),
@@ -862,10 +969,10 @@ func TestAccContainerCluster_withGcpPublicCidrsAccessEnabledToggle(t *testing.T)
 				ResourceName:				"google_container_cluster.with_gcp_public_cidrs_access_enabled",
 				ImportState:				true,
 				ImportStateVerify:			true,
-				ImportStateVerifyIgnore:	[]string{"min_master_version"},
+				ImportStateVerifyIgnore:	[]string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withGcpPublicCidrsAccessEnabled(clusterName, "false"),
+				Config: testAccContainerCluster_withGcpPublicCidrsAccessEnabled(clusterName, "false", networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_gcp_public_cidrs_access_enabled",
 						"master_authorized_networks_config.0.gcp_public_cidrs_access_enabled", "false"),
@@ -875,10 +982,10 @@ func TestAccContainerCluster_withGcpPublicCidrsAccessEnabledToggle(t *testing.T)
 				ResourceName:				"google_container_cluster.with_gcp_public_cidrs_access_enabled",
 				ImportState:				true,
 				ImportStateVerify:			true,
-				ImportStateVerifyIgnore:	[]string{"min_master_version"},
+				ImportStateVerifyIgnore:	[]string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withGcpPublicCidrsAccessEnabled(clusterName, "true"),
+				Config: testAccContainerCluster_withGcpPublicCidrsAccessEnabled(clusterName, "true", networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_gcp_public_cidrs_access_enabled",
 						"master_authorized_networks_config.0.gcp_public_cidrs_access_enabled", "true"),
@@ -888,7 +995,7 @@ func TestAccContainerCluster_withGcpPublicCidrsAccessEnabledToggle(t *testing.T)
 	})
 }
 
-func testAccContainerCluster_withGcpPublicCidrsAccessEnabled(clusterName string, flag string) string {
+func testAccContainerCluster_withGcpPublicCidrsAccessEnabled(clusterName string, flag, networkName, subnetworkName string) string {
 
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "uscentral1a" {
@@ -904,11 +1011,14 @@ resource "google_container_cluster" "with_gcp_public_cidrs_access_enabled" {
   master_authorized_networks_config {
     gcp_public_cidrs_access_enabled = %s
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, flag)
+`, clusterName, flag, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withoutGcpPublicCidrsAccessEnabled(clusterName string) string {
+func testAccContainerCluster_withoutGcpPublicCidrsAccessEnabled(clusterName, networkName, subnetworkName string) string {
 
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "uscentral1a" {
@@ -920,14 +1030,19 @@ resource "google_container_cluster" "with_gcp_public_cidrs_access_enabled" {
   location           = "us-central1-a"
   min_master_version = data.google_container_engine_versions.uscentral1a.release_channel_latest_version["STABLE"]
   initial_node_count = 1
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName)
+`, clusterName, networkName, subnetworkName)
 }
 
 func TestAccContainerCluster_regional(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-regional-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -935,12 +1050,13 @@ func TestAccContainerCluster_regional(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_regional(clusterName),
+				Config: testAccContainerCluster_regional(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:		 "google_container_cluster.regional",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -951,6 +1067,8 @@ func TestAccContainerCluster_regionalWithNodePool(t *testing.T) {
 
 	clusterName := fmt.Sprintf("tf-test-cluster-regional-%s", acctest.RandString(t, 10))
 	npName := fmt.Sprintf("tf-test-cluster-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -958,12 +1076,13 @@ func TestAccContainerCluster_regionalWithNodePool(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_regionalWithNodePool(clusterName, npName),
+				Config: testAccContainerCluster_regionalWithNodePool(clusterName, npName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:		 "google_container_cluster.regional",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -973,6 +1092,8 @@ func TestAccContainerCluster_regionalWithNodeLocations(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -980,20 +1101,22 @@ func TestAccContainerCluster_regionalWithNodeLocations(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_regionalNodeLocations(clusterName),
+				Config: testAccContainerCluster_regionalNodeLocations(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:		 "google_container_cluster.with_node_locations",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_regionalUpdateNodeLocations(clusterName),
+				Config: testAccContainerCluster_regionalUpdateNodeLocations(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:		 "google_container_cluster.with_node_locations",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -1021,6 +1144,7 @@ func TestAccContainerCluster_withTpu(t *testing.T) {
 				ResourceName:		 "google_container_cluster.with_tpu",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -1045,6 +1169,7 @@ func TestAccContainerCluster_withPrivateClusterConfigBasic(t *testing.T) {
 				ResourceName:		 "google_container_cluster.with_private_cluster",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
 				Config: testAccContainerCluster_withPrivateClusterConfig(containerNetName, clusterName, true),
@@ -1053,6 +1178,7 @@ func TestAccContainerCluster_withPrivateClusterConfigBasic(t *testing.T) {
 				ResourceName:		 "google_container_cluster.with_private_cluster",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -1095,6 +1221,7 @@ func TestAccContainerCluster_withPrivateClusterConfigMissingCidrBlock_withAutopi
 				ResourceName:      "google_container_cluster.with_private_cluster",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -1104,6 +1231,8 @@ func TestAccContainerCluster_withPrivateClusterConfigGlobalAccessEnabledOnly(t *
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -1111,20 +1240,22 @@ func TestAccContainerCluster_withPrivateClusterConfigGlobalAccessEnabledOnly(t *
 		CheckDestroy:             testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withPrivateClusterConfigGlobalAccessEnabledOnly(clusterName, true),
+				Config: testAccContainerCluster_withPrivateClusterConfigGlobalAccessEnabledOnly(clusterName, networkName, subnetworkName, true),
 			},
 			{
 				ResourceName:      "google_container_cluster.with_private_cluster",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withPrivateClusterConfigGlobalAccessEnabledOnly(clusterName, false),
+				Config: testAccContainerCluster_withPrivateClusterConfigGlobalAccessEnabledOnly(clusterName, networkName, subnetworkName, false),
 			},
 			{
 				ResourceName:      "google_container_cluster.with_private_cluster",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -1134,6 +1265,8 @@ func TestAccContainerCluster_withIntraNodeVisibility(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
@@ -1141,7 +1274,7 @@ func TestAccContainerCluster_withIntraNodeVisibility(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withIntraNodeVisibility(clusterName),
+				Config: testAccContainerCluster_withIntraNodeVisibility(clusterName, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_intranode_visibility", "enable_intranode_visibility", "true"),
 				),
@@ -1150,9 +1283,10 @@ func TestAccContainerCluster_withIntraNodeVisibility(t *testing.T) {
 				ResourceName:        "google_container_cluster.with_intranode_visibility",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_updateIntraNodeVisibility(clusterName),
+				Config: testAccContainerCluster_updateIntraNodeVisibility(clusterName, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_intranode_visibility", "enable_intranode_visibility", "false"),
 				),
@@ -1161,6 +1295,7 @@ func TestAccContainerCluster_withIntraNodeVisibility(t *testing.T) {
 				ResourceName:        "google_container_cluster.with_intranode_visibility",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -1170,6 +1305,8 @@ func TestAccContainerCluster_withVersion(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -1177,13 +1314,13 @@ func TestAccContainerCluster_withVersion(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withVersion(clusterName),
+				Config: testAccContainerCluster_withVersion(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:			 "google_container_cluster.with_version",
 				ImportState:			 true,
 				ImportStateVerify:		 true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -1193,6 +1330,8 @@ func TestAccContainerCluster_updateVersion(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -1200,22 +1339,22 @@ func TestAccContainerCluster_updateVersion(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withLowerVersion(clusterName),
+				Config: testAccContainerCluster_withLowerVersion(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:			 "google_container_cluster.with_version",
 				ImportState:			 true,
 				ImportStateVerify:		 true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_updateVersion(clusterName),
+				Config: testAccContainerCluster_updateVersion(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:			 "google_container_cluster.with_version",
 				ImportState:			 true,
 				ImportStateVerify:		 true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -1225,6 +1364,8 @@ func TestAccContainerCluster_withNodeConfig(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -1232,20 +1373,22 @@ func TestAccContainerCluster_withNodeConfig(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withNodeConfig(clusterName),
+				Config: testAccContainerCluster_withNodeConfig(clusterName, networkName, subnetworkName),
 			},
 			{
-				ResourceName:		 "google_container_cluster.with_node_config",
-				ImportState:		 true,
-				ImportStateVerify:	 true,
+				ResourceName:		         "google_container_cluster.with_node_config",
+				ImportState:		         true,
+				ImportStateVerify:	     true,
+				ImportStateVerifyIgnore: []string{"node_config.0.taint", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withNodeConfigUpdate(clusterName),
+				Config: testAccContainerCluster_withNodeConfigUpdate(clusterName, networkName, subnetworkName),
 			},
 			{
-				ResourceName:		 "google_container_cluster.with_node_config",
-				ImportState:		 true,
-				ImportStateVerify:	 true,
+				ResourceName:		         "google_container_cluster.with_node_config",
+				ImportState:		         true,
+				ImportStateVerify:	     true,
+				ImportStateVerifyIgnore: []string{"node_config.0.taint", "deletion_protection"},
 			},
 		},
 	})
@@ -1254,18 +1397,22 @@ func TestAccContainerCluster_withNodeConfig(t *testing.T) {
 func TestAccContainerCluster_withLoggingVariantInNodeConfig(t *testing.T) {
 	t.Parallel()
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withLoggingVariantInNodeConfig(clusterName, "MAX_THROUGHPUT"),
+				Config: testAccContainerCluster_withLoggingVariantInNodeConfig(clusterName, "MAX_THROUGHPUT", networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_logging_variant_in_node_config",
 				ImportState:             true,
 				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -1275,18 +1422,22 @@ func TestAccContainerCluster_withLoggingVariantInNodePool(t *testing.T) {
 	t.Parallel()
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	nodePoolName := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withLoggingVariantInNodePool(clusterName, nodePoolName, "MAX_THROUGHPUT"),
+				Config: testAccContainerCluster_withLoggingVariantInNodePool(clusterName, nodePoolName, "MAX_THROUGHPUT", networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_logging_variant_in_node_pool",
 				ImportState:             true,
 				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -1295,34 +1446,40 @@ func TestAccContainerCluster_withLoggingVariantInNodePool(t *testing.T) {
 func TestAccContainerCluster_withLoggingVariantUpdates(t *testing.T) {
 	t.Parallel()
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withLoggingVariantNodePoolDefault(clusterName, "DEFAULT"),
+				Config: testAccContainerCluster_withLoggingVariantNodePoolDefault(clusterName, "DEFAULT", networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_logging_variant_node_pool_default",
 				ImportState:             true,
 				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withLoggingVariantNodePoolDefault(clusterName, "MAX_THROUGHPUT"),
+				Config: testAccContainerCluster_withLoggingVariantNodePoolDefault(clusterName, "MAX_THROUGHPUT", networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_logging_variant_node_pool_default",
 				ImportState:             true,
 				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withLoggingVariantNodePoolDefault(clusterName, "DEFAULT"),
+				Config: testAccContainerCluster_withLoggingVariantNodePoolDefault(clusterName, "DEFAULT", networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_logging_variant_node_pool_default",
 				ImportState:             true,
 				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -1330,56 +1487,61 @@ func TestAccContainerCluster_withLoggingVariantUpdates(t *testing.T) {
 
 <% unless version == 'ga' -%>
 func TestAccContainerCluster_withNodePoolDefaults(t *testing.T) {
-        t.Parallel()
-        clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
-        acctest.VcrTest(t, resource.TestCase{
-                PreCheck:         func() { acctest.AccTestPreCheck(t) },
-                ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
-                CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
-                Steps: []resource.TestStep{
-                        {
-				Config: testAccContainerCluster_basic(clusterName),
-                                Check: resource.ComposeTestCheckFunc(
+	t.Parallel()
+	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:         func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccContainerCluster_basic(clusterName, networkName, subnetworkName),
+				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckNoResourceAttr("google_container_cluster.primary",
 						"node_pool_defaults.0.node_config_defaults.0.gcfs_config.0.enabled"),
 				),
 			},
-                        {
+			{
 				ResourceName:      "google_container_cluster.primary",
 				ImportStateId:     fmt.Sprintf("us-central1-a/%s", clusterName),
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
-                        {
-                                Config: testAccContainerCluster_withNodePoolDefaults(clusterName, "true"),
-                                Check: resource.ComposeAggregateTestCheckFunc(
-                                  resource.TestCheckResourceAttr("google_container_cluster.with_node_pool_defaults",
-                                          "node_pool_defaults.0.node_config_defaults.0.gcfs_config.#", "1"),
-                                  resource.TestCheckResourceAttr("google_container_cluster.with_node_pool_defaults",
-                                          "node_pool_defaults.0.node_config_defaults.0.gcfs_config.0.enabled", "true"),
+			{
+				Config: testAccContainerCluster_withNodePoolDefaults(clusterName, "true", networkName, subnetworkName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr("google_container_cluster.with_node_pool_defaults",
+						"node_pool_defaults.0.node_config_defaults.0.gcfs_config.#", "1"),
+					resource.TestCheckResourceAttr("google_container_cluster.with_node_pool_defaults",
+						"node_pool_defaults.0.node_config_defaults.0.gcfs_config.0.enabled", "true"),
 				),
-                        },
-                        {
-                                ResourceName:            "google_container_cluster.with_node_pool_defaults",
-                                ImportState:             true,
-                                ImportStateVerify:       true,
-                        },
-                        {
-                                Config: testAccContainerCluster_withNodePoolDefaults(clusterName, "false"),
-                                Check: resource.ComposeAggregateTestCheckFunc(
-                                  resource.TestCheckResourceAttr("google_container_cluster.with_node_pool_defaults",
-                                          "node_pool_defaults.0.node_config_defaults.0.gcfs_config.#", "1"),
-                                  resource.TestCheckResourceAttr("google_container_cluster.with_node_pool_defaults",
-                                          "node_pool_defaults.0.node_config_defaults.0.gcfs_config.0.enabled", "false"),
-                                ),
-                        },
-                        {
-                                ResourceName:            "google_container_cluster.with_node_pool_defaults",
-                                ImportState:             true,
-                                ImportStateVerify:       true,
-                        },
-                },
-        })
+			},
+			{
+					ResourceName:            "google_container_cluster.with_node_pool_defaults",
+					ImportState:             true,
+					ImportStateVerify:       true,
+					ImportStateVerifyIgnore: []string{"deletion_protection"},
+			},
+			{
+					Config: testAccContainerCluster_withNodePoolDefaults(clusterName, "false", networkName, subnetworkName),
+					Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr("google_container_cluster.with_node_pool_defaults",
+							"node_pool_defaults.0.node_config_defaults.0.gcfs_config.#", "1"),
+					resource.TestCheckResourceAttr("google_container_cluster.with_node_pool_defaults",
+							"node_pool_defaults.0.node_config_defaults.0.gcfs_config.0.enabled", "false"),
+					),
+			},
+			{
+					ResourceName:            "google_container_cluster.with_node_pool_defaults",
+					ImportState:             true,
+					ImportStateVerify:       true,
+					ImportStateVerifyIgnore: []string{"deletion_protection"},
+			},
+},
+	})
 }
 <% end -%>
 
@@ -1387,6 +1549,8 @@ func TestAccContainerCluster_withNodeConfigScopeAlias(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -1394,12 +1558,13 @@ func TestAccContainerCluster_withNodeConfigScopeAlias(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withNodeConfigScopeAlias(clusterName),
+				Config: testAccContainerCluster_withNodeConfigScopeAlias(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:		 "google_container_cluster.with_node_config_scope_alias",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -1409,6 +1574,8 @@ func TestAccContainerCluster_withNodeConfigShieldedInstanceConfig(t *testing.T)
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -1416,12 +1583,13 @@ func TestAccContainerCluster_withNodeConfigShieldedInstanceConfig(t *testing.T)
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withNodeConfigShieldedInstanceConfig(clusterName),
+				Config: testAccContainerCluster_withNodeConfigShieldedInstanceConfig(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:        "google_container_cluster.with_node_config",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -1431,6 +1599,8 @@ func TestAccContainerCluster_withNodeConfigReservationAffinity(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -1438,7 +1608,7 @@ func TestAccContainerCluster_withNodeConfigReservationAffinity(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withNodeConfigReservationAffinity(clusterName),
+				Config: testAccContainerCluster_withNodeConfigReservationAffinity(clusterName, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_node_config",
 						"node_config.0.reservation_affinity.#", "1"),
@@ -1450,6 +1620,7 @@ func TestAccContainerCluster_withNodeConfigReservationAffinity(t *testing.T) {
 				ResourceName:        "google_container_cluster.with_node_config",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -1460,6 +1631,8 @@ func TestAccContainerCluster_withNodeConfigReservationAffinitySpecific(t *testin
 
     reservationName := fmt.Sprintf("tf-test-reservation-%s", acctest.RandString(t, 10))
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -1467,7 +1640,7 @@ func TestAccContainerCluster_withNodeConfigReservationAffinitySpecific(t *testin
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withNodeConfigReservationAffinitySpecific(reservationName, clusterName),
+				Config: testAccContainerCluster_withNodeConfigReservationAffinitySpecific(reservationName, clusterName, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_node_config",
 						"node_config.0.reservation_affinity.#", "1"),
@@ -1485,6 +1658,7 @@ func TestAccContainerCluster_withNodeConfigReservationAffinitySpecific(t *testin
 				ResourceName:        "google_container_cluster.with_node_config",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -1494,6 +1668,8 @@ func TestAccContainerCluster_withWorkloadMetadataConfig(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -1501,7 +1677,7 @@ func TestAccContainerCluster_withWorkloadMetadataConfig(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withWorkloadMetadataConfig(clusterName),
+				Config: testAccContainerCluster_withWorkloadMetadataConfig(clusterName, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_workload_metadata_config",
 						"node_config.0.workload_metadata_config.0.mode", "GCE_METADATA"),
@@ -1511,7 +1687,7 @@ func TestAccContainerCluster_withWorkloadMetadataConfig(t *testing.T) {
 				ResourceName:			 "google_container_cluster.with_workload_metadata_config",
 				ImportState:			 true,
 				ImportStateVerify:		 true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -1522,6 +1698,8 @@ func TestAccContainerCluster_withSandboxConfig(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -1529,7 +1707,7 @@ func TestAccContainerCluster_withSandboxConfig(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withSandboxConfig(clusterName),
+				Config: testAccContainerCluster_withSandboxConfig(clusterName, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_sandbox_config",
 						"node_config.0.sandbox_config.0.sandbox_type", "gvisor"),
@@ -1541,12 +1719,12 @@ func TestAccContainerCluster_withSandboxConfig(t *testing.T) {
 				ResourceName:            "google_container_cluster.with_sandbox_config",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "node_config.0.taint", "deletion_protection"},
 			},
 			{
 				// GKE sets automatic labels and taints on nodes. This makes
 				// sure we ignore the automatic ones and keep our own.
-				Config:   testAccContainerCluster_withSandboxConfig(clusterName),
+				Config:   testAccContainerCluster_withSandboxConfig(clusterName, networkName, subnetworkName),
 				// When we use PlanOnly without ExpectNonEmptyPlan, we're
 				// guaranteeing that the computed fields of the resources don't
 				// force an unintentional change to the plan. That is, we
@@ -1559,7 +1737,7 @@ func TestAccContainerCluster_withSandboxConfig(t *testing.T) {
 				// the plan. We make sure we don't over-suppress and end up
 				// eliminating the labels or taints we asked for. This will
 				// destroy and recreate the cluster as labels are immutable.
-				Config: testAccContainerCluster_withSandboxConfig_changeLabels(clusterName),
+				Config: testAccContainerCluster_withSandboxConfig_changeLabels(clusterName, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_sandbox_config",
 						"node_config.0.labels.test.terraform.io/gke-sandbox", "true"),
@@ -1579,6 +1757,8 @@ func TestAccContainerCluster_withBootDiskKmsKey(t *testing.T) {
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	kms := acctest.BootstrapKMSKeyInLocation(t, "us-central1")
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	if acctest.BootstrapPSARole(t, "service-", "compute-system", "roles/cloudkms.cryptoKeyEncrypterDecrypter") {
 		t.Fatal("Stopping the test because a role was added to the policy.")
@@ -1590,13 +1770,13 @@ func TestAccContainerCluster_withBootDiskKmsKey(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withBootDiskKmsKey(clusterName, kms.CryptoKey.Name),
+				Config: testAccContainerCluster_withBootDiskKmsKey(clusterName, kms.CryptoKey.Name, networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_boot_disk_kms_key",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -1617,14 +1797,16 @@ func TestAccContainerCluster_network(t *testing.T) {
 				Config: testAccContainerCluster_networkRef(clusterName, network),
 			},
 			{
-				ResourceName:		 "google_container_cluster.with_net_ref_by_url",
-				ImportState:		 true,
-				ImportStateVerify:	 true,
+				ResourceName:		     "google_container_cluster.with_net_ref_by_url",
+				ImportState:		     true,
+				ImportStateVerify:	     true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				ResourceName:		 "google_container_cluster.with_net_ref_by_name",
-				ImportState:		 true,
-				ImportStateVerify:	 true,
+				ResourceName:		     "google_container_cluster.with_net_ref_by_name",
+				ImportState:		     true,
+				ImportStateVerify:	     true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -1634,6 +1816,8 @@ func TestAccContainerCluster_backend(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -1641,12 +1825,13 @@ func TestAccContainerCluster_backend(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_backendRef(clusterName),
+				Config: testAccContainerCluster_backendRef(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:		 "google_container_cluster.primary",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -1657,6 +1842,8 @@ func TestAccContainerCluster_withNodePoolBasic(t *testing.T) {
 
 	clusterName := fmt.Sprintf("tf-test-cluster-nodepool-%s", acctest.RandString(t, 10))
 	npName := fmt.Sprintf("tf-test-cluster-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -1664,12 +1851,13 @@ func TestAccContainerCluster_withNodePoolBasic(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withNodePoolBasic(clusterName, npName),
+				Config: testAccContainerCluster_withNodePoolBasic(clusterName, npName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:		 "google_container_cluster.with_node_pool",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -1680,6 +1868,8 @@ func TestAccContainerCluster_withNodePoolUpdateVersion(t *testing.T) {
 
 	clusterName := fmt.Sprintf("tf-test-cluster-nodepool-%s", acctest.RandString(t, 10))
 	npName := fmt.Sprintf("tf-test-cluster-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -1687,22 +1877,22 @@ func TestAccContainerCluster_withNodePoolUpdateVersion(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withNodePoolLowerVersion(clusterName, npName),
+				Config: testAccContainerCluster_withNodePoolLowerVersion(clusterName, npName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:			 "google_container_cluster.with_node_pool",
 				ImportState:			 true,
 				ImportStateVerify:		 true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withNodePoolUpdateVersion(clusterName, npName),
+				Config: testAccContainerCluster_withNodePoolUpdateVersion(clusterName, npName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:			 "google_container_cluster.with_node_pool",
 				ImportState:			 true,
 				ImportStateVerify:		 true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -1713,13 +1903,16 @@ func TestAccContainerCluster_withNodePoolResize(t *testing.T) {
 
 	clusterName := fmt.Sprintf("tf-test-cluster-nodepool-%s", acctest.RandString(t, 10))
 	npName := fmt.Sprintf("tf-test-cluster-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withNodePoolNodeLocations(clusterName, npName),
+				Config: testAccContainerCluster_withNodePoolNodeLocations(clusterName, npName, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_node_pool", "node_pool.0.node_count", "2"),
 				),
@@ -1728,9 +1921,10 @@ func TestAccContainerCluster_withNodePoolResize(t *testing.T) {
 				ResourceName:		 "google_container_cluster.with_node_pool",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withNodePoolResize(clusterName, npName),
+				Config: testAccContainerCluster_withNodePoolResize(clusterName, npName, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_node_pool", "node_pool.0.node_count", "3"),
 				),
@@ -1739,6 +1933,7 @@ func TestAccContainerCluster_withNodePoolResize(t *testing.T) {
 				ResourceName:		 "google_container_cluster.with_node_pool",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -1749,6 +1944,8 @@ func TestAccContainerCluster_withNodePoolAutoscaling(t *testing.T) {
 
 	clusterName := fmt.Sprintf("tf-test-cluster-nodepool-%s", acctest.RandString(t, 10))
 	npName := fmt.Sprintf("tf-test-cluster-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -1756,7 +1953,7 @@ func TestAccContainerCluster_withNodePoolAutoscaling(t *testing.T) {
 		CheckDestroy: testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			resource.TestStep{
-				Config: testAccContainerCluster_withNodePoolAutoscaling(clusterName, npName),
+				Config: testAccContainerCluster_withNodePoolAutoscaling(clusterName, npName, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_node_pool", "node_pool.0.autoscaling.0.min_node_count", "1"),
 					resource.TestCheckResourceAttr("google_container_cluster.with_node_pool", "node_pool.0.autoscaling.0.max_node_count", "3"),
@@ -1766,9 +1963,10 @@ func TestAccContainerCluster_withNodePoolAutoscaling(t *testing.T) {
 				ResourceName:		 "google_container_cluster.with_node_pool",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			resource.TestStep{
-				Config: testAccContainerCluster_withNodePoolUpdateAutoscaling(clusterName, npName),
+				Config: testAccContainerCluster_withNodePoolUpdateAutoscaling(clusterName, npName, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_node_pool", "node_pool.0.autoscaling.0.min_node_count", "1"),
 					resource.TestCheckResourceAttr("google_container_cluster.with_node_pool", "node_pool.0.autoscaling.0.max_node_count", "5"),
@@ -1778,9 +1976,10 @@ func TestAccContainerCluster_withNodePoolAutoscaling(t *testing.T) {
 				ResourceName:		 "google_container_cluster.with_node_pool",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			resource.TestStep{
-				Config: testAccContainerCluster_withNodePoolBasic(clusterName, npName),
+				Config: testAccContainerCluster_withNodePoolBasic(clusterName, npName, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckNoResourceAttr("google_container_cluster.with_node_pool", "node_pool.0.autoscaling.0.min_node_count"),
 					resource.TestCheckNoResourceAttr("google_container_cluster.with_node_pool", "node_pool.0.autoscaling.0.max_node_count"),
@@ -1790,6 +1989,7 @@ func TestAccContainerCluster_withNodePoolAutoscaling(t *testing.T) {
 				ResourceName:		 "google_container_cluster.with_node_pool",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -1800,6 +2000,8 @@ func TestAccContainerCluster_withNodePoolCIA(t *testing.T) {
 
 	clusterName := fmt.Sprintf("tf-test-cluster-nodepool-%s", acctest.RandString(t, 10))
 	npName := fmt.Sprintf("tf-test-cluster-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -1807,7 +2009,7 @@ func TestAccContainerCluster_withNodePoolCIA(t *testing.T) {
 		CheckDestroy: testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			resource.TestStep{
-				Config: testAccContainerRegionalCluster_withNodePoolCIA(clusterName, npName),
+				Config: testAccContainerRegionalCluster_withNodePoolCIA(clusterName, npName, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_node_pool", "node_pool.0.autoscaling.0.min_node_count", "0"),
 					resource.TestCheckResourceAttr("google_container_cluster.with_node_pool", "node_pool.0.autoscaling.0.max_node_count", "0"),
@@ -1820,10 +2022,10 @@ func TestAccContainerCluster_withNodePoolCIA(t *testing.T) {
 				ResourceName:		 "google_container_cluster.with_node_pool",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			resource.TestStep{
-				Config: testAccContainerRegionalClusterUpdate_withNodePoolCIA(clusterName, npName),
+				Config: testAccContainerRegionalClusterUpdate_withNodePoolCIA(clusterName, npName, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_node_pool", "node_pool.0.autoscaling.0.min_node_count", "0"),
 					resource.TestCheckResourceAttr("google_container_cluster.with_node_pool", "node_pool.0.autoscaling.0.max_node_count", "0"),
@@ -1836,10 +2038,10 @@ func TestAccContainerCluster_withNodePoolCIA(t *testing.T) {
 				ResourceName:		 "google_container_cluster.with_node_pool",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			resource.TestStep{
-				Config: testAccContainerRegionalCluster_withNodePoolBasic(clusterName, npName),
+				Config: testAccContainerRegionalCluster_withNodePoolBasic(clusterName, npName, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckNoResourceAttr("google_container_cluster.with_node_pool", "node_pool.0.autoscaling.0.min_node_count"),
 					resource.TestCheckNoResourceAttr("google_container_cluster.with_node_pool", "node_pool.0.autoscaling.0.max_node_count"),
@@ -1851,7 +2053,7 @@ func TestAccContainerCluster_withNodePoolCIA(t *testing.T) {
 				ResourceName:		 "google_container_cluster.with_node_pool",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -1877,7 +2079,7 @@ func TestAccContainerCluster_withNodePoolNamePrefix(t *testing.T) {
 				ResourceName:			 "google_container_cluster.with_node_pool_name_prefix",
 				ImportState:			 true,
 				ImportStateVerify:		 true,
-				ImportStateVerifyIgnore: []string{"node_pool.0.name_prefix"},
+				ImportStateVerifyIgnore: []string{"node_pool.0.name_prefix", "deletion_protection"},
 			},
 		},
 	})
@@ -1887,6 +2089,8 @@ func TestAccContainerCluster_withNodePoolMultiple(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 	npNamePrefix := "tf-test-np-"
 
 	acctest.VcrTest(t, resource.TestCase{
@@ -1895,12 +2099,13 @@ func TestAccContainerCluster_withNodePoolMultiple(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withNodePoolMultiple(clusterName, npNamePrefix),
+				Config: testAccContainerCluster_withNodePoolMultiple(clusterName, npNamePrefix, networkName, subnetworkName),
 			},
 			{
 				ResourceName:		 "google_container_cluster.with_node_pool_multiple",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -1930,6 +2135,8 @@ func TestAccContainerCluster_withNodePoolNodeConfig(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-np-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -1937,12 +2144,13 @@ func TestAccContainerCluster_withNodePoolNodeConfig(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withNodePoolNodeConfig(cluster, np),
+				Config: testAccContainerCluster_withNodePoolNodeConfig(cluster, np, networkName, subnetworkName),
 			},
 			{
 				ResourceName:		 "google_container_cluster.with_node_pool_node_config",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -1953,6 +2161,8 @@ func TestAccContainerCluster_withMaintenanceWindow(t *testing.T) {
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	resourceName := "google_container_cluster.with_maintenance_window"
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -1960,15 +2170,16 @@ func TestAccContainerCluster_withMaintenanceWindow(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withMaintenanceWindow(clusterName, "03:00"),
+				Config: testAccContainerCluster_withMaintenanceWindow(clusterName, "03:00", networkName, subnetworkName),
 			},
 			{
 				ResourceName:		 resourceName,
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withMaintenanceWindow(clusterName, ""),
+				Config: testAccContainerCluster_withMaintenanceWindow(clusterName, "", networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckNoResourceAttr(resourceName,
 						"maintenance_policy.0.daily_maintenance_window.0.start_time"),
@@ -1980,7 +2191,7 @@ func TestAccContainerCluster_withMaintenanceWindow(t *testing.T) {
 				ImportStateVerify:	 true,
 				// maintenance_policy.# = 0 is equivalent to no maintenance policy at all,
 				// but will still cause an import diff
-				ImportStateVerifyIgnore: []string{"maintenance_policy.#"},
+				ImportStateVerifyIgnore: []string{"maintenance_policy.#", "deletion_protection"},
 			},
 		},
 	})
@@ -1990,6 +2201,8 @@ func TestAccContainerCluster_withRecurringMaintenanceWindow(t *testing.T) {
 	t.Parallel()
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	resourceName := "google_container_cluster.with_recurring_maintenance_window"
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -1997,7 +2210,7 @@ func TestAccContainerCluster_withRecurringMaintenanceWindow(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withRecurringMaintenanceWindow(cluster, "2019-01-01T00:00:00Z", "2019-01-02T00:00:00Z"),
+				Config: testAccContainerCluster_withRecurringMaintenanceWindow(cluster, "2019-01-01T00:00:00Z", "2019-01-02T00:00:00Z", networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckNoResourceAttr(resourceName,
 						"maintenance_policy.0.daily_maintenance_window.0.start_time"),
@@ -2008,9 +2221,11 @@ func TestAccContainerCluster_withRecurringMaintenanceWindow(t *testing.T) {
 				ImportStateIdPrefix: "us-central1-a/",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
+
 			},
 			{
-				Config: testAccContainerCluster_withRecurringMaintenanceWindow(cluster, "", ""),
+				Config: testAccContainerCluster_withRecurringMaintenanceWindow(cluster, "", "", networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckNoResourceAttr(resourceName,
 						"maintenance_policy.0.daily_maintenance_window.0.start_time"),
@@ -2025,7 +2240,7 @@ func TestAccContainerCluster_withRecurringMaintenanceWindow(t *testing.T) {
 				ImportStateVerify:	 true,
 				// maintenance_policy.# = 0 is equivalent to no maintenance policy at all,
 				// but will still cause an import diff
-				ImportStateVerifyIgnore: []string{"maintenance_policy.#"},
+				ImportStateVerifyIgnore: []string{"maintenance_policy.#", "deletion_protection"},
 			},
 		},
 	})
@@ -2035,6 +2250,8 @@ func TestAccContainerCluster_withMaintenanceExclusionWindow(t *testing.T) {
 	t.Parallel()
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	resourceName := "google_container_cluster.with_maintenance_exclusion_window"
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
@@ -2042,22 +2259,24 @@ func TestAccContainerCluster_withMaintenanceExclusionWindow(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withExclusion_RecurringMaintenanceWindow(cluster, "2019-01-01T00:00:00Z", "2019-01-02T00:00:00Z", "2019-05-01T00:00:00Z", "2019-05-02T00:00:00Z"),
+				Config: testAccContainerCluster_withExclusion_RecurringMaintenanceWindow(cluster, "2019-01-01T00:00:00Z", "2019-01-02T00:00:00Z", "2019-05-01T00:00:00Z", "2019-05-02T00:00:00Z", networkName, subnetworkName),
 			},
 			{
 				ResourceName:        resourceName,
 				ImportStateIdPrefix: "us-central1-a/",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withExclusion_DailyMaintenanceWindow(cluster, "2020-01-01T00:00:00Z", "2020-01-02T00:00:00Z"),
+				Config: testAccContainerCluster_withExclusion_DailyMaintenanceWindow(cluster, "2020-01-01T00:00:00Z", "2020-01-02T00:00:00Z", networkName, subnetworkName),
 			},
 			{
 				ResourceName:        resourceName,
 				ImportStateIdPrefix: "us-central1-a/",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -2067,6 +2286,8 @@ func TestAccContainerCluster_withMaintenanceExclusionOptions(t *testing.T) {
 	t.Parallel()
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	resourceName := "google_container_cluster.with_maintenance_exclusion_options"
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
@@ -2075,7 +2296,7 @@ func TestAccContainerCluster_withMaintenanceExclusionOptions(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccContainerCluster_withExclusionOptions_RecurringMaintenanceWindow(
-					cluster, "2019-01-01T00:00:00Z", "2019-01-02T00:00:00Z", "2019-05-01T00:00:00Z", "2019-05-02T00:00:00Z", "NO_MINOR_UPGRADES", "NO_MINOR_OR_NODE_UPGRADES"),
+					cluster, "2019-01-01T00:00:00Z", "2019-01-02T00:00:00Z", "2019-05-01T00:00:00Z", "2019-05-02T00:00:00Z", "NO_MINOR_UPGRADES", "NO_MINOR_OR_NODE_UPGRADES", networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 						resource.TestCheckResourceAttr(resourceName,
 							"maintenance_policy.0.maintenance_exclusion.0.exclusion_options.0.scope", "NO_MINOR_UPGRADES"),
@@ -2088,6 +2309,7 @@ func TestAccContainerCluster_withMaintenanceExclusionOptions(t *testing.T) {
 				ImportStateIdPrefix: "us-central1-a/",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -2097,6 +2319,8 @@ func TestAccContainerCluster_deleteMaintenanceExclusionOptions(t *testing.T) {
 	t.Parallel()
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	resourceName := "google_container_cluster.with_maintenance_exclusion_options"
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
@@ -2105,7 +2329,7 @@ func TestAccContainerCluster_deleteMaintenanceExclusionOptions(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccContainerCluster_withExclusionOptions_RecurringMaintenanceWindow(
-					cluster, "2019-01-01T00:00:00Z", "2019-01-02T00:00:00Z", "2019-05-01T00:00:00Z", "2019-05-02T00:00:00Z", "NO_UPGRADES", "NO_MINOR_OR_NODE_UPGRADES"),
+					cluster, "2019-01-01T00:00:00Z", "2019-01-02T00:00:00Z", "2019-05-01T00:00:00Z", "2019-05-02T00:00:00Z", "NO_UPGRADES", "NO_MINOR_OR_NODE_UPGRADES", networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 						resource.TestCheckResourceAttr(resourceName,
 							"maintenance_policy.0.maintenance_exclusion.0.exclusion_options.0.scope", "NO_UPGRADES"),
@@ -2118,10 +2342,11 @@ func TestAccContainerCluster_deleteMaintenanceExclusionOptions(t *testing.T) {
 				ImportStateIdPrefix: "us-central1-a/",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
 				Config: testAccContainerCluster_NoExclusionOptions_RecurringMaintenanceWindow(
-					cluster, "2019-01-01T00:00:00Z", "2019-01-02T00:00:00Z", "2019-05-01T00:00:00Z", "2019-05-02T00:00:00Z"),
+					cluster, "2019-01-01T00:00:00Z", "2019-01-02T00:00:00Z", "2019-05-01T00:00:00Z", "2019-05-02T00:00:00Z", networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 						resource.TestCheckNoResourceAttr(resourceName,
 							"maintenance_policy.0.maintenance_exclusion.0.exclusion_options.0.scope"),
@@ -2134,6 +2359,7 @@ func TestAccContainerCluster_deleteMaintenanceExclusionOptions(t *testing.T) {
 				ImportStateIdPrefix: "us-central1-a/",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -2143,6 +2369,8 @@ func TestAccContainerCluster_updateMaintenanceExclusionOptions(t *testing.T) {
 	t.Parallel()
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	resourceName := "google_container_cluster.with_maintenance_exclusion_options"
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	// step1: create a new cluster and initialize the maintenceExclusion without exclusion scopes,
 	// step2: add exclusion scopes to the maintenancePolicy,
@@ -2154,7 +2382,7 @@ func TestAccContainerCluster_updateMaintenanceExclusionOptions(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccContainerCluster_NoExclusionOptions_RecurringMaintenanceWindow(
-					cluster, "2019-01-01T00:00:00Z", "2019-01-02T00:00:00Z", "2019-05-01T00:00:00Z", "2019-05-02T00:00:00Z"),
+					cluster, "2019-01-01T00:00:00Z", "2019-01-02T00:00:00Z", "2019-05-01T00:00:00Z", "2019-05-02T00:00:00Z", networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 						resource.TestCheckNoResourceAttr(resourceName,
 							"maintenance_policy.0.maintenance_exclusion.0.exclusion_options.0.scope"),
@@ -2167,10 +2395,11 @@ func TestAccContainerCluster_updateMaintenanceExclusionOptions(t *testing.T) {
 				ImportStateIdPrefix: "us-central1-a/",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
 				Config: testAccContainerCluster_withExclusionOptions_RecurringMaintenanceWindow(
-					cluster, "2019-01-01T00:00:00Z", "2019-01-02T00:00:00Z", "2019-05-01T00:00:00Z", "2019-05-02T00:00:00Z", "NO_MINOR_UPGRADES", "NO_MINOR_OR_NODE_UPGRADES"),
+					cluster, "2019-01-01T00:00:00Z", "2019-01-02T00:00:00Z", "2019-05-01T00:00:00Z", "2019-05-02T00:00:00Z", "NO_MINOR_UPGRADES", "NO_MINOR_OR_NODE_UPGRADES", networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 						resource.TestCheckResourceAttr(resourceName,
 							"maintenance_policy.0.maintenance_exclusion.0.exclusion_options.0.scope", "NO_MINOR_UPGRADES"),
@@ -2183,10 +2412,11 @@ func TestAccContainerCluster_updateMaintenanceExclusionOptions(t *testing.T) {
 				ImportStateIdPrefix: "us-central1-a/",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
 				Config: testAccContainerCluster_updateExclusionOptions_RecurringMaintenanceWindow(
-					cluster, "2019-01-01T00:00:00Z", "2019-01-02T00:00:00Z", "2019-05-01T00:00:00Z", "2019-05-02T00:00:00Z", "NO_UPGRADES", "NO_MINOR_UPGRADES"),
+					cluster, "2019-01-01T00:00:00Z", "2019-01-02T00:00:00Z", "2019-05-01T00:00:00Z", "2019-05-02T00:00:00Z", "NO_UPGRADES", "NO_MINOR_UPGRADES", networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 						resource.TestCheckResourceAttr(resourceName,
 							"maintenance_policy.0.maintenance_exclusion.0.exclusion_options.0.scope", "NO_UPGRADES"),
@@ -2199,6 +2429,7 @@ func TestAccContainerCluster_updateMaintenanceExclusionOptions(t *testing.T) {
 				ImportStateIdPrefix: "us-central1-a/",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -2209,6 +2440,8 @@ func TestAccContainerCluster_deleteExclusionWindow(t *testing.T) {
 	t.Parallel()
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	resourceName := "google_container_cluster.with_maintenance_exclusion_window"
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
@@ -2216,31 +2449,34 @@ func TestAccContainerCluster_deleteExclusionWindow(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withExclusion_DailyMaintenanceWindow(cluster, "2020-01-01T00:00:00Z", "2020-01-02T00:00:00Z"),
+				Config: testAccContainerCluster_withExclusion_DailyMaintenanceWindow(cluster, "2020-01-01T00:00:00Z", "2020-01-02T00:00:00Z", networkName, subnetworkName),
 			},
 			{
 				ResourceName:        resourceName,
 				ImportStateIdPrefix: "us-central1-a/",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withExclusion_RecurringMaintenanceWindow(cluster, "2019-01-01T00:00:00Z", "2019-01-02T00:00:00Z", "2019-05-01T00:00:00Z", "2019-05-02T00:00:00Z"),
+				Config: testAccContainerCluster_withExclusion_RecurringMaintenanceWindow(cluster, "2019-01-01T00:00:00Z", "2019-01-02T00:00:00Z", "2019-05-01T00:00:00Z", "2019-05-02T00:00:00Z", networkName, subnetworkName),
 			},
 			{
 				ResourceName:        resourceName,
 				ImportStateIdPrefix: "us-central1-a/",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withExclusion_NoMaintenanceWindow(cluster, "2020-01-01T00:00:00Z", "2020-01-02T00:00:00Z"),
+				Config: testAccContainerCluster_withExclusion_NoMaintenanceWindow(cluster, "2020-01-01T00:00:00Z", "2020-01-02T00:00:00Z", networkName, subnetworkName),
 			},
 			{
 				ResourceName:        resourceName,
 				ImportStateIdPrefix: "us-central1-a/",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -2263,6 +2499,7 @@ func TestAccContainerCluster_withIPAllocationPolicy_existingSecondaryRanges(t *t
 				ResourceName:		 "google_container_cluster.with_ip_allocation_policy",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -2285,6 +2522,7 @@ func TestAccContainerCluster_withIPAllocationPolicy_specificIPRanges(t *testing.
 				ResourceName:		 "google_container_cluster.with_ip_allocation_policy",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -2307,6 +2545,7 @@ func TestAccContainerCluster_withIPAllocationPolicy_specificSizes(t *testing.T)
 				ResourceName:		 "google_container_cluster.with_ip_allocation_policy",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -2334,7 +2573,7 @@ func TestAccContainerCluster_stackType_withDualStack(t *testing.T) {
 				ResourceName:		 resourceName,
 				ImportState:		 true,
 				ImportStateVerify:	 true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -2362,7 +2601,7 @@ func TestAccContainerCluster_stackType_withSingleStack(t *testing.T) {
 				ResourceName:		 resourceName,
 				ImportState:		 true,
 				ImportStateVerify:	 true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -2390,7 +2629,7 @@ func TestAccContainerCluster_with_PodCIDROverprovisionDisabled(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -2400,6 +2639,8 @@ func TestAccContainerCluster_nodeAutoprovisioning(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -2407,7 +2648,7 @@ func TestAccContainerCluster_nodeAutoprovisioning(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_autoprovisioning(clusterName, true, false),
+				Config: testAccContainerCluster_autoprovisioning(clusterName, networkName, subnetworkName, true, false),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_autoprovisioning",
 						"cluster_autoscaling.0.enabled", "true"),
@@ -2417,10 +2658,10 @@ func TestAccContainerCluster_nodeAutoprovisioning(t *testing.T) {
 				ResourceName:		 "google_container_cluster.with_autoprovisioning",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_autoprovisioning(clusterName, false, false),
+				Config: testAccContainerCluster_autoprovisioning(clusterName, networkName, subnetworkName, false, false),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_autoprovisioning",
 						"cluster_autoscaling.0.enabled", "false"),
@@ -2430,7 +2671,7 @@ func TestAccContainerCluster_nodeAutoprovisioning(t *testing.T) {
 				ResourceName:		 "google_container_cluster.with_autoprovisioning",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -2440,6 +2681,8 @@ func TestAccContainerCluster_nodeAutoprovisioningDefaults(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 	includeMinCpuPlatform := true
 
 	acctest.VcrTest(t, resource.TestCase{
@@ -2448,7 +2691,7 @@ func TestAccContainerCluster_nodeAutoprovisioningDefaults(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_autoprovisioningDefaults(clusterName, false),
+				Config: testAccContainerCluster_autoprovisioningDefaults(clusterName, networkName, subnetworkName, false),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_autoprovisioning",
 						"cluster_autoscaling.0.enabled", "true"),
@@ -2458,30 +2701,30 @@ func TestAccContainerCluster_nodeAutoprovisioningDefaults(t *testing.T) {
 				ResourceName:		 "google_container_cluster.with_autoprovisioning",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_autoprovisioningDefaults(clusterName, true),
+				Config: testAccContainerCluster_autoprovisioningDefaults(clusterName, networkName, subnetworkName, true),
 				PlanOnly:           true,
 				ExpectNonEmptyPlan: false,
 			},
 			{
-				Config: testAccContainerCluster_autoprovisioningDefaultsMinCpuPlatform(clusterName, includeMinCpuPlatform),
+				Config: testAccContainerCluster_autoprovisioningDefaultsMinCpuPlatform(clusterName, networkName, subnetworkName, includeMinCpuPlatform),
 			},
 			{
 				ResourceName:		 "google_container_cluster.with_autoprovisioning",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_autoprovisioningDefaultsMinCpuPlatform(clusterName, !includeMinCpuPlatform),
+				Config: testAccContainerCluster_autoprovisioningDefaultsMinCpuPlatform(clusterName, networkName, subnetworkName, !includeMinCpuPlatform),
 			},
 			{
 				ResourceName:		 "google_container_cluster.with_autoprovisioning",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -2491,6 +2734,8 @@ func TestAccContainerCluster_autoprovisioningDefaultsUpgradeSettings(t *testing.
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
@@ -2498,34 +2743,37 @@ func TestAccContainerCluster_autoprovisioningDefaultsUpgradeSettings(t *testing.
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_autoprovisioningDefaultsUpgradeSettings(clusterName, 2, 1, "SURGE"),
+				Config: testAccContainerCluster_autoprovisioningDefaultsUpgradeSettings(clusterName, networkName, subnetworkName, 2, 1, "SURGE"),
 			},
 			{
 				ResourceName:      "google_container_cluster.with_autoprovisioning_upgrade_settings",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config:      testAccContainerCluster_autoprovisioningDefaultsUpgradeSettings(clusterName, 2, 1, "BLUE_GREEN"),
+				Config:      testAccContainerCluster_autoprovisioningDefaultsUpgradeSettings(clusterName, networkName, subnetworkName, 2, 1, "BLUE_GREEN"),
 				ExpectError: regexp.MustCompile(`Surge upgrade settings max_surge/max_unavailable can only be used when strategy is set to SURGE`),
 			},
 			{
-				Config:      testAccContainerCluster_autoprovisioningDefaultsUpgradeSettingsWithBlueGreenStrategy(clusterName, "3.500s", "BLUE_GREEN"),
+				Config:      testAccContainerCluster_autoprovisioningDefaultsUpgradeSettingsWithBlueGreenStrategy(clusterName, networkName, subnetworkName, "3.500s", "BLUE_GREEN"),
 			},
 			{
 				ResourceName:      "google_container_cluster.with_autoprovisioning_upgrade_settings",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
 }
 
-<% unless version == 'ga' -%>
 func TestAccContainerCluster_nodeAutoprovisioningNetworkTags(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
@@ -2533,7 +2781,7 @@ func TestAccContainerCluster_nodeAutoprovisioningNetworkTags(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_autoprovisioning(clusterName, true, true),
+				Config: testAccContainerCluster_autoprovisioning(clusterName, networkName, subnetworkName, true, true),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.with_autoprovisioning",
 						"node_pool_auto_config.0.network_tags.0.tags.0", "test-network-tag"),
@@ -2543,12 +2791,11 @@ func TestAccContainerCluster_nodeAutoprovisioningNetworkTags(t *testing.T) {
 				ResourceName:            "google_container_cluster.with_autoprovisioning",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
 }
-<% end -%>
 
 func TestAccContainerCluster_withShieldedNodes(t *testing.T) {
 	t.Parallel()
@@ -2567,6 +2814,7 @@ func TestAccContainerCluster_withShieldedNodes(t *testing.T) {
 				ResourceName:		 "google_container_cluster.with_shielded_nodes",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
 				Config: testAccContainerCluster_withShieldedNodes(clusterName, false),
@@ -2575,6 +2823,7 @@ func TestAccContainerCluster_withShieldedNodes(t *testing.T) {
 				ResourceName:		 "google_container_cluster.with_shielded_nodes",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -2594,12 +2843,15 @@ func TestAccContainerCluster_withAutopilot(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccContainerCluster_withAutopilot(pid, containerNetName, clusterName, "us-central1", true, false, ""),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_container_cluster.with_autopilot", "networking_mode", "VPC_NATIVE"),
+				),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_autopilot",
 				ImportState:             true,
 				ImportStateVerify:	     true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -2634,7 +2886,7 @@ func TestAccContainerClusterCustomServiceAccount_withAutopilot(t *testing.T) {
 				ResourceName:            "google_container_cluster.with_autopilot",
 				ImportState:             true,
 				ImportStateVerify:	     true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -2660,7 +2912,6 @@ func TestAccContainerCluster_errorAutopilotLocation(t *testing.T) {
 	})
 }
 
-<% unless version == 'ga' -%>
 func TestAccContainerCluster_withAutopilotNetworkTags(t *testing.T) {
 	t.Parallel()
 
@@ -2680,17 +2931,18 @@ func TestAccContainerCluster_withAutopilotNetworkTags(t *testing.T) {
 				ResourceName:            "google_container_cluster.with_autopilot",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
 }
-<% end -%>
 
 func TestAccContainerCluster_withWorkloadIdentityConfig(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 	pid := envvar.GetTestProjectFromEnv()
 
 	acctest.VcrTest(t, resource.TestCase{
@@ -2699,131 +2951,142 @@ func TestAccContainerCluster_withWorkloadIdentityConfig(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withWorkloadIdentityConfigEnabled(pid, clusterName),
+				Config: testAccContainerCluster_withWorkloadIdentityConfigEnabled(pid, clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:        "google_container_cluster.with_workload_identity_config",
 				ImportState:         true,
 				ImportStateVerify:   true,
-				ImportStateVerifyIgnore: []string{"remove_default_node_pool"},
+				ImportStateVerifyIgnore: []string{"remove_default_node_pool", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_updateWorkloadIdentityConfig(pid, clusterName, false),
+				Config: testAccContainerCluster_updateWorkloadIdentityConfig(pid, clusterName, networkName, subnetworkName, false),
 			},
 			{
 				ResourceName:        "google_container_cluster.with_workload_identity_config",
 				ImportState:         true,
 				ImportStateVerify:   true,
-				ImportStateVerifyIgnore: []string{"remove_default_node_pool"},
+				ImportStateVerifyIgnore: []string{"remove_default_node_pool", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_updateWorkloadIdentityConfig(pid, clusterName, true),
+				Config: testAccContainerCluster_updateWorkloadIdentityConfig(pid, clusterName, networkName, subnetworkName, true),
 			},
 			{
 				ResourceName:        "google_container_cluster.with_workload_identity_config",
 				ImportState:         true,
 				ImportStateVerify:   true,
-				ImportStateVerifyIgnore: []string{"remove_default_node_pool"},
+				ImportStateVerifyIgnore: []string{"remove_default_node_pool", "deletion_protection"},
 			},
 		},
 	})
 }
 
-<% unless version == 'ga' -%>
 func TestAccContainerCluster_withIdentityServiceConfig(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_basic(clusterName),
+				Config: testAccContainerCluster_basic(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:        "google_container_cluster.primary",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withIdentityServiceConfigEnabled(clusterName),
+				Config: testAccContainerCluster_withIdentityServiceConfigEnabled(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:        "google_container_cluster.primary",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withIdentityServiceConfigUpdated(clusterName),
+				Config: testAccContainerCluster_withIdentityServiceConfigUpdated(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:        "google_container_cluster.primary",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_basic(clusterName),
+				Config: testAccContainerCluster_basic(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:        "google_container_cluster.primary",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
 }
-<% end -%>
 
 func TestAccContainerCluster_withLoggingConfig(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_basic(clusterName),
+				Config: testAccContainerCluster_basic(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:        "google_container_cluster.primary",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withLoggingConfigEnabled(clusterName),
+				Config: testAccContainerCluster_withLoggingConfigEnabled(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:        "google_container_cluster.primary",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withLoggingConfigDisabled(clusterName),
+				Config: testAccContainerCluster_withLoggingConfigDisabled(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:        "google_container_cluster.primary",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withLoggingConfigUpdated(clusterName),
+				Config: testAccContainerCluster_withLoggingConfigUpdated(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:        "google_container_cluster.primary",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_basic(clusterName),
+				Config: testAccContainerCluster_basic(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:        "google_container_cluster.primary",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -2845,7 +3108,7 @@ func TestAccContainerCluster_withMonitoringConfigAdvancedDatapathObservabilityCo
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
 				Config: testAccContainerCluster_withMonitoringConfigAdvancedDatapathObservabilityConfigDisabled(clusterName),
@@ -2854,7 +3117,7 @@ func TestAccContainerCluster_withMonitoringConfigAdvancedDatapathObservabilityCo
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -2864,92 +3127,94 @@ func TestAccContainerCluster_withMonitoringConfig(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_basic(clusterName),
+				Config: testAccContainerCluster_basic(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withMonitoringConfigEnabled(clusterName),
+				Config: testAccContainerCluster_withMonitoringConfigEnabled(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withMonitoringConfigDisabled(clusterName),
+				Config: testAccContainerCluster_withMonitoringConfigDisabled(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withMonitoringConfigUpdated(clusterName),
+				Config: testAccContainerCluster_withMonitoringConfigUpdated(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withMonitoringConfigPrometheusUpdated(clusterName),
+				Config: testAccContainerCluster_withMonitoringConfigPrometheusUpdated(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			// Back to basic settings to test setting Prometheus on its own
 			{
-				Config: testAccContainerCluster_basic(clusterName),
+				Config: testAccContainerCluster_basic(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withMonitoringConfigPrometheusOnly(clusterName),
+				Config: testAccContainerCluster_withMonitoringConfigPrometheusOnly(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withMonitoringConfigPrometheusOnly2(clusterName),
+				Config: testAccContainerCluster_withMonitoringConfigPrometheusOnly2(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_basic(clusterName),
+				Config: testAccContainerCluster_basic(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -2959,18 +3224,21 @@ func TestAccContainerCluster_withSoleTenantGroup(t *testing.T) {
 	t.Parallel()
 
 	resourceName := fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withSoleTenantGroup(resourceName),
+				Config: testAccContainerCluster_withSoleTenantGroup(resourceName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:        "google_container_cluster.primary",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -2983,28 +3251,33 @@ func TestAccContainerCluster_withSoleTenantGroup(t *testing.T) {
 func TestAccContainerCluster_withAutoscalingProfile(t *testing.T) {
 	t.Parallel()
 	clusterName := fmt.Sprintf("cluster-test-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withAutoscalingProfile(clusterName, "BALANCED"),
+				Config: testAccContainerCluster_withAutoscalingProfile(clusterName, "BALANCED", networkName, subnetworkName),
 			},
 			{
 				ResourceName:        "google_container_cluster.autoscaling_with_profile",
 				ImportStateIdPrefix: "us-central1-a/",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withAutoscalingProfile(clusterName, "OPTIMIZE_UTILIZATION"),
+				Config: testAccContainerCluster_withAutoscalingProfile(clusterName, "OPTIMIZE_UTILIZATION", networkName, subnetworkName),
 			},
 			{
 				ResourceName:        "google_container_cluster.autoscaling_with_profile",
 				ImportStateIdPrefix: "us-central1-a/",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -3015,13 +3288,16 @@ func TestAccContainerCluster_withInvalidAutoscalingProfile(t *testing.T) {
 	acctest.SkipIfVcr(t)
 	t.Parallel()
 	clusterName := fmt.Sprintf("cluster-test-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withAutoscalingProfile(clusterName, "AS_CHEAP_AS_POSSIBLE"),
+				Config: testAccContainerCluster_withAutoscalingProfile(clusterName, "AS_CHEAP_AS_POSSIBLE", networkName, subnetworkName),
 				ExpectError: regexp.MustCompile(`expected cluster_autoscaling\.0\.autoscaling_profile to be one of \[BALANCED OPTIMIZE_UTILIZATION\], got AS_CHEAP_AS_POSSIBLE`),
 			},
 		},
@@ -3052,6 +3328,7 @@ func TestAccContainerCluster_sharedVpc(t *testing.T) {
 				ImportStateId: fmt.Sprintf("%s-service/us-central1-a/%s", projectName, clusterName),
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -3061,6 +3338,8 @@ func TestAccContainerCluster_withBinaryAuthorizationEnabledBool(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -3068,53 +3347,22 @@ func TestAccContainerCluster_withBinaryAuthorizationEnabledBool(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withBinaryAuthorizationEnabledBool(clusterName, true),
+				Config: testAccContainerCluster_withBinaryAuthorizationEnabledBool(clusterName, networkName, subnetworkName, true),
 			},
 			{
 				ResourceName:		 "google_container_cluster.with_binary_authorization_enabled_bool",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
-                                ImportStateVerifyIgnore: []string{"enable_binary_authorization"},
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withBinaryAuthorizationEnabledBool(clusterName, false),
+				Config: testAccContainerCluster_withBinaryAuthorizationEnabledBool(clusterName, networkName, subnetworkName, false),
 			},
 			{
 				ResourceName:		 "google_container_cluster.with_binary_authorization_enabled_bool",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
-			},
-		},
-	})
-}
-
-func TestAccContainerCluster_withBinaryAuthorizationEnabledBoolLegacy(t *testing.T) {
-	t.Parallel()
-
-	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
-
-	acctest.VcrTest(t, resource.TestCase{
-		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
-		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
-		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
-		Steps: []resource.TestStep{
-			{
-				Config: testAccContainerCluster_withBinaryAuthorizationEnabledBoolLegacy(clusterName, true),
-			},
-			{
-				ResourceName:		 "google_container_cluster.with_binary_authorization_enabled_bool_legacy",
-				ImportState:		 true,
-				ImportStateVerify:	 true,
-                                ImportStateVerifyIgnore: []string{"enable_binary_authorization", "binary_authorization.#", "binary_authorization.0.%", "binary_authorization.0.enabled", "binary_authorization.0.evaluation_mode"},
-			},
-			{
-				Config: testAccContainerCluster_withBinaryAuthorizationEnabledBoolLegacy(clusterName, false),
-			},
-			{
-				ResourceName:		 "google_container_cluster.with_binary_authorization_enabled_bool_legacy",
-				ImportState:		 true,
-				ImportStateVerify:	 true,
-                                ImportStateVerifyIgnore: []string{"enable_binary_authorization"},
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -3137,6 +3385,7 @@ func TestAccContainerCluster_withBinaryAuthorizationEvaluationModeAutopilot(t *t
 				ResourceName:		 "google_container_cluster.with_binary_authorization_evaluation_mode",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
 				Config: testAccContainerCluster_withBinaryAuthorizationEvaluationMode(clusterName, true, "DISABLED"),
@@ -3145,6 +3394,7 @@ func TestAccContainerCluster_withBinaryAuthorizationEvaluationModeAutopilot(t *t
 				ResourceName:		 "google_container_cluster.with_binary_authorization_evaluation_mode",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -3167,6 +3417,7 @@ func TestAccContainerCluster_withBinaryAuthorizationEvaluationModeClassic(t *tes
 				ResourceName:		 "google_container_cluster.with_binary_authorization_evaluation_mode",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
 				Config: testAccContainerCluster_withBinaryAuthorizationEvaluationMode(clusterName, false, "DISABLED"),
@@ -3175,6 +3426,7 @@ func TestAccContainerCluster_withBinaryAuthorizationEvaluationModeClassic(t *tes
 				ResourceName:		 "google_container_cluster.with_binary_authorization_evaluation_mode",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -3198,6 +3450,7 @@ func TestAccContainerCluster_withFlexiblePodCIDR(t *testing.T) {
 				ResourceName:		 "google_container_cluster.with_flexible_cidr",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -3208,6 +3461,8 @@ func TestAccContainerCluster_nodeAutoprovisioningDefaultsDiskSizeGb(t *testing.T
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 	includeDiskSizeGb := true
 
 	acctest.VcrTest(t, resource.TestCase{
@@ -3216,22 +3471,22 @@ func TestAccContainerCluster_nodeAutoprovisioningDefaultsDiskSizeGb(t *testing.T
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_autoprovisioningDefaultsDiskSizeGb(clusterName, includeDiskSizeGb),
+				Config: testAccContainerCluster_autoprovisioningDefaultsDiskSizeGb(clusterName, networkName, subnetworkName, includeDiskSizeGb),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_autoprovisioning",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_autoprovisioningDefaultsDiskSizeGb(clusterName, !includeDiskSizeGb),
+				Config: testAccContainerCluster_autoprovisioningDefaultsDiskSizeGb(clusterName, networkName, subnetworkName, !includeDiskSizeGb),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_autoprovisioning",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -3241,6 +3496,8 @@ func TestAccContainerCluster_nodeAutoprovisioningDefaultsDiskType(t *testing.T)
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 	includeDiskType := true
 
 	acctest.VcrTest(t, resource.TestCase{
@@ -3249,22 +3506,22 @@ func TestAccContainerCluster_nodeAutoprovisioningDefaultsDiskType(t *testing.T)
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_autoprovisioningDefaultsDiskType(clusterName, includeDiskType),
+				Config: testAccContainerCluster_autoprovisioningDefaultsDiskType(clusterName, networkName, subnetworkName, includeDiskType),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_autoprovisioning",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_autoprovisioningDefaultsDiskType(clusterName, !includeDiskType),
+				Config: testAccContainerCluster_autoprovisioningDefaultsDiskType(clusterName, networkName, subnetworkName, !includeDiskType),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_autoprovisioning",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -3274,6 +3531,8 @@ func TestAccContainerCluster_nodeAutoprovisioningDefaultsImageType(t *testing.T)
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 	includeImageType := true
 
 	acctest.VcrTest(t, resource.TestCase{
@@ -3282,22 +3541,22 @@ func TestAccContainerCluster_nodeAutoprovisioningDefaultsImageType(t *testing.T)
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_autoprovisioningDefaultsImageType(clusterName, includeImageType),
+				Config: testAccContainerCluster_autoprovisioningDefaultsImageType(clusterName, networkName, subnetworkName, includeImageType),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_autoprovisioning",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_autoprovisioningDefaultsImageType(clusterName, !includeImageType),
+				Config: testAccContainerCluster_autoprovisioningDefaultsImageType(clusterName, networkName, subnetworkName, !includeImageType),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_autoprovisioning",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -3308,6 +3567,8 @@ func TestAccContainerCluster_nodeAutoprovisioningDefaultsBootDiskKmsKey(t *testi
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	kms := acctest.BootstrapKMSKeyInLocation(t, "us-central1")
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	if acctest.BootstrapPSARole(t, "service-", "compute-system", "roles/cloudkms.cryptoKeyEncrypterDecrypter") {
 		t.Fatal("Stopping the test because a role was added to the policy.")
@@ -3319,7 +3580,7 @@ func TestAccContainerCluster_nodeAutoprovisioningDefaultsBootDiskKmsKey(t *testi
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_autoprovisioningDefaultsBootDiskKmsKey(clusterName, kms.CryptoKey.Name),
+				Config: testAccContainerCluster_autoprovisioningDefaultsBootDiskKmsKey(clusterName, kms.CryptoKey.Name, networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.nap_boot_disk_kms_key",
@@ -3327,6 +3588,7 @@ func TestAccContainerCluster_nodeAutoprovisioningDefaultsBootDiskKmsKey(t *testi
 				ImportStateVerify:       true,
 				ImportStateVerifyIgnore: []string{
 					"min_master_version",
+					"deletion_protection",
 					"node_pool", // cluster_autoscaling (node auto-provisioning) creates new node pools automatically
 				},
 			},
@@ -3338,6 +3600,8 @@ func TestAccContainerCluster_nodeAutoprovisioningDefaultsShieldedInstance(t *tes
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -3345,13 +3609,13 @@ func TestAccContainerCluster_nodeAutoprovisioningDefaultsShieldedInstance(t *tes
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_autoprovisioningDefaultsShieldedInstance(clusterName),
+				Config: testAccContainerCluster_autoprovisioningDefaultsShieldedInstance(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.nap_shielded_instance",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -3361,6 +3625,8 @@ func TestAccContainerCluster_autoprovisioningDefaultsManagement(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
@@ -3368,27 +3634,30 @@ func TestAccContainerCluster_autoprovisioningDefaultsManagement(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_autoprovisioningDefaultsManagement(clusterName, false, false),
+				Config: testAccContainerCluster_autoprovisioningDefaultsManagement(clusterName, networkName, subnetworkName, false, false),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_autoprovisioning_management",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_autoprovisioningDefaultsManagement(clusterName, true, true),
+				Config: testAccContainerCluster_autoprovisioningDefaultsManagement(clusterName, networkName, subnetworkName, true, true),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_autoprovisioning_management",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
 }
 
+// This resource originally cleaned up the dangling cluster directly, but now
+// taints it, having Terraform clean it up during the next apply. This test
+// name is now inexact, but is being preserved to maintain the test history.
 func TestAccContainerCluster_errorCleanDanglingCluster(t *testing.T) {
 	t.Parallel()
 
@@ -3409,18 +3678,19 @@ func TestAccContainerCluster_errorCleanDanglingCluster(t *testing.T) {
 				Config: initConfig,
 			},
 			{
-				ResourceName:		 "google_container_cluster.cidr_error_preempt",
-				ImportState:		 true,
+				ResourceName:		     "google_container_cluster.cidr_error_preempt",
+				ImportState:		     true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config:		 overlapConfig,
+				Config:		   overlapConfig,
 				ExpectError: regexp.MustCompile("Error waiting for creating GKE cluster"),
 			},
-			// If dangling cluster wasn't deleted, this plan will return an error
+			// If tainted cluster won't be deleted, this step will return an error
 			{
-				Config:				overlapConfig,
-				PlanOnly:			true,
+				Config:				      overlapConfig,
+				PlanOnly:			      true,
 				ExpectNonEmptyPlan: true,
 			},
 		},
@@ -3437,7 +3707,7 @@ func TestAccContainerCluster_errorNoClusterCreated(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:		 testAccContainerCluster_withInvalidLocation("wonderland"),
-				ExpectError: regexp.MustCompile(`Permission denied on 'locations/wonderland' \(or it may not exist\).`),
+				ExpectError: regexp.MustCompile(`Location "wonderland" does not exist.`),
 			},
 		},
 	})
@@ -3447,6 +3717,8 @@ func TestAccContainerCluster_withExternalIpsConfig(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 	pid := envvar.GetTestProjectFromEnv()
 
 	acctest.VcrTest(t, resource.TestCase{
@@ -3455,20 +3727,22 @@ func TestAccContainerCluster_withExternalIpsConfig(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withExternalIpsConfig(pid, clusterName, true),
+				Config: testAccContainerCluster_withExternalIpsConfig(pid, clusterName, networkName, subnetworkName, true),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_external_ips_config",
 				ImportState:             true,
 				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withExternalIpsConfig(pid, clusterName, false),
+				Config: testAccContainerCluster_withExternalIpsConfig(pid, clusterName, networkName, subnetworkName, false),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_external_ips_config",
 				ImportState:             true,
 				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -3478,6 +3752,8 @@ func TestAccContainerCluster_withMeshCertificatesConfig(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 	pid := envvar.GetTestProjectFromEnv()
 
 	acctest.VcrTest(t, resource.TestCase{
@@ -3486,31 +3762,31 @@ func TestAccContainerCluster_withMeshCertificatesConfig(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withMeshCertificatesConfigEnabled(pid, clusterName),
+				Config: testAccContainerCluster_withMeshCertificatesConfigEnabled(pid, clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_mesh_certificates_config",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"remove_default_node_pool"},
+				ImportStateVerifyIgnore: []string{"remove_default_node_pool", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_updateMeshCertificatesConfig(pid, clusterName, true),
+				Config: testAccContainerCluster_updateMeshCertificatesConfig(pid, clusterName, networkName, subnetworkName, true),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_mesh_certificates_config",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"remove_default_node_pool"},
+				ImportStateVerifyIgnore: []string{"remove_default_node_pool", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_updateMeshCertificatesConfig(pid, clusterName, false),
+				Config: testAccContainerCluster_updateMeshCertificatesConfig(pid, clusterName, networkName, subnetworkName, false),
 			},
 			{
 				ResourceName:            "google_container_cluster.with_mesh_certificates_config",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"remove_default_node_pool"},
+				ImportStateVerifyIgnore: []string{"remove_default_node_pool", "deletion_protection"},
 			},
 		},
 	})
@@ -3520,6 +3796,8 @@ func TestAccContainerCluster_withCostManagementConfig(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 	pid := envvar.GetTestProjectFromEnv()
 
 	acctest.VcrTest(t, resource.TestCase{
@@ -3528,20 +3806,22 @@ func TestAccContainerCluster_withCostManagementConfig(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_updateCostManagementConfig(pid, clusterName, true),
+				Config: testAccContainerCluster_updateCostManagementConfig(pid, clusterName, networkName, subnetworkName, true),
 			},
 			{
 				ResourceName:      "google_container_cluster.with_cost_management_config",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_updateCostManagementConfig(pid, clusterName, false),
+				Config: testAccContainerCluster_updateCostManagementConfig(pid, clusterName, networkName, subnetworkName, false),
 			},
 			{
 				ResourceName:      "google_container_cluster.with_cost_management_config",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -3551,6 +3831,8 @@ func TestAccContainerCluster_withDatabaseEncryption(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	// Use the bootstrapped KMS key so we can avoid creating keys needlessly
 	// as they will pile up in the project because they can not be completely
@@ -3565,21 +3847,23 @@ func TestAccContainerCluster_withDatabaseEncryption(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withDatabaseEncryption(clusterName, kmsData),
+				Config: testAccContainerCluster_withDatabaseEncryption(clusterName, kmsData, networkName, subnetworkName),
 				Check:  resource.TestCheckResourceAttrSet("data.google_kms_key_ring_iam_policy.test_key_ring_iam_policy", "policy_data"),
 			},
 			{
 				ResourceName:        "google_container_cluster.primary",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_basic(clusterName),
+				Config: testAccContainerCluster_basic(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:        "google_container_cluster.primary",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -3602,6 +3886,7 @@ func TestAccContainerCluster_withAdvancedDatapath(t *testing.T) {
 				ResourceName:        "google_container_cluster.primary",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -3613,6 +3898,8 @@ func TestAccContainerCluster_withResourceUsageExportConfig(t *testing.T) {
 	suffix := acctest.RandString(t, 10)
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", suffix)
 	datesetId := fmt.Sprintf("tf_test_cluster_resource_usage_%s", suffix)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
@@ -3620,28 +3907,31 @@ func TestAccContainerCluster_withResourceUsageExportConfig(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withResourceUsageExportConfig(clusterName, datesetId, "true"),
+				Config: testAccContainerCluster_withResourceUsageExportConfig(clusterName, datesetId, "true", networkName, subnetworkName),
 			},
 			{
 				ResourceName:        "google_container_cluster.with_resource_usage_export_config",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withResourceUsageExportConfig(clusterName, datesetId, "false"),
+				Config: testAccContainerCluster_withResourceUsageExportConfig(clusterName, datesetId, "false", networkName, subnetworkName),
 			},
 			{
 				ResourceName:        "google_container_cluster.with_resource_usage_export_config",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withResourceUsageExportConfigNoConfig(clusterName, datesetId),
+				Config: testAccContainerCluster_withResourceUsageExportConfigNoConfig(clusterName, datesetId, networkName, subnetworkName),
 			},
 			{
 				ResourceName:        "google_container_cluster.with_resource_usage_export_config",
 				ImportState:         true,
 				ImportStateVerify:   true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -3668,6 +3958,7 @@ func TestAccContainerCluster_withMasterAuthorizedNetworksDisabled(t *testing.T)
 				ResourceName:		 "google_container_cluster.with_private_cluster",
 				ImportState:		 true,
 				ImportStateVerify:	 true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -3678,6 +3969,8 @@ func TestAccContainerCluster_withEnableKubernetesAlpha(t *testing.T) {
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	npName := fmt.Sprintf("tf-test-np-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
@@ -3685,12 +3978,13 @@ func TestAccContainerCluster_withEnableKubernetesAlpha(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withEnableKubernetesAlpha(clusterName, npName),
+				Config: testAccContainerCluster_withEnableKubernetesAlpha(clusterName, npName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -3700,6 +3994,8 @@ func TestAccContainerCluster_withEnableKubernetesBetaAPIs(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
@@ -3707,13 +4003,13 @@ func TestAccContainerCluster_withEnableKubernetesBetaAPIs(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withEnableKubernetesBetaAPIs(clusterName),
+				Config: testAccContainerCluster_withEnableKubernetesBetaAPIs(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.primary",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -3723,6 +4019,8 @@ func TestAccContainerCluster_withEnableKubernetesBetaAPIsOnExistingCluster(t *te
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
@@ -3730,22 +4028,22 @@ func TestAccContainerCluster_withEnableKubernetesBetaAPIsOnExistingCluster(t *te
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withoutEnableKubernetesBetaAPIs(clusterName),
+				Config: testAccContainerCluster_withoutEnableKubernetesBetaAPIs(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.primary",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withEnableKubernetesBetaAPIs(clusterName),
+				Config: testAccContainerCluster_withEnableKubernetesBetaAPIs(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.primary",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -3773,18 +4071,21 @@ func TestAccContainerCluster_withDNSConfig(t *testing.T) {
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	domainName := fmt.Sprintf("tf-test-domain-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withDNSConfig(clusterName, "CLOUD_DNS", domainName, "VPC_SCOPE"),
+				Config: testAccContainerCluster_withDNSConfig(clusterName, "CLOUD_DNS", domainName, "VPC_SCOPE", networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.with_dns_config",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -3793,32 +4094,34 @@ func TestAccContainerCluster_withDNSConfig(t *testing.T) {
 func TestAccContainerCluster_withGatewayApiConfig(t *testing.T) {
 	t.Parallel()
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withGatewayApiConfig(clusterName, "CANARY"),
+				Config: testAccContainerCluster_withGatewayApiConfig(clusterName, "CANARY", networkName, subnetworkName),
 				ExpectError: regexp.MustCompile(`expected gateway_api_config\.0\.channel to be one of \[CHANNEL_DISABLED CHANNEL_EXPERIMENTAL CHANNEL_STANDARD\], got CANARY`),
 			},
 			{
-				Config: testAccContainerCluster_withGatewayApiConfig(clusterName, "CHANNEL_DISABLED"),
+				Config: testAccContainerCluster_withGatewayApiConfig(clusterName, "CHANNEL_DISABLED", networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withGatewayApiConfig(clusterName, "CHANNEL_STANDARD"),
+				Config: testAccContainerCluster_withGatewayApiConfig(clusterName, "CHANNEL_STANDARD", networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -3843,7 +4146,7 @@ func TestAccContainerCluster_withTPUConfig(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 				// TODO: remove when tpu_config can be read from the API
-				ImportStateVerifyIgnore: []string{"tpu_config"},
+				ImportStateVerifyIgnore: []string{"tpu_config", "deletion_protection"},
 			},
 		},
 	})
@@ -3853,6 +4156,8 @@ func TestAccContainerCluster_withProtectConfig(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -3860,22 +4165,22 @@ func TestAccContainerCluster_withProtectConfig(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withProtectConfig(clusterName),
+				Config: testAccContainerCluster_withProtectConfig(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.primary",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withProtectConfigUpdated(clusterName),
+				Config: testAccContainerCluster_withProtectConfigUpdated(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_cluster.primary",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -3886,6 +4191,8 @@ func TestAccContainerCluster_withSecurityPostureConfig(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -3893,34 +4200,101 @@ func TestAccContainerCluster_withSecurityPostureConfig(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_SetSecurityPostureToStandard(clusterName),
+				Config: testAccContainerCluster_SetSecurityPostureToStandard(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.with_security_posture_config",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-			 	Config: testAccContainerCluster_SetWorkloadVulnerabilityToStandard(clusterName),
+			 	Config: testAccContainerCluster_SetWorkloadVulnerabilityToStandard(clusterName, networkName, subnetworkName),
 			},
 			{
 			 	ResourceName:      "google_container_cluster.with_security_posture_config",
 			 	ImportState:       true,
 			 	ImportStateVerify: true,
+				 ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_DisableALL(clusterName),
+				Config: testAccContainerCluster_DisableALL(clusterName, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.with_security_posture_config",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
+			},
+		},
+	})
+}
+
+func TestAccContainerCluster_withFleetConfig(t *testing.T) {
+	t.Parallel()
+
+	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	projectID := envvar.GetTestProjectFromEnv()
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckContainerClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccContainerCluster_withFleetConfig(clusterName, projectID),
+			},
+			{
+				ResourceName:            "google_container_cluster.primary",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
+			},
+			{
+				Config:		testAccContainerCluster_withFleetConfig(clusterName, "random-project"),
+				ExpectError: regexp.MustCompile(`changing existing fleet host project is not supported`),
+			},
+			{
+				Config: testAccContainerCluster_DisableFleet(clusterName),
+			},
+			{
+				ResourceName:      "google_container_cluster.primary",
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
 }
 
-func testAccContainerCluster_SetSecurityPostureToStandard(resource_name string) string {
+func testAccContainerCluster_withFleetConfig(name, projectID string) string {
+	return fmt.Sprintf(`
+resource "google_container_cluster" "primary" {
+  name               = "%s"
+  location           = "us-central1-a"
+  initial_node_count = 1
+
+  fleet {
+	project = "%s"
+  }
+
+  deletion_protection = false
+}
+`, name, projectID)
+}
+
+func testAccContainerCluster_DisableFleet(resource_name string) string {
+	return fmt.Sprintf(`
+resource "google_container_cluster" "primary" {
+  name               = "%s"
+  location           = "us-central1-a"
+  initial_node_count = 1
+  deletion_protection = false
+}
+`, resource_name)
+}
+
+func testAccContainerCluster_SetSecurityPostureToStandard(resource_name, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_security_posture_config" {
   name               = "%s"
@@ -3929,11 +4303,14 @@ resource "google_container_cluster" "with_security_posture_config" {
   security_posture_config {
 	mode = "BASIC"
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, resource_name)
+`, resource_name, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_SetWorkloadVulnerabilityToStandard(resource_name string) string {
+func testAccContainerCluster_SetWorkloadVulnerabilityToStandard(resource_name, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_security_posture_config" {
   name               = "%s"
@@ -3942,11 +4319,14 @@ resource "google_container_cluster" "with_security_posture_config" {
   security_posture_config {
 	vulnerability_mode = "VULNERABILITY_BASIC"
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, resource_name)
+`, resource_name, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_DisableALL(resource_name string) string {
+func testAccContainerCluster_DisableALL(resource_name, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_security_posture_config" {
   name               = "%s"
@@ -3956,8 +4336,11 @@ resource "google_container_cluster" "with_security_posture_config" {
 	mode = "DISABLED"
 	vulnerability_mode = "VULNERABILITY_DISABLED"
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, resource_name)
+`, resource_name, networkName, subnetworkName)
 }
 
 func TestAccContainerCluster_autopilot_minimal(t *testing.T) {
@@ -3976,6 +4359,7 @@ func TestAccContainerCluster_autopilot_minimal(t *testing.T) {
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -3997,7 +4381,7 @@ func TestAccContainerCluster_autopilot_net_admin(t *testing.T) {
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore:	[]string{"min_master_version"},
+				ImportStateVerifyIgnore:	[]string{"min_master_version", "deletion_protection"},
 			},
 			{
 				Config: testAccContainerCluster_autopilot_net_admin(clusterName, false),
@@ -4006,7 +4390,7 @@ func TestAccContainerCluster_autopilot_net_admin(t *testing.T) {
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore:	[]string{"min_master_version"},
+				ImportStateVerifyIgnore:	[]string{"min_master_version", "deletion_protection"},
 			},
 			{
 				Config: testAccContainerCluster_autopilot_net_admin(clusterName, true),
@@ -4015,7 +4399,7 @@ func TestAccContainerCluster_autopilot_net_admin(t *testing.T) {
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore:	[]string{"min_master_version"},
+				ImportStateVerifyIgnore:	[]string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -4037,6 +4421,7 @@ func TestAccContainerCluster_additional_pod_ranges_config_on_create(t *testing.T
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -4058,6 +4443,7 @@ func TestAccContainerCluster_additional_pod_ranges_config_on_update(t *testing.T
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
 				Config: testAccContainerCluster_additional_pod_ranges_config(clusterName, 2),
@@ -4066,6 +4452,7 @@ func TestAccContainerCluster_additional_pod_ranges_config_on_update(t *testing.T
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
 				Config: testAccContainerCluster_additional_pod_ranges_config(clusterName, 0),
@@ -4074,6 +4461,7 @@ func TestAccContainerCluster_additional_pod_ranges_config_on_update(t *testing.T
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
 				Config: testAccContainerCluster_additional_pod_ranges_config(clusterName, 1),
@@ -4082,6 +4470,7 @@ func TestAccContainerCluster_additional_pod_ranges_config_on_update(t *testing.T
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
 				Config: testAccContainerCluster_additional_pod_ranges_config(clusterName, 0),
@@ -4090,6 +4479,7 @@ func TestAccContainerCluster_additional_pod_ranges_config_on_update(t *testing.T
 				ResourceName:      "google_container_cluster.primary",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
@@ -4140,28 +4530,40 @@ func testAccCheckContainerClusterDestroyProducer(t *testing.T) func(s *terraform
 	}
 }
 
-func testAccContainerCluster_basic(name string) string {
+func testAccContainerCluster_basic(name, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "primary" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, name)
+`, name, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_networkingModeRoutes(name string) string {
+func testAccContainerCluster_networkingModeRoutes(firstName, secondName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "primary" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 1
   networking_mode    = "ROUTES"
+  deletion_protection = false
 }
-`, name)
+
+resource "google_container_cluster" "secondary" {
+	name               = "%s"
+	location           = "us-central1-a"
+	initial_node_count = 1
+	cluster_ipv4_cidr  = "10.96.0.0/14"
+	deletion_protection = false
+  }
+`, firstName, secondName)
 }
 
-func testAccContainerCluster_misc(name string) string {
+func testAccContainerCluster_misc(name, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "primary" {
   name               = "%s"
@@ -4191,11 +4593,14 @@ resource "google_container_cluster" "primary" {
 <% unless version == 'ga' -%>
   enable_intranode_visibility = true
 <% end -%>
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, name)
+`, name, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_misc_update(name string) string {
+func testAccContainerCluster_misc_update(name, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "primary" {
   name               = "%s"
@@ -4226,11 +4631,14 @@ resource "google_container_cluster" "primary" {
 <% unless version == 'ga' -%>
   enable_intranode_visibility = true
 <% end -%>
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, name)
+`, name, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withAddons(projectID string, clusterName string) string {
+func testAccContainerCluster_withAddons(projectID, clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_project" "project" {
   project_id = "%s"
@@ -4288,11 +4696,14 @@ resource "google_container_cluster" "primary" {
     }
 <% end -%>
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, projectID, clusterName)
+`, projectID, clusterName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_updateAddons(projectID string, clusterName string) string {
+func testAccContainerCluster_updateAddons(projectID, clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_project" "project" {
   project_id = "%s"
@@ -4323,7 +4734,7 @@ resource "google_container_cluster" "primary" {
       enabled = true
     }
     cloudrun_config {
-	  # https://github.com/hashicorp/terraform-provider-google/issues/11943
+    # https://github.com/hashicorp/terraform-provider-google/issues/11943
       # disabled = false
       disabled = true
     }
@@ -4333,12 +4744,12 @@ resource "google_container_cluster" "primary" {
     gce_persistent_disk_csi_driver_config {
       enabled = true
     }
-	gke_backup_agent_config {
-	  enabled = true
-	}
-	config_connector_config {
-	  enabled = true
-	}
+  gke_backup_agent_config {
+    enabled = true
+  }
+  config_connector_config {
+    enabled = true
+  }
     gcs_fuse_csi_driver_config {
       enabled = true
     }
@@ -4351,13 +4762,15 @@ resource "google_container_cluster" "primary" {
       enabled = true
     }
 <% end -%>
-  }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, projectID, clusterName)
+`, projectID, clusterName, networkName, subnetworkName)
 }
 
 // Issue with cloudrun_config addon: https://github.com/hashicorp/terraform-provider-google/issues/11943/
-// func testAccContainerCluster_withInternalLoadBalancer(projectID string, clusterName string) string {
+// func testAccContainerCluster_withInternalLoadBalancer(projectID string, clusterName, networkName, subnetworkName string) string {
 // 	return fmt.Sprintf(`
 // data "google_project" "project" {
 //   project_id = "%s"
@@ -4389,11 +4802,14 @@ resource "google_container_cluster" "primary" {
 // 	  load_balancer_type = "LOAD_BALANCER_TYPE_INTERNAL"
 //     }
 //   }
+//   deletion_protection = false
+//   network    = "%s"
+//   subnetwork    = "%s"
 // }
-// `, projectID, clusterName)
+// `, projectID, clusterName, networkName, subnetworkName)
 // }
 
-func testAccContainerCluster_withNotificationConfig(clusterName string, topic string) string {
+func testAccContainerCluster_withNotificationConfig(clusterName, topic, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 
 resource "google_pubsub_topic" "%s" {
@@ -4405,31 +4821,37 @@ resource "google_container_cluster" "notification_config" {
   location           = "us-central1-a"
   initial_node_count = 3
   notification_config {
-	pubsub {
-	  enabled = true
-	  topic   = google_pubsub_topic.%s.id
-	}
+    pubsub {
+      enabled = true
+      topic   = google_pubsub_topic.%s.id
+    }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, topic, topic, clusterName, topic)
+`, topic, topic, clusterName, topic, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_disableNotificationConfig(clusterName string) string {
+func testAccContainerCluster_disableNotificationConfig(clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "notification_config" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 3
   notification_config {
-	pubsub {
-	  enabled = false
-	}
+    pubsub {
+      enabled = false
+    }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName)
+`, clusterName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withFilteredNotificationConfig(clusterName string, topic string) string {
+func testAccContainerCluster_withFilteredNotificationConfig(clusterName, topic, networkName, subnetworkName string) string {
 
 	return fmt.Sprintf(`
 
@@ -4442,19 +4864,22 @@ resource "google_container_cluster" "filtered_notification_config" {
   location           = "us-central1-a"
   initial_node_count = 3
   notification_config {
-	pubsub {
-	  enabled = true
-	  topic   = google_pubsub_topic.%s.id
-	  filter {
-		event_type = ["UPGRADE_EVENT", "SECURITY_BULLETIN_EVENT"]
-	  }
-	}
+    pubsub {
+      enabled = true
+      topic   = google_pubsub_topic.%s.id
+      filter {
+        event_type = ["UPGRADE_EVENT", "SECURITY_BULLETIN_EVENT"]
+      }
+    }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, topic, topic, clusterName, topic)
+`, topic, topic, clusterName, topic, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withFilteredNotificationConfigUpdate(clusterName string, topic string) string {
+func testAccContainerCluster_withFilteredNotificationConfigUpdate(clusterName, topic, networkName, subnetworkName string) string {
 
 	return fmt.Sprintf(`
 
@@ -4475,11 +4900,14 @@ resource "google_container_cluster" "filtered_notification_config" {
 	  }
 	}
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, topic, topic, clusterName, topic)
+`, topic, topic, clusterName, topic, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_disableFilteredNotificationConfig(clusterName string, topic string) string {
+func testAccContainerCluster_disableFilteredNotificationConfig(clusterName, topic, networkName, subnetworkName string) string {
 
 	return fmt.Sprintf(`
 
@@ -4497,11 +4925,14 @@ resource "google_container_cluster" "filtered_notification_config" {
 	  topic   = google_pubsub_topic.%s.id
 	}
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, topic, topic, clusterName, topic)
+`, topic, topic, clusterName, topic, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withConfidentialNodes(clusterName string, npName string) string {
+func testAccContainerCluster_withConfidentialNodes(clusterName, npName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "confidential_nodes" {
   name               = "%s"
@@ -4521,11 +4952,14 @@ resource "google_container_cluster" "confidential_nodes" {
   confidential_nodes {
     enabled = true
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, npName)
+`, clusterName, npName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_disableConfidentialNodes(clusterName string, npName string) string {
+func testAccContainerCluster_disableConfidentialNodes(clusterName, npName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "confidential_nodes" {
   name               = "%s"
@@ -4545,11 +4979,14 @@ resource "google_container_cluster" "confidential_nodes" {
   confidential_nodes {
     enabled = false
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, npName)
+`, clusterName, npName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withILBSubSetting(clusterName string, npName string) string {
+func testAccContainerCluster_withILBSubSetting(clusterName, npName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "confidential_nodes" {
   name               = "%s"
@@ -4567,11 +5004,14 @@ resource "google_container_cluster" "confidential_nodes" {
   }
 
   enable_l4_ilb_subsetting = true
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, npName)
+`, clusterName, npName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_disableILBSubSetting(clusterName string, npName string) string {
+func testAccContainerCluster_disableILBSubSetting(clusterName, npName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "confidential_nodes" {
   name               = "%s"
@@ -4589,11 +5029,14 @@ resource "google_container_cluster" "confidential_nodes" {
   }
 
   enable_l4_ilb_subsetting = false
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, npName)
+`, clusterName, npName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withNetworkPolicyEnabled(clusterName string) string {
+func testAccContainerCluster_withNetworkPolicyEnabled(clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_network_policy_enabled" {
   name                     = "%s"
@@ -4611,12 +5054,26 @@ resource "google_container_cluster" "with_network_policy_enabled" {
       disabled = false
     }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName)
+`, clusterName, networkName, subnetworkName)
 }
 
+func testAccContainerCluster_withDeletionProtection(clusterName string, deletionProtection string) string {
+	return fmt.Sprintf(`
+resource "google_container_cluster" "primary" {
+  name               = "%s"
+  location           = "us-central1-a"
+  initial_node_count = 1
+
+  deletion_protection = %s
+}
+`, clusterName, deletionProtection)
+}
 
-func testAccContainerCluster_withReleaseChannelEnabled(clusterName string, channel string) string {
+func testAccContainerCluster_withReleaseChannelEnabled(clusterName, channel, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_release_channel" {
   name               = "%s"
@@ -4626,11 +5083,14 @@ resource "google_container_cluster" "with_release_channel" {
   release_channel {
     channel = "%s"
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, channel)
+`, clusterName, channel, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withReleaseChannelEnabledDefaultVersion(clusterName string, channel string) string {
+func testAccContainerCluster_withReleaseChannelEnabledDefaultVersion(clusterName, channel, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 
 data "google_container_engine_versions" "central1a" {
@@ -4642,12 +5102,15 @@ resource "google_container_cluster" "with_release_channel" {
   location           = "us-central1-a"
   initial_node_count = 1
   min_master_version = data.google_container_engine_versions.central1a.release_channel_default_version["%s"]
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, channel)
+`, clusterName, channel, networkName, subnetworkName)
 }
 
 <% unless version == 'ga' -%>
-func testAccContainerCluster_withTelemetryEnabled(clusterName string, telemetryType string) string {
+func testAccContainerCluster_withTelemetryEnabled(clusterName, telemetryType, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_cluster_telemetry" {
   name               = "%s"
@@ -4657,23 +5120,29 @@ resource "google_container_cluster" "with_cluster_telemetry" {
   cluster_telemetry {
     type = "%s"
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, telemetryType)
+`, clusterName, telemetryType, networkName, subnetworkName)
 }
 <% end -%>
 
-func testAccContainerCluster_removeNetworkPolicy(clusterName string) string {
+func testAccContainerCluster_removeNetworkPolicy(clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_network_policy_enabled" {
   name                     = "%s"
   location                 = "us-central1-a"
   initial_node_count       = 1
   remove_default_node_pool = true
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName)
+`, clusterName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withNetworkPolicyDisabled(clusterName string) string {
+func testAccContainerCluster_withNetworkPolicyDisabled(clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_network_policy_enabled" {
   name                     = "%s"
@@ -4684,11 +5153,14 @@ resource "google_container_cluster" "with_network_policy_enabled" {
   network_policy {
     enabled = false
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName)
+`, clusterName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withNetworkPolicyConfigDisabled(clusterName string) string {
+func testAccContainerCluster_withNetworkPolicyConfigDisabled(clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_network_policy_enabled" {
   name                     = "%s"
@@ -4705,36 +5177,45 @@ resource "google_container_cluster" "with_network_policy_enabled" {
       disabled = true
     }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName)
+`, clusterName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withAuthenticatorGroupsConfigUpdate(name string, orgDomain string) string {
+func testAccContainerCluster_withAuthenticatorGroupsConfigUpdate(name, orgDomain, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "primary" {
-	name               = "%s"
-	location           = "us-central1-a"
-	initial_node_count = 1
+  name               = "%s"
+  location           = "us-central1-a"
+  initial_node_count = 1
 
-	authenticator_groups_config {
-		security_group = "gke-security-groups@%s"
-	}
+  authenticator_groups_config {
+    security_group = "gke-security-groups@%s"
+  }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, name, orgDomain)
+`, name, orgDomain, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withAuthenticatorGroupsConfigUpdate2(name string) string {
+func testAccContainerCluster_withAuthenticatorGroupsConfigUpdate2(name, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "primary" {
-	name               = "%s"
-	location           = "us-central1-a"
-	initial_node_count = 1
+  name               = "%s"
+  location           = "us-central1-a"
+  initial_node_count = 1
 
-	authenticator_groups_config {
-		security_group = ""
-	}
+  authenticator_groups_config {
+    security_group = ""
+  }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, name)
+`, name, networkName, subnetworkName)
 }
 
 
@@ -4762,6 +5243,7 @@ resource "google_container_cluster" "with_master_authorized_networks" {
   master_authorized_networks_config {
     %s
   }
+  deletion_protection = false
 }
 `, clusterName, cidrBlocks)
 }
@@ -4772,18 +5254,22 @@ resource "google_container_cluster" "with_master_authorized_networks" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
 }
 `, clusterName)
 }
 
-func testAccContainerCluster_regional(clusterName string) string {
+func testAccContainerCluster_regional(clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "regional" {
   name               = "%s"
   location           = "us-central1"
   initial_node_count = 1
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName)
+`, clusterName, networkName, subnetworkName)
 }
 
 func TestAccContainerCluster_withPrivateEndpointSubnetwork(t *testing.T) {
@@ -4812,7 +5298,7 @@ func TestAccContainerCluster_withPrivateEndpointSubnetwork(t *testing.T) {
 				ResourceName:				"google_container_cluster.with_private_endpoint_subnetwork",
 				ImportState:				true,
 				ImportStateVerify:			true,
-				ImportStateVerifyIgnore:	[]string{"min_master_version"},
+				ImportStateVerifyIgnore:	[]string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -4857,6 +5343,7 @@ resource "google_container_cluster" "with_private_endpoint_subnetwork" {
   private_cluster_config {
     private_endpoint_subnetwork = google_compute_subnetwork.container_subnetwork2.name
   }
+  deletion_protection = false
 }
 `, containerNetName, s1Name, s1Cidr, s2Name, s2Cidr, clusterName)
 }
@@ -4881,7 +5368,7 @@ func TestAccContainerCluster_withPrivateClusterConfigPrivateEndpointSubnetwork(t
 				ResourceName:            "google_container_cluster.with_private_endpoint_subnetwork",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"min_master_version"},
+				ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
@@ -4933,6 +5420,7 @@ resource "google_container_cluster" "with_private_endpoint_subnetwork" {
     cluster_secondary_range_name  = google_compute_subnetwork.container_subnetwork.secondary_ip_range[0].range_name
     services_secondary_range_name = google_compute_subnetwork.container_subnetwork.secondary_ip_range[1].range_name
   }
+  deletion_protection = false
 }
 `, containerNetName, clusterName)
 }
@@ -4941,6 +5429,8 @@ func TestAccContainerCluster_withEnablePrivateEndpointToggle(t *testing.T) {
 	t.Parallel()
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -4948,61 +5438,33 @@ func TestAccContainerCluster_withEnablePrivateEndpointToggle(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_withEnablePrivateEndpoint(clusterName, "true"),
+				Config: testAccContainerCluster_withEnablePrivateEndpoint(clusterName, "true", networkName, subnetworkName),
 			},
 			{
 				ResourceName:				"google_container_cluster.with_enable_private_endpoint",
 				ImportState:				true,
 				ImportStateVerify:			true,
-				ImportStateVerifyIgnore:	[]string{"min_master_version"},
+				ImportStateVerifyIgnore:	[]string{"min_master_version", "deletion_protection"},
 			},
 			{
-				Config: testAccContainerCluster_withEnablePrivateEndpoint(clusterName, "false"),
+				Config: testAccContainerCluster_withEnablePrivateEndpoint(clusterName, "false", networkName, subnetworkName),
 			},
 			{
 				ResourceName:				"google_container_cluster.with_enable_private_endpoint",
 				ImportState:				true,
 				ImportStateVerify:			true,
-				ImportStateVerifyIgnore:	[]string{"min_master_version"},
+				ImportStateVerifyIgnore:	[]string{"min_master_version", "deletion_protection"},
 			},
 		},
 	})
 }
 
-func TestAccContainerCluster_failedCreation(t *testing.T) {
-	// Test that in a scenario where the cluster fails to create, a subsequent apply will delete the resource.
-	// Skip this test for now as we don't have a good way to force cluster creation to fail. https://github.com/hashicorp/terraform-provider-google/issues/13711
-	t.Skip()
-	t.Parallel()
-
-	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+func testAccContainerCluster_withEnablePrivateEndpoint(clusterName, flag, networkName, subnetworkName string) string {
 
-	project := acctest.BootstrapProject(t, "tf-fail-cluster-", envvar.GetTestBillingAccountFromEnv(t), []string{"container.googleapis.com"})
-	acctest.RemoveContainerServiceAgentRoleFromContainerEngineRobot(t, project)
-
-	acctest.VcrTest(t, resource.TestCase{
-		PreCheck:  func() { acctest.AccTestPreCheck(t) },
-		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
-		Steps: []resource.TestStep{
-			{
-				Config:      testAccContainerCluster_failedCreation(clusterName, project.ProjectId),
-				ExpectError: regexp.MustCompile("timeout while waiting for state to become 'DONE'"),
-			},
-			{
-				Config:      testAccContainerCluster_failedCreation_update(clusterName, project.ProjectId),
-				ExpectError: regexp.MustCompile("Failed to create cluster"),
-				Check:       testAccCheckContainerClusterDestroyProducer(t),
-			},
-		},
-	})
-}
-
-func testAccContainerCluster_withEnablePrivateEndpoint(clusterName string, flag string) string {
-
-	return fmt.Sprintf(`
-data "google_container_engine_versions" "uscentral1a" {
-  location = "us-central1-a"
-}
+	return fmt.Sprintf(`
+data "google_container_engine_versions" "uscentral1a" {
+  location = "us-central1-a"
+}
 
 resource "google_container_cluster" "with_enable_private_endpoint" {
   name               = "%s"
@@ -5017,11 +5479,14 @@ resource "google_container_cluster" "with_enable_private_endpoint" {
   private_cluster_config {
     enable_private_endpoint = %s
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, flag)
+`, clusterName, flag, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_regionalWithNodePool(cluster, nodePool string) string {
+func testAccContainerCluster_regionalWithNodePool(cluster, nodePool, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "regional" {
   name     = "%s"
@@ -5030,11 +5495,14 @@ resource "google_container_cluster" "regional" {
   node_pool {
     name = "%s"
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, cluster, nodePool)
+`, cluster, nodePool, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_regionalNodeLocations(clusterName string) string {
+func testAccContainerCluster_regionalNodeLocations(clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_node_locations" {
   name               = "%s"
@@ -5045,11 +5513,14 @@ resource "google_container_cluster" "with_node_locations" {
     "us-central1-f",
     "us-central1-c",
   ]
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName)
+`, clusterName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_regionalUpdateNodeLocations(clusterName string) string {
+func testAccContainerCluster_regionalUpdateNodeLocations(clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_node_locations" {
   name               = "%s"
@@ -5060,8 +5531,11 @@ resource "google_container_cluster" "with_node_locations" {
     "us-central1-f",
     "us-central1-b",
   ]
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName)
+`, clusterName, networkName, subnetworkName)
 }
 
 <% unless version == 'ga' -%>
@@ -5115,23 +5589,27 @@ resource "google_container_cluster" "with_tpu" {
     cluster_secondary_range_name  = google_compute_subnetwork.container_subnetwork.secondary_ip_range[0].range_name
     services_secondary_range_name = google_compute_subnetwork.container_subnetwork.secondary_ip_range[1].range_name
   }
+  deletion_protection = false
 }
 `, containerNetName, clusterName)
 }
 
 <% end -%>
-func testAccContainerCluster_withIntraNodeVisibility(clusterName string) string {
+func testAccContainerCluster_withIntraNodeVisibility(clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_intranode_visibility" {
   name                        = "%s"
   location                    = "us-central1-a"
   initial_node_count          = 1
   enable_intranode_visibility = true
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName)
+`, clusterName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_updateIntraNodeVisibility(clusterName string) string {
+func testAccContainerCluster_updateIntraNodeVisibility(clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_intranode_visibility" {
   name                        = "%s"
@@ -5139,11 +5617,14 @@ resource "google_container_cluster" "with_intranode_visibility" {
   initial_node_count          = 1
   enable_intranode_visibility = false
   private_ipv6_google_access  = "PRIVATE_IPV6_GOOGLE_ACCESS_BIDIRECTIONAL"
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName)
+`, clusterName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withVersion(clusterName string) string {
+func testAccContainerCluster_withVersion(clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
   location = "us-central1-a"
@@ -5154,11 +5635,14 @@ resource "google_container_cluster" "with_version" {
   location           = "us-central1-a"
   min_master_version = data.google_container_engine_versions.central1a.latest_master_version
   initial_node_count = 1
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName)
+`, clusterName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withLowerVersion(clusterName string) string {
+func testAccContainerCluster_withLowerVersion(clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
   location = "us-central1-a"
@@ -5169,11 +5653,14 @@ resource "google_container_cluster" "with_version" {
   location           = "us-central1-a"
   min_master_version = data.google_container_engine_versions.central1a.valid_master_versions[3]
   initial_node_count = 1
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName)
+`, clusterName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withMasterAuthNoCert(clusterName string) string {
+func testAccContainerCluster_withMasterAuthNoCert(clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_master_auth_no_cert" {
   name               = "%s"
@@ -5184,11 +5671,14 @@ resource "google_container_cluster" "with_master_auth_no_cert" {
       issue_client_certificate = false
     }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName)
+`, clusterName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_updateVersion(clusterName string) string {
+func testAccContainerCluster_updateVersion(clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
   location = "us-central1-a"
@@ -5200,11 +5690,14 @@ resource "google_container_cluster" "with_version" {
   min_master_version = data.google_container_engine_versions.central1a.latest_master_version
   node_version       = data.google_container_engine_versions.central1a.valid_node_versions[1]
   initial_node_count = 1
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName)
+`, clusterName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withNodeConfig(clusterName string) string {
+func testAccContainerCluster_withNodeConfig(clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_node_config" {
   name               = "%s"
@@ -5249,11 +5742,14 @@ resource "google_container_cluster" "with_node_config" {
     // Updatable fields
     image_type = "COS_CONTAINERD"
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName)
+`, clusterName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withLoggingVariantInNodeConfig(clusterName, loggingVariant string) string {
+func testAccContainerCluster_withLoggingVariantInNodeConfig(clusterName, loggingVariant, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_logging_variant_in_node_config" {
   name               = "%s"
@@ -5263,11 +5759,14 @@ resource "google_container_cluster" "with_logging_variant_in_node_config" {
   node_config {
     logging_variant = "%s"
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, loggingVariant)
+`, clusterName, loggingVariant, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withLoggingVariantInNodePool(clusterName, nodePoolName, loggingVariant string) string {
+func testAccContainerCluster_withLoggingVariantInNodePool(clusterName, nodePoolName, loggingVariant, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_logging_variant_in_node_pool" {
   name               = "%s"
@@ -5280,11 +5779,14 @@ resource "google_container_cluster" "with_logging_variant_in_node_pool" {
       logging_variant = "%s"
     }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, nodePoolName, loggingVariant)
+`, clusterName, nodePoolName, loggingVariant, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withLoggingVariantNodePoolDefault(clusterName, loggingVariant string) string {
+func testAccContainerCluster_withLoggingVariantNodePoolDefault(clusterName, loggingVariant, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_logging_variant_node_pool_default" {
   name               = "%s"
@@ -5296,12 +5798,15 @@ resource "google_container_cluster" "with_logging_variant_node_pool_default" {
       logging_variant = "%s"
     }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, loggingVariant)
+`, clusterName, loggingVariant, networkName, subnetworkName)
 }
 
 <% unless version == 'ga' -%>
-func testAccContainerCluster_withNodePoolDefaults(clusterName, enabled string) string {
+func testAccContainerCluster_withNodePoolDefaults(clusterName, enabled, networkName, subnetworkName string) string {
         return fmt.Sprintf(`
 resource "google_container_cluster" "with_node_pool_defaults" {
   name               = "%s"
@@ -5315,12 +5820,15 @@ resource "google_container_cluster" "with_node_pool_defaults" {
       }
     }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, enabled)
+`, clusterName, enabled, networkName, subnetworkName)
 }
 <% end -%>
 
-func testAccContainerCluster_withNodeConfigUpdate(clusterName string) string {
+func testAccContainerCluster_withNodeConfigUpdate(clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_node_config" {
   name               = "%s"
@@ -5365,11 +5873,14 @@ resource "google_container_cluster" "with_node_config" {
     // Updatable fields
     image_type = "UBUNTU_CONTAINERD"
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName)
+`, clusterName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withNodeConfigScopeAlias(clusterName string) string {
+func testAccContainerCluster_withNodeConfigScopeAlias(clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_node_config_scope_alias" {
   name               = "%s"
@@ -5381,11 +5892,14 @@ resource "google_container_cluster" "with_node_config_scope_alias" {
     disk_size_gb = 15
     oauth_scopes = ["compute-rw", "storage-ro", "logging-write", "monitoring"]
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName)
+`, clusterName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withNodeConfigShieldedInstanceConfig(clusterName string) string {
+func testAccContainerCluster_withNodeConfigShieldedInstanceConfig(clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_node_config" {
   name               = "%s"
@@ -5421,11 +5935,14 @@ resource "google_container_cluster" "with_node_config" {
       enable_integrity_monitoring = true
     }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName)
+`, clusterName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withNodeConfigReservationAffinity(clusterName string) string {
+func testAccContainerCluster_withNodeConfigReservationAffinity(clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_node_config" {
   name               = "%s"
@@ -5460,11 +5977,14 @@ resource "google_container_cluster" "with_node_config" {
       consume_reservation_type = "ANY_RESERVATION"
     }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName)
+`, clusterName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withNodeConfigReservationAffinitySpecific(reservation, clusterName string) string {
+func testAccContainerCluster_withNodeConfigReservationAffinitySpecific(reservation, clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 
 resource "google_project_service" "compute" {
@@ -5530,12 +6050,15 @@ resource "google_container_cluster" "with_node_config" {
       ]
     }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
   depends_on = [google_project_service.container]
 }
-`, reservation, clusterName)
+`, reservation, clusterName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withWorkloadMetadataConfig(clusterName string) string {
+func testAccContainerCluster_withWorkloadMetadataConfig(clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
   location = "us-central1-a"
@@ -5557,12 +6080,15 @@ resource "google_container_cluster" "with_workload_metadata_config" {
       mode = "GCE_METADATA"
     }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName)
+`, clusterName, networkName, subnetworkName)
 }
 
 <% unless version.nil? || version == 'ga' -%>
-func testAccContainerCluster_withSandboxConfig(clusterName string) string {
+func testAccContainerCluster_withSandboxConfig(clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
   location = "us-central1-a"
@@ -5597,11 +6123,14 @@ resource "google_container_cluster" "with_sandbox_config" {
       effect = "NO_SCHEDULE"
     }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName)
+`, clusterName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withSandboxConfig_changeLabels(clusterName string) string {
+func testAccContainerCluster_withSandboxConfig_changeLabels(clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
   location = "us-central1-a"
@@ -5637,12 +6166,15 @@ resource "google_container_cluster" "with_sandbox_config" {
       effect = "NO_SCHEDULE"
     }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName)
+`, clusterName, networkName, subnetworkName)
 }
 <% end -%>
 
-func testAccContainerCluster_withBootDiskKmsKey(clusterName, kmsKeyName string) string {
+func testAccContainerCluster_withBootDiskKmsKey(clusterName, kmsKeyName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_boot_disk_kms_key" {
   name               = "%s"
@@ -5660,8 +6192,11 @@ resource "google_container_cluster" "with_boot_disk_kms_key" {
 
     boot_disk_kms_key = "%s"
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, kmsKeyName)
+`, clusterName, kmsKeyName, networkName, subnetworkName)
 }
 
 func testAccContainerCluster_networkRef(cluster, network string) string {
@@ -5677,6 +6212,7 @@ resource "google_container_cluster" "with_net_ref_by_url" {
   initial_node_count = 1
 
   network = google_compute_network.container_network.self_link
+  deletion_protection = false
 }
 
 resource "google_container_cluster" "with_net_ref_by_name" {
@@ -5685,11 +6221,12 @@ resource "google_container_cluster" "with_net_ref_by_name" {
   initial_node_count = 1
 
   network = google_compute_network.container_network.name
+  deletion_protection = false
 }
 `, network, cluster, cluster)
 }
 
-func testAccContainerCluster_autoprovisioningDefaultsManagement(clusterName string, autoUpgrade, autoRepair bool) string {
+func testAccContainerCluster_autoprovisioningDefaultsManagement(clusterName, networkName, subnetworkName string, autoUpgrade, autoRepair bool) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_autoprovisioning_management" {
   name               = "%s"
@@ -5716,11 +6253,14 @@ resource "google_container_cluster" "with_autoprovisioning_management" {
       }
     }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, autoUpgrade, autoRepair)
+`, clusterName, autoUpgrade, autoRepair, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_backendRef(cluster string) string {
+func testAccContainerCluster_backendRef(cluster, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_compute_backend_service" "my-backend-service" {
   name      = "%s-backend"
@@ -5759,25 +6299,32 @@ resource "google_container_cluster" "primary" {
       "https://www.googleapis.com/auth/monitoring",
     ]
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, cluster, cluster, cluster)
+`, cluster, cluster, cluster, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withNodePoolBasic(cluster, nodePool string) string {
+func testAccContainerCluster_withNodePoolBasic(cluster, nodePool, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_node_pool" {
   name     = "%s"
   location = "us-central1-a"
+  deletion_protection = false
 
   node_pool {
     name               = "%s"
     initial_node_count = 2
   }
+
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, cluster, nodePool)
+`, cluster, nodePool, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withNodePoolLowerVersion(cluster, nodePool string) string {
+func testAccContainerCluster_withNodePoolLowerVersion(cluster, nodePool, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
   location = "us-central1-a"
@@ -5794,11 +6341,14 @@ resource "google_container_cluster" "with_node_pool" {
     initial_node_count = 2
     version            = data.google_container_engine_versions.central1a.valid_node_versions[2]
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, cluster, nodePool)
+`, cluster, nodePool, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withNodePoolUpdateVersion(cluster, nodePool string) string {
+func testAccContainerCluster_withNodePoolUpdateVersion(cluster, nodePool, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
   location = "us-central1-a"
@@ -5815,11 +6365,14 @@ resource "google_container_cluster" "with_node_pool" {
     initial_node_count = 2
     version            = data.google_container_engine_versions.central1a.valid_node_versions[1]
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, cluster, nodePool)
+`, cluster, nodePool, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withNodePoolNodeLocations(cluster, nodePool string) string {
+func testAccContainerCluster_withNodePoolNodeLocations(cluster, nodePool, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_node_pool" {
   name     = "%s"
@@ -5834,11 +6387,14 @@ resource "google_container_cluster" "with_node_pool" {
     name       = "%s"
     node_count = 2
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, cluster, nodePool)
+`, cluster, nodePool, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withNodePoolResize(cluster, nodePool string) string {
+func testAccContainerCluster_withNodePoolResize(cluster, nodePool, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_node_pool" {
   name     = "%s"
@@ -5853,12 +6409,15 @@ resource "google_container_cluster" "with_node_pool" {
     name       = "%s"
     node_count = 3
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, cluster, nodePool)
+`, cluster, nodePool, networkName, subnetworkName)
 }
 
 <% unless version == 'ga' -%>
-func testAccContainerCluster_withAutoscalingProfile(cluster string, autoscalingProfile string) string {
+func testAccContainerCluster_withAutoscalingProfile(cluster, autoscalingProfile, networkName, subnetworkName string) string {
 	config := fmt.Sprintf(`
 resource "google_container_cluster" "autoscaling_with_profile" {
   name               = "%s"
@@ -5869,13 +6428,16 @@ resource "google_container_cluster" "autoscaling_with_profile" {
     enabled             = false
     autoscaling_profile = "%s"
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, cluster, autoscalingProfile)
+`, cluster, autoscalingProfile, networkName, subnetworkName)
 	return config
 }
 <% end -%>
 
-func testAccContainerCluster_autoprovisioning(cluster string, autoprovisioning, withNetworkTag bool) string {
+func testAccContainerCluster_autoprovisioning(cluster, networkName, subnetworkName string, autoprovisioning, withNetworkTag bool) string {
 	config := fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
   location = "us-central1-a"
@@ -5886,7 +6448,10 @@ resource "google_container_cluster" "with_autoprovisioning" {
   location           = "us-central1-a"
   min_master_version = data.google_container_engine_versions.central1a.latest_master_version
   initial_node_count = 1
-`, cluster)
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
+`, cluster, networkName, subnetworkName)
 	if autoprovisioning {
 		config += `
   cluster_autoscaling {
@@ -5919,7 +6484,7 @@ resource "google_container_cluster" "with_autoprovisioning" {
 	return config
 }
 
-func testAccContainerCluster_autoprovisioningDefaults(cluster string, monitoringWrite bool) string {
+func testAccContainerCluster_autoprovisioningDefaults(cluster, networkName, subnetworkName string, monitoringWrite bool) string {
 	config := fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
   location = "us-central1-a"
@@ -5930,6 +6495,10 @@ resource "google_container_cluster" "with_autoprovisioning" {
   location           = "us-central1-a"
   min_master_version = data.google_container_engine_versions.central1a.latest_master_version
   initial_node_count = 1
+  deletion_protection = false
+  
+  network    = "%s"
+  subnetwork    = "%s"
 
   logging_service    = "none"
   monitoring_service = "none"
@@ -5949,7 +6518,7 @@ resource "google_container_cluster" "with_autoprovisioning" {
       oauth_scopes = [
         "https://www.googleapis.com/auth/pubsub",
         "https://www.googleapis.com/auth/devstorage.read_only",`,
-cluster)
+		cluster, networkName, subnetworkName)
 
 if monitoringWrite {
 		config += `
@@ -5964,7 +6533,7 @@ if monitoringWrite {
 	return config
 }
 
-func testAccContainerCluster_autoprovisioningDefaultsMinCpuPlatform(cluster string, includeMinCpuPlatform bool) string {
+func testAccContainerCluster_autoprovisioningDefaultsMinCpuPlatform(cluster, networkName, subnetworkName string, includeMinCpuPlatform bool) string {
 	minCpuPlatformCfg := ""
 	if includeMinCpuPlatform {
 		minCpuPlatformCfg = `min_cpu_platform = "Intel Haswell"`
@@ -5979,6 +6548,8 @@ resource "google_container_cluster" "with_autoprovisioning" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 1
+  network    = "%s"
+  subnetwork    = "%s"
 
   min_master_version = data.google_container_engine_versions.central1a.latest_master_version
 
@@ -5998,10 +6569,12 @@ resource "google_container_cluster" "with_autoprovisioning" {
       %s
     }
   }
-}`, cluster, minCpuPlatformCfg)
+  deletion_protection = false
+}
+`, cluster, networkName, subnetworkName, minCpuPlatformCfg)
 }
 
-func testAccContainerCluster_autoprovisioningDefaultsUpgradeSettings(clusterName string, maxSurge, maxUnavailable int, strategy string) string {
+func testAccContainerCluster_autoprovisioningDefaultsUpgradeSettings(clusterName, networkName, subnetworkName string, maxSurge, maxUnavailable int, strategy string) string {
   blueGreenSettings := ""
   if strategy == "BLUE_GREEN" {
     blueGreenSettings = `
@@ -6043,11 +6616,14 @@ func testAccContainerCluster_autoprovisioningDefaultsUpgradeSettings(clusterName
           }
         }
       }
+      deletion_protection = false
+      network    = "%s"
+      subnetwork    = "%s"
     }
-  `, clusterName, maxSurge, maxUnavailable, strategy, blueGreenSettings)
+  `, clusterName, maxSurge, maxUnavailable, strategy, blueGreenSettings, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_autoprovisioningDefaultsUpgradeSettingsWithBlueGreenStrategy(clusterName string, duration, strategy string) string {
+func testAccContainerCluster_autoprovisioningDefaultsUpgradeSettingsWithBlueGreenStrategy(clusterName, networkName, subnetworkName string, duration, strategy string) string {
 	return fmt.Sprintf(`
       resource "google_container_cluster" "with_autoprovisioning_upgrade_settings" {
         name               = "%s"
@@ -6080,11 +6656,14 @@ func testAccContainerCluster_autoprovisioningDefaultsUpgradeSettingsWithBlueGree
             }
           }
         }
+        deletion_protection = false
+        network    = "%s"
+        subnetwork    = "%s"
       }
-    `, clusterName, strategy, duration, duration)
+    `, clusterName, strategy, duration, duration, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_autoprovisioningDefaultsDiskSizeGb(cluster string, includeDiskSizeGb bool) string {
+func testAccContainerCluster_autoprovisioningDefaultsDiskSizeGb(cluster, networkName, subnetworkName string, includeDiskSizeGb bool) string {
 	DiskSizeGbCfg := ""
 	if includeDiskSizeGb {
 		DiskSizeGbCfg = `disk_size = 120`
@@ -6113,10 +6692,14 @@ resource "google_container_cluster" "with_autoprovisioning" {
       %s
     }
   }
-}`, cluster, DiskSizeGbCfg)
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
+}
+`, cluster, DiskSizeGbCfg, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_autoprovisioningDefaultsDiskType(cluster string, includeDiskType bool) string {
+func testAccContainerCluster_autoprovisioningDefaultsDiskType(cluster, networkName, subnetworkName string, includeDiskType bool) string {
 	DiskTypeCfg := ""
 	if includeDiskType {
 		DiskTypeCfg = `disk_type = "pd-balanced"`
@@ -6145,10 +6728,14 @@ resource "google_container_cluster" "with_autoprovisioning" {
       %s
     }
   }
-}`, cluster, DiskTypeCfg)
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
+}
+`, cluster, DiskTypeCfg, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_autoprovisioningDefaultsImageType(cluster string, includeImageType bool) string {
+func testAccContainerCluster_autoprovisioningDefaultsImageType(cluster, networkName, subnetworkName string, includeImageType bool) string {
 	imageTypeCfg := ""
 	if includeImageType {
 		imageTypeCfg = `image_type = "COS_CONTAINERD"`
@@ -6177,10 +6764,14 @@ resource "google_container_cluster" "with_autoprovisioning" {
       %s
     }
   }
-}`, cluster, imageTypeCfg)
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
+}
+`, cluster, imageTypeCfg, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_autoprovisioningDefaultsBootDiskKmsKey(clusterName, kmsKeyName string) string {
+func testAccContainerCluster_autoprovisioningDefaultsBootDiskKmsKey(clusterName, kmsKeyName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "nap_boot_disk_kms_key" {
   name               = "%s"
@@ -6203,11 +6794,14 @@ resource "google_container_cluster" "nap_boot_disk_kms_key" {
 	  boot_disk_kms_key = "%s"
     }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, kmsKeyName)
+`, clusterName, kmsKeyName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_autoprovisioningDefaultsShieldedInstance(cluster string) string {
+func testAccContainerCluster_autoprovisioningDefaultsShieldedInstance(cluster, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
   location = "us-central1-a"
@@ -6228,16 +6822,20 @@ resource "google_container_cluster" "nap_shielded_instance" {
       maximum       = 2048
     }
     auto_provisioning_defaults {
-	  shielded_instance_config {
-	    enable_integrity_monitoring = true
-	    enable_secure_boot          = true
-	  }
+      shielded_instance_config {
+        enable_integrity_monitoring = true
+        enable_secure_boot          = true
+      }
     }
   }
-}`, cluster)
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
+}
+`, cluster, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withNodePoolAutoscaling(cluster, np string) string {
+func testAccContainerCluster_withNodePoolAutoscaling(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_node_pool" {
   name     = "%s"
@@ -6251,11 +6849,14 @@ resource "google_container_cluster" "with_node_pool" {
       max_node_count = 3
     }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, cluster, np)
+`, cluster, np, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withNodePoolUpdateAutoscaling(cluster, np string) string {
+func testAccContainerCluster_withNodePoolUpdateAutoscaling(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_node_pool" {
   name     = "%s"
@@ -6269,11 +6870,14 @@ resource "google_container_cluster" "with_node_pool" {
       max_node_count = 5
     }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, cluster, np)
+`, cluster, np, networkName, subnetworkName)
 }
 
-func testAccContainerRegionalCluster_withNodePoolCIA(cluster, np string) string {
+func testAccContainerRegionalCluster_withNodePoolCIA(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "uscentral1a" {
   location = "us-central1-a"
@@ -6293,11 +6897,14 @@ resource "google_container_cluster" "with_node_pool" {
       location_policy = "BALANCED"
     }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, cluster, np)
+`, cluster, np, networkName, subnetworkName)
 }
 
-func testAccContainerRegionalClusterUpdate_withNodePoolCIA(cluster, np string) string {
+func testAccContainerRegionalClusterUpdate_withNodePoolCIA(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "uscentral1a" {
   location = "us-central1-a"
@@ -6317,11 +6924,14 @@ resource "google_container_cluster" "with_node_pool" {
       location_policy = "ANY"
     }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, cluster, np)
+`, cluster, np, networkName, subnetworkName)
 }
 
-func testAccContainerRegionalCluster_withNodePoolBasic(cluster, nodePool string) string {
+func testAccContainerRegionalCluster_withNodePoolBasic(cluster, nodePool, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "uscentral1a" {
   location = "us-central1-a"
@@ -6336,8 +6946,11 @@ resource "google_container_cluster" "with_node_pool" {
     name               = "%s"
     initial_node_count = 2
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, cluster, nodePool)
+`, cluster, nodePool, networkName, subnetworkName)
 }
 
 func testAccContainerCluster_withNodePoolNamePrefix(cluster, npPrefix string) string {
@@ -6350,11 +6963,12 @@ resource "google_container_cluster" "with_node_pool_name_prefix" {
     name_prefix = "%s"
     node_count  = 2
   }
+  deletion_protection = false
 }
 `, cluster, npPrefix)
 }
 
-func testAccContainerCluster_withNodePoolMultiple(cluster, npPrefix string) string {
+func testAccContainerCluster_withNodePoolMultiple(cluster, npPrefix, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_node_pool_multiple" {
   name     = "%s"
@@ -6369,8 +6983,11 @@ resource "google_container_cluster" "with_node_pool_multiple" {
     name       = "%s-two"
     node_count = 3
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, cluster, npPrefix, npPrefix)
+`, cluster, npPrefix, npPrefix, networkName, subnetworkName)
 }
 
 func testAccContainerCluster_withNodePoolConflictingNameFields(cluster, npPrefix string) string {
@@ -6385,11 +7002,12 @@ resource "google_container_cluster" "with_node_pool_multiple" {
     name_prefix = "%s"
     node_count  = 1
   }
+  deletion_protection = false
 }
 `, cluster, npPrefix, npPrefix)
 }
 
-func testAccContainerCluster_withNodePoolNodeConfig(cluster, np string) string {
+func testAccContainerCluster_withNodePoolNodeConfig(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_node_pool_node_config" {
   name     = "%s"
@@ -6419,11 +7037,14 @@ resource "google_container_cluster" "with_node_pool_node_config" {
       tags = ["foo", "bar"]
     }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, cluster, np)
+`, cluster, np, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withMaintenanceWindow(clusterName string, startTime string) string {
+func testAccContainerCluster_withMaintenanceWindow(clusterName, startTime, networkName, subnetworkName string) string {
 	maintenancePolicy := ""
 	if len(startTime) > 0 {
 		maintenancePolicy = fmt.Sprintf(`
@@ -6440,11 +7061,14 @@ resource "google_container_cluster" "with_maintenance_window" {
   location           = "us-central1-a"
   initial_node_count = 1
   %s
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, maintenancePolicy)
+`, clusterName, maintenancePolicy, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withRecurringMaintenanceWindow(clusterName string, startTime, endTime string) string {
+func testAccContainerCluster_withRecurringMaintenanceWindow(clusterName, startTime, endTime, networkName, subnetworkName string) string {
 	maintenancePolicy := ""
 	if len(startTime) > 0 {
 		maintenancePolicy = fmt.Sprintf(`
@@ -6463,12 +7087,15 @@ resource "google_container_cluster" "with_recurring_maintenance_window" {
   location           = "us-central1-a"
   initial_node_count = 1
   %s
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, maintenancePolicy)
+`, clusterName, maintenancePolicy, networkName, subnetworkName)
 
 }
 
-func testAccContainerCluster_withExclusion_RecurringMaintenanceWindow(clusterName string, w1startTime, w1endTime, w2startTime, w2endTime string) string {
+func testAccContainerCluster_withExclusion_RecurringMaintenanceWindow(clusterName string, w1startTime, w1endTime, w2startTime, w2endTime, networkName, subnetworkName string) string {
 
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_maintenance_exclusion_window" {
@@ -6477,27 +7104,30 @@ resource "google_container_cluster" "with_maintenance_exclusion_window" {
   initial_node_count = 1
 
   maintenance_policy {
-	recurring_window {
-		start_time = "%s"
-		end_time = "%s"
-		recurrence = "FREQ=DAILY"
-	}
-	maintenance_exclusion {
-		exclusion_name = "batch job"
-		start_time = "%s"
-		end_time = "%s"
-	}
-	maintenance_exclusion {
-		exclusion_name = "holiday data load"
-		start_time = "%s"
-		end_time = "%s"
-	}
- }
+    recurring_window {
+      start_time = "%s"
+      end_time = "%s"
+      recurrence = "FREQ=DAILY"
+    }
+    maintenance_exclusion {
+      exclusion_name = "batch job"
+      start_time = "%s"
+      end_time = "%s"
+    }
+    maintenance_exclusion {
+      exclusion_name = "holiday data load"
+      start_time = "%s"
+      end_time = "%s"
+    }
+  }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, w1startTime, w1endTime, w1startTime, w1endTime, w2startTime, w2endTime)
+`, clusterName, w1startTime, w1endTime, w1startTime, w1endTime, w2startTime, w2endTime, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withExclusionOptions_RecurringMaintenanceWindow(cclusterName string, w1startTime, w1endTime, w2startTime, w2endTime string, scope1, scope2 string) string {
+func testAccContainerCluster_withExclusionOptions_RecurringMaintenanceWindow(cclusterName, w1startTime, w1endTime, w2startTime, w2endTime, scope1, scope2, networkName, subnetworkName string) string {
 
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_maintenance_exclusion_options" {
@@ -6506,33 +7136,36 @@ resource "google_container_cluster" "with_maintenance_exclusion_options" {
   initial_node_count = 1
 
   maintenance_policy {
-	recurring_window {
-		start_time = "%s"
-		end_time = "%s"
-		recurrence = "FREQ=DAILY"
-	}
-	maintenance_exclusion {
-		exclusion_name = "batch job"
-		start_time = "%s"
-		end_time = "%s"
-		exclusion_options {
-			scope = "%s"
-    	}
-	}
-	maintenance_exclusion {
-		exclusion_name = "holiday data load"
-		start_time = "%s"
-		end_time = "%s"
-		exclusion_options {
-			scope = "%s"
-    	}
-	}
- }
+    recurring_window {
+      start_time = "%s"
+      end_time = "%s"
+      recurrence = "FREQ=DAILY"
+    }
+    maintenance_exclusion {
+      exclusion_name = "batch job"
+      start_time = "%s"
+      end_time = "%s"
+      exclusion_options {
+        scope = "%s"
+      }
+    }
+    maintenance_exclusion {
+      exclusion_name = "holiday data load"
+      start_time = "%s"
+      end_time = "%s"
+      exclusion_options {
+        scope = "%s"
+      }
+    }
+  }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, cclusterName, w1startTime, w1endTime, w1startTime, w1endTime, scope1, w2startTime, w2endTime, scope2)
+`, cclusterName, w1startTime, w1endTime, w1startTime, w1endTime, scope1, w2startTime, w2endTime, scope2, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_NoExclusionOptions_RecurringMaintenanceWindow(cclusterName string, w1startTime, w1endTime, w2startTime, w2endTime string) string {
+func testAccContainerCluster_NoExclusionOptions_RecurringMaintenanceWindow(cclusterName, w1startTime, w1endTime, w2startTime, w2endTime, networkName, subnetworkName string) string {
 
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_maintenance_exclusion_options" {
@@ -6541,62 +7174,68 @@ resource "google_container_cluster" "with_maintenance_exclusion_options" {
   initial_node_count = 1
 
   maintenance_policy {
-	recurring_window {
-		start_time = "%s"
-		end_time = "%s"
-		recurrence = "FREQ=DAILY"
-	}
-	maintenance_exclusion {
-		exclusion_name = "batch job"
-		start_time = "%s"
-		end_time = "%s"
-	}
-	maintenance_exclusion {
-		exclusion_name = "holiday data load"
-		start_time = "%s"
-		end_time = "%s"
-	}
- }
+    recurring_window {
+      start_time = "%s"
+      end_time = "%s"
+      recurrence = "FREQ=DAILY"
+    }
+    maintenance_exclusion {
+      exclusion_name = "batch job"
+      start_time = "%s"
+      end_time = "%s"
+    }
+    maintenance_exclusion {
+      exclusion_name = "holiday data load"
+      start_time = "%s"
+      end_time = "%s"
+    }
+  }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, cclusterName, w1startTime, w1endTime, w1startTime, w1endTime, w2startTime, w2endTime)
+`, cclusterName, w1startTime, w1endTime, w1startTime, w1endTime, w2startTime, w2endTime, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_updateExclusionOptions_RecurringMaintenanceWindow(cclusterName string, w1startTime, w1endTime, w2startTime, w2endTime string, scope1, scope2 string) string {
+func testAccContainerCluster_updateExclusionOptions_RecurringMaintenanceWindow(cclusterName, w1startTime, w1endTime, w2startTime, w2endTime, scope1, scope2, networkName, subnetworkName string) string {
 
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_maintenance_exclusion_options" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
 
   maintenance_policy {
-	recurring_window {
-		start_time = "%s"
-		end_time = "%s"
-		recurrence = "FREQ=DAILY"
-	}
-	maintenance_exclusion {
-		exclusion_name = "batch job"
-		start_time = "%s"
-		end_time = "%s"
-		exclusion_options {
-			scope = "%s"
-    	}
-	}
-	maintenance_exclusion {
-		exclusion_name = "holiday data load"
-		start_time = "%s"
-		end_time = "%s"
-		exclusion_options {
-			scope = "%s"
-    	}
-	}
- }
+    recurring_window {
+      start_time = "%s"
+      end_time = "%s"
+      recurrence = "FREQ=DAILY"
+    }
+    maintenance_exclusion {
+      exclusion_name = "batch job"
+      start_time = "%s"
+      end_time = "%s"
+      exclusion_options {
+        scope = "%s"
+      }
+    }
+    maintenance_exclusion {
+      exclusion_name = "holiday data load"
+      start_time = "%s"
+      end_time = "%s"
+      exclusion_options {
+        scope = "%s"
+      }
+    }
+  }
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, cclusterName, w1startTime, w1endTime, w1startTime, w1endTime, scope1, w2startTime, w2endTime, scope2)
+`, cclusterName, w1startTime, w1endTime, w1startTime, w1endTime, scope1, w2startTime, w2endTime, scope2, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withExclusion_NoMaintenanceWindow(clusterName string, w1startTime, w1endTime string) string {
+func testAccContainerCluster_withExclusion_NoMaintenanceWindow(clusterName string, w1startTime, w1endTime, networkName, subnetworkName string) string {
 
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_maintenance_exclusion_window" {
@@ -6605,17 +7244,20 @@ resource "google_container_cluster" "with_maintenance_exclusion_window" {
   initial_node_count = 1
 
   maintenance_policy {
-	recurring_window {
-		start_time = "%s"
-		end_time = "%s"
-		recurrence = "FREQ=DAILY"
-	}
- }
+    recurring_window {
+      start_time = "%s"
+      end_time = "%s"
+      recurrence = "FREQ=DAILY"
+    }
+  }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, w1startTime, w1endTime)
+`, clusterName, w1startTime, w1endTime, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withExclusion_DailyMaintenanceWindow(clusterName string, w1startTime, w1endTime string) string {
+func testAccContainerCluster_withExclusion_DailyMaintenanceWindow(clusterName, w1startTime, w1endTime, networkName, subnetworkName string) string {
 
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_maintenance_exclusion_window" {
@@ -6624,17 +7266,20 @@ resource "google_container_cluster" "with_maintenance_exclusion_window" {
   initial_node_count = 1
 
   maintenance_policy {
-	daily_maintenance_window {
-		start_time = "03:00"
-	}
-	maintenance_exclusion {
-		exclusion_name = "batch job"
-		start_time = "%s"
-		end_time = "%s"
-	}
- }
+    daily_maintenance_window {
+      start_time = "03:00"
+    }
+    maintenance_exclusion {
+      exclusion_name = "batch job"
+      start_time = "%s"
+      end_time = "%s"
+    }
+  }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, w1startTime, w1endTime)
+`, clusterName, w1startTime, w1endTime, networkName, subnetworkName)
 }
 
 func testAccContainerCluster_withIPAllocationPolicy_existingSecondaryRanges(containerNetName string, clusterName string) string {
@@ -6674,6 +7319,7 @@ resource "google_container_cluster" "with_ip_allocation_policy" {
     cluster_secondary_range_name  = "pods"
     services_secondary_range_name = "services"
   }
+  deletion_protection = false
 }
 `, containerNetName, clusterName)
 }
@@ -6706,6 +7352,7 @@ resource "google_container_cluster" "with_ip_allocation_policy" {
     cluster_ipv4_cidr_block  = "10.0.0.0/16"
     services_ipv4_cidr_block = "10.1.0.0/16"
   }
+  deletion_protection = false
 }
 `, containerNetName, clusterName)
 }
@@ -6738,6 +7385,7 @@ resource "google_container_cluster" "with_ip_allocation_policy" {
     cluster_ipv4_cidr_block  = "/16"
     services_ipv4_cidr_block = "/22"
   }
+  deletion_protection = false
 }
 `, containerNetName, clusterName)
 }
@@ -6775,6 +7423,7 @@ resource "google_container_cluster" "with_stack_type" {
         services_ipv4_cidr_block = "10.1.0.0/16"
         stack_type = "IPV4_IPV6"
     }
+	deletion_protection = false
 }
 `, containerNetName, clusterName)
 }
@@ -6809,6 +7458,7 @@ resource "google_container_cluster" "with_stack_type" {
         services_ipv4_cidr_block = "10.1.0.0/16"
         stack_type = "IPV4"
     }
+	deletion_protection = false
 }
 `, containerNetName, clusterName)
 }
@@ -6841,15 +7491,16 @@ resource "google_container_cluster" "with_pco_disabled" {
     ip_allocation_policy {
         cluster_ipv4_cidr_block  = "10.1.0.0/16"
         services_ipv4_cidr_block = "10.2.0.0/16"
-	pod_cidr_overprovision_config {
-		disabled = true
-	}
+		pod_cidr_overprovision_config {
+			disabled = true
+		}
     }
+	deletion_protection = false
 }
 `, containerNetName, clusterName)
 }
 
-func testAccContainerCluster_withResourceUsageExportConfig(clusterName, datasetId, enableMetering string) string {
+func testAccContainerCluster_withResourceUsageExportConfig(clusterName, datasetId, enableMetering, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 provider "google" {
   alias                 = "user-project-override"
@@ -6873,11 +7524,14 @@ resource "google_container_cluster" "with_resource_usage_export_config" {
       dataset_id = google_bigquery_dataset.default.dataset_id
     }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, datasetId, clusterName, enableMetering)
+`, datasetId, clusterName, enableMetering, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withResourceUsageExportConfigNoConfig(clusterName, datasetId string) string {
+func testAccContainerCluster_withResourceUsageExportConfigNoConfig(clusterName, datasetId, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_bigquery_dataset" "default" {
   dataset_id                 = "%s"
@@ -6889,8 +7543,11 @@ resource "google_container_cluster" "with_resource_usage_export_config" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, datasetId, clusterName)
+`, datasetId, clusterName, networkName, subnetworkName)
 }
 
 func testAccContainerCluster_withPrivateClusterConfigMissingCidrBlock(containerNetName, clusterName, location string, autopilotEnabled bool) string {
@@ -6940,6 +7597,7 @@ resource "google_container_cluster" "with_private_cluster" {
     cluster_secondary_range_name  = google_compute_subnetwork.container_subnetwork.secondary_ip_range[0].range_name
     services_secondary_range_name = google_compute_subnetwork.container_subnetwork.secondary_ip_range[1].range_name
   }
+  deletion_protection = false
 }
 `, containerNetName, clusterName, location, autopilotEnabled)
 }
@@ -6995,11 +7653,12 @@ resource "google_container_cluster" "with_private_cluster" {
     cluster_secondary_range_name  = google_compute_subnetwork.container_subnetwork.secondary_ip_range[0].range_name
     services_secondary_range_name = google_compute_subnetwork.container_subnetwork.secondary_ip_range[1].range_name
   }
+  deletion_protection = false
 }
 `, containerNetName, clusterName, masterGlobalAccessEnabled)
 }
 
-func testAccContainerCluster_withPrivateClusterConfigGlobalAccessEnabledOnly(clusterName string, masterGlobalAccessEnabled bool) string {
+func testAccContainerCluster_withPrivateClusterConfigGlobalAccessEnabledOnly(clusterName, networkName, subnetworkName string, masterGlobalAccessEnabled bool) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_private_cluster" {
   name               = "%s"
@@ -7011,8 +7670,11 @@ resource "google_container_cluster" "with_private_cluster" {
       enabled = %t
 	}
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, masterGlobalAccessEnabled)
+`, clusterName, masterGlobalAccessEnabled, networkName, subnetworkName)
 }
 
 func testAccContainerCluster_withShieldedNodes(clusterName string, enabled bool) string {
@@ -7023,11 +7685,12 @@ resource "google_container_cluster" "with_shielded_nodes" {
   initial_node_count = 1
 
   enable_shielded_nodes = %v
+  deletion_protection = false
 }
 `, clusterName, enabled)
 }
 
-func testAccContainerCluster_withWorkloadIdentityConfigEnabled(projectID string, clusterName string) string {
+func testAccContainerCluster_withWorkloadIdentityConfigEnabled(projectID, clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_project" "project" {
   project_id = "%s"
@@ -7042,12 +7705,14 @@ resource "google_container_cluster" "with_workload_identity_config" {
     workload_pool = "${data.google_project.project.project_id}.svc.id.goog"
   }
   remove_default_node_pool = true
-
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, projectID, clusterName)
+`, projectID, clusterName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_updateWorkloadIdentityConfig(projectID string, clusterName string, enable bool) string {
+func testAccContainerCluster_updateWorkloadIdentityConfig(projectID, clusterName, networkName, subnetworkName string, enable bool) string {
 	workloadIdentityConfig := ""
 	if enable {
 		workloadIdentityConfig = `
@@ -7071,8 +7736,11 @@ resource "google_container_cluster" "with_workload_identity_config" {
   initial_node_count = 1
   remove_default_node_pool = true
   %s
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, projectID, clusterName, workloadIdentityConfig)
+`, projectID, clusterName, workloadIdentityConfig, networkName, subnetworkName)
 }
 
 
@@ -7179,11 +7847,12 @@ resource "google_container_cluster" "shared_vpc_cluster" {
     google_compute_subnetwork_iam_member.service_network_cloud_services,
     google_compute_subnetwork_iam_member.service_network_gke_user,
   ]
+  deletion_protection = false
 }
 `, projectName, org, billingId, projectName, org, billingId, suffix, suffix, name)
 }
 
-func testAccContainerCluster_withBinaryAuthorizationEnabledBool(clusterName string, enabled bool) string {
+func testAccContainerCluster_withBinaryAuthorizationEnabledBool(clusterName, networkName, subnetworkName string, enabled bool) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_binary_authorization_enabled_bool" {
   name               = "%s"
@@ -7193,20 +7862,11 @@ resource "google_container_cluster" "with_binary_authorization_enabled_bool" {
   binary_authorization {
     enabled = %v
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, enabled)
-}
-
-func testAccContainerCluster_withBinaryAuthorizationEnabledBoolLegacy(clusterName string, enabled bool) string {
-	return fmt.Sprintf(`
-resource "google_container_cluster" "with_binary_authorization_enabled_bool_legacy" {
-  name               = "%s"
-  location           = "us-central1-a"
-  initial_node_count = 1
-
-  enable_binary_authorization = %v
-}
-`, clusterName, enabled)
+`, clusterName, enabled, networkName, subnetworkName)
 }
 
 func testAccContainerCluster_withBinaryAuthorizationEvaluationMode(clusterName string, autopilot_enabled bool, evaluation_mode string) string {
@@ -7222,6 +7882,7 @@ resource "google_container_cluster" "with_binary_authorization_evaluation_mode"
   binary_authorization {
     evaluation_mode = "%s"
   }
+  deletion_protection = false
 }
 `, clusterName, autopilot_enabled, evaluation_mode)
 }
@@ -7275,6 +7936,7 @@ resource "google_container_cluster" "with_flexible_cidr" {
   }
 
   default_max_pods_per_node = 100
+  deletion_protection = false
 }
 `, containerNetName, clusterName)
 }
@@ -7307,6 +7969,7 @@ resource "google_container_cluster" "cidr_error_preempt" {
     cluster_ipv4_cidr_block  = "10.0.0.0/16"
     services_ipv4_cidr_block = "10.1.0.0/16"
   }
+  deletion_protection = false
 }
 `, containerNetName, clusterName)
 }
@@ -7329,6 +7992,7 @@ resource "google_container_cluster" "cidr_error_overlap" {
     cluster_ipv4_cidr_block  = "10.0.0.0/16"
     services_ipv4_cidr_block = "10.1.0.0/16"
   }
+  deletion_protection = false
 }
 `, initConfig, secondCluster)
 }
@@ -7339,84 +8003,100 @@ resource "google_container_cluster" "with_resource_labels" {
   name               = "invalid-gke-cluster"
   location           = "%s"
   initial_node_count = 1
+  deletion_protection = false
 }
 `, location)
 }
 
-func testAccContainerCluster_withExternalIpsConfig(projectID string, clusterName string, enabled bool) string {
+func testAccContainerCluster_withExternalIpsConfig(projectID, clusterName, networkName, subnetworkName string, enabled bool) string {
 	return fmt.Sprintf(`
-	data "google_project" "project" {
-  		project_id = "%s"
-	}
+data "google_project" "project" {
+    project_id = "%s"
+}
 
-	resource "google_container_cluster" "with_external_ips_config" {
-		name               = "%s"
-		location           = "us-central1-a"
-		initial_node_count = 1
-		service_external_ips_config {
-			enabled = %v
-		}
-	}`, projectID, clusterName, enabled)
+resource "google_container_cluster" "with_external_ips_config" {
+  name               = "%s"
+  location           = "us-central1-a"
+  initial_node_count = 1
+  service_external_ips_config {
+    enabled = %v
+  }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
+}
+`, projectID, clusterName, enabled, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withMeshCertificatesConfigEnabled(projectID string, clusterName string) string {
+func testAccContainerCluster_withMeshCertificatesConfigEnabled(projectID, clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
-	data "google_project" "project" {
-		project_id = "%s"
-	}
+data "google_project" "project" {
+  project_id = "%s"
+}
 
-	resource "google_container_cluster" "with_mesh_certificates_config" {
-	name               = "%s"
-	location           = "us-central1-a"
-	initial_node_count = 1
-	remove_default_node_pool = true
-	workload_identity_config {
-		workload_pool = "${data.google_project.project.project_id}.svc.id.goog"
-	}
-	mesh_certificates {
-		enable_certificates = true
-	}
-	}
-`, projectID, clusterName)
+resource "google_container_cluster" "with_mesh_certificates_config" {
+  name               = "%s"
+  location           = "us-central1-a"
+  initial_node_count = 1
+  remove_default_node_pool = true
+  workload_identity_config {
+    workload_pool = "${data.google_project.project.project_id}.svc.id.goog"
+  }
+  mesh_certificates {
+    enable_certificates = true
+  }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
+}
+`, projectID, clusterName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_updateMeshCertificatesConfig(projectID string, clusterName string, enabled bool) string {
+func testAccContainerCluster_updateMeshCertificatesConfig(projectID, clusterName, networkName, subnetworkName string, enabled bool) string {
 	return fmt.Sprintf(`
-	data "google_project" "project" {
-  		project_id = "%s"
-	}
+data "google_project" "project" {
+    project_id = "%s"
+}
 
-	resource "google_container_cluster" "with_mesh_certificates_config" {
-		name               = "%s"
-		location           = "us-central1-a"
-		initial_node_count = 1
-		remove_default_node_pool = true
-		workload_identity_config {
-			workload_pool = "${data.google_project.project.project_id}.svc.id.goog"
-			}
-			mesh_certificates {
-			enable_certificates = %v
-			}
-	}`, projectID, clusterName, enabled)
+resource "google_container_cluster" "with_mesh_certificates_config" {
+  name               = "%s"
+  location           = "us-central1-a"
+  initial_node_count = 1
+  remove_default_node_pool = true
+  workload_identity_config {
+    workload_pool = "${data.google_project.project.project_id}.svc.id.goog"
+    }
+  mesh_certificates {
+    enable_certificates = %v
+  }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
+}
+`, projectID, clusterName, enabled, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_updateCostManagementConfig(projectID string, clusterName string, enabled bool) string {
+func testAccContainerCluster_updateCostManagementConfig(projectID, clusterName, networkName, subnetworkName string, enabled bool) string {
 	return fmt.Sprintf(`
-	data "google_project" "project" {
-  		project_id = "%s"
-	}
+data "google_project" "project" {
+  project_id = "%s"
+}
 
-	resource "google_container_cluster" "with_cost_management_config" {
-		name               = "%s"
-		location           = "us-central1-a"
-		initial_node_count = 1
-		cost_management_config {
-			enabled = %v
-		}
-	}`, projectID, clusterName, enabled)
+resource "google_container_cluster" "with_cost_management_config" {
+  name               = "%s"
+  location           = "us-central1-a"
+  initial_node_count = 1
+  cost_management_config {
+    enabled = %v
+  }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
+}
+`, projectID, clusterName, enabled, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withDatabaseEncryption(clusterName string, kmsData acctest.BootstrappedKMS) string {
+func testAccContainerCluster_withDatabaseEncryption(clusterName string, kmsData acctest.BootstrappedKMS, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_project" "project" {
 }
@@ -7449,8 +8129,11 @@ resource "google_container_cluster" "primary" {
     state    = "ENCRYPTED"
     key_name = "%[2]s"
   }
+  deletion_protection = false
+  network    = "%[4]s"
+  subnetwork = "%[5]s"
 }
-`, kmsData.KeyRing.Name, kmsData.CryptoKey.Name, clusterName)
+`, kmsData.KeyRing.Name, kmsData.CryptoKey.Name, clusterName, networkName, subnetworkName)
 }
 
 func testAccContainerCluster_withDatapathProvider(clusterName, datapathProvider string) string {
@@ -7467,6 +8150,7 @@ resource "google_container_cluster" "primary" {
   release_channel {
     channel = "RAPID"
   }
+  deletion_protection = false
 }
 `, clusterName, datapathProvider)
 }
@@ -7515,11 +8199,12 @@ resource "google_container_cluster" "with_private_cluster" {
     cluster_secondary_range_name  = google_compute_subnetwork.container_subnetwork.secondary_ip_range[0].range_name
     services_secondary_range_name = google_compute_subnetwork.container_subnetwork.secondary_ip_range[1].range_name
   }
+  deletion_protection = false
 }
 `, containerNetName, clusterName)
 }
 
-func testAccContainerCluster_withEnableKubernetesAlpha(cluster, np string) string {
+func testAccContainerCluster_withEnableKubernetesAlpha(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "primary" {
   name               = "%s"
@@ -7534,11 +8219,14 @@ resource "google_container_cluster" "primary" {
 		auto_upgrade = false
 	}
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, cluster, np)
+`, cluster, np, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withoutEnableKubernetesBetaAPIs(clusterName string) string {
+func testAccContainerCluster_withoutEnableKubernetesBetaAPIs(clusterName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
   location = "us-central1-a"
@@ -7549,11 +8237,14 @@ resource "google_container_cluster" "primary" {
   location           = "us-central1-a"
   min_master_version = data.google_container_engine_versions.central1a.release_channel_latest_version["STABLE"]
   initial_node_count = 1
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName)
+`, clusterName, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withEnableKubernetesBetaAPIs(cluster string) string {
+func testAccContainerCluster_withEnableKubernetesBetaAPIs(cluster, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "uscentral1a" {
   location = "us-central1-a"
@@ -7564,6 +8255,7 @@ resource "google_container_cluster" "primary" {
   location           = "us-central1-a"
   min_master_version = data.google_container_engine_versions.uscentral1a.release_channel_latest_version["STABLE"]
   initial_node_count = 1
+  deletion_protection = false
 
   # This feature has been available since GKE 1.27, and currently the only
   # supported Beta API is authentication.k8s.io/v1beta1/selfsubjectreviews.
@@ -7588,8 +8280,10 @@ resource "google_container_cluster" "primary" {
   enable_k8s_beta_apis {
     enabled_apis = ["authentication.k8s.io/v1beta1/selfsubjectreviews"]
   }
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, cluster)
+`, cluster, networkName, subnetworkName)
 }
 
 func testAccContainerCluster_withIPv4Error(name string) string {
@@ -7603,6 +8297,7 @@ resource "google_container_cluster" "primary" {
     enable_private_nodes    = false
     master_ipv4_cidr_block  = "10.42.0.0/28"
   }
+  deletion_protection = false
 }
 `, name)
 }
@@ -7668,6 +8363,7 @@ resource "google_container_cluster" "with_autopilot" {
 	name               = "%s"
 	location           = "%s"
 	enable_autopilot   = %v
+	deletion_protection = false
 	min_master_version = "latest"
 	release_channel {
 		channel = "RAPID"
@@ -7700,113 +8396,132 @@ resource "google_container_cluster" "with_autopilot" {
 	return config
 }
 
-func testAccContainerCluster_withDNSConfig(clusterName string, clusterDns string, clusterDnsDomain string, clusterDnsScope string) string {
+func testAccContainerCluster_withDNSConfig(clusterName, clusterDns, clusterDnsDomain, clusterDnsScope, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_dns_config" {
-	name               = "%s"
-	location           = "us-central1-f"
-	initial_node_count = 1
-	dns_config {
-		cluster_dns 	   = "%s"
-		cluster_dns_domain = "%s"
-		cluster_dns_scope  = "%s"
-	}
+  name               = "%s"
+  location           = "us-central1-f"
+  initial_node_count = 1
+  dns_config {
+    cluster_dns 	   = "%s"
+    cluster_dns_domain = "%s"
+    cluster_dns_scope  = "%s"
+  }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, clusterDns, clusterDnsDomain, clusterDnsScope)
+`, clusterName, clusterDns, clusterDnsDomain, clusterDnsScope, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withGatewayApiConfig(clusterName string, gatewayApiChannel string) string {
+func testAccContainerCluster_withGatewayApiConfig(clusterName, gatewayApiChannel, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "uscentral1a" {
   location = "us-central1-a"
 }
 
 resource "google_container_cluster" "primary" {
-	name               = "%s"
-	location           = "us-central1-f"
-	initial_node_count = 1
-	min_master_version = data.google_container_engine_versions.uscentral1a.release_channel_latest_version["STABLE"]
-	gateway_api_config {
-		channel = "%s"
-	}
+  name               = "%s"
+  location           = "us-central1-f"
+  initial_node_count = 1
+  min_master_version = data.google_container_engine_versions.uscentral1a.release_channel_latest_version["STABLE"]
+  gateway_api_config {
+    channel = "%s"
+  }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, clusterName, gatewayApiChannel)
+`, clusterName, gatewayApiChannel, networkName, subnetworkName)
 }
 
-<% unless version == 'ga' -%>
-func testAccContainerCluster_withIdentityServiceConfigEnabled(name string) string {
+func testAccContainerCluster_withIdentityServiceConfigEnabled(name, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "primary" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 1
   identity_service_config {
-	  enabled = true
+    enabled = true
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, name)
+`, name, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withIdentityServiceConfigUpdated(name string) string {
+func testAccContainerCluster_withIdentityServiceConfigUpdated(name, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "primary" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 1
   identity_service_config {
-	  enabled = false
+    enabled = false
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, name)
+`, name, networkName, subnetworkName)
 }
-<% end -%>
 
-func testAccContainerCluster_withLoggingConfigEnabled(name string) string {
+func testAccContainerCluster_withLoggingConfigEnabled(name, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "primary" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 1
   logging_config {
-	  enable_components = [ "SYSTEM_COMPONENTS" ]
+    enable_components = [ "SYSTEM_COMPONENTS" ]
   }
   monitoring_config {
       enable_components = [ "SYSTEM_COMPONENTS" ]
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, name)
+`, name, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withLoggingConfigDisabled(name string) string {
+func testAccContainerCluster_withLoggingConfigDisabled(name, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "primary" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 1
   logging_config {
-	  enable_components = []
+    enable_components = []
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, name)
+`, name, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withLoggingConfigUpdated(name string) string {
+func testAccContainerCluster_withLoggingConfigUpdated(name, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "primary" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 1
   logging_config {
-	  enable_components = [ "SYSTEM_COMPONENTS", "APISERVER", "CONTROLLER_MANAGER", "SCHEDULER"]
+    enable_components = [ "SYSTEM_COMPONENTS", "APISERVER", "CONTROLLER_MANAGER", "SCHEDULER"]
   }
   monitoring_config {
-	  enable_components = [ "SYSTEM_COMPONENTS" ]
+    enable_components = [ "SYSTEM_COMPONENTS" ]
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, name)
+`, name, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withMonitoringConfigEnabled(name string) string {
+func testAccContainerCluster_withMonitoringConfigEnabled(name, networkName, subnetworkName string) string {
        return fmt.Sprintf(`
 data "google_container_engine_versions" "uscentral1a" {
   location = "us-central1-a"
@@ -7819,11 +8534,14 @@ resource "google_container_cluster" "primary" {
   monitoring_config {
       enable_components = [ "SYSTEM_COMPONENTS", "APISERVER", "CONTROLLER_MANAGER", "SCHEDULER" ]
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, name)
+`, name, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withMonitoringConfigDisabled(name string) string {
+func testAccContainerCluster_withMonitoringConfigDisabled(name, networkName, subnetworkName string) string {
        return fmt.Sprintf(`
 resource "google_container_cluster" "primary" {
   name               = "%s"
@@ -7832,11 +8550,14 @@ resource "google_container_cluster" "primary" {
   monitoring_config {
       enable_components = []
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, name)
+`, name, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withMonitoringConfigUpdated(name string) string {
+func testAccContainerCluster_withMonitoringConfigUpdated(name, networkName, subnetworkName string) string {
        return fmt.Sprintf(`
 resource "google_container_cluster" "primary" {
   name               = "%s"
@@ -7845,11 +8566,14 @@ resource "google_container_cluster" "primary" {
   monitoring_config {
          enable_components = [ "SYSTEM_COMPONENTS", "APISERVER", "CONTROLLER_MANAGER" ]
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, name)
+`, name, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withMonitoringConfigPrometheusUpdated(name string) string {
+func testAccContainerCluster_withMonitoringConfigPrometheusUpdated(name, networkName, subnetworkName string) string {
        return fmt.Sprintf(`
 resource "google_container_cluster" "primary" {
   name               = "%s"
@@ -7861,11 +8585,14 @@ resource "google_container_cluster" "primary" {
                  enabled = true
          }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, name)
+`, name, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withMonitoringConfigPrometheusOnly(name string) string {
+func testAccContainerCluster_withMonitoringConfigPrometheusOnly(name, networkName, subnetworkName string) string {
        return fmt.Sprintf(`
 resource "google_container_cluster" "primary" {
   name               = "%s"
@@ -7877,11 +8604,14 @@ resource "google_container_cluster" "primary" {
                 enabled = true
          }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, name)
+`, name, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withMonitoringConfigPrometheusOnly2(name string) string {
+func testAccContainerCluster_withMonitoringConfigPrometheusOnly2(name, networkName, subnetworkName string) string {
        return fmt.Sprintf(`
 resource "google_container_cluster" "primary" {
   name               = "%s"
@@ -7892,8 +8622,11 @@ resource "google_container_cluster" "primary" {
                 enabled = true
          }
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, name)
+`, name, networkName, subnetworkName)
 }
 
 func testAccContainerCluster_withMonitoringConfigAdvancedDatapathObservabilityConfigEnabled(name string) string {
@@ -7941,6 +8674,7 @@ resource "google_container_cluster" "primary" {
       relay_mode     = "INTERNAL_VPC_LB"
     }
   }
+  deletion_protection = false
 }
 `, name, name)
 }
@@ -7990,11 +8724,12 @@ resource "google_container_cluster" "primary" {
       relay_mode     = "DISABLED"
     }
   }
+  deletion_protection = false
 }
 `, name, name)
 }
 
-func testAccContainerCluster_withSoleTenantGroup(name string) string {
+func testAccContainerCluster_withSoleTenantGroup(name, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_compute_node_template" "soletenant-tmpl" {
   name      = "%s"
@@ -8007,7 +8742,7 @@ resource "google_compute_node_group" "group" {
   zone        = "us-central1-f"
   description = "example google_compute_node_group for Terraform Google Provider"
 
-  size          = 1
+  initial_size	= 1
   node_template = google_compute_node_template.soletenant-tmpl.id
 }
 
@@ -8021,8 +8756,11 @@ resource "google_container_cluster" "primary" {
     disk_type       = "pd-ssd"
     node_group = google_compute_node_group.group.name
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, name, name, name)
+`, name, name, name, networkName, subnetworkName)
 }
 
 <% unless version == 'ga' -%>
@@ -8078,45 +8816,14 @@ resource "google_container_cluster" "with_tpu_config" {
 		cluster_secondary_range_name  = google_compute_subnetwork.container_subnetwork.secondary_ip_range[0].range_name
 		services_secondary_range_name = google_compute_subnetwork.container_subnetwork.secondary_ip_range[1].range_name
 	}
+	deletion_protection = false
 }
 `, network, cluster)
 }
 <% end -%>
 
-func testAccContainerCluster_failedCreation(cluster, project string) string {
-	return fmt.Sprintf(`
-resource "google_container_cluster" "primary" {
-  name               = "%s"
-  project            = "%s"
-  location           = "us-central1-a"
-  initial_node_count = 1
-
-  workload_identity_config {
-    workload_pool = "%s.svc.id.goog"
-  }
-
-  timeouts {
-    create = "40s"
-  }
-}`, cluster, project, project)
-}
-
-func testAccContainerCluster_failedCreation_update(cluster, project string) string {
-	return fmt.Sprintf(`
-resource "google_container_cluster" "primary" {
-  name               = "%s"
-  project            = "%s"
-  location           = "us-central1-a"
-  initial_node_count = 1
-
-  workload_identity_config {
-    workload_pool = "%s.svc.id.goog"
-  }
-}`, cluster, project, project)
-}
-
 <% unless version == 'ga' -%>
-func testAccContainerCluster_withProtectConfig(name string) string {
+func testAccContainerCluster_withProtectConfig(name, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "primary" {
   name               = "%s"
@@ -8129,11 +8836,14 @@ resource "google_container_cluster" "primary" {
 	}
 	workload_vulnerability_mode = "BASIC"
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, name)
+`, name, networkName, subnetworkName)
 }
 
-func testAccContainerCluster_withProtectConfigUpdated(name string) string {
+func testAccContainerCluster_withProtectConfigUpdated(name, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "primary" {
   name               = "%s"
@@ -8146,8 +8856,11 @@ resource "google_container_cluster" "primary" {
 	}
 	workload_vulnerability_mode = "DISABLED"
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
-`, name)
+`, name, networkName, subnetworkName)
 }
 <% end -%>
 
@@ -8158,6 +8871,7 @@ resource "google_container_cluster" "primary" {
   name             = "%s"
   location         = "us-central1"
   enable_autopilot = true
+  deletion_protection = false
 }`, name)
 }
 
@@ -8169,6 +8883,7 @@ resource "google_container_cluster" "primary" {
   enable_autopilot = true
   allow_net_admin  = %t
   min_master_version = 1.27
+  deletion_protection = false
 }`, name, enabled)
 }
 
@@ -8177,6 +8892,8 @@ func TestAccContainerCluster_customPlacementPolicy(t *testing.T) {
 	t.Parallel()
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 	np := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
 	policy := fmt.Sprintf("tf-test-policy-%s", acctest.RandString(t, 10))
 
@@ -8186,7 +8903,7 @@ func TestAccContainerCluster_customPlacementPolicy(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerCluster_customPlacementPolicy(cluster, np, policy),
+				Config: testAccContainerCluster_customPlacementPolicy(cluster, np, policy, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_cluster.cluster", "node_pool.0.placement_policy.0.type", "COMPACT"),
 					resource.TestCheckResourceAttr("google_container_cluster.cluster", "node_pool.0.placement_policy.0.policy_name", policy),
@@ -8197,12 +8914,13 @@ func TestAccContainerCluster_customPlacementPolicy(t *testing.T) {
 				ResourceName:      "google_container_cluster.cluster",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
 }
 
-func testAccContainerCluster_customPlacementPolicy(cluster, np, policyName string) string {
+func testAccContainerCluster_customPlacementPolicy(cluster, np, policyName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 
 resource "google_compute_resource_policy" "policy" {
@@ -8230,7 +8948,11 @@ resource "google_container_cluster" "cluster" {
       policy_name = google_compute_resource_policy.policy.name
     }
   }
-}`, policyName, cluster, np)
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
+}
+`, policyName, cluster, np, networkName, subnetworkName)
 }
 
 func testAccContainerCluster_additional_pod_ranges_config(name string, nameCount int) string {
@@ -8309,6 +9031,166 @@ func testAccContainerCluster_additional_pod_ranges_config(name string, nameCount
 			services_secondary_range_name = "gke-autopilot-services"
 			%s
 		}
+		deletion_protection = false
 	}
 	`, name, name, name, aprc)
 }
+
+<% unless version == 'ga' -%>
+func TestAccContainerCluster_withConfidentialBootDisk(t *testing.T) {
+	t.Parallel()
+
+	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	npName := fmt.Sprintf("tf-test-node-pool-%s", acctest.RandString(t, 10))
+	kms := acctest.BootstrapKMSKeyInLocation(t, "us-central1")
+
+	if acctest.BootstrapPSARole(t, "service-", "compute-system", "roles/cloudkms.cryptoKeyEncrypterDecrypter") {
+		t.Fatal("Stopping the test because a role was added to the policy.")
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccContainerCluster_withConfidentialBootDisk(clusterName, npName, kms.CryptoKey.Name),
+			},
+			{
+				ResourceName:            "google_container_cluster.with_confidential_boot_disk",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
+			},
+		},
+	})
+}
+
+func testAccContainerCluster_withConfidentialBootDisk(clusterName, npName, kmsKeyName string) string {
+	return fmt.Sprintf(`
+resource "google_container_cluster" "with_confidential_boot_disk" {
+ name               = "%s"
+ location           = "us-central1-a"
+ release_channel {
+ channel = "RAPID"
+}
+ node_pool {
+  name = "%s"
+  initial_node_count = 1
+  node_config {
+  oauth_scopes = [
+    "https://www.googleapis.com/auth/cloud-platform",
+   ]
+  image_type = "COS_CONTAINERD"
+  boot_disk_kms_key = "%s"
+  machine_type = "n2-standard-2"
+  enable_confidential_storage = true
+  disk_type = "hyperdisk-balanced"
+  }
+}
+ deletion_protection = false
+}
+`, clusterName, npName, kmsKeyName)
+}
+
+func TestAccContainerCluster_withConfidentialBootDiskNodeConfig(t *testing.T) {
+	t.Parallel()
+
+	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	kms := acctest.BootstrapKMSKeyInLocation(t, "us-central1")
+
+	if acctest.BootstrapPSARole(t, "service-", "compute-system", "roles/cloudkms.cryptoKeyEncrypterDecrypter") {
+		t.Fatal("Stopping the test because a role was added to the policy.")
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccContainerCluster_withConfidentialBootDiskNodeConfig(clusterName, kms.CryptoKey.Name),
+			},
+			{
+				ResourceName:            "google_container_cluster.with_confidential_boot_disk_node_config",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
+			},
+		},
+	})
+}
+
+func testAccContainerCluster_withConfidentialBootDiskNodeConfig(clusterName, kmsKeyName string) string {
+	return fmt.Sprintf(`
+resource "google_container_cluster" "with_confidential_boot_disk_node_config" {
+ name               = "%s"
+ location           = "us-central1-a"
+ initial_node_count = 1
+ release_channel {
+   channel = "RAPID"
+  }
+ node_config {
+  oauth_scopes = [
+    "https://www.googleapis.com/auth/cloud-platform",
+  ]
+ image_type = "COS_CONTAINERD"
+ boot_disk_kms_key = "%s"
+ machine_type = "n2-standard-2"
+ enable_confidential_storage = true
+ disk_type = "hyperdisk-balanced"
+ }
+deletion_protection = false
+}
+`, clusterName, kmsKeyName)
+}
+
+func TestAccContainerCluster_withoutConfidentialBootDisk(t *testing.T) {
+	t.Parallel()
+
+	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	npName := fmt.Sprintf("tf-test-cluster-nodepool-%s", acctest.RandString(t, 10))
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccContainerCluster_withoutConfidentialBootDisk(clusterName, npName),
+			},
+			{
+				ResourceName:            "google_container_cluster.without_confidential_boot_disk",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
+			},
+		},
+	})
+}
+func testAccContainerCluster_withoutConfidentialBootDisk(clusterName string, npName string) string {
+	return fmt.Sprintf(`
+resource "google_container_cluster" "without_confidential_boot_disk" {
+ name               = "%s"
+ location           = "us-central1-a"
+ release_channel {
+   channel = "RAPID"
+  }
+ node_pool {
+  name = "%s"
+  initial_node_count = 1
+  node_config {
+  oauth_scopes = [
+   "https://www.googleapis.com/auth/cloud-platform",
+  ]
+  image_type = "COS_CONTAINERD"
+  machine_type = "n2-standard-2"
+  enable_confidential_storage = false
+  disk_type = "pd-balanced"
+  }
+}
+ deletion_protection = false
+}
+`, clusterName, npName)
+}
+<% end -%>
diff --git a/mmv1/third_party/terraform/services/container/resource_container_node_pool.go.erb b/mmv1/third_party/terraform/services/container/resource_container_node_pool.go.erb
index c286914102d5..1bd538dd9794 100644
--- a/mmv1/third_party/terraform/services/container/resource_container_node_pool.go.erb
+++ b/mmv1/third_party/terraform/services/container/resource_container_node_pool.go.erb
@@ -48,6 +48,7 @@ func ResourceContainerNodePool() *schema.Resource {
 		},
 
 		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
 			resourceNodeConfigEmptyGuestAccelerator,
 		),
 
@@ -197,13 +198,11 @@ var schemaNodePool = map[string]*schema.Schema{
 					ForceNew:    true,
 					Description:  `If set, refers to the name of a custom resource policy supplied by the user. The resource policy must be in the same project and region as the node pool. If not found, InvalidArgument error is returned.`,
 				},
-<% unless version == 'ga' -%>
 				"tpu_topology": {
 					Type:        schema.TypeString,
 					Optional:    true,
 					Description: `TPU placement topology for pod slice node pool. https://cloud.google.com/tpu/docs/types-topologies#tpu_topologies`,
 				},
-<% end -%>
 			},
 		},
 	},
@@ -294,15 +293,15 @@ var schemaNodePool = map[string]*schema.Schema{
 				"auto_repair": {
 					Type:        schema.TypeBool,
 					Optional:    true,
-					Default:     false,
-					Description: `Whether the nodes will be automatically repaired.`,
+					Default:     true,
+					Description: `Whether the nodes will be automatically repaired. Enabled by default.`,
 				},
 
 				"auto_upgrade": {
 					Type:        schema.TypeBool,
 					Optional:    true,
-					Default:     false,
-					Description: `Whether the nodes will be automatically upgraded.`,
+					Default:     true,
+					Description: `Whether the nodes will be automatically upgraded. Enabled by default.`,
 				},
 			},
 		},
@@ -581,9 +580,11 @@ func resourceContainerNodePoolCreate(d *schema.ResourceData, meta interface{}) e
 		operation, err = clusterNodePoolsCreateCall.Do()
 
 		if err != nil {
-			if tpgresource.IsFailedPreconditionError(err) {
+			if tpgresource.IsFailedPreconditionError(err) || tpgresource.IsQuotaError(err) {
 				// We get failed precondition errors if the cluster is updating
 				// while we try to add the node pool.
+				// We get quota errors if there the number of running concurrent
+                                // operations reaches the quota.
 				return resource.RetryableError(err)
 			}
 			return resource.NonRetryableError(err)
@@ -786,9 +787,11 @@ func resourceContainerNodePoolDelete(d *schema.ResourceData, meta interface{}) e
 		operation, err = clusterNodePoolsDeleteCall.Do()
 
 		if err != nil {
-			if tpgresource.IsFailedPreconditionError(err) {
+			if tpgresource.IsFailedPreconditionError(err) || tpgresource.IsQuotaError(err) {
 				// We get failed precondition errors if the cluster is updating
 				// while we try to delete the node pool.
+				// We get quota errors if there the number of running concurrent
+				// operations reaches the quota.
 				return resource.RetryableError(err)
 			}
 			return resource.NonRetryableError(err)
@@ -926,15 +929,16 @@ func expandNodePool(d *schema.ResourceData, prefix string) (*container.NodePool,
 	}
 
 	if v, ok := d.GetOk(prefix + "autoscaling"); ok {
-		autoscaling := v.([]interface{})[0].(map[string]interface{})
-		np.Autoscaling = &container.NodePoolAutoscaling{
-			Enabled:           true,
-			MinNodeCount:      int64(autoscaling["min_node_count"].(int)),
-			MaxNodeCount:      int64(autoscaling["max_node_count"].(int)),
-			TotalMinNodeCount: int64(autoscaling["total_min_node_count"].(int)),
-			TotalMaxNodeCount: int64(autoscaling["total_max_node_count"].(int)),
-			LocationPolicy:    autoscaling["location_policy"].(string),
-			ForceSendFields:   []string{"MinNodeCount", "MaxNodeCount", "TotalMinNodeCount", "TotalMaxNodeCount"},
+		if autoscaling, ok := v.([]interface{})[0].(map[string]interface{}); ok {
+			np.Autoscaling = &container.NodePoolAutoscaling{
+				Enabled:           true,
+				MinNodeCount:      int64(autoscaling["min_node_count"].(int)),
+				MaxNodeCount:      int64(autoscaling["max_node_count"].(int)),
+				TotalMinNodeCount: int64(autoscaling["total_min_node_count"].(int)),
+				TotalMaxNodeCount: int64(autoscaling["total_max_node_count"].(int)),
+				LocationPolicy:    autoscaling["location_policy"].(string),
+				ForceSendFields:   []string{"MinNodeCount", "MaxNodeCount", "TotalMinNodeCount", "TotalMaxNodeCount"},
+			}
 		}
 	}
 
@@ -944,9 +948,7 @@ func expandNodePool(d *schema.ResourceData, prefix string) (*container.NodePool,
 			np.PlacementPolicy = &container.PlacementPolicy{
 				Type: placement_policy["type"].(string),
 				PolicyName: placement_policy["policy_name"].(string),
-<% unless version == 'ga' -%>
 				TpuTopology: placement_policy["tpu_topology"].(string),
-<% end -%>
 			}
 		}
 	}
@@ -1111,7 +1113,7 @@ func flattenNodePool(d *schema.ResourceData, config *transport_tpg.Config, np *c
 		"initial_node_count":  np.InitialNodeCount,
 		"node_locations":      schema.NewSet(schema.HashString, tpgresource.ConvertStringArrToInterface(np.Locations)),
 		"node_count":          nodeCount,
-		"node_config":         flattenNodeConfig(np.Config),
+		"node_config":         flattenNodeConfig(np.Config, d.Get(prefix + "node_config")),
 		"instance_group_urls": igmUrls,
 		"managed_instance_group_urls": managedIgmUrls,
 		"version":             np.Version,
@@ -1139,9 +1141,7 @@ func flattenNodePool(d *schema.ResourceData, config *transport_tpg.Config, np *c
 			{
 				"type": np.PlacementPolicy.Type,
 				"policy_name": np.PlacementPolicy.PolicyName,
-<% unless version == 'ga' -%>
 				"tpu_topology": np.PlacementPolicy.TpuTopology,
-<% end -%>
 			},
 		}
 	}
@@ -1343,7 +1343,7 @@ func nodePoolUpdate(d *schema.ResourceData, meta interface{}, nodePoolInfo *Node
 				timeout)
 		}
 
-		if err := tpgresource.RetryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
+		if err := retryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
 				return err
 		}
 		log.Printf("[INFO] Updated autoscaling in Node Pool %s", d.Id())
@@ -1381,14 +1381,70 @@ func nodePoolUpdate(d *schema.ResourceData, meta interface{}, nodePoolInfo *Node
 						timeout)
 				}
 
-				if err := tpgresource.RetryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
+				if err := retryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
 						return err
 				}
 
 				log.Printf("[INFO] Updated logging_variant for node pool %s", name)
 			}
 		}
-		
+
+		if d.HasChange(prefix + "node_config.0.taint") {
+			req := &container.UpdateNodePoolRequest{
+				Name: name,
+			}
+			if v, ok := d.GetOk(prefix + "node_config.0.taint"); ok {
+				taintsList := v.([]interface{})
+				taints := make([]*container.NodeTaint, 0, len(taintsList))
+				for _, v := range taintsList {
+					if v != nil {
+						data := v.(map[string]interface{})
+						taint := &container.NodeTaint{
+							Key:    data["key"].(string),
+							Value:  data["value"].(string),
+							Effect: data["effect"].(string),
+						}
+						taints = append(taints, taint)
+					}
+				}
+				ntaints := &container.NodeTaints{
+					Taints: taints,
+				}
+				req.Taints = ntaints
+			}
+
+			if req.Taints == nil {
+				taints := make([]*container.NodeTaint, 0, 0)
+				ntaints := &container.NodeTaints{
+					Taints: taints,
+				}
+				req.Taints = ntaints
+			}
+
+			updateF := func() error {
+				clusterNodePoolsUpdateCall := config.NewContainerClient(userAgent).Projects.Locations.Clusters.NodePools.Update(nodePoolInfo.fullyQualifiedName(name), req)
+				if config.UserProjectOverride {
+					clusterNodePoolsUpdateCall.Header().Add("X-Goog-User-Project", nodePoolInfo.project)
+				}
+				op, err := clusterNodePoolsUpdateCall.Do()
+				if err != nil {
+					return err
+				}
+
+				// Wait until it's updated
+				return ContainerOperationWait(config, op,
+					nodePoolInfo.project,
+					nodePoolInfo.location,
+					"updating GKE node pool taints", userAgent,
+					timeout)
+			}
+
+			if err := retryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
+					return err
+			}
+			log.Printf("[INFO] Updated taints for Node Pool %s", d.Id())
+		}
+
 		if d.HasChange(prefix + "node_config.0.tags") {
 			req := &container.UpdateNodePoolRequest{
 				Name: name,
@@ -1406,7 +1462,7 @@ func nodePoolUpdate(d *schema.ResourceData, meta interface{}, nodePoolInfo *Node
 				}
 				req.Tags = ntags
 			}
-			
+
 		    // sets tags to the empty list when user removes a previously defined list of tags entriely
 			// aka the node pool goes from having tags to no longer having any
 			if req.Tags == nil {
@@ -1416,7 +1472,7 @@ func nodePoolUpdate(d *schema.ResourceData, meta interface{}, nodePoolInfo *Node
 				}
 				req.Tags = ntags
 			}
-	
+
 			updateF := func() error {
 				clusterNodePoolsUpdateCall := config.NewContainerClient(userAgent).Projects.Locations.Clusters.NodePools.Update(nodePoolInfo.fullyQualifiedName(name), req)
 				if config.UserProjectOverride {
@@ -1426,7 +1482,7 @@ func nodePoolUpdate(d *schema.ResourceData, meta interface{}, nodePoolInfo *Node
 				if err != nil {
 					return err
 				}
-	
+
 				// Wait until it's updated
 				return ContainerOperationWait(config, op,
 					nodePoolInfo.project,
@@ -1435,12 +1491,12 @@ func nodePoolUpdate(d *schema.ResourceData, meta interface{}, nodePoolInfo *Node
 					timeout)
 			}
 
-			if err := tpgresource.RetryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
+			if err := retryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
 					return err
 			}
 			log.Printf("[INFO] Updated tags for node pool %s", name)
 		}
-		
+
 		if d.HasChange(prefix + "node_config.0.resource_labels") {
 			req := &container.UpdateNodePoolRequest{
 				Name: name,
@@ -1452,7 +1508,7 @@ func nodePoolUpdate(d *schema.ResourceData, meta interface{}, nodePoolInfo *Node
 					Labels: tpgresource.ConvertStringMap(resourceLabels),
 				}
 			}
-				
+
 			updateF := func() error {
 				clusterNodePoolsUpdateCall := config.NewContainerClient(userAgent).Projects.Locations.Clusters.NodePools.Update(nodePoolInfo.fullyQualifiedName(name), req)
 				if config.UserProjectOverride {
@@ -1462,7 +1518,7 @@ func nodePoolUpdate(d *schema.ResourceData, meta interface{}, nodePoolInfo *Node
 				if err != nil {
 					return err
 				}
-	
+
 				// Wait until it's updated
 				return ContainerOperationWait(config, op,
 					nodePoolInfo.project,
@@ -1472,7 +1528,7 @@ func nodePoolUpdate(d *schema.ResourceData, meta interface{}, nodePoolInfo *Node
 			}
 
 			// Call update serially.
-			if err := tpgresource.RetryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
+			if err := retryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
 					return err
 			}
 
@@ -1490,7 +1546,7 @@ func nodePoolUpdate(d *schema.ResourceData, meta interface{}, nodePoolInfo *Node
 					Labels: tpgresource.ConvertStringMap(labels),
 				}
 			}
-				
+
 			updateF := func() error {
 				clusterNodePoolsUpdateCall := config.NewContainerClient(userAgent).Projects.Locations.Clusters.NodePools.Update(nodePoolInfo.fullyQualifiedName(name), req)
 				if config.UserProjectOverride {
@@ -1500,7 +1556,7 @@ func nodePoolUpdate(d *schema.ResourceData, meta interface{}, nodePoolInfo *Node
 				if err != nil {
 					return err
 				}
-	
+
 				// Wait until it's updated
 				return ContainerOperationWait(config, op,
 					nodePoolInfo.project,
@@ -1510,7 +1566,7 @@ func nodePoolUpdate(d *schema.ResourceData, meta interface{}, nodePoolInfo *Node
 			}
 
 			// Call update serially.
-			if err := tpgresource.RetryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
+			if err := retryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
 					return err
 			}
 
@@ -1542,7 +1598,7 @@ func nodePoolUpdate(d *schema.ResourceData, meta interface{}, nodePoolInfo *Node
 					timeout)
 			}
 
-			if err := tpgresource.RetryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
+			if err := retryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
 					return err
 			}
 			log.Printf("[INFO] Updated image type in Node Pool %s", d.Id())
@@ -1576,7 +1632,7 @@ func nodePoolUpdate(d *schema.ResourceData, meta interface{}, nodePoolInfo *Node
 					timeout)
 			}
 
-			if err := tpgresource.RetryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
+			if err := retryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
 					return err
 			}
 			log.Printf("[INFO] Updated workload_metadata_config for node pool %s", name)
@@ -1609,7 +1665,7 @@ func nodePoolUpdate(d *schema.ResourceData, meta interface{}, nodePoolInfo *Node
 					timeout)
 			}
 
-			if err := tpgresource.RetryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
+			if err := retryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
 					return err
 			}
 
@@ -1642,13 +1698,47 @@ func nodePoolUpdate(d *schema.ResourceData, meta interface{}, nodePoolInfo *Node
 					timeout)
 			}
 
-			if err := tpgresource.RetryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
+			if err := retryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
 					return err
 			}
 
 			log.Printf("[INFO] Updated linux_node_config for node pool %s", name)
 		}
+		if d.HasChange(prefix + "node_config.0.fast_socket") {
+			req := &container.UpdateNodePoolRequest{
+				NodePoolId: name,
+				FastSocket: &container.FastSocket{},
+			}
+			if v, ok := d.GetOk(prefix + "node_config.0.fast_socket"); ok {
+				fastSocket := v.([]interface{})[0].(map[string]interface{})
+				req.FastSocket =  &container.FastSocket{
+					Enabled: fastSocket["enabled"].(bool),
+				}
+			}
+			updateF := func() error {
+				clusterNodePoolsUpdateCall := config.NewContainerClient(userAgent).Projects.Locations.Clusters.NodePools.Update(nodePoolInfo.fullyQualifiedName(name),req)
+				if config.UserProjectOverride {
+					clusterNodePoolsUpdateCall.Header().Add("X-Goog-User-Project", nodePoolInfo.project)
+				}
+				op, err := clusterNodePoolsUpdateCall.Do()
+				if err != nil {
+					return err
+				}
+
+				// Wait until it's updated
+				return ContainerOperationWait(config, op,
+					nodePoolInfo.project,
+					nodePoolInfo.location,
+					"updating GKE node pool fast_socket", userAgent,
+					timeout)
+			}
+
+			if err := retryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
+					return err
+			}
 
+			log.Printf("[INFO] Updated fast_socket for node pool %s", name)
+		}
 	}
 
 	if d.HasChange(prefix + "node_count") {
@@ -1673,7 +1763,7 @@ func nodePoolUpdate(d *schema.ResourceData, meta interface{}, nodePoolInfo *Node
 				nodePoolInfo.location, "updating GKE node pool size", userAgent,
 				timeout)
 		}
-		if err := tpgresource.RetryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
+		if err := retryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
 				return err
 		}
 		log.Printf("[INFO] GKE node pool %s size has been updated to %d", name, newSize)
@@ -1708,7 +1798,7 @@ func nodePoolUpdate(d *schema.ResourceData, meta interface{}, nodePoolInfo *Node
 				nodePoolInfo.location, "updating GKE node pool management", userAgent, timeout)
 		}
 
-		if err := tpgresource.RetryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
+		if err := retryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
 				return err
 		}
 		log.Printf("[INFO] Updated management in Node Pool %s", name)
@@ -1735,7 +1825,7 @@ func nodePoolUpdate(d *schema.ResourceData, meta interface{}, nodePoolInfo *Node
 				nodePoolInfo.project,
 				nodePoolInfo.location, "updating GKE node pool version", userAgent, timeout)
 		}
-		if err := tpgresource.RetryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
+		if err := retryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
 				return err
 		}
 		log.Printf("[INFO] Updated version in Node Pool %s", name)
@@ -1760,7 +1850,7 @@ func nodePoolUpdate(d *schema.ResourceData, meta interface{}, nodePoolInfo *Node
 			return ContainerOperationWait(config, op, nodePoolInfo.project, nodePoolInfo.location, "updating GKE node pool node locations", userAgent, timeout)
 		}
 
-		if err := tpgresource.RetryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
+		if err := retryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
 				return err
 		}
 		log.Printf("[INFO] Updated node locations in Node Pool %s", name)
@@ -1840,7 +1930,7 @@ func nodePoolUpdate(d *schema.ResourceData, meta interface{}, nodePoolInfo *Node
 			// Wait until it's updated
 			return ContainerOperationWait(config, op, nodePoolInfo.project, nodePoolInfo.location, "updating GKE node pool upgrade settings", userAgent, timeout)
 		}
-		if err := tpgresource.RetryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
+		if err := retryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
 				return err
 		}
 		log.Printf("[INFO] Updated upgrade settings in Node Pool %s", name)
@@ -1871,7 +1961,7 @@ func nodePoolUpdate(d *schema.ResourceData, meta interface{}, nodePoolInfo *Node
 					timeout)
 			}
 
-			if err := tpgresource.RetryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
+			if err := retryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
 					return err
 			}
 
@@ -1922,3 +2012,21 @@ func containerNodePoolAwaitRestingState(config *transport_tpg.Config, name, proj
 
 	return state, err
 }
+
+// Retries an operation while the canonical error code is FAILED_PRECONDTION
+// or RESOURCE_EXHAUSTED which indicates there is an incompatible operation
+// already running on the cluster or there are the number of allowed
+// concurrent operations running on the cluster. These errors can be safely
+// retried until the incompatible operation completes, and the newly
+// requested operation can begin.
+func retryWhileIncompatibleOperation(timeout time.Duration, lockKey string, f func() error) error {
+	return resource.Retry(timeout, func() *resource.RetryError {
+		if err := transport_tpg.LockedCall(lockKey, f); err != nil {
+			if tpgresource.IsFailedPreconditionError(err) || tpgresource.IsQuotaError(err) {
+				return resource.RetryableError(err)
+			}
+			return resource.NonRetryableError(err)
+		}
+		return nil
+	})
+}
diff --git a/mmv1/third_party/terraform/services/container/resource_container_node_pool_test.go.erb b/mmv1/third_party/terraform/services/container/resource_container_node_pool_test.go.erb
index e5fc654afaf9..aac2bfc21ce3 100644
--- a/mmv1/third_party/terraform/services/container/resource_container_node_pool_test.go.erb
+++ b/mmv1/third_party/terraform/services/container/resource_container_node_pool_test.go.erb
@@ -17,6 +17,8 @@ func TestAccContainerNodePool_basic(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -24,7 +26,7 @@ func TestAccContainerNodePool_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			resource.TestStep{
-				Config: testAccContainerNodePool_basic(cluster, np),
+				Config: testAccContainerNodePool_basic(cluster, np, networkName, subnetworkName),
 			},
 			resource.TestStep{
 				ResourceName:      "google_container_node_pool.np",
@@ -40,6 +42,8 @@ func TestAccContainerNodePool_basicWithClusterId(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -47,7 +51,7 @@ func TestAccContainerNodePool_basicWithClusterId(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerNodePool_basicWithClusterId(cluster, np),
+				Config: testAccContainerNodePool_basicWithClusterId(cluster, np, networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_node_pool.np",
@@ -113,6 +117,8 @@ func TestAccContainerNodePool_namePrefix(t *testing.T) {
 	t.Parallel()
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -120,7 +126,7 @@ func TestAccContainerNodePool_namePrefix(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			resource.TestStep{
-				Config: testAccContainerNodePool_namePrefix(cluster, "tf-np-"),
+				Config: testAccContainerNodePool_namePrefix(cluster, "tf-np-", networkName, subnetworkName),
 			},
 			resource.TestStep{
 				ResourceName:            "google_container_node_pool.np",
@@ -138,6 +144,8 @@ func TestAccContainerNodePool_noName(t *testing.T) {
 	t.Parallel()
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -145,7 +153,7 @@ func TestAccContainerNodePool_noName(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			resource.TestStep{
-				Config: testAccContainerNodePool_noName(cluster),
+				Config: testAccContainerNodePool_noName(cluster, networkName, subnetworkName),
 			},
 			resource.TestStep{
 				ResourceName:      "google_container_node_pool.np",
@@ -161,6 +169,8 @@ func TestAccContainerNodePool_withLoggingVariantUpdates(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	nodePool := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -168,7 +178,7 @@ func TestAccContainerNodePool_withLoggingVariantUpdates(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerNodePool_withLoggingVariant(cluster, nodePool, "DEFAULT"),
+				Config: testAccContainerNodePool_withLoggingVariant(cluster, nodePool, "DEFAULT", networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_node_pool.with_logging_variant",
@@ -176,7 +186,7 @@ func TestAccContainerNodePool_withLoggingVariantUpdates(t *testing.T) {
 				ImportStateVerify:       true,
 			},
 			{
-				Config: testAccContainerNodePool_withLoggingVariant(cluster, nodePool, "MAX_THROUGHPUT"),
+				Config: testAccContainerNodePool_withLoggingVariant(cluster, nodePool, "MAX_THROUGHPUT", networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_node_pool.with_logging_variant",
@@ -184,7 +194,7 @@ func TestAccContainerNodePool_withLoggingVariantUpdates(t *testing.T) {
 				ImportStateVerify:       true,
 			},
 			{
-				Config: testAccContainerNodePool_withLoggingVariant(cluster, nodePool, "DEFAULT"),
+				Config: testAccContainerNodePool_withLoggingVariant(cluster, nodePool, "DEFAULT", networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_node_pool.with_logging_variant",
@@ -200,6 +210,8 @@ func TestAccContainerNodePool_withNodeConfig(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	nodePool := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -207,7 +219,7 @@ func TestAccContainerNodePool_withNodeConfig(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			resource.TestStep{
-				Config: testAccContainerNodePool_withNodeConfig(cluster, nodePool),
+				Config: testAccContainerNodePool_withNodeConfig(cluster, nodePool, networkName, subnetworkName),
 			},
 			resource.TestStep{
 				ResourceName:      "google_container_node_pool.np_with_node_config",
@@ -215,10 +227,10 @@ func TestAccContainerNodePool_withNodeConfig(t *testing.T) {
 				ImportStateVerify: true,
 				// autoscaling.# = 0 is equivalent to no autoscaling at all,
 				// but will still cause an import diff
-				ImportStateVerifyIgnore: []string{"autoscaling.#"},
+				ImportStateVerifyIgnore: []string{"autoscaling.#", "node_config.0.taint"},
 			},
 			resource.TestStep{
-				Config: testAccContainerNodePool_withNodeConfigUpdate(cluster, nodePool),
+				Config: testAccContainerNodePool_withNodeConfigUpdate(cluster, nodePool, networkName, subnetworkName),
 			},
 			resource.TestStep{
 				ResourceName:      "google_container_node_pool.np_with_node_config",
@@ -226,7 +238,43 @@ func TestAccContainerNodePool_withNodeConfig(t *testing.T) {
 				ImportStateVerify: true,
 				// autoscaling.# = 0 is equivalent to no autoscaling at all,
 				// but will still cause an import diff
-				ImportStateVerifyIgnore: []string{"autoscaling.#"},
+				ImportStateVerifyIgnore: []string{"autoscaling.#", "node_config.0.taint"},
+			},
+		},
+	})
+}
+
+func TestAccContainerNodePool_withTaintsUpdate(t *testing.T) {
+	t.Parallel()
+
+	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	nodePool := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccContainerNodePool_basic(cluster, nodePool, networkName, subnetworkName),
+			},
+			resource.TestStep{
+				ResourceName:      "google_container_node_pool.np",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			resource.TestStep{
+				Config: testAccContainerNodePool_withTaintsUpdate(cluster, nodePool, networkName, subnetworkName),
+			},
+			resource.TestStep{
+				ResourceName:      "google_container_node_pool.np",
+				ImportState:       true,
+				ImportStateVerify: true,
+				// autoscaling.# = 0 is equivalent to no autoscaling at all,
+				// but will still cause an import diff
+				ImportStateVerifyIgnore: []string{"autoscaling.#", "node_config.0.taint"},
 			},
 		},
 	})
@@ -237,6 +285,8 @@ func TestAccContainerNodePool_withReservationAffinity(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-np-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -244,7 +294,7 @@ func TestAccContainerNodePool_withReservationAffinity(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerNodePool_withReservationAffinity(cluster, np),
+				Config: testAccContainerNodePool_withReservationAffinity(cluster, np, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_node_pool.with_reservation_affinity",
 						"node_config.0.reservation_affinity.#", "1"),
@@ -267,6 +317,8 @@ func TestAccContainerNodePool_withReservationAffinitySpecific(t *testing.T) {
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	reservation := fmt.Sprintf("tf-test-reservation-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-np-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -274,7 +326,7 @@ func TestAccContainerNodePool_withReservationAffinitySpecific(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerNodePool_withReservationAffinitySpecific(cluster, reservation, np),
+				Config: testAccContainerNodePool_withReservationAffinitySpecific(cluster, reservation, np, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_node_pool.with_reservation_affinity",
 						"node_config.0.reservation_affinity.#", "1"),
@@ -303,6 +355,8 @@ func TestAccContainerNodePool_withWorkloadIdentityConfig(t *testing.T) {
 	pid := envvar.GetTestProjectFromEnv()
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-np-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -310,7 +364,7 @@ func TestAccContainerNodePool_withWorkloadIdentityConfig(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerNodePool_withWorkloadMetadataConfig(cluster, np),
+				Config: testAccContainerNodePool_withWorkloadMetadataConfig(cluster, np, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_node_pool.with_workload_metadata_config",
 						"node_config.0.workload_metadata_config.0.mode", "GCE_METADATA"),
@@ -322,7 +376,7 @@ func TestAccContainerNodePool_withWorkloadIdentityConfig(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccContainerNodePool_withWorkloadMetadataConfig_gkeMetadata(pid, cluster, np),
+				Config: testAccContainerNodePool_withWorkloadMetadataConfig_gkeMetadata(pid, cluster, np, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_node_pool.with_workload_metadata_config",
 						"node_config.0.workload_metadata_config.0.mode", "GKE_METADATA"),
@@ -343,6 +397,8 @@ func TestAccContainerNodePool_withSandboxConfig(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-np-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -350,7 +406,7 @@ func TestAccContainerNodePool_withSandboxConfig(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerNodePool_withSandboxConfig(cluster, np),
+				Config: testAccContainerNodePool_withSandboxConfig(cluster, np, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_node_pool.with_sandbox_config",
 						"node_config.0.sandbox_config.0.sandbox_type", "gvisor"),
@@ -361,42 +417,19 @@ func TestAccContainerNodePool_withSandboxConfig(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
-			{
-				// GKE sets automatic labels and taints on nodes. This makes
-				// sure we ignore the automatic ones and keep our own.
-				Config:   testAccContainerNodePool_withSandboxConfig(cluster, np),
-				// When we use PlanOnly without ExpectNonEmptyPlan, we're
-				// guaranteeing that the computed fields of the resources don't
-				// force an unintentional change to the plan. That is, we
-				// expect this part of the test to pass only if the plan
-				// doesn't change.
-				PlanOnly: true,
-			},
-			{
-				// Now we'll modify the taints, which should force a change to
-				// the plan. We make sure we don't over-suppress and end up
-				// eliminating the labels or taints we asked for. This will
-				// destroy and recreate the node pool as taints are immutable.
-				Config: testAccContainerNodePool_withSandboxConfig_changeTaints(cluster, np),
-				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr("google_container_node_pool.with_sandbox_config",
-						"node_config.0.labels.test.terraform.io/gke-sandbox", "true"),
-					resource.TestCheckResourceAttr("google_container_node_pool.with_sandbox_config",
-						"node_config.0.taint.0.key", "test.terraform.io/gke-sandbox"),
-					resource.TestCheckResourceAttr("google_container_node_pool.with_sandbox_config",
-						"node_config.0.taint.1.key", "test.terraform.io/gke-sandbox-amended"),
-				),
-			},
 		},
 	})
 }
 <% end -%>
 
 func TestAccContainerNodePool_withKubeletConfig(t *testing.T) {
+	t.Skipf("Skipping test %s due to https://github.com/hashicorp/terraform-provider-google/issues/16064", t.Name())
 	t.Parallel()
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-np-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -404,7 +437,7 @@ func TestAccContainerNodePool_withKubeletConfig(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "static", "100us", true, 2048),
+				Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "static", "100us", networkName, subnetworkName, true, 2048),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
 						"node_config.0.kubelet_config.0.cpu_cfs_quota", "true"),
@@ -418,7 +451,7 @@ func TestAccContainerNodePool_withKubeletConfig(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "", "", false, 1024),
+				Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "", "", networkName, subnetworkName, false, 1024),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
 						"node_config.0.kubelet_config.0.cpu_cfs_quota", "false"),
@@ -440,6 +473,8 @@ func TestAccContainerNodePool_withInvalidKubeletCpuManagerPolicy(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-np-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -447,7 +482,7 @@ func TestAccContainerNodePool_withInvalidKubeletCpuManagerPolicy(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config:      testAccContainerNodePool_withKubeletConfig(cluster, np, "dontexist", "100us", true, 1024),
+				Config:      testAccContainerNodePool_withKubeletConfig(cluster, np, "dontexist", "100us", networkName, subnetworkName, true, 1024),
 				ExpectError: regexp.MustCompile(`.*to be one of \[static none \].*`),
 			},
 		},
@@ -459,14 +494,25 @@ func TestAccContainerNodePool_withLinuxNodeConfig(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-np-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy:             testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
+			// Create a node pool with empty `linux_node_config.sysctls`.
+			{
+				Config: testAccContainerNodePool_withLinuxNodeConfig(cluster, np, "", networkName, subnetworkName),
+			},
+			{
+				ResourceName:      "google_container_node_pool.with_linux_node_config",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
 			{
-				Config: testAccContainerNodePool_withLinuxNodeConfig(cluster, np, 10000, 12800, "1000 20000 100000", 1),
+				Config: testAccContainerNodePool_withLinuxNodeConfig(cluster, np, "1000 20000 100000", networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_node_pool.with_linux_node_config",
@@ -475,7 +521,7 @@ func TestAccContainerNodePool_withLinuxNodeConfig(t *testing.T) {
 			},
 			// Perform an update.
 			{
-				Config: testAccContainerNodePool_withLinuxNodeConfig(cluster, np, 10000, 12800, "1000 20000 200000", 1),
+				Config: testAccContainerNodePool_withLinuxNodeConfig(cluster, np, "1000 20000 200000", networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_node_pool.with_linux_node_config",
@@ -486,6 +532,40 @@ func TestAccContainerNodePool_withLinuxNodeConfig(t *testing.T) {
 	})
 }
 
+func TestAccContainerNodePool_withCgroupMode(t *testing.T) {
+	t.Parallel()
+
+	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	np := fmt.Sprintf("tf-test-np-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckContainerClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccContainerNodePool_withCgroupMode(cluster, np, "CGROUP_MODE_V2", networkName, subnetworkName),
+			},
+			{
+				ResourceName:      "google_container_node_pool.np",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			// Perform an update.
+			{
+				Config: testAccContainerNodePool_withCgroupMode(cluster, np, "CGROUP_MODE_UNSPECIFIED", networkName, subnetworkName),
+			},
+			{
+				ResourceName:      "google_container_node_pool.np",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func TestAccContainerNodePool_withNetworkConfig(t *testing.T) {
 	t.Parallel()
 
@@ -542,7 +622,7 @@ func TestAccContainerNodePool_withMultiNicNetworkConfig(t *testing.T) {
 				ResourceName:            "google_container_cluster.cluster",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"network_config.0.create_pod_range"},
+				ImportStateVerifyIgnore: []string{"network_config.0.create_pod_range", "deletion_protection"},
 			},
 		},
 	})
@@ -621,6 +701,7 @@ resource "google_container_cluster" "cluster" {
     cluster_secondary_range_name  = google_compute_subnetwork.container_subnetwork.secondary_ip_range[0].range_name
     services_secondary_range_name = google_compute_subnetwork.container_subnetwork.secondary_ip_range[1].range_name
   }
+  deletion_protection = false
 }
 
 resource "google_container_node_pool" "with_enable_private_nodes" {
@@ -650,6 +731,8 @@ func TestAccContainerNodePool_withBootDiskKmsKey(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-np-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	if acctest.BootstrapPSARole(t, "service-", "compute-system", "roles/cloudkms.cryptoKeyEncrypterDecrypter") {
 		t.Fatal("Stopping the test because a role was added to the policy.")
@@ -661,7 +744,7 @@ func TestAccContainerNodePool_withBootDiskKmsKey(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerNodePool_withBootDiskKmsKey(cluster, np),
+				Config: testAccContainerNodePool_withBootDiskKmsKey(cluster, np, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_node_pool.with_boot_disk_kms_key",
@@ -674,10 +757,13 @@ func TestAccContainerNodePool_withBootDiskKmsKey(t *testing.T) {
 <% end -%>
 
 func TestAccContainerNodePool_withUpgradeSettings(t *testing.T) {
+	t.Skipf("Skipping test %s due to https://github.com/hashicorp/terraform-provider-google/issues/16064", t.Name())
 	t.Parallel()
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-np-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -685,7 +771,7 @@ func TestAccContainerNodePool_withUpgradeSettings(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerNodePool_withUpgradeSettings(cluster, np, 2, 3, "SURGE", "", 0, 0.0, ""),
+				Config: testAccContainerNodePool_withUpgradeSettings(cluster, np, networkName, subnetworkName, 2, 3, "SURGE", "", 0, 0.0, ""),
 			},
 			{
 				ResourceName:      "google_container_node_pool.with_upgrade_settings",
@@ -693,7 +779,7 @@ func TestAccContainerNodePool_withUpgradeSettings(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccContainerNodePool_withUpgradeSettings(cluster, np, 2, 1, "SURGE", "", 0, 0.0, ""),
+				Config: testAccContainerNodePool_withUpgradeSettings(cluster, np, networkName, subnetworkName, 2, 1, "SURGE", "", 0, 0.0, ""),
 			},
 			{
 				ResourceName:      "google_container_node_pool.with_upgrade_settings",
@@ -701,7 +787,7 @@ func TestAccContainerNodePool_withUpgradeSettings(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccContainerNodePool_withUpgradeSettings(cluster, np, 1, 1, "SURGE", "", 0, 0.0, ""),
+				Config: testAccContainerNodePool_withUpgradeSettings(cluster, np, networkName, subnetworkName, 1, 1, "SURGE", "", 0, 0.0, ""),
 			},
 			{
 				ResourceName:      "google_container_node_pool.with_upgrade_settings",
@@ -709,7 +795,7 @@ func TestAccContainerNodePool_withUpgradeSettings(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccContainerNodePool_withUpgradeSettings(cluster, np, 0, 0, "BLUE_GREEN", "100s", 1, 0.0, "0s"),
+				Config: testAccContainerNodePool_withUpgradeSettings(cluster, np, networkName, subnetworkName, 0, 0, "BLUE_GREEN", "100s", 1, 0.0, "0s"),
 			},
 			{
 				ResourceName:      "google_container_node_pool.with_upgrade_settings",
@@ -717,7 +803,7 @@ func TestAccContainerNodePool_withUpgradeSettings(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccContainerNodePool_withUpgradeSettings(cluster, np, 0, 0, "BLUE_GREEN", "100s", 0, 0.5, "1s"),
+				Config: testAccContainerNodePool_withUpgradeSettings(cluster, np, networkName, subnetworkName, 0, 0, "BLUE_GREEN", "100s", 0, 0.5, "1s"),
 			},
 			{
 				ResourceName:      "google_container_node_pool.with_upgrade_settings",
@@ -733,6 +819,8 @@ func TestAccContainerNodePool_withGPU(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-np-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -740,7 +828,7 @@ func TestAccContainerNodePool_withGPU(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			resource.TestStep{
-				Config: testAccContainerNodePool_withGPU(cluster, np),
+				Config: testAccContainerNodePool_withGPU(cluster, np, networkName, subnetworkName),
 			},
 			resource.TestStep{
 				ResourceName:      "google_container_node_pool.np_with_gpu",
@@ -756,6 +844,9 @@ func TestAccContainerNodePool_withManagement(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	nodePool := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
+
 	management := `
 	management {
 		auto_repair = "false"
@@ -768,7 +859,7 @@ func TestAccContainerNodePool_withManagement(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			resource.TestStep{
-				Config: testAccContainerNodePool_withManagement(cluster, nodePool, ""),
+				Config: testAccContainerNodePool_withManagement(cluster, nodePool, "", networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(
 						"google_container_node_pool.np_with_management", "management.#", "1"),
@@ -784,7 +875,7 @@ func TestAccContainerNodePool_withManagement(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			resource.TestStep{
-				Config: testAccContainerNodePool_withManagement(cluster, nodePool, management),
+				Config: testAccContainerNodePool_withManagement(cluster, nodePool, management, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(
 						"google_container_node_pool.np_with_management", "management.#", "1"),
@@ -808,6 +899,8 @@ func TestAccContainerNodePool_withNodeConfigScopeAlias(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-np-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -815,7 +908,7 @@ func TestAccContainerNodePool_withNodeConfigScopeAlias(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			resource.TestStep{
-				Config: testAccContainerNodePool_withNodeConfigScopeAlias(cluster, np),
+				Config: testAccContainerNodePool_withNodeConfigScopeAlias(cluster, np, networkName, subnetworkName),
 			},
 			resource.TestStep{
 				ResourceName:      "google_container_node_pool.np_with_node_config_scope_alias",
@@ -832,6 +925,8 @@ func TestAccContainerNodePool_regionalAutoscaling(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -839,7 +934,7 @@ func TestAccContainerNodePool_regionalAutoscaling(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			resource.TestStep{
-				Config: testAccContainerNodePool_regionalAutoscaling(cluster, np),
+				Config: testAccContainerNodePool_regionalAutoscaling(cluster, np, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_node_pool.np", "autoscaling.0.min_node_count", "1"),
 					resource.TestCheckResourceAttr("google_container_node_pool.np", "autoscaling.0.max_node_count", "3"),
@@ -851,7 +946,7 @@ func TestAccContainerNodePool_regionalAutoscaling(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			resource.TestStep{
-				Config: testAccContainerNodePool_updateAutoscaling(cluster, np),
+				Config: testAccContainerNodePool_updateAutoscaling(cluster, np, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_node_pool.np", "autoscaling.0.min_node_count", "0"),
 					resource.TestCheckResourceAttr("google_container_node_pool.np", "autoscaling.0.max_node_count", "5"),
@@ -863,7 +958,7 @@ func TestAccContainerNodePool_regionalAutoscaling(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			resource.TestStep{
-				Config: testAccContainerNodePool_basic(cluster, np),
+				Config: testAccContainerNodePool_basic(cluster, np, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckNoResourceAttr("google_container_node_pool.np", "autoscaling.0.min_node_count"),
 					resource.TestCheckNoResourceAttr("google_container_node_pool.np", "autoscaling.0.max_node_count"),
@@ -887,6 +982,8 @@ func TestAccContainerNodePool_totalSize(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -894,7 +991,7 @@ func TestAccContainerNodePool_totalSize(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			resource.TestStep{
-				Config: testAccContainerNodePool_totalSize(cluster, np),
+				Config: testAccContainerNodePool_totalSize(cluster, np, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_node_pool.np", "autoscaling.0.total_min_node_count", "4"),
 					resource.TestCheckResourceAttr("google_container_node_pool.np", "autoscaling.0.total_max_node_count", "12"),
@@ -907,7 +1004,7 @@ func TestAccContainerNodePool_totalSize(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			resource.TestStep{
-				Config: testAccContainerNodePool_updateTotalSize(cluster, np),
+				Config: testAccContainerNodePool_updateTotalSize(cluster, np, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_node_pool.np", "autoscaling.0.total_min_node_count", "2"),
 					resource.TestCheckResourceAttr("google_container_node_pool.np", "autoscaling.0.total_max_node_count", "22"),
@@ -920,7 +1017,7 @@ func TestAccContainerNodePool_totalSize(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			resource.TestStep{
-				Config: testAccContainerNodePool_basicTotalSize(cluster, np),
+				Config: testAccContainerNodePool_basicTotalSize(cluster, np, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckNoResourceAttr("google_container_node_pool.np", "autoscaling.0.min_node_count"),
 					resource.TestCheckNoResourceAttr("google_container_node_pool.np", "autoscaling.0.max_node_count"),
@@ -943,6 +1040,8 @@ func TestAccContainerNodePool_autoscaling(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -950,7 +1049,7 @@ func TestAccContainerNodePool_autoscaling(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			resource.TestStep{
-				Config: testAccContainerNodePool_autoscaling(cluster, np),
+				Config: testAccContainerNodePool_autoscaling(cluster, np, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_node_pool.np", "autoscaling.0.min_node_count", "1"),
 					resource.TestCheckResourceAttr("google_container_node_pool.np", "autoscaling.0.max_node_count", "3"),
@@ -962,7 +1061,7 @@ func TestAccContainerNodePool_autoscaling(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			resource.TestStep{
-				Config: testAccContainerNodePool_updateAutoscaling(cluster, np),
+				Config: testAccContainerNodePool_updateAutoscaling(cluster, np, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_node_pool.np", "autoscaling.0.min_node_count", "0"),
 					resource.TestCheckResourceAttr("google_container_node_pool.np", "autoscaling.0.max_node_count", "5"),
@@ -974,7 +1073,7 @@ func TestAccContainerNodePool_autoscaling(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			resource.TestStep{
-				Config: testAccContainerNodePool_basic(cluster, np),
+				Config: testAccContainerNodePool_basic(cluster, np, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckNoResourceAttr("google_container_node_pool.np", "autoscaling.0.min_node_count"),
 					resource.TestCheckNoResourceAttr("google_container_node_pool.np", "autoscaling.0.max_node_count"),
@@ -997,6 +1096,8 @@ func TestAccContainerNodePool_resize(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -1004,7 +1105,7 @@ func TestAccContainerNodePool_resize(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerNodePool_additionalZones(cluster, np),
+				Config: testAccContainerNodePool_additionalZones(cluster, np, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_node_pool.np", "node_count", "2"),
 				),
@@ -1015,7 +1116,7 @@ func TestAccContainerNodePool_resize(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccContainerNodePool_resize(cluster, np),
+				Config: testAccContainerNodePool_resize(cluster, np, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_node_pool.np", "node_count", "3"),
 				),
@@ -1034,6 +1135,8 @@ func TestAccContainerNodePool_version(t *testing.T) {
 	t.Parallel()
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -1041,7 +1144,7 @@ func TestAccContainerNodePool_version(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerNodePool_version(cluster, np),
+				Config: testAccContainerNodePool_version(cluster, np, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_node_pool.np",
@@ -1049,7 +1152,7 @@ func TestAccContainerNodePool_version(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccContainerNodePool_updateVersion(cluster, np),
+				Config: testAccContainerNodePool_updateVersion(cluster, np, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_node_pool.np",
@@ -1057,7 +1160,7 @@ func TestAccContainerNodePool_version(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccContainerNodePool_version(cluster, np),
+				Config: testAccContainerNodePool_version(cluster, np, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_node_pool.np",
@@ -1073,6 +1176,8 @@ func TestAccContainerNodePool_regionalClusters(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -1080,7 +1185,7 @@ func TestAccContainerNodePool_regionalClusters(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			resource.TestStep{
-				Config: testAccContainerNodePool_regionalClusters(cluster, np),
+				Config: testAccContainerNodePool_regionalClusters(cluster, np, networkName, subnetworkName),
 			},
 			resource.TestStep{
 				ResourceName:      "google_container_node_pool.np",
@@ -1096,6 +1201,8 @@ func TestAccContainerNodePool_012_ConfigModeAttr(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -1103,7 +1210,7 @@ func TestAccContainerNodePool_012_ConfigModeAttr(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerNodePool_012_ConfigModeAttr1(cluster, np),
+				Config: testAccContainerNodePool_012_ConfigModeAttr1(cluster, np, networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_node_pool.np",
@@ -1111,7 +1218,7 @@ func TestAccContainerNodePool_012_ConfigModeAttr(t *testing.T) {
 				ImportStateVerify:       true,
 			},
 			{
-				Config: testAccContainerNodePool_012_ConfigModeAttr2(cluster, np),
+				Config: testAccContainerNodePool_012_ConfigModeAttr2(cluster, np, networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_node_pool.np",
@@ -1127,6 +1234,8 @@ func TestAccContainerNodePool_EmptyGuestAccelerator(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -1135,7 +1244,7 @@ func TestAccContainerNodePool_EmptyGuestAccelerator(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// Test alternative way to specify an empty node pool
-				Config: testAccContainerNodePool_EmptyGuestAccelerator(cluster, np),
+				Config: testAccContainerNodePool_EmptyGuestAccelerator(cluster, np, networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_node_pool.np",
@@ -1144,7 +1253,7 @@ func TestAccContainerNodePool_EmptyGuestAccelerator(t *testing.T) {
 			},
 			{
 				// Test alternative way to specify an empty node pool
-				Config: testAccContainerNodePool_PartialEmptyGuestAccelerator(cluster, np, 1),
+				Config: testAccContainerNodePool_PartialEmptyGuestAccelerator(cluster, np, networkName, subnetworkName, 1),
 			},
 			{
 				ResourceName:            "google_container_node_pool.np",
@@ -1153,13 +1262,13 @@ func TestAccContainerNodePool_EmptyGuestAccelerator(t *testing.T) {
 			},
 			{
 				// Assert that changes in count from 1 result in a diff
-				Config:             testAccContainerNodePool_PartialEmptyGuestAccelerator(cluster, np, 2),
+				Config:             testAccContainerNodePool_PartialEmptyGuestAccelerator(cluster, np, networkName, subnetworkName, 2),
 				ExpectNonEmptyPlan: true,
 				PlanOnly:           true,
 			},
 			{
 				// Assert that adding another accelerator block will also result in a diff
-				Config:             testAccContainerNodePool_PartialEmptyGuestAccelerator2(cluster, np),
+				Config:             testAccContainerNodePool_PartialEmptyGuestAccelerator2(cluster, np, networkName, subnetworkName),
 				ExpectNonEmptyPlan: true,
 				PlanOnly:           true,
 			},
@@ -1172,6 +1281,8 @@ func TestAccContainerNodePool_shieldedInstanceConfig(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -1179,7 +1290,7 @@ func TestAccContainerNodePool_shieldedInstanceConfig(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			resource.TestStep{
-				Config: testAccContainerNodePool_shieldedInstanceConfig(cluster, np),
+				Config: testAccContainerNodePool_shieldedInstanceConfig(cluster, np, networkName, subnetworkName),
 			},
 			resource.TestStep{
 				ResourceName:            "google_container_node_pool.np",
@@ -1197,6 +1308,8 @@ func TestAccContainerNodePool_concurrent(t *testing.T) {
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np1 := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
 	np2 := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -1204,7 +1317,7 @@ func TestAccContainerNodePool_concurrent(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerNodePool_concurrentCreate(cluster, np1, np2),
+				Config: testAccContainerNodePool_concurrentCreate(cluster, np1, np2, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_node_pool.np1",
@@ -1217,7 +1330,7 @@ func TestAccContainerNodePool_concurrent(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccContainerNodePool_concurrentUpdate(cluster, np1, np2),
+				Config: testAccContainerNodePool_concurrentUpdate(cluster, np1, np2, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_node_pool.np1",
@@ -1234,26 +1347,28 @@ func TestAccContainerNodePool_concurrent(t *testing.T) {
 }
 
 func TestAccContainerNodePool_withSoleTenantConfig(t *testing.T) {
-       t.Parallel()
+	t.Parallel()
 
-       cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
-       np := fmt.Sprintf("tf-test-np-%s", acctest.RandString(t, 10))
+	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	np := fmt.Sprintf("tf-test-np-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
-       acctest.VcrTest(t, resource.TestCase{
-               PreCheck:                 func() { acctest.AccTestPreCheck(t) },
-               ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
-               CheckDestroy:             testAccCheckContainerClusterDestroyProducer(t),
-               Steps: []resource.TestStep{
-                       {
-                               Config: testAccContainerNodePool_withSoleTenantConfig(cluster, np),
-                       },
-                       {
-                               ResourceName:      "google_container_node_pool.with_sole_tenant_config",
-                               ImportState:       true,
-                               ImportStateVerify: true,
-                       },
-               },
-       })
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckContainerClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccContainerNodePool_withSoleTenantConfig(cluster, np, networkName, subnetworkName),
+			},
+			{
+				ResourceName:      "google_container_node_pool.with_sole_tenant_config",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
 }
 
 
@@ -1264,6 +1379,8 @@ func TestAccContainerNodePool_ephemeralStorageConfig(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -1271,7 +1388,7 @@ func TestAccContainerNodePool_ephemeralStorageConfig(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			resource.TestStep{
-				Config: testAccContainerNodePool_ephemeralStorageConfig(cluster, np),
+				Config: testAccContainerNodePool_ephemeralStorageConfig(cluster, np, networkName, subnetworkName),
 			},
 			resource.TestStep{
 				ResourceName:            "google_container_node_pool.np",
@@ -1282,12 +1399,15 @@ func TestAccContainerNodePool_ephemeralStorageConfig(t *testing.T) {
 	})
 }
 
-func testAccContainerNodePool_ephemeralStorageConfig(cluster, np string) string {
+func testAccContainerNodePool_ephemeralStorageConfig(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -1303,7 +1423,7 @@ resource "google_container_node_pool" "np" {
     }
   }
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 <% end %>
 
@@ -1312,6 +1432,8 @@ func TestAccContainerNodePool_ephemeralStorageLocalSsdConfig(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -1319,7 +1441,7 @@ func TestAccContainerNodePool_ephemeralStorageLocalSsdConfig(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerNodePool_ephemeralStorageLocalSsdConfig(cluster, np),
+				Config: testAccContainerNodePool_ephemeralStorageLocalSsdConfig(cluster, np, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_node_pool.np",
@@ -1330,7 +1452,7 @@ func TestAccContainerNodePool_ephemeralStorageLocalSsdConfig(t *testing.T) {
 	})
 }
 
-func testAccContainerNodePool_ephemeralStorageLocalSsdConfig(cluster, np string) string {
+func testAccContainerNodePool_ephemeralStorageLocalSsdConfig(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
 	location       = "us-central1-a"
@@ -1343,6 +1465,9 @@ resource "google_container_cluster" "cluster" {
   location           = "us-central1-a"
   min_master_version = data.google_container_engine_versions.central1a.latest_master_version
   initial_node_count = 1
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -1358,7 +1483,7 @@ resource "google_container_node_pool" "np" {
     }
   }
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
 func TestAccContainerNodePool_localNvmeSsdBlockConfig(t *testing.T) {
@@ -1366,6 +1491,8 @@ func TestAccContainerNodePool_localNvmeSsdBlockConfig(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -1373,7 +1500,7 @@ func TestAccContainerNodePool_localNvmeSsdBlockConfig(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerNodePool_localNvmeSsdBlockConfig(cluster, np),
+				Config: testAccContainerNodePool_localNvmeSsdBlockConfig(cluster, np, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_node_pool.np",
@@ -1384,7 +1511,7 @@ func TestAccContainerNodePool_localNvmeSsdBlockConfig(t *testing.T) {
 	})
 }
 
-func testAccContainerNodePool_localNvmeSsdBlockConfig(cluster, np string) string {
+func testAccContainerNodePool_localNvmeSsdBlockConfig(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
 	location       = "us-central1-a"
@@ -1397,6 +1524,9 @@ resource "google_container_cluster" "cluster" {
   location           = "us-central1-a"
   min_master_version = data.google_container_engine_versions.central1a.latest_master_version
   initial_node_count = 1
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -1412,7 +1542,7 @@ resource "google_container_node_pool" "np" {
     }
   }
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
 func TestAccContainerNodePool_gcfsConfig(t *testing.T) {
@@ -1420,6 +1550,8 @@ func TestAccContainerNodePool_gcfsConfig(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -1427,7 +1559,7 @@ func TestAccContainerNodePool_gcfsConfig(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			resource.TestStep{
-				Config: testAccContainerNodePool_gcfsConfig(cluster, np),
+				Config: testAccContainerNodePool_gcfsConfig(cluster, np, networkName, subnetworkName),
 			},
 			resource.TestStep{
 				ResourceName:            "google_container_node_pool.np",
@@ -1438,12 +1570,15 @@ func TestAccContainerNodePool_gcfsConfig(t *testing.T) {
 	})
 }
 
-func testAccContainerNodePool_gcfsConfig(cluster, np string) string {
+func testAccContainerNodePool_gcfsConfig(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -1460,7 +1595,7 @@ resource "google_container_node_pool" "np" {
     }
   }
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
 func TestAccContainerNodePool_gvnic(t *testing.T) {
@@ -1468,6 +1603,8 @@ func TestAccContainerNodePool_gvnic(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -1475,7 +1612,7 @@ func TestAccContainerNodePool_gvnic(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerNodePool_gvnic(cluster, np),
+				Config: testAccContainerNodePool_gvnic(cluster, np, networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_node_pool.np",
@@ -1486,12 +1623,15 @@ func TestAccContainerNodePool_gvnic(t *testing.T) {
 	})
 }
 
-func testAccContainerNodePool_gvnic(cluster, np string) string {
+func testAccContainerNodePool_gvnic(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -1508,7 +1648,84 @@ resource "google_container_node_pool" "np" {
     }
   }
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
+}
+
+func TestAccContainerNodePool_fastSocket(t *testing.T) {
+	t.Parallel()
+
+	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	np := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccContainerNodePool_fastSocket(cluster, np, networkName, subnetworkName, true),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_container_node_pool.np",
+						"node_config.0.fast_socket.0.enabled", "true"),
+				),
+			},
+			{
+				ResourceName:      "google_container_node_pool.np",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccContainerNodePool_fastSocket(cluster, np, networkName, subnetworkName, false),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_container_node_pool.np",
+						"node_config.0.fast_socket.0.enabled", "false"),
+				),
+			},
+			{
+				ResourceName:      "google_container_node_pool.np",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccContainerNodePool_fastSocket(cluster, np, networkName, subnetworkName string, enabled bool) string {
+	return fmt.Sprintf(`
+resource "google_container_cluster" "cluster" {
+  name               = "%s"
+  location           = "us-central1-f"
+  initial_node_count = 1
+  min_master_version = "1.25"
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
+}
+
+resource "google_container_node_pool" "np" {
+  name               = "%s"
+  location           = "us-central1-f"
+  cluster            = google_container_cluster.cluster.name
+  initial_node_count = 1
+
+  node_config {
+    machine_type = "n1-standard-8"
+    image_type = "COS_CONTAINERD"
+    guest_accelerator {
+      type  = "nvidia-tesla-t4"
+      count = 1
+      }
+    gvnic {
+      enabled = true
+    }
+    fast_socket {
+      enabled = %t
+    }
+  }
+}
+`, cluster, networkName, subnetworkName, np, enabled)
 }
 
 func TestAccContainerNodePool_compactPlacement(t *testing.T) {
@@ -1516,6 +1733,8 @@ func TestAccContainerNodePool_compactPlacement(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -1523,23 +1742,27 @@ func TestAccContainerNodePool_compactPlacement(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerNodePool_compactPlacement(cluster, np, "COMPACT"),
+				Config: testAccContainerNodePool_compactPlacement(cluster, np, "COMPACT", networkName, subnetworkName),
 			},
 			{
 				ResourceName:      "google_container_cluster.cluster",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
 }
 
-func testAccContainerNodePool_compactPlacement(cluster, np, placementType string) string {
+func testAccContainerNodePool_compactPlacement(cluster, np, placementType, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -1555,7 +1778,7 @@ resource "google_container_node_pool" "np" {
     type = "%s"
   }
 }
-`, cluster, np, placementType)
+`, cluster, networkName, subnetworkName, np, placementType)
 }
 
 func TestAccContainerNodePool_customPlacementPolicy(t *testing.T) {
@@ -1564,6 +1787,8 @@ func TestAccContainerNodePool_customPlacementPolicy(t *testing.T) {
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
 	policy := fmt.Sprintf("tf-test-policy-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -1571,7 +1796,7 @@ func TestAccContainerNodePool_customPlacementPolicy(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerNodePool_customPlacementPolicy(cluster, np, policy),
+				Config: testAccContainerNodePool_customPlacementPolicy(cluster, np, policy, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_node_pool.np", "node_config.0.machine_type", "c2-standard-4"),
 					resource.TestCheckResourceAttr("google_container_node_pool.np", "placement_policy.0.policy_name", policy),
@@ -1587,12 +1812,15 @@ func TestAccContainerNodePool_customPlacementPolicy(t *testing.T) {
 	})
 }
 
-func testAccContainerNodePool_customPlacementPolicy(cluster, np, policyName string) string {
+func testAccContainerNodePool_customPlacementPolicy(cluster, np, policyName, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_compute_resource_policy" "policy" {
@@ -1608,6 +1836,7 @@ resource "google_container_node_pool" "np" {
   location           = "us-central1-a"
   cluster            = google_container_cluster.cluster.name
   initial_node_count = 2
+	autoscaling {}
 
   node_config {
     machine_type = "c2-standard-4"
@@ -1617,7 +1846,7 @@ resource "google_container_node_pool" "np" {
     policy_name = google_compute_resource_policy.policy.name
   }
 }
-`, cluster, policyName, np)
+`, cluster, networkName, subnetworkName, policyName, np)
 }
 
 func TestAccContainerNodePool_threadsPerCore(t *testing.T) {
@@ -1625,6 +1854,8 @@ func TestAccContainerNodePool_threadsPerCore(t *testing.T) {
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
         acctest.VcrTest(t, resource.TestCase{
 		PreCheck:     func() { acctest.AccTestPreCheck(t) },
@@ -1632,23 +1863,27 @@ func TestAccContainerNodePool_threadsPerCore(t *testing.T) {
 		CheckDestroy: testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerNodePool_threadsPerCore(cluster, np, 1),
+				Config: testAccContainerNodePool_threadsPerCore(cluster, np, networkName, subnetworkName, 1),
 			},
 			{
 				ResourceName:      "google_container_cluster.cluster",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
 }
 
-func testAccContainerNodePool_threadsPerCore(cluster, np string, threadsPerCore int) string {
+func testAccContainerNodePool_threadsPerCore(cluster, np, networkName, subnetworkName string, threadsPerCore int) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 
   node_config {
     machine_type = "c2-standard-4"
@@ -1671,7 +1906,7 @@ resource "google_container_node_pool" "np" {
 	}
   }
 }
-`, cluster, threadsPerCore, np, threadsPerCore)
+`, cluster, networkName, subnetworkName, threadsPerCore, np, threadsPerCore)
 }
 
 func testAccCheckContainerNodePoolDestroyProducer(t *testing.T) func(s *terraform.State) error {
@@ -1710,7 +1945,7 @@ func testAccCheckContainerNodePoolDestroyProducer(t *testing.T) func(s *terrafor
 	}
 }
 
-func testAccContainerNodePool_basic(cluster, np string) string {
+func testAccContainerNodePool_basic(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 provider "google" {
   alias                 = "user-project-override"
@@ -1721,6 +1956,9 @@ resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 3
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -1730,15 +1968,18 @@ resource "google_container_node_pool" "np" {
   cluster            = google_container_cluster.cluster.name
   initial_node_count = 2
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
-func testAccContainerNodePool_withLoggingVariant(cluster, np, loggingVariant string) string {
+func testAccContainerNodePool_withLoggingVariant(cluster, np, loggingVariant, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "with_logging_variant" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "with_logging_variant" {
@@ -1750,10 +1991,10 @@ resource "google_container_node_pool" "with_logging_variant" {
     logging_variant = "%s"
   }
 }
-`,	cluster, np, loggingVariant)
+`,	cluster, networkName, subnetworkName, np, loggingVariant)
 }
 
-func testAccContainerNodePool_basicWithClusterId(cluster, np string) string {
+func testAccContainerNodePool_basicWithClusterId(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 provider "google" {
   alias                 = "user-project-override"
@@ -1764,6 +2005,9 @@ resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 3
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -1772,7 +2016,7 @@ resource "google_container_node_pool" "np" {
   cluster            = google_container_cluster.cluster.id
   initial_node_count = 2
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
 func testAccContainerNodePool_nodeLocations(cluster, np, network string) string {
@@ -1820,6 +2064,7 @@ resource "google_container_cluster" "cluster" {
 
   master_authorized_networks_config {
   }
+  deletion_protection = false
 }
 
 resource "google_container_node_pool" "np" {
@@ -1878,6 +2123,7 @@ resource "google_container_cluster" "cluster" {
 
   master_authorized_networks_config {
   }
+  deletion_protection = false
 }
 
 resource "google_container_node_pool" "np" {
@@ -1890,12 +2136,15 @@ resource "google_container_node_pool" "np" {
 `, network, cluster, np)
 }
 
-func testAccContainerNodePool_regionalClusters(cluster, np string) string {
+func testAccContainerNodePool_regionalClusters(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1"
   initial_node_count = 3
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -1904,15 +2153,18 @@ resource "google_container_node_pool" "np" {
   location           = "us-central1"
   initial_node_count = 2
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
-func testAccContainerNodePool_namePrefix(cluster, np string) string {
+func testAccContainerNodePool_namePrefix(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 3
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -1921,15 +2173,18 @@ resource "google_container_node_pool" "np" {
   cluster            = google_container_cluster.cluster.name
   initial_node_count = 2
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
-func testAccContainerNodePool_noName(cluster string) string {
+func testAccContainerNodePool_noName(cluster, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 3
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -1937,15 +2192,18 @@ resource "google_container_node_pool" "np" {
   cluster            = google_container_cluster.cluster.name
   initial_node_count = 2
 }
-`, cluster)
+`, cluster, networkName, subnetworkName)
 }
 
-func testAccContainerNodePool_regionalAutoscaling(cluster, np string) string {
+func testAccContainerNodePool_regionalAutoscaling(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1"
   initial_node_count = 3
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -1958,16 +2216,19 @@ resource "google_container_node_pool" "np" {
     max_node_count = 3
   }
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
-func testAccContainerNodePool_totalSize(cluster, np string) string {
+func testAccContainerNodePool_totalSize(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1"
   initial_node_count = 3
   min_master_version = "1.27"
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -1981,16 +2242,19 @@ resource "google_container_node_pool" "np" {
     location_policy      = "BALANCED"
   }
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
-func testAccContainerNodePool_updateTotalSize(cluster, np string) string {
+func testAccContainerNodePool_updateTotalSize(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1"
   initial_node_count = 3
   min_master_version = "1.27"
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -2004,11 +2268,11 @@ resource "google_container_node_pool" "np" {
     location_policy      = "ANY"
   }
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
 
-func testAccContainerNodePool_basicTotalSize(cluster, np string) string {
+func testAccContainerNodePool_basicTotalSize(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 provider "google" {
   alias                 = "user-project-override"
@@ -2020,6 +2284,9 @@ resource "google_container_cluster" "cluster" {
   location           = "us-central1"
   initial_node_count = 3
   min_master_version = "1.27"
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -2029,15 +2296,18 @@ resource "google_container_node_pool" "np" {
   cluster            = google_container_cluster.cluster.name
   initial_node_count = 2
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
-func testAccContainerNodePool_autoscaling(cluster, np string) string {
+func testAccContainerNodePool_autoscaling(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 3
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -2050,15 +2320,18 @@ resource "google_container_node_pool" "np" {
     max_node_count = 3
   }
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
-func testAccContainerNodePool_updateAutoscaling(cluster, np string) string {
+func testAccContainerNodePool_updateAutoscaling(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 3
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -2071,10 +2344,10 @@ resource "google_container_node_pool" "np" {
     max_node_count = 5
   }
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
-func testAccContainerNodePool_additionalZones(cluster, nodePool string) string {
+func testAccContainerNodePool_additionalZones(cluster, nodePool, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
@@ -2085,6 +2358,9 @@ resource "google_container_cluster" "cluster" {
     "us-central1-b",
     "us-central1-c",
   ]
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -2093,10 +2369,10 @@ resource "google_container_node_pool" "np" {
   cluster    = google_container_cluster.cluster.name
   node_count = 2
 }
-`, cluster, nodePool)
+`, cluster, networkName, subnetworkName, nodePool)
 }
 
-func testAccContainerNodePool_resize(cluster, nodePool string) string {
+func testAccContainerNodePool_resize(cluster, nodePool, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
@@ -2107,6 +2383,9 @@ resource "google_container_cluster" "cluster" {
     "us-central1-b",
     "us-central1-c",
   ]
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -2115,10 +2394,10 @@ resource "google_container_node_pool" "np" {
   cluster    = google_container_cluster.cluster.name
   node_count = 3
 }
-`, cluster, nodePool)
+`, cluster, networkName, subnetworkName, nodePool)
 }
 
-func testAccContainerNodePool_withManagement(cluster, nodePool, management string) string {
+func testAccContainerNodePool_withManagement(cluster, nodePool, management, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
@@ -2127,6 +2406,9 @@ resource "google_container_cluster" "cluster" {
   release_channel {
 	  channel = "UNSPECIFIED"
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np_with_management" {
@@ -2143,15 +2425,18 @@ resource "google_container_node_pool" "np_with_management" {
     oauth_scopes = ["compute-rw", "storage-ro", "logging-write", "monitoring"]
   }
 }
-`, cluster, nodePool, management)
+`, cluster, networkName, subnetworkName, nodePool, management)
 }
 
-func testAccContainerNodePool_withNodeConfig(cluster, nodePool string) string {
+func testAccContainerNodePool_withNodeConfig(cluster, nodePool, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np_with_node_config" {
@@ -2197,15 +2482,18 @@ resource "google_container_node_pool" "np_with_node_config" {
     }
   }
 }
-`, cluster, nodePool)
+`, cluster, networkName, subnetworkName, nodePool)
 }
 
-func testAccContainerNodePool_withNodeConfigUpdate(cluster, nodePool string) string {
+func testAccContainerNodePool_withNodeConfigUpdate(cluster, nodePool, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np_with_node_config" {
@@ -2253,10 +2541,46 @@ resource "google_container_node_pool" "np_with_node_config" {
     }
   }
 }
-`, cluster, nodePool)
+`, cluster, networkName, subnetworkName, nodePool)
+}
+
+func testAccContainerNodePool_withTaintsUpdate(cluster, np, networkName, subnetworkName string) string {
+	return fmt.Sprintf(`
+provider "google" {
+  alias                 = "user-project-override"
+  user_project_override = true
+}
+resource "google_container_cluster" "cluster" {
+  provider           = google.user-project-override
+  name               = "%s"
+  location           = "us-central1-a"
+  initial_node_count = 3
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
+}
+
+resource "google_container_node_pool" "np" {
+  provider           = google.user-project-override
+  name               = "%s"
+  location           = "us-central1-a"
+  cluster            = google_container_cluster.cluster.name
+  initial_node_count = 2
+
+  node_config {
+	taint {
+      key    = "taint_key"
+      value  = "taint_value"
+      effect = "PREFER_NO_SCHEDULE"
+    }
+  }
+
+
+}
+`, cluster, networkName, subnetworkName, np)
 }
 
-func testAccContainerNodePool_withReservationAffinity(cluster, np string) string {
+func testAccContainerNodePool_withReservationAffinity(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
   location = "us-central1-a"
@@ -2267,6 +2591,9 @@ resource "google_container_cluster" "cluster" {
   location           = "us-central1-a"
   initial_node_count = 1
   min_master_version = data.google_container_engine_versions.central1a.latest_master_version
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "with_reservation_affinity" {
@@ -2285,10 +2612,10 @@ resource "google_container_node_pool" "with_reservation_affinity" {
     }
   }
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
-func testAccContainerNodePool_withReservationAffinitySpecific(cluster, reservation, np string) string {
+func testAccContainerNodePool_withReservationAffinitySpecific(cluster, reservation, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
   location = "us-central1-a"
@@ -2299,6 +2626,9 @@ resource "google_container_cluster" "cluster" {
   location           = "us-central1-a"
   initial_node_count = 1
   min_master_version = data.google_container_engine_versions.central1a.latest_master_version
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_compute_reservation" "gce_reservation" {
@@ -2335,11 +2665,11 @@ resource "google_container_node_pool" "with_reservation_affinity" {
     }
   }
 }
-`, cluster, reservation, np)
+`, cluster, networkName, subnetworkName, reservation, np)
 }
 
 
-func testAccContainerNodePool_withWorkloadMetadataConfig(cluster, np string) string {
+func testAccContainerNodePool_withWorkloadMetadataConfig(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
   location = "us-central1-a"
@@ -2350,6 +2680,9 @@ resource "google_container_cluster" "cluster" {
   location           = "us-central1-a"
   initial_node_count = 1
   min_master_version = data.google_container_engine_versions.central1a.latest_master_version
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "with_workload_metadata_config" {
@@ -2369,10 +2702,10 @@ resource "google_container_node_pool" "with_workload_metadata_config" {
     }
   }
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
-func testAccContainerNodePool_withWorkloadMetadataConfig_gkeMetadata(projectID, cluster, np string) string {
+func testAccContainerNodePool_withWorkloadMetadataConfig_gkeMetadata(projectID, cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_project" "project" {
   project_id = "%s"
@@ -2391,6 +2724,9 @@ resource "google_container_cluster" "cluster" {
   workload_identity_config {
     workload_pool = "${data.google_project.project.project_id}.svc.id.goog"
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "with_workload_metadata_config" {
@@ -2409,11 +2745,11 @@ resource "google_container_node_pool" "with_workload_metadata_config" {
     }
   }
 }
-`, projectID, cluster, np)
+`, projectID, cluster, networkName, subnetworkName, np)
 }
 
 <% unless version.nil? || version == 'ga' -%>
-func testAccContainerNodePool_withSandboxConfig(cluster, np string) string {
+func testAccContainerNodePool_withSandboxConfig(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
   location = "us-central1-a"
@@ -2424,6 +2760,9 @@ resource "google_container_cluster" "cluster" {
   location           = "us-central1-a"
   initial_node_count = 1
   min_master_version = data.google_container_engine_versions.central1a.latest_master_version
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "with_sandbox_config" {
@@ -2443,22 +2782,17 @@ resource "google_container_node_pool" "with_sandbox_config" {
       "test.terraform.io/gke-sandbox" = "true"
     }
 
-    taint {
-      key    = "test.terraform.io/gke-sandbox"
-      value  = "true"
-      effect = "NO_SCHEDULE"
-    }
-
     oauth_scopes = [
       "https://www.googleapis.com/auth/logging.write",
       "https://www.googleapis.com/auth/monitoring",
     ]
   }
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
+<% end -%>
 
-func testAccContainerNodePool_withSandboxConfig_changeTaints(cluster, np string) string {
+func testAccContainerNodePool_withKubeletConfig(cluster, np, policy, period, networkName, subnetworkName string, quota bool, podPidsLimit int) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
   location = "us-central1-a"
@@ -2469,48 +2803,60 @@ resource "google_container_cluster" "cluster" {
   location           = "us-central1-a"
   initial_node_count = 1
   min_master_version = data.google_container_engine_versions.central1a.latest_master_version
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
-resource "google_container_node_pool" "with_sandbox_config" {
+# cpu_manager_policy & cpu_cfs_quota_period cannot be blank if cpu_cfs_quota is set to true
+# cpu_manager_policy & cpu_cfs_quota_period must not set if cpu_cfs_quota is set to false
+resource "google_container_node_pool" "with_kubelet_config" {
   name               = "%s"
   location           = "us-central1-a"
   cluster            = google_container_cluster.cluster.name
   initial_node_count = 1
   node_config {
-    machine_type = "n1-standard-1"  // can't be e2 because of gvisor
     image_type = "COS_CONTAINERD"
-
-    sandbox_config {
-      sandbox_type = "gvisor"
-    }
-
-    labels = {
-      "test.terraform.io/gke-sandbox" = "true"
-    }
-
-    taint {
-      key    = "test.terraform.io/gke-sandbox"
-      value  = "true"
-      effect = "NO_SCHEDULE"
-    }
-
-    taint {
-      key    = "test.terraform.io/gke-sandbox-amended"
-      value  = "also-true"
-      effect = "NO_SCHEDULE"
+    kubelet_config {
+      cpu_manager_policy   = %q
+      cpu_cfs_quota        = %v
+      cpu_cfs_quota_period = %q
+      pod_pids_limit			 = %d
     }
-
     oauth_scopes = [
       "https://www.googleapis.com/auth/logging.write",
       "https://www.googleapis.com/auth/monitoring",
     ]
+    logging_variant = "DEFAULT"
   }
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np, policy, quota, period, podPidsLimit)
 }
-<% end -%>
 
-func testAccContainerNodePool_withKubeletConfig(cluster, np, policy, period string, quota bool, podPidsLimit int) string {
+func testAccContainerNodePool_withLinuxNodeConfig(cluster, np, tcpMem, networkName, subnetworkName string) string {
+	linuxNodeConfig := `
+    linux_node_config {
+      sysctls = {}
+    }
+`
+	if len(tcpMem) != 0 {
+		linuxNodeConfig = fmt.Sprintf(`
+    linux_node_config {
+      sysctls = {
+        "net.core.netdev_max_backlog" = "10000"
+        "net.core.rmem_max"           = 10000
+        "net.core.wmem_default"       = 10000
+        "net.core.wmem_max"           = 20000
+        "net.core.optmem_max"         = 10000
+        "net.core.somaxconn"          = 12800
+        "net.ipv4.tcp_rmem"           = "%s"
+        "net.ipv4.tcp_wmem"           = "%s"
+        "net.ipv4.tcp_tw_reuse"       = 1
+      }
+    }
+`, tcpMem, tcpMem)
+	}
+
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
   location = "us-central1-a"
@@ -2521,46 +2867,45 @@ resource "google_container_cluster" "cluster" {
   location           = "us-central1-a"
   initial_node_count = 1
   min_master_version = data.google_container_engine_versions.central1a.latest_master_version
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
-# cpu_manager_policy & cpu_cfs_quota_period cannot be blank if cpu_cfs_quota is set to true
-# cpu_manager_policy & cpu_cfs_quota_period must not set if cpu_cfs_quota is set to false
-resource "google_container_node_pool" "with_kubelet_config" {
+resource "google_container_node_pool" "with_linux_node_config" {
   name               = "%s"
   location           = "us-central1-a"
   cluster            = google_container_cluster.cluster.name
   initial_node_count = 1
   node_config {
     image_type = "COS_CONTAINERD"
-    kubelet_config {
-      cpu_manager_policy   = %q
-      cpu_cfs_quota        = %v
-      cpu_cfs_quota_period = %q
-      pod_pids_limit			 = %d
-    }
+    %s
     oauth_scopes = [
       "https://www.googleapis.com/auth/logging.write",
       "https://www.googleapis.com/auth/monitoring",
     ]
   }
 }
-`, cluster, np, policy, quota, period, podPidsLimit)
+`, cluster, networkName, subnetworkName, np, linuxNodeConfig)
 }
 
-func testAccContainerNodePool_withLinuxNodeConfig(cluster, np string, maxBacklog, soMaxConn int, tcpMem string, twReuse int) string {
+func testAccContainerNodePool_withCgroupMode(cluster, np, mode, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
   location = "us-central1-a"
 }
 
 resource "google_container_cluster" "cluster" {
-  name               = "%s"
-  location           = "us-central1-a"
-  initial_node_count = 1
-  min_master_version = data.google_container_engine_versions.central1a.latest_master_version
+  name                = "%s"
+  location            = "us-central1-a"
+  initial_node_count  = 1
+  min_master_version  = data.google_container_engine_versions.central1a.latest_master_version
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
-resource "google_container_node_pool" "with_linux_node_config" {
+resource "google_container_node_pool" "np" {
   name               = "%s"
   location           = "us-central1-a"
   cluster            = google_container_cluster.cluster.name
@@ -2568,17 +2913,7 @@ resource "google_container_node_pool" "with_linux_node_config" {
   node_config {
     image_type = "COS_CONTAINERD"
     linux_node_config {
-      sysctls = {
-        "net.core.netdev_max_backlog" = "%d"
-        "net.core.rmem_max"           = 10000
-        "net.core.wmem_default"       = 10000
-        "net.core.wmem_max"           = 20000
-        "net.core.optmem_max"         = 10000
-        "net.core.somaxconn"          = %d
-        "net.ipv4.tcp_rmem"           = "%s"
-        "net.ipv4.tcp_wmem"           = "%s"
-        "net.ipv4.tcp_tw_reuse"       = %d
-      }
+      cgroup_mode = "%s"
     }
     oauth_scopes = [
       "https://www.googleapis.com/auth/logging.write",
@@ -2586,10 +2921,9 @@ resource "google_container_node_pool" "with_linux_node_config" {
     ]
   }
 }
-`, cluster, np, maxBacklog, soMaxConn, tcpMem, tcpMem, twReuse)
+`, cluster, networkName, subnetworkName, np, mode)
 }
 
-
 func testAccContainerNodePool_withNetworkConfig(cluster, np, network string) string {
 	return fmt.Sprintf(`
 resource "google_compute_network" "container_network" {
@@ -2641,6 +2975,7 @@ resource "google_container_cluster" "cluster" {
   release_channel {
 	channel = "RAPID"
   }
+  deletion_protection = false
 }
 
 resource "google_container_node_pool" "with_manual_pod_cidr" {
@@ -2778,6 +3113,7 @@ resource "google_container_cluster" "cluster" {
   }
   enable_multi_networking = true
   datapath_provider = "ADVANCED_DATAPATH"
+  deletion_protection = false
 }
 
 resource "google_container_node_pool" "with_multi_nic" {
@@ -2817,7 +3153,7 @@ resource "google_container_node_pool" "with_multi_nic" {
 <% end -%>
 
 <% unless version.nil? || version == 'ga' -%>
-func testAccContainerNodePool_withBootDiskKmsKey(cluster, np string) string {
+func testAccContainerNodePool_withBootDiskKmsKey(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
   location = "us-central1-a"
@@ -2839,6 +3175,9 @@ resource "google_container_cluster" "cluster" {
   location           = "us-central1-a"
   initial_node_count = 1
   min_master_version = data.google_container_engine_versions.central1a.latest_master_version
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "with_boot_disk_kms_key" {
@@ -2856,7 +3195,7 @@ resource "google_container_node_pool" "with_boot_disk_kms_key" {
     ]
   }
 }
-`, cluster, cluster, cluster, np)
+`, cluster, cluster, cluster, networkName, subnetworkName, np)
 }
 <% end -%>
 
@@ -2885,7 +3224,7 @@ upgrade_settings {
 `, maxSurge, maxUnavailable, strategy)
 }
 
-func testAccContainerNodePool_withUpgradeSettings(clusterName string, nodePoolName string, maxSurge int, maxUnavailable int, strategy string, nodePoolSoakDuration string, batchNodeCount int, batchPercentage float64, batchSoakDuration string) string {
+func testAccContainerNodePool_withUpgradeSettings(clusterName, nodePoolName, networkName, subnetworkName string, maxSurge int, maxUnavailable int, strategy string, nodePoolSoakDuration string, batchNodeCount int, batchPercentage float64, batchSoakDuration string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "central1" {
   location = "us-central1"
@@ -2896,6 +3235,9 @@ resource "google_container_cluster" "cluster" {
   location           = "us-central1"
   initial_node_count = 1
   min_master_version = "${data.google_container_engine_versions.central1.latest_master_version}"
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "with_upgrade_settings" {
@@ -2905,10 +3247,10 @@ resource "google_container_node_pool" "with_upgrade_settings" {
   initial_node_count = 1
   %s
 }
-`, clusterName, nodePoolName, makeUpgradeSettings(maxSurge, maxUnavailable, strategy, nodePoolSoakDuration, batchNodeCount, batchPercentage, batchSoakDuration))
+`, clusterName, networkName, subnetworkName, nodePoolName, makeUpgradeSettings(maxSurge, maxUnavailable, strategy, nodePoolSoakDuration, batchNodeCount, batchPercentage, batchSoakDuration))
 }
 
-func testAccContainerNodePool_withGPU(cluster, np string) string {
+func testAccContainerNodePool_withGPU(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "central1c" {
   location = "us-central1-c"
@@ -2919,6 +3261,9 @@ resource "google_container_cluster" "cluster" {
   location           = "us-central1-c"
   initial_node_count = 1
   min_master_version = data.google_container_engine_versions.central1c.latest_master_version
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np_with_gpu" {
@@ -2959,15 +3304,18 @@ resource "google_container_node_pool" "np_with_gpu" {
     }
   }
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
-func testAccContainerNodePool_withNodeConfigScopeAlias(cluster, np string) string {
+func testAccContainerNodePool_withNodeConfigScopeAlias(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np_with_node_config_scope_alias" {
@@ -2981,10 +3329,10 @@ resource "google_container_node_pool" "np_with_node_config_scope_alias" {
     oauth_scopes = ["compute-rw", "storage-ro", "logging-write", "monitoring"]
   }
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
-func testAccContainerNodePool_version(cluster, np string) string {
+func testAccContainerNodePool_version(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
   location = "us-central1-a"
@@ -2995,6 +3343,9 @@ resource "google_container_cluster" "cluster" {
   location           = "us-central1-a"
   initial_node_count = 1
   min_master_version = data.google_container_engine_versions.central1a.latest_master_version
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -3005,10 +3356,10 @@ resource "google_container_node_pool" "np" {
 
   version = data.google_container_engine_versions.central1a.valid_node_versions[1]
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
-func testAccContainerNodePool_updateVersion(cluster, np string) string {
+func testAccContainerNodePool_updateVersion(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
   location = "us-central1-a"
@@ -3019,6 +3370,9 @@ resource "google_container_cluster" "cluster" {
   location           = "us-central1-a"
   initial_node_count = 1
   min_master_version = data.google_container_engine_versions.central1a.latest_master_version
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -3029,15 +3383,18 @@ resource "google_container_node_pool" "np" {
 
   version = data.google_container_engine_versions.central1a.valid_node_versions[0]
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
-func testAccContainerNodePool_012_ConfigModeAttr1(cluster, np string) string {
+func testAccContainerNodePool_012_ConfigModeAttr1(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1-f"
   initial_node_count = 3
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -3049,20 +3406,23 @@ resource "google_container_node_pool" "np" {
   node_config {
     guest_accelerator {
       count = 1
-      type  = "nvidia-tesla-p100"
+      type  = "nvidia-tesla-t4"
     }
 	machine_type = "n1-highmem-4"
   }
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
-func testAccContainerNodePool_012_ConfigModeAttr2(cluster, np string) string {
+func testAccContainerNodePool_012_ConfigModeAttr2(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1-f"
   initial_node_count = 3
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -3075,15 +3435,18 @@ resource "google_container_node_pool" "np" {
     guest_accelerator = []
   }
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
-func testAccContainerNodePool_EmptyGuestAccelerator(cluster, np string) string {
+func testAccContainerNodePool_EmptyGuestAccelerator(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1-f"
   initial_node_count = 3
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -3100,15 +3463,18 @@ resource "google_container_node_pool" "np" {
 	machine_type = "n1-highmem-4"
   }
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
-func testAccContainerNodePool_PartialEmptyGuestAccelerator(cluster, np string, count int) string {
+func testAccContainerNodePool_PartialEmptyGuestAccelerator(cluster, np, networkName, subnetworkName string, count int) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1-f"
   initial_node_count = 3
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -3130,15 +3496,18 @@ resource "google_container_node_pool" "np" {
 	machine_type = "n1-highmem-4"
   }
 }
-`, cluster, np, count)
+`, cluster, networkName, subnetworkName, np, count)
 }
 
-func testAccContainerNodePool_PartialEmptyGuestAccelerator2(cluster, np string) string {
+func testAccContainerNodePool_PartialEmptyGuestAccelerator2(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1-f"
   initial_node_count = 3
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -3165,15 +3534,18 @@ resource "google_container_node_pool" "np" {
 	machine_type = "n1-highmem-4"
   }
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
-func testAccContainerNodePool_shieldedInstanceConfig(cluster, np string) string {
+func testAccContainerNodePool_shieldedInstanceConfig(cluster, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
@@ -3188,15 +3560,18 @@ resource "google_container_node_pool" "np" {
     }
   }
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
-func testAccContainerNodePool_concurrentCreate(cluster, np1, np2 string) string {
+func testAccContainerNodePool_concurrentCreate(cluster, np1, np2, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 3
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np1" {
@@ -3212,15 +3587,18 @@ resource "google_container_node_pool" "np2" {
 	cluster            = google_container_cluster.cluster.name
 	initial_node_count = 2
   }
-`, cluster, np1, np2)
+`, cluster, networkName, subnetworkName, np1, np2)
 }
 
-func testAccContainerNodePool_concurrentUpdate(cluster, np1, np2 string) string {
+func testAccContainerNodePool_concurrentUpdate(cluster, np1, np2, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
   location           = "us-central1-a"
   initial_node_count = 3
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np1" {
@@ -3238,10 +3616,10 @@ resource "google_container_node_pool" "np2" {
   initial_node_count = 2
   version            = "1.27.3-gke.1700"
 }
-`, cluster, np1, np2)
+`, cluster, networkName, subnetworkName, np1, np2)
 }
 
-func testAccContainerNodePool_withSoleTenantConfig(cluster, np string) string {
+func testAccContainerNodePool_withSoleTenantConfig(cluster, np, networkName, subnetworkName string) string {
        return fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
   location = "us-central1-a"
@@ -3256,7 +3634,7 @@ resource "google_compute_node_template" "soletenant-tmpl" {
 resource "google_compute_node_group" "nodes" {
   name        = "tf-test-soletenant-group"
   zone        = "us-central1-a"
-  size          = 1
+  initial_size	= 1
   node_template = google_compute_node_template.soletenant-tmpl.id
 }
 
@@ -3265,6 +3643,9 @@ resource "google_container_cluster" "cluster" {
   location           = "us-central1-a"
   initial_node_count = 1
   min_master_version = data.google_container_engine_versions.central1a.latest_master_version
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "with_sole_tenant_config" {
@@ -3287,7 +3668,7 @@ resource "google_container_node_pool" "with_sole_tenant_config" {
     ]
   }
 }
-`, cluster, np)
+`, cluster, networkName, subnetworkName, np)
 }
 
 func TestAccContainerNodePool_withConfidentialNodes(t *testing.T) {
@@ -3295,6 +3676,8 @@ func TestAccContainerNodePool_withConfidentialNodes(t *testing.T) {
 
 	clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np := fmt.Sprintf("tf-test-cluster-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:	  func() { acctest.AccTestPreCheck(t) },
@@ -3302,7 +3685,7 @@ func TestAccContainerNodePool_withConfidentialNodes(t *testing.T) {
 		CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerNodePool_withConfidentialNodes(clusterName, np),
+				Config: testAccContainerNodePool_withConfidentialNodes(clusterName, np, networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_node_pool.np",
@@ -3310,7 +3693,7 @@ func TestAccContainerNodePool_withConfidentialNodes(t *testing.T) {
 				ImportStateVerify:       true,
 			},
 			{
-				Config: testAccContainerNodePool_disableConfidentialNodes(clusterName, np),
+				Config: testAccContainerNodePool_disableConfidentialNodes(clusterName, np, networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_node_pool.np",
@@ -3318,7 +3701,7 @@ func TestAccContainerNodePool_withConfidentialNodes(t *testing.T) {
 				ImportStateVerify:       true,
 			},
 			{
-				Config: testAccContainerNodePool_withConfidentialNodes(clusterName, np),
+				Config: testAccContainerNodePool_withConfidentialNodes(clusterName, np, networkName, subnetworkName),
 			},
 			{
 				ResourceName:            "google_container_node_pool.np",
@@ -3329,11 +3712,11 @@ func TestAccContainerNodePool_withConfidentialNodes(t *testing.T) {
 	})
 }
 
-func testAccContainerNodePool_withConfidentialNodes(clusterName string, np string) string {
+func testAccContainerNodePool_withConfidentialNodes(clusterName, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
-  location           = "asia-east1-c"
+  location           = "us-central1-a"
   initial_node_count = 1
   node_config {
     confidential_nodes {
@@ -3341,11 +3724,14 @@ resource "google_container_cluster" "cluster" {
     }
     machine_type = "n2-standard-2"
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
   name               = "%s"
-  location           = "asia-east1-c"
+  location           = "us-central1-a"
   cluster            = google_container_cluster.cluster.name
   initial_node_count = 1
   node_config {
@@ -3355,14 +3741,14 @@ resource "google_container_node_pool" "np" {
     }
   }
 }
-`, clusterName, np)
+`, clusterName, networkName, subnetworkName, np)
 }
 
-func testAccContainerNodePool_disableConfidentialNodes(clusterName string, np string) string {
+func testAccContainerNodePool_disableConfidentialNodes(clusterName, np, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
-  location           = "asia-east1-c"
+  location           = "us-central1-a"
   initial_node_count = 1
   node_config {
     confidential_nodes {
@@ -3370,11 +3756,14 @@ resource "google_container_cluster" "cluster" {
     }
     machine_type = "n2-standard-2"
   }
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "np" {
   name               = "%s"
-  location           = "asia-east1-c"
+  location           = "us-central1-a"
   cluster            = google_container_cluster.cluster.name
   initial_node_count = 1
   node_config {
@@ -3384,17 +3773,18 @@ resource "google_container_node_pool" "np" {
     }
   }
 }
-`, clusterName, np)
+`, clusterName, networkName, subnetworkName, np)
 }
 
-<% unless version == 'ga' -%>
 func TestAccContainerNodePool_tpuTopology(t *testing.T) {
 	t.Parallel()
-	acctest.SkipIfVcr(t)
+	t.Skip("https://github.com/hashicorp/terraform-provider-google/issues/15254#issuecomment-1646277473")
 
 	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
 	np1 := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
 	np2 := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -3402,7 +3792,7 @@ func TestAccContainerNodePool_tpuTopology(t *testing.T) {
 		CheckDestroy:             testAccCheckContainerNodePoolDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccContainerNodePool_tpuTopology(cluster, np1, np2, "2x2x2"),
+				Config: testAccContainerNodePool_tpuTopology(cluster, np1, np2, "2x2x2", networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("google_container_node_pool.regular_pool", "node_config.0.machine_type", "n1-standard-4"),
 					resource.TestCheckResourceAttr("google_container_node_pool.with_tpu_topology", "node_config.0.machine_type", "ct4p-hightpu-4t"),
@@ -3419,29 +3809,31 @@ func TestAccContainerNodePool_tpuTopology(t *testing.T) {
 	})
 }
 
-func testAccContainerNodePool_tpuTopology(cluster, np1, np2, tpuTopology string) string {
+func testAccContainerNodePool_tpuTopology(cluster, np1, np2, tpuTopology, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_container_cluster" "cluster" {
   name               = "%s"
-  location           = "us-central2-b"
+  location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
 }
 
 resource "google_container_node_pool" "regular_pool" {
-	name               = "%s"
-	location           = "us-central2-b"
-	cluster            = google_container_cluster.cluster.name
-	initial_node_count = 1
-  
-	node_config {
-	  machine_type = "n1-standard-4"
-  
-	}
+  name               = "%s"
+  location           = "us-central1-a"
+  cluster            = google_container_cluster.cluster.name
+  initial_node_count = 1
+
+  node_config {
+    machine_type = "n1-standard-4"
   }
+}
 
 resource "google_container_node_pool" "with_tpu_topology" {
   name               = "%s"
-  location           = "us-central2-b"
+  location           = "us-central1-a"
   cluster            = google_container_cluster.cluster.name
   initial_node_count = 2
 
@@ -3450,13 +3842,14 @@ resource "google_container_node_pool" "with_tpu_topology" {
 
   }
   placement_policy {
-	type = "COMPACT"
-	tpu_topology = "%s"
+  type = "COMPACT"
+  tpu_topology = "%s"
   }
 }
-`, cluster, np1, np2, tpuTopology)
+`, cluster, networkName, subnetworkName, np1, np2, tpuTopology)
 }
 
+<% unless version == 'ga' -%>
 func TestAccContainerNodePool_withHostMaintenancePolicy(t *testing.T) {
 	t.Parallel()
 
@@ -3492,6 +3885,7 @@ resource "google_container_cluster" "cluster" {
 	}
     machine_type = "n2-standard-2"
   }
+  deletion_protection = false
 }
 
 resource "google_container_node_pool" "np" {
@@ -3509,3 +3903,132 @@ resource "google_container_node_pool" "np" {
 `, cluster, np)
 }
 <% end -%>
+
+<% unless version == 'ga' -%>
+
+func TestAccContainerNodePool_withConfidentialBootDisk(t *testing.T) {
+	t.Parallel()
+
+	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	np := fmt.Sprintf("tf-test-np-%s", acctest.RandString(t, 10))
+	kms := acctest.BootstrapKMSKeyInLocation(t, "us-central1")
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
+
+	if acctest.BootstrapPSARole(t, "service-", "compute-system", "roles/cloudkms.cryptoKeyEncrypterDecrypter") {
+		t.Fatal("Stopping the test because a role was added to the policy.")
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckContainerClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccContainerNodePool_withConfidentialBootDisk(cluster, np, kms.CryptoKey.Name, networkName, subnetworkName),
+			},
+			{
+				ResourceName:      "google_container_node_pool.with_confidential_boot_disk",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccContainerNodePool_withConfidentialBootDisk(cluster, np string, kmsKeyName, networkName, subnetworkName string) string {
+	return fmt.Sprintf(`
+data "google_container_engine_versions" "central1a" {
+  location = "us-central1-a"
+}
+
+resource "google_container_cluster" "cluster" {
+  name               = "%s"
+  location           = "us-central1-a"
+  initial_node_count = 1
+  min_master_version = data.google_container_engine_versions.central1a.latest_master_version
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
+}
+
+resource "google_container_node_pool" "with_confidential_boot_disk" {
+  name               = "%s"
+  location           = "us-central1-a"
+  cluster            = google_container_cluster.cluster.name
+    
+  node_config {
+    image_type = "COS_CONTAINERD"
+    boot_disk_kms_key = "%s"
+    oauth_scopes = [
+      "https://www.googleapis.com/auth/logging.write",
+      "https://www.googleapis.com/auth/monitoring",
+    ]
+    enable_confidential_storage = true
+    machine_type = "n2-standard-2"
+    disk_type = "hyperdisk-balanced"
+  }
+}
+`, cluster, networkName, subnetworkName, np, kmsKeyName)
+}
+
+func TestAccContainerNodePool_withoutConfidentialBootDisk(t *testing.T) {
+	t.Parallel()	
+
+	cluster := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
+	np := fmt.Sprintf("tf-test-np-%s", acctest.RandString(t, 10))
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckContainerClusterDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccContainerNodePool_withoutConfidentialBootDisk(cluster, np, networkName, subnetworkName),
+			},
+			{
+				ResourceName:      "google_container_node_pool.without_confidential_boot_disk",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccContainerNodePool_withoutConfidentialBootDisk(cluster, np, networkName, subnetworkName string) string {
+	return fmt.Sprintf(`
+data "google_container_engine_versions" "central1a" {
+  location = "us-central1-a"
+}
+
+resource "google_container_cluster" "cluster" {
+  name               = "%s"
+  location           = "us-central1-a"
+  initial_node_count = 1
+  min_master_version = data.google_container_engine_versions.central1a.latest_master_version
+  deletion_protection = false
+  network    = "%s"
+  subnetwork    = "%s"
+}
+
+resource "google_container_node_pool" "without_confidential_boot_disk" {
+  name               = "%s"
+  location           = "us-central1-a"
+  cluster            = google_container_cluster.cluster.name
+    
+  node_config {
+    image_type = "COS_CONTAINERD"
+    oauth_scopes = [
+      "https://www.googleapis.com/auth/logging.write",
+      "https://www.googleapis.com/auth/monitoring",
+    ]
+    enable_confidential_storage = false
+    machine_type = "n2-standard-2"
+    disk_type = "pd-balanced"
+  }
+}
+`, cluster, networkName, subnetworkName, np)
+}
+<% end -%>
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/services/containeranalysis/resource_container_registry.go b/mmv1/third_party/terraform/services/containeranalysis/resource_container_registry.go
index f19e1389bd0b..d44bb07e105c 100644
--- a/mmv1/third_party/terraform/services/containeranalysis/resource_container_registry.go
+++ b/mmv1/third_party/terraform/services/containeranalysis/resource_container_registry.go
@@ -5,6 +5,7 @@ import (
 	"log"
 	"strings"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
@@ -16,6 +17,10 @@ func ResourceContainerRegistry() *schema.Resource {
 		Read:   resourceContainerRegistryRead,
 		Delete: resourceContainerRegistryDelete,
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+		),
+
 		Schema: map[string]*schema.Schema{
 			"location": {
 				Type:     schema.TypeString,
diff --git a/mmv1/third_party/terraform/services/containerattached/resource_container_attached_cluster_update_test.go b/mmv1/third_party/terraform/services/containerattached/resource_container_attached_cluster_update_test.go
index 8df998cc8aab..1ffd4f727393 100644
--- a/mmv1/third_party/terraform/services/containerattached/resource_container_attached_cluster_update_test.go
+++ b/mmv1/third_party/terraform/services/containerattached/resource_container_attached_cluster_update_test.go
@@ -26,7 +26,7 @@ func TestAccContainerAttachedCluster_update(t *testing.T) {
 				ResourceName:            "google_container_attached_cluster.primary",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"location"},
+				ImportStateVerifyIgnore: []string{"location", "annotations"},
 			},
 			{
 				Config: testAccContainerAttachedCluster_containerAttachedCluster_update(context),
@@ -35,7 +35,7 @@ func TestAccContainerAttachedCluster_update(t *testing.T) {
 				ResourceName:            "google_container_attached_cluster.primary",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"location"},
+				ImportStateVerifyIgnore: []string{"location", "annotations"},
 			},
 			{
 				Config: testAccContainerAttachedCluster_containerAttachedCluster_destroy(context),
@@ -44,7 +44,7 @@ func TestAccContainerAttachedCluster_update(t *testing.T) {
 				ResourceName:            "google_container_attached_cluster.primary",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"location"},
+				ImportStateVerifyIgnore: []string{"location", "annotations"},
 			},
 		},
 	})
@@ -71,6 +71,7 @@ resource "google_container_attached_cluster" "primary" {
   }
   authorization {
     admin_users = [ "user1@example.com", "user2@example.com"]
+    admin_groups = [ "group1@example.com", "group2@example.com"]
   }
   oidc_config {
       issuer_url = "https://oidc.issuer.url"
@@ -90,6 +91,9 @@ resource "google_container_attached_cluster" "primary" {
       enabled = true
     }
   }
+  binary_authorization {
+    evaluation_mode = "PROJECT_SINGLETON_POLICY_ENFORCE"
+  }
 }
 `, context)
 }
@@ -116,6 +120,7 @@ resource "google_container_attached_cluster" "primary" {
   }
   authorization {
     admin_users = [ "user2@example.com", "user3@example.com"]
+    admin_groups = [ "group3@example.com"]
   }
   oidc_config {
       issuer_url = "https://oidc.issuer.url"
@@ -128,6 +133,9 @@ resource "google_container_attached_cluster" "primary" {
   monitoring_config {
     managed_prometheus_config {}
   }
+  binary_authorization {
+    evaluation_mode = "DISABLED"
+  }
   lifecycle {
     prevent_destroy = true
   }
@@ -159,6 +167,7 @@ resource "google_container_attached_cluster" "primary" {
   }
   authorization {
     admin_users = [ "user2@example.com", "user3@example.com"]
+    admin_groups = [ "group3@example.com"]
   }
   oidc_config {
       issuer_url = "https://oidc.issuer.url"
@@ -171,6 +180,9 @@ resource "google_container_attached_cluster" "primary" {
   monitoring_config {
     managed_prometheus_config {}
   }
+  binary_authorization {
+    evaluation_mode = "DISABLED"
+  }
 }
 `, context)
 }
diff --git a/mmv1/third_party/terraform/services/corebilling/resource_google_billing_project_info_test.go b/mmv1/third_party/terraform/services/corebilling/resource_google_billing_project_info_test.go
index 67ea5ce04e93..feb75b3d7ad6 100644
--- a/mmv1/third_party/terraform/services/corebilling/resource_google_billing_project_info_test.go
+++ b/mmv1/third_party/terraform/services/corebilling/resource_google_billing_project_info_test.go
@@ -29,6 +29,7 @@ func TestAccBillingProjectInfo_update(t *testing.T) {
 				ResourceName:      "google_billing_project_info.info",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateId:     fmt.Sprintf("projects/%s", projectId),
 			},
 			{
 				Config: testAccBillingProjectInfo_basic(projectId, orgId, ""),
@@ -37,6 +38,7 @@ func TestAccBillingProjectInfo_update(t *testing.T) {
 				ResourceName:      "google_billing_project_info.info",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateId:     fmt.Sprintf("projects/%s", projectId),
 			},
 			{
 				Config: testAccBillingProjectInfo_basic(projectId, orgId, billingAccount),
@@ -45,6 +47,7 @@ func TestAccBillingProjectInfo_update(t *testing.T) {
 				ResourceName:      "google_billing_project_info.info",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateId:     fmt.Sprintf("projects/%s", projectId),
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/databasemigrationservice/resource_database_migration_service_connection_profile_test.go b/mmv1/third_party/terraform/services/databasemigrationservice/resource_database_migration_service_connection_profile_test.go
index 598da3507871..eb4e9a879c0f 100644
--- a/mmv1/third_party/terraform/services/databasemigrationservice/resource_database_migration_service_connection_profile_test.go
+++ b/mmv1/third_party/terraform/services/databasemigrationservice/resource_database_migration_service_connection_profile_test.go
@@ -3,8 +3,9 @@ package databasemigrationservice_test
 import (
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-provider-google/google/acctest"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 )
 
 func TestAccDatabaseMigrationServiceConnectionProfile_update(t *testing.T) {
@@ -25,7 +26,7 @@ func TestAccDatabaseMigrationServiceConnectionProfile_update(t *testing.T) {
 				ResourceName:            "google_database_migration_service_connection_profile.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"connection_profile_id", "location", "mysql.0.password"},
+				ImportStateVerifyIgnore: []string{"connection_profile_id", "location", "mysql.0.password", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccDatabaseMigrationServiceConnectionProfile_update(suffix),
@@ -34,7 +35,7 @@ func TestAccDatabaseMigrationServiceConnectionProfile_update(t *testing.T) {
 				ResourceName:            "google_database_migration_service_connection_profile.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"connection_profile_id", "location", "mysql.0.password"},
+				ImportStateVerifyIgnore: []string{"connection_profile_id", "location", "mysql.0.password", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -77,3 +78,70 @@ resource "google_database_migration_service_connection_profile" "default" {
 }
 `, context)
 }
+
+func TestAccDatabaseMigrationServiceConnectionProfile_databaseMigrationServiceConnectionProfileAlloydb(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "vpc-network-1"),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckDatabaseMigrationServiceConnectionProfileDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDatabaseMigrationServiceConnectionProfile_databaseMigrationServiceConnectionProfileAlloydb(context),
+			},
+			{
+				ResourceName:            "google_database_migration_service_connection_profile.alloydbprofile",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"connection_profile_id", "location", "alloydb.0.settings.0.initial_user.0.password", "labels", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccDatabaseMigrationServiceConnectionProfile_databaseMigrationServiceConnectionProfileAlloydb(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+
+resource "google_database_migration_service_connection_profile" "alloydbprofile" {
+  location = "us-central1"
+  connection_profile_id = "tf-test-my-profileid%{random_suffix}"
+  display_name = "tf-test-my-profileid%{random_suffix}_display"
+  labels = { 
+    foo = "bar" 
+  }
+  alloydb {
+    cluster_id = "tf-test-dbmsalloycluster%{random_suffix}"
+    settings {
+      initial_user {
+        user = "alloyuser%{random_suffix}"
+        password = "alloypass%{random_suffix}"
+      }
+      vpc_network = data.google_compute_network.default.id
+      labels  = { 
+        alloyfoo = "alloybar" 
+      }
+      primary_instance_settings {
+        id = "priminstid"
+        machine_config {
+          cpu_count = 2
+        }
+        database_flags = { 
+        }
+        labels = { 
+          alloysinstfoo = "allowinstbar" 
+        }
+      }
+    }
+  }
+}
+`, context)
+}
diff --git a/mmv1/third_party/terraform/services/dataflow/resource_dataflow_flex_template_job.go.erb b/mmv1/third_party/terraform/services/dataflow/resource_dataflow_flex_template_job.go.erb
index 01632223d44b..8ef9ad05c1da 100644
--- a/mmv1/third_party/terraform/services/dataflow/resource_dataflow_flex_template_job.go.erb
+++ b/mmv1/third_party/terraform/services/dataflow/resource_dataflow_flex_template_job.go.erb
@@ -6,13 +6,14 @@ import (
 	"context"
 	"fmt"
 	"log"
+	"strconv"
 	"strings"
 	"time"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"google.golang.org/api/googleapi"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -32,11 +33,20 @@ func ResourceDataflowFlexTemplateJob() *schema.Resource {
 		Update: resourceDataflowFlexTemplateJobUpdate,
 		Delete: resourceDataflowFlexTemplateJobDelete,
 		CustomizeDiff: customdiff.All(
+			tpgresource.SetLabelsDiff,
 			resourceDataflowFlexJobTypeCustomizeDiff,
 		),
 		Importer: &schema.ResourceImporter{
 			State: schema.ImportStatePassthrough,
 		},
+		SchemaVersion: 1,
+		StateUpgraders: []schema.StateUpgrader{
+			{
+				Type:    resourceDataflowFlexTemplateJobResourceV0().CoreConfigSchema().ImpliedType(),
+				Upgrade: ResourceDataflowFlexTemplateJobStateUpgradeV0,
+				Version: 0,
+			},
+		},
 		Schema: map[string]*schema.Schema{
 
 			"container_spec_gcs_path": {
@@ -74,8 +84,22 @@ func ResourceDataflowFlexTemplateJob() *schema.Resource {
 			"labels": {
 				Type:             schema.TypeMap,
 				Optional:         true,
-				DiffSuppressFunc: resourceDataflowJobLabelDiffSuppress,
-				Description:      `User labels to be specified for the job. Keys and values should follow the restrictions specified in the labeling restrictions page. NOTE: Google-provided Dataflow templates often provide default labels that begin with goog-dataflow-provided. Unless explicitly set in config, these labels will be ignored to prevent diffs on re-apply.`,
+				Description:      `User labels to be specified for the job. Keys and values should follow the restrictions specified in the labeling restrictions page. NOTE: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+			},
+
+			"terraform_labels": {
+				Type:        schema.TypeMap,
+				Computed:    true,
+				Description: `The combination of labels configured directly on the resource and default labels configured on the provider.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+			},
+
+			"effective_labels": {
+				Type:        schema.TypeMap,
+				Computed:    true,
+				Description: `All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
 			},
 
 			"parameters": {
@@ -111,6 +135,7 @@ func ResourceDataflowFlexTemplateJob() *schema.Resource {
 				Optional: true,
 				// ForceNew applies to both stream and batch jobs
 				ForceNew:    true,
+				Computed:    true,
 				Description: `The initial number of Google Compute Engine instances for the job.`,
 			},
 
@@ -119,6 +144,7 @@ func ResourceDataflowFlexTemplateJob() *schema.Resource {
 				Optional: true,
 				// ForceNew applies to both stream and batch jobs
 				ForceNew:    true,
+				Computed:    true,
 				Description: `The maximum number of Google Compute Engine instances to be made available to your pipeline during execution, from 1 to 1000.`,
 			},
 
@@ -146,12 +172,14 @@ func ResourceDataflowFlexTemplateJob() *schema.Resource {
 			"sdk_container_image": {
 				Type:        schema.TypeString,
 				Optional:    true,
+				Computed:    true,
 				Description: `Docker registry location of container image to use for the 'worker harness. Default is the container for the version of the SDK. Note this field is only valid for portable pipelines.`,
 			},
 
 			"network": {
 				Type:             schema.TypeString,
 				Optional:         true,
+				Computed:         true,
 				DiffSuppressFunc: tpgresource.CompareSelfLinkOrResourceName,
 				Description:      `The network to which VMs will be assigned. If it is not provided, "default" will be used.`,
 			},
@@ -159,6 +187,7 @@ func ResourceDataflowFlexTemplateJob() *schema.Resource {
 			"subnetwork": {
 				Type:             schema.TypeString,
 				Optional:         true,
+				Computed:         true,
 				DiffSuppressFunc: tpgresource.CompareSelfLinkOrResourceName,
 				Description:      `The subnetwork to which VMs will be assigned. Should be of the form "regions/REGION/subnetworks/SUBNETWORK".`,
 			},
@@ -166,12 +195,14 @@ func ResourceDataflowFlexTemplateJob() *schema.Resource {
 			"machine_type": {
 				Type:        schema.TypeString,
 				Optional:    true,
+				Computed:    true,
 				Description: `The machine type to use for the job.`,
 			},
 
 			"kms_key_name": {
 				Type:        schema.TypeString,
 				Optional:    true,
+				Computed:    true,
 				Description: `The name for the Cloud KMS key for the job. Key format is: projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY`,
 			},
 
@@ -202,12 +233,14 @@ func ResourceDataflowFlexTemplateJob() *schema.Resource {
 			"autoscaling_algorithm": {
 				Type:        schema.TypeString,
 				Optional:    true,
+				Computed:    true,
 				Description: `The algorithm to use for autoscaling`,
 			},
 
 			"launcher_machine_type": {
 				Type:        schema.TypeString,
 				Optional:    true,
+				Computed:    true,
 				Description: `The machine type to use for launching the job. The default is n1-standard-1.`,
 			},
 
@@ -225,7 +258,7 @@ func ResourceDataflowFlexTemplateJob() *schema.Resource {
 // resourceDataflowFlexTemplateJobCreate creates a Flex Template Job from TF code.
 func resourceDataflowFlexTemplateJobCreate(d *schema.ResourceData, meta interface{}) error {
 	config := meta.(*transport_tpg.Config)
-	userAgent, err :=  tpgresource.GenerateUserAgentString(d, config.UserAgent)
+	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
 	if err != nil {
 		return err
 	}
@@ -240,7 +273,7 @@ func resourceDataflowFlexTemplateJobCreate(d *schema.ResourceData, meta interfac
 		return err
 	}
 
-	env, err := resourceDataflowFlexJobSetupEnv(d, config)
+	env, updatedParameters, err := resourceDataflowFlexJobSetupEnv(d, config)
 	if err != nil {
 		return err
 	}
@@ -249,7 +282,7 @@ func resourceDataflowFlexTemplateJobCreate(d *schema.ResourceData, meta interfac
 		LaunchParameter: &dataflow.LaunchFlexTemplateParameter{
 			ContainerSpecGcsPath: d.Get("container_spec_gcs_path").(string),
 			JobName:              d.Get("name").(string),
-			Parameters:           tpgresource.ExpandStringMap(d, "parameters"),
+			Parameters:           updatedParameters,
 			Environment:          &env,
 		},
 	}
@@ -275,35 +308,98 @@ func resourceDataflowFlexTemplateJobCreate(d *schema.ResourceData, meta interfac
 	return resourceDataflowFlexTemplateJobRead(d, meta)
 }
 
-func resourceDataflowFlexJobSetupEnv(d *schema.ResourceData, config *transport_tpg.Config) (dataflow.FlexTemplateRuntimeEnvironment, error) {
+func resourceDataflowFlexJobSetupEnv(d *schema.ResourceData, config *transport_tpg.Config) (dataflow.FlexTemplateRuntimeEnvironment, map[string]string, error) {
+
+	updatedParameters := tpgresource.ExpandStringMap(d, "parameters")
 
 	additionalExperiments := tpgresource.ConvertStringSet(d.Get("additional_experiments").(*schema.Set))
 
+	var autoscalingAlgorithm string
+	autoscalingAlgorithm, updatedParameters = dataflowFlexJobTypeTransferVar("autoscaling_algorithm", "autoscalingAlgorithm", updatedParameters, d)
+
+	var numWorkers int
+	if p, ok := d.GetOk("parameters.numWorkers"); ok {
+		number, err := strconv.Atoi(p.(string))
+		if err != nil {
+			return dataflow.FlexTemplateRuntimeEnvironment{}, updatedParameters, fmt.Errorf("parameters.numWorkers must have a valid integer assigned to it, current value is %s", p.(string))
+		}
+		delete(updatedParameters, "numWorkers")
+		numWorkers = number
+	} else {
+		if v, ok := d.GetOk("num_workers"); ok {
+			numWorkers = v.(int)
+		}
+	}
+
+	var maxNumWorkers int
+	if p, ok := d.GetOk("parameters.maxNumWorkers"); ok {
+		number, err := strconv.Atoi(p.(string))
+		if err != nil {
+			return dataflow.FlexTemplateRuntimeEnvironment{}, updatedParameters, fmt.Errorf("parameters.maxNumWorkers must have a valid integer assigned to it, current value is %s", p.(string))
+		}
+		delete(updatedParameters, "maxNumWorkers")
+		maxNumWorkers = number
+	} else {
+		if v, ok := d.GetOk("max_workers"); ok {
+			maxNumWorkers = v.(int)
+		}
+	}
+
+	network, updatedParameters := dataflowFlexJobTypeTransferVar("network", "network", updatedParameters, d)
+
+	serviceAccountEmail, updatedParameters := dataflowFlexJobTypeTransferVar("service_account_email", "serviceAccountEmail", updatedParameters, d)
+
+	subnetwork, updatedParameters := dataflowFlexJobTypeTransferVar("subnetwork", "subnetwork", updatedParameters, d)
+
+	tempLocation, updatedParameters := dataflowFlexJobTypeTransferVar("temp_location", "tempLocation", updatedParameters, d)
+
+	stagingLocation, updatedParameters := dataflowFlexJobTypeTransferVar("staging_location", "stagingLocation", updatedParameters, d)
+
+	machineType, updatedParameters := dataflowFlexJobTypeTransferVar("machine_type", "workerMachineType", updatedParameters, d)
+
+	kmsKeyName, updatedParameters := dataflowFlexJobTypeTransferVar("kms_key_name", "kmsKeyName", updatedParameters, d)
+
+	ipConfiguration, updatedParameters := dataflowFlexJobTypeTransferVar("ip_configuration", "ipConfiguration", updatedParameters, d)
+
+	var enableStreamingEngine bool
+	if p, ok := d.GetOk("parameters.enableStreamingEngine"); ok {
+		delete(updatedParameters, "enableStreamingEngine")
+		enableStreamingEngine = p.(bool)
+	} else {
+		if v, ok := d.GetOk("enable_streaming_engine"); ok {
+			enableStreamingEngine = v.(bool)
+		}
+	}
+
+	sdkContainerImage, updatedParameters := dataflowFlexJobTypeTransferVar("sdk_container_image", "sdkContainerImage", updatedParameters, d)
+
+	launcherMachineType, updatedParameters := dataflowFlexJobTypeTransferVar("launcher_machine_type", "launcherMachineType", updatedParameters, d)
+
 	env := dataflow.FlexTemplateRuntimeEnvironment{
-		AdditionalUserLabels:  tpgresource.ExpandStringMap(d, "labels"),
-		AutoscalingAlgorithm:  d.Get("autoscaling_algorithm").(string),
-		NumWorkers:            int64(d.Get("num_workers").(int)),
-		MaxWorkers:            int64(d.Get("max_workers").(int)),
-		Network:               d.Get("network").(string),
-		ServiceAccountEmail:   d.Get("service_account_email").(string),
-		Subnetwork:            d.Get("subnetwork").(string),
-		TempLocation:          d.Get("temp_location").(string),
-		StagingLocation:       d.Get("staging_location").(string),
-		MachineType:           d.Get("machine_type").(string),
-		KmsKeyName:            d.Get("kms_key_name").(string),
-		IpConfiguration:       d.Get("ip_configuration").(string),
-		EnableStreamingEngine: d.Get("enable_streaming_engine").(bool),
+		AdditionalUserLabels:  tpgresource.ExpandStringMap(d, "effective_labels"),
+		AutoscalingAlgorithm:  autoscalingAlgorithm,
+		NumWorkers:            int64(numWorkers),
+		MaxWorkers:            int64(maxNumWorkers),
+		Network:               network,
+		ServiceAccountEmail:   serviceAccountEmail,
+		Subnetwork:            subnetwork,
+		TempLocation:          tempLocation,
+		StagingLocation:       stagingLocation,
+		MachineType:           machineType,
+		KmsKeyName:            kmsKeyName,
+		IpConfiguration:       ipConfiguration,
+		EnableStreamingEngine: enableStreamingEngine,
 		AdditionalExperiments: additionalExperiments,
-		SdkContainerImage:     d.Get("sdk_container_image").(string),
-		LauncherMachineType:   d.Get("launcher_machine_type").(string),
+		SdkContainerImage:     sdkContainerImage,
+		LauncherMachineType:   launcherMachineType,
 	}
-	return env, nil
+	return env, updatedParameters, nil
 }
 
 // resourceDataflowFlexTemplateJobRead reads a Flex Template Job resource.
 func resourceDataflowFlexTemplateJobRead(d *schema.ResourceData, meta interface{}) error {
 	config := meta.(*transport_tpg.Config)
-	userAgent, err :=  tpgresource.GenerateUserAgentString(d, config.UserAgent)
+	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
 	if err != nil {
 		return err
 	}
@@ -340,9 +436,15 @@ func resourceDataflowFlexTemplateJobRead(d *schema.ResourceData, meta interface{
 	if err := d.Set("project", project); err != nil {
 		return fmt.Errorf("Error setting project: %s", err)
 	}
-	if err := d.Set("labels", job.Labels); err != nil {
+	if err := tpgresource.SetLabels(job.Labels, d, "labels"); err != nil {
 		return fmt.Errorf("Error setting labels: %s", err)
 	}
+	if err := tpgresource.SetLabels(job.Labels, d, "terraform_labels"); err != nil {
+		return fmt.Errorf("Error setting terraform_labels: %s", err)
+	}
+	if err := d.Set("effective_labels", job.Labels); err != nil {
+		return fmt.Errorf("Error setting effective_labels: %s", err)
+	}
 	if err := d.Set("kms_key_name", job.Environment.ServiceKmsKeyName); err != nil {
 		return fmt.Errorf("Error setting kms_key_name: %s", err)
 	}
@@ -365,7 +467,7 @@ func resourceDataflowFlexTemplateJobRead(d *schema.ResourceData, meta interface{
 	if err := d.Set("num_workers", optionsMap["numWorkers"]); err != nil {
 		return fmt.Errorf("Error setting num_workers: %s", err)
 	}
-	if err := d.Set("max_workers", optionsMap["maxWorkers"]); err != nil {
+	if err := d.Set("max_workers", optionsMap["maxNumWorkers"]); err != nil {
 		return fmt.Errorf("Error setting max_workers: %s", err)
 	}
 	if err := d.Set("staging_location", optionsMap["stagingLocation"]); err != nil {
@@ -438,72 +540,73 @@ func resourceDataflowFlexTemplateJobUpdate(d *schema.ResourceData, meta interfac
 		return nil
 	}
 
-	config := meta.(*transport_tpg.Config)
-	userAgent, err :=  tpgresource.GenerateUserAgentString(d, config.UserAgent)
-	if err != nil {
-		return err
-	}
+	if jobHasUpdate(d, ResourceDataflowFlexTemplateJob().Schema) {
+		config := meta.(*transport_tpg.Config)
+		userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
+		if err != nil {
+			return err
+		}
 
-	project, err := tpgresource.GetProject(d, config)
-	if err != nil {
-		return err
-	}
+		project, err := tpgresource.GetProject(d, config)
+		if err != nil {
+			return err
+		}
 
-	region, err := tpgresource.GetRegion(d, config)
-	if err != nil {
-		return err
-	}
+		region, err := tpgresource.GetRegion(d, config)
+		if err != nil {
+			return err
+		}
 
-	tnamemapping := tpgresource.ExpandStringMap(d, "transform_name_mapping")
+		tnamemapping := tpgresource.ExpandStringMap(d, "transform_name_mapping")
 
-	env, err := resourceDataflowFlexJobSetupEnv(d, config)
-	if err != nil {
-		return err
-	}
+		env, updatedParameters, err := resourceDataflowFlexJobSetupEnv(d, config)
+		if err != nil {
+			return err
+		}
 
-	// wait until current job is running or terminated
-	err = waitForDataflowJobState(d, config, d.Id(), userAgent, d.Timeout(schema.TimeoutUpdate), "JOB_STATE_RUNNING")
-	if err != nil {
-		return fmt.Errorf("Error waiting for job with job ID %q to be running: %s", d.Id(), err)
-	}
+		// wait until current job is running or terminated
+		err = waitForDataflowJobState(d, config, d.Id(), userAgent, d.Timeout(schema.TimeoutUpdate), "JOB_STATE_RUNNING")
+		if err != nil {
+			return fmt.Errorf("Error waiting for job with job ID %q to be running: %s", d.Id(), err)
+		}
 
-	request := dataflow.LaunchFlexTemplateRequest{
-		LaunchParameter: &dataflow.LaunchFlexTemplateParameter{
+		request := dataflow.LaunchFlexTemplateRequest{
+			LaunchParameter: &dataflow.LaunchFlexTemplateParameter{
 
-			ContainerSpecGcsPath: d.Get("container_spec_gcs_path").(string),
-			JobName:              d.Get("name").(string),
-			Parameters:           tpgresource.ExpandStringMap(d, "parameters"),
-			TransformNameMappings: tnamemapping,
-			Environment:          &env,
-			Update:               true,
-		},
-	}
+				ContainerSpecGcsPath:  d.Get("container_spec_gcs_path").(string),
+				JobName:               d.Get("name").(string),
+				Parameters:            updatedParameters,
+				TransformNameMappings: tnamemapping,
+				Environment:           &env,
+				Update:                true,
+			},
+		}
 
-	response, err := config.NewDataflowClient(userAgent).Projects.Locations.FlexTemplates.Launch(project, region, &request).Do()
-	if err != nil {
-		return err
-	}
+		response, err := config.NewDataflowClient(userAgent).Projects.Locations.FlexTemplates.Launch(project, region, &request).Do()
+		if err != nil {
+			return err
+		}
 
-	// don't set id until new job is successfully running
-	job := response.Job
-	err = waitForDataflowJobState(d, config, job.Id, userAgent, d.Timeout(schema.TimeoutUpdate), "JOB_STATE_RUNNING")
-	if err != nil {
-		// the default behavior is to overwrite the resource's state with the state of the "new" job, even though we are returning an error here. this call to Partial prevents this behavior
-		d.Partial(true)
-		return fmt.Errorf("Error waiting for Job with job ID %q to be updated: %s", job.Id, err)
-	}
+		// don't set id until new job is successfully running
+		job := response.Job
+		err = waitForDataflowJobState(d, config, job.Id, userAgent, d.Timeout(schema.TimeoutUpdate), "JOB_STATE_RUNNING")
+		if err != nil {
+			// the default behavior is to overwrite the resource's state with the state of the "new" job, even though we are returning an error here. this call to Partial prevents this behavior
+			d.Partial(true)
+			return fmt.Errorf("Error waiting for Job with job ID %q to be updated: %s", job.Id, err)
+		}
 
-	d.SetId(job.Id)
-	if err := d.Set("job_id", job.Id); err != nil {
-		return fmt.Errorf("Error setting job_id: %s", err)
+		d.SetId(job.Id)
+		if err := d.Set("job_id", job.Id); err != nil {
+			return fmt.Errorf("Error setting job_id: %s", err)
+		}
 	}
-
 	return resourceDataflowFlexTemplateJobRead(d, meta)
 }
 
 func resourceDataflowFlexTemplateJobDelete(d *schema.ResourceData, meta interface{}) error {
 	config := meta.(*transport_tpg.Config)
-	userAgent, err :=  tpgresource.GenerateUserAgentString(d, config.UserAgent)
+	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
 	if err != nil {
 		return err
 	}
@@ -585,6 +688,100 @@ func resourceDataflowFlexTemplateJobDelete(d *schema.ResourceData, meta interfac
 }
 
 func resourceDataflowFlexJobTypeCustomizeDiff(_ context.Context, d *schema.ResourceDiff, meta interface{}) error {
+
+	err := dataflowFlexJobTypeParameterOverride("autoscaling_algorithm", "autoscalingAlgorithm", d)
+	if err != nil {
+		return err
+	}
+
+	if p, ok := d.GetOk("parameters.numWorkers"); ok {
+		if d.HasChange("num_workers") {
+			e := d.Get("num_workers")
+			return fmt.Errorf("Error setting num_workers, value is supplied twice: num_workers=%d, parameters.numWorkers=%d", e.(int), p.(int))
+		} else {
+			p := d.Get("parameters.numWorkers")
+			number, err := strconv.Atoi(p.(string))
+			if err != nil {
+				return fmt.Errorf("parameters.maxNumWorkers must have a valid integer assigned to it, current value is %s", p.(string))
+			}
+			d.SetNew("num_workers", number)
+		}
+	}
+
+	if p, ok := d.GetOk("parameters.maxNumWorkers"); ok {
+		if d.HasChange("max_workers") {
+			e := d.Get("max_workers")
+			return fmt.Errorf("Error setting max_workers, value is supplied twice: max_workers=%d, parameters.maxNumWorkers=%d", e.(int), p.(int))
+		} else {
+			p := d.Get("parameters.maxNumWorkers")
+			number, err := strconv.Atoi(p.(string))
+			if err != nil {
+				return fmt.Errorf("parameters.maxNumWorkers must have a valid integer assigned to it, current value is %s", p.(string))
+			}
+			d.SetNew("max_workers", number)
+		}
+	}
+
+	err = dataflowFlexJobTypeParameterOverride("network", "network", d)
+	if err != nil {
+		return err
+	}
+
+	err = dataflowFlexJobTypeParameterOverride("service_account_email", "serviceAccountEmail", d)
+	if err != nil {
+		return err
+	}
+
+	err = dataflowFlexJobTypeParameterOverride("subnetwork", "subnetwork", d)
+	if err != nil {
+		return err
+	}
+
+	err = dataflowFlexJobTypeParameterOverride("temp_location", "tempLocation", d)
+	if err != nil {
+		return err
+	}
+
+	err = dataflowFlexJobTypeParameterOverride("staging_location", "stagingLocation", d)
+	if err != nil {
+		return err
+	}
+
+	err = dataflowFlexJobTypeParameterOverride("machine_type", "workerMachineType", d)
+	if err != nil {
+		return err
+	}
+
+	err = dataflowFlexJobTypeParameterOverride("kms_key_name", "kmsKeyName", d)
+	if err != nil {
+		return err
+	}
+
+	err = dataflowFlexJobTypeParameterOverride("ip_configuration", "ipConfiguration", d)
+	if err != nil {
+		return err
+	}
+
+	if p, ok := d.GetOk("parameters.enableStreamingEngine"); ok {
+		if d.HasChange("enable_streaming_engine") {
+			e := d.Get("enable_streaming_engine")
+			return fmt.Errorf("Error setting enable_streaming_engine, value is supplied twice: enable_streaming_engine=%t, parameters.enableStreamingEngine=%t", e.(bool), p.(bool))
+		} else {
+			p := d.Get("parameters.enableStreamingEngine")
+			d.SetNew("enable_streaming_engine", p.(string))
+		}
+	}
+
+	err = dataflowFlexJobTypeParameterOverride("sdk_container_image", "sdkContainerImage", d)
+	if err != nil {
+		return err
+	}
+
+	err = dataflowFlexJobTypeParameterOverride("launcher_machine_type", "launcherMachineType", d)
+	if err != nil {
+		return err
+	}
+
 	// All non-virtual fields are ForceNew for batch jobs
 	if d.Get("type") == "JOB_TYPE_BATCH" {
 		resourceSchema := ResourceDataflowFlexTemplateJob().Schema
@@ -592,12 +789,8 @@ func resourceDataflowFlexJobTypeCustomizeDiff(_ context.Context, d *schema.Resou
 			if field == "on_delete" {
 				continue
 			}
-			// Labels map will likely have suppressed changes, so we check each key instead of the parent field
-			if field == "labels" {
-				if err := resourceDataflowJobIterateMapForceNew(field, d); err != nil {
-					return err
-				}
-			} else if d.HasChange(field) {
+
+			if field != "terraform_labels" && d.HasChange(field) {
 				if err := d.ForceNew(field); err != nil {
 					return err
 				}
@@ -608,4 +801,36 @@ func resourceDataflowFlexJobTypeCustomizeDiff(_ context.Context, d *schema.Resou
 	return nil
 }
 
+func dataflowFlexJobTypeTransferVar(ename, pname string, updatedParameters map[string]string, d *schema.ResourceData) (string, map[string]string) {
+
+	pstring := fmt.Sprintf("parameters.%s", pname)
+
+	if p, ok := d.GetOk(pstring); ok {
+		delete(updatedParameters, pname)
+		return p.(string), updatedParameters
+	} else {
+		if v, ok := d.GetOk(ename); ok {
+			return v.(string), updatedParameters
+		} else {
+			return "", updatedParameters
+		}
+	}
+}
+
+func dataflowFlexJobTypeParameterOverride(ename, pname string, d *schema.ResourceDiff) error {
+
+	pstring := fmt.Sprintf("parameters.%s", pname)
+
+	if p, ok := d.GetOk(pstring); ok {
+		if d.HasChange(ename) {
+			e := d.Get(ename)
+			return fmt.Errorf("Error setting %s, value is supplied twice: %s=\"%s\", %s=\"%s\"", ename, ename, e.(string), pstring, p.(string))
+		} else {
+			p := d.Get(pstring)
+			d.SetNew(ename, p.(string))
+		}
+	}
+	return nil
+}
+
 <% end -%>
diff --git a/mmv1/third_party/terraform/services/dataflow/resource_dataflow_flex_template_job_migrate.go.erb b/mmv1/third_party/terraform/services/dataflow/resource_dataflow_flex_template_job_migrate.go.erb
new file mode 100644
index 000000000000..aa0c11361713
--- /dev/null
+++ b/mmv1/third_party/terraform/services/dataflow/resource_dataflow_flex_template_job_migrate.go.erb
@@ -0,0 +1,205 @@
+<% autogen_exception -%>
+package dataflow
+<% unless version == 'ga' -%>
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+)
+
+func resourceDataflowFlexTemplateJobResourceV0() *schema.Resource {
+	return &schema.Resource{
+		Schema: map[string]*schema.Schema{
+
+			"container_spec_gcs_path": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+
+			"name": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"region": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				ForceNew:    true,
+				Computed:    true,
+				Description: `The region in which the created job should run.`,
+			},
+
+			"transform_name_mapping": {
+				Type:        schema.TypeMap,
+				Optional:    true,
+				Description: `Only applicable when updating a pipeline. Map of transform name prefixes of the job to be replaced with the corresponding name prefixes of the new job.`,
+			},
+
+			"on_delete": {
+				Type:         schema.TypeString,
+				ValidateFunc: validation.StringInSlice([]string{"cancel", "drain"}, false),
+				Optional:     true,
+				Default:      "cancel",
+			},
+
+			"labels": {
+				Type:             schema.TypeMap,
+				Optional:         true,
+				DiffSuppressFunc: resourceDataflowJobLabelDiffSuppress,
+				Description:      `User labels to be specified for the job. Keys and values should follow the restrictions specified in the labeling restrictions page. NOTE: Google-provided Dataflow templates often provide default labels that begin with goog-dataflow-provided. Unless explicitly set in config, these labels will be ignored to prevent diffs on re-apply.`,
+			},
+
+			"parameters": {
+				Type:     schema.TypeMap,
+				Optional: true,
+			},
+
+			"project": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+
+			"job_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+
+			"state": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+
+			"type": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: `The type of this job, selected from the JobType enum.`,
+			},
+
+			"num_workers": {
+				Type:     schema.TypeInt,
+				Optional: true,
+				// ForceNew applies to both stream and batch jobs
+				ForceNew:    true,
+				Description: `The initial number of Google Compute Engine instances for the job.`,
+			},
+
+			"max_workers": {
+				Type:     schema.TypeInt,
+				Optional: true,
+				// ForceNew applies to both stream and batch jobs
+				ForceNew:    true,
+				Description: `The maximum number of Google Compute Engine instances to be made available to your pipeline during execution, from 1 to 1000.`,
+			},
+
+			"service_account_email": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Computed:    true,
+				Description: `The Service Account email used to create the job.`,
+			},
+
+			"temp_location": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Computed:    true,
+				Description: `The Cloud Storage path to use for temporary files. Must be a valid Cloud Storage URL, beginning with gs://.`,
+			},
+
+			"staging_location": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Computed:    true,
+				Description: `The Cloud Storage path to use for staging files. Must be a valid Cloud Storage URL, beginning with gs://.`,
+			},
+
+			"sdk_container_image": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: `Docker registry location of container image to use for the 'worker harness. Default is the container for the version of the SDK. Note this field is only valid for portable pipelines.`,
+			},
+
+			"network": {
+				Type:             schema.TypeString,
+				Optional:         true,
+				DiffSuppressFunc: tpgresource.CompareSelfLinkOrResourceName,
+				Description:      `The network to which VMs will be assigned. If it is not provided, "default" will be used.`,
+			},
+
+			"subnetwork": {
+				Type:             schema.TypeString,
+				Optional:         true,
+				DiffSuppressFunc: tpgresource.CompareSelfLinkOrResourceName,
+				Description:      `The subnetwork to which VMs will be assigned. Should be of the form "regions/REGION/subnetworks/SUBNETWORK".`,
+			},
+
+			"machine_type": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: `The machine type to use for the job.`,
+			},
+
+			"kms_key_name": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: `The name for the Cloud KMS key for the job. Key format is: projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY`,
+			},
+
+			"ip_configuration": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Description:  `The configuration for VM IPs. Options are "WORKER_IP_PUBLIC" or "WORKER_IP_PRIVATE".`,
+				ValidateFunc: validation.StringInSlice([]string{"WORKER_IP_PUBLIC", "WORKER_IP_PRIVATE"}, false),
+			},
+
+			"additional_experiments": {
+				Type:        schema.TypeSet,
+				Optional:    true,
+				Computed:    true,
+				Description: `List of experiments that should be used by the job. An example value is ["enable_stackdriver_agent_metrics"].`,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+
+			"enable_streaming_engine": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				ForceNew:    true,
+				Description: `Indicates if the job should use the streaming engine feature.`,
+			},
+
+			"autoscaling_algorithm": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: `The algorithm to use for autoscaling`,
+			},
+
+			"launcher_machine_type": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: `The machine type to use for launching the job. The default is n1-standard-1.`,
+			},
+
+			"skip_wait_on_job_termination": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Default:     false,
+				Description: `If true, treat DRAINING and CANCELLING as terminal job states and do not wait for further changes before removing from terraform state and moving on. WARNING: this will lead to job name conflicts if you do not ensure that the job names are different, e.g. by embedding a release ID or by using a random_id.`,
+			},
+		},
+		UseJSONNumber: true,
+	}
+}
+
+func ResourceDataflowFlexTemplateJobStateUpgradeV0(_ context.Context, rawState map[string]interface{}, meta interface{}) (map[string]interface{}, error) {
+	return tpgresource.LabelsStateUpgrade(rawState, resourceDataflowJobGoogleLabelPrefix)
+}
+
+<% end -%>
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/services/dataflow/resource_dataflow_flex_template_job_test.go.erb b/mmv1/third_party/terraform/services/dataflow/resource_dataflow_flex_template_job_test.go.erb
index 577ec7f63de8..bb012c7b9484 100644
--- a/mmv1/third_party/terraform/services/dataflow/resource_dataflow_flex_template_job_test.go.erb
+++ b/mmv1/third_party/terraform/services/dataflow/resource_dataflow_flex_template_job_test.go.erb
@@ -44,7 +44,7 @@ func TestAccDataflowFlexTemplateJob_basic(t *testing.T) {
 				ResourceName:            "google_dataflow_flex_template_job.flex_job",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "container_spec_gcs_path"},
+				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "container_spec_gcs_path", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -83,7 +83,7 @@ func TestAccDataflowFlexTemplateJob_streamUpdate(t *testing.T) {
 				ResourceName:            "google_dataflow_flex_template_job.flex_job",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "transform_name_mapping", "state", "container_spec_gcs_path"},
+				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "transform_name_mapping", "state", "container_spec_gcs_path", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -139,22 +139,22 @@ func TestAccDataflowFlexTemplateJob_FullUpdate(t *testing.T) {
 		CheckDestroy:             testAccCheckDataflowJobDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataflowFlexTemplateJob_dataflowFlexTemplateJobFull(job, bucket, topic),
+				Config: testAccDataflowFlexTemplateJob_dataflowFlexTemplateJobFull(job, bucket, topic, randStr),
 			},
 			{
 				ResourceName:            "google_dataflow_flex_template_job.flex_job_fullupdate",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "container_spec_gcs_path"},
+				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "container_spec_gcs_path", "labels", "terraform_labels"},
 			},
 			{
-				Config: testAccDataflowFlexTemplateJob_dataflowFlexTemplateJobFullUpdate(job, bucket, topic),
+				Config: testAccDataflowFlexTemplateJob_dataflowFlexTemplateJobFullUpdate(job, bucket, topic, randStr),
 			},
 			{
 				ResourceName:            "google_dataflow_flex_template_job.flex_job_fullupdate",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "container_spec_gcs_path"},
+				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "container_spec_gcs_path", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -189,7 +189,7 @@ func TestAccDataflowFlexTemplateJob_withNetwork(t *testing.T) {
 				ResourceName:            "google_dataflow_flex_template_job.flex_job_network",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "container_spec_gcs_path"},
+				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "container_spec_gcs_path", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccDataflowFlexTemplateJob_networkUpdate(job, network1, network2, bucket, topic),
@@ -202,7 +202,7 @@ func TestAccDataflowFlexTemplateJob_withNetwork(t *testing.T) {
 				ResourceName:            "google_dataflow_flex_template_job.flex_job_network",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "container_spec_gcs_path"},
+				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "container_spec_gcs_path", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -238,7 +238,7 @@ func TestAccDataflowFlexTemplateJob_withSubNetwork(t *testing.T) {
 				ResourceName:            "google_dataflow_flex_template_job.flex_job_subnetwork",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "container_spec_gcs_path"},
+				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "container_spec_gcs_path", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccDataflowFlexTemplateJob_subnetworkUpdate(job, network, subnetwork1, subnetwork2, bucket, topic),
@@ -251,7 +251,7 @@ func TestAccDataflowFlexTemplateJob_withSubNetwork(t *testing.T) {
 				ResourceName:            "google_dataflow_flex_template_job.flex_job_subnetwork",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "container_spec_gcs_path"},
+				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "container_spec_gcs_path", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -285,7 +285,7 @@ func TestAccDataflowFlexTemplateJob_withIpConfig(t *testing.T) {
 				ResourceName:            "google_dataflow_flex_template_job.flex_job_ipconfig",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "ip_configuration", "state", "container_spec_gcs_path"},
+				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "ip_configuration", "state", "container_spec_gcs_path", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -319,7 +319,7 @@ func TestAccDataflowFlexTemplateJob_withKmsKey(t *testing.T) {
 				ResourceName:            "google_dataflow_flex_template_job.flex_job_kms",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "container_spec_gcs_path"},
+				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "container_spec_gcs_path", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -353,7 +353,87 @@ func TestAccDataflowFlexTemplateJob_withAdditionalExperiments(t *testing.T) {
 				ResourceName:            "google_dataflow_flex_template_job.flex_job_experiments",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "additional_experiments", "container_spec_gcs_path"},
+				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "additional_experiments", "container_spec_gcs_path", "labels", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func TestAccDataflowFlexTemplateJob_withProviderDefaultLabels(t *testing.T) {
+	// This resource uses custom retry logic that cannot be sped up without
+	// modifying the actual resource
+	acctest.SkipIfVcr(t)
+	t.Parallel()
+
+	randStr := acctest.RandString(t, 10)
+	job := "tf-test-dataflow-job-" + randStr
+	bucket := "tf-test-dataflow-bucket-" + randStr
+	topic := "tf-test-topic" + randStr
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckDataflowJobDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDataflowFlexTemplateJob_withProviderDefaultLabels(job, bucket, topic, randStr),
+				Check: resource.ComposeTestCheckFunc(
+					testAccDataflowFlexJobExists(t, "google_dataflow_flex_template_job.flex_job_fullupdate", false),
+				),
+			},
+			{
+				ResourceName:            "google_dataflow_flex_template_job.flex_job_fullupdate",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "container_spec_gcs_path", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccComputeAddress_resourceLabelsOverridesProviderDefaultLabels(job, bucket, topic, randStr),
+				Check: resource.ComposeTestCheckFunc(
+					testAccDataflowFlexJobExists(t, "google_dataflow_flex_template_job.flex_job_fullupdate", false),
+				),
+			},
+			{
+				ResourceName:            "google_dataflow_flex_template_job.flex_job_fullupdate",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "container_spec_gcs_path", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccComputeAddress_moveResourceLabelToProviderDefaultLabels(job, bucket, topic, randStr),
+				Check: resource.ComposeTestCheckFunc(
+					testAccDataflowFlexJobExists(t, "google_dataflow_flex_template_job.flex_job_fullupdate", false),
+				),
+			},
+			{
+				ResourceName:            "google_dataflow_flex_template_job.flex_job_fullupdate",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "container_spec_gcs_path", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccComputeAddress_resourceLabelsOverridesProviderDefaultLabels(job, bucket, topic, randStr),
+				Check: resource.ComposeTestCheckFunc(
+					testAccDataflowFlexJobExists(t, "google_dataflow_flex_template_job.flex_job_fullupdate", false),
+				),
+			},
+			{
+				ResourceName:            "google_dataflow_flex_template_job.flex_job_fullupdate",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "container_spec_gcs_path", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccDataflowFlexTemplateJob_dataflowFlexTemplateJobFull(job, bucket, topic, randStr),
+				Check: resource.ComposeTestCheckFunc(
+					testAccDataflowFlexJobExists(t, "google_dataflow_flex_template_job.flex_job_fullupdate", false),
+				),
+			},
+			{
+				ResourceName:            "google_dataflow_flex_template_job.flex_job_fullupdate",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "container_spec_gcs_path", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -441,8 +521,8 @@ func testAccDataflowFlexTemplateGetGeneratedInstanceTemplate(t *testing.T, s *te
 	var instanceTemplate *compute.InstanceTemplate
 
 	err := resource.Retry(1*time.Minute, func() *resource.RetryError {
-		instanceTemplates, rerr := config.NewComputeClient(config.UserAgent).InstanceTemplates.
-			List(config.Project).
+		instanceTemplates, rerr := config.NewComputeClient(config.UserAgent).RegionInstanceTemplates.
+			List(config.Project, config.Region).
 			Filter(filter).
 			MaxResults(2).
 			Fields("items/properties").Do()
@@ -569,7 +649,7 @@ resource "google_dataflow_flex_template_job" "flex_job" {
 `, bucket, job)
 }
 
-func testAccDataflowFlexTemplateJob_dataflowFlexTemplateJobFull(job, bucket, topicName string) string {
+func testAccDataflowFlexTemplateJob_dataflowFlexTemplateJobFull(job, bucket, topicName, randStr string) string {
 	return fmt.Sprintf(`
 data "google_project" "project" {}
 
@@ -579,7 +659,7 @@ resource "google_pubsub_topic" "example" {
 
 resource "google_service_account" "dataflow-sa" {
   count = 2
-  account_id   = "dataflow-sa-${count.index}"
+  account_id   = "tf-test-dataflow-%s-${count.index}"
   display_name = "DataFlow Service Account"
 }
 
@@ -635,17 +715,18 @@ resource "google_dataflow_flex_template_job" "flex_job_fullupdate" {
     schemaLocation = "gs://${google_storage_bucket_object.schema.bucket}/schema.json"
     qps = "1"
     topic = google_pubsub_topic.example.id
+  	workerMachineType = "n1-standard-2"
+  	maxNumWorkers = 2
   }
   labels = {
    "my_labels" = "value-1"
   }
   service_account_email = google_service_account.dataflow-sa[0].email
-  machine_type = "n1-standard-2"
 }
-`, topicName, bucket, job)
+`, topicName, randStr, bucket, job)
 }
 
-func testAccDataflowFlexTemplateJob_dataflowFlexTemplateJobFullUpdate(job, bucket, topicName string) string {
+func testAccDataflowFlexTemplateJob_dataflowFlexTemplateJobFullUpdate(job, bucket, topicName, randStr string) string {
 	return fmt.Sprintf(`
 data "google_project" "project" {}
 
@@ -655,7 +736,7 @@ resource "google_pubsub_topic" "example" {
 
 resource "google_service_account" "dataflow-sa" {
 	count = 2
-	account_id   = "dataflow-sa-${count.index}"
+	account_id   = "tf-test-dataflow-%s-${count.index}"
 	display_name = "DataFlow Service Account"
 }
 
@@ -705,18 +786,19 @@ resource "google_dataflow_flex_template_job" "flex_job_fullupdate" {
   name = "%s"
   container_spec_gcs_path = "gs://${data.google_storage_bucket_object.flex_template.bucket}/${data.google_storage_bucket_object.flex_template.name}"
   on_delete = "cancel"
+  machine_type = "n2-standard-2"
   parameters = {
     schemaLocation = "gs://${google_storage_bucket_object.schema.bucket}/schema.json"
     qps = "1"
     topic = google_pubsub_topic.example.id
+  	maxNumWorkers = 3
   }
   labels = {
    "my_labels" = "value-update"
   }
   service_account_email = google_service_account.dataflow-sa[1].email
-  machine_type = "n2-standard-2"
 }
-`, topicName, bucket, job)
+`, topicName, randStr, bucket, job)
 }
 
 func testAccDataflowFlexTemplateJob_network(job, network1, bucket, topicName string) string {
@@ -1185,6 +1267,260 @@ resource "google_dataflow_flex_template_job" "flex_job_experiments" {
 `, topicName, bucket, job, strings.Join(experiments, `", "`))
 }
 
+func testAccDataflowFlexTemplateJob_withProviderDefaultLabels(job, bucket, topicName, randStr string) string {
+	return fmt.Sprintf(`
+
+provider "google" {
+  default_labels = {
+	default_key1 = "default_value1"
+  }
+}
+
+data "google_project" "project" {}
+
+resource "google_pubsub_topic" "example" {
+  name = "%s"
+}
+
+resource "google_service_account" "dataflow-sa" {
+  count = 2
+  account_id   = "tf-test-dataflow-%s-${count.index}"
+  display_name = "DataFlow Service Account"
+}
+
+resource "google_project_iam_member" "dataflow-worker" {
+  count = 2
+  project = data.google_project.project.project_id
+  role   = "roles/dataflow.worker"
+  member = "serviceAccount:${google_service_account.dataflow-sa[count.index].email}"
+}
+
+resource "google_project_iam_member" "dataflow-storage" {
+  count = 2
+  project = data.google_project.project.project_id
+  role   = "roles/storage.admin"
+  member = "serviceAccount:${google_service_account.dataflow-sa[count.index].email}"
+}
+
+data "google_storage_bucket_object" "flex_template" {
+  name   = "latest/flex/Streaming_Data_Generator"
+  bucket = "dataflow-templates"
+}
+
+resource "google_storage_bucket" "bucket" {
+  name = "%s"
+  location = "US-CENTRAL1"
+  force_destroy = true
+  uniform_bucket_level_access = true
+}
+
+resource "google_storage_bucket_object" "schema" {
+  name = "schema.json"
+  bucket = google_storage_bucket.bucket.name
+  content = <<EOF
+{
+	"eventId": "{{uuid()}}",
+	"eventTimestamp": {{timestamp()}},
+	"ipv4": "{{ipv4()}}",
+	"ipv6": "{{ipv6()}}",
+	"country": "{{country()}}",
+	"username": "{{username()}}",
+	"quest": "{{random("A Break In the Ice", "Ghosts of Perdition", "Survive the Low Road")}}",
+	"score": {{integer(100, 10000)}},
+	"completed": {{bool()}}
+}
+EOF
+}
+
+resource "google_dataflow_flex_template_job" "flex_job_fullupdate" {
+  name = "%s"
+  container_spec_gcs_path = "gs://${data.google_storage_bucket_object.flex_template.bucket}/${data.google_storage_bucket_object.flex_template.name}"
+  on_delete = "cancel"
+  parameters = {
+    schemaLocation = "gs://${google_storage_bucket_object.schema.bucket}/schema.json"
+    qps = "1"
+    topic = google_pubsub_topic.example.id
+  }
+  labels = {
+    env       = "foo"
+    my_labels = "value"
+  }
+  service_account_email = google_service_account.dataflow-sa[0].email
+  machine_type = "n1-standard-2"
+}
+`, topicName, randStr, bucket, job)
+}
+
+func testAccComputeAddress_resourceLabelsOverridesProviderDefaultLabels(job, bucket, topicName, randStr string) string {
+	return fmt.Sprintf(`
+
+provider "google" {
+  default_labels = {
+	default_key1 = "default_value1"
+  }
+}
+
+data "google_project" "project" {}
+
+resource "google_pubsub_topic" "example" {
+  name = "%s"
+}
+
+resource "google_service_account" "dataflow-sa" {
+  count = 2
+  account_id   = "tf-test-dataflow-%s-${count.index}"
+  display_name = "DataFlow Service Account"
+}
+
+resource "google_project_iam_member" "dataflow-worker" {
+  count = 2
+  project = data.google_project.project.project_id
+  role   = "roles/dataflow.worker"
+  member = "serviceAccount:${google_service_account.dataflow-sa[count.index].email}"
+}
+
+resource "google_project_iam_member" "dataflow-storage" {
+  count = 2
+  project = data.google_project.project.project_id
+  role   = "roles/storage.admin"
+  member = "serviceAccount:${google_service_account.dataflow-sa[count.index].email}"
+}
+
+data "google_storage_bucket_object" "flex_template" {
+  name   = "latest/flex/Streaming_Data_Generator"
+  bucket = "dataflow-templates"
+}
+
+resource "google_storage_bucket" "bucket" {
+  name = "%s"
+  location = "US-CENTRAL1"
+  force_destroy = true
+  uniform_bucket_level_access = true
+}
+
+resource "google_storage_bucket_object" "schema" {
+  name = "schema.json"
+  bucket = google_storage_bucket.bucket.name
+  content = <<EOF
+{
+	"eventId": "{{uuid()}}",
+	"eventTimestamp": {{timestamp()}},
+	"ipv4": "{{ipv4()}}",
+	"ipv6": "{{ipv6()}}",
+	"country": "{{country()}}",
+	"username": "{{username()}}",
+	"quest": "{{random("A Break In the Ice", "Ghosts of Perdition", "Survive the Low Road")}}",
+	"score": {{integer(100, 10000)}},
+	"completed": {{bool()}}
+}
+EOF
+}
+
+resource "google_dataflow_flex_template_job" "flex_job_fullupdate" {
+  name = "%s"
+  container_spec_gcs_path = "gs://${data.google_storage_bucket_object.flex_template.bucket}/${data.google_storage_bucket_object.flex_template.name}"
+  on_delete = "cancel"
+  parameters = {
+    schemaLocation = "gs://${google_storage_bucket_object.schema.bucket}/schema.json"
+    qps = "1"
+    topic = google_pubsub_topic.example.id
+  }
+  labels = {
+    env       = "foo"
+    my_labels = "value"
+	default_key1 = "value1"
+  }
+  service_account_email = google_service_account.dataflow-sa[0].email
+  machine_type = "n1-standard-2"
+}
+`, topicName, randStr, bucket, job)
+}
+
+func testAccComputeAddress_moveResourceLabelToProviderDefaultLabels(job, bucket, topicName, randStr string) string {
+	return fmt.Sprintf(`
+
+provider "google" {
+  default_labels = {
+	default_key1 = "default_value1"
+	env          = "foo"
+  }
+}
+
+data "google_project" "project" {}
+
+resource "google_pubsub_topic" "example" {
+  name = "%s"
+}
+
+resource "google_service_account" "dataflow-sa" {
+  count = 2
+  account_id   = "tf-test-dataflow-%s-${count.index}"
+  display_name = "DataFlow Service Account"
+}
+
+resource "google_project_iam_member" "dataflow-worker" {
+  count = 2
+  project = data.google_project.project.project_id
+  role   = "roles/dataflow.worker"
+  member = "serviceAccount:${google_service_account.dataflow-sa[count.index].email}"
+}
+
+resource "google_project_iam_member" "dataflow-storage" {
+  count = 2
+  project = data.google_project.project.project_id
+  role   = "roles/storage.admin"
+  member = "serviceAccount:${google_service_account.dataflow-sa[count.index].email}"
+}
+
+data "google_storage_bucket_object" "flex_template" {
+  name   = "latest/flex/Streaming_Data_Generator"
+  bucket = "dataflow-templates"
+}
+
+resource "google_storage_bucket" "bucket" {
+  name = "%s"
+  location = "US-CENTRAL1"
+  force_destroy = true
+  uniform_bucket_level_access = true
+}
+
+resource "google_storage_bucket_object" "schema" {
+  name = "schema.json"
+  bucket = google_storage_bucket.bucket.name
+  content = <<EOF
+{
+	"eventId": "{{uuid()}}",
+	"eventTimestamp": {{timestamp()}},
+	"ipv4": "{{ipv4()}}",
+	"ipv6": "{{ipv6()}}",
+	"country": "{{country()}}",
+	"username": "{{username()}}",
+	"quest": "{{random("A Break In the Ice", "Ghosts of Perdition", "Survive the Low Road")}}",
+	"score": {{integer(100, 10000)}},
+	"completed": {{bool()}}
+}
+EOF
+}
+
+resource "google_dataflow_flex_template_job" "flex_job_fullupdate" {
+  name = "%s"
+  container_spec_gcs_path = "gs://${data.google_storage_bucket_object.flex_template.bucket}/${data.google_storage_bucket_object.flex_template.name}"
+  on_delete = "cancel"
+  parameters = {
+    schemaLocation = "gs://${google_storage_bucket_object.schema.bucket}/schema.json"
+    qps = "1"
+    topic = google_pubsub_topic.example.id
+  }
+  labels = {
+    my_labels = "value"
+	default_key1 = "value1"
+  }
+  service_account_email = google_service_account.dataflow-sa[0].email
+  machine_type = "n1-standard-2"
+}
+`, topicName, randStr, bucket, job)
+}
+
 func testAccDataflowFlexJobHasOption(t *testing.T, res, option, expectedValue string, wait bool) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if wait {
diff --git a/mmv1/third_party/terraform/services/dataflow/resource_dataflow_job.go.erb b/mmv1/third_party/terraform/services/dataflow/resource_dataflow_job.go.erb
index fc1c5594d916..9ecdbd2443ff 100644
--- a/mmv1/third_party/terraform/services/dataflow/resource_dataflow_job.go.erb
+++ b/mmv1/third_party/terraform/services/dataflow/resource_dataflow_job.go.erb
@@ -20,7 +20,8 @@ import (
 	"google.golang.org/api/googleapi"
 )
 
-const resourceDataflowJobGoogleProvidedLabelPrefix = "labels.goog-dataflow-provided"
+const resourceDataflowJobGoogleLabelPrefix = "goog-dataflow-provided"
+const resourceDataflowJobGoogleProvidedLabelPrefix = "labels." + resourceDataflowJobGoogleLabelPrefix
 
 var DataflowTerminatingStatesMap = map[string]struct{}{
 	"JOB_STATE_CANCELLING": {},
@@ -61,11 +62,20 @@ func ResourceDataflowJob() *schema.Resource {
 			Update: schema.DefaultTimeout(10 * time.Minute),
 		},
 		CustomizeDiff: customdiff.All(
+			tpgresource.SetLabelsDiff,
 			resourceDataflowJobTypeCustomizeDiff,
 		),
 		Importer: &schema.ResourceImporter{
 			State: schema.ImportStatePassthrough,
 		},
+		SchemaVersion: 1,
+		StateUpgraders: []schema.StateUpgrader{
+			{
+				Type:    resourceDataflowJobResourceV0().CoreConfigSchema().ImpliedType(),
+				Upgrade: ResourceDataflowJobStateUpgradeV0,
+				Version: 0,
+			},
+		},
 		Schema: map[string]*schema.Schema{
 			"name": {
 				Type:     schema.TypeString,
@@ -120,9 +130,22 @@ func ResourceDataflowJob() *schema.Resource {
 			"labels": {
 				Type:             schema.TypeMap,
 				Optional:         true,
-				Computed:         true,
-				DiffSuppressFunc: resourceDataflowJobLabelDiffSuppress,
-				Description:      `User labels to be specified for the job. Keys and values should follow the restrictions specified in the labeling restrictions page. NOTE: Google-provided Dataflow templates often provide default labels that begin with goog-dataflow-provided. Unless explicitly set in config, these labels will be ignored to prevent diffs on re-apply.`,
+				Description:      `User labels to be specified for the job. Keys and values should follow the restrictions specified in the labeling restrictions page. NOTE: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+			},
+
+			"terraform_labels": {
+				Type:        schema.TypeMap,
+				Computed:    true,
+				Description: `The combination of labels configured directly on the resource and default labels configured on the provider.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+			},
+
+			"effective_labels": {
+				Type:        schema.TypeMap,
+				Computed:    true,
+				Description: `All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
 			},
 
 			"transform_name_mapping": {
@@ -238,12 +261,8 @@ func resourceDataflowJobTypeCustomizeDiff(_ context.Context, d *schema.ResourceD
 			if field == "on_delete" {
 				continue
 			}
-			// Labels map will likely have suppressed changes, so we check each key instead of the parent field
-			if field == "labels" {
-				if err := resourceDataflowJobIterateMapForceNew(field, d); err != nil {
-					return err
-				}
-			} else if d.HasChange(field) {
+
+			if field != "terraform_labels" && d.HasChange(field) {
 				if err := d.ForceNew(field); err != nil {
 					return err
 				}
@@ -343,32 +362,40 @@ func resourceDataflowJobRead(d *schema.ResourceData, meta interface{}) error {
 	if err := d.Set("project", project); err != nil {
 		return fmt.Errorf("Error setting project: %s", err)
 	}
-	if err := d.Set("labels", job.Labels); err != nil {
+	if err := tpgresource.SetLabels(job.Labels, d, "labels"); err != nil {
 		return fmt.Errorf("Error setting labels: %s", err)
 	}
+	if err := tpgresource.SetLabels(job.Labels, d, "terraform_labels"); err != nil {
+		return fmt.Errorf("Error setting terraform_labels: %s", err)
+	}
+	if err := d.Set("effective_labels", job.Labels); err != nil {
+		return fmt.Errorf("Error setting effective_labels: %s", err)
+	}
 	if err := d.Set("kms_key_name", job.Environment.ServiceKmsKeyName); err != nil {
 		return fmt.Errorf("Error setting kms_key_name: %s", err)
 	}
 
+	// This map isn't provided on all responses. It's not clear why but we only want to set these fields
+	// if the API returns. Otherwise this execution will crash for the user.
+	// https://github.com/hashicorp/terraform-provider-google/issues/7449
 	sdkPipelineOptions, err := tpgresource.ConvertToMap(job.Environment.SdkPipelineOptions)
-	if err != nil {
-		return err
-	}
-	optionsMap := sdkPipelineOptions["options"].(map[string]interface{})
-	if err := d.Set("template_gcs_path", optionsMap["templateLocation"]); err != nil {
-		return fmt.Errorf("Error setting template_gcs_path: %s", err)
-	}
-	if err := d.Set("temp_gcs_location", optionsMap["tempLocation"]); err != nil {
-		return fmt.Errorf("Error setting temp_gcs_location: %s", err)
-	}
-	if err := d.Set("machine_type", optionsMap["machineType"]); err != nil {
-		return fmt.Errorf("Error setting machine_type: %s", err)
-	}
-	if err := d.Set("network", optionsMap["network"]); err != nil {
-		return fmt.Errorf("Error setting network: %s", err)
-	}
-	if err := d.Set("service_account_email", optionsMap["serviceAccountEmail"]); err != nil {
-		return fmt.Errorf("Error setting service_account_email: %s", err)
+	if err == nil {
+		optionsMap := sdkPipelineOptions["options"].(map[string]interface{})
+		if err := d.Set("template_gcs_path", optionsMap["templateLocation"]); err != nil {
+			return fmt.Errorf("Error setting template_gcs_path: %s", err)
+		}
+		if err := d.Set("temp_gcs_location", optionsMap["tempLocation"]); err != nil {
+			return fmt.Errorf("Error setting temp_gcs_location: %s", err)
+		}
+		if err := d.Set("machine_type", optionsMap["machineType"]); err != nil {
+			return fmt.Errorf("Error setting machine_type: %s", err)
+		}
+		if err := d.Set("network", optionsMap["network"]); err != nil {
+			return fmt.Errorf("Error setting network: %s", err)
+		}
+		if err := d.Set("service_account_email", optionsMap["serviceAccountEmail"]); err != nil {
+			return fmt.Errorf("Error setting service_account_email: %s", err)
+		}
 	}
 
 	if ok := shouldStopDataflowJobDeleteQuery(job.CurrentState, d.Get("skip_wait_on_job_termination").(bool)); ok {
@@ -388,57 +415,58 @@ func resourceDataflowJobUpdateByReplacement(d *schema.ResourceData, meta interfa
 		return nil
 	}
 
-	config := meta.(*transport_tpg.Config)
-	userAgent, err :=  tpgresource.GenerateUserAgentString(d, config.UserAgent)
-	if err != nil {
-		return err
-	}
-
-	project, err := tpgresource.GetProject(d, config)
-	if err != nil {
-		return err
-	}
+	if jobHasUpdate(d, ResourceDataflowJob().Schema) {
+		config := meta.(*transport_tpg.Config)
+		userAgent, err :=  tpgresource.GenerateUserAgentString(d, config.UserAgent)
+		if err != nil {
+			return err
+		}
 
-	region, err := tpgresource.GetRegion(d, config)
-	if err != nil {
-		return err
-	}
+		project, err := tpgresource.GetProject(d, config)
+		if err != nil {
+			return err
+		}
 
-	params := tpgresource.ExpandStringMap(d, "parameters")
-	tnamemapping := tpgresource.ExpandStringMap(d, "transform_name_mapping")
+		region, err := tpgresource.GetRegion(d, config)
+		if err != nil {
+			return err
+		}
 
-	env, err := resourceDataflowJobSetupEnv(d, config)
-	if err != nil {
-		return err
-	}
+		params := tpgresource.ExpandStringMap(d, "parameters")
+		tnamemapping := tpgresource.ExpandStringMap(d, "transform_name_mapping")
 
-	request := dataflow.LaunchTemplateParameters{
-		JobName:              d.Get("name").(string),
-		Parameters:           params,
-		TransformNameMapping: tnamemapping,
-		Environment:          &env,
-		Update:               true,
-	}
+		env, err := resourceDataflowJobSetupEnv(d, config)
+		if err != nil {
+			return err
+		}
 
-	var response *dataflow.LaunchTemplateResponse
-	err = transport_tpg.Retry(transport_tpg.RetryOptions{
-		RetryFunc: func() (updateErr error) {
-			response, updateErr = resourceDataflowJobLaunchTemplate(config, project, region, userAgent, d.Get("template_gcs_path").(string), &request)
-			return updateErr
-		},
-		Timeout: time.Minute*time.Duration(5),
-		ErrorRetryPredicates: []transport_tpg.RetryErrorPredicateFunc{transport_tpg.IsDataflowJobUpdateRetryableError},
-	})
-	if err != nil {
-		return err
-	}
+		request := dataflow.LaunchTemplateParameters{
+			JobName:              d.Get("name").(string),
+			Parameters:           params,
+			TransformNameMapping: tnamemapping,
+			Environment:          &env,
+			Update:               true,
+		}
 
-	if err := waitForDataflowJobToBeUpdated(d, config, response.Job.Id, userAgent, d.Timeout(schema.TimeoutUpdate)); err != nil {
-		return fmt.Errorf("Error updating job with job ID %q: %v", d.Id(), err)
-	}
+		var response *dataflow.LaunchTemplateResponse
+		err = transport_tpg.Retry(transport_tpg.RetryOptions{
+			RetryFunc: func() (updateErr error) {
+				response, updateErr = resourceDataflowJobLaunchTemplate(config, project, region, userAgent, d.Get("template_gcs_path").(string), &request)
+				return updateErr
+			},
+			Timeout: time.Minute*time.Duration(5),
+			ErrorRetryPredicates: []transport_tpg.RetryErrorPredicateFunc{transport_tpg.IsDataflowJobUpdateRetryableError},
+		})
+		if err != nil {
+			return err
+		}
 
-	d.SetId(response.Job.Id)
+		if err := waitForDataflowJobToBeUpdated(d, config, response.Job.Id, userAgent, d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return fmt.Errorf("Error updating job with job ID %q: %v", d.Id(), err)
+		}
 
+		d.SetId(response.Job.Id)
+	}
 	return resourceDataflowJobRead(d, meta)
 }
 
@@ -566,7 +594,7 @@ func resourceDataflowJobLaunchTemplate(config *transport_tpg.Config, project, re
 func resourceDataflowJobSetupEnv(d *schema.ResourceData, config *transport_tpg.Config) (dataflow.RuntimeEnvironment, error) {
 	zone, _ := tpgresource.GetZone(d, config)
 
-	labels := tpgresource.ExpandStringMap(d, "labels")
+	labels := tpgresource.ExpandStringMap(d, "effective_labels")
 
 	additionalExperiments := tpgresource.ConvertStringSet(d.Get("additional_experiments").(*schema.Set))
 
@@ -620,9 +648,8 @@ func resourceDataflowJobIsVirtualUpdate(d *schema.ResourceData, resourceSchema m
 			if field == "on_delete" {
 				continue
 			}
-			// Labels map will likely have suppressed changes, so we check each key instead of the parent field
-			if (field == "labels" && resourceDataflowJobIterateMapHasChange(field, d)) ||
-				(field != "labels" && d.HasChange(field)) {
+
+			if d.HasChange(field) {
 				return false
 			}
 		}
@@ -633,6 +660,25 @@ func resourceDataflowJobIsVirtualUpdate(d *schema.ResourceData, resourceSchema m
 	return false
 }
 
+// If only fields on_delete, terraform_labels are changing, no update request is needed
+func jobHasUpdate(d *schema.ResourceData, resourceSchema map[string]*schema.Schema) bool {
+	if d.HasChange("on_delete") || d.HasChange("labels") || d.HasChange("terraform_labels") {
+		for field := range resourceSchema {
+			if field == "on_delete" || field == "labels" || field == "terraform_labels" {
+				continue
+			}
+
+			if d.HasChange(field) {
+				return true
+			}
+		}
+		// on_delete, or terraform_labels are changing, but nothing else
+		return false
+	}
+
+	return true
+}
+
 func waitForDataflowJobToBeUpdated(d *schema.ResourceData, config *transport_tpg.Config, replacementJobID, userAgent string, timeout time.Duration) error {
 	return resource.Retry(timeout, func() *resource.RetryError {
 		project, err := tpgresource.GetProject(d, config)
diff --git a/mmv1/third_party/terraform/services/dataflow/resource_dataflow_job_migrate.go b/mmv1/third_party/terraform/services/dataflow/resource_dataflow_job_migrate.go
new file mode 100644
index 000000000000..10d42ed21ac6
--- /dev/null
+++ b/mmv1/third_party/terraform/services/dataflow/resource_dataflow_job_migrate.go
@@ -0,0 +1,180 @@
+package dataflow
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+)
+
+func resourceDataflowJobResourceV0() *schema.Resource {
+	return &schema.Resource{
+		Schema: map[string]*schema.Schema{
+			"name": {
+				Type:     schema.TypeString,
+				Required: true,
+				// ForceNew applies to both stream and batch jobs
+				ForceNew:    true,
+				Description: `A unique name for the resource, required by Dataflow.`,
+			},
+
+			"template_gcs_path": {
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: `The Google Cloud Storage path to the Dataflow job template.`,
+			},
+
+			"temp_gcs_location": {
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: `A writeable location on Google Cloud Storage for the Dataflow job to dump its temporary data.`,
+			},
+
+			"zone": {
+				Type:     schema.TypeString,
+				Optional: true,
+				// ForceNew applies to both stream and batch jobs
+				ForceNew:    true,
+				Description: `The zone in which the created job should run. If it is not provided, the provider zone is used.`,
+			},
+
+			"region": {
+				Type:     schema.TypeString,
+				Optional: true,
+				// ForceNew applies to both stream and batch jobs
+				ForceNew:    true,
+				Description: `The region in which the created job should run.`,
+			},
+
+			"max_workers": {
+				Type:     schema.TypeInt,
+				Optional: true,
+				// ForceNew applies to both stream and batch jobs
+				ForceNew:    true,
+				Description: `The number of workers permitted to work on the job. More workers may improve processing speed at additional cost.`,
+			},
+
+			"parameters": {
+				Type:        schema.TypeMap,
+				Optional:    true,
+				Description: `Key/Value pairs to be passed to the Dataflow job (as used in the template).`,
+			},
+
+			"labels": {
+				Type:             schema.TypeMap,
+				Optional:         true,
+				Computed:         true,
+				DiffSuppressFunc: resourceDataflowJobLabelDiffSuppress,
+				Description:      `User labels to be specified for the job. Keys and values should follow the restrictions specified in the labeling restrictions page. NOTE: Google-provided Dataflow templates often provide default labels that begin with goog-dataflow-provided. Unless explicitly set in config, these labels will be ignored to prevent diffs on re-apply.`,
+			},
+
+			"transform_name_mapping": {
+				Type:        schema.TypeMap,
+				Optional:    true,
+				Description: `Only applicable when updating a pipeline. Map of transform name prefixes of the job to be replaced with the corresponding name prefixes of the new job.`,
+			},
+
+			"on_delete": {
+				Type:         schema.TypeString,
+				ValidateFunc: validation.StringInSlice([]string{"cancel", "drain"}, false),
+				Optional:     true,
+				Default:      "drain",
+				Description:  `One of "drain" or "cancel". Specifies behavior of deletion during terraform destroy.`,
+			},
+
+			"project": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				// ForceNew applies to both stream and batch jobs
+				ForceNew:    true,
+				Description: `The project in which the resource belongs.`,
+			},
+
+			"state": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: `The current state of the resource, selected from the JobState enum.`,
+			},
+			"type": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: `The type of this job, selected from the JobType enum.`,
+			},
+			"service_account_email": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: `The Service Account email used to create the job.`,
+			},
+
+			"network": {
+				Type:             schema.TypeString,
+				Optional:         true,
+				DiffSuppressFunc: tpgresource.CompareSelfLinkOrResourceName,
+				Description:      `The network to which VMs will be assigned. If it is not provided, "default" will be used.`,
+			},
+
+			"subnetwork": {
+				Type:             schema.TypeString,
+				Optional:         true,
+				DiffSuppressFunc: tpgresource.CompareSelfLinkOrResourceName,
+				Description:      `The subnetwork to which VMs will be assigned. Should be of the form "regions/REGION/subnetworks/SUBNETWORK".`,
+			},
+
+			"machine_type": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: `The machine type to use for the job.`,
+			},
+
+			"kms_key_name": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: `The name for the Cloud KMS key for the job. Key format is: projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY`,
+			},
+
+			"ip_configuration": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Description:  `The configuration for VM IPs. Options are "WORKER_IP_PUBLIC" or "WORKER_IP_PRIVATE".`,
+				ValidateFunc: validation.StringInSlice([]string{"WORKER_IP_PUBLIC", "WORKER_IP_PRIVATE", ""}, false),
+			},
+
+			"additional_experiments": {
+				Type:        schema.TypeSet,
+				Optional:    true,
+				Computed:    true,
+				Description: `List of experiments that should be used by the job. An example value is ["enable_stackdriver_agent_metrics"].`,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+
+			"job_id": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: `The unique ID of this job.`,
+			},
+
+			"enable_streaming_engine": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Description: `Indicates if the job should use the streaming engine feature.`,
+			},
+
+			"skip_wait_on_job_termination": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Default:     false,
+				Description: `If true, treat DRAINING and CANCELLING as terminal job states and do not wait for further changes before removing from terraform state and moving on. WARNING: this will lead to job name conflicts if you do not ensure that the job names are different, e.g. by embedding a release ID or by using a random_id.`,
+			},
+		},
+		UseJSONNumber: true,
+	}
+}
+
+func ResourceDataflowJobStateUpgradeV0(_ context.Context, rawState map[string]interface{}, meta interface{}) (map[string]interface{}, error) {
+	return tpgresource.LabelsStateUpgrade(rawState, resourceDataflowJobGoogleLabelPrefix)
+}
diff --git a/mmv1/third_party/terraform/services/dataflow/resource_dataflow_job_sweeper.go b/mmv1/third_party/terraform/services/dataflow/resource_dataflow_job_sweeper.go
new file mode 100644
index 000000000000..a25ccbc2a0ef
--- /dev/null
+++ b/mmv1/third_party/terraform/services/dataflow/resource_dataflow_job_sweeper.go
@@ -0,0 +1,122 @@
+package dataflow
+
+import (
+	"context"
+	"log"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/terraform-provider-google/google/envvar"
+	"github.com/hashicorp/terraform-provider-google/google/sweeper"
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
+)
+
+func init() {
+	sweeper.AddTestSweepers("DataflowJob", testSweepDataFlowJob)
+}
+
+// At the time of writing, the CI only passes us-central1 as the region
+func testSweepDataFlowJob(region string) error {
+	resourceName := "DataflowJob"
+	log.Printf("[INFO][SWEEPER_LOG] Starting sweeper for %s", resourceName)
+
+	config, err := sweeper.SharedConfigForRegion(region)
+	if err != nil {
+		log.Printf("[INFO][SWEEPER_LOG] error getting shared config for region: %s", err)
+		return err
+	}
+
+	err = config.LoadAndValidate(context.Background())
+	if err != nil {
+		log.Printf("[INFO][SWEEPER_LOG] error loading: %s", err)
+		return err
+	}
+
+	t := &testing.T{}
+	billingId := envvar.GetTestBillingAccountFromEnv(t)
+
+	// Setup variables to replace in list template
+	d := &tpgresource.ResourceDataMock{
+		FieldsInSchema: map[string]interface{}{
+			"project":         config.Project,
+			"region":          region,
+			"location":        region,
+			"zone":            "-",
+			"billing_account": billingId,
+		},
+	}
+
+	listTemplate := strings.Split("https://dataflow.googleapis.com/v1b3/projects/{{project}}/locations/{{location}}/jobs", "?")[0]
+	listUrl, err := tpgresource.ReplaceVars(d, config, listTemplate)
+	if err != nil {
+		log.Printf("[INFO][SWEEPER_LOG] error preparing sweeper list url: %s", err)
+		return nil
+	}
+
+	res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+		Config:    config,
+		Method:    "GET",
+		Project:   config.Project,
+		RawURL:    listUrl,
+		UserAgent: config.UserAgent,
+	})
+	if err != nil {
+		log.Printf("[INFO][SWEEPER_LOG] Error in response from request %s: %s", listUrl, err)
+		return nil
+	}
+
+	resourceList, ok := res["items"]
+	if !ok {
+		log.Printf("[INFO][SWEEPER_LOG] Nothing found in response.")
+		return nil
+	}
+
+	rl := resourceList.([]interface{})
+
+	log.Printf("[INFO][SWEEPER_LOG] Found %d items in %s list response.", len(rl), resourceName)
+	// Keep count of items that aren't sweepable for logging.
+	nonPrefixCount := 0
+	for _, ri := range rl {
+		obj := ri.(map[string]interface{})
+		if obj["name"] == nil {
+			log.Printf("[INFO][SWEEPER_LOG] %s resource name was nil", resourceName)
+			return nil
+		}
+
+		name := tpgresource.GetResourceNameFromSelfLink(obj["name"].(string))
+		// Skip resources that shouldn't be sweeped
+		if !sweeper.IsSweepableTestResource(name) {
+			nonPrefixCount++
+			continue
+		}
+
+		deleteTemplate := "https://dataflow.googleapis.com/v1b3/projects/{{project}}/locations/{{location}}/jobs"
+		deleteUrl, err := tpgresource.ReplaceVars(d, config, deleteTemplate)
+		if err != nil {
+			log.Printf("[INFO][SWEEPER_LOG] error preparing delete url: %s", err)
+			return nil
+		}
+		deleteUrl = deleteUrl + name
+
+		// Don't wait on operations as we may have a lot to delete
+		_, err = transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+			Config:    config,
+			Method:    "DELETE",
+			Project:   config.Project,
+			RawURL:    deleteUrl,
+			UserAgent: config.UserAgent,
+		})
+		if err != nil {
+			log.Printf("[INFO][SWEEPER_LOG] Error deleting for url %s : %s", deleteUrl, err)
+		} else {
+			log.Printf("[INFO][SWEEPER_LOG] Sent delete request for %s resource: %s", resourceName, name)
+		}
+	}
+
+	if nonPrefixCount > 0 {
+		log.Printf("[INFO][SWEEPER_LOG] %d items were non-sweepable and skipped.", nonPrefixCount)
+	}
+
+	return nil
+}
diff --git a/mmv1/third_party/terraform/services/dataflow/resource_dataflow_job_test.go.erb b/mmv1/third_party/terraform/services/dataflow/resource_dataflow_job_test.go.erb
index 9f4f69035a8f..ac9624cd3bc5 100644
--- a/mmv1/third_party/terraform/services/dataflow/resource_dataflow_job_test.go.erb
+++ b/mmv1/third_party/terraform/services/dataflow/resource_dataflow_job_test.go.erb
@@ -243,15 +243,136 @@ func TestAccDataflowJob_withLabels(t *testing.T) {
 			{
 				Config: testAccDataflowJob_labels(bucket, job, key, value),
 				Check: resource.ComposeTestCheckFunc(
-					testAccDataflowJobExists(t, "google_dataflow_job.with_labels"),
-					testAccDataflowJobHasLabels(t, "google_dataflow_job.with_labels", key),
+					testAccDataflowJobExists(t, "google_dataflow_job.big_data"),
+					testAccDataflowJobHasLabels(t, "google_dataflow_job.big_data", key),
 				),
 			},
 			{
-				ResourceName:            "google_dataflow_job.with_labels",
+				ResourceName:            "google_dataflow_job.big_data",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state"},
+				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "labels", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func TestAccDataflowJob_withProviderDefaultLabels(t *testing.T) {
+	// The test failed if VCR testing is enabled, because the cached provider config is used.
+	// With the cached provider config, any changes in the provider default labels will not be applied. 
+	acctest.SkipIfVcr(t)
+	t.Parallel()
+
+	randStr := acctest.RandString(t, 10)
+	bucket := "tf-test-dataflow-gcs-" + randStr
+	job := "tf-test-dataflow-job-" + randStr
+	zone := "us-central1-f"
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckDataflowJobDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDataflowJob_withProviderDefaultLabels(bucket, job),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "labels.%", "2"),
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "labels.default_expiration_ms", "3600000"),
+
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "terraform_labels.%", "3"),
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "terraform_labels.default_key1", "default_value1"),
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "terraform_labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "terraform_labels.default_expiration_ms", "3600000"),
+
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "effective_labels.%", "6"),
+				),
+			},
+			{
+				ResourceName:      "google_dataflow_job.big_data",
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccDataflowJob_resourceLabelsOverridesProviderDefaultLabels(bucket, job),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "labels.%", "3"),
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "labels.default_expiration_ms", "3600000"),
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "labels.default_key1", "value1"),
+
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "terraform_labels.%", "3"),
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "terraform_labels.default_key1", "value1"),
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "terraform_labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "terraform_labels.default_expiration_ms", "3600000"),
+
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "effective_labels.%", "6"),
+				),
+			},
+			{
+				ResourceName:      "google_dataflow_job.big_data",
+				ImportState:       true,
+				ImportStateVerify: true,
+				// The labels field in the state is decided by the configuration.
+				// During importing, the configuration is unavailable, so the labels field in the state after importing is empty.
+				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccDataflowJob_moveResourceLabelToProviderDefaultLabels(bucket, job),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "labels.%", "2"),
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "labels.default_expiration_ms", "3600000"),
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "labels.default_key1", "value1"),
+
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "terraform_labels.%", "3"),
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "terraform_labels.default_key1", "value1"),
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "terraform_labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "terraform_labels.default_expiration_ms", "3600000"),
+
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "effective_labels.%", "6"),
+				),
+			},
+			{
+				ResourceName:      "google_dataflow_job.big_data",
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccDataflowJob_resourceLabelsOverridesProviderDefaultLabels(bucket, job),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "labels.%", "3"),
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "labels.default_expiration_ms", "3600000"),
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "labels.default_key1", "value1"),
+
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "terraform_labels.%", "3"),
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "terraform_labels.default_key1", "value1"),
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "terraform_labels.env", "foo"),
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "terraform_labels.default_expiration_ms", "3600000"),
+
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "effective_labels.%", "6"),
+				),
+			},
+			{
+				ResourceName:      "google_dataflow_job.big_data",
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "state", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccDataflowJob_zone(bucket, job, zone),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckNoResourceAttr("google_dataflow_job.big_data", "labels.%"),
+					resource.TestCheckResourceAttr("google_dataflow_job.big_data", "effective_labels.%", "3"),
+				),
+			},
+			{
+				ResourceName:      "google_dataflow_job.big_data",
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"on_delete", "parameters", "skip_wait_on_job_termination", "zone", "state"},
 			},
 		},
 	})
@@ -605,8 +726,8 @@ func testAccDataflowJobGetGeneratedInstanceTemplate(t *testing.T, s *terraform.S
 	var instanceTemplate *compute.InstanceTemplate
 
 	err := resource.Retry(1*time.Minute, func() *resource.RetryError {
-		instanceTemplates, rerr := config.NewComputeClient(config.UserAgent).InstanceTemplates.
-			List(config.Project).
+		instanceTemplates, rerr := config.NewComputeClient(config.UserAgent).RegionInstanceTemplates.
+			List(config.Project, config.Region).
 			Filter(filter).
 			MaxResults(2).
 			Fields("items/properties").Do()
@@ -956,7 +1077,7 @@ resource "google_storage_bucket" "temp" {
   force_destroy = true
 }
 
-resource "google_dataflow_job" "with_labels" {
+resource "google_dataflow_job" "big_data" {
   name = "%s"
 
   labels = {
@@ -972,7 +1093,107 @@ resource "google_dataflow_job" "with_labels" {
   on_delete = "cancel"
 }
 `, bucket, job, labelKey, labelVal, testDataflowJobTemplateWordCountUrl, testDataflowJobSampleFileUrl)
+}
 
+func testAccDataflowJob_withProviderDefaultLabels(bucket, job string) string {
+	return fmt.Sprintf(`
+provider "google" {
+  default_labels = {
+    default_key1 = "default_value1"
+  }
+}
+
+resource "google_storage_bucket" "temp" {
+  name          = "%s"
+  location      = "US"
+  force_destroy = true
+}
+
+resource "google_dataflow_job" "big_data" {
+  name = "%s"
+
+  labels = {
+    env                   = "foo"
+    default_expiration_ms = 3600000
+  }
+
+  template_gcs_path = "%s"
+  temp_gcs_location = google_storage_bucket.temp.url
+  parameters = {
+    inputFile = "%s"
+    output    = "${google_storage_bucket.temp.url}/output"
+  }
+  on_delete = "cancel"
+}
+`, bucket, job, testDataflowJobTemplateWordCountUrl, testDataflowJobSampleFileUrl)
+}
+
+func testAccDataflowJob_resourceLabelsOverridesProviderDefaultLabels(bucket, job string) string {
+	return fmt.Sprintf(`
+provider "google" {
+  default_labels = {
+    default_key1 = "default_value1"
+  }
+}
+
+resource "google_storage_bucket" "temp" {
+  name          = "%s"
+  location      = "US"
+  force_destroy = true
+}
+
+resource "google_dataflow_job" "big_data" {
+  name = "%s"
+
+  labels = {
+    env                   = "foo"
+    default_expiration_ms = 3600000
+    default_key1          = "value1"
+  }
+
+  template_gcs_path = "%s"
+  temp_gcs_location = google_storage_bucket.temp.url
+  parameters = {
+    inputFile = "%s"
+    output    = "${google_storage_bucket.temp.url}/output"
+  }
+  on_delete = "cancel"
+}
+`, bucket, job, testDataflowJobTemplateWordCountUrl, testDataflowJobSampleFileUrl)
+}
+
+func testAccDataflowJob_moveResourceLabelToProviderDefaultLabels(bucket, job string) string {
+	return fmt.Sprintf(`
+provider "google" {
+  default_labels = {
+	default_key1 = "default_value1"
+	env          = "foo"
+  }
+}
+
+resource "google_storage_bucket" "temp" {
+  name          = "%s"
+  location      = "US"
+  force_destroy = true
+}
+
+resource "google_dataflow_job" "big_data" {
+  name = "%s"
+
+  labels = {
+    default_expiration_ms = 3600000
+    default_key1          = "value1"
+  }
+
+  template_gcs_path = "%s"
+  temp_gcs_location = google_storage_bucket.temp.url
+  parameters = {
+    inputFile = "%s"
+    output    = "${google_storage_bucket.temp.url}/output"
+  }
+  on_delete = "cancel"
+}
+`, bucket, job, testDataflowJobTemplateWordCountUrl, testDataflowJobSampleFileUrl)
 }
 
 func testAccDataflowJob_kms(key_ring, crypto_key, bucket, job, zone string) string {
diff --git a/mmv1/third_party/terraform/services/dataform/resource_dataform_repository_test.go.erb b/mmv1/third_party/terraform/services/dataform/resource_dataform_repository_test.go.erb
index 79043dd0fea3..fd24afe43b3f 100644
--- a/mmv1/third_party/terraform/services/dataform/resource_dataform_repository_test.go.erb
+++ b/mmv1/third_party/terraform/services/dataform/resource_dataform_repository_test.go.erb
@@ -56,7 +56,7 @@ resource "google_secret_manager_secret" "secret" {
   secret_id = "secret"
 
   replication {
-    automatic = true
+    auto {}
   }
 }
 
@@ -98,7 +98,7 @@ resource "google_secret_manager_secret" "secret" {
   secret_id = "secret"
 
   replication {
-    automatic = true
+    auto {}
   }
 }
 
diff --git a/mmv1/third_party/terraform/services/datafusion/resource_data_fusion_instance_test.go b/mmv1/third_party/terraform/services/datafusion/resource_data_fusion_instance_test.go
index f245f7334cce..b741c39a53b6 100644
--- a/mmv1/third_party/terraform/services/datafusion/resource_data_fusion_instance_test.go
+++ b/mmv1/third_party/terraform/services/datafusion/resource_data_fusion_instance_test.go
@@ -21,17 +21,19 @@ func TestAccDataFusionInstance_update(t *testing.T) {
 				Config: testAccDataFusionInstance_basic(instanceName),
 			},
 			{
-				ResourceName:      "google_data_fusion_instance.foobar",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_data_fusion_instance.foobar",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccDataFusionInstance_updated(instanceName),
 			},
 			{
-				ResourceName:      "google_data_fusion_instance.foobar",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_data_fusion_instance.foobar",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -97,17 +99,19 @@ func TestAccDataFusionInstanceEnterprise_update(t *testing.T) {
 				Config: testAccDataFusionInstanceEnterprise_basic(instanceName),
 			},
 			{
-				ResourceName:      "google_data_fusion_instance.foobar",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_data_fusion_instance.foobar",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccDataFusionInstanceEnterprise_updated(instanceName),
 			},
 			{
-				ResourceName:      "google_data_fusion_instance.foobar",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_data_fusion_instance.foobar",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/dataproc/iam_dataproc_cluster_test.go b/mmv1/third_party/terraform/services/dataproc/iam_dataproc_cluster_test.go
index 71cc92e15c56..c77f4d86b13f 100644
--- a/mmv1/third_party/terraform/services/dataproc/iam_dataproc_cluster_test.go
+++ b/mmv1/third_party/terraform/services/dataproc/iam_dataproc_cluster_test.go
@@ -16,6 +16,10 @@ func TestAccDataprocClusterIamBinding(t *testing.T) {
 	account := "tf-dataproc-iam-" + acctest.RandString(t, 10)
 	role := "roles/editor"
 
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
 	importId := fmt.Sprintf("projects/%s/regions/%s/clusters/%s %s",
 		envvar.GetTestProjectFromEnv(), "us-central1", cluster, role)
 
@@ -25,7 +29,7 @@ func TestAccDataprocClusterIamBinding(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// Test IAM Binding creation
-				Config: testAccDataprocClusterIamBinding_basic(cluster, account, role),
+				Config: testAccDataprocClusterIamBinding_basic(cluster, subnetworkName, account, role),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(
 						"google_dataproc_cluster_iam_binding.binding", "role", role),
@@ -39,7 +43,7 @@ func TestAccDataprocClusterIamBinding(t *testing.T) {
 			},
 			{
 				// Test IAM Binding update
-				Config: testAccDataprocClusterIamBinding_update(cluster, account, role),
+				Config: testAccDataprocClusterIamBinding_update(cluster, subnetworkName, account, role),
 			},
 			{
 				ResourceName:      "google_dataproc_cluster_iam_binding.binding",
@@ -58,6 +62,10 @@ func TestAccDataprocClusterIamMember(t *testing.T) {
 	account := "tf-dataproc-iam-" + acctest.RandString(t, 10)
 	role := "roles/editor"
 
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
 	importId := fmt.Sprintf("projects/%s/regions/%s/clusters/%s %s serviceAccount:%s",
 		envvar.GetTestProjectFromEnv(),
 		"us-central1",
@@ -71,7 +79,7 @@ func TestAccDataprocClusterIamMember(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// Test IAM Binding creation
-				Config: testAccDataprocClusterIamMember(cluster, account, role),
+				Config: testAccDataprocClusterIamMember(cluster, subnetworkName, account, role),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(
 						"google_dataproc_cluster_iam_member.member", "role", role),
@@ -96,6 +104,10 @@ func TestAccDataprocClusterIamPolicy(t *testing.T) {
 	account := "tf-dataproc-iam-" + acctest.RandString(t, 10)
 	role := "roles/editor"
 
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
 	importId := fmt.Sprintf("projects/%s/regions/%s/clusters/%s",
 		envvar.GetTestProjectFromEnv(), "us-central1", cluster)
 
@@ -105,7 +117,7 @@ func TestAccDataprocClusterIamPolicy(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// Test IAM Binding creation
-				Config: testAccDataprocClusterIamPolicy(cluster, account, role),
+				Config: testAccDataprocClusterIamPolicy(cluster, subnetworkName, account, role),
 				Check:  resource.TestCheckResourceAttrSet("data.google_dataproc_cluster_iam_policy.policy", "policy_data"),
 			},
 			{
@@ -118,7 +130,7 @@ func TestAccDataprocClusterIamPolicy(t *testing.T) {
 	})
 }
 
-func testAccDataprocClusterIamBinding_basic(cluster, account, role string) string {
+func testAccDataprocClusterIamBinding_basic(cluster, subnetworkName, account, role string) string {
 	return fmt.Sprintf(testDataprocIamSingleNodeCluster+`
 resource "google_service_account" "test-account1" {
   account_id   = "%s-1"
@@ -138,10 +150,10 @@ resource "google_dataproc_cluster_iam_binding" "binding" {
     "serviceAccount:${google_service_account.test-account1.email}",
   ]
 }
-`, cluster, account, account, role)
+`, cluster, subnetworkName, account, account, role)
 }
 
-func testAccDataprocClusterIamBinding_update(cluster, account, role string) string {
+func testAccDataprocClusterIamBinding_update(cluster, subnetworkName, account, role string) string {
 	return fmt.Sprintf(testDataprocIamSingleNodeCluster+`
 resource "google_service_account" "test-account1" {
   account_id   = "%s-1"
@@ -162,10 +174,10 @@ resource "google_dataproc_cluster_iam_binding" "binding" {
     "serviceAccount:${google_service_account.test-account2.email}",
   ]
 }
-`, cluster, account, account, role)
+`, cluster, subnetworkName, account, account, role)
 }
 
-func testAccDataprocClusterIamMember(cluster, account, role string) string {
+func testAccDataprocClusterIamMember(cluster, subnetworkName, account, role string) string {
 	return fmt.Sprintf(testDataprocIamSingleNodeCluster+`
 resource "google_service_account" "test-account" {
   account_id   = "%s"
@@ -177,10 +189,10 @@ resource "google_dataproc_cluster_iam_member" "member" {
   role    = "%s"
   member  = "serviceAccount:${google_service_account.test-account.email}"
 }
-`, cluster, account, role)
+`, cluster, subnetworkName, account, role)
 }
 
-func testAccDataprocClusterIamPolicy(cluster, account, role string) string {
+func testAccDataprocClusterIamPolicy(cluster, subnetworkName, account, role string) string {
 	return fmt.Sprintf(testDataprocIamSingleNodeCluster+`
 resource "google_service_account" "test-account" {
   account_id   = "%s"
@@ -205,7 +217,7 @@ data "google_dataproc_cluster_iam_policy" "policy" {
   region      = "us-central1"
 }
 
-`, cluster, account, role)
+`, cluster, subnetworkName, account, role)
 }
 
 // Smallest cluster possible for testing
@@ -215,6 +227,10 @@ resource "google_dataproc_cluster" "cluster" {
   region = "us-central1"
 
   cluster_config {
+    gce_cluster_config {
+      subnetwork = "%s"
+    }
+      
     # Keep the costs down with smallest config we can get away with
     software_config {
       override_properties = {
diff --git a/mmv1/third_party/terraform/services/dataproc/iam_dataproc_job_test.go b/mmv1/third_party/terraform/services/dataproc/iam_dataproc_job_test.go
index db870b514093..5e4b95c98da9 100644
--- a/mmv1/third_party/terraform/services/dataproc/iam_dataproc_job_test.go
+++ b/mmv1/third_party/terraform/services/dataproc/iam_dataproc_job_test.go
@@ -17,6 +17,10 @@ func TestAccDataprocJobIamBinding(t *testing.T) {
 	account := "tf-dataproc-iam-" + acctest.RandString(t, 10)
 	role := "roles/editor"
 
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
 	importId := fmt.Sprintf("projects/%s/regions/%s/jobs/%s %s",
 		envvar.GetTestProjectFromEnv(), "us-central1", job, role)
 
@@ -26,7 +30,7 @@ func TestAccDataprocJobIamBinding(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// Test IAM Binding creation
-				Config: testAccDataprocJobIamBinding_basic(cluster, job, account, role),
+				Config: testAccDataprocJobIamBinding_basic(cluster, subnetworkName, job, account, role),
 			},
 			{
 				ResourceName:      "google_dataproc_job_iam_binding.binding",
@@ -36,7 +40,7 @@ func TestAccDataprocJobIamBinding(t *testing.T) {
 			},
 			{
 				// Test IAM Binding update
-				Config: testAccDataprocJobIamBinding_update(cluster, job, account, role),
+				Config: testAccDataprocJobIamBinding_update(cluster, subnetworkName, job, account, role),
 			},
 			{
 				ResourceName:      "google_dataproc_job_iam_binding.binding",
@@ -56,6 +60,10 @@ func TestAccDataprocJobIamMember(t *testing.T) {
 	account := "tf-dataproc-iam-" + acctest.RandString(t, 10)
 	role := "roles/editor"
 
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
 	importId := fmt.Sprintf("projects/%s/regions/%s/jobs/%s %s serviceAccount:%s",
 		envvar.GetTestProjectFromEnv(),
 		"us-central1",
@@ -69,7 +77,7 @@ func TestAccDataprocJobIamMember(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// Test IAM Binding creation
-				Config: testAccDataprocJobIamMember(cluster, job, account, role),
+				Config: testAccDataprocJobIamMember(cluster, subnetworkName, job, account, role),
 			},
 			{
 				ResourceName:      "google_dataproc_job_iam_member.member",
@@ -89,6 +97,10 @@ func TestAccDataprocJobIamPolicy(t *testing.T) {
 	account := "tf-dataproc-iam-" + acctest.RandString(t, 10)
 	role := "roles/editor"
 
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
 	importId := fmt.Sprintf("projects/%s/regions/%s/jobs/%s",
 		envvar.GetTestProjectFromEnv(), "us-central1", job)
 
@@ -98,7 +110,7 @@ func TestAccDataprocJobIamPolicy(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// Test IAM Binding creation
-				Config: testAccDataprocJobIamPolicy(cluster, job, account, role),
+				Config: testAccDataprocJobIamPolicy(cluster, subnetworkName, job, account, role),
 				Check:  resource.TestCheckResourceAttrSet("data.google_dataproc_job_iam_policy.policy", "policy_data"),
 			},
 			{
@@ -139,7 +151,7 @@ resource "google_dataproc_job" "pyspark" {
 }
 `
 
-func testAccDataprocJobIamBinding_basic(cluster, job, account, role string) string {
+func testAccDataprocJobIamBinding_basic(cluster, subnetworkName, job, account, role string) string {
 	return fmt.Sprintf(testDataprocIamJobConfig+`
 resource "google_service_account" "test-account1" {
   account_id   = "%s-1"
@@ -159,10 +171,10 @@ resource "google_dataproc_job_iam_binding" "binding" {
     "serviceAccount:${google_service_account.test-account1.email}",
   ]
 }
-`, cluster, job, account, account, role)
+`, cluster, subnetworkName, job, account, account, role)
 }
 
-func testAccDataprocJobIamBinding_update(cluster, job, account, role string) string {
+func testAccDataprocJobIamBinding_update(cluster, subnetworkName, job, account, role string) string {
 	return fmt.Sprintf(testDataprocIamJobConfig+`
 resource "google_service_account" "test-account1" {
   account_id   = "%s-1"
@@ -183,10 +195,10 @@ resource "google_dataproc_job_iam_binding" "binding" {
     "serviceAccount:${google_service_account.test-account2.email}",
   ]
 }
-`, cluster, job, account, account, role)
+`, cluster, subnetworkName, job, account, account, role)
 }
 
-func testAccDataprocJobIamMember(cluster, job, account, role string) string {
+func testAccDataprocJobIamMember(cluster, subnetworkName, job, account, role string) string {
 	return fmt.Sprintf(testDataprocIamJobConfig+`
 resource "google_service_account" "test-account" {
   account_id   = "%s"
@@ -198,10 +210,10 @@ resource "google_dataproc_job_iam_member" "member" {
   role   = "%s"
   member = "serviceAccount:${google_service_account.test-account.email}"
 }
-`, cluster, job, account, role)
+`, cluster, subnetworkName, job, account, role)
 }
 
-func testAccDataprocJobIamPolicy(cluster, job, account, role string) string {
+func testAccDataprocJobIamPolicy(cluster, subnetworkName, job, account, role string) string {
 	return fmt.Sprintf(testDataprocIamJobConfig+`
 resource "google_service_account" "test-account" {
   account_id   = "%s"
@@ -226,5 +238,5 @@ data "google_dataproc_job_iam_policy" "policy" {
   region      = "us-central1"
 }
 
-`, cluster, job, account, role)
+`, cluster, subnetworkName, job, account, role)
 }
diff --git a/mmv1/third_party/terraform/services/dataproc/resource_dataproc_cluster.go.erb b/mmv1/third_party/terraform/services/dataproc/resource_dataproc_cluster.go
similarity index 77%
rename from mmv1/third_party/terraform/services/dataproc/resource_dataproc_cluster.go.erb
rename to mmv1/third_party/terraform/services/dataproc/resource_dataproc_cluster.go
index 39c8bd221972..210e77b9b791 100644
--- a/mmv1/third_party/terraform/services/dataproc/resource_dataproc_cluster.go.erb
+++ b/mmv1/third_party/terraform/services/dataproc/resource_dataproc_cluster.go
@@ -1,4 +1,3 @@
-<% autogen_exception -%>
 package dataproc
 
 import (
@@ -10,6 +9,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 
@@ -116,7 +116,8 @@ var (
 	}
 )
 
-const resourceDataprocGoogleProvidedLabelPrefix = "labels.goog-dataproc"
+const resourceDataprocGoogleLabelPrefix = "goog-dataproc"
+const resourceDataprocGoogleProvidedLabelPrefix = "labels." + resourceDataprocGoogleLabelPrefix
 
 func resourceDataprocLabelDiffSuppress(k, old, new string, d *schema.ResourceData) bool {
 	if strings.HasPrefix(k, resourceDataprocGoogleProvidedLabelPrefix) && new == "" {
@@ -162,6 +163,20 @@ func ResourceDataprocCluster() *schema.Resource {
 			Delete: schema.DefaultTimeout(45 * time.Minute),
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+			tpgresource.SetLabelsDiff,
+		),
+
+		SchemaVersion: 1,
+		StateUpgraders: []schema.StateUpgrader{
+			{
+				Type:    resourceDataprocClusterResourceV0().CoreConfigSchema().ImpliedType(),
+				Upgrade: ResourceDataprocClusterStateUpgradeV0,
+				Version: 0,
+			},
+		},
+
 		Schema: map[string]*schema.Schema{
 			"name": {
 				Type:        schema.TypeString,
@@ -218,10 +233,24 @@ func ResourceDataprocCluster() *schema.Resource {
 				Type:     schema.TypeMap,
 				Optional: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
-				// GCP automatically adds labels
-				DiffSuppressFunc: resourceDataprocLabelDiffSuppress,
+				Description: `The list of the labels (key/value pairs) configured on the resource and to be applied to instances in the cluster.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+			},
+
+			"terraform_labels": {
+				Type:        schema.TypeMap,
 				Computed:    true,
-				Description: `The list of labels (key/value pairs) to be applied to instances in the cluster. GCP generates some itself including goog-dataproc-cluster-name which is the name of the cluster.`,
+				Description: `The combination of labels configured directly on the resource and default labels configured on the provider.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+			},
+
+			"effective_labels": {
+				Type:        schema.TypeMap,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+				Computed:    true,
+				Description: `All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.`,
 			},
 
 			"virtual_cluster_config": {
@@ -696,10 +725,10 @@ func ResourceDataprocCluster() *schema.Resource {
 										Elem: &schema.Resource{
 											Schema: map[string]*schema.Schema{
 												"node_group_uri": {
-													Type:         schema.TypeString,
-													ForceNew:     true,
-													Required:     true,
-													Description:  `The URI of a sole-tenant that the cluster will be created on.`,
+													Type:             schema.TypeString,
+													ForceNew:         true,
+													Required:         true,
+													Description:      `The URI of a sole-tenant that the cluster will be created on.`,
 													DiffSuppressFunc: tpgresource.CompareSelfLinkOrResourceName,
 												},
 											},
@@ -709,8 +738,316 @@ func ResourceDataprocCluster() *schema.Resource {
 							},
 						},
 
-						"master_config": instanceConfigSchema("master_config"),
-						"worker_config": instanceConfigSchema("worker_config"),
+						"master_config": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							AtLeastOneOf: clusterConfigKeys,
+							Computed:     true,
+							MaxItems:     1,
+							Description:  `The Compute Engine config settings for the cluster's master instance.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"num_instances": {
+										Type:        schema.TypeInt,
+										Optional:    true,
+										ForceNew:    true,
+										Computed:    true,
+										Description: `Specifies the number of master nodes to create. If not specified, GCP will default to a predetermined computed value.`,
+										AtLeastOneOf: []string{
+											"cluster_config.0.master_config.0.num_instances",
+											"cluster_config.0.master_config.0.image_uri",
+											"cluster_config.0.master_config.0.machine_type",
+											"cluster_config.0.master_config.0.accelerators",
+										},
+									},
+
+									"image_uri": {
+										Type:     schema.TypeString,
+										Optional: true,
+										Computed: true,
+										AtLeastOneOf: []string{
+											"cluster_config.0.master_config.0.num_instances",
+											"cluster_config.0.master_config.0.image_uri",
+											"cluster_config.0.master_config.0.machine_type",
+											"cluster_config.0.master_config.0.accelerators",
+										},
+										ForceNew:    true,
+										Description: `The URI for the image to use for this master`,
+									},
+
+									"machine_type": {
+										Type:     schema.TypeString,
+										Optional: true,
+										Computed: true,
+										AtLeastOneOf: []string{
+											"cluster_config.0.master_config.0.num_instances",
+											"cluster_config.0.master_config.0.image_uri",
+											"cluster_config.0.master_config.0.machine_type",
+											"cluster_config.0.master_config.0.accelerators",
+										},
+										ForceNew:    true,
+										Description: `The name of a Google Compute Engine machine type to create for the master`,
+									},
+
+									"min_cpu_platform": {
+										Type:     schema.TypeString,
+										Optional: true,
+										Computed: true,
+										AtLeastOneOf: []string{
+											"cluster_config.0.master_config.0.num_instances",
+											"cluster_config.0.master_config.0.image_uri",
+											"cluster_config.0.master_config.0.machine_type",
+											"cluster_config.0.master_config.0.accelerators",
+										},
+										ForceNew:    true,
+										Description: `The name of a minimum generation of CPU family for the master. If not specified, GCP will default to a predetermined computed value for each zone.`,
+									},
+									"disk_config": {
+										Type:     schema.TypeList,
+										Optional: true,
+										Computed: true,
+										AtLeastOneOf: []string{
+											"cluster_config.0.master_config.0.num_instances",
+											"cluster_config.0.master_config.0.image_uri",
+											"cluster_config.0.master_config.0.machine_type",
+											"cluster_config.0.master_config.0.accelerators",
+											"cluster_config.0.master_config.0.disk_config",
+										},
+										MaxItems:    1,
+										Description: `Disk Config`,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"num_local_ssds": {
+													Type:        schema.TypeInt,
+													Optional:    true,
+													Computed:    true,
+													Description: `The amount of local SSD disks that will be attached to each master cluster node. Defaults to 0.`,
+													AtLeastOneOf: []string{
+														"cluster_config.0.master_config.0.disk_config.0.num_local_ssds",
+														"cluster_config.0.master_config.0.disk_config.0.boot_disk_size_gb",
+														"cluster_config.0.master_config.0.disk_config.0.boot_disk_type",
+													},
+													ForceNew: true,
+												},
+
+												"boot_disk_size_gb": {
+													Type:        schema.TypeInt,
+													Optional:    true,
+													Computed:    true,
+													Description: `Size of the primary disk attached to each node, specified in GB. The primary disk contains the boot volume and system libraries, and the smallest allowed disk size is 10GB. GCP will default to a predetermined computed value if not set (currently 500GB). Note: If SSDs are not attached, it also contains the HDFS data blocks and Hadoop working directories.`,
+													AtLeastOneOf: []string{
+														"cluster_config.0.master_config.0.disk_config.0.num_local_ssds",
+														"cluster_config.0.master_config.0.disk_config.0.boot_disk_size_gb",
+														"cluster_config.0.master_config.0.disk_config.0.boot_disk_type",
+													},
+													ForceNew:     true,
+													ValidateFunc: validation.IntAtLeast(10),
+												},
+
+												"boot_disk_type": {
+													Type:        schema.TypeString,
+													Optional:    true,
+													Description: `The disk type of the primary disk attached to each node. Such as "pd-ssd" or "pd-standard". Defaults to "pd-standard".`,
+													AtLeastOneOf: []string{
+														"cluster_config.0.master_config.0.disk_config.0.num_local_ssds",
+														"cluster_config.0.master_config.0.disk_config.0.boot_disk_size_gb",
+														"cluster_config.0.master_config.0.disk_config.0.boot_disk_type",
+													},
+													ForceNew: true,
+													Default:  "pd-standard",
+												},
+											},
+										},
+									},
+									"accelerators": {
+										Type:     schema.TypeSet,
+										Optional: true,
+										AtLeastOneOf: []string{
+											"cluster_config.0.master_config.0.num_instances",
+											"cluster_config.0.master_config.0.image_uri",
+											"cluster_config.0.master_config.0.machine_type",
+											"cluster_config.0.master_config.0.accelerators",
+										},
+										ForceNew:    true,
+										Elem:        acceleratorsSchema(),
+										Description: `The Compute Engine accelerator (GPU) configuration for these instances. Can be specified multiple times.`,
+									},
+
+									"instance_names": {
+										Type:        schema.TypeList,
+										Computed:    true,
+										Elem:        &schema.Schema{Type: schema.TypeString},
+										Description: `List of master instance names which have been assigned to the cluster.`,
+									},
+								},
+							},
+						},
+						"worker_config": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							AtLeastOneOf: clusterConfigKeys,
+							Computed:     true,
+							MaxItems:     1,
+							Description:  `The Compute Engine config settings for the cluster's worker instances.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"num_instances": {
+										Type:        schema.TypeInt,
+										Optional:    true,
+										ForceNew:    false,
+										Computed:    true,
+										Description: `Specifies the number of worker nodes to create. If not specified, GCP will default to a predetermined computed value.`,
+										AtLeastOneOf: []string{
+											"cluster_config.0.worker_config.0.num_instances",
+											"cluster_config.0.worker_config.0.image_uri",
+											"cluster_config.0.worker_config.0.machine_type",
+											"cluster_config.0.worker_config.0.accelerators",
+											"cluster_config.0.worker_config.0.min_num_instances",
+										},
+									},
+
+									"image_uri": {
+										Type:     schema.TypeString,
+										Optional: true,
+										Computed: true,
+										AtLeastOneOf: []string{
+											"cluster_config.0.worker_config.0.num_instances",
+											"cluster_config.0.worker_config.0.image_uri",
+											"cluster_config.0.worker_config.0.machine_type",
+											"cluster_config.0.worker_config.0.accelerators",
+											"cluster_config.0.worker_config.0.min_num_instances",
+										},
+										ForceNew:    true,
+										Description: `The URI for the image to use for this master/worker`,
+									},
+
+									"machine_type": {
+										Type:     schema.TypeString,
+										Optional: true,
+										Computed: true,
+										AtLeastOneOf: []string{
+											"cluster_config.0.worker_config.0.num_instances",
+											"cluster_config.0.worker_config.0.image_uri",
+											"cluster_config.0.worker_config.0.machine_type",
+											"cluster_config.0.worker_config.0.accelerators",
+											"cluster_config.0.worker_config.0.min_num_instances",
+										},
+										ForceNew:    true,
+										Description: `The name of a Google Compute Engine machine type to create for the master/worker`,
+									},
+
+									"min_cpu_platform": {
+										Type:     schema.TypeString,
+										Optional: true,
+										Computed: true,
+										AtLeastOneOf: []string{
+											"cluster_config.0.worker_config.0.num_instances",
+											"cluster_config.0.worker_config.0.image_uri",
+											"cluster_config.0.worker_config.0.machine_type",
+											"cluster_config.0.worker_config.0.accelerators",
+											"cluster_config.0.worker_config.0.min_num_instances",
+										},
+										ForceNew:    true,
+										Description: `The name of a minimum generation of CPU family for the master/worker. If not specified, GCP will default to a predetermined computed value for each zone.`,
+									},
+									"disk_config": {
+										Type:     schema.TypeList,
+										Optional: true,
+										Computed: true,
+										AtLeastOneOf: []string{
+											"cluster_config.0.worker_config.0.num_instances",
+											"cluster_config.0.worker_config.0.image_uri",
+											"cluster_config.0.worker_config.0.machine_type",
+											"cluster_config.0.worker_config.0.accelerators",
+											"cluster_config.0.worker_config.0.min_num_instances",
+											"cluster_config.0.worker_config.0.disk_config",
+										},
+										MaxItems:    1,
+										Description: `Disk Config`,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"num_local_ssds": {
+													Type:        schema.TypeInt,
+													Optional:    true,
+													Computed:    true,
+													Description: `The amount of local SSD disks that will be attached to each master cluster node. Defaults to 0.`,
+													AtLeastOneOf: []string{
+														"cluster_config.0.worker_config.0.disk_config.0.num_local_ssds",
+														"cluster_config.0.worker_config.0.disk_config.0.boot_disk_size_gb",
+														"cluster_config.0.worker_config.0.disk_config.0.boot_disk_type",
+													},
+													ForceNew: true,
+												},
+
+												"boot_disk_size_gb": {
+													Type:        schema.TypeInt,
+													Optional:    true,
+													Computed:    true,
+													Description: `Size of the primary disk attached to each node, specified in GB. The primary disk contains the boot volume and system libraries, and the smallest allowed disk size is 10GB. GCP will default to a predetermined computed value if not set (currently 500GB). Note: If SSDs are not attached, it also contains the HDFS data blocks and Hadoop working directories.`,
+													AtLeastOneOf: []string{
+														"cluster_config.0.worker_config.0.disk_config.0.num_local_ssds",
+														"cluster_config.0.worker_config.0.disk_config.0.boot_disk_size_gb",
+														"cluster_config.0.worker_config.0.disk_config.0.boot_disk_type",
+													},
+													ForceNew:     true,
+													ValidateFunc: validation.IntAtLeast(10),
+												},
+
+												"boot_disk_type": {
+													Type:        schema.TypeString,
+													Optional:    true,
+													Description: `The disk type of the primary disk attached to each node. Such as "pd-ssd" or "pd-standard". Defaults to "pd-standard".`,
+													AtLeastOneOf: []string{
+														"cluster_config.0.worker_config.0.disk_config.0.num_local_ssds",
+														"cluster_config.0.worker_config.0.disk_config.0.boot_disk_size_gb",
+														"cluster_config.0.worker_config.0.disk_config.0.boot_disk_type",
+													},
+													ForceNew: true,
+													Default:  "pd-standard",
+												},
+											},
+										},
+									},
+
+									// Note: preemptible workers don't support accelerators
+									"accelerators": {
+										Type:     schema.TypeSet,
+										Optional: true,
+										AtLeastOneOf: []string{
+											"cluster_config.0.worker_config.0.num_instances",
+											"cluster_config.0.worker_config.0.image_uri",
+											"cluster_config.0.worker_config.0.machine_type",
+											"cluster_config.0.worker_config.0.accelerators",
+											"cluster_config.0.worker_config.0.min_num_instances",
+										},
+										ForceNew:    true,
+										Elem:        acceleratorsSchema(),
+										Description: `The Compute Engine accelerator (GPU) configuration for these instances. Can be specified multiple times.`,
+									},
+
+									"instance_names": {
+										Type:        schema.TypeList,
+										Computed:    true,
+										Elem:        &schema.Schema{Type: schema.TypeString},
+										Description: `List of master/worker instance names which have been assigned to the cluster.`,
+									},
+									"min_num_instances": {
+										Type:     schema.TypeInt,
+										Optional: true,
+										Computed: true,
+										ForceNew: false,
+										AtLeastOneOf: []string{
+											"cluster_config.0.worker_config.0.num_instances",
+											"cluster_config.0.worker_config.0.image_uri",
+											"cluster_config.0.worker_config.0.machine_type",
+											"cluster_config.0.worker_config.0.accelerators",
+											"cluster_config.0.worker_config.0.min_num_instances",
+										},
+										Description: `The minimum number of primary worker instances to create.`,
+									},
+								},
+							},
+						},
 						// preemptible_worker_config has a slightly different config
 						"preemptible_worker_config": {
 							Type:         schema.TypeList,
@@ -738,8 +1075,8 @@ func ResourceDataprocCluster() *schema.Resource {
 									// "machine_type": { ... }
 									// "min_cpu_platform": { ... }
 									"preemptibility": {
-										Type:		 schema.TypeString,
-										Optional: 	 true,
+										Type:        schema.TypeString,
+										Optional:    true,
 										Description: `Specifies the preemptibility of the secondary nodes. Defaults to PREEMPTIBLE.`,
 										AtLeastOneOf: []string{
 											"cluster_config.0.preemptible_worker_config.0.num_instances",
@@ -802,6 +1139,74 @@ func ResourceDataprocCluster() *schema.Resource {
 										Elem:        &schema.Schema{Type: schema.TypeString},
 										Description: `List of preemptible instance names which have been assigned to the cluster.`,
 									},
+									"instance_flexibility_policy": {
+										Type:        schema.TypeList,
+										Optional:    true,
+										Computed:    true,
+										Description: `Instance flexibility Policy allowing a mixture of VM shapes and provisioning models.`,
+										AtLeastOneOf: []string{
+											"cluster_config.0.preemptible_worker_config.0.num_instances",
+											"cluster_config.0.preemptible_worker_config.0.preemptibility",
+											"cluster_config.0.preemptible_worker_config.0.disk_config",
+											"cluster_config.0.preemptible_worker_config.0.instance_flexibility_policy",
+										},
+										MaxItems: 1,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"instance_selection_list": {
+													Type:     schema.TypeList,
+													Computed: true,
+													Optional: true,
+													ForceNew: true,
+													AtLeastOneOf: []string{
+														"cluster_config.0.preemptible_worker_config.0.instance_flexibility_policy.0.instance_selection_list",
+													},
+													Description: `List of instance selection options that the group will use when creating new VMs.`,
+													Elem: &schema.Resource{
+														Schema: map[string]*schema.Schema{
+															"machine_types": {
+																Type:        schema.TypeList,
+																Computed:    true,
+																Optional:    true,
+																ForceNew:    true,
+																Elem:        &schema.Schema{Type: schema.TypeString},
+																Description: `Full machine-type names, e.g. "n1-standard-16".`,
+															},
+															"rank": {
+																Type:        schema.TypeInt,
+																Computed:    true,
+																Optional:    true,
+																ForceNew:    true,
+																Elem:        &schema.Schema{Type: schema.TypeInt},
+																Description: `Preference of this instance selection. Lower number means higher preference. Dataproc will first try to create a VM based on the machine-type with priority rank and fallback to next rank based on availability. Machine types and instance selections with the same priority have the same preference.`,
+															},
+														},
+													},
+												},
+												"instance_selection_results": {
+													Type:        schema.TypeList,
+													Computed:    true,
+													Description: `A list of instance selection results in the group.`,
+													Elem: &schema.Resource{
+														Schema: map[string]*schema.Schema{
+															"machine_type": {
+																Type:        schema.TypeString,
+																Computed:    true,
+																Elem:        &schema.Schema{Type: schema.TypeString},
+																Description: `Full machine-type names, e.g. "n1-standard-16".`,
+															},
+															"vm_count": {
+																Type:        schema.TypeInt,
+																Computed:    true,
+																Elem:        &schema.Schema{Type: schema.TypeInt},
+																Description: `Number of VM provisioned with the machine_type.`,
+															},
+														},
+													},
+												},
+											},
+										},
+									},
 								},
 							},
 						},
@@ -1020,22 +1425,22 @@ by Dataproc`,
 							},
 						},
 						"metastore_config": {
-							Type:             schema.TypeList,
-							Optional:         true,
-							AtLeastOneOf:     clusterConfigKeys,
-							MaxItems:         1,
-							Description:      `Specifies a Metastore configuration.`,
+							Type:         schema.TypeList,
+							Optional:     true,
+							AtLeastOneOf: clusterConfigKeys,
+							MaxItems:     1,
+							Description:  `Specifies a Metastore configuration.`,
 							Elem: &schema.Resource{
 								Schema: map[string]*schema.Schema{
 									"dataproc_metastore_service": {
-										Type:             schema.TypeString,
-										Required:         true,
-										ForceNew:         true,
-										Description:      `Resource name of an existing Dataproc Metastore service.`,
+										Type:        schema.TypeString,
+										Required:    true,
+										ForceNew:    true,
+										Description: `Resource name of an existing Dataproc Metastore service.`,
 									},
 								},
 							},
-						},						
+						},
 						"lifecycle_config": {
 							Type:         schema.TypeList,
 							Optional:     true,
@@ -1100,18 +1505,18 @@ by Dataproc`,
 						},
 
 						"dataproc_metric_config": {
-							Type:        schema.TypeList,
-							Optional:    true,
-							MaxItems:    1,
-							Description: `The config for Dataproc metrics.`,
+							Type:         schema.TypeList,
+							Optional:     true,
+							MaxItems:     1,
+							Description:  `The config for Dataproc metrics.`,
 							AtLeastOneOf: clusterConfigKeys,
 							Elem: &schema.Resource{
 								Schema: map[string]*schema.Schema{
 									"metrics": {
-										Type:         schema.TypeList,
-										Required:     true,
-										Description:  `Metrics sources to enable.`,
-										Elem:         metricsSchema(),
+										Type:        schema.TypeList,
+										Required:    true,
+										Description: `Metrics sources to enable.`,
+										Elem:        metricsSchema(),
 									},
 								},
 							},
@@ -1126,7 +1531,7 @@ by Dataproc`,
 
 // We need to pull metrics' schema out so we can use it to make a set hash func
 func metricsSchema() *schema.Resource {
-	return  &schema.Resource{
+	return &schema.Resource{
 		Schema: map[string]*schema.Schema{
 			"metric_source": {
 				Type:         schema.TypeString,
@@ -1136,140 +1541,11 @@ func metricsSchema() *schema.Resource {
 				Description:  `A source for the collection of Dataproc OSS metrics (see [available OSS metrics] (https://cloud.google.com//dataproc/docs/guides/monitoring#available_oss_metrics)).`,
 			},
 			"metric_overrides": {
-				Type:         schema.TypeSet,
-				Elem:         &schema.Schema{Type: schema.TypeString},
-				Optional:     true,
-				ForceNew:     true,
-				Description:  `Specify one or more [available OSS metrics] (https://cloud.google.com/dataproc/docs/guides/monitoring#available_oss_metrics) to collect.`,
-			},
-		},
-	}
-}
-
-func instanceConfigSchema(parent string) *schema.Schema {
-	var instanceConfigKeys = []string{
-		"cluster_config.0." + parent + ".0.num_instances",
-		"cluster_config.0." + parent + ".0.image_uri",
-		"cluster_config.0." + parent + ".0.machine_type",
-		"cluster_config.0." + parent + ".0.min_cpu_platform",
-		"cluster_config.0." + parent + ".0.disk_config",
-		"cluster_config.0." + parent + ".0.accelerators",
-	}
-
-	masterConfig := strings.Contains(parent, "master")
-
-	return &schema.Schema{
-		Type:         schema.TypeList,
-		Optional:     true,
-		Computed:     true,
-		AtLeastOneOf: clusterConfigKeys,
-		MaxItems:     1,
-		Description:  `The Google Compute Engine config settings for the master/worker instances in a cluster.`,
-		Elem: &schema.Resource{
-			Schema: map[string]*schema.Schema{
-				"num_instances": {
-					Type:         schema.TypeInt,
-					Optional:     true,
-					ForceNew:     masterConfig,
-					Computed:     true,
-					Description:  `Specifies the number of master/worker nodes to create. If not specified, GCP will default to a predetermined computed value.`,
-					AtLeastOneOf: instanceConfigKeys,
-				},
-
-				"image_uri": {
-					Type:         schema.TypeString,
-					Optional:     true,
-					Computed:     true,
-					AtLeastOneOf: instanceConfigKeys,
-					ForceNew:     true,
-					Description:  `The URI for the image to use for this master/worker`,
-				},
-
-				"machine_type": {
-					Type:         schema.TypeString,
-					Optional:     true,
-					Computed:     true,
-					AtLeastOneOf: instanceConfigKeys,
-					ForceNew:     true,
-					Description:  `The name of a Google Compute Engine machine type to create for the master/worker`,
-				},
-
-				"min_cpu_platform": {
-					Type:         schema.TypeString,
-					Optional:     true,
-					Computed:     true,
-					AtLeastOneOf: instanceConfigKeys,
-					ForceNew:     true,
-					Description:  `The name of a minimum generation of CPU family for the master/worker. If not specified, GCP will default to a predetermined computed value for each zone.`,
-				},
-				"disk_config": {
-					Type:         schema.TypeList,
-					Optional:     true,
-					Computed:     true,
-					AtLeastOneOf: instanceConfigKeys,
-					MaxItems:     1,
-					Description:  `Disk Config`,
-					Elem: &schema.Resource{
-						Schema: map[string]*schema.Schema{
-							"num_local_ssds": {
-								Type:        schema.TypeInt,
-								Optional:    true,
-								Computed:    true,
-								Description: `The amount of local SSD disks that will be attached to each master cluster node. Defaults to 0.`,
-								AtLeastOneOf: []string{
-									"cluster_config.0." + parent + ".0.disk_config.0.num_local_ssds",
-									"cluster_config.0." + parent + ".0.disk_config.0.boot_disk_size_gb",
-									"cluster_config.0." + parent + ".0.disk_config.0.boot_disk_type",
-								},
-								ForceNew: true,
-							},
-
-							"boot_disk_size_gb": {
-								Type:        schema.TypeInt,
-								Optional:    true,
-								Computed:    true,
-								Description: `Size of the primary disk attached to each node, specified in GB. The primary disk contains the boot volume and system libraries, and the smallest allowed disk size is 10GB. GCP will default to a predetermined computed value if not set (currently 500GB). Note: If SSDs are not attached, it also contains the HDFS data blocks and Hadoop working directories.`,
-								AtLeastOneOf: []string{
-									"cluster_config.0." + parent + ".0.disk_config.0.num_local_ssds",
-									"cluster_config.0." + parent + ".0.disk_config.0.boot_disk_size_gb",
-									"cluster_config.0." + parent + ".0.disk_config.0.boot_disk_type",
-								},
-								ForceNew:     true,
-								ValidateFunc: validation.IntAtLeast(10),
-							},
-
-							"boot_disk_type": {
-								Type:        schema.TypeString,
-								Optional:    true,
-								Description: `The disk type of the primary disk attached to each node. Such as "pd-ssd" or "pd-standard". Defaults to "pd-standard".`,
-								AtLeastOneOf: []string{
-									"cluster_config.0." + parent + ".0.disk_config.0.num_local_ssds",
-									"cluster_config.0." + parent + ".0.disk_config.0.boot_disk_size_gb",
-									"cluster_config.0." + parent + ".0.disk_config.0.boot_disk_type",
-								},
-								ForceNew:     true,
-								Default:      "pd-standard",
-							},
-						},
-					},
-				},
-
-				// Note: preemptible workers don't support accelerators
-				"accelerators": {
-					Type:         schema.TypeSet,
-					Optional:     true,
-					AtLeastOneOf: instanceConfigKeys,
-					ForceNew:     true,
-					Elem:         acceleratorsSchema(),
-					Description:  `The Compute Engine accelerator (GPU) configuration for these instances. Can be specified multiple times.`,
-				},
-
-				"instance_names": {
-					Type:        schema.TypeList,
-					Computed:    true,
-					Elem:        &schema.Schema{Type: schema.TypeString},
-					Description: `List of master/worker instance names which have been assigned to the cluster.`,
-				},
+				Type:        schema.TypeSet,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+				Optional:    true,
+				ForceNew:    true,
+				Description: `Specify one or more [available OSS metrics] (https://cloud.google.com/dataproc/docs/guides/monitoring#available_oss_metrics) to collect.`,
 			},
 		},
 	}
@@ -1298,7 +1574,7 @@ func acceleratorsSchema() *schema.Resource {
 
 func resourceDataprocClusterCreate(d *schema.ResourceData, meta interface{}) error {
 	config := meta.(*transport_tpg.Config)
-	userAgent, err :=  tpgresource.GenerateUserAgentString(d, config.UserAgent)
+	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
 	if err != nil {
 		return err
 	}
@@ -1324,8 +1600,8 @@ func resourceDataprocClusterCreate(d *schema.ResourceData, meta interface{}) err
 		return err
 	}
 
-	if _, ok := d.GetOk("labels"); ok {
-		cluster.Labels = tpgresource.ExpandLabels(d)
+	if _, ok := d.GetOk("effective_labels"); ok {
+		cluster.Labels = tpgresource.ExpandEffectiveLabels(d)
 	}
 
 	// Checking here caters for the case where the user does not specify cluster_config
@@ -1605,12 +1881,12 @@ func expandClusterConfig(d *schema.ResourceData, config *transport_tpg.Config) (
 
 	if cfg, ok := configOptions(d, "cluster_config.0.master_config"); ok {
 		log.Println("[INFO] got master_config")
-		conf.MasterConfig = expandInstanceGroupConfig(cfg)
+		conf.MasterConfig = expandMasterInstanceGroupConfig(cfg)
 	}
 
 	if cfg, ok := configOptions(d, "cluster_config.0.worker_config"); ok {
 		log.Println("[INFO] got worker config")
-		conf.WorkerConfig = expandInstanceGroupConfig(cfg)
+		conf.WorkerConfig = expandWorkerInstanceGroupConfig(cfg)
 	}
 
 	if cfg, ok := configOptions(d, "cluster_config.0.preemptible_worker_config"); ok {
@@ -1829,7 +2105,7 @@ func expandDataprocMetricConfig(cfg map[string]interface{}) *dataproc.DataprocMe
 	for _, raw := range metricsConfigs {
 		data := raw.(map[string]interface{})
 		metric := dataproc.Metric{
-			MetricSource: data["metric_source"].(string),
+			MetricSource:    data["metric_source"].(string),
 			MetricOverrides: tpgresource.ConvertStringSet(data["metric_overrides"].(*schema.Set)),
 		}
 		metricsSet = append(metricsSet, &metric)
@@ -1887,13 +2163,47 @@ func expandPreemptibleInstanceGroupConfig(cfg map[string]interface{}) *dataproc.
 			}
 		}
 	}
+
+	if ifpc, ok := cfg["instance_flexibility_policy"]; ok {
+		ifps := ifpc.([]interface{})
+		if len(ifps) > 0 {
+			flexibilityPolicy := ifps[0].(map[string]interface{})
+			icg.InstanceFlexibilityPolicy = &dataproc.InstanceFlexibilityPolicy{}
+			if v, ok := flexibilityPolicy["instance_selection_list"]; ok {
+				icg.InstanceFlexibilityPolicy.InstanceSelectionList = expandInstanceSelectionList(v)
+			}
+		}
+
+	}
 	if p, ok := cfg["preemptibility"]; ok {
 		icg.Preemptibility = p.(string)
 	}
 	return icg
 }
 
-func expandInstanceGroupConfig(cfg map[string]interface{}) *dataproc.InstanceGroupConfig {
+func expandInstanceSelectionList(v interface{}) []*dataproc.InstanceSelection {
+	instanceSelectionList := v.([]interface{})
+
+	instanceSelections := []*dataproc.InstanceSelection{}
+	for _, v1 := range instanceSelectionList {
+		instanceSelectionItem := v1.(map[string]interface{})
+		machineTypes := []string{}
+		for _, machineType := range instanceSelectionItem["machine_types"].([]interface{}) {
+			machineTypes = append(machineTypes, machineType.(string))
+		}
+		instanceSelection := &dataproc.InstanceSelection{
+			MachineTypes: machineTypes,
+		}
+		if x, ok := instanceSelectionItem["rank"]; ok {
+			instanceSelection.Rank = int64(x.(int))
+		}
+		instanceSelections = append(instanceSelections, instanceSelection)
+	}
+
+	return instanceSelections
+}
+
+func expandMasterInstanceGroupConfig(cfg map[string]interface{}) *dataproc.InstanceGroupConfig {
 	icg := &dataproc.InstanceGroupConfig{}
 
 	if v, ok := cfg["num_instances"]; ok {
@@ -1931,6 +2241,47 @@ func expandInstanceGroupConfig(cfg map[string]interface{}) *dataproc.InstanceGro
 	return icg
 }
 
+func expandWorkerInstanceGroupConfig(cfg map[string]interface{}) *dataproc.InstanceGroupConfig {
+	icg := &dataproc.InstanceGroupConfig{}
+
+	if v, ok := cfg["num_instances"]; ok {
+		icg.NumInstances = int64(v.(int))
+	}
+	if v, ok := cfg["machine_type"]; ok {
+		icg.MachineTypeUri = tpgresource.GetResourceNameFromSelfLink(v.(string))
+	}
+	if v, ok := cfg["min_cpu_platform"]; ok {
+		icg.MinCpuPlatform = v.(string)
+	}
+	if v, ok := cfg["min_num_instances"]; ok {
+		icg.MinNumInstances = int64(v.(int))
+	}
+	if v, ok := cfg["image_uri"]; ok {
+		icg.ImageUri = v.(string)
+	}
+
+	if dc, ok := cfg["disk_config"]; ok {
+		d := dc.([]interface{})
+		if len(d) > 0 {
+			dcfg := d[0].(map[string]interface{})
+			icg.DiskConfig = &dataproc.DiskConfig{}
+
+			if v, ok := dcfg["boot_disk_size_gb"]; ok {
+				icg.DiskConfig.BootDiskSizeGb = int64(v.(int))
+			}
+			if v, ok := dcfg["num_local_ssds"]; ok {
+				icg.DiskConfig.NumLocalSsds = int64(v.(int))
+			}
+			if v, ok := dcfg["boot_disk_type"]; ok {
+				icg.DiskConfig.BootDiskType = v.(string)
+			}
+		}
+	}
+
+	icg.Accelerators = expandAccelerators(cfg["accelerators"].(*schema.Set).List())
+	return icg
+}
+
 func expandAccelerators(configured []interface{}) []*dataproc.AcceleratorConfig {
 	accelerators := make([]*dataproc.AcceleratorConfig, 0, len(configured))
 	for _, raw := range configured {
@@ -1948,7 +2299,7 @@ func expandAccelerators(configured []interface{}) []*dataproc.AcceleratorConfig
 
 func resourceDataprocClusterUpdate(d *schema.ResourceData, meta interface{}) error {
 	config := meta.(*transport_tpg.Config)
-	userAgent, err :=  tpgresource.GenerateUserAgentString(d, config.UserAgent)
+	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
 	if err != nil {
 		return err
 	}
@@ -1969,8 +2320,8 @@ func resourceDataprocClusterUpdate(d *schema.ResourceData, meta interface{}) err
 
 	updMask := []string{}
 
-	if d.HasChange("labels") {
-		v := d.Get("labels")
+	if d.HasChange("effective_labels") {
+		v := d.Get("effective_labels")
 		m := make(map[string]string)
 		for k, val := range v.(map[string]interface{}) {
 			m[k] = val.(string)
@@ -2055,7 +2406,7 @@ func resourceDataprocClusterUpdate(d *schema.ResourceData, meta interface{}) err
 
 func resourceDataprocClusterRead(d *schema.ResourceData, meta interface{}) error {
 	config := meta.(*transport_tpg.Config)
-	userAgent, err :=  tpgresource.GenerateUserAgentString(d, config.UserAgent)
+	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
 	if err != nil {
 		return err
 	}
@@ -2083,10 +2434,19 @@ func resourceDataprocClusterRead(d *schema.ResourceData, meta interface{}) error
 	if err := d.Set("region", region); err != nil {
 		return fmt.Errorf("Error setting region: %s", err)
 	}
-	if err := d.Set("labels", cluster.Labels); err != nil {
+
+	if err := tpgresource.SetLabels(cluster.Labels, d, "labels"); err != nil {
 		return fmt.Errorf("Error setting labels: %s", err)
 	}
 
+	if err := tpgresource.SetLabels(cluster.Labels, d, "terraform_labels"); err != nil {
+		return fmt.Errorf("Error setting terraform_labels: %s", err)
+	}
+
+	if err := d.Set("effective_labels", cluster.Labels); err != nil {
+		return fmt.Errorf("Error setting effective_labels: %s", err)
+	}
+
 	var cfg []map[string]interface{}
 	cfg, err = flattenClusterConfig(d, cluster.Config)
 
@@ -2241,8 +2601,8 @@ func flattenClusterConfig(d *schema.ResourceData, cfg *dataproc.ClusterConfig) (
 		"bucket":                    cfg.ConfigBucket,
 		"temp_bucket":               cfg.TempBucket,
 		"gce_cluster_config":        flattenGceClusterConfig(d, cfg.GceClusterConfig),
-		"master_config":             flattenInstanceGroupConfig(d, cfg.MasterConfig),
-		"worker_config":             flattenInstanceGroupConfig(d, cfg.WorkerConfig),
+		"master_config":             flattenMasterInstanceGroupConfig(d, cfg.MasterConfig),
+		"worker_config":             flattenWorkerInstanceGroupConfig(d, cfg.WorkerConfig),
 		"software_config":           flattenSoftwareConfig(d, cfg.SoftwareConfig),
 		"encryption_config":         flattenEncryptionConfig(d, cfg.EncryptionConfig),
 		"autoscaling_config":        flattenAutoscalingConfig(d, cfg.AutoscalingConfig),
@@ -2367,7 +2727,7 @@ func flattenDataprocMetricConfig(d *schema.ResourceData, dmc *dataproc.DataprocM
 	metricsTypeList := schema.NewSet(schema.HashResource(metricsSchema()), []interface{}{}).List()
 	for _, metric := range dmc.Metrics {
 		data := map[string]interface{}{
-			"metric_source":  metric.MetricSource,
+			"metric_source":    metric.MetricSource,
 			"metric_overrides": metric.MetricOverrides,
 		}
 
@@ -2459,16 +2819,16 @@ func flattenGceClusterConfig(d *schema.ResourceData, gcc *dataproc.GceClusterCon
 	if gcc.ReservationAffinity != nil {
 		gceConfig["reservation_affinity"] = []map[string]interface{}{
 			{
-				"consume_reservation_type":    gcc.ReservationAffinity.ConsumeReservationType,
-				"key":                         gcc.ReservationAffinity.Key,
-				"values":                      gcc.ReservationAffinity.Values,
+				"consume_reservation_type": gcc.ReservationAffinity.ConsumeReservationType,
+				"key":                      gcc.ReservationAffinity.Key,
+				"values":                   gcc.ReservationAffinity.Values,
 			},
 		}
 	}
 	if gcc.NodeGroupAffinity != nil {
 		gceConfig["node_group_affinity"] = []map[string]interface{}{
 			{
-				"node_group_uri":    gcc.NodeGroupAffinity.NodeGroupUri,
+				"node_group_uri": gcc.NodeGroupAffinity.NodeGroupUri,
 			},
 		}
 	}
@@ -2494,6 +2854,7 @@ func flattenPreemptibleInstanceGroupConfig(d *schema.ResourceData, icg *dataproc
 	}
 
 	disk := map[string]interface{}{}
+	instanceFlexibilityPolicy := map[string]interface{}{}
 	data := map[string]interface{}{}
 
 	if icg != nil {
@@ -2505,13 +2866,69 @@ func flattenPreemptibleInstanceGroupConfig(d *schema.ResourceData, icg *dataproc
 			disk["num_local_ssds"] = icg.DiskConfig.NumLocalSsds
 			disk["boot_disk_type"] = icg.DiskConfig.BootDiskType
 		}
+		if icg.InstanceFlexibilityPolicy != nil {
+			instanceFlexibilityPolicy["instance_selection_list"] = flattenInstanceSelectionList(icg.InstanceFlexibilityPolicy.InstanceSelectionList)
+			instanceFlexibilityPolicy["instance_selection_results"] = flattenInstanceSelectionResults(icg.InstanceFlexibilityPolicy.InstanceSelectionResults)
+		}
+	}
+
+	data["disk_config"] = []map[string]interface{}{disk}
+	data["instance_flexibility_policy"] = []map[string]interface{}{instanceFlexibilityPolicy}
+	return []map[string]interface{}{data}
+}
+
+func flattenInstanceSelectionList(is []*dataproc.InstanceSelection) []map[string]interface{} {
+
+	instanceSelections := []map[string]interface{}{}
+	for _, v := range is {
+		instanceSelection := map[string]interface{}{}
+		if len(v.MachineTypes) > 0 {
+			instanceSelection["machine_types"] = v.MachineTypes
+		}
+		instanceSelection["rank"] = v.Rank
+		instanceSelections = append(instanceSelections, instanceSelection)
+	}
+	return instanceSelections
+
+}
+
+func flattenInstanceSelectionResults(isr []*dataproc.InstanceSelectionResult) []map[string]interface{} {
+
+	instanceSelectionResults := []map[string]interface{}{}
+	for _, v := range isr {
+		instanceSelection := map[string]interface{}{}
+		instanceSelection["machine_type"] = v.MachineType
+		instanceSelection["vm_count"] = v.VmCount
+		instanceSelectionResults = append(instanceSelectionResults, instanceSelection)
+	}
+	return instanceSelectionResults
+
+}
+
+func flattenMasterInstanceGroupConfig(d *schema.ResourceData, icg *dataproc.InstanceGroupConfig) []map[string]interface{} {
+	disk := map[string]interface{}{}
+	data := map[string]interface{}{}
+
+	if icg != nil {
+		data["num_instances"] = icg.NumInstances
+		data["machine_type"] = tpgresource.GetResourceNameFromSelfLink(icg.MachineTypeUri)
+		data["min_cpu_platform"] = icg.MinCpuPlatform
+		data["image_uri"] = icg.ImageUri
+		data["instance_names"] = icg.InstanceNames
+		if icg.DiskConfig != nil {
+			disk["boot_disk_size_gb"] = icg.DiskConfig.BootDiskSizeGb
+			disk["num_local_ssds"] = icg.DiskConfig.NumLocalSsds
+			disk["boot_disk_type"] = icg.DiskConfig.BootDiskType
+		}
+
+		data["accelerators"] = flattenAccelerators(icg.Accelerators)
 	}
 
 	data["disk_config"] = []map[string]interface{}{disk}
 	return []map[string]interface{}{data}
 }
 
-func flattenInstanceGroupConfig(d *schema.ResourceData, icg *dataproc.InstanceGroupConfig) []map[string]interface{} {
+func flattenWorkerInstanceGroupConfig(d *schema.ResourceData, icg *dataproc.InstanceGroupConfig) []map[string]interface{} {
 	disk := map[string]interface{}{}
 	data := map[string]interface{}{}
 
@@ -2519,6 +2936,7 @@ func flattenInstanceGroupConfig(d *schema.ResourceData, icg *dataproc.InstanceGr
 		data["num_instances"] = icg.NumInstances
 		data["machine_type"] = tpgresource.GetResourceNameFromSelfLink(icg.MachineTypeUri)
 		data["min_cpu_platform"] = icg.MinCpuPlatform
+		data["min_num_instances"] = icg.MinNumInstances
 		data["image_uri"] = icg.ImageUri
 		data["instance_names"] = icg.InstanceNames
 		if icg.DiskConfig != nil {
@@ -2544,7 +2962,7 @@ func extractInitTimeout(t string) (int, error) {
 
 func resourceDataprocClusterDelete(d *schema.ResourceData, meta interface{}) error {
 	config := meta.(*transport_tpg.Config)
-	userAgent, err :=  tpgresource.GenerateUserAgentString(d, config.UserAgent)
+	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
 	if err != nil {
 		return err
 	}
diff --git a/mmv1/third_party/terraform/services/dataproc/resource_dataproc_cluster_migrate.go b/mmv1/third_party/terraform/services/dataproc/resource_dataproc_cluster_migrate.go
new file mode 100644
index 000000000000..768d639642b1
--- /dev/null
+++ b/mmv1/third_party/terraform/services/dataproc/resource_dataproc_cluster_migrate.go
@@ -0,0 +1,1356 @@
+package dataproc
+
+import (
+	"context"
+	"fmt"
+	"regexp"
+	"time"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+)
+
+func resourceDataprocClusterResourceV0() *schema.Resource {
+	return &schema.Resource{
+		Schema: map[string]*schema.Schema{
+			"name": {
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: `The name of the cluster, unique within the project and zone.`,
+				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
+					value := v.(string)
+
+					if len(value) > 55 {
+						errors = append(errors, fmt.Errorf(
+							"%q cannot be longer than 55 characters", k))
+					}
+					if !regexp.MustCompile("^[a-z0-9-]+$").MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q can only contain lowercase letters, numbers and hyphens", k))
+					}
+					if !regexp.MustCompile("^[a-z]").MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q must start with a letter", k))
+					}
+					if !regexp.MustCompile("[a-z0-9]$").MatchString(value) {
+						errors = append(errors, fmt.Errorf(
+							"%q must end with a number or a letter", k))
+					}
+					return
+				},
+			},
+
+			"project": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Computed:    true,
+				ForceNew:    true,
+				Description: `The ID of the project in which the cluster will exist. If it is not provided, the provider project is used.`,
+			},
+
+			"region": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Default:     "global",
+				ForceNew:    true,
+				Description: `The region in which the cluster and associated nodes will be created in. Defaults to global.`,
+			},
+
+			"graceful_decommission_timeout": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Default:     "0s",
+				Description: `The timeout duration which allows graceful decomissioning when you change the number of worker nodes directly through a terraform apply`,
+			},
+
+			"labels": {
+				Type:     schema.TypeMap,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				// GCP automatically adds labels
+				DiffSuppressFunc: resourceDataprocLabelDiffSuppress,
+				Computed:         true,
+				Description:      `The list of labels (key/value pairs) to be applied to instances in the cluster. GCP generates some itself including goog-dataproc-cluster-name which is the name of the cluster.`,
+			},
+
+			"virtual_cluster_config": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				Computed:    true,
+				MaxItems:    1,
+				Description: `The virtual cluster config is used when creating a Dataproc cluster that does not directly control the underlying compute resources, for example, when creating a Dataproc-on-GKE cluster. Dataproc may set default values, and values may change when clusters are updated. Exactly one of config or virtualClusterConfig must be specified.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+
+						"staging_bucket": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							AtLeastOneOf: virtualClusterConfigKeys,
+							ForceNew:     true,
+							Description:  `A Cloud Storage bucket used to stage job dependencies, config files, and job driver console output. If you do not specify a staging bucket, Cloud Dataproc will determine a Cloud Storage location (US, ASIA, or EU) for your cluster's staging bucket according to the Compute Engine zone where your cluster is deployed, and then create and manage this project-level, per-location bucket.`,
+						},
+
+						"auxiliary_services_config": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							Computed:     true,
+							MaxItems:     1,
+							AtLeastOneOf: virtualClusterConfigKeys,
+							Description:  `Auxiliary services configuration for a Cluster.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+
+									"metastore_config": {
+										Type:         schema.TypeList,
+										Optional:     true,
+										MaxItems:     1,
+										AtLeastOneOf: auxiliaryServicesConfigKeys,
+										Description:  `The Hive Metastore configuration for this workload.`,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+
+												"dataproc_metastore_service": {
+													Type:         schema.TypeString,
+													Optional:     true,
+													ForceNew:     true,
+													AtLeastOneOf: auxiliaryServicesMetastoreConfigKeys,
+													Description:  `The Hive Metastore configuration for this workload.`,
+												},
+											},
+										},
+									},
+
+									"spark_history_server_config": {
+										Type:         schema.TypeList,
+										Optional:     true,
+										MaxItems:     1,
+										AtLeastOneOf: auxiliaryServicesConfigKeys,
+										Description:  `The Spark History Server configuration for the workload.`,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+
+												"dataproc_cluster": {
+													Type:         schema.TypeString,
+													Optional:     true,
+													ForceNew:     true,
+													AtLeastOneOf: auxiliaryServicesSparkHistoryServerConfigKeys,
+													Description:  `Resource name of an existing Dataproc Cluster to act as a Spark History Server for the workload.`,
+												},
+											},
+										},
+									},
+								},
+							},
+						},
+
+						"kubernetes_cluster_config": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							Computed:     true,
+							MaxItems:     1,
+							AtLeastOneOf: virtualClusterConfigKeys,
+							Description:  `The configuration for running the Dataproc cluster on Kubernetes.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+
+									"kubernetes_namespace": {
+										Type:         schema.TypeString,
+										Optional:     true,
+										ForceNew:     true,
+										AtLeastOneOf: kubernetesClusterConfigKeys,
+										Description:  `A namespace within the Kubernetes cluster to deploy into. If this namespace does not exist, it is created. If it exists, Dataproc verifies that another Dataproc VirtualCluster is not installed into it. If not specified, the name of the Dataproc Cluster is used.`,
+									},
+
+									"kubernetes_software_config": {
+										Type:        schema.TypeList,
+										MaxItems:    1,
+										Required:    true,
+										Description: `The software configuration for this Dataproc cluster running on Kubernetes.`,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+
+												"component_version": {
+													Type:        schema.TypeMap,
+													Required:    true,
+													ForceNew:    true,
+													Elem:        &schema.Schema{Type: schema.TypeString},
+													Description: `The components that should be installed in this Dataproc cluster. The key must be a string from the KubernetesComponent enumeration. The value is the version of the software to be installed.`,
+												},
+
+												"properties": {
+													Type:             schema.TypeMap,
+													Optional:         true,
+													ForceNew:         true,
+													DiffSuppressFunc: resourceDataprocPropertyDiffSuppress,
+													Elem:             &schema.Schema{Type: schema.TypeString},
+													Computed:         true,
+													Description:      `The properties to set on daemon config files. Property keys are specified in prefix:property format, for example spark:spark.kubernetes.container.image.`,
+												},
+											},
+										},
+									},
+
+									"gke_cluster_config": {
+										Type:        schema.TypeList,
+										Required:    true,
+										MaxItems:    1,
+										Description: `The configuration for running the Dataproc cluster on GKE.`,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+
+												"gke_cluster_target": {
+													Type:         schema.TypeString,
+													ForceNew:     true,
+													Optional:     true,
+													AtLeastOneOf: gkeClusterConfigKeys,
+													Description:  `A target GKE cluster to deploy to. It must be in the same project and region as the Dataproc cluster (the GKE cluster can be zonal or regional). Format: 'projects/{project}/locations/{location}/clusters/{cluster_id}'`,
+												},
+
+												"node_pool_target": {
+													Type:         schema.TypeList,
+													Optional:     true,
+													AtLeastOneOf: gkeClusterConfigKeys,
+													MinItems:     1,
+													Description:  `GKE node pools where workloads will be scheduled. At least one node pool must be assigned the DEFAULT GkeNodePoolTarget.Role. If a GkeNodePoolTarget is not specified, Dataproc constructs a DEFAULT GkeNodePoolTarget.`,
+													Elem: &schema.Resource{
+														Schema: map[string]*schema.Schema{
+
+															"node_pool": {
+																Type:        schema.TypeString,
+																ForceNew:    true,
+																Required:    true,
+																Description: `The target GKE node pool. Format: 'projects/{project}/locations/{location}/clusters/{cluster}/nodePools/{nodePool}'`,
+															},
+
+															"roles": {
+																Type:        schema.TypeSet,
+																Elem:        &schema.Schema{Type: schema.TypeString},
+																ForceNew:    true,
+																Required:    true,
+																Description: `The roles associated with the GKE node pool.`,
+															},
+
+															"node_pool_config": {
+																Type:        schema.TypeList,
+																Optional:    true,
+																Computed:    true,
+																MaxItems:    1,
+																Description: `Input only. The configuration for the GKE node pool.`,
+																Elem: &schema.Resource{
+																	Schema: map[string]*schema.Schema{
+
+																		"config": {
+																			Type:        schema.TypeList,
+																			Optional:    true,
+																			Computed:    true,
+																			MaxItems:    1,
+																			Description: `The node pool configuration.`,
+																			Elem: &schema.Resource{
+																				Schema: map[string]*schema.Schema{
+
+																					"machine_type": {
+																						Type:        schema.TypeString,
+																						ForceNew:    true,
+																						Optional:    true,
+																						Description: `The name of a Compute Engine machine type.`,
+																					},
+
+																					"local_ssd_count": {
+																						Type:        schema.TypeInt,
+																						ForceNew:    true,
+																						Optional:    true,
+																						Description: `The minimum number of nodes in the node pool. Must be >= 0 and <= maxNodeCount.`,
+																					},
+
+																					"preemptible": {
+																						Type:        schema.TypeBool,
+																						ForceNew:    true,
+																						Optional:    true,
+																						Description: `Whether the nodes are created as preemptible VM instances. Preemptible nodes cannot be used in a node pool with the CONTROLLER role or in the DEFAULT node pool if the CONTROLLER role is not assigned (the DEFAULT node pool will assume the CONTROLLER role).`,
+																					},
+
+																					"min_cpu_platform": {
+																						Type:        schema.TypeString,
+																						ForceNew:    true,
+																						Optional:    true,
+																						Description: `Minimum CPU platform to be used by this instance. The instance may be scheduled on the specified or a newer CPU platform. Specify the friendly names of CPU platforms, such as "Intel Haswell" or "Intel Sandy Bridge".`,
+																					},
+
+																					"spot": {
+																						Type:        schema.TypeBool,
+																						ForceNew:    true,
+																						Optional:    true,
+																						Description: `Spot flag for enabling Spot VM, which is a rebrand of the existing preemptible flag.`,
+																					},
+																				},
+																			},
+																		},
+
+																		"locations": {
+																			Type:        schema.TypeSet,
+																			Elem:        &schema.Schema{Type: schema.TypeString},
+																			ForceNew:    true,
+																			Required:    true,
+																			Description: `The list of Compute Engine zones where node pool nodes associated with a Dataproc on GKE virtual cluster will be located.`,
+																		},
+
+																		"autoscaling": {
+																			Type:        schema.TypeList,
+																			Optional:    true,
+																			Computed:    true,
+																			MaxItems:    1,
+																			Description: `The autoscaler configuration for this node pool. The autoscaler is enabled only when a valid configuration is present.`,
+																			Elem: &schema.Resource{
+																				Schema: map[string]*schema.Schema{
+
+																					"min_node_count": {
+																						Type:        schema.TypeInt,
+																						ForceNew:    true,
+																						Optional:    true,
+																						Description: `The minimum number of nodes in the node pool. Must be >= 0 and <= maxNodeCount.`,
+																					},
+
+																					"max_node_count": {
+																						Type:        schema.TypeInt,
+																						ForceNew:    true,
+																						Optional:    true,
+																						Description: `The maximum number of nodes in the node pool. Must be >= minNodeCount, and must be > 0.`,
+																					},
+																				},
+																			},
+																		},
+																	},
+																},
+															},
+														},
+													},
+												},
+											},
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+
+			"cluster_config": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				Computed:    true,
+				MaxItems:    1,
+				Description: `Allows you to configure various aspects of the cluster.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+
+						"staging_bucket": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							AtLeastOneOf: clusterConfigKeys,
+							ForceNew:     true,
+							Description:  `The Cloud Storage staging bucket used to stage files, such as Hadoop jars, between client machines and the cluster. Note: If you don't explicitly specify a staging_bucket then GCP will auto create / assign one for you. However, you are not guaranteed an auto generated bucket which is solely dedicated to your cluster; it may be shared with other clusters in the same region/zone also choosing to use the auto generation option.`,
+						},
+						// If the user does not specify a staging bucket, GCP will allocate one automatically.
+						// The staging_bucket field provides a way for the user to supply their own
+						// staging bucket. The bucket field is purely a computed field which details
+						// the definitive bucket allocated and in use (either the user supplied one via
+						// staging_bucket, or the GCP generated one)
+						"bucket": {
+							Type:        schema.TypeString,
+							Computed:    true,
+							Description: ` The name of the cloud storage bucket ultimately used to house the staging data for the cluster. If staging_bucket is specified, it will contain this value, otherwise it will be the auto generated name.`,
+						},
+
+						"temp_bucket": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							Computed:     true,
+							AtLeastOneOf: clusterConfigKeys,
+							ForceNew:     true,
+							Description:  `The Cloud Storage temp bucket used to store ephemeral cluster and jobs data, such as Spark and MapReduce history files. Note: If you don't explicitly specify a temp_bucket then GCP will auto create / assign one for you.`,
+						},
+
+						"gce_cluster_config": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							AtLeastOneOf: clusterConfigKeys,
+							Computed:     true,
+							MaxItems:     1,
+							Description:  `Common config settings for resources of Google Compute Engine cluster instances, applicable to all instances in the cluster.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+
+									"zone": {
+										Type:         schema.TypeString,
+										Optional:     true,
+										Computed:     true,
+										AtLeastOneOf: gceClusterConfigKeys,
+										ForceNew:     true,
+										Description:  `The GCP zone where your data is stored and used (i.e. where the master and the worker nodes will be created in). If region is set to 'global' (default) then zone is mandatory, otherwise GCP is able to make use of Auto Zone Placement to determine this automatically for you. Note: This setting additionally determines and restricts which computing resources are available for use with other configs such as cluster_config.master_config.machine_type and cluster_config.worker_config.machine_type.`,
+									},
+
+									"network": {
+										Type:             schema.TypeString,
+										Optional:         true,
+										Computed:         true,
+										AtLeastOneOf:     gceClusterConfigKeys,
+										ForceNew:         true,
+										ConflictsWith:    []string{"cluster_config.0.gce_cluster_config.0.subnetwork"},
+										DiffSuppressFunc: tpgresource.CompareSelfLinkOrResourceName,
+										Description:      `The name or self_link of the Google Compute Engine network to the cluster will be part of. Conflicts with subnetwork. If neither is specified, this defaults to the "default" network.`,
+									},
+
+									"subnetwork": {
+										Type:             schema.TypeString,
+										Optional:         true,
+										AtLeastOneOf:     gceClusterConfigKeys,
+										ForceNew:         true,
+										ConflictsWith:    []string{"cluster_config.0.gce_cluster_config.0.network"},
+										DiffSuppressFunc: tpgresource.CompareSelfLinkOrResourceName,
+										Description:      `The name or self_link of the Google Compute Engine subnetwork the cluster will be part of. Conflicts with network.`,
+									},
+
+									"tags": {
+										Type:         schema.TypeSet,
+										Optional:     true,
+										AtLeastOneOf: gceClusterConfigKeys,
+										ForceNew:     true,
+										Elem:         &schema.Schema{Type: schema.TypeString},
+										Description:  `The list of instance tags applied to instances in the cluster. Tags are used to identify valid sources or targets for network firewalls.`,
+									},
+
+									"service_account": {
+										Type:         schema.TypeString,
+										Optional:     true,
+										AtLeastOneOf: gceClusterConfigKeys,
+										ForceNew:     true,
+										Description:  `The service account to be used by the Node VMs. If not specified, the "default" service account is used.`,
+									},
+
+									"service_account_scopes": {
+										Type:         schema.TypeSet,
+										Optional:     true,
+										Computed:     true,
+										AtLeastOneOf: gceClusterConfigKeys,
+										ForceNew:     true,
+										Description:  `The set of Google API scopes to be made available on all of the node VMs under the service_account specified. These can be either FQDNs, or scope aliases.`,
+										Elem: &schema.Schema{
+											Type: schema.TypeString,
+											StateFunc: func(v interface{}) string {
+												return tpgresource.CanonicalizeServiceScope(v.(string))
+											},
+										},
+										Set: tpgresource.StringScopeHashcode,
+									},
+
+									"internal_ip_only": {
+										Type:         schema.TypeBool,
+										Optional:     true,
+										AtLeastOneOf: gceClusterConfigKeys,
+										ForceNew:     true,
+										Default:      false,
+										Description:  `By default, clusters are not restricted to internal IP addresses, and will have ephemeral external IP addresses assigned to each instance. If set to true, all instances in the cluster will only have internal IP addresses. Note: Private Google Access (also known as privateIpGoogleAccess) must be enabled on the subnetwork that the cluster will be launched in.`,
+									},
+
+									"metadata": {
+										Type:         schema.TypeMap,
+										Optional:     true,
+										AtLeastOneOf: gceClusterConfigKeys,
+										Elem:         &schema.Schema{Type: schema.TypeString},
+										ForceNew:     true,
+										Description:  `A map of the Compute Engine metadata entries to add to all instances`,
+									},
+
+									"shielded_instance_config": {
+										Type:         schema.TypeList,
+										Optional:     true,
+										AtLeastOneOf: gceClusterConfigKeys,
+										Computed:     true,
+										MaxItems:     1,
+										Description:  `Shielded Instance Config for clusters using Compute Engine Shielded VMs.`,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"enable_secure_boot": {
+													Type:         schema.TypeBool,
+													Optional:     true,
+													Default:      false,
+													AtLeastOneOf: schieldedInstanceConfigKeys,
+													ForceNew:     true,
+													Description:  `Defines whether instances have Secure Boot enabled.`,
+												},
+												"enable_vtpm": {
+													Type:         schema.TypeBool,
+													Optional:     true,
+													Default:      false,
+													AtLeastOneOf: schieldedInstanceConfigKeys,
+													ForceNew:     true,
+													Description:  `Defines whether instances have the vTPM enabled.`,
+												},
+												"enable_integrity_monitoring": {
+													Type:         schema.TypeBool,
+													Optional:     true,
+													Default:      false,
+													AtLeastOneOf: schieldedInstanceConfigKeys,
+													ForceNew:     true,
+													Description:  `Defines whether instances have integrity monitoring enabled.`,
+												},
+											},
+										},
+									},
+
+									"reservation_affinity": {
+										Type:         schema.TypeList,
+										Optional:     true,
+										AtLeastOneOf: gceClusterConfigKeys,
+										Computed:     true,
+										MaxItems:     1,
+										Description:  `Reservation Affinity for consuming Zonal reservation.`,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"consume_reservation_type": {
+													Type:         schema.TypeString,
+													Optional:     true,
+													AtLeastOneOf: reservationAffinityKeys,
+													ForceNew:     true,
+													ValidateFunc: validation.StringInSlice([]string{"NO_RESERVATION", "ANY_RESERVATION", "SPECIFIC_RESERVATION"}, false),
+													Description:  `Type of reservation to consume.`,
+												},
+												"key": {
+													Type:         schema.TypeString,
+													Optional:     true,
+													AtLeastOneOf: reservationAffinityKeys,
+													ForceNew:     true,
+													Description:  `Corresponds to the label key of reservation resource.`,
+												},
+												"values": {
+													Type:         schema.TypeSet,
+													Elem:         &schema.Schema{Type: schema.TypeString},
+													Optional:     true,
+													AtLeastOneOf: reservationAffinityKeys,
+													ForceNew:     true,
+													Description:  `Corresponds to the label values of reservation resource.`,
+												},
+											},
+										},
+									},
+
+									"node_group_affinity": {
+										Type:         schema.TypeList,
+										Optional:     true,
+										AtLeastOneOf: gceClusterConfigKeys,
+										Computed:     true,
+										MaxItems:     1,
+										Description:  `Node Group Affinity for sole-tenant clusters.`,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"node_group_uri": {
+													Type:             schema.TypeString,
+													ForceNew:         true,
+													Required:         true,
+													Description:      `The URI of a sole-tenant that the cluster will be created on.`,
+													DiffSuppressFunc: tpgresource.CompareSelfLinkOrResourceName,
+												},
+											},
+										},
+									},
+								},
+							},
+						},
+
+						"master_config": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							AtLeastOneOf: clusterConfigKeys,
+							Computed:     true,
+							MaxItems:     1,
+							Description:  `The Compute Engine config settings for the cluster's master instance.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"num_instances": {
+										Type:        schema.TypeInt,
+										Optional:    true,
+										ForceNew:    true,
+										Computed:    true,
+										Description: `Specifies the number of master nodes to create. If not specified, GCP will default to a predetermined computed value.`,
+										AtLeastOneOf: []string{
+											"cluster_config.0.master_config.0.num_instances",
+											"cluster_config.0.master_config.0.image_uri",
+											"cluster_config.0.master_config.0.machine_type",
+											"cluster_config.0.master_config.0.accelerators",
+										},
+									},
+
+									"image_uri": {
+										Type:     schema.TypeString,
+										Optional: true,
+										Computed: true,
+										AtLeastOneOf: []string{
+											"cluster_config.0.master_config.0.num_instances",
+											"cluster_config.0.master_config.0.image_uri",
+											"cluster_config.0.master_config.0.machine_type",
+											"cluster_config.0.master_config.0.accelerators",
+										},
+										ForceNew:    true,
+										Description: `The URI for the image to use for this master`,
+									},
+
+									"machine_type": {
+										Type:     schema.TypeString,
+										Optional: true,
+										Computed: true,
+										AtLeastOneOf: []string{
+											"cluster_config.0.master_config.0.num_instances",
+											"cluster_config.0.master_config.0.image_uri",
+											"cluster_config.0.master_config.0.machine_type",
+											"cluster_config.0.master_config.0.accelerators",
+										},
+										ForceNew:    true,
+										Description: `The name of a Google Compute Engine machine type to create for the master`,
+									},
+
+									"min_cpu_platform": {
+										Type:     schema.TypeString,
+										Optional: true,
+										Computed: true,
+										AtLeastOneOf: []string{
+											"cluster_config.0.master_config.0.num_instances",
+											"cluster_config.0.master_config.0.image_uri",
+											"cluster_config.0.master_config.0.machine_type",
+											"cluster_config.0.master_config.0.accelerators",
+										},
+										ForceNew:    true,
+										Description: `The name of a minimum generation of CPU family for the master. If not specified, GCP will default to a predetermined computed value for each zone.`,
+									},
+									"disk_config": {
+										Type:     schema.TypeList,
+										Optional: true,
+										Computed: true,
+										AtLeastOneOf: []string{
+											"cluster_config.0.master_config.0.num_instances",
+											"cluster_config.0.master_config.0.image_uri",
+											"cluster_config.0.master_config.0.machine_type",
+											"cluster_config.0.master_config.0.accelerators",
+										},
+										MaxItems:    1,
+										Description: `Disk Config`,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"num_local_ssds": {
+													Type:        schema.TypeInt,
+													Optional:    true,
+													Computed:    true,
+													Description: `The amount of local SSD disks that will be attached to each master cluster node. Defaults to 0.`,
+													AtLeastOneOf: []string{
+														"cluster_config.0.master_config.0.disk_config.0.num_local_ssds",
+														"cluster_config.0.master_config.0.disk_config.0.boot_disk_size_gb",
+														"cluster_config.0.master_config.0.disk_config.0.boot_disk_type",
+													},
+													ForceNew: true,
+												},
+
+												"boot_disk_size_gb": {
+													Type:        schema.TypeInt,
+													Optional:    true,
+													Computed:    true,
+													Description: `Size of the primary disk attached to each node, specified in GB. The primary disk contains the boot volume and system libraries, and the smallest allowed disk size is 10GB. GCP will default to a predetermined computed value if not set (currently 500GB). Note: If SSDs are not attached, it also contains the HDFS data blocks and Hadoop working directories.`,
+													AtLeastOneOf: []string{
+														"cluster_config.0.master_config.0.disk_config.0.num_local_ssds",
+														"cluster_config.0.master_config.0.disk_config.0.boot_disk_size_gb",
+														"cluster_config.0.master_config.0.disk_config.0.boot_disk_type",
+													},
+													ForceNew:     true,
+													ValidateFunc: validation.IntAtLeast(10),
+												},
+
+												"boot_disk_type": {
+													Type:        schema.TypeString,
+													Optional:    true,
+													Description: `The disk type of the primary disk attached to each node. Such as "pd-ssd" or "pd-standard". Defaults to "pd-standard".`,
+													AtLeastOneOf: []string{
+														"cluster_config.0.master_config.0.disk_config.0.num_local_ssds",
+														"cluster_config.0.master_config.0.disk_config.0.boot_disk_size_gb",
+														"cluster_config.0.master_config.0.disk_config.0.boot_disk_type",
+													},
+													ForceNew: true,
+													Default:  "pd-standard",
+												},
+											},
+										},
+									},
+									"accelerators": {
+										Type:     schema.TypeSet,
+										Optional: true,
+										AtLeastOneOf: []string{
+											"cluster_config.0.master_config.0.num_instances",
+											"cluster_config.0.master_config.0.image_uri",
+											"cluster_config.0.master_config.0.machine_type",
+											"cluster_config.0.master_config.0.accelerators",
+										},
+										ForceNew:    true,
+										Elem:        acceleratorsSchema(),
+										Description: `The Compute Engine accelerator (GPU) configuration for these instances. Can be specified multiple times.`,
+									},
+
+									"instance_names": {
+										Type:        schema.TypeList,
+										Computed:    true,
+										Elem:        &schema.Schema{Type: schema.TypeString},
+										Description: `List of master instance names which have been assigned to the cluster.`,
+									},
+								},
+							},
+						},
+						"worker_config": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							AtLeastOneOf: clusterConfigKeys,
+							Computed:     true,
+							MaxItems:     1,
+							Description:  `The Compute Engine config settings for the cluster's worker instances.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"num_instances": {
+										Type:        schema.TypeInt,
+										Optional:    true,
+										ForceNew:    false,
+										Computed:    true,
+										Description: `Specifies the number of worker nodes to create. If not specified, GCP will default to a predetermined computed value.`,
+										AtLeastOneOf: []string{
+											"cluster_config.0.worker_config.0.num_instances",
+											"cluster_config.0.worker_config.0.image_uri",
+											"cluster_config.0.worker_config.0.machine_type",
+											"cluster_config.0.worker_config.0.accelerators",
+											"cluster_config.0.worker_config.0.min_num_instances",
+										},
+									},
+
+									"image_uri": {
+										Type:     schema.TypeString,
+										Optional: true,
+										Computed: true,
+										AtLeastOneOf: []string{
+											"cluster_config.0.worker_config.0.num_instances",
+											"cluster_config.0.worker_config.0.image_uri",
+											"cluster_config.0.worker_config.0.machine_type",
+											"cluster_config.0.worker_config.0.accelerators",
+											"cluster_config.0.worker_config.0.min_num_instances",
+										},
+										ForceNew:    true,
+										Description: `The URI for the image to use for this master/worker`,
+									},
+
+									"machine_type": {
+										Type:     schema.TypeString,
+										Optional: true,
+										Computed: true,
+										AtLeastOneOf: []string{
+											"cluster_config.0.worker_config.0.num_instances",
+											"cluster_config.0.worker_config.0.image_uri",
+											"cluster_config.0.worker_config.0.machine_type",
+											"cluster_config.0.worker_config.0.accelerators",
+											"cluster_config.0.worker_config.0.min_num_instances",
+										},
+										ForceNew:    true,
+										Description: `The name of a Google Compute Engine machine type to create for the master/worker`,
+									},
+
+									"min_cpu_platform": {
+										Type:     schema.TypeString,
+										Optional: true,
+										Computed: true,
+										AtLeastOneOf: []string{
+											"cluster_config.0.worker_config.0.num_instances",
+											"cluster_config.0.worker_config.0.image_uri",
+											"cluster_config.0.worker_config.0.machine_type",
+											"cluster_config.0.worker_config.0.accelerators",
+											"cluster_config.0.worker_config.0.min_num_instances",
+										},
+										ForceNew:    true,
+										Description: `The name of a minimum generation of CPU family for the master/worker. If not specified, GCP will default to a predetermined computed value for each zone.`,
+									},
+									"disk_config": {
+										Type:     schema.TypeList,
+										Optional: true,
+										Computed: true,
+										AtLeastOneOf: []string{
+											"cluster_config.0.worker_config.0.num_instances",
+											"cluster_config.0.worker_config.0.image_uri",
+											"cluster_config.0.worker_config.0.machine_type",
+											"cluster_config.0.worker_config.0.accelerators",
+											"cluster_config.0.worker_config.0.min_num_instances",
+											"cluster_config.0.worker_config.0.disk_config",
+										},
+										MaxItems:    1,
+										Description: `Disk Config`,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"num_local_ssds": {
+													Type:        schema.TypeInt,
+													Optional:    true,
+													Computed:    true,
+													Description: `The amount of local SSD disks that will be attached to each master cluster node. Defaults to 0.`,
+													AtLeastOneOf: []string{
+														"cluster_config.0.worker_config.0.disk_config.0.num_local_ssds",
+														"cluster_config.0.worker_config.0.disk_config.0.boot_disk_size_gb",
+														"cluster_config.0.worker_config.0.disk_config.0.boot_disk_type",
+													},
+													ForceNew: true,
+												},
+
+												"boot_disk_size_gb": {
+													Type:        schema.TypeInt,
+													Optional:    true,
+													Computed:    true,
+													Description: `Size of the primary disk attached to each node, specified in GB. The primary disk contains the boot volume and system libraries, and the smallest allowed disk size is 10GB. GCP will default to a predetermined computed value if not set (currently 500GB). Note: If SSDs are not attached, it also contains the HDFS data blocks and Hadoop working directories.`,
+													AtLeastOneOf: []string{
+														"cluster_config.0.worker_config.0.disk_config.0.num_local_ssds",
+														"cluster_config.0.worker_config.0.disk_config.0.boot_disk_size_gb",
+														"cluster_config.0.worker_config.0.disk_config.0.boot_disk_type",
+													},
+													ForceNew:     true,
+													ValidateFunc: validation.IntAtLeast(10),
+												},
+
+												"boot_disk_type": {
+													Type:        schema.TypeString,
+													Optional:    true,
+													Description: `The disk type of the primary disk attached to each node. Such as "pd-ssd" or "pd-standard". Defaults to "pd-standard".`,
+													AtLeastOneOf: []string{
+														"cluster_config.0.worker_config.0.disk_config.0.num_local_ssds",
+														"cluster_config.0.worker_config.0.disk_config.0.boot_disk_size_gb",
+														"cluster_config.0.worker_config.0.disk_config.0.boot_disk_type",
+													},
+													ForceNew: true,
+													Default:  "pd-standard",
+												},
+											},
+										},
+									},
+
+									// Note: preemptible workers don't support accelerators
+									"accelerators": {
+										Type:     schema.TypeSet,
+										Optional: true,
+										AtLeastOneOf: []string{
+											"cluster_config.0.worker_config.0.num_instances",
+											"cluster_config.0.worker_config.0.image_uri",
+											"cluster_config.0.worker_config.0.machine_type",
+											"cluster_config.0.worker_config.0.accelerators",
+											"cluster_config.0.worker_config.0.min_num_instances",
+										},
+										ForceNew:    true,
+										Elem:        acceleratorsSchema(),
+										Description: `The Compute Engine accelerator (GPU) configuration for these instances. Can be specified multiple times.`,
+									},
+
+									"instance_names": {
+										Type:        schema.TypeList,
+										Computed:    true,
+										Elem:        &schema.Schema{Type: schema.TypeString},
+										Description: `List of master/worker instance names which have been assigned to the cluster.`,
+									},
+									"min_num_instances": {
+										Type:     schema.TypeInt,
+										Optional: true,
+										Computed: true,
+										ForceNew: false,
+										AtLeastOneOf: []string{
+											"cluster_config.0.worker_config.0.num_instances",
+											"cluster_config.0.worker_config.0.image_uri",
+											"cluster_config.0.worker_config.0.machine_type",
+											"cluster_config.0.worker_config.0.accelerators",
+											"cluster_config.0.worker_config.0.min_num_instances",
+										},
+										Description: `The minimum number of primary worker instances to create.`,
+									},
+								},
+							},
+						},
+						// preemptible_worker_config has a slightly different config
+						"preemptible_worker_config": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							AtLeastOneOf: clusterConfigKeys,
+							Computed:     true,
+							MaxItems:     1,
+							Description:  `The Google Compute Engine config settings for the additional (aka preemptible) instances in a cluster.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"num_instances": {
+										Type:        schema.TypeInt,
+										Optional:    true,
+										Computed:    true,
+										Description: `Specifies the number of preemptible nodes to create. Defaults to 0.`,
+										AtLeastOneOf: []string{
+											"cluster_config.0.preemptible_worker_config.0.num_instances",
+											"cluster_config.0.preemptible_worker_config.0.preemptibility",
+											"cluster_config.0.preemptible_worker_config.0.disk_config",
+										},
+									},
+
+									// API does not honour this if set ...
+									// It always uses whatever is specified for the worker_config
+									// "machine_type": { ... }
+									// "min_cpu_platform": { ... }
+									"preemptibility": {
+										Type:        schema.TypeString,
+										Optional:    true,
+										Description: `Specifies the preemptibility of the secondary nodes. Defaults to PREEMPTIBLE.`,
+										AtLeastOneOf: []string{
+											"cluster_config.0.preemptible_worker_config.0.num_instances",
+											"cluster_config.0.preemptible_worker_config.0.preemptibility",
+											"cluster_config.0.preemptible_worker_config.0.disk_config",
+										},
+										ForceNew:     true,
+										ValidateFunc: validation.StringInSlice([]string{"PREEMPTIBILITY_UNSPECIFIED", "NON_PREEMPTIBLE", "PREEMPTIBLE", "SPOT"}, false),
+										Default:      "PREEMPTIBLE",
+									},
+
+									"disk_config": {
+										Type:        schema.TypeList,
+										Optional:    true,
+										Computed:    true,
+										Description: `Disk Config`,
+										AtLeastOneOf: []string{
+											"cluster_config.0.preemptible_worker_config.0.num_instances",
+											"cluster_config.0.preemptible_worker_config.0.preemptibility",
+											"cluster_config.0.preemptible_worker_config.0.disk_config",
+										},
+										MaxItems: 1,
+
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"num_local_ssds": {
+													Type:         schema.TypeInt,
+													Optional:     true,
+													Computed:     true,
+													AtLeastOneOf: preemptibleWorkerDiskConfigKeys,
+													ForceNew:     true,
+													Description:  `The amount of local SSD disks that will be attached to each preemptible worker node. Defaults to 0.`,
+												},
+
+												"boot_disk_size_gb": {
+													Type:         schema.TypeInt,
+													Optional:     true,
+													Computed:     true,
+													AtLeastOneOf: preemptibleWorkerDiskConfigKeys,
+													ForceNew:     true,
+													ValidateFunc: validation.IntAtLeast(10),
+													Description:  `Size of the primary disk attached to each preemptible worker node, specified in GB. The smallest allowed disk size is 10GB. GCP will default to a predetermined computed value if not set (currently 500GB). Note: If SSDs are not attached, it also contains the HDFS data blocks and Hadoop working directories.`,
+												},
+
+												"boot_disk_type": {
+													Type:         schema.TypeString,
+													Optional:     true,
+													AtLeastOneOf: preemptibleWorkerDiskConfigKeys,
+													ForceNew:     true,
+													Default:      "pd-standard",
+													Description:  `The disk type of the primary disk attached to each preemptible worker node. Such as "pd-ssd" or "pd-standard". Defaults to "pd-standard".`,
+												},
+											},
+										},
+									},
+
+									"instance_names": {
+										Type:        schema.TypeList,
+										Computed:    true,
+										Elem:        &schema.Schema{Type: schema.TypeString},
+										Description: `List of preemptible instance names which have been assigned to the cluster.`,
+									},
+									"instance_flexibility_policy": {
+										Type:        schema.TypeList,
+										Optional:    true,
+										Computed:    true,
+										Description: `Instance flexibility Policy allowing a mixture of VM shapes and provisioning models.`,
+										AtLeastOneOf: []string{
+											"cluster_config.0.preemptible_worker_config.0.num_instances",
+											"cluster_config.0.preemptible_worker_config.0.preemptibility",
+											"cluster_config.0.preemptible_worker_config.0.disk_config",
+											"cluster_config.0.preemptible_worker_config.0.instance_flexibility_policy",
+										},
+										MaxItems: 1,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"instance_selection_list": {
+													Type:     schema.TypeList,
+													Computed: true,
+													Optional: true,
+													ForceNew: true,
+													AtLeastOneOf: []string{
+														"cluster_config.0.preemptible_worker_config.0.instance_flexibility_policy.0.instance_selection_list",
+													},
+													Description: `List of instance selection options that the group will use when creating new VMs.`,
+													Elem: &schema.Resource{
+														Schema: map[string]*schema.Schema{
+															"machine_types": {
+																Type:        schema.TypeList,
+																Computed:    true,
+																Optional:    true,
+																ForceNew:    true,
+																Elem:        &schema.Schema{Type: schema.TypeString},
+																Description: `Full machine-type names, e.g. "n1-standard-16".`,
+															},
+															"rank": {
+																Type:        schema.TypeInt,
+																Computed:    true,
+																Optional:    true,
+																ForceNew:    true,
+																Elem:        &schema.Schema{Type: schema.TypeInt},
+																Description: `Preference of this instance selection. Lower number means higher preference. Dataproc will first try to create a VM based on the machine-type with priority rank and fallback to next rank based on availability. Machine types and instance selections with the same priority have the same preference.`,
+															},
+														},
+													},
+												},
+												"instance_selection_results": {
+													Type:        schema.TypeList,
+													Computed:    true,
+													Description: `A list of instance selection results in the group.`,
+													Elem: &schema.Resource{
+														Schema: map[string]*schema.Schema{
+															"machine_type": {
+																Type:        schema.TypeString,
+																Computed:    true,
+																Elem:        &schema.Schema{Type: schema.TypeString},
+																Description: `Full machine-type names, e.g. "n1-standard-16".`,
+															},
+															"vm_count": {
+																Type:        schema.TypeInt,
+																Computed:    true,
+																Elem:        &schema.Schema{Type: schema.TypeInt},
+																Description: `Number of VM provisioned with the machine_type.`,
+															},
+														},
+													},
+												},
+											},
+										},
+									},
+								},
+							},
+						},
+
+						"security_config": {
+							Type:        schema.TypeList,
+							Optional:    true,
+							MaxItems:    1,
+							Description: `Security related configuration.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"kerberos_config": {
+										Type:        schema.TypeList,
+										Required:    true,
+										Description: "Kerberos related configuration",
+										MaxItems:    1,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"cross_realm_trust_admin_server": {
+													Type:        schema.TypeString,
+													Optional:    true,
+													Description: `The admin server (IP or hostname) for the remote trusted realm in a cross realm trust relationship.`,
+												},
+												"cross_realm_trust_kdc": {
+													Type:        schema.TypeString,
+													Optional:    true,
+													Description: `The KDC (IP or hostname) for the remote trusted realm in a cross realm trust relationship.`,
+												},
+												"cross_realm_trust_realm": {
+													Type:        schema.TypeString,
+													Optional:    true,
+													Description: `The remote realm the Dataproc on-cluster KDC will trust, should the user enable cross realm trust.`,
+												},
+												"cross_realm_trust_shared_password_uri": {
+													Type:     schema.TypeString,
+													Optional: true,
+													Description: `The Cloud Storage URI of a KMS encrypted file containing the shared password between the on-cluster
+Kerberos realm and the remote trusted realm, in a cross realm trust relationship.`,
+												},
+												"enable_kerberos": {
+													Type:        schema.TypeBool,
+													Optional:    true,
+													Description: `Flag to indicate whether to Kerberize the cluster.`,
+												},
+												"kdc_db_key_uri": {
+													Type:        schema.TypeString,
+													Optional:    true,
+													Description: `The Cloud Storage URI of a KMS encrypted file containing the master key of the KDC database.`,
+												},
+												"key_password_uri": {
+													Type:        schema.TypeString,
+													Optional:    true,
+													Description: `The Cloud Storage URI of a KMS encrypted file containing the password to the user provided key. For the self-signed certificate, this password is generated by Dataproc.`,
+												},
+												"keystore_uri": {
+													Type:        schema.TypeString,
+													Optional:    true,
+													Description: `The Cloud Storage URI of the keystore file used for SSL encryption. If not provided, Dataproc will provide a self-signed certificate.`,
+												},
+												"keystore_password_uri": {
+													Type:     schema.TypeString,
+													Optional: true,
+													Description: `The Cloud Storage URI of a KMS encrypted file containing
+the password to the user provided keystore. For the self-signed certificate, this password is generated
+by Dataproc`,
+												},
+												"kms_key_uri": {
+													Type:        schema.TypeString,
+													Required:    true,
+													Description: `The uri of the KMS key used to encrypt various sensitive files.`,
+												},
+												"realm": {
+													Type:        schema.TypeString,
+													Optional:    true,
+													Description: `The name of the on-cluster Kerberos realm. If not specified, the uppercased domain of hostnames will be the realm.`,
+												},
+												"root_principal_password_uri": {
+													Type:        schema.TypeString,
+													Required:    true,
+													Description: `The cloud Storage URI of a KMS encrypted file containing the root principal password.`,
+												},
+												"tgt_lifetime_hours": {
+													Type:        schema.TypeInt,
+													Optional:    true,
+													Description: `The lifetime of the ticket granting ticket, in hours.`,
+												},
+												"truststore_password_uri": {
+													Type:        schema.TypeString,
+													Optional:    true,
+													Description: `The Cloud Storage URI of a KMS encrypted file containing the password to the user provided truststore. For the self-signed certificate, this password is generated by Dataproc.`,
+												},
+												"truststore_uri": {
+													Type:        schema.TypeString,
+													Optional:    true,
+													Description: `The Cloud Storage URI of the truststore file used for SSL encryption. If not provided, Dataproc will provide a self-signed certificate.`,
+												},
+											},
+										},
+									},
+								},
+							},
+						},
+
+						"software_config": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							AtLeastOneOf: clusterConfigKeys,
+							Computed:     true,
+							MaxItems:     1,
+							Description:  `The config settings for software inside the cluster.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"image_version": {
+										Type:             schema.TypeString,
+										Optional:         true,
+										Computed:         true,
+										AtLeastOneOf:     clusterSoftwareConfigKeys,
+										ForceNew:         true,
+										DiffSuppressFunc: dataprocImageVersionDiffSuppress,
+										Description:      `The Cloud Dataproc image version to use for the cluster - this controls the sets of software versions installed onto the nodes when you create clusters. If not specified, defaults to the latest version.`,
+									},
+									"override_properties": {
+										Type:         schema.TypeMap,
+										Optional:     true,
+										AtLeastOneOf: clusterSoftwareConfigKeys,
+										ForceNew:     true,
+										Elem:         &schema.Schema{Type: schema.TypeString},
+										Description:  `A list of override and additional properties (key/value pairs) used to modify various aspects of the common configuration files used when creating a cluster.`,
+									},
+
+									"properties": {
+										Type:        schema.TypeMap,
+										Computed:    true,
+										Description: `A list of the properties used to set the daemon config files. This will include any values supplied by the user via cluster_config.software_config.override_properties`,
+									},
+
+									// We have two versions of the properties field here because by default
+									// dataproc will set a number of default properties for you out of the
+									// box. If you want to override one or more, if we only had one field,
+									// you would need to add in all these values as well otherwise you would
+									// get a diff. To make this easier, 'properties' simply contains the computed
+									// values (including overrides) for all properties, whilst override_properties
+									// is only for properties the user specifically wants to override. If nothing
+									// is overridden, this will be empty.
+
+									"optional_components": {
+										Type:         schema.TypeSet,
+										Optional:     true,
+										AtLeastOneOf: clusterSoftwareConfigKeys,
+										Description:  `The set of optional components to activate on the cluster.`,
+										Elem: &schema.Schema{
+											Type: schema.TypeString,
+										},
+									},
+								},
+							},
+						},
+
+						"initialization_action": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							AtLeastOneOf: clusterConfigKeys,
+							ForceNew:     true,
+							Description:  `Commands to execute on each node after config is completed. You can specify multiple versions of these.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"script": {
+										Type:        schema.TypeString,
+										Required:    true,
+										ForceNew:    true,
+										Description: `The script to be executed during initialization of the cluster. The script must be a GCS file with a gs:// prefix.`,
+									},
+
+									"timeout_sec": {
+										Type:        schema.TypeInt,
+										Optional:    true,
+										Default:     300,
+										ForceNew:    true,
+										Description: `The maximum duration (in seconds) which script is allowed to take to execute its action. GCP will default to a predetermined computed value if not set (currently 300).`,
+									},
+								},
+							},
+						},
+						"encryption_config": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							AtLeastOneOf: clusterConfigKeys,
+							MaxItems:     1,
+							Description:  `The Customer managed encryption keys settings for the cluster.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"kms_key_name": {
+										Type:        schema.TypeString,
+										Required:    true,
+										Description: `The Cloud KMS key name to use for PD disk encryption for all instances in the cluster.`,
+									},
+								},
+							},
+						},
+						"autoscaling_config": {
+							Type:             schema.TypeList,
+							Optional:         true,
+							AtLeastOneOf:     clusterConfigKeys,
+							MaxItems:         1,
+							Description:      `The autoscaling policy config associated with the cluster.`,
+							DiffSuppressFunc: tpgresource.EmptyOrUnsetBlockDiffSuppress,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"policy_uri": {
+										Type:             schema.TypeString,
+										Required:         true,
+										Description:      `The autoscaling policy used by the cluster.`,
+										DiffSuppressFunc: tpgresource.LocationDiffSuppress,
+									},
+								},
+							},
+						},
+						"metastore_config": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							AtLeastOneOf: clusterConfigKeys,
+							MaxItems:     1,
+							Description:  `Specifies a Metastore configuration.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"dataproc_metastore_service": {
+										Type:        schema.TypeString,
+										Required:    true,
+										ForceNew:    true,
+										Description: `Resource name of an existing Dataproc Metastore service.`,
+									},
+								},
+							},
+						},
+						"lifecycle_config": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							MaxItems:     1,
+							AtLeastOneOf: clusterConfigKeys,
+							Description:  `The settings for auto deletion cluster schedule.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"idle_delete_ttl": {
+										Type:        schema.TypeString,
+										Optional:    true,
+										Description: `The duration to keep the cluster alive while idling (no jobs running). After this TTL, the cluster will be deleted. Valid range: [10m, 14d].`,
+										AtLeastOneOf: []string{
+											"cluster_config.0.lifecycle_config.0.idle_delete_ttl",
+											"cluster_config.0.lifecycle_config.0.auto_delete_time",
+										},
+									},
+									"idle_start_time": {
+										Type:        schema.TypeString,
+										Computed:    true,
+										Description: `Time when the cluster became idle (most recent job finished) and became eligible for deletion due to idleness.`,
+									},
+									// the API also has the auto_delete_ttl option in its request, however,
+									// the value is not returned in the response, rather the auto_delete_time
+									// after calculating ttl with the update time is returned, thus, for now
+									// we will only allow auto_delete_time to updated.
+									"auto_delete_time": {
+										Type:             schema.TypeString,
+										Optional:         true,
+										Description:      `The time when cluster will be auto-deleted. A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".`,
+										DiffSuppressFunc: tpgresource.TimestampDiffSuppress(time.RFC3339Nano),
+										AtLeastOneOf: []string{
+											"cluster_config.0.lifecycle_config.0.idle_delete_ttl",
+											"cluster_config.0.lifecycle_config.0.auto_delete_time",
+										},
+									},
+								},
+							},
+						},
+						"endpoint_config": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							Computed:     true,
+							MaxItems:     1,
+							Description:  `The config settings for port access on the cluster. Structure defined below.`,
+							AtLeastOneOf: clusterConfigKeys,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"enable_http_port_access": {
+										Type:        schema.TypeBool,
+										Required:    true,
+										ForceNew:    true,
+										Description: `The flag to enable http access to specific ports on the cluster from external sources (aka Component Gateway). Defaults to false.`,
+									},
+									"http_ports": {
+										Type:        schema.TypeMap,
+										Computed:    true,
+										Description: `The map of port descriptions to URLs. Will only be populated if enable_http_port_access is true.`,
+									},
+								},
+							},
+						},
+
+						"dataproc_metric_config": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							MaxItems:     1,
+							Description:  `The config for Dataproc metrics.`,
+							AtLeastOneOf: clusterConfigKeys,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"metrics": {
+										Type:        schema.TypeList,
+										Required:    true,
+										Description: `Metrics sources to enable.`,
+										Elem:        metricsSchema(),
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		UseJSONNumber: true,
+	}
+}
+
+func ResourceDataprocClusterStateUpgradeV0(_ context.Context, rawState map[string]interface{}, meta interface{}) (map[string]interface{}, error) {
+	return tpgresource.LabelsStateUpgrade(rawState, resourceDataprocGoogleLabelPrefix)
+}
diff --git a/mmv1/third_party/terraform/services/dataproc/resource_dataproc_cluster_sweeper.go b/mmv1/third_party/terraform/services/dataproc/resource_dataproc_cluster_sweeper.go
new file mode 100644
index 000000000000..ad4927e28a19
--- /dev/null
+++ b/mmv1/third_party/terraform/services/dataproc/resource_dataproc_cluster_sweeper.go
@@ -0,0 +1,126 @@
+package dataproc
+
+import (
+	"context"
+	"log"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/terraform-provider-google/google/envvar"
+	"github.com/hashicorp/terraform-provider-google/google/sweeper"
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
+)
+
+func init() {
+	sweeper.AddTestSweepers("DataprocCluster", testSweepDataprocCluster)
+}
+
+// At the time of writing, the CI only passes us-central1 as the region
+func testSweepDataprocCluster(region string) error {
+	resourceName := "DataprocCluster"
+	log.Printf("[INFO][SWEEPER_LOG] Starting sweeper for %s", resourceName)
+
+	config, err := sweeper.SharedConfigForRegion(region)
+	if err != nil {
+		log.Printf("[INFO][SWEEPER_LOG] error getting shared config for region: %s", err)
+		return err
+	}
+
+	err = config.LoadAndValidate(context.Background())
+	if err != nil {
+		log.Printf("[INFO][SWEEPER_LOG] error loading: %s", err)
+		return err
+	}
+
+	t := &testing.T{}
+	billingId := envvar.GetTestBillingAccountFromEnv(t)
+
+	// Setup variables to replace in list template
+	d := &tpgresource.ResourceDataMock{
+		FieldsInSchema: map[string]interface{}{
+			"project":         config.Project,
+			"region":          region,
+			"location":        region,
+			"zone":            "-",
+			"billing_account": billingId,
+		},
+	}
+
+	listTemplate := strings.Split("https://dataproc.googleapis.com/v1/projects/{{project}}/regions/{{region}}/clusters", "?")[0]
+	listUrl, err := tpgresource.ReplaceVars(d, config, listTemplate)
+	if err != nil {
+		log.Printf("[INFO][SWEEPER_LOG] error preparing sweeper list url: %s", err)
+		return nil
+	}
+
+	res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+		Config:    config,
+		Method:    "GET",
+		Project:   config.Project,
+		RawURL:    listUrl,
+		UserAgent: config.UserAgent,
+	})
+	if err != nil {
+		log.Printf("[INFO][SWEEPER_LOG] Error in response from request %s: %s", listUrl, err)
+		return nil
+	}
+
+	resourceList, ok := res["policies"]
+	if !ok {
+		log.Printf("[INFO][SWEEPER_LOG] Nothing found in response.")
+		return nil
+	}
+
+	rl := resourceList.([]interface{})
+
+	log.Printf("[INFO][SWEEPER_LOG] Found %d items in %s list response.", len(rl), resourceName)
+	// Keep count of items that aren't sweepable for logging.
+	nonPrefixCount := 0
+	for _, ri := range rl {
+		obj := ri.(map[string]interface{})
+		var name string
+		// Id detected in the delete URL, attempt to use id.
+		if obj["id"] != nil {
+			name = tpgresource.GetResourceNameFromSelfLink(obj["id"].(string))
+		} else if obj["name"] != nil {
+			name = tpgresource.GetResourceNameFromSelfLink(obj["name"].(string))
+		} else {
+			log.Printf("[INFO][SWEEPER_LOG] %s resource name and id were nil", resourceName)
+			return nil
+		}
+		// Skip resources that shouldn't be sweeped
+		if !sweeper.IsSweepableTestResource(name) {
+			nonPrefixCount++
+			continue
+		}
+
+		deleteTemplate := "https://dataproc.googleapis.com/v1/projects/{{project}}/regions/{{region}}/clusters/{cluster_id}"
+		deleteUrl, err := tpgresource.ReplaceVars(d, config, deleteTemplate)
+		if err != nil {
+			log.Printf("[INFO][SWEEPER_LOG] error preparing delete url: %s", err)
+			return nil
+		}
+		deleteUrl = deleteUrl + name
+
+		// Don't wait on operations as we may have a lot to delete
+		_, err = transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+			Config:    config,
+			Method:    "DELETE",
+			Project:   config.Project,
+			RawURL:    deleteUrl,
+			UserAgent: config.UserAgent,
+		})
+		if err != nil {
+			log.Printf("[INFO][SWEEPER_LOG] Error deleting for url %s : %s", deleteUrl, err)
+		} else {
+			log.Printf("[INFO][SWEEPER_LOG] Sent delete request for %s resource: %s", resourceName, name)
+		}
+	}
+
+	if nonPrefixCount > 0 {
+		log.Printf("[INFO][SWEEPER_LOG] %d items were non-sweepable and skipped.", nonPrefixCount)
+	}
+
+	return nil
+}
diff --git a/mmv1/third_party/terraform/services/dataproc/resource_dataproc_cluster_test.go.erb b/mmv1/third_party/terraform/services/dataproc/resource_dataproc_cluster_test.go.erb
index 4e0f97060275..c1e050b94491 100644
--- a/mmv1/third_party/terraform/services/dataproc/resource_dataproc_cluster_test.go.erb
+++ b/mmv1/third_party/terraform/services/dataproc/resource_dataproc_cluster_test.go.erb
@@ -105,7 +105,6 @@ func TestAccDataprocCluster_basic(t *testing.T) {
 	})
 }
 
-<% if version == "ga" -%>
 func TestAccDataprocVirtualCluster_basic(t *testing.T) {
 	t.Parallel()
 
@@ -113,6 +112,8 @@ func TestAccDataprocVirtualCluster_basic(t *testing.T) {
 	rnd := acctest.RandString(t, 10)
 	pid := envvar.GetTestProjectFromEnv()
 	version := "3.1-dataproc-7"
+	networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -120,7 +121,7 @@ func TestAccDataprocVirtualCluster_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocVirtualCluster_basic(pid, rnd),
+				Config: testAccDataprocVirtualCluster_basic(pid, rnd, networkName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.virtual_cluster", &cluster),
 
@@ -142,7 +143,6 @@ func TestAccDataprocVirtualCluster_basic(t *testing.T) {
 		},
 	})
 }
-<% end -%>
 
 func TestAccDataprocCluster_withAccelerators(t *testing.T) {
 	t.Parallel()
@@ -153,6 +153,9 @@ func TestAccDataprocCluster_withAccelerators(t *testing.T) {
 	project := envvar.GetTestProjectFromEnv()
 	acceleratorType := "nvidia-tesla-k80"
 	zone := "us-central1-c"
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -160,7 +163,7 @@ func TestAccDataprocCluster_withAccelerators(t *testing.T) {
 		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocCluster_withAccelerators(rnd, acceleratorType, zone),
+				Config: testAccDataprocCluster_withAccelerators(rnd, acceleratorType, zone, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.accelerated_cluster", &cluster),
 					testAccCheckDataprocClusterAccelerator(&cluster, project, 1, 1),
@@ -238,13 +241,17 @@ func TestAccDataprocCluster_withMetadataAndTags(t *testing.T) {
 
 	var cluster dataproc.Cluster
 	rnd := acctest.RandString(t, 10)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocCluster_withMetadataAndTags(rnd),
+				Config: testAccDataprocCluster_withMetadataAndTags(rnd, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.basic", &cluster),
 
@@ -257,18 +264,48 @@ func TestAccDataprocCluster_withMetadataAndTags(t *testing.T) {
 	})
 }
 
+func TestAccDataprocCluster_withMinNumInstances(t *testing.T) {
+	t.Parallel()
+
+	var cluster dataproc.Cluster
+	rnd := acctest.RandString(t, 10)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDataprocCluster_withMinNumInstances(rnd, subnetworkName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.with_min_num_instances", &cluster),
+
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_min_num_instances", "cluster_config.0.worker_config.0.min_num_instances", "2"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccDataprocCluster_withReservationAffinity(t *testing.T) {
 	t.Parallel()
 
 	var cluster dataproc.Cluster
 	rnd := acctest.RandString(t, 10)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocCluster_withReservationAffinity(rnd),
+				Config: testAccDataprocCluster_withReservationAffinity(rnd, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.basic", &cluster),
 
@@ -286,13 +323,17 @@ func TestAccDataprocCluster_withDataprocMetricConfig(t *testing.T) {
 
 	var cluster dataproc.Cluster
 	rnd := acctest.RandString(t, 10)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocCluster_withDataprocMetricConfig(rnd),
+				Config: testAccDataprocCluster_withDataprocMetricConfig(rnd, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.basic", &cluster),
 
@@ -311,13 +352,17 @@ func TestAccDataprocCluster_withNodeGroupAffinity(t *testing.T) {
 
 	var cluster dataproc.Cluster
 	rnd := acctest.RandString(t, 10)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocCluster_withNodeGroupAffinity(rnd),
+				Config: testAccDataprocCluster_withNodeGroupAffinity(rnd, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.basic", &cluster),
 
@@ -332,6 +377,10 @@ func TestAccDataprocCluster_singleNodeCluster(t *testing.T) {
 	t.Parallel()
 
 	rnd := acctest.RandString(t, 10)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
 	var cluster dataproc.Cluster
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -339,7 +388,7 @@ func TestAccDataprocCluster_singleNodeCluster(t *testing.T) {
 		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocCluster_singleNodeCluster(rnd),
+				Config: testAccDataprocCluster_singleNodeCluster(rnd, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.single_node_cluster", &cluster),
 					resource.TestCheckResourceAttr("google_dataproc_cluster.single_node_cluster", "cluster_config.0.master_config.0.num_instances", "1"),
@@ -396,14 +445,18 @@ func TestAccDataprocCluster_nonPreemptibleSecondary(t *testing.T) {
 	t.Parallel()
 
 	rnd := acctest.RandString(t, 10)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
 	var cluster dataproc.Cluster
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocCluster_nonPreemptibleSecondary(rnd),
+				Config: testAccDataprocCluster_nonPreemptibleSecondary(rnd, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.non_preemptible_secondary", &cluster),
 					resource.TestCheckResourceAttr("google_dataproc_cluster.non_preemptible_secondary", "cluster_config.0.preemptible_worker_config.0.preemptibility", "NON_PREEMPTIBLE"),
@@ -417,14 +470,18 @@ func TestAccDataprocCluster_spotSecondary(t *testing.T) {
 	t.Parallel()
 
 	rnd := acctest.RandString(t, 10)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
 	var cluster dataproc.Cluster
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocCluster_spotSecondary(rnd),
+				Config: testAccDataprocCluster_spotSecondary(rnd, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.spot_secondary", &cluster),
 					resource.TestCheckResourceAttr("google_dataproc_cluster.spot_secondary", "cluster_config.0.preemptible_worker_config.0.preemptibility", "SPOT"),
@@ -434,6 +491,29 @@ func TestAccDataprocCluster_spotSecondary(t *testing.T) {
 	})
 }
 
+func TestAccDataprocCluster_spotWithInstanceFlexibilityPolicy(t *testing.T) {
+	t.Parallel()
+
+	rnd := acctest.RandString(t, 10)
+	var cluster dataproc.Cluster
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDataprocCluster_spotWithInstanceFlexibilityPolicy(rnd),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.spot_with_instance_flexibility_policy", &cluster),
+					resource.TestCheckResourceAttr("google_dataproc_cluster.spot_with_instance_flexibility_policy", "cluster_config.0.preemptible_worker_config.0.preemptibility", "SPOT"),
+					resource.TestCheckResourceAttr("google_dataproc_cluster.spot_with_instance_flexibility_policy", "cluster_config.0.preemptible_worker_config.0.instance_flexibility_policy.0.instance_selection_list.0.machine_types.0", "n2d-standard-2"),
+					resource.TestCheckResourceAttr("google_dataproc_cluster.spot_with_instance_flexibility_policy", "cluster_config.0.preemptible_worker_config.0.instance_flexibility_policy.0.instance_selection_list.0.rank", "3"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccDataprocCluster_withStagingBucket(t *testing.T) {
 	t.Parallel()
 
@@ -441,6 +521,9 @@ func TestAccDataprocCluster_withStagingBucket(t *testing.T) {
 	var cluster dataproc.Cluster
 	clusterName := fmt.Sprintf("tf-test-dproc-%s", rnd)
 	bucketName := fmt.Sprintf("%s-bucket", clusterName)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -448,7 +531,7 @@ func TestAccDataprocCluster_withStagingBucket(t *testing.T) {
 		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocCluster_withStagingBucketAndCluster(clusterName, bucketName),
+				Config: testAccDataprocCluster_withStagingBucketAndCluster(clusterName, bucketName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.with_bucket", &cluster),
 					resource.TestCheckResourceAttr("google_dataproc_cluster.with_bucket", "cluster_config.0.staging_bucket", bucketName),
@@ -473,6 +556,9 @@ func TestAccDataprocCluster_withTempBucket(t *testing.T) {
 	var cluster dataproc.Cluster
 	clusterName := fmt.Sprintf("tf-test-dproc-%s", rnd)
 	bucketName := fmt.Sprintf("%s-temp-bucket", clusterName)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -480,7 +566,7 @@ func TestAccDataprocCluster_withTempBucket(t *testing.T) {
 		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocCluster_withTempBucketAndCluster(clusterName, bucketName),
+				Config: testAccDataprocCluster_withTempBucketAndCluster(clusterName, bucketName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.with_bucket", &cluster),
 					resource.TestCheckResourceAttr("google_dataproc_cluster.with_bucket", "cluster_config.0.temp_bucket", bucketName)),
@@ -504,13 +590,17 @@ func TestAccDataprocCluster_withInitAction(t *testing.T) {
 	var cluster dataproc.Cluster
 	bucketName := fmt.Sprintf("tf-test-dproc-%s-init-bucket", rnd)
 	objectName := "msg.txt"
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocCluster_withInitAction(rnd, bucketName, objectName),
+				Config: testAccDataprocCluster_withInitAction(rnd, bucketName, objectName, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.with_init_action", &cluster),
 					resource.TestCheckResourceAttr("google_dataproc_cluster.with_init_action", "cluster_config.0.initialization_action.#", "2"),
@@ -527,13 +617,17 @@ func TestAccDataprocCluster_withConfigOverrides(t *testing.T) {
 
 	rnd := acctest.RandString(t, 10)
 	var cluster dataproc.Cluster
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocCluster_withConfigOverrides(rnd),
+				Config: testAccDataprocCluster_withConfigOverrides(rnd, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.with_config_overrides", &cluster),
 					validateDataprocCluster_withConfigOverrides("google_dataproc_cluster.with_config_overrides", &cluster),
@@ -549,6 +643,9 @@ func TestAccDataprocCluster_withServiceAcc(t *testing.T) {
 	sa := "a" + acctest.RandString(t, 10)
 	saEmail := fmt.Sprintf("%s@%s.iam.gserviceaccount.com", sa, envvar.GetTestProjectFromEnv())
 	rnd := acctest.RandString(t, 10)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
 
 	var cluster dataproc.Cluster
 
@@ -558,7 +655,7 @@ func TestAccDataprocCluster_withServiceAcc(t *testing.T) {
 		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocCluster_withServiceAcc(sa, rnd),
+				Config: testAccDataprocCluster_withServiceAcc(sa, rnd, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(
 						t, "google_dataproc_cluster.with_service_account", &cluster),
@@ -580,6 +677,9 @@ func TestAccDataprocCluster_withImageVersion(t *testing.T) {
 
 	rnd := acctest.RandString(t, 10)
 	version := "2.0.35-debian10"
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
 
 	var cluster dataproc.Cluster
 	acctest.VcrTest(t, resource.TestCase{
@@ -588,7 +688,7 @@ func TestAccDataprocCluster_withImageVersion(t *testing.T) {
 		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocCluster_withImageVersion(rnd, version),
+				Config: testAccDataprocCluster_withImageVersion(rnd, version, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.with_image_version", &cluster),
 					resource.TestCheckResourceAttr("google_dataproc_cluster.with_image_version", "cluster_config.0.software_config.0.image_version", version),
@@ -602,14 +702,18 @@ func TestAccDataprocCluster_withOptionalComponents(t *testing.T) {
 	t.Parallel()
 
 	rnd := acctest.RandString(t, 10)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
 	var cluster dataproc.Cluster
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocCluster_withOptionalComponents(rnd),
+				Config: testAccDataprocCluster_withOptionalComponents(rnd, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.with_opt_components", &cluster),
 					testAccCheckDataprocClusterHasOptionalComponents(&cluster, "ZOOKEEPER", "DOCKER"),
@@ -623,20 +727,24 @@ func TestAccDataprocCluster_withLifecycleConfigIdleDeleteTtl(t *testing.T) {
 	t.Parallel()
 
 	rnd := acctest.RandString(t, 10)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
 	var cluster dataproc.Cluster
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocCluster_withLifecycleConfigIdleDeleteTtl(rnd, "600s"),
+				Config: testAccDataprocCluster_withLifecycleConfigIdleDeleteTtl(rnd, "600s", subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.with_lifecycle_config", &cluster),
 				),
 			},
 			{
-				Config: testAccDataprocCluster_withLifecycleConfigIdleDeleteTtl(rnd, "610s"),
+				Config: testAccDataprocCluster_withLifecycleConfigIdleDeleteTtl(rnd, "610s", subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.with_lifecycle_config", &cluster),
 				),
@@ -653,6 +761,9 @@ func TestAccDataprocCluster_withLifecycleConfigAutoDeletion(t *testing.T) {
 	rnd := acctest.RandString(t, 10)
 	now := time.Now()
 	fmtString := "2006-01-02T15:04:05.072Z"
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
 
 	var cluster dataproc.Cluster
 	acctest.VcrTest(t, resource.TestCase{
@@ -661,13 +772,13 @@ func TestAccDataprocCluster_withLifecycleConfigAutoDeletion(t *testing.T) {
 		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocCluster_withLifecycleConfigAutoDeletionTime(rnd, now.Add(time.Hour * 10).Format(fmtString)),
+				Config: testAccDataprocCluster_withLifecycleConfigAutoDeletionTime(rnd, now.Add(time.Hour * 10).Format(fmtString), subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.with_lifecycle_config", &cluster),
 				),
 			},
 			{
-				Config: testAccDataprocCluster_withLifecycleConfigAutoDeletionTime(rnd, now.Add(time.Hour * 20).Format(fmtString)),
+				Config: testAccDataprocCluster_withLifecycleConfigAutoDeletionTime(rnd, now.Add(time.Hour * 20).Format(fmtString), subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.with_lifecycle_config", &cluster),
 				),
@@ -680,20 +791,56 @@ func TestAccDataprocCluster_withLabels(t *testing.T) {
 	t.Parallel()
 
 	rnd := acctest.RandString(t, 10)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
 	var cluster dataproc.Cluster
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocCluster_withLabels(rnd),
+				Config: testAccDataprocCluster_withoutLabels(rnd, subnetworkName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.with_labels", &cluster),
+
+					resource.TestCheckNoResourceAttr("google_dataproc_cluster.with_labels", "labels.%"),
+					// We don't provide any, but GCP adds three and goog-dataproc-autozone is added internally, so expect 4.
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "effective_labels.%", "4"),
+				),
+			},
+			{
+				Config: testAccDataprocCluster_withLabels(rnd, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.with_labels", &cluster),
 
-					// We only provide one, but GCP adds three and we added goog-dataproc-autozone internally, so expect 5.
-					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "labels.%", "5"),
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "labels.%", "1"),
 					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "labels.key1", "value1"),
+					// We only provide one, but GCP adds three and goog-dataproc-autozone is added internally, so expect 5.
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "effective_labels.%", "5"),
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "effective_labels.key1", "value1"),
+				),
+			},
+			{
+				Config: testAccDataprocCluster_withLabelsUpdate(rnd, subnetworkName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.with_labels", &cluster),
+
+					// We only provide two, so expect 2.
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "labels.%", "1"),
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "labels.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccDataprocCluster_withoutLabels(rnd, subnetworkName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.with_labels", &cluster),
+
+					resource.TestCheckNoResourceAttr("google_dataproc_cluster.with_labels", "labels.%"),
+					// We don't provide any, but GCP adds three and goog-dataproc-autozone is added internally, so expect 4.
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "effective_labels.%", "4"),
 				),
 			},
 		},
@@ -730,13 +877,17 @@ func TestAccDataprocCluster_withEndpointConfig(t *testing.T) {
 
 	var cluster dataproc.Cluster
 	rnd := acctest.RandString(t, 10)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocCluster_withEndpointConfig(rnd),
+				Config: testAccDataprocCluster_withEndpointConfig(rnd, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.with_endpoint_config", &cluster),
 					resource.TestCheckResourceAttr("google_dataproc_cluster.with_endpoint_config", "cluster_config.0.endpoint_config.0.enable_http_port_access", "true"),
@@ -751,6 +902,9 @@ func TestAccDataprocCluster_KMS(t *testing.T) {
 
 	rnd := acctest.RandString(t, 10)
 	kms := acctest.BootstrapKMSKey(t)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
 
 	if acctest.BootstrapPSARole(t, "service-", "compute-system", "roles/cloudkms.cryptoKeyEncrypterDecrypter") {
 		t.Fatal("Stopping the test because a role was added to the policy.")
@@ -763,7 +917,7 @@ func TestAccDataprocCluster_KMS(t *testing.T) {
 		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocCluster_KMS(rnd, kms.CryptoKey.Name),
+				Config: testAccDataprocCluster_KMS(rnd, kms.CryptoKey.Name, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.kms", &cluster),
 				),
@@ -777,6 +931,9 @@ func TestAccDataprocCluster_withKerberos(t *testing.T) {
 
 	rnd := acctest.RandString(t, 10)
 	kms := acctest.BootstrapKMSKey(t)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
 
 	var cluster dataproc.Cluster
 	acctest.VcrTest(t, resource.TestCase{
@@ -785,7 +942,7 @@ func TestAccDataprocCluster_withKerberos(t *testing.T) {
 		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocCluster_withKerberos(rnd, kms.CryptoKey.Name),
+				Config: testAccDataprocCluster_withKerberos(rnd, kms.CryptoKey.Name, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.kerb", &cluster),
 				),
@@ -798,6 +955,9 @@ func TestAccDataprocCluster_withAutoscalingPolicy(t *testing.T) {
 	t.Parallel()
 
 	rnd := acctest.RandString(t, 10)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
 
 	var cluster dataproc.Cluster
 	acctest.VcrTest(t, resource.TestCase{
@@ -806,14 +966,14 @@ func TestAccDataprocCluster_withAutoscalingPolicy(t *testing.T) {
 		CheckDestroy:             testAccCheckDataprocClusterDestroy(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocCluster_withAutoscalingPolicy(rnd),
+				Config: testAccDataprocCluster_withAutoscalingPolicy(rnd, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.basic", &cluster),
 					testAccCheckDataprocClusterAutoscaling(t, &cluster, true),
 				),
 			},
 			{
-				Config: testAccDataprocCluster_removeAutoscalingPolicy(rnd),
+				Config: testAccDataprocCluster_removeAutoscalingPolicy(rnd, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.basic", &cluster),
 					testAccCheckDataprocClusterAutoscaling(t, &cluster, false),
@@ -1117,8 +1277,7 @@ resource "google_dataproc_cluster" "basic" {
 `, rnd)
 }
 
-<% if version == "ga" -%>
-func testAccDataprocVirtualCluster_basic(projectID string, rnd string) string {
+func testAccDataprocVirtualCluster_basic(projectID, rnd, networkName, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_project" "project" {
   project_id = "%s"
@@ -1127,12 +1286,15 @@ data "google_project" "project" {
 resource "google_container_cluster" "primary" {
   name     = "tf-test-gke-%s"
   location = "us-central1-a"
+  network    = "%s"
+  subnetwork    = "%s"
 
   initial_node_count = 1
 
   workload_identity_config {
     workload_pool = "${data.google_project.project.project_id}.svc.id.goog"
   }
+  deletion_protection = false
 }
 
 resource "google_project_iam_binding" "workloadidentity" {
@@ -1174,9 +1336,8 @@ resource "google_dataproc_cluster" "virtual_cluster" {
 	  }
 	}
   }
-`, projectID, rnd, projectID, rnd, rnd, rnd, rnd, rnd, rnd)
+`, projectID, rnd, networkName, subnetworkName, projectID, rnd, rnd, rnd, rnd, rnd, rnd)
 }
-<% end -%>
 
 func testAccCheckDataprocGkeClusterNodePoolsHaveRoles(cluster *dataproc.Cluster, roles ...string) func(s *terraform.State) error {
 	return func(s *terraform.State) error {
@@ -1191,7 +1352,7 @@ func testAccCheckDataprocGkeClusterNodePoolsHaveRoles(cluster *dataproc.Cluster,
 	}
 }
 
-func testAccDataprocCluster_withAccelerators(rnd, acceleratorType, zone string) string {
+func testAccDataprocCluster_withAccelerators(rnd, acceleratorType, zone, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_dataproc_cluster" "accelerated_cluster" {
   name   = "tf-test-dproc-%s"
@@ -1199,6 +1360,7 @@ resource "google_dataproc_cluster" "accelerated_cluster" {
 
   cluster_config {
     gce_cluster_config {
+      subnetwork = "%s"
       zone = "%s"
     }
 
@@ -1217,7 +1379,7 @@ resource "google_dataproc_cluster" "accelerated_cluster" {
     }
   }
 }
-`, rnd, zone, acceleratorType, acceleratorType)
+`, rnd, subnetworkName, zone, acceleratorType, acceleratorType)
 }
 
 func testAccDataprocCluster_withInternalIpOnlyTrueAndShieldedConfig(rnd string) string {
@@ -1292,7 +1454,7 @@ resource "google_dataproc_cluster" "basic" {
 `, rnd, rnd, rnd, rnd)
 }
 
-func testAccDataprocCluster_withMetadataAndTags(rnd string) string {
+func testAccDataprocCluster_withMetadataAndTags(rnd, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_dataproc_cluster" "basic" {
   name   = "tf-test-dproc-%s"
@@ -1300,6 +1462,7 @@ resource "google_dataproc_cluster" "basic" {
 
   cluster_config {
     gce_cluster_config {
+      subnetwork = "%s"
       metadata = {
         foo = "bar"
         baz = "qux"
@@ -1308,10 +1471,32 @@ resource "google_dataproc_cluster" "basic" {
     }
   }
 }
-`, rnd)
+`, rnd, subnetworkName)
 }
 
-func testAccDataprocCluster_withReservationAffinity(rnd string) string {
+func testAccDataprocCluster_withMinNumInstances(rnd, subnetworkName string) string {
+	return fmt.Sprintf(`
+resource "google_dataproc_cluster" "with_min_num_instances" {
+  name   = "tf-test-dproc-%s"
+  region = "us-central1"
+ 
+  cluster_config {
+    gce_cluster_config {
+      subnetwork = "%s"
+    }
+    master_config{
+      num_instances=1
+    }
+    worker_config{
+      num_instances = 3
+      min_num_instances = 2
+    }
+  }
+}
+`, rnd, subnetworkName)
+}
+
+func testAccDataprocCluster_withReservationAffinity(rnd, subnetworkName string) string {
 	return fmt.Sprintf(`
 
 resource "google_compute_reservation" "reservation" {
@@ -1332,7 +1517,6 @@ resource "google_dataproc_cluster" "basic" {
   region = "us-central1"
 
   cluster_config {
-
     master_config {
       machine_type  = "n1-standard-2"
     }
@@ -1342,6 +1526,7 @@ resource "google_dataproc_cluster" "basic" {
     }
 
     gce_cluster_config {
+      subnetwork = "%s"
       zone = "us-central1-f"
       reservation_affinity {
         consume_reservation_type = "SPECIFIC_RESERVATION"
@@ -1351,16 +1536,19 @@ resource "google_dataproc_cluster" "basic" {
     }
   }
 }
-`, rnd, rnd)
+`, rnd, rnd, subnetworkName)
 }
 
-func testAccDataprocCluster_withDataprocMetricConfig(rnd string) string {
+func testAccDataprocCluster_withDataprocMetricConfig(rnd, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_dataproc_cluster" "basic" {
   name   = "tf-test-dproc-%s"
   region = "us-central1"
 
   cluster_config {
+    gce_cluster_config {
+      subnetwork = "%s"
+    }
     dataproc_metric_config {
       metrics {
         metric_source = "HDFS"
@@ -1374,10 +1562,10 @@ resource "google_dataproc_cluster" "basic" {
     }
   }
 }
-`, rnd)
+`, rnd, subnetworkName)
 }
 
-func testAccDataprocCluster_withNodeGroupAffinity(rnd string) string {
+func testAccDataprocCluster_withNodeGroupAffinity(rnd, subnetworkName string) string {
 	return fmt.Sprintf(`
 
 resource "google_compute_node_template" "nodetmpl" {
@@ -1397,7 +1585,7 @@ resource "google_compute_node_group" "nodes" {
   name = "test-nodegroup-%s"
   zone = "us-central1-f"
 
-  size          = 3
+  initial_size	= 3
   node_template = google_compute_node_template.nodetmpl.self_link
 }
 
@@ -1407,6 +1595,7 @@ resource "google_dataproc_cluster" "basic" {
 
   cluster_config {
     gce_cluster_config {
+      subnetwork = "%s"
       zone = "us-central1-f"
       node_group_affinity {
         node_group_uri = google_compute_node_group.nodes.name
@@ -1414,16 +1603,20 @@ resource "google_dataproc_cluster" "basic" {
     }
   }
 }
-`, rnd, rnd, rnd)
+`, rnd, rnd, rnd, subnetworkName)
 }
 
-func testAccDataprocCluster_singleNodeCluster(rnd string) string {
+func testAccDataprocCluster_singleNodeCluster(rnd, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_dataproc_cluster" "single_node_cluster" {
   name   = "tf-test-dproc-%s"
   region = "us-central1"
 
   cluster_config {
+    gce_cluster_config {
+      subnetwork = "%s"
+    }
+
     # Keep the costs down with smallest config we can get away with
     software_config {
       override_properties = {
@@ -1432,16 +1625,19 @@ resource "google_dataproc_cluster" "single_node_cluster" {
     }
   }
 }
-`, rnd)
+`, rnd, subnetworkName)
 }
 
-func testAccDataprocCluster_withConfigOverrides(rnd string) string {
+func testAccDataprocCluster_withConfigOverrides(rnd, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_dataproc_cluster" "with_config_overrides" {
   name     = "tf-test-dproc-%s"
   region   = "us-central1"
 
   cluster_config {
+    gce_cluster_config {
+      subnetwork = "%s"
+    }
     master_config {
       num_instances = 3
       machine_type  = "n1-standard-2"  // can't be e2 because of min_cpu_platform
@@ -1474,10 +1670,10 @@ resource "google_dataproc_cluster" "with_config_overrides" {
     }
   }
 }
-`, rnd)
+`, rnd, subnetworkName)
 }
 
-func testAccDataprocCluster_withInitAction(rnd, bucket, objName string) string {
+func testAccDataprocCluster_withInitAction(rnd, bucket, objName, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_storage_bucket" "init_bucket" {
   name          = "%s"
@@ -1501,6 +1697,10 @@ resource "google_dataproc_cluster" "with_init_action" {
   region = "us-central1"
 
   cluster_config {
+    gce_cluster_config {
+      subnetwork = "%s"
+    }
+
     # Keep the costs down with smallest config we can get away with
     software_config {
       override_properties = {
@@ -1524,7 +1724,7 @@ resource "google_dataproc_cluster" "with_init_action" {
     }
   }
 }
-`, bucket, rnd, objName, objName, rnd)
+`, bucket, rnd, objName, objName, rnd, subnetworkName)
 }
 
 func testAccDataprocCluster_updatable(rnd string, w, p int) string {
@@ -1562,48 +1762,56 @@ resource "google_dataproc_cluster" "updatable" {
 `, rnd, w, p)
 }
 
-func testAccDataprocCluster_nonPreemptibleSecondary(rnd string) string {
+func testAccDataprocCluster_nonPreemptibleSecondary(rnd, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_dataproc_cluster" "non_preemptible_secondary" {
   name   = "tf-test-dproc-%s"
   region = "us-central1"
 
   cluster_config {
+    gce_cluster_config {
+      subnetwork = "%s"
+    }
+
     master_config {
-	  num_instances = "1"
-	  machine_type  = "e2-medium"
-	  disk_config {
-		boot_disk_size_gb = 35
-	  }
-	}
+      num_instances = "1"
+      machine_type  = "e2-medium"
+      disk_config {
+        boot_disk_size_gb = 35
+      }
+    }
   
-	worker_config {
-	  num_instances = "2"
-	  machine_type  = "e2-medium"
-	  disk_config {
-		boot_disk_size_gb = 35
-	  }
-	}
+    worker_config {
+      num_instances = "2"
+      machine_type  = "e2-medium"
+      disk_config {
+        boot_disk_size_gb = 35
+      }
+    }
   
-	preemptible_worker_config {
-	  num_instances = "1"
-	  preemptibility = "NON_PREEMPTIBLE"
-	  disk_config {
-		boot_disk_size_gb = 35
-	  }
-	}
+    preemptible_worker_config {
+      num_instances = "1"
+      preemptibility = "NON_PREEMPTIBLE"
+      disk_config {
+        boot_disk_size_gb = 35
+      }
+    }
   }
 }
-	`, rnd)
+	`, rnd, subnetworkName)
 }
 
-func testAccDataprocCluster_spotSecondary(rnd string) string {
+func testAccDataprocCluster_spotSecondary(rnd, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_dataproc_cluster" "spot_secondary" {
   name   = "tf-test-dproc-%s"
   region = "us-central1"
 
   cluster_config {
+    gce_cluster_config {
+      subnetwork = "%s"
+    }
+
     master_config {
       num_instances = "1"
       machine_type  = "e2-medium"
@@ -1628,6 +1836,47 @@ resource "google_dataproc_cluster" "spot_secondary" {
       }
     }
   }
+}
+	`, rnd, subnetworkName)
+}
+
+func testAccDataprocCluster_spotWithInstanceFlexibilityPolicy(rnd string) string {
+	return fmt.Sprintf(`
+resource "google_dataproc_cluster" "spot_with_instance_flexibility_policy" {
+  name   = "tf-test-dproc-%s"
+  region = "us-central1"
+
+  cluster_config {
+    master_config {
+      num_instances = "1"
+      machine_type  = "e2-medium"
+      disk_config {
+        boot_disk_size_gb = 35
+      }
+    }
+
+    worker_config {
+      num_instances = "2"
+      machine_type  = "e2-medium"
+      disk_config {
+        boot_disk_size_gb = 35
+      }
+    }
+
+    preemptible_worker_config {
+      num_instances = "3"
+      preemptibility = "SPOT"
+      disk_config {
+        boot_disk_size_gb = 35
+      }
+	  instance_flexibility_policy {
+        instance_selection_list {
+          machine_types = ["n2d-standard-2"]
+          rank          = 3
+        }
+      }
+    }
+  }
 }
 	`, rnd)
 }
@@ -1652,7 +1901,7 @@ resource "google_storage_bucket" "bucket" {
 `, bucketName)
 }
 
-func testAccDataprocCluster_withStagingBucketAndCluster(clusterName, bucketName string) string {
+func testAccDataprocCluster_withStagingBucketAndCluster(clusterName, bucketName, subnetworkName string) string {
 	return fmt.Sprintf(`
 %s
 
@@ -1663,6 +1912,10 @@ resource "google_dataproc_cluster" "with_bucket" {
   cluster_config {
     staging_bucket = google_storage_bucket.bucket.name
 
+    gce_cluster_config {
+      subnetwork = "%s"
+    }
+
     # Keep the costs down with smallest config we can get away with
     software_config {
       override_properties = {
@@ -1678,10 +1931,10 @@ resource "google_dataproc_cluster" "with_bucket" {
     }
   }
 }
-`, testAccDataprocCluster_withStagingBucketOnly(bucketName), clusterName)
+`, testAccDataprocCluster_withStagingBucketOnly(bucketName), clusterName, subnetworkName)
 }
 
-func testAccDataprocCluster_withTempBucketAndCluster(clusterName, bucketName string) string {
+func testAccDataprocCluster_withTempBucketAndCluster(clusterName, bucketName, subnetworkName string) string {
 	return fmt.Sprintf(`
 %s
 
@@ -1692,6 +1945,10 @@ resource "google_dataproc_cluster" "with_bucket" {
   cluster_config {
     temp_bucket = google_storage_bucket.bucket.name
 
+    gce_cluster_config {
+      subnetwork = "%s"
+    }
+
     # Keep the costs down with smallest config we can get away with
     software_config {
       override_properties = {
@@ -1707,98 +1964,155 @@ resource "google_dataproc_cluster" "with_bucket" {
     }
   }
 }
-`, testAccDataprocCluster_withTempBucketOnly(bucketName), clusterName)
+`, testAccDataprocCluster_withTempBucketOnly(bucketName), clusterName, subnetworkName)
 }
 
-func testAccDataprocCluster_withLabels(rnd string) string {
+func testAccDataprocCluster_withLabels(rnd, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_dataproc_cluster" "with_labels" {
   name   = "tf-test-dproc-%s"
   region = "us-central1"
+  cluster_config {
+    gce_cluster_config {
+      subnetwork = "%s"
+    }
+  }
 
   labels = {
     key1 = "value1"
   }
 }
-`, rnd)
+`, rnd, subnetworkName)
 }
 
-func testAccDataprocCluster_withEndpointConfig(rnd string) string {
+func testAccDataprocCluster_withLabelsUpdate(rnd, subnetworkName string) string {
+	return fmt.Sprintf(`
+resource "google_dataproc_cluster" "with_labels" {
+  name   = "tf-test-dproc-%s"
+  region = "us-central1"
+  cluster_config {
+    gce_cluster_config {
+      subnetwork = "%s"
+    }
+  }
+
+  labels = {
+    key2 = "value2"
+  }
+}
+`, rnd, subnetworkName)
+}
+
+func testAccDataprocCluster_withoutLabels(rnd, subnetworkName string) string {
+	return fmt.Sprintf(`
+resource "google_dataproc_cluster" "with_labels" {
+  name   = "tf-test-dproc-%s"
+  region = "us-central1"
+  cluster_config {
+    gce_cluster_config {
+      subnetwork = "%s"
+    }
+  }
+}
+`, rnd, subnetworkName)
+}
+
+func testAccDataprocCluster_withEndpointConfig(rnd, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_dataproc_cluster" "with_endpoint_config" {
 	name                  = "tf-test-%s"
 	region                = "us-central1"
 
 	cluster_config {
+    gce_cluster_config {
+      subnetwork = "%s"
+    }
+
 		endpoint_config {
 			enable_http_port_access = "true"
 		}
 	}
 }
-`, rnd)
+`, rnd, subnetworkName)
 }
 
-func testAccDataprocCluster_withImageVersion(rnd, version string) string {
+func testAccDataprocCluster_withImageVersion(rnd, version, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_dataproc_cluster" "with_image_version" {
   name   = "tf-test-dproc-%s"
   region = "us-central1"
 
   cluster_config {
+    gce_cluster_config {
+      subnetwork = "%s"
+    }
+
     software_config {
       image_version = "%s"
     }
   }
 }
-`, rnd, version)
+`, rnd, subnetworkName, version)
 }
 
-func testAccDataprocCluster_withOptionalComponents(rnd string) string {
+func testAccDataprocCluster_withOptionalComponents(rnd, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_dataproc_cluster" "with_opt_components" {
   name   = "tf-test-dproc-%s"
   region = "us-central1"
 
   cluster_config {
+    gce_cluster_config {
+      subnetwork = "%s"
+    }
+
     software_config {
       optional_components = ["DOCKER", "ZOOKEEPER"]
     }
   }
 }
-`, rnd)
+`, rnd, subnetworkName)
 }
 
-func testAccDataprocCluster_withLifecycleConfigIdleDeleteTtl(rnd, tm string) string {
+func testAccDataprocCluster_withLifecycleConfigIdleDeleteTtl(rnd, tm, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_dataproc_cluster" "with_lifecycle_config" {
   name   = "tf-test-dproc-%s"
   region = "us-central1"
 
   cluster_config {
+    gce_cluster_config {
+      subnetwork = "%s"
+    }
+
     lifecycle_config {
       idle_delete_ttl = "%s"
     }
   }
 }
-`, rnd, tm)
+`, rnd, subnetworkName, tm)
 }
 
-func testAccDataprocCluster_withLifecycleConfigAutoDeletionTime(rnd, tm string) string {
+func testAccDataprocCluster_withLifecycleConfigAutoDeletionTime(rnd, tm, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_dataproc_cluster" "with_lifecycle_config" {
  name   = "tf-test-dproc-%s"
  region = "us-central1"
 
  cluster_config {
+  gce_cluster_config {
+      subnetwork = "%s"
+    }
+
    lifecycle_config {
      auto_delete_time = "%s"
    }
  }
 }
-`, rnd, tm)
+`, rnd, subnetworkName, tm)
 }
 
-func testAccDataprocCluster_withServiceAcc(sa string, rnd string) string {
+func testAccDataprocCluster_withServiceAcc(sa, rnd, subnetworkName string) string {
 	return fmt.Sprintf(`
 data "google_project" "project" {}
 
@@ -1832,6 +2146,7 @@ resource "google_dataproc_cluster" "with_service_account" {
     }
 
     gce_cluster_config {
+      subnetwork = "%s"
       service_account = google_service_account.service_account.email
       service_account_scopes = [
 		#	User supplied scopes
@@ -1850,7 +2165,7 @@ resource "google_dataproc_cluster" "with_service_account" {
 
   depends_on = [google_project_iam_member.service_account]
 }
-`, sa, rnd)
+`, sa, rnd, subnetworkName)
 }
 
 func testAccDataprocCluster_withNetworkRefs(rnd, netName string) string {
@@ -1894,6 +2209,7 @@ resource "google_dataproc_cluster" "with_net_ref_by_name" {
   depends_on = [google_compute_firewall.dataproc_network_firewall]
 
   cluster_config {
+
     # Keep the costs down with smallest config we can get away with
     software_config {
       override_properties = {
@@ -1920,6 +2236,7 @@ resource "google_dataproc_cluster" "with_net_ref_by_url" {
   depends_on = [google_compute_firewall.dataproc_network_firewall]
 
   cluster_config {
+
     # Keep the costs down with smallest config we can get away with
     software_config {
       override_properties = {
@@ -1942,22 +2259,26 @@ resource "google_dataproc_cluster" "with_net_ref_by_url" {
 `, netName, rnd, rnd, rnd)
 }
 
-func testAccDataprocCluster_KMS(rnd, kmsKey string) string {
+func testAccDataprocCluster_KMS(rnd, kmsKey, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_dataproc_cluster" "kms" {
   name   = "tf-test-dproc-%s"
   region = "us-central1"
 
   cluster_config {
+    gce_cluster_config {
+      subnetwork = "%s"
+    }
+
     encryption_config {
       kms_key_name = "%s"
     }
   }
 }
-`, rnd, kmsKey)
+`, rnd, subnetworkName, kmsKey)
 }
 
-func testAccDataprocCluster_withKerberos(rnd, kmsKey string) string {
+func testAccDataprocCluster_withKerberos(rnd, kmsKey, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_storage_bucket" "bucket" {
   name     = "tf-test-dproc-%s"
@@ -1974,6 +2295,10 @@ resource "google_dataproc_cluster" "kerb" {
   region = "us-central1"
 
   cluster_config {
+    gce_cluster_config {
+      subnetwork = "%s"
+    }
+
     security_config {
       kerberos_config {
         root_principal_password_uri = google_storage_bucket_object.password.self_link
@@ -1982,16 +2307,20 @@ resource "google_dataproc_cluster" "kerb" {
     }
   }
 }
-`, rnd, rnd, rnd, kmsKey)
+`, rnd, rnd, rnd, subnetworkName, kmsKey)
 }
 
-func testAccDataprocCluster_withAutoscalingPolicy(rnd string) string {
+func testAccDataprocCluster_withAutoscalingPolicy(rnd, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_dataproc_cluster" "basic" {
   name     = "tf-test-dataproc-policy-%s"
   region   = "us-central1"
 
   cluster_config {
+    gce_cluster_config {
+      subnetwork = "%s"
+    }
+
     autoscaling_config {
       policy_uri = google_dataproc_autoscaling_policy.asp.id
     }
@@ -2014,16 +2343,20 @@ resource "google_dataproc_autoscaling_policy" "asp" {
     }
   }
 }
-`, rnd, rnd)
+`, rnd, subnetworkName, rnd)
 }
 
-func testAccDataprocCluster_removeAutoscalingPolicy(rnd string) string {
+func testAccDataprocCluster_removeAutoscalingPolicy(rnd, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_dataproc_cluster" "basic" {
   name     = "tf-test-dataproc-policy-%s"
   region   = "us-central1"
 
   cluster_config {
+    gce_cluster_config {
+      subnetwork = "%s"
+    }
+
     autoscaling_config {
       policy_uri = ""
     }
@@ -2046,36 +2379,36 @@ resource "google_dataproc_autoscaling_policy" "asp" {
     }
   }
 }
-`, rnd, rnd)
+`, rnd, subnetworkName, rnd)
 }
 
 func testAccDataprocCluster_withMetastoreConfig(clusterName, serviceId string) string {
 	return fmt.Sprintf(`
 resource "google_dataproc_cluster" "with_metastore_config" {
-	name                  = "%s"
-	region                = "us-central1"
+  name                  = "%s"
+  region                = "us-central1"
 
-	cluster_config {
-		metastore_config {
-			dataproc_metastore_service = google_dataproc_metastore_service.ms.name
-		}
-	}
+  cluster_config {
+    metastore_config {
+      dataproc_metastore_service = google_dataproc_metastore_service.ms.name
+    }
+  }
 }
 
 resource "google_dataproc_metastore_service" "ms" {
-	service_id = "%s"
-	location   = "us-central1"
-	port       = 9080
-	tier       = "DEVELOPER"
-
-	maintenance_window {
-		hour_of_day = 2
-		day_of_week = "SUNDAY"
-	}
+  service_id = "%s"
+  location   = "us-central1"
+  port       = 9080
+  tier       = "DEVELOPER"
+
+  maintenance_window {
+    hour_of_day = 2
+    day_of_week = "SUNDAY"
+  }
 
-	hive_metastore_config {
-		version = "3.1.2"
-	}
+  hive_metastore_config {
+    version = "3.1.2"
+  }
 }
 `, clusterName, serviceId)
 }
@@ -2083,30 +2416,30 @@ resource "google_dataproc_metastore_service" "ms" {
 func testAccDataprocCluster_withMetastoreConfig_update(clusterName, serviceId string) string {
 	return fmt.Sprintf(`
 resource "google_dataproc_cluster" "with_metastore_config" {
-	name                  = "%s"
-	region                = "us-central1"
+  name                  = "%s"
+  region                = "us-central1"
 
-	cluster_config {
-		metastore_config {
-			dataproc_metastore_service = google_dataproc_metastore_service.ms.name
-		}
-	}
+  cluster_config {
+    metastore_config {
+      dataproc_metastore_service = google_dataproc_metastore_service.ms.name
+    }
+  }
 }
 
 resource "google_dataproc_metastore_service" "ms" {
-	service_id = "%s"
-	location   = "us-central1"
-	port       = 9080
-	tier       = "DEVELOPER"
-
-	maintenance_window {
-		hour_of_day = 2
-		day_of_week = "SUNDAY"
-	}
+  service_id = "%s"
+  location   = "us-central1"
+  port       = 9080
+  tier       = "DEVELOPER"
+
+  maintenance_window {
+    hour_of_day = 2
+    day_of_week = "SUNDAY"
+  }
 
-	hive_metastore_config {
-		version = "3.1.2"
-	}
+  hive_metastore_config {
+    version = "3.1.2"
+  }
 }
 `, clusterName, serviceId)
 }
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/services/dataproc/resource_dataproc_cluster_upgrade_test.go b/mmv1/third_party/terraform/services/dataproc/resource_dataproc_cluster_upgrade_test.go
new file mode 100644
index 000000000000..bc8b96ac1023
--- /dev/null
+++ b/mmv1/third_party/terraform/services/dataproc/resource_dataproc_cluster_upgrade_test.go
@@ -0,0 +1,175 @@
+package dataproc_test
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+
+	"google.golang.org/api/dataproc/v1"
+
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+)
+
+// Tests schema version migration by creating a cluster with an old version of the provider (4.65.0)
+// and then updating it with the current version the provider.
+func TestAccDataprocClusterLabelsMigration_withoutLabels_withoutChanges(t *testing.T) {
+	acctest.SkipIfVcr(t)
+	t.Parallel()
+
+	rnd := acctest.RandString(t, 10)
+	var cluster dataproc.Cluster
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
+	oldVersion := map[string]resource.ExternalProvider{
+		"google": {
+			VersionConstraint: "4.65.0", // a version that doesn't separate user defined labels and system labels
+			Source:            "registry.terraform.io/hashicorp/google",
+		},
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:     func() { acctest.AccTestPreCheck(t) },
+		CheckDestroy: testAccCheckDataprocClusterDestroy(t),
+		Steps: []resource.TestStep{
+			{
+				Config:            testAccDataprocCluster_withoutLabels(rnd, subnetworkName),
+				ExternalProviders: oldVersion,
+			},
+			{
+				Config:                   testAccDataprocCluster_withoutLabels(rnd, subnetworkName),
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.with_labels", &cluster),
+
+					resource.TestCheckNoResourceAttr("google_dataproc_cluster.with_labels", "labels.%"),
+					// GCP adds three and goog-dataproc-autozone is added internally, so expect 4.
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "effective_labels.%", "4"),
+				),
+			},
+			{
+				Config:                   testAccDataprocCluster_withLabels(rnd, subnetworkName),
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.with_labels", &cluster),
+
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "labels.%", "1"),
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "labels.key1", "value1"),
+					// We only provide one, but GCP adds three and goog-dataproc-autozone is added internally, so expect 5.
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "effective_labels.%", "5"),
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "effective_labels.key1", "value1"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccDataprocClusterLabelsMigration_withLabels_withoutChanges(t *testing.T) {
+	acctest.SkipIfVcr(t)
+	t.Parallel()
+
+	rnd := acctest.RandString(t, 10)
+	var cluster dataproc.Cluster
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
+	oldVersion := map[string]resource.ExternalProvider{
+		"google": {
+			VersionConstraint: "4.65.0", // a version that doesn't separate user defined labels and system labels
+			Source:            "registry.terraform.io/hashicorp/google",
+		},
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:     func() { acctest.AccTestPreCheck(t) },
+		CheckDestroy: testAccCheckDataprocClusterDestroy(t),
+		Steps: []resource.TestStep{
+			{
+				Config:            testAccDataprocCluster_withLabels(rnd, subnetworkName),
+				ExternalProviders: oldVersion,
+			},
+			{
+				Config:                   testAccDataprocCluster_withLabels(rnd, subnetworkName),
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.with_labels", &cluster),
+
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "labels.%", "1"),
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "labels.key1", "value1"),
+					// We only provide one, but GCP adds three and goog-dataproc-autozone is added internally, so expect 5.
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "effective_labels.%", "5"),
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "effective_labels.key1", "value1"),
+				),
+			},
+			{
+				Config:                   testAccDataprocCluster_withLabelsUpdate(rnd, subnetworkName),
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.with_labels", &cluster),
+
+					// We only provide one, so expect 1.
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "labels.%", "1"),
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "labels.key2", "value2"),
+					// We only provide one, but GCP adds three and goog-dataproc-autozone is added internally, so expect 5.
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "effective_labels.%", "5"),
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "effective_labels.key2", "value2"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccDataprocClusterLabelsMigration_withUpdate(t *testing.T) {
+	acctest.SkipIfVcr(t)
+	t.Parallel()
+
+	rnd := acctest.RandString(t, 10)
+	var cluster dataproc.Cluster
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
+	oldVersion := map[string]resource.ExternalProvider{
+		"google": {
+			VersionConstraint: "4.65.0", // a version that doesn't separate user defined labels and system labels
+			Source:            "registry.terraform.io/hashicorp/google",
+		},
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:     func() { acctest.AccTestPreCheck(t) },
+		CheckDestroy: testAccCheckDataprocClusterDestroy(t),
+		Steps: []resource.TestStep{
+			{
+				Config:            testAccDataprocCluster_withoutLabels(rnd, subnetworkName),
+				ExternalProviders: oldVersion,
+			},
+			{
+				Config:                   testAccDataprocCluster_withLabels(rnd, subnetworkName),
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.with_labels", &cluster),
+
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "labels.%", "1"),
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "labels.key1", "value1"),
+					// We only provide one, but GCP adds three and goog-dataproc-autozone is added internally, so expect 5.
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "effective_labels.%", "5"),
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "effective_labels.key1", "value1"),
+				),
+			},
+			{
+				Config:                   testAccDataprocCluster_withoutLabels(rnd, subnetworkName),
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDataprocClusterExists(t, "google_dataproc_cluster.with_labels", &cluster),
+
+					resource.TestCheckNoResourceAttr("google_dataproc_cluster.with_labels", "labels.%"),
+					// We only provide one, but GCP adds three and goog-dataproc-autozone is added internally, so expect 4.
+					resource.TestCheckResourceAttr("google_dataproc_cluster.with_labels", "effective_labels.%", "4"),
+				),
+			},
+		},
+	})
+}
diff --git a/mmv1/third_party/terraform/services/dataproc/resource_dataproc_job.go.erb b/mmv1/third_party/terraform/services/dataproc/resource_dataproc_job.go.erb
index 94cd75a6ed99..c51e7f5d19c5 100644
--- a/mmv1/third_party/terraform/services/dataproc/resource_dataproc_job.go.erb
+++ b/mmv1/third_party/terraform/services/dataproc/resource_dataproc_job.go.erb
@@ -11,6 +11,7 @@ import (
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 	"github.com/hashicorp/terraform-provider-google/google/verify"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"google.golang.org/api/dataproc/v1"
@@ -30,6 +31,11 @@ func ResourceDataprocJob() *schema.Resource {
 			Delete: schema.DefaultTimeout(20 * time.Minute),
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+			tpgresource.SetLabelsDiff,
+		),
+
 		Schema: map[string]*schema.Schema{
 			"project": {
 				Type:        schema.TypeString,
@@ -144,12 +150,30 @@ func ResourceDataprocJob() *schema.Resource {
 
 			"labels": {
 				Type:        schema.TypeMap,
-				Description: "Optional. The labels to associate with this job.",
+				Description: `Optional. The labels to associate with this job.
+
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
 				Optional:    true,
 				ForceNew:    true,
 				Elem:        &schema.Schema{Type: schema.TypeString},
 			},
 
+			"terraform_labels": {
+				Type:        schema.TypeMap,
+				Computed:    true,
+				Description: `The combination of labels configured directly on the resource and default labels configured on the provider.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+			},
+
+			"effective_labels": {
+				Type:        schema.TypeMap,
+				Computed:    true,
+				ForceNew:    true,
+				Description: `All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+			},
+
 			"scheduling": {
 				Type:        schema.TypeList,
 				Description: "Optional. Job scheduling configuration.",
@@ -230,8 +254,8 @@ func resourceDataprocJobCreate(d *schema.ResourceData, meta interface{}) error {
 		submitReq.Job.Scheduling = expandJobScheduling(config)
 	}
 
-	if _, ok := d.GetOk("labels"); ok {
-		submitReq.Job.Labels = tpgresource.ExpandLabels(d)
+	if _, ok := d.GetOk("effective_labels"); ok {
+		submitReq.Job.Labels = tpgresource.ExpandEffectiveLabels(d)
 	}
 
 	if v, ok := d.GetOk("pyspark_config"); ok {
@@ -311,9 +335,15 @@ func resourceDataprocJobRead(d *schema.ResourceData, meta interface{}) error {
 	if err := d.Set("force_delete", d.Get("force_delete")); err != nil {
 		return fmt.Errorf("Error setting force_delete: %s", err)
 	}
-	if err := d.Set("labels", job.Labels); err != nil {
+	if err := tpgresource.SetLabels(job.Labels, d, "labels"); err != nil {
 		return fmt.Errorf("Error setting labels: %s", err)
 	}
+	if err := tpgresource.SetLabels(job.Labels, d, "terraform_labels"); err != nil {
+		return fmt.Errorf("Error setting terraform_labels: %s", err)
+	}
+	if err := d.Set("effective_labels", job.Labels); err != nil {
+		return fmt.Errorf("Error setting effective_labels: %s", err)
+	}
 	if err := d.Set("driver_output_resource_uri", job.DriverOutputResourceUri); err != nil {
 		return fmt.Errorf("Error setting driver_output_resource_uri: %s", err)
 	}
diff --git a/mmv1/third_party/terraform/services/dataproc/resource_dataproc_job_test.go.erb b/mmv1/third_party/terraform/services/dataproc/resource_dataproc_job_test.go.erb
index c5e00cbf0494..07d166d4e637 100644
--- a/mmv1/third_party/terraform/services/dataproc/resource_dataproc_job_test.go.erb
+++ b/mmv1/third_party/terraform/services/dataproc/resource_dataproc_job_test.go.erb
@@ -50,20 +50,24 @@ func TestAccDataprocJob_updatable(t *testing.T) {
 	var job dataproc.Job
 	rnd := acctest.RandString(t, 10)
 	jobId := fmt.Sprintf("dproc-update-job-id-%s", rnd)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy:             testAccCheckDataprocJobDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocJob_updatable(rnd, jobId, "false"),
+				Config: testAccDataprocJob_updatable(rnd, subnetworkName, jobId, "false"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocJobExists(t, "google_dataproc_job.updatable", &job),
 					resource.TestCheckResourceAttr("google_dataproc_job.updatable", "force_delete", "false"),
 				),
 			},
 			{
-				Config: testAccDataprocJob_updatable(rnd, jobId, "true"),
+				Config: testAccDataprocJob_updatable(rnd, subnetworkName, jobId, "true"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocJobExists(t, "google_dataproc_job.updatable", &job),
 					resource.TestCheckResourceAttr("google_dataproc_job.updatable", "force_delete", "true"),
@@ -79,13 +83,17 @@ func TestAccDataprocJob_PySpark(t *testing.T) {
 	var job dataproc.Job
 	rnd := acctest.RandString(t, 10)
 	jobId := fmt.Sprintf("dproc-custom-job-id-%s", rnd)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy:             testAccCheckDataprocJobDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocJob_pySpark(rnd),
+				Config: testAccDataprocJob_pySpark(rnd, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 
 					testAccCheckDataprocJobExists(t, "google_dataproc_job.pyspark", &job),
@@ -117,13 +125,17 @@ func TestAccDataprocJob_Spark(t *testing.T) {
 
 	var job dataproc.Job
 	rnd := acctest.RandString(t, 10)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy:             testAccCheckDataprocJobDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocJob_spark(rnd),
+				Config: testAccDataprocJob_spark(rnd, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocJobExists(t, "google_dataproc_job.spark", &job),
 
@@ -149,13 +161,17 @@ func TestAccDataprocJob_Hadoop(t *testing.T) {
 
 	var job dataproc.Job
 	rnd := acctest.RandString(t, 10)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy:             testAccCheckDataprocJobDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocJob_hadoop(rnd),
+				Config: testAccDataprocJob_hadoop(rnd, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocJobExists(t, "google_dataproc_job.hadoop", &job),
 
@@ -181,13 +197,17 @@ func TestAccDataprocJob_Hive(t *testing.T) {
 
 	var job dataproc.Job
 	rnd := acctest.RandString(t, 10)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy:             testAccCheckDataprocJobDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocJob_hive(rnd),
+				Config: testAccDataprocJob_hive(rnd, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocJobExists(t, "google_dataproc_job.hive", &job),
 
@@ -213,13 +233,17 @@ func TestAccDataprocJob_Pig(t *testing.T) {
 
 	var job dataproc.Job
 	rnd := acctest.RandString(t, 10)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy:             testAccCheckDataprocJobDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocJob_pig(rnd),
+				Config: testAccDataprocJob_pig(rnd, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocJobExists(t, "google_dataproc_job.pig", &job),
 
@@ -245,13 +269,17 @@ func TestAccDataprocJob_SparkSql(t *testing.T) {
 
 	var job dataproc.Job
 	rnd := acctest.RandString(t, 10)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy:             testAccCheckDataprocJobDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocJob_sparksql(rnd),
+				Config: testAccDataprocJob_sparksql(rnd, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocJobExists(t, "google_dataproc_job.sparksql", &job),
 
@@ -277,13 +305,17 @@ func TestAccDataprocJob_Presto(t *testing.T) {
 
 	var job dataproc.Job
 	rnd := acctest.RandString(t, 10)
+	networkName := acctest.BootstrapSharedTestNetwork(t, "dataproc-cluster")
+	subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
+	acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)
+	
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy:             testAccCheckDataprocJobDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataprocJob_presto(rnd),
+				Config: testAccDataprocJob_presto(rnd, subnetworkName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataprocJobExists(t, "google_dataproc_job.presto", &job),
 
@@ -637,11 +669,15 @@ resource "google_dataproc_cluster" "basic" {
         boot_disk_size_gb = 35
       }
     }
+
+    gce_cluster_config {
+      subnetwork = "%s"
+    }
   }
 }
 `
 
-func testAccDataprocJob_updatable(rnd, jobId, del string) string {
+func testAccDataprocJob_updatable(rnd, subnetworkName, jobId, del string) string {
 	return fmt.Sprintf(
 		singleNodeClusterConfig+`
 resource "google_dataproc_job" "updatable" {
@@ -659,10 +695,10 @@ resource "google_dataproc_job" "updatable" {
     main_python_file_uri = "gs://dataproc-examples-2f10d78d114f6aaec76462e3c310f31f/src/pyspark/hello-world/hello-world.py"
   }
 }
-`, rnd, jobId, del)
+`, rnd, subnetworkName, jobId, del)
 }
 
-func testAccDataprocJob_pySpark(rnd string) string {
+func testAccDataprocJob_pySpark(rnd, subnetworkName string) string {
 	return fmt.Sprintf(
 		singleNodeClusterConfig+`
 resource "google_dataproc_job" "pyspark" {
@@ -697,10 +733,10 @@ resource "google_dataproc_job" "pyspark" {
     one = "1"
   }
 }
-`, rnd, rnd)
+`, rnd, subnetworkName, rnd)
 }
 
-func testAccDataprocJob_spark(rnd string) string {
+func testAccDataprocJob_spark(rnd, subnetworkName string) string {
 	return fmt.Sprintf(
 		singleNodeClusterConfig+`
 resource "google_dataproc_job" "spark" {
@@ -723,11 +759,11 @@ resource "google_dataproc_job" "spark" {
     }
   }
 }
-`, rnd)
+`, rnd, subnetworkName)
 
 }
 
-func testAccDataprocJob_hadoop(rnd string) string {
+func testAccDataprocJob_hadoop(rnd, subnetworkName string) string {
 	return fmt.Sprintf(
 		singleNodeClusterConfig+`
 resource "google_dataproc_job" "hadoop" {
@@ -746,11 +782,11 @@ resource "google_dataproc_job" "hadoop" {
     ]
   }
 }
-`, rnd, rnd)
+`, rnd, subnetworkName, rnd)
 
 }
 
-func testAccDataprocJob_hive(rnd string) string {
+func testAccDataprocJob_hive(rnd, subnetworkName string) string {
 	return fmt.Sprintf(
 		singleNodeClusterConfig+`
 resource "google_dataproc_job" "hive" {
@@ -768,11 +804,11 @@ resource "google_dataproc_job" "hive" {
     ]
   }
 }
-`, rnd)
+`, rnd, subnetworkName)
 
 }
 
-func testAccDataprocJob_pig(rnd string) string {
+func testAccDataprocJob_pig(rnd, subnetworkName string) string {
 	return fmt.Sprintf(
 		singleNodeClusterConfig+`
 resource "google_dataproc_job" "pig" {
@@ -792,11 +828,11 @@ resource "google_dataproc_job" "pig" {
     ]
   }
 }
-`, rnd)
+`, rnd, subnetworkName)
 
 }
 
-func testAccDataprocJob_sparksql(rnd string) string {
+func testAccDataprocJob_sparksql(rnd, subnetworkName string) string {
 	return fmt.Sprintf(
 		singleNodeClusterConfig+`
 resource "google_dataproc_job" "sparksql" {
@@ -814,11 +850,11 @@ resource "google_dataproc_job" "sparksql" {
     ]
   }
 }
-`, rnd)
+`, rnd, subnetworkName)
 
 }
 
-func testAccDataprocJob_presto(rnd string) string {
+func testAccDataprocJob_presto(rnd, subnetworkName string) string {
 	return fmt.Sprintf(`
 resource "google_dataproc_cluster" "basic" {
   name   = "dproc-job-test-%s"
@@ -830,7 +866,7 @@ resource "google_dataproc_cluster" "basic" {
       override_properties = {
         "dataproc:dataproc.allow.zero.workers" = "true"
       }
-	  optional_components = ["PRESTO"]
+      optional_components = ["PRESTO"]
     }
 
     master_config {
@@ -840,6 +876,10 @@ resource "google_dataproc_cluster" "basic" {
         boot_disk_size_gb = 35
       }
     }
+
+    gce_cluster_config {
+      subnetwork = "%s"
+    }
   }
 }
 
@@ -856,6 +896,6 @@ resource "google_dataproc_job" "presto" {
     ]
   }
 }
-`, rnd)
+`, rnd, subnetworkName)
 
 }
diff --git a/mmv1/third_party/terraform/services/dataproc/resource_dataproc_workflow_template_test.go.erb b/mmv1/third_party/terraform/services/dataproc/resource_dataproc_workflow_template_test.go.erb
index 65afbe1c1026..21988d0cb673 100644
--- a/mmv1/third_party/terraform/services/dataproc/resource_dataproc_workflow_template_test.go.erb
+++ b/mmv1/third_party/terraform/services/dataproc/resource_dataproc_workflow_template_test.go.erb
@@ -37,6 +37,10 @@ func TestAccDataprocWorkflowTemplate_basic(t *testing.T) {
       {
         ImportState:             true,
         ImportStateVerify:       true,
+        // The "labels" field in the state are decided by the configuration.
+        // During importing, as the configuration is unavailable, the "labels" field in the state will be empty.
+        // So add the "labels" to the ImportStateVerifyIgnore list.
+        ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
         ResourceName:            "google_dataproc_workflow_template.template",
       },
     },
@@ -124,6 +128,11 @@ resource "google_dataproc_workflow_template" "template" {
       query_file_uri = "someuri"
     }
   }
+
+  labels = {
+    env     = "foo"
+    somekey = "somevalue"
+  }
 }
 `, context)
 }
diff --git a/mmv1/third_party/terraform/services/dataprocmetastore/data_source_dataproc_metastore_service.go.erb b/mmv1/third_party/terraform/services/dataprocmetastore/data_source_dataproc_metastore_service.go.erb
index 6a351893759d..38225a1d54ad 100644
--- a/mmv1/third_party/terraform/services/dataprocmetastore/data_source_dataproc_metastore_service.go.erb
+++ b/mmv1/third_party/terraform/services/dataprocmetastore/data_source_dataproc_metastore_service.go.erb
@@ -28,5 +28,17 @@ func dataSourceDataprocMetastoreServiceRead(d *schema.ResourceData, meta interfa
 		return fmt.Errorf("Error constructing id: %s", err)
 	}
 	d.SetId(id)
-	return resourceDataprocMetastoreServiceRead(d, meta)
+	err = resourceDataprocMetastoreServiceRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if err := tpgresource.SetDataSourceLabels(d); err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/dataprocmetastore/data_source_dataproc_metastore_service_test.go.erb b/mmv1/third_party/terraform/services/dataprocmetastore/data_source_dataproc_metastore_service_test.go.erb
index 23832fffb79c..bb8ef1bcabdc 100644
--- a/mmv1/third_party/terraform/services/dataprocmetastore/data_source_dataproc_metastore_service_test.go.erb
+++ b/mmv1/third_party/terraform/services/dataprocmetastore/data_source_dataproc_metastore_service_test.go.erb
@@ -38,6 +38,10 @@ resource "google_dataproc_metastore_service" "my_metastore" {
 	hive_metastore_config {
 		version = "2.3.6"
 	}
+
+	labels = {
+		env = "test"
+	}
 }
 
 data "google_dataproc_metastore_service" "my_metastore" {
diff --git a/mmv1/third_party/terraform/services/datastream/resource_datastream_stream_test.go b/mmv1/third_party/terraform/services/datastream/resource_datastream_stream_test.go
index dde019ab0af1..ad71b868cd22 100644
--- a/mmv1/third_party/terraform/services/datastream/resource_datastream_stream_test.go
+++ b/mmv1/third_party/terraform/services/datastream/resource_datastream_stream_test.go
@@ -33,7 +33,7 @@ func TestAccDatastreamStream_update(t *testing.T) {
 				ResourceName:            "google_datastream_stream.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"stream_id", "location", "desired_state"},
+				ImportStateVerifyIgnore: []string{"stream_id", "location", "desired_state", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccDatastreamStream_datastreamStreamBasicUpdate(context, "RUNNING", true),
@@ -43,7 +43,7 @@ func TestAccDatastreamStream_update(t *testing.T) {
 				ResourceName:            "google_datastream_stream.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"stream_id", "location", "desired_state"},
+				ImportStateVerifyIgnore: []string{"stream_id", "location", "desired_state", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccDatastreamStream_datastreamStreamBasicUpdate(context, "PAUSED", true),
@@ -53,7 +53,7 @@ func TestAccDatastreamStream_update(t *testing.T) {
 				ResourceName:            "google_datastream_stream.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"stream_id", "location", "desired_state"},
+				ImportStateVerifyIgnore: []string{"stream_id", "location", "desired_state", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccDatastreamStream_datastreamStreamBasicUpdate(context, "RUNNING", true),
@@ -63,7 +63,7 @@ func TestAccDatastreamStream_update(t *testing.T) {
 				ResourceName:            "google_datastream_stream.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"stream_id", "location", "desired_state"},
+				ImportStateVerifyIgnore: []string{"stream_id", "location", "desired_state", "labels", "terraform_labels"},
 			},
 			{
 				// Disable prevent_destroy
diff --git a/mmv1/third_party/terraform/services/dialogflow/resource_dialogflow_agent_test.go.erb b/mmv1/third_party/terraform/services/dialogflow/resource_dialogflow_agent_test.go.erb
index 68b136a4c9c2..ca6a3cbedf58 100644
--- a/mmv1/third_party/terraform/services/dialogflow/resource_dialogflow_agent_test.go.erb
+++ b/mmv1/third_party/terraform/services/dialogflow/resource_dialogflow_agent_test.go.erb
@@ -45,6 +45,8 @@ func TestAccDialogflowAgent_update(t *testing.T) {
 }
 
 func testAccDialogflowAgent_full1(context map[string]interface{}) string {
+	// NOTE: we're creating a new project because you're only allowed one Agent per project
+	// -> to test creating an Agent you need to create the project too
 	return acctest.Nprintf(`
 	resource "google_project" "agent_project" {
 		name = "tf-test-dialogflow-%{random_suffix}"
diff --git a/mmv1/third_party/terraform/services/dialogflowcx/dialogflow_cx_operation.go b/mmv1/third_party/terraform/services/dialogflowcx/dialogflow_cx_operation.go
index 2198891aef13..582e9c2aa2e8 100644
--- a/mmv1/third_party/terraform/services/dialogflowcx/dialogflow_cx_operation.go
+++ b/mmv1/third_party/terraform/services/dialogflowcx/dialogflow_cx_operation.go
@@ -3,6 +3,7 @@ package dialogflowcx
 import (
 	"encoding/json"
 	"fmt"
+	"regexp"
 	"time"
 
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
@@ -13,7 +14,6 @@ type DialogflowCXOperationWaiter struct {
 	Config    *transport_tpg.Config
 	UserAgent string
 	tpgresource.CommonOperationWaiter
-	Location string
 }
 
 func (w *DialogflowCXOperationWaiter) QueryOp() (interface{}, error) {
@@ -21,7 +21,18 @@ func (w *DialogflowCXOperationWaiter) QueryOp() (interface{}, error) {
 		return nil, fmt.Errorf("Cannot query operation, it's unset or nil.")
 	}
 	// Returns the proper get.
-	url := fmt.Sprintf("https://%s-dialogflow.googleapis.com/v3/%s", w.Location, w.CommonOperationWaiter.Op.Name)
+	location := ""
+	if parts := regexp.MustCompile(`locations\/([^\/]*)\/`).FindStringSubmatch(w.CommonOperationWaiter.Op.Name); parts != nil {
+		location = parts[1]
+	} else {
+		return nil, fmt.Errorf(
+			"Saw %s when the op name is expected to contains location %s",
+			w.CommonOperationWaiter.Op.Name,
+			"projects/{{project}}/locations/{{location}}/...",
+		)
+	}
+
+	url := fmt.Sprintf("https://%s-dialogflow.googleapis.com/v3/%s", location, w.CommonOperationWaiter.Op.Name)
 
 	return transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
 		Config:    w.Config,
@@ -31,11 +42,10 @@ func (w *DialogflowCXOperationWaiter) QueryOp() (interface{}, error) {
 	})
 }
 
-func createDialogflowCXWaiter(config *transport_tpg.Config, op map[string]interface{}, activity, userAgent, location string) (*DialogflowCXOperationWaiter, error) {
+func createDialogflowCXWaiter(config *transport_tpg.Config, op map[string]interface{}, activity, userAgent string) (*DialogflowCXOperationWaiter, error) {
 	w := &DialogflowCXOperationWaiter{
 		Config:    config,
 		UserAgent: userAgent,
-		Location:  location,
 	}
 	if err := w.CommonOperationWaiter.SetOp(op); err != nil {
 		return nil, err
@@ -44,8 +54,8 @@ func createDialogflowCXWaiter(config *transport_tpg.Config, op map[string]interf
 }
 
 // nolint: deadcode,unused
-func DialogflowCXOperationWaitTimeWithResponse(config *transport_tpg.Config, op map[string]interface{}, response *map[string]interface{}, activity, userAgent, location string, timeout time.Duration) error {
-	w, err := createDialogflowCXWaiter(config, op, activity, userAgent, location)
+func DialogflowCXOperationWaitTimeWithResponse(config *transport_tpg.Config, op map[string]interface{}, response *map[string]interface{}, activity, userAgent string, timeout time.Duration) error {
+	w, err := createDialogflowCXWaiter(config, op, activity, userAgent)
 	if err != nil {
 		return err
 	}
@@ -55,12 +65,12 @@ func DialogflowCXOperationWaitTimeWithResponse(config *transport_tpg.Config, op
 	return json.Unmarshal([]byte(w.CommonOperationWaiter.Op.Response), response)
 }
 
-func DialogflowCXOperationWaitTime(config *transport_tpg.Config, op map[string]interface{}, activity, userAgent, location string, timeout time.Duration) error {
+func DialogflowCXOperationWaitTime(config *transport_tpg.Config, op map[string]interface{}, activity, userAgent string, timeout time.Duration) error {
 	if val, ok := op["name"]; !ok || val == "" {
 		// This was a synchronous call - there is no operation to wait for.
 		return nil
 	}
-	w, err := createDialogflowCXWaiter(config, op, activity, userAgent, location)
+	w, err := createDialogflowCXWaiter(config, op, activity, userAgent)
 	if err != nil {
 		// If w is nil, the op was synchronous.
 		return err
diff --git a/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflow_cx_environment.go b/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflow_cx_environment.go
deleted file mode 100644
index 086883aa0d4d..000000000000
--- a/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflow_cx_environment.go
+++ /dev/null
@@ -1,508 +0,0 @@
-package dialogflowcx
-
-import (
-	"fmt"
-	"log"
-	"reflect"
-	"regexp"
-	"strings"
-	"time"
-
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
-
-	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
-	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
-)
-
-func ResourceDialogflowCXEnvironment() *schema.Resource {
-	return &schema.Resource{
-		Create: resourceDialogflowCXEnvironmentCreate,
-		Read:   resourceDialogflowCXEnvironmentRead,
-		Update: resourceDialogflowCXEnvironmentUpdate,
-		Delete: resourceDialogflowCXEnvironmentDelete,
-
-		Importer: &schema.ResourceImporter{
-			State: resourceDialogflowCXEnvironmentImport,
-		},
-
-		Timeouts: &schema.ResourceTimeout{
-			Create: schema.DefaultTimeout(40 * time.Minute),
-			Update: schema.DefaultTimeout(40 * time.Minute),
-			Delete: schema.DefaultTimeout(20 * time.Minute),
-		},
-
-		Schema: map[string]*schema.Schema{
-			"display_name": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: validation.StringLenBetween(0, 64),
-				Description:  `The human-readable name of the environment (unique in an agent). Limit of 64 characters.`,
-			},
-			"version_configs": {
-				Type:        schema.TypeList,
-				Required:    true,
-				Description: `A list of configurations for flow versions. You should include version configs for all flows that are reachable from [Start Flow][Agent.start_flow] in the agent. Otherwise, an error will be returned.`,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"version": {
-							Type:        schema.TypeString,
-							Required:    true,
-							Description: `Format: projects/{{project}}/locations/{{location}}/agents/{{agent}}/flows/{{flow}}/versions/{{version}}.`,
-						},
-					},
-				},
-			},
-			"description": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: validation.StringLenBetween(0, 500),
-				Description:  `The human-readable description of the environment. The maximum length is 500 characters. If exceeded, the request is rejected.`,
-			},
-			"parent": {
-				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: true,
-				Description: `The Agent to create an Environment for.
-Format: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>.`,
-			},
-			"name": {
-				Type:        schema.TypeString,
-				Computed:    true,
-				Description: `The name of the environment.`,
-			},
-			"update_time": {
-				Type:        schema.TypeString,
-				Computed:    true,
-				Description: `Update time of this environment. A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".`,
-			},
-		},
-		UseJSONNumber: true,
-	}
-}
-
-func resourceDialogflowCXEnvironmentCreate(d *schema.ResourceData, meta interface{}) error {
-	config := meta.(*transport_tpg.Config)
-	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
-	if err != nil {
-		return err
-	}
-
-	obj := make(map[string]interface{})
-	displayNameProp, err := expandDialogflowCXEnvironmentDisplayName(d.Get("display_name"), d, config)
-	if err != nil {
-		return err
-	} else if v, ok := d.GetOkExists("display_name"); !tpgresource.IsEmptyValue(reflect.ValueOf(displayNameProp)) && (ok || !reflect.DeepEqual(v, displayNameProp)) {
-		obj["displayName"] = displayNameProp
-	}
-	descriptionProp, err := expandDialogflowCXEnvironmentDescription(d.Get("description"), d, config)
-	if err != nil {
-		return err
-	} else if v, ok := d.GetOkExists("description"); !tpgresource.IsEmptyValue(reflect.ValueOf(descriptionProp)) && (ok || !reflect.DeepEqual(v, descriptionProp)) {
-		obj["description"] = descriptionProp
-	}
-	versionConfigsProp, err := expandDialogflowCXEnvironmentVersionConfigs(d.Get("version_configs"), d, config)
-	if err != nil {
-		return err
-	} else if v, ok := d.GetOkExists("version_configs"); !tpgresource.IsEmptyValue(reflect.ValueOf(versionConfigsProp)) && (ok || !reflect.DeepEqual(v, versionConfigsProp)) {
-		obj["versionConfigs"] = versionConfigsProp
-	}
-
-	url, err := tpgresource.ReplaceVars(d, config, "{{DialogflowCXBasePath}}{{parent}}/environments")
-	if err != nil {
-		return err
-	}
-
-	log.Printf("[DEBUG] Creating new Environment: %#v", obj)
-	billingProject := ""
-
-	// err == nil indicates that the billing_project value was found
-	if bp, err := tpgresource.GetBillingProject(d, config); err == nil {
-		billingProject = bp
-	}
-
-	// extract location from the parent
-	location := ""
-
-	if parts := regexp.MustCompile(`locations\/([^\/]*)\/`).FindStringSubmatch(d.Get("parent").(string)); parts != nil {
-		location = parts[1]
-	} else {
-		return fmt.Errorf(
-			"Saw %s when the parent is expected to contains location %s",
-			d.Get("parent"),
-			"projects/{{project}}/locations/{{location}}/...",
-		)
-	}
-
-	url = strings.Replace(url, "-dialogflow", fmt.Sprintf("%s-dialogflow", location), 1)
-	res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
-		Config:    config,
-		Method:    "POST",
-		Project:   billingProject,
-		RawURL:    url,
-		UserAgent: userAgent,
-		Body:      obj,
-		Timeout:   d.Timeout(schema.TimeoutCreate),
-	})
-	if err != nil {
-		return fmt.Errorf("Error creating Environment: %s", err)
-	}
-
-	// Store the ID now
-	id, err := tpgresource.ReplaceVars(d, config, "{{parent}}/environments/{{name}}")
-	if err != nil {
-		return fmt.Errorf("Error constructing id: %s", err)
-	}
-	d.SetId(id)
-
-	// Use the resource in the operation response to populate
-	// identity fields and d.Id() before read
-	var opRes map[string]interface{}
-	err = DialogflowCXOperationWaitTimeWithResponse(
-		config, res, &opRes, "Creating Environment", userAgent, location,
-		d.Timeout(schema.TimeoutCreate))
-	if err != nil {
-		// The resource didn't actually create
-		d.SetId("")
-
-		return fmt.Errorf("Error waiting to create Environment: %s", err)
-	}
-
-	if err := d.Set("name", flattenDialogflowCXEnvironmentName(opRes["name"], d, config)); err != nil {
-		return err
-	}
-
-	// This may have caused the ID to update - update it if so.
-	id, err = tpgresource.ReplaceVars(d, config, "{{parent}}/environments/{{name}}")
-	if err != nil {
-		return fmt.Errorf("Error constructing id: %s", err)
-	}
-	d.SetId(id)
-
-	log.Printf("[DEBUG] Finished creating Environment %q: %#v", d.Id(), res)
-
-	return resourceDialogflowCXEnvironmentRead(d, meta)
-}
-
-func resourceDialogflowCXEnvironmentRead(d *schema.ResourceData, meta interface{}) error {
-	config := meta.(*transport_tpg.Config)
-	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
-	if err != nil {
-		return err
-	}
-
-	url, err := tpgresource.ReplaceVars(d, config, "{{DialogflowCXBasePath}}{{parent}}/environments/{{name}}")
-	if err != nil {
-		return err
-	}
-
-	billingProject := ""
-
-	// err == nil indicates that the billing_project value was found
-	if bp, err := tpgresource.GetBillingProject(d, config); err == nil {
-		billingProject = bp
-	}
-
-	// extract location from the parent
-	location := ""
-
-	if parts := regexp.MustCompile(`locations\/([^\/]*)\/`).FindStringSubmatch(d.Get("parent").(string)); parts != nil {
-		location = parts[1]
-	} else {
-		return fmt.Errorf(
-			"Saw %s when the parent is expected to contains location %s",
-			d.Get("parent"),
-			"projects/{{project}}/locations/{{location}}/...",
-		)
-	}
-
-	url = strings.Replace(url, "-dialogflow", fmt.Sprintf("%s-dialogflow", location), 1)
-	res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
-		Config:    config,
-		Method:    "GET",
-		Project:   billingProject,
-		RawURL:    url,
-		UserAgent: userAgent,
-	})
-	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("DialogflowCXEnvironment %q", d.Id()))
-	}
-
-	if err := d.Set("name", flattenDialogflowCXEnvironmentName(res["name"], d, config)); err != nil {
-		return fmt.Errorf("Error reading Environment: %s", err)
-	}
-	if err := d.Set("display_name", flattenDialogflowCXEnvironmentDisplayName(res["displayName"], d, config)); err != nil {
-		return fmt.Errorf("Error reading Environment: %s", err)
-	}
-	if err := d.Set("description", flattenDialogflowCXEnvironmentDescription(res["description"], d, config)); err != nil {
-		return fmt.Errorf("Error reading Environment: %s", err)
-	}
-	if err := d.Set("version_configs", flattenDialogflowCXEnvironmentVersionConfigs(res["versionConfigs"], d, config)); err != nil {
-		return fmt.Errorf("Error reading Environment: %s", err)
-	}
-	if err := d.Set("update_time", flattenDialogflowCXEnvironmentUpdateTime(res["updateTime"], d, config)); err != nil {
-		return fmt.Errorf("Error reading Environment: %s", err)
-	}
-
-	return nil
-}
-
-func resourceDialogflowCXEnvironmentUpdate(d *schema.ResourceData, meta interface{}) error {
-	config := meta.(*transport_tpg.Config)
-	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
-	if err != nil {
-		return err
-	}
-
-	billingProject := ""
-
-	obj := make(map[string]interface{})
-	displayNameProp, err := expandDialogflowCXEnvironmentDisplayName(d.Get("display_name"), d, config)
-	if err != nil {
-		return err
-	} else if v, ok := d.GetOkExists("display_name"); !tpgresource.IsEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, displayNameProp)) {
-		obj["displayName"] = displayNameProp
-	}
-	descriptionProp, err := expandDialogflowCXEnvironmentDescription(d.Get("description"), d, config)
-	if err != nil {
-		return err
-	} else if v, ok := d.GetOkExists("description"); !tpgresource.IsEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, descriptionProp)) {
-		obj["description"] = descriptionProp
-	}
-	versionConfigsProp, err := expandDialogflowCXEnvironmentVersionConfigs(d.Get("version_configs"), d, config)
-	if err != nil {
-		return err
-	} else if v, ok := d.GetOkExists("version_configs"); !tpgresource.IsEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, versionConfigsProp)) {
-		obj["versionConfigs"] = versionConfigsProp
-	}
-
-	url, err := tpgresource.ReplaceVars(d, config, "{{DialogflowCXBasePath}}{{parent}}/environments/{{name}}")
-	if err != nil {
-		return err
-	}
-
-	log.Printf("[DEBUG] Updating Environment %q: %#v", d.Id(), obj)
-	updateMask := []string{}
-
-	if d.HasChange("display_name") {
-		updateMask = append(updateMask, "displayName")
-	}
-
-	if d.HasChange("description") {
-		updateMask = append(updateMask, "description")
-	}
-
-	if d.HasChange("version_configs") {
-		updateMask = append(updateMask, "versionConfigs")
-	}
-	// updateMask is a URL parameter but not present in the schema, so ReplaceVars
-	// won't set it
-	url, err = transport_tpg.AddQueryParams(url, map[string]string{"updateMask": strings.Join(updateMask, ",")})
-	if err != nil {
-		return err
-	}
-
-	// extract location from the parent
-	location := ""
-
-	if parts := regexp.MustCompile(`locations\/([^\/]*)\/`).FindStringSubmatch(d.Get("parent").(string)); parts != nil {
-		location = parts[1]
-	} else {
-		return fmt.Errorf(
-			"Saw %s when the parent is expected to contains location %s",
-			d.Get("parent"),
-			"projects/{{project}}/locations/{{location}}/...",
-		)
-	}
-
-	url = strings.Replace(url, "-dialogflow", fmt.Sprintf("%s-dialogflow", location), 1)
-
-	// err == nil indicates that the billing_project value was found
-	if bp, err := tpgresource.GetBillingProject(d, config); err == nil {
-		billingProject = bp
-	}
-
-	res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
-		Config:    config,
-		Method:    "PATCH",
-		Project:   billingProject,
-		RawURL:    url,
-		UserAgent: userAgent,
-		Body:      obj,
-		Timeout:   d.Timeout(schema.TimeoutUpdate),
-	})
-
-	if err != nil {
-		return fmt.Errorf("Error updating Environment %q: %s", d.Id(), err)
-	} else {
-		log.Printf("[DEBUG] Finished updating Environment %q: %#v", d.Id(), res)
-	}
-
-	err = DialogflowCXOperationWaitTime(
-		config, res, "Updating Environment", userAgent, location,
-		d.Timeout(schema.TimeoutUpdate))
-
-	if err != nil {
-		return err
-	}
-
-	return resourceDialogflowCXEnvironmentRead(d, meta)
-}
-
-func resourceDialogflowCXEnvironmentDelete(d *schema.ResourceData, meta interface{}) error {
-	config := meta.(*transport_tpg.Config)
-	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
-	if err != nil {
-		return err
-	}
-
-	billingProject := ""
-
-	url, err := tpgresource.ReplaceVars(d, config, "{{DialogflowCXBasePath}}{{parent}}/environments/{{name}}")
-	if err != nil {
-		return err
-	}
-
-	var obj map[string]interface{}
-
-	// extract location from the parent
-	location := ""
-
-	if parts := regexp.MustCompile(`locations\/([^\/]*)\/`).FindStringSubmatch(d.Get("parent").(string)); parts != nil {
-		location = parts[1]
-	} else {
-		return fmt.Errorf(
-			"Saw %s when the parent is expected to contains location %s",
-			d.Get("parent"),
-			"projects/{{project}}/locations/{{location}}/...",
-		)
-	}
-
-	url = strings.Replace(url, "-dialogflow", fmt.Sprintf("%s-dialogflow", location), 1)
-	log.Printf("[DEBUG] Deleting Environment %q", d.Id())
-
-	// err == nil indicates that the billing_project value was found
-	if bp, err := tpgresource.GetBillingProject(d, config); err == nil {
-		billingProject = bp
-	}
-
-	res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
-		Config:    config,
-		Method:    "DELETE",
-		Project:   billingProject,
-		RawURL:    url,
-		UserAgent: userAgent,
-		Body:      obj,
-		Timeout:   d.Timeout(schema.TimeoutDelete),
-	})
-	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, "Environment")
-	}
-
-	err = DialogflowCXOperationWaitTime(
-		config, res, "Deleting Environment", userAgent, location,
-		d.Timeout(schema.TimeoutDelete))
-
-	if err != nil {
-		return err
-	}
-
-	log.Printf("[DEBUG] Finished deleting Environment %q: %#v", d.Id(), res)
-	return nil
-}
-
-func resourceDialogflowCXEnvironmentImport(d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
-	config := meta.(*transport_tpg.Config)
-
-	// current import_formats can't import fields with forward slashes in their value and parent contains slashes
-	if err := tpgresource.ParseImportId([]string{
-		"(?P<parent>.+)/environments/(?P<name>[^/]+)",
-		"(?P<parent>.+)/(?P<name>[^/]+)",
-	}, d, config); err != nil {
-		return nil, err
-	}
-
-	// Replace import id for the resource id
-	id, err := tpgresource.ReplaceVars(d, config, "{{parent}}/environments/{{name}}")
-	if err != nil {
-		return nil, fmt.Errorf("Error constructing id: %s", err)
-	}
-	d.SetId(id)
-
-	return []*schema.ResourceData{d}, nil
-}
-
-func flattenDialogflowCXEnvironmentName(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-	if v == nil {
-		return v
-	}
-	return tpgresource.NameFromSelfLinkStateFunc(v)
-}
-
-func flattenDialogflowCXEnvironmentDisplayName(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-	return v
-}
-
-func flattenDialogflowCXEnvironmentDescription(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-	return v
-}
-
-func flattenDialogflowCXEnvironmentVersionConfigs(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-	if v == nil {
-		return v
-	}
-	l := v.([]interface{})
-	transformed := make([]interface{}, 0, len(l))
-	for _, raw := range l {
-		original := raw.(map[string]interface{})
-		if len(original) < 1 {
-			// Do not include empty json objects coming back from the api
-			continue
-		}
-		transformed = append(transformed, map[string]interface{}{
-			"version": flattenDialogflowCXEnvironmentVersionConfigsVersion(original["version"], d, config),
-		})
-	}
-	return transformed
-}
-func flattenDialogflowCXEnvironmentVersionConfigsVersion(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-	return v
-}
-
-func flattenDialogflowCXEnvironmentUpdateTime(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-	return v
-}
-
-func expandDialogflowCXEnvironmentDisplayName(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
-	return v, nil
-}
-
-func expandDialogflowCXEnvironmentDescription(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
-	return v, nil
-}
-
-func expandDialogflowCXEnvironmentVersionConfigs(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
-	l := v.([]interface{})
-	req := make([]interface{}, 0, len(l))
-	for _, raw := range l {
-		if raw == nil {
-			continue
-		}
-		original := raw.(map[string]interface{})
-		transformed := make(map[string]interface{})
-
-		transformedVersion, err := expandDialogflowCXEnvironmentVersionConfigsVersion(original["version"], d, config)
-		if err != nil {
-			return nil, err
-		} else if val := reflect.ValueOf(transformedVersion); val.IsValid() && !tpgresource.IsEmptyValue(val) {
-			transformed["version"] = transformedVersion
-		}
-
-		req = append(req, transformed)
-	}
-	return req, nil
-}
-
-func expandDialogflowCXEnvironmentVersionConfigsVersion(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
-	return v, nil
-}
diff --git a/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflow_cx_security_settings_test.go b/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflow_cx_security_settings_test.go
new file mode 100644
index 000000000000..ed1fddcbf668
--- /dev/null
+++ b/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflow_cx_security_settings_test.go
@@ -0,0 +1,113 @@
+package dialogflowcx_test
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+	"github.com/hashicorp/terraform-provider-google/google/envvar"
+)
+
+func TestAccDialogflowCXSecuritySettings_dialogflowcxSecuritySettings_update(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"project":         envvar.GetTestProjectFromEnv(),
+		"billing_account": envvar.GetTestBillingAccountFromEnv(t),
+		"random_suffix":   acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDialogflowCXSecuritySettings_dialogflowcxSecuritySettings_basic(context),
+			},
+			{
+				ResourceName:            "google_dialogflow_cx_security_settings.basic_security_settings",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"location"},
+			},
+			{
+				Config: testAccDialogflowCXSecuritySettings_dialogflowcxSecuritySettings_update(context),
+			},
+			{
+				ResourceName:            "google_dialogflow_cx_security_settings.basic_security_settings",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"location"},
+			},
+		},
+	})
+}
+
+func testAccDialogflowCXSecuritySettings_dialogflowcxSecuritySettings_basic(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_dialogflow_cx_security_settings" "basic_security_settings" {
+  display_name          = "tf-test-dialogflowcx-security-settings%{random_suffix}"
+  location              = "global"
+  purge_data_types      = []
+  retention_window_days = 7
+}
+`, context)
+}
+
+func testAccDialogflowCXSecuritySettings_dialogflowcxSecuritySettings_update(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_data_loss_prevention_inspect_template" "inspect" {
+  parent       = "projects/%{project}/locations/global"
+  display_name = "tf-test-dialogflowcx-inspect-template%{random_suffix}"
+  inspect_config {
+    info_types {
+      name = "EMAIL_ADDRESS"
+    }
+  }
+}
+
+resource "google_data_loss_prevention_deidentify_template" "deidentify" {
+  parent       = "projects/%{project}/locations/global"
+  display_name = "tf-test-dialogflowcx-deidentify-template%{random_suffix}"
+  deidentify_config {
+    info_type_transformations {
+      transformations {
+        primitive_transformation {
+          replace_config {
+            new_value {
+              string_value = "[REDACTED]"
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+resource "google_storage_bucket" "bucket" {
+  name                        = "tf-test-dialogflowcx-bucket%{random_suffix}"
+  location                    = "US"
+  uniform_bucket_level_access = true
+}
+
+resource "google_dialogflow_cx_security_settings" "basic_security_settings" {
+  display_name        = "tf-test-dialogflowcx-security-settings%{random_suffix}"
+  location            = "global"
+  redaction_strategy  = "REDACT_WITH_SERVICE"
+  redaction_scope     = "REDACT_DISK_STORAGE"
+  inspect_template    = google_data_loss_prevention_inspect_template.inspect.id
+  deidentify_template = google_data_loss_prevention_deidentify_template.deidentify.id
+  purge_data_types    = ["DIALOGFLOW_HISTORY"]
+  audio_export_settings {
+    gcs_bucket             = google_storage_bucket.bucket.id
+    audio_export_pattern   = "export"
+    enable_audio_redaction = true
+    audio_format           = "OGG"
+  }
+  insights_export_settings {
+    enable_insights_export = true
+  }
+  retention_strategy = "REMOVE_AFTER_CONVERSATION"
+}
+`, context)
+}
diff --git a/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflow_cx_test_case_test.go b/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflow_cx_test_case_test.go
new file mode 100644
index 000000000000..407bd10bf5b3
--- /dev/null
+++ b/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflow_cx_test_case_test.go
@@ -0,0 +1,255 @@
+package dialogflowcx_test
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+	"github.com/hashicorp/terraform-provider-google/google/envvar"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+)
+
+func TestAccDialogflowCXTestCase_update(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"org_id":          envvar.GetTestOrgFromEnv(t),
+		"billing_account": envvar.GetTestBillingAccountFromEnv(t),
+		"random_suffix":   acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDialogflowCXTestCase_full(context),
+			},
+			{
+				ResourceName:      "google_dialogflow_cx_test_case.basic_test_case",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccDialogflowCXTestCase_update(context),
+			},
+			{
+				ResourceName:      "google_dialogflow_cx_test_case.basic_test_case",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccDialogflowCXTestCase_full(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_dialogflow_cx_agent" "agent" {
+  display_name               = "tf-test-dialogflowcx-agent%{random_suffix}"
+  location                   = "global"
+  default_language_code      = "en"
+  supported_language_codes   = ["fr", "de", "es"]
+  time_zone                  = "America/New_York"
+  description                = "Example description."
+  avatar_uri                 = "https://storage.cloud.google.com/dialogflow-test-host-image/cloud-logo.png"
+  enable_stackdriver_logging = true
+  enable_spell_correction    = true
+  speech_to_text_settings {
+    enable_speech_adaptation = true
+  }
+}
+
+resource "google_dialogflow_cx_page" "page" {
+  parent       = google_dialogflow_cx_agent.agent.start_flow
+  display_name = "MyPage"
+
+  transition_routes {
+    intent = google_dialogflow_cx_intent.intent.id
+    trigger_fulfillment {
+      messages {
+        text {
+          text = ["Training phrase response"]
+        }
+      }
+    }
+  }
+
+  event_handlers {
+    event = "some-event"
+    trigger_fulfillment {
+      messages {
+        text {
+          text = ["Handling some event"]
+        }
+      }
+    }
+  }
+}
+
+resource "google_dialogflow_cx_intent" "intent" {
+  parent       = google_dialogflow_cx_agent.agent.id
+  display_name = "MyIntent"
+  priority     = 1
+  training_phrases {
+    parts {
+      text = "training phrase"
+    }
+    repeat_count = 1
+  }
+}
+
+resource "google_dialogflow_cx_test_case" "basic_test_case" {
+  parent       = google_dialogflow_cx_agent.agent.id
+  display_name = "MyTestCase"
+
+  test_config {
+    tracking_parameters = []
+    flow                = google_dialogflow_cx_agent.agent.start_flow
+  }
+
+  test_case_conversation_turns {
+    user_input {
+      input {
+        language_code = "en"
+        text {
+          text = "some phrase"
+        }
+      }
+    }
+    virtual_agent_output {
+      text_responses {
+        text = ["Some response"]
+      }
+    }
+  }
+}`, context)
+}
+
+func testAccDialogflowCXTestCase_update(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_dialogflow_cx_agent" "agent" {
+  display_name               = "tf-test-dialogflowcx-agent%{random_suffix}"
+  location                   = "global"
+  default_language_code      = "en"
+  supported_language_codes   = ["fr", "de", "es"]
+  time_zone                  = "America/New_York"
+  description                = "Example description."
+  avatar_uri                 = "https://storage.cloud.google.com/dialogflow-test-host-image/cloud-logo.png"
+  enable_stackdriver_logging = true
+  enable_spell_correction    = true
+  speech_to_text_settings {
+    enable_speech_adaptation = true
+  }
+}
+
+resource "google_dialogflow_cx_page" "page" {
+  parent       = google_dialogflow_cx_agent.agent.start_flow
+  display_name = "MyPage"
+
+  transition_routes {
+    intent = google_dialogflow_cx_intent.intent.id
+    trigger_fulfillment {
+      messages {
+        text {
+          text = ["Training phrase response"]
+        }
+      }
+    }
+  }
+
+  event_handlers {
+    event = "some-event"
+    trigger_fulfillment {
+      messages {
+        text {
+          text = ["Handling some event"]
+        }
+      }
+    }
+  }
+}
+
+resource "google_dialogflow_cx_intent" "intent" {
+  parent       = google_dialogflow_cx_agent.agent.id
+  display_name = "MyIntent"
+  priority     = 1
+  training_phrases {
+    parts {
+      text = "training phrase"
+    }
+    repeat_count = 1
+  }
+}
+
+resource "google_dialogflow_cx_test_case" "basic_test_case" {
+  parent       = google_dialogflow_cx_agent.agent.id
+  display_name = "MyTestCase"
+  tags         = ["#tag1"]
+  notes        = "demonstrates a simple training phrase response"
+
+  test_config {
+    tracking_parameters = ["some_param"]
+    page                = google_dialogflow_cx_page.page.id
+  }
+
+  test_case_conversation_turns {
+    user_input {
+      input {
+        language_code = "en"
+        text {
+          text = "training phrase"
+        }
+      }
+      injected_parameters       = jsonencode({ some_param = "1" })
+      is_webhook_enabled        = true
+      enable_sentiment_analysis = true
+    }
+    virtual_agent_output {
+      session_parameters = jsonencode({ some_param = "1" })
+      triggered_intent {
+        name = google_dialogflow_cx_intent.intent.id
+      }
+      current_page {
+        name = google_dialogflow_cx_page.page.id
+      }
+      text_responses {
+        text = ["Training phrase response"]
+      }
+    }
+  }
+
+  test_case_conversation_turns {
+    user_input {
+      input {
+        event {
+          event = "some-event"
+        }
+      }
+    }
+    virtual_agent_output {
+      current_page {
+        name = google_dialogflow_cx_page.page.id
+      }
+      text_responses {
+        text = ["Handling some event"]
+      }
+    }
+  }
+
+  test_case_conversation_turns {
+    user_input {
+      input {
+        dtmf {
+          digits       = "12"
+          finish_digit = "3"
+        }
+      }
+    }
+    virtual_agent_output {
+      text_responses {
+        text = ["I didn't get that. Can you say it again?"]
+      }
+    }
+  }
+}`, context)
+}
diff --git a/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflow_cx_version.go b/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflow_cx_version.go
deleted file mode 100644
index 980387b9eb16..000000000000
--- a/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflow_cx_version.go
+++ /dev/null
@@ -1,506 +0,0 @@
-package dialogflowcx
-
-import (
-	"fmt"
-	"log"
-	"reflect"
-	"regexp"
-	"strings"
-	"time"
-
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
-
-	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
-	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
-	"github.com/hashicorp/terraform-provider-google/google/verify"
-)
-
-func ResourceDialogflowCXVersion() *schema.Resource {
-	return &schema.Resource{
-		Create: resourceDialogflowCXVersionCreate,
-		Read:   resourceDialogflowCXVersionRead,
-		Update: resourceDialogflowCXVersionUpdate,
-		Delete: resourceDialogflowCXVersionDelete,
-
-		Importer: &schema.ResourceImporter{
-			State: resourceDialogflowCXVersionImport,
-		},
-
-		Timeouts: &schema.ResourceTimeout{
-			Create: schema.DefaultTimeout(40 * time.Minute),
-			Update: schema.DefaultTimeout(40 * time.Minute),
-			Delete: schema.DefaultTimeout(20 * time.Minute),
-		},
-
-		Schema: map[string]*schema.Schema{
-			"display_name": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: validation.StringLenBetween(0, 64),
-				Description:  `The human-readable name of the version. Limit of 64 characters.`,
-			},
-			"description": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: validation.StringLenBetween(0, 500),
-				Description:  `The description of the version. The maximum length is 500 characters. If exceeded, the request is rejected.`,
-			},
-			"parent": {
-				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: true,
-				Description: `The Flow to create an Version for.
-Format: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>.`,
-			},
-			"create_time": {
-				Type:        schema.TypeString,
-				Computed:    true,
-				Description: `A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".`,
-			},
-			"name": {
-				Type:        schema.TypeString,
-				Computed:    true,
-				Description: `Format: projects//locations//agents//flows//versions/. Version ID is a self-increasing number generated by Dialogflow upon version creation.`,
-			},
-			"nlu_settings": {
-				Type:        schema.TypeList,
-				Computed:    true,
-				Description: `The NLU settings of the flow at version creation.`,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"classification_threshold": {
-							Type:     schema.TypeFloat,
-							Optional: true,
-							Description: `To filter out false positive results and still get variety in matched natural language inputs for your agent, you can tune the machine learning classification threshold. If the returned score value is less than the threshold value, then a no-match event will be triggered.
-The score values range from 0.0 (completely uncertain) to 1.0 (completely certain). If set to 0.0, the default of 0.3 is used.`,
-						},
-						"model_training_mode": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							ValidateFunc: verify.ValidateEnum([]string{"MODEL_TRAINING_MODE_AUTOMATIC", "MODEL_TRAINING_MODE_MANUAL", ""}),
-							Description: `Indicates NLU model training mode.
-* MODEL_TRAINING_MODE_AUTOMATIC: NLU model training is automatically triggered when a flow gets modified. User can also manually trigger model training in this mode.
-* MODEL_TRAINING_MODE_MANUAL: User needs to manually trigger NLU model training. Best for large flows whose models take long time to train. Possible values: ["MODEL_TRAINING_MODE_AUTOMATIC", "MODEL_TRAINING_MODE_MANUAL"]`,
-						},
-						"model_type": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							ValidateFunc: verify.ValidateEnum([]string{"MODEL_TYPE_STANDARD", "MODEL_TYPE_ADVANCED", ""}),
-							Description: `Indicates the type of NLU model.
-* MODEL_TYPE_STANDARD: Use standard NLU model.
-* MODEL_TYPE_ADVANCED: Use advanced NLU model. Possible values: ["MODEL_TYPE_STANDARD", "MODEL_TYPE_ADVANCED"]`,
-						},
-					},
-				},
-			},
-			"state": {
-				Type:     schema.TypeString,
-				Computed: true,
-				Description: `The state of this version.
-* RUNNING: Version is not ready to serve (e.g. training is running).
-* SUCCEEDED: Training has succeeded and this version is ready to serve.
-* FAILED: Version training failed.`,
-			},
-		},
-		UseJSONNumber: true,
-	}
-}
-
-func resourceDialogflowCXVersionCreate(d *schema.ResourceData, meta interface{}) error {
-	config := meta.(*transport_tpg.Config)
-	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
-	if err != nil {
-		return err
-	}
-
-	obj := make(map[string]interface{})
-	displayNameProp, err := expandDialogflowCXVersionDisplayName(d.Get("display_name"), d, config)
-	if err != nil {
-		return err
-	} else if v, ok := d.GetOkExists("display_name"); !tpgresource.IsEmptyValue(reflect.ValueOf(displayNameProp)) && (ok || !reflect.DeepEqual(v, displayNameProp)) {
-		obj["displayName"] = displayNameProp
-	}
-	descriptionProp, err := expandDialogflowCXVersionDescription(d.Get("description"), d, config)
-	if err != nil {
-		return err
-	} else if v, ok := d.GetOkExists("description"); !tpgresource.IsEmptyValue(reflect.ValueOf(descriptionProp)) && (ok || !reflect.DeepEqual(v, descriptionProp)) {
-		obj["description"] = descriptionProp
-	}
-
-	url, err := tpgresource.ReplaceVars(d, config, "{{DialogflowCXBasePath}}{{parent}}/versions")
-	if err != nil {
-		return err
-	}
-
-	log.Printf("[DEBUG] Creating new Version: %#v", obj)
-	billingProject := ""
-
-	// err == nil indicates that the billing_project value was found
-	if bp, err := tpgresource.GetBillingProject(d, config); err == nil {
-		billingProject = bp
-	}
-
-	// extract location from the parent
-	location := ""
-
-	if parts := regexp.MustCompile(`locations\/([^\/]*)\/`).FindStringSubmatch(d.Get("parent").(string)); parts != nil {
-		location = parts[1]
-	} else {
-		return fmt.Errorf(
-			"Saw %s when the parent is expected to contains location %s",
-			d.Get("parent"),
-			"projects/{{project}}/locations/{{location}}/...",
-		)
-	}
-
-	url = strings.Replace(url, "-dialogflow", fmt.Sprintf("%s-dialogflow", location), 1)
-	res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
-		Config:    config,
-		Method:    "POST",
-		Project:   billingProject,
-		RawURL:    url,
-		UserAgent: userAgent,
-		Body:      obj,
-		Timeout:   d.Timeout(schema.TimeoutCreate),
-	})
-	if err != nil {
-		return fmt.Errorf("Error creating Version: %s", err)
-	}
-
-	// Store the ID now
-	id, err := tpgresource.ReplaceVars(d, config, "{{parent}}/versions/{{name}}")
-	if err != nil {
-		return fmt.Errorf("Error constructing id: %s", err)
-	}
-	d.SetId(id)
-
-	// Use the resource in the operation response to populate
-	// identity fields and d.Id() before read
-	var opRes map[string]interface{}
-	err = DialogflowCXOperationWaitTimeWithResponse(
-		config, res, &opRes, "Creating Version", userAgent, location,
-		d.Timeout(schema.TimeoutCreate))
-	if err != nil {
-		// The resource didn't actually create
-		d.SetId("")
-
-		return fmt.Errorf("Error waiting to create Version: %s", err)
-	}
-
-	if err := d.Set("name", flattenDialogflowCXVersionName(opRes["name"], d, config)); err != nil {
-		return err
-	}
-
-	// This may have caused the ID to update - update it if so.
-	id, err = tpgresource.ReplaceVars(d, config, "{{parent}}/versions/{{name}}")
-	if err != nil {
-		return fmt.Errorf("Error constructing id: %s", err)
-	}
-	d.SetId(id)
-
-	log.Printf("[DEBUG] Finished creating Version %q: %#v", d.Id(), res)
-
-	return resourceDialogflowCXVersionRead(d, meta)
-}
-
-func resourceDialogflowCXVersionRead(d *schema.ResourceData, meta interface{}) error {
-	config := meta.(*transport_tpg.Config)
-	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
-	if err != nil {
-		return err
-	}
-
-	url, err := tpgresource.ReplaceVars(d, config, "{{DialogflowCXBasePath}}{{parent}}/versions/{{name}}")
-	if err != nil {
-		return err
-	}
-
-	billingProject := ""
-
-	// err == nil indicates that the billing_project value was found
-	if bp, err := tpgresource.GetBillingProject(d, config); err == nil {
-		billingProject = bp
-	}
-
-	// extract location from the parent
-	location := ""
-
-	if parts := regexp.MustCompile(`locations\/([^\/]*)\/`).FindStringSubmatch(d.Get("parent").(string)); parts != nil {
-		location = parts[1]
-	} else {
-		return fmt.Errorf(
-			"Saw %s when the parent is expected to contains location %s",
-			d.Get("parent"),
-			"projects/{{project}}/locations/{{location}}/...",
-		)
-	}
-
-	url = strings.Replace(url, "-dialogflow", fmt.Sprintf("%s-dialogflow", location), 1)
-	res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
-		Config:    config,
-		Method:    "GET",
-		Project:   billingProject,
-		RawURL:    url,
-		UserAgent: userAgent,
-	})
-	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("DialogflowCXVersion %q", d.Id()))
-	}
-
-	if err := d.Set("name", flattenDialogflowCXVersionName(res["name"], d, config)); err != nil {
-		return fmt.Errorf("Error reading Version: %s", err)
-	}
-	if err := d.Set("display_name", flattenDialogflowCXVersionDisplayName(res["displayName"], d, config)); err != nil {
-		return fmt.Errorf("Error reading Version: %s", err)
-	}
-	if err := d.Set("description", flattenDialogflowCXVersionDescription(res["description"], d, config)); err != nil {
-		return fmt.Errorf("Error reading Version: %s", err)
-	}
-	if err := d.Set("nlu_settings", flattenDialogflowCXVersionNluSettings(res["nluSettings"], d, config)); err != nil {
-		return fmt.Errorf("Error reading Version: %s", err)
-	}
-	if err := d.Set("create_time", flattenDialogflowCXVersionCreateTime(res["createTime"], d, config)); err != nil {
-		return fmt.Errorf("Error reading Version: %s", err)
-	}
-	if err := d.Set("state", flattenDialogflowCXVersionState(res["state"], d, config)); err != nil {
-		return fmt.Errorf("Error reading Version: %s", err)
-	}
-
-	return nil
-}
-
-func resourceDialogflowCXVersionUpdate(d *schema.ResourceData, meta interface{}) error {
-	config := meta.(*transport_tpg.Config)
-	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
-	if err != nil {
-		return err
-	}
-
-	billingProject := ""
-
-	obj := make(map[string]interface{})
-	displayNameProp, err := expandDialogflowCXVersionDisplayName(d.Get("display_name"), d, config)
-	if err != nil {
-		return err
-	} else if v, ok := d.GetOkExists("display_name"); !tpgresource.IsEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, displayNameProp)) {
-		obj["displayName"] = displayNameProp
-	}
-	descriptionProp, err := expandDialogflowCXVersionDescription(d.Get("description"), d, config)
-	if err != nil {
-		return err
-	} else if v, ok := d.GetOkExists("description"); !tpgresource.IsEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, descriptionProp)) {
-		obj["description"] = descriptionProp
-	}
-
-	url, err := tpgresource.ReplaceVars(d, config, "{{DialogflowCXBasePath}}{{parent}}/versions/{{name}}")
-	if err != nil {
-		return err
-	}
-
-	log.Printf("[DEBUG] Updating Version %q: %#v", d.Id(), obj)
-	updateMask := []string{}
-
-	if d.HasChange("display_name") {
-		updateMask = append(updateMask, "displayName")
-	}
-
-	if d.HasChange("description") {
-		updateMask = append(updateMask, "description")
-	}
-	// updateMask is a URL parameter but not present in the schema, so ReplaceVars
-	// won't set it
-	url, err = transport_tpg.AddQueryParams(url, map[string]string{"updateMask": strings.Join(updateMask, ",")})
-	if err != nil {
-		return err
-	}
-
-	// extract location from the parent
-	location := ""
-
-	if parts := regexp.MustCompile(`locations\/([^\/]*)\/`).FindStringSubmatch(d.Get("parent").(string)); parts != nil {
-		location = parts[1]
-	} else {
-		return fmt.Errorf(
-			"Saw %s when the parent is expected to contains location %s",
-			d.Get("parent"),
-			"projects/{{project}}/locations/{{location}}/...",
-		)
-	}
-
-	url = strings.Replace(url, "-dialogflow", fmt.Sprintf("%s-dialogflow", location), 1)
-
-	// err == nil indicates that the billing_project value was found
-	if bp, err := tpgresource.GetBillingProject(d, config); err == nil {
-		billingProject = bp
-	}
-
-	res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
-		Config:    config,
-		Method:    "PATCH",
-		Project:   billingProject,
-		RawURL:    url,
-		UserAgent: userAgent,
-		Body:      obj,
-		Timeout:   d.Timeout(schema.TimeoutUpdate),
-	})
-
-	if err != nil {
-		return fmt.Errorf("Error updating Version %q: %s", d.Id(), err)
-	} else {
-		log.Printf("[DEBUG] Finished updating Version %q: %#v", d.Id(), res)
-	}
-
-	err = DialogflowCXOperationWaitTime(
-		config, res, "Updating Version", userAgent, location,
-		d.Timeout(schema.TimeoutUpdate))
-
-	if err != nil {
-		return err
-	}
-
-	return resourceDialogflowCXVersionRead(d, meta)
-}
-
-func resourceDialogflowCXVersionDelete(d *schema.ResourceData, meta interface{}) error {
-	config := meta.(*transport_tpg.Config)
-	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
-	if err != nil {
-		return err
-	}
-
-	billingProject := ""
-
-	url, err := tpgresource.ReplaceVars(d, config, "{{DialogflowCXBasePath}}{{parent}}/versions/{{name}}")
-	if err != nil {
-		return err
-	}
-
-	var obj map[string]interface{}
-
-	// extract location from the parent
-	location := ""
-
-	if parts := regexp.MustCompile(`locations\/([^\/]*)\/`).FindStringSubmatch(d.Get("parent").(string)); parts != nil {
-		location = parts[1]
-	} else {
-		return fmt.Errorf(
-			"Saw %s when the parent is expected to contains location %s",
-			d.Get("parent"),
-			"projects/{{project}}/locations/{{location}}/...",
-		)
-	}
-
-	url = strings.Replace(url, "-dialogflow", fmt.Sprintf("%s-dialogflow", location), 1)
-	log.Printf("[DEBUG] Deleting Version %q", d.Id())
-
-	// err == nil indicates that the billing_project value was found
-	if bp, err := tpgresource.GetBillingProject(d, config); err == nil {
-		billingProject = bp
-	}
-
-	res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
-		Config:    config,
-		Method:    "DELETE",
-		Project:   billingProject,
-		RawURL:    url,
-		UserAgent: userAgent,
-		Body:      obj,
-		Timeout:   d.Timeout(schema.TimeoutDelete),
-	})
-	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, "Version")
-	}
-
-	err = DialogflowCXOperationWaitTime(
-		config, res, "Deleting Version", userAgent, location,
-		d.Timeout(schema.TimeoutDelete))
-
-	if err != nil {
-		return err
-	}
-
-	log.Printf("[DEBUG] Finished deleting Version %q: %#v", d.Id(), res)
-	return nil
-}
-
-func resourceDialogflowCXVersionImport(d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
-	config := meta.(*transport_tpg.Config)
-
-	// current import_formats can't import fields with forward slashes in their value and parent contains slashes
-	if err := tpgresource.ParseImportId([]string{
-		"(?P<parent>.+)/versions/(?P<name>[^/]+)",
-		"(?P<parent>.+)/(?P<name>[^/]+)",
-	}, d, config); err != nil {
-		return nil, err
-	}
-
-	// Replace import id for the resource id
-	id, err := tpgresource.ReplaceVars(d, config, "{{parent}}/versions/{{name}}")
-	if err != nil {
-		return nil, fmt.Errorf("Error constructing id: %s", err)
-	}
-	d.SetId(id)
-
-	return []*schema.ResourceData{d}, nil
-}
-
-func flattenDialogflowCXVersionName(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-	if v == nil {
-		return v
-	}
-	return tpgresource.NameFromSelfLinkStateFunc(v)
-}
-
-func flattenDialogflowCXVersionDisplayName(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-	return v
-}
-
-func flattenDialogflowCXVersionDescription(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-	return v
-}
-
-func flattenDialogflowCXVersionNluSettings(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-	if v == nil {
-		return nil
-	}
-	original := v.(map[string]interface{})
-	if len(original) == 0 {
-		return nil
-	}
-	transformed := make(map[string]interface{})
-	transformed["model_type"] =
-		flattenDialogflowCXVersionNluSettingsModelType(original["modelType"], d, config)
-	transformed["classification_threshold"] =
-		flattenDialogflowCXVersionNluSettingsClassificationThreshold(original["classificationThreshold"], d, config)
-	transformed["model_training_mode"] =
-		flattenDialogflowCXVersionNluSettingsModelTrainingMode(original["modelTrainingMode"], d, config)
-	return []interface{}{transformed}
-}
-func flattenDialogflowCXVersionNluSettingsModelType(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-	return v
-}
-
-func flattenDialogflowCXVersionNluSettingsClassificationThreshold(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-	return v
-}
-
-func flattenDialogflowCXVersionNluSettingsModelTrainingMode(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-	return v
-}
-
-func flattenDialogflowCXVersionCreateTime(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-	return v
-}
-
-func flattenDialogflowCXVersionState(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
-	return v
-}
-
-func expandDialogflowCXVersionDisplayName(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
-	return v, nil
-}
-
-func expandDialogflowCXVersionDescription(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
-	return v, nil
-}
diff --git a/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_agent_test.go.erb b/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_agent_test.go.erb
index 5de09aa3ac51..d93367bf0105 100644
--- a/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_agent_test.go.erb
+++ b/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_agent_test.go.erb
@@ -30,6 +30,7 @@ func TestAccDialogflowCXAgent_update(t *testing.T) {
 				ResourceName:            "google_dialogflow_cx_agent.foobar",
 				ImportState:             true,
 				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"git_integration_settings.0.github_settings.0.access_token"},
 			},
 			{
 				Config: testAccDialogflowCXAgent_full(context),
@@ -38,6 +39,16 @@ func TestAccDialogflowCXAgent_update(t *testing.T) {
 				ResourceName:            "google_dialogflow_cx_agent.foobar",
 				ImportState:             true,
 				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"git_integration_settings.0.github_settings.0.access_token"},
+			},
+			{
+				Config: testAccDialogflowCXAgent_removeSettings(context),
+			},
+			{
+				ResourceName:            "google_dialogflow_cx_agent.foobar",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"git_integration_settings.0.github_settings.0.access_token"},
 			},
 		},
 	})
@@ -45,18 +56,6 @@ func TestAccDialogflowCXAgent_update(t *testing.T) {
 
 func testAccDialogflowCXAgent_basic(context map[string]interface{}) string {
 	return acctest.Nprintf(`
-	data "google_project" "project" {}
-
-	resource "google_service_account" "dialogflowcx_service_account" {
-		account_id = "tf-test-dialogflow-%{random_suffix}"
-	}
-
-	resource "google_project_iam_member" "agent_create" {
-		project = data.google_project.project.project_id
-		role    = "roles/dialogflow.admin"
-		member  = "serviceAccount:${google_service_account.dialogflowcx_service_account.email}"
-	}
-
 	resource "google_dialogflow_cx_agent" "foobar" {
 		display_name = "tf-test-%{random_suffix}"
 		location = "global"
@@ -65,23 +64,16 @@ func testAccDialogflowCXAgent_basic(context map[string]interface{}) string {
 		time_zone = "America/New_York"
 		description = "Description 1."
 		avatar_uri = "https://storage.cloud.google.com/dialogflow-test-host-image/cloud-logo.png"
-		depends_on = [google_project_iam_member.agent_create]
 	}
 	`, context)
 }
 
 func testAccDialogflowCXAgent_full(context map[string]interface{}) string {
 	return acctest.Nprintf(`
-	data "google_project" "project" {}
-
-	resource "google_service_account" "dialogflowcx_service_account" {
-		account_id = "tf-test-dialogflow-%{random_suffix}"
-	}
-
-	resource "google_project_iam_member" "agent_create" {
-		project = data.google_project.project.project_id
-		role    = "roles/dialogflow.admin"
-		member  = "serviceAccount:${google_service_account.dialogflowcx_service_account.email}"
+	resource "google_storage_bucket" "bucket" {
+		name                        = "tf-test-dialogflowcx-bucket%{random_suffix}"
+		location                    = "US"
+		uniform_bucket_level_access = true
 	}
 
 	resource "google_dialogflow_cx_agent" "foobar" {
@@ -93,11 +85,55 @@ func testAccDialogflowCXAgent_full(context map[string]interface{}) string {
 		description = "Description 2!"
 		avatar_uri = "https://storage.cloud.google.com/dialogflow-test-host-image/cloud-logo-2.png"
 		enable_stackdriver_logging = true
-        enable_spell_correction    = true
+		enable_spell_correction    = true
 		speech_to_text_settings {
 			enable_speech_adaptation = true
 		}
-		depends_on = [google_project_iam_member.agent_create]
+		advanced_settings {
+			audio_export_gcs_destination {
+				uri = "${google_storage_bucket.bucket.url}/prefix-"
+			}
+			dtmf_settings {
+				enabled = true
+				max_digits = 1
+				finish_digit = "#"
+			}
+		}
+		git_integration_settings {
+			github_settings {
+				display_name = "Github Repo"
+				repository_uri = "https://api.github.com/repos/githubtraining/hellogitworld"
+				tracking_branch = "main"
+				access_token = "secret-token"
+				branches = ["main"]
+			}
+		}
+		text_to_speech_settings {
+			synthesize_speech_configs = jsonencode({
+				en = {
+					voice = {
+						name = "en-US-Neural2-A"
+					}
+				}
+			})
+		}
+	}
+	  `, context)
+}
+
+func testAccDialogflowCXAgent_removeSettings(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+	resource "google_dialogflow_cx_agent" "foobar" {
+		display_name = "tf-test-%{random_suffix}"
+		location = "global"
+		default_language_code = "en"
+		supported_language_codes = ["fr","de","es"]
+		time_zone = "America/New_York"
+		description = "Description 1."
+		avatar_uri = "https://storage.cloud.google.com/dialogflow-test-host-image/cloud-logo.png"
+		advanced_settings {}
+		git_integration_settings {}
+		text_to_speech_settings {}
 	}
 	  `, context)
 }
diff --git a/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_entity_type_test.go b/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_entity_type_test.go
index 9fefa8bee057..282255ae543f 100644
--- a/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_entity_type_test.go
+++ b/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_entity_type_test.go
@@ -43,18 +43,6 @@ func TestAccDialogflowCXEntityType_update(t *testing.T) {
 
 func testAccDialogflowCXEntityType_basic(context map[string]interface{}) string {
 	return acctest.Nprintf(`
-	data "google_project" "project" {}
-
-	resource "google_service_account" "dialogflowcx_service_account" {
-		account_id = "tf-test-dialogflow-%{random_suffix}"
-	}
-
-	resource "google_project_iam_member" "agent_create" {
-		project = data.google_project.project.project_id
-		role    = "roles/dialogflow.admin"
-		member  = "serviceAccount:${google_service_account.dialogflowcx_service_account.email}"
-	}
-
 	resource "google_dialogflow_cx_agent" "agent_entity" {
 		display_name = "tf-test-%{random_suffix}"
 		location = "global"
@@ -63,7 +51,6 @@ func testAccDialogflowCXEntityType_basic(context map[string]interface{}) string
 		time_zone = "America/New_York"
 		description = "Description 1."
 		avatar_uri = "https://storage.cloud.google.com/dialogflow-test-host-image/cloud-logo.png"
-		depends_on = [google_project_iam_member.agent_create]
 	}
     
 	resource "google_dialogflow_cx_entity_type" "my_entity" {
@@ -85,18 +72,6 @@ func testAccDialogflowCXEntityType_basic(context map[string]interface{}) string
 
 func testAccDialogflowCXEntityType_full(context map[string]interface{}) string {
 	return acctest.Nprintf(`
-	data "google_project" "project" {}
-
-	resource "google_service_account" "dialogflowcx_service_account" {
-		account_id = "tf-test-dialogflow-%{random_suffix}"
-	}
-
-	resource "google_project_iam_member" "agent_create" {
-		project = data.google_project.project.project_id
-		role    = "roles/dialogflow.admin"
-		member  = "serviceAccount:${google_service_account.dialogflowcx_service_account.email}"
-	}
-
 	resource "google_dialogflow_cx_agent" "agent_entity" {
 		display_name = "tf-test-%{random_suffix}"
 		location = "global"
@@ -105,7 +80,6 @@ func testAccDialogflowCXEntityType_full(context map[string]interface{}) string {
 		time_zone = "America/New_York"
 		description = "Description 1."
 		avatar_uri = "https://storage.cloud.google.com/dialogflow-test-host-image/cloud-logo.png"
-		depends_on = [google_project_iam_member.agent_create]
 	}
     
 	resource "google_dialogflow_cx_entity_type" "my_entity" {
diff --git a/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_environment_test.go b/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_environment_test.go
index e53cf28ce2b4..db53c55bf10b 100644
--- a/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_environment_test.go
+++ b/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_environment_test.go
@@ -1,17 +1,12 @@
 package dialogflowcx_test
 
 import (
-	"fmt"
-	"strings"
 	"testing"
 
 	"github.com/hashicorp/terraform-provider-google/google/acctest"
 	"github.com/hashicorp/terraform-provider-google/google/envvar"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
-	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
-	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 )
 
 func TestAccDialogflowCXEnvironment_update(t *testing.T) {
@@ -49,18 +44,6 @@ func TestAccDialogflowCXEnvironment_update(t *testing.T) {
 
 func testAccDialogflowCXEnvironment_basic(context map[string]interface{}) string {
 	return acctest.Nprintf(`
-	data "google_project" "project" {}
-
-	resource "google_service_account" "dialogflowcx_service_account" {
-		account_id = "tf-test-dialogflow-%{random_suffix}"
-	}
-
-	resource "google_project_iam_member" "agent_create" {
-		project = data.google_project.project.project_id
-		role    = "roles/dialogflow.admin"
-		member  = "serviceAccount:${google_service_account.dialogflowcx_service_account.email}"
-	}
-
 	resource "google_dialogflow_cx_agent" "agent_version" {
 		display_name = "tf-test-%{random_suffix}"
 		location = "global"
@@ -69,7 +52,6 @@ func testAccDialogflowCXEnvironment_basic(context map[string]interface{}) string
 		time_zone = "America/New_York"
 		description = "Description 1."
 		avatar_uri = "https://storage.cloud.google.com/dialogflow-test-host-image/cloud-logo.png"
-		depends_on = [google_project_iam_member.agent_create]
 	}
     
 	resource "google_dialogflow_cx_version" "version1" {
@@ -90,18 +72,6 @@ func testAccDialogflowCXEnvironment_basic(context map[string]interface{}) string
 
 func testAccDialogflowCXEnvironment_full(context map[string]interface{}) string {
 	return acctest.Nprintf(`
-	data "google_project" "project" {}
-
-	resource "google_service_account" "dialogflowcx_service_account" {
-		account_id = "tf-test-dialogflow-%{random_suffix}"
-	}
-
-	resource "google_project_iam_member" "agent_create" {
-		project = data.google_project.project.project_id
-		role    = "roles/dialogflow.admin"
-		member  = "serviceAccount:${google_service_account.dialogflowcx_service_account.email}"
-	}
-
 	resource "google_dialogflow_cx_agent" "agent_version" {
 		display_name = "tf-test-%{random_suffix}"
 		location = "global"
@@ -110,7 +80,6 @@ func testAccDialogflowCXEnvironment_full(context map[string]interface{}) string
 		time_zone = "America/New_York"
 		description = "Description 1."
 		avatar_uri = "https://storage.cloud.google.com/dialogflow-test-host-image/cloud-logo.png"
-		depends_on = [google_project_iam_member.agent_create]
 	}
 
 	resource "google_dialogflow_cx_version" "version1" {
@@ -127,165 +96,10 @@ func testAccDialogflowCXEnvironment_full(context map[string]interface{}) string
 
 	resource "google_dialogflow_cx_environment" "development" {
         parent       = google_dialogflow_cx_agent.agent_version.id
-        display_name = "Development"
+        display_name = "Development updated"
         version_configs {
             version = google_dialogflow_cx_version.version2.id
         }
     }
 	  `, context)
 }
-
-func TestAccDialogflowCXEnvironment_dialogflowcxEnvironmentFullExample(t *testing.T) {
-	t.Parallel()
-
-	context := map[string]interface{}{
-		"random_suffix": acctest.RandString(t, 10),
-	}
-
-	acctest.VcrTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
-		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
-		CheckDestroy:             testAccCheckDialogflowCXEnvironmentDestroyProducer(t),
-		Steps: []resource.TestStep{
-			{
-				Config: testAccDialogflowCXEnvironment_dialogflowcxEnvironmentFullExample(context),
-			},
-			{
-				ResourceName:            "google_dialogflow_cx_environment.development",
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"parent"},
-			},
-		},
-	})
-}
-
-func testAccDialogflowCXEnvironment_dialogflowcxEnvironmentFullExample(context map[string]interface{}) string {
-	return acctest.Nprintf(`
-resource "google_dialogflow_cx_agent" "agent" {
-  display_name = "tf-test-dialogflowcx-agent%{random_suffix}"
-  location = "global"
-  default_language_code = "en"
-  supported_language_codes = ["fr","de","es"]
-  time_zone = "America/New_York"
-  description = "Example description."
-  avatar_uri = "https://cloud.google.com/_static/images/cloud/icons/favicons/onecloud/super_cloud.png"
-  enable_stackdriver_logging = true
-  enable_spell_correction    = true
-	speech_to_text_settings {
-		enable_speech_adaptation = true
-	}
-}
-
-resource "google_dialogflow_cx_version" "version_1" {
-  parent       = google_dialogflow_cx_agent.agent.start_flow
-  display_name = "1.0.0"
-  description  = "version 1.0.0"
-}
-
-resource "google_dialogflow_cx_environment" "development" {
-  parent       = google_dialogflow_cx_agent.agent.id
-  display_name = "Development"
-  description  = "Development Environment"
-  version_configs {
-    version = google_dialogflow_cx_version.version_1.id
-  }
-}
-`, context)
-}
-
-func TestAccDialogflowCXEnvironment_dialogflowcxEnvironmentRegional(t *testing.T) {
-	t.Parallel()
-
-	context := map[string]interface{}{
-		"random_suffix": acctest.RandString(t, 10),
-	}
-
-	acctest.VcrTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
-		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
-		CheckDestroy:             testAccCheckDialogflowCXEnvironmentDestroyProducer(t),
-		Steps: []resource.TestStep{
-			{
-				Config: testAccDialogflowCXEnvironment_dialogflowcxEnvironmentFRegional(context),
-			},
-			{
-				ResourceName:            "google_dialogflow_cx_environment.development",
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"parent"},
-			},
-		},
-	})
-}
-
-func testAccDialogflowCXEnvironment_dialogflowcxEnvironmentFRegional(context map[string]interface{}) string {
-	return acctest.Nprintf(`
-resource "google_dialogflow_cx_agent" "agent" {
-	display_name = "issue12880"
-	location = "europe-west2"
-	default_language_code = "en"
-	supported_language_codes = ["fr","de","es"]
-	time_zone = "Europe/London"
-	description = "CX BOT Agent"
-	enable_stackdriver_logging = true
-		speech_to_text_settings {
-			enable_speech_adaptation = true
-		}
-	}
-
-resource "google_dialogflow_cx_version" "version_1" {
-	parent       = google_dialogflow_cx_agent.agent.start_flow
-	display_name = "1.0.0"
-	description  = "version 1.0.0"
-}
-
-resource "google_dialogflow_cx_environment" "development" {
-	parent       = google_dialogflow_cx_agent.agent.id
-	display_name = "Development"
-	description  = "Development Environment"
-	version_configs {
-		version = google_dialogflow_cx_version.version_1.id
-	}
-}
-`, context)
-}
-
-func testAccCheckDialogflowCXEnvironmentDestroyProducer(t *testing.T) func(s *terraform.State) error {
-	return func(s *terraform.State) error {
-		for name, rs := range s.RootModule().Resources {
-			if rs.Type != "google_dialogflow_cx_environment" {
-				continue
-			}
-			if strings.HasPrefix(name, "data.") {
-				continue
-			}
-
-			config := acctest.GoogleProviderConfig(t)
-
-			url, err := tpgresource.ReplaceVarsForTest(config, rs, "{{DialogflowCXBasePath}}{{parent}}/environments/{{name}}")
-			if err != nil {
-				return err
-			}
-
-			billingProject := ""
-
-			if config.BillingProject != "" {
-				billingProject = config.BillingProject
-			}
-
-			_, err = transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
-				Config:    config,
-				Method:    "GET",
-				Project:   billingProject,
-				RawURL:    url,
-				UserAgent: config.UserAgent,
-			})
-			if err == nil {
-				return fmt.Errorf("DialogflowCXEnvironment still exists at %s", url)
-			}
-		}
-
-		return nil
-	}
-}
diff --git a/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_flow_test.go b/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_flow_test.go
index e30f0a2a83a1..3b75c3ae1d56 100644
--- a/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_flow_test.go
+++ b/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_flow_test.go
@@ -43,18 +43,6 @@ func TestAccDialogflowCXFlow_update(t *testing.T) {
 
 func testAccDialogflowCXFlow_basic(context map[string]interface{}) string {
 	return acctest.Nprintf(`
-  data "google_project" "project" {}
-
-  resource "google_service_account" "dialogflowcx_service_account" {
-    account_id = "tf-test-dialogflow-%{random_suffix}"
-  }
-
-  resource "google_project_iam_member" "agent_create" {
-    project = data.google_project.project.project_id
-    role    = "roles/dialogflow.admin"
-    member  = "serviceAccount:${google_service_account.dialogflowcx_service_account.email}"
-  }
-
   resource "google_dialogflow_cx_agent" "agent_entity" {
     display_name             = "tf-test-%{random_suffix}"
     location                 = "global"
@@ -63,7 +51,6 @@ func testAccDialogflowCXFlow_basic(context map[string]interface{}) string {
     time_zone                = "America/New_York"
     description              = "Description 1."
     avatar_uri               = "https://storage.cloud.google.com/dialogflow-test-host-image/cloud-logo.png"
-    depends_on               = [google_project_iam_member.agent_create]
   }
 
   resource "google_dialogflow_cx_flow" "my_flow" {
@@ -80,18 +67,6 @@ func testAccDialogflowCXFlow_basic(context map[string]interface{}) string {
 
 func testAccDialogflowCXFlow_full(context map[string]interface{}) string {
 	return acctest.Nprintf(`
-  data "google_project" "project" {}
-
-  resource "google_service_account" "dialogflowcx_service_account" {
-    account_id = "tf-test-dialogflow-%{random_suffix}"
-  }
-
-  resource "google_project_iam_member" "agent_create" {
-    project = data.google_project.project.project_id
-    role    = "roles/dialogflow.admin"
-    member  = "serviceAccount:${google_service_account.dialogflowcx_service_account.email}"
-  }
-
   resource "google_dialogflow_cx_agent" "agent_entity" {
     display_name               = "tf-test-dialogflowcx-agent%{random_suffix}update"
     location                   = "global"
@@ -105,7 +80,12 @@ func testAccDialogflowCXFlow_full(context map[string]interface{}) string {
     speech_to_text_settings {
       enable_speech_adaptation = true
     }
-    depends_on                 = [google_project_iam_member.agent_create]
+  }
+
+  resource "google_storage_bucket" "bucket" {
+    name                        = "tf-test-dialogflowcx-bucket%{random_suffix}"
+    location                    = "US"
+    uniform_bucket_level_access = true
   }
 
   resource "google_dialogflow_cx_flow" "my_flow" {
@@ -356,6 +336,217 @@ func testAccDialogflowCXFlow_full(context map[string]interface{}) string {
       }
       target_flow = google_dialogflow_cx_agent.agent_entity.start_flow
     }
+
+    advanced_settings {
+      audio_export_gcs_destination {
+        uri = "${google_storage_bucket.bucket.url}/prefix-"
+      }
+      dtmf_settings {
+        enabled      = true
+        max_digits   = 1
+        finish_digit = "#"
+      }
+    }
   }
 `, context)
 }
+
+func TestAccDialogflowCXFlow_defaultStartFlow(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		Steps: []resource.TestStep{
+			{
+				// Note: this isn't actually a "create" test; it creates a resource in the TF state, but is actually importing the default object GCP has created, then updating it.
+				Config: testAccDialogflowCXFlow_defaultStartFlow_create(context),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_dialogflow_cx_flow.default_start_flow", "name", "00000000-0000-0000-0000-000000000000"),
+					resource.TestCheckResourceAttrPair(
+						"google_dialogflow_cx_flow.default_start_flow", "id",
+						"google_dialogflow_cx_agent.agent", "start_flow",
+					),
+				),
+			},
+			{
+				ResourceName:      "google_dialogflow_cx_flow.default_start_flow",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				// This is testing updating the default object without having to create it in the TF state first.
+				Config: testAccDialogflowCXFlow_defaultStartFlow_update(context),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_dialogflow_cx_flow.default_start_flow", "name", "00000000-0000-0000-0000-000000000000"),
+					resource.TestCheckResourceAttrPair(
+						"google_dialogflow_cx_flow.default_start_flow", "id",
+						"google_dialogflow_cx_agent.agent", "start_flow",
+					),
+				),
+			},
+			{
+				ResourceName:      "google_dialogflow_cx_flow.default_start_flow",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccDialogflowCXFlow_defaultStartFlow_create(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_dialogflow_cx_agent" "agent" {
+  display_name          = "tf-test-dialogflowcx-agent%{random_suffix}"
+  location              = "global"
+  default_language_code = "en"
+  time_zone             = "America/New_York"
+}
+
+resource "google_dialogflow_cx_intent" "default_welcome_intent" {
+  parent                    = google_dialogflow_cx_agent.agent.id
+  is_default_welcome_intent = true
+  display_name              = "Default Welcome Intent"
+  priority                  = 1
+  training_phrases {
+    parts {
+      text = "Hello"
+    }
+    repeat_count = 1
+  }
+}
+
+
+resource "google_dialogflow_cx_flow" "default_start_flow" {
+  parent                = google_dialogflow_cx_agent.agent.id
+  is_default_start_flow = true
+  display_name          = "Default Start Flow"
+  description           = "A start flow created along with the agent"
+
+  nlu_settings {
+    classification_threshold = 0.3
+    model_type               = "MODEL_TYPE_STANDARD"
+  }
+
+  transition_routes {
+    intent = google_dialogflow_cx_intent.default_welcome_intent.id
+    trigger_fulfillment {
+      messages {
+        text {
+          text = ["Response to default welcome intent."]
+        }
+      }
+    }
+  }
+
+  event_handlers {
+    event = "custom-event"
+    trigger_fulfillment {
+      messages {
+        text {
+          text = ["Handle a custom event!"]
+        }
+      }
+    }
+  }
+
+  event_handlers {
+    event = "sys.no-match-default"
+    trigger_fulfillment {
+      messages {
+        text {
+          text = ["This is the flow no-match response."]
+        }
+      }
+    }
+  }
+
+  event_handlers {
+    event = "sys.no-input-default"
+    trigger_fulfillment {
+      messages {
+        text {
+          text = ["This is the flow no-input response."]
+        }
+      }
+    }
+  }
+}
+`, context)
+}
+
+func testAccDialogflowCXFlow_defaultStartFlow_update(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_dialogflow_cx_agent" "agent" {
+  display_name          = "tf-test-dialogflowcx-agent%{random_suffix}"
+  location              = "global"
+  default_language_code = "en"
+  time_zone             = "America/New_York"
+}
+
+resource "google_dialogflow_cx_intent" "default_welcome_intent" {
+  parent                    = google_dialogflow_cx_agent.agent.id
+  is_default_welcome_intent = true
+  display_name              = "Default Welcome Intent"
+  priority                  = 1
+  training_phrases {
+    parts {
+      text = "Hello"
+    }
+    repeat_count = 1
+  }
+}
+
+
+resource "google_dialogflow_cx_flow" "default_start_flow" {
+  parent                = google_dialogflow_cx_agent.agent.id
+  is_default_start_flow = true
+  display_name          = "Default Start Flow"
+  description           = "A start flow created along with the agent"
+
+  nlu_settings {
+    classification_threshold = 0.5
+    model_type               = "MODEL_TYPE_STANDARD"
+  }
+
+  transition_routes {
+    intent = google_dialogflow_cx_intent.default_welcome_intent.id
+    trigger_fulfillment {
+      messages {
+        text {
+          text = ["We can update the default welcome intent response!"]
+        }
+      }
+    }
+  }
+
+  // delete the custom-event handler to show we can
+
+  event_handlers {
+    event = "sys.no-match-default"
+    trigger_fulfillment {
+      messages {
+        text {
+          text = ["We an also update the no-match response!"]
+        }
+      }
+    }
+  }
+
+  event_handlers {
+    event = "sys.no-input-default"
+    trigger_fulfillment {
+      messages {
+        text {
+          text = ["The no-input response has been updated too!"]
+        }
+      }
+    }
+  }
+}
+`, context)
+}
diff --git a/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_intent_test.go b/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_intent_test.go
index eba882c85830..7d073bc64883 100644
--- a/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_intent_test.go
+++ b/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_intent_test.go
@@ -25,17 +25,19 @@ func TestAccDialogflowCXIntent_update(t *testing.T) {
 				Config: testAccDialogflowCXIntent_basic(context),
 			},
 			{
-				ResourceName:      "google_dialogflow_cx_intent.my_intent",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_dialogflow_cx_intent.my_intent",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccDialogflowCXIntent_full(context),
 			},
 			{
-				ResourceName:      "google_dialogflow_cx_intent.my_intent",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_dialogflow_cx_intent.my_intent",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -43,18 +45,6 @@ func TestAccDialogflowCXIntent_update(t *testing.T) {
 
 func testAccDialogflowCXIntent_basic(context map[string]interface{}) string {
 	return acctest.Nprintf(`
-	data "google_project" "project" {}
-
-	resource "google_service_account" "dialogflowcx_service_account" {
-		account_id = "tf-test-dialogflow-%{random_suffix}"
-	}
-
-	resource "google_project_iam_member" "agent_create" {
-		project = data.google_project.project.project_id
-		role    = "roles/dialogflow.admin"
-		member  = "serviceAccount:${google_service_account.dialogflowcx_service_account.email}"
-	}
-
 	resource "google_dialogflow_cx_agent" "agent_intent" {
 		display_name = "tf-test-%{random_suffix}"
 		location = "global"
@@ -63,7 +53,6 @@ func testAccDialogflowCXIntent_basic(context map[string]interface{}) string {
 		time_zone = "America/New_York"
 		description = "Description 1."
 		avatar_uri = "https://storage.cloud.google.com/dialogflow-test-host-image/cloud-logo.png"
-		depends_on = [google_project_iam_member.agent_create]
 	}
     
 	resource "google_dialogflow_cx_intent" "my_intent" {
@@ -102,18 +91,6 @@ func testAccDialogflowCXIntent_basic(context map[string]interface{}) string {
 
 func testAccDialogflowCXIntent_full(context map[string]interface{}) string {
 	return acctest.Nprintf(`
-	data "google_project" "project" {}
-
-	resource "google_service_account" "dialogflowcx_service_account" {
-		account_id = "tf-test-dialogflow-%{random_suffix}"
-	}
-
-	resource "google_project_iam_member" "agent_create" {
-		project = data.google_project.project.project_id
-		role    = "roles/dialogflow.admin"
-		member  = "serviceAccount:${google_service_account.dialogflowcx_service_account.email}"
-	}
-
 	resource "google_dialogflow_cx_agent" "agent_intent" {
 		display_name = "tf-test-%{random_suffix}update"
 		location = "global"
@@ -127,7 +104,6 @@ func testAccDialogflowCXIntent_full(context map[string]interface{}) string {
 		speech_to_text_settings {
 			enable_speech_adaptation = true
 		}
-		depends_on = [google_project_iam_member.agent_create]
 	}
     
 	resource "google_dialogflow_cx_intent" "my_intent" {
@@ -163,3 +139,134 @@ func testAccDialogflowCXIntent_full(context map[string]interface{}) string {
     } 
 	  `, context)
 }
+
+func TestAccDialogflowCXIntent_defaultIntents(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		Steps: []resource.TestStep{
+			{
+				// Note: this isn't actually a "create" test; it creates resources in the TF state, but is actually importing the default objects GCP has created, then updating them.
+				Config: testAccDialogflowCXIntent_defaultIntents_create(context),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_dialogflow_cx_intent.default_negative_intent", "name", "00000000-0000-0000-0000-000000000001"),
+					resource.TestCheckResourceAttr("google_dialogflow_cx_intent.default_welcome_intent", "name", "00000000-0000-0000-0000-000000000000"),
+				),
+			},
+			{
+				ResourceName:            "google_dialogflow_cx_intent.default_negative_intent",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
+			},
+			{
+				ResourceName:            "google_dialogflow_cx_intent.default_welcome_intent",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
+			},
+			{
+				// This is testing updating the default objects without having to create them in the TF state first.
+				Config: testAccDialogflowCXIntent_defaultIntents_update(context),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_dialogflow_cx_intent.default_negative_intent", "name", "00000000-0000-0000-0000-000000000001"),
+					resource.TestCheckResourceAttr("google_dialogflow_cx_intent.default_welcome_intent", "name", "00000000-0000-0000-0000-000000000000"),
+				),
+			},
+			{
+				ResourceName:            "google_dialogflow_cx_intent.default_negative_intent",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
+			},
+			{
+				ResourceName:            "google_dialogflow_cx_intent.default_welcome_intent",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccDialogflowCXIntent_defaultIntents_create(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_dialogflow_cx_agent" "agent" {
+  display_name          = "tf-test-dialogflowcx-agent%{random_suffix}"
+  location              = "global"
+  default_language_code = "en"
+  time_zone             = "America/New_York"
+}
+
+resource "google_dialogflow_cx_intent" "default_negative_intent" {
+  parent                     = google_dialogflow_cx_agent.agent.id
+  is_default_negative_intent = true
+  display_name               = "Default Negative Intent"
+  priority                   = 1
+  is_fallback                = true
+  training_phrases {
+     parts {
+         text = "Never match this phrase"
+     }
+     repeat_count = 1
+  }
+}
+
+resource "google_dialogflow_cx_intent" "default_welcome_intent" {
+  parent                    = google_dialogflow_cx_agent.agent.id
+  is_default_welcome_intent = true
+  display_name              = "Default Welcome Intent"
+  priority                  = 1
+  training_phrases {
+     parts {
+         text = "Hello"
+     }
+     repeat_count = 1
+  }
+}
+`, context)
+}
+
+func testAccDialogflowCXIntent_defaultIntents_update(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_dialogflow_cx_agent" "agent" {
+  display_name          = "tf-test-dialogflowcx-agent%{random_suffix}"
+  location              = "global"
+  default_language_code = "en"
+  time_zone             = "America/New_York"
+}
+
+resource "google_dialogflow_cx_intent" "default_negative_intent" {
+  parent                     = google_dialogflow_cx_agent.agent.id
+  is_default_negative_intent = true
+  display_name               = "Default Negative Intent"
+  priority                   = 1
+  is_fallback                = true
+  training_phrases {
+     parts {
+         text = "An updated phrase to never match."
+     }
+     repeat_count = 2
+  }
+}
+
+resource "google_dialogflow_cx_intent" "default_welcome_intent" {
+  parent                    = google_dialogflow_cx_agent.agent.id
+  is_default_welcome_intent = true
+  display_name              = "Default Welcome Intent"
+  priority                  = 1
+  training_phrases {
+     parts {
+         text = "An updated hello."
+     }
+     repeat_count = 2
+  }
+}
+`, context)
+}
diff --git a/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_page_test.go b/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_page_test.go
index 05d876d11869..ed35567a0aca 100644
--- a/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_page_test.go
+++ b/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_page_test.go
@@ -43,18 +43,6 @@ func TestAccDialogflowCXPage_update(t *testing.T) {
 
 func testAccDialogflowCXPage_basic(context map[string]interface{}) string {
 	return acctest.Nprintf(`
-  data "google_project" "project" {}
-
-  resource "google_service_account" "dialogflowcx_service_account" {
-    account_id = "tf-test-dialogflow-%{random_suffix}"
-  }
-
-  resource "google_project_iam_member" "agent_create" {
-    project = data.google_project.project.project_id
-    role    = "roles/dialogflow.admin"
-    member  = "serviceAccount:${google_service_account.dialogflowcx_service_account.email}"
-  }
-
   resource "google_dialogflow_cx_agent" "agent_page" {
     display_name             = "tf-test-%{random_suffix}"
     location                 = "global"
@@ -63,7 +51,6 @@ func testAccDialogflowCXPage_basic(context map[string]interface{}) string {
     time_zone                = "America/New_York"
     description              = "Description 1."
     avatar_uri               = "https://storage.cloud.google.com/dialogflow-test-host-image/cloud-logo.png"
-    depends_on               = [google_project_iam_member.agent_create]
   }
 
   resource "google_dialogflow_cx_page" "my_page" {
@@ -75,18 +62,6 @@ func testAccDialogflowCXPage_basic(context map[string]interface{}) string {
 
 func testAccDialogflowCXPage_full(context map[string]interface{}) string {
 	return acctest.Nprintf(`
-  data "google_project" "project" {}
-
-  resource "google_service_account" "dialogflowcx_service_account" {
-    account_id = "tf-test-dialogflow-%{random_suffix}"
-  }
-
-  resource "google_project_iam_member" "agent_create" {
-    project = data.google_project.project.project_id
-    role    = "roles/dialogflow.admin"
-    member  = "serviceAccount:${google_service_account.dialogflowcx_service_account.email}"
-  }
-
   resource "google_dialogflow_cx_agent" "agent_page" {
     display_name               = "tf-test-%{random_suffix}update"
     location                   = "global"
@@ -100,7 +75,6 @@ func testAccDialogflowCXPage_full(context map[string]interface{}) string {
     speech_to_text_settings {
       enable_speech_adaptation = true
     }
-    depends_on = [google_project_iam_member.agent_create]
   }
 
   resource "google_dialogflow_cx_page" "my_page" {
@@ -521,6 +495,13 @@ func testAccDialogflowCXPage_full(context map[string]interface{}) string {
         }
         required = "true"
         redact   = "true"
+        advanced_settings {
+          dtmf_settings {
+            enabled      = true
+            max_digits   = 1
+            finish_digit = "#"
+          }
+        }
       }
     }
 
@@ -624,6 +605,14 @@ func testAccDialogflowCXPage_full(context map[string]interface{}) string {
       }
       target_page = google_dialogflow_cx_page.my_page2.id
     }
+
+    advanced_settings {
+      dtmf_settings {
+        enabled      = true
+        max_digits   = 1
+        finish_digit = "#"
+      }
+    }
   }
 
   resource "google_dialogflow_cx_page" "my_page2" {
diff --git a/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_version_test.go b/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_version_test.go
new file mode 100644
index 000000000000..b254e970544c
--- /dev/null
+++ b/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_version_test.go
@@ -0,0 +1,82 @@
+package dialogflowcx_test
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+	"github.com/hashicorp/terraform-provider-google/google/envvar"
+)
+
+func TestAccDialogflowCXVersion_update(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"org_id":          envvar.GetTestOrgFromEnv(t),
+		"billing_account": envvar.GetTestBillingAccountFromEnv(t),
+		"random_suffix":   acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDialogflowCXVersion_basic(context),
+			},
+			{
+				ResourceName:      "google_dialogflow_cx_version.version1",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccDialogflowCXVersion_full(context),
+			},
+			{
+				ResourceName:      "google_dialogflow_cx_version.version1",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccDialogflowCXVersion_basic(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+	resource "google_dialogflow_cx_agent" "agent_version" {
+		display_name = "tf-test-%{random_suffix}"
+		location = "global"
+		default_language_code = "en"
+		supported_language_codes = ["fr","de","es"]
+		time_zone = "America/New_York"
+		description = "Description 1."
+		avatar_uri = "https://storage.cloud.google.com/dialogflow-test-host-image/cloud-logo.png"
+	}
+    
+	resource "google_dialogflow_cx_version" "version1" {
+		parent       = google_dialogflow_cx_agent.agent_version.start_flow
+		display_name = "1.0.0"
+		description  = "version 1.0.0"
+	}
+    `, context)
+}
+
+func testAccDialogflowCXVersion_full(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+	resource "google_dialogflow_cx_agent" "agent_version" {
+		display_name = "tf-test-%{random_suffix}"
+		location = "global"
+		default_language_code = "en"
+		supported_language_codes = ["fr","de","es"]
+		time_zone = "America/New_York"
+		description = "Description 1."
+		avatar_uri = "https://storage.cloud.google.com/dialogflow-test-host-image/cloud-logo.png"
+	}
+
+	resource "google_dialogflow_cx_version" "version1" {
+		parent       = google_dialogflow_cx_agent.agent_version.start_flow
+		display_name = "1.0.0 updated"
+		description  = "version 1.0.0 updated"
+	}
+	  `, context)
+}
diff --git a/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_version_test.go.erb b/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_version_test.go.erb
deleted file mode 100644
index 8991289374a0..000000000000
--- a/mmv1/third_party/terraform/services/dialogflowcx/resource_dialogflowcx_version_test.go.erb
+++ /dev/null
@@ -1,208 +0,0 @@
-<% autogen_exception -%>
-package dialogflowcx_test
-
-import (
-	"fmt"
-	"strings"
-	"testing"
-
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
-	"github.com/hashicorp/terraform-provider-google/google/acctest"
-	"github.com/hashicorp/terraform-provider-google/google/envvar"
-	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
-	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
-)
-
-func TestAccDialogflowCXVersion_update(t *testing.T) {
-	t.Parallel()
-
-	context := map[string]interface{}{
-		"org_id":          envvar.GetTestOrgFromEnv(t),
-		"billing_account": envvar.GetTestBillingAccountFromEnv(t),
-		"random_suffix":   acctest.RandString(t, 10),
-	}
-
-	acctest.VcrTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
-		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
-		Steps: []resource.TestStep{
-			{
-				Config: testAccDialogflowCXVersion_basic(context),
-			},
-			{
-				ResourceName:            "google_dialogflow_cx_version.version1",
-				ImportState:             true,
-				ImportStateVerify:       true,
-			},
-			{
-				Config: testAccDialogflowCXVersion_full(context),
-			},
-			{
-				ResourceName:            "google_dialogflow_cx_version.version1",
-				ImportState:             true,
-				ImportStateVerify:       true,
-			},
-		},
-	})
-}
-
-func testAccDialogflowCXVersion_basic(context map[string]interface{}) string {
-	return acctest.Nprintf(`
-	data "google_project" "project" {}
-
-	resource "google_service_account" "dialogflowcx_service_account" {
-		account_id = "tf-test-dialogflow-%{random_suffix}"
-	}
-
-	resource "google_project_iam_member" "agent_create" {
-		project = data.google_project.project.project_id
-		role    = "roles/dialogflow.admin"
-		member  = "serviceAccount:${google_service_account.dialogflowcx_service_account.email}"
-	}
-
-	resource "google_dialogflow_cx_agent" "agent_version" {
-		display_name = "tf-test-%{random_suffix}"
-		location = "global"
-		default_language_code = "en"
-		supported_language_codes = ["fr","de","es"]
-		time_zone = "America/New_York"
-		description = "Description 1."
-		avatar_uri = "https://storage.cloud.google.com/dialogflow-test-host-image/cloud-logo.png"
-		depends_on = [google_project_iam_member.agent_create]
-	}
-    
-	resource "google_dialogflow_cx_version" "version1" {
-		parent       = google_dialogflow_cx_agent.agent_version.start_flow
-		display_name = "1.0.0"
-		description  = "version 1.0.0"
-	}
-    `, context)
-}
-
-func testAccDialogflowCXVersion_full(context map[string]interface{}) string {
-	return acctest.Nprintf(`
-	data "google_project" "project" {}
-
-	resource "google_service_account" "dialogflowcx_service_account" {
-		account_id = "tf-test-dialogflow-%{random_suffix}"
-	}
-
-	resource "google_project_iam_member" "agent_create" {
-    project = data.google_project.project.project_id
-		role    = "roles/dialogflow.admin"
-		member  = "serviceAccount:${google_service_account.dialogflowcx_service_account.email}"
-	}
-
-	resource "google_dialogflow_cx_agent" "agent_version" {
-		display_name = "tf-test-%{random_suffix}update"
-		location = "global"
-		default_language_code = "en"
-		supported_language_codes = ["no"]
-		time_zone = "Europe/London"
-		description = "Description 2!"
-		avatar_uri = "https://storage.cloud.google.com/dialogflow-test-host-image/cloud-logo-2.png"
-		enable_stackdriver_logging = true
-        enable_spell_correction    = true
-		speech_to_text_settings {
-			enable_speech_adaptation = true
-		}
-		depends_on = [google_project_iam_member.agent_create]
-	}
-	resource "google_dialogflow_cx_version" "version1" {
-		parent       = google_dialogflow_cx_agent.agent_version.start_flow
-		display_name = "1.0.0"
-		description  = "version 1.0.0"
-	}
-	  `, context)
-}
-
-func TestAccDialogflowCXVersion_dialogflowcxVersionFullExample(t *testing.T) {
-	t.Parallel()
-
-	context := map[string]interface{}{
-		"random_suffix": acctest.RandString(t, 10),
-	}
-
-	acctest.VcrTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
-		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
-		CheckDestroy:             testAccCheckDialogflowCXVersionDestroyProducer(t),
-		Steps: []resource.TestStep{
-			{
-				Config: testAccDialogflowCXVersion_dialogflowcxVersionFullExample(context),
-			},
-			{
-				ResourceName:            "google_dialogflow_cx_version.version_1",
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"parent"},
-			},
-		},
-	})
-}
-
-func testAccDialogflowCXVersion_dialogflowcxVersionFullExample(context map[string]interface{}) string {
-	return acctest.Nprintf(`
-resource "google_dialogflow_cx_agent" "agent" {
-  display_name = "tf-test-dialogflowcx-agent%{random_suffix}"
-  location = "global"
-  default_language_code = "en"
-  supported_language_codes = ["fr","de","es"]
-  time_zone = "America/New_York"
-  description = "Example description."
-  avatar_uri = "https://cloud.google.com/_static/images/cloud/icons/favicons/onecloud/super_cloud.png"
-  enable_stackdriver_logging = true
-  enable_spell_correction    = true
-	speech_to_text_settings {
-		enable_speech_adaptation = true
-	}
-}
-
-
-resource "google_dialogflow_cx_version" "version_1" {
-  parent       = google_dialogflow_cx_agent.agent.start_flow
-  display_name = "1.0.0"
-  description  = "version 1.0.0"
-}
-`, context)
-}
-
-func testAccCheckDialogflowCXVersionDestroyProducer(t *testing.T) func(s *terraform.State) error {
-	return func(s *terraform.State) error {
-		for name, rs := range s.RootModule().Resources {
-			if rs.Type != "google_dialogflow_cx_version" {
-				continue
-			}
-			if strings.HasPrefix(name, "data.") {
-				continue
-			}
-
-			config := acctest.GoogleProviderConfig(t)
-
-			url, err := tpgresource.ReplaceVarsForTest(config, rs, "{{DialogflowCXBasePath}}{{parent}}/versions/{{name}}")
-			if err != nil {
-				return err
-			}
-
-			billingProject := ""
-
-			if config.BillingProject != "" {
-				billingProject = config.BillingProject
-			}
-
-			_, err = transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
-				Config: config,
-				Method: "GET",
-				Project: billingProject,
-				RawURL: url,
-				UserAgent: config.UserAgent,
-			})
-			if err == nil {
-				return fmt.Errorf("DialogflowCXVersion still exists at %s", url)
-			}
-		}
-
-		return nil
-	}
-}
diff --git a/mmv1/third_party/terraform/services/dns/data_source_dns_keys.go b/mmv1/third_party/terraform/services/dns/data_source_dns_keys.go
index 1cc9c8af095f..470815cdc2d0 100644
--- a/mmv1/third_party/terraform/services/dns/data_source_dns_keys.go
+++ b/mmv1/third_party/terraform/services/dns/data_source_dns_keys.go
@@ -16,7 +16,6 @@ import (
 	"github.com/hashicorp/terraform-provider-google/google/fwmodels"
 	"github.com/hashicorp/terraform-provider-google/google/fwresource"
 	"github.com/hashicorp/terraform-provider-google/google/fwtransport"
-	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 )
 
 // Ensure the implementation satisfies the expected interfaces
@@ -179,9 +178,7 @@ func (d *GoogleDnsKeysDataSource) Read(ctx context.Context, req datasource.ReadR
 
 	clientResp, err := d.client.DnsKeys.List(data.Project.ValueString(), data.ManagedZone.ValueString()).Do()
 	if err != nil {
-		if !transport_tpg.IsGoogleApiErrorWithCode(err, 404) {
-			resp.Diagnostics.AddError(fmt.Sprintf("Error when reading or editing dataSourceDnsKeys"), err.Error())
-		}
+		resp.Diagnostics.AddError(fmt.Sprintf("Error when reading or editing dataSourceDnsKeys"), err.Error())
 		// Save data into Terraform state
 		resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
 		return
diff --git a/mmv1/third_party/terraform/services/dns/data_source_dns_managed_zone_test.go.erb b/mmv1/third_party/terraform/services/dns/data_source_dns_managed_zone_test.go.erb
index 12ab91ef997a..d5109d5fb4f0 100644
--- a/mmv1/third_party/terraform/services/dns/data_source_dns_managed_zone_test.go.erb
+++ b/mmv1/third_party/terraform/services/dns/data_source_dns_managed_zone_test.go.erb
@@ -40,6 +40,8 @@ func TestAccDataSourceDnsManagedZone_basic(t *testing.T) {
 						"forwarding_config.#":                   {},
 						"force_destroy":                         {},
 						"labels.#":                              {},
+						"terraform_labels.%":                    {},
+						"effective_labels.%":                    {},
 						"creation_time":                         {},
 						"cloud_logging_config.#":                {},
 						"cloud_logging_config.0.%":              {},
@@ -63,6 +65,8 @@ func TestAccDataSourceDnsManagedZone_basic(t *testing.T) {
 						"forwarding_config.#":                   {},
 						"force_destroy":                         {},
 						"labels.#":                              {},
+						"terraform_labels.%":                    {},
+						"effective_labels.%":                    {},
 						"creation_time":                         {},
 						"cloud_logging_config.#":                {},
 						"cloud_logging_config.0.%":              {},
diff --git a/mmv1/third_party/terraform/services/dns/resource_dns_managed_zone_test.go.erb b/mmv1/third_party/terraform/services/dns/resource_dns_managed_zone_test.go.erb
index 5b6fdd6f76ba..fbbd8ad3bbcf 100644
--- a/mmv1/third_party/terraform/services/dns/resource_dns_managed_zone_test.go.erb
+++ b/mmv1/third_party/terraform/services/dns/resource_dns_managed_zone_test.go.erb
@@ -32,6 +32,7 @@ func TestAccDNSManagedZone_update(t *testing.T) {
 				ResourceName:      "google_dns_managed_zone.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccDnsManagedZone_basic(zoneSuffix, "description2", map[string]string{"foo": "bar"}),
@@ -40,6 +41,7 @@ func TestAccDNSManagedZone_update(t *testing.T) {
 				ResourceName:      "google_dns_managed_zone.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -174,6 +176,7 @@ func TestAccDNSManagedZone_cloudLoggingConfigUpdate(t *testing.T) {
 				ResourceName:      "google_dns_managed_zone.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccDnsManagedZone_cloudLoggingConfig_update(zoneSuffix, true),
@@ -182,6 +185,7 @@ func TestAccDNSManagedZone_cloudLoggingConfigUpdate(t *testing.T) {
 				ResourceName:      "google_dns_managed_zone.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccDnsManagedZone_cloudLoggingConfig_update(zoneSuffix, false),
@@ -190,6 +194,7 @@ func TestAccDNSManagedZone_cloudLoggingConfigUpdate(t *testing.T) {
 				ResourceName:      "google_dns_managed_zone.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -438,6 +443,7 @@ resource "google_container_cluster" "cluster-1" {
   name               = "tf-test-cluster-1-%s"
   location           = "us-central1-c"
   initial_node_count = 1
+  deletion_protection = false
 
   networking_mode = "VPC_NATIVE"
   default_snat_status {
diff --git a/mmv1/third_party/terraform/services/dns/resource_dns_record_set.go b/mmv1/third_party/terraform/services/dns/resource_dns_record_set.go
index 38d53ebc4b39..f5b0b41b6b14 100644
--- a/mmv1/third_party/terraform/services/dns/resource_dns_record_set.go
+++ b/mmv1/third_party/terraform/services/dns/resource_dns_record_set.go
@@ -8,6 +8,7 @@ import (
 
 	"net"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
@@ -81,6 +82,10 @@ func ResourceDnsRecordSet() *schema.Resource {
 			State: resourceDnsRecordSetImportState,
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+		),
+
 		Schema: map[string]*schema.Schema{
 			"managed_zone": {
 				Type:             schema.TypeString,
@@ -425,15 +430,11 @@ func resourceDnsRecordSetRead(d *schema.ResourceData, meta interface{}) error {
 	if err := d.Set("ttl", rrset.Ttl); err != nil {
 		return fmt.Errorf("Error setting ttl: %s", err)
 	}
-	if len(rrset.Rrdatas) > 0 {
-		if err := d.Set("rrdatas", rrset.Rrdatas); err != nil {
-			return fmt.Errorf("Error setting rrdatas: %s", err)
-		}
+	if err := d.Set("rrdatas", rrset.Rrdatas); err != nil {
+		return fmt.Errorf("Error setting rrdatas: %s", err)
 	}
-	if rrset.RoutingPolicy != nil {
-		if err := d.Set("routing_policy", flattenDnsRecordSetRoutingPolicy(rrset.RoutingPolicy)); err != nil {
-			return fmt.Errorf("Error setting routing_policy: %s", err)
-		}
+	if err := d.Set("routing_policy", flattenDnsRecordSetRoutingPolicy(rrset.RoutingPolicy)); err != nil {
+		return fmt.Errorf("Error setting routing_policy: %s", err)
 	}
 	if err := d.Set("project", project); err != nil {
 		return fmt.Errorf("Error setting project: %s", err)
diff --git a/mmv1/third_party/terraform/services/dns/resource_dns_record_set_test.go.erb b/mmv1/third_party/terraform/services/dns/resource_dns_record_set_test.go.erb
index 6be8cd14b1e5..4255d51eeb4e 100644
--- a/mmv1/third_party/terraform/services/dns/resource_dns_record_set_test.go.erb
+++ b/mmv1/third_party/terraform/services/dns/resource_dns_record_set_test.go.erb
@@ -15,6 +15,7 @@ import (
 	tpgdns "github.com/hashicorp/terraform-provider-google/google/services/dns"
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
+    "google.golang.org/api/dns/v1"
 )
 
 func TestIpv6AddressDiffSuppress(t *testing.T) {
@@ -344,6 +345,15 @@ func TestAccDNSRecordSet_changeRouting(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
+            {
+				Config: testAccDnsRecordSet_basic(zoneName, "127.0.0.10", 300),
+			},
+			{
+				ResourceName:      "google_dns_record_set.foobar",
+				ImportStateId:     fmt.Sprintf("%s/%s/test-record.%s.hashicorptest.com./A", envvar.GetTestProjectFromEnv(), zoneName, zoneName),
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
@@ -371,6 +381,181 @@ func TestAccDNSRecordSet_interpolated(t *testing.T) {
 	})
 }
 
+func TestAccDNSRecordSet_readOutOfBandRoutingPolicyChange(t *testing.T) {
+	t.Parallel()
+
+	zoneName := fmt.Sprintf("dnszone-test-%s", acctest.RandString(t, 10))
+	rrsetName := fmt.Sprintf("test-record.%s.hashicorptest.com.", zoneName)
+	ttl := 300
+	rrdata := []string{"127.0.0.1", "127.0.0.10"}
+	routingPolicy := &dns.RRSetRoutingPolicy{
+		Wrr: &dns.RRSetRoutingPolicyWrrPolicy{
+			Items: []*dns.RRSetRoutingPolicyWrrPolicyWrrPolicyItem{
+				{
+					Weight:  0,
+					Rrdatas: []string{"1.2.3.4", "4.3.2.1"},
+				},
+				{
+					Weight:  0,
+					Rrdatas: []string{"2.3.4.5", "5.4.3.2"},
+				},
+			},
+		},
+	}
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckDnsRecordSetDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDnsRecordSet_basic(zoneName, "127.0.0.10", 300),
+			},
+			{
+				ResourceName:      "google_dns_record_set.foobar",
+				ImportStateId:     fmt.Sprintf("%s/%s/test-record.%s.hashicorptest.com./A", envvar.GetTestProjectFromEnv(), zoneName, zoneName),
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				PreConfig: testAccCheckDnsRecordSetSetRoutingPolicyOutOfBand(t, zoneName, rrsetName, ttl, rrdata, routingPolicy),
+				Config:    testAccDnsRecordSet_basic(zoneName, "127.0.0.10", 300),
+			},
+			{
+				ResourceName:      "google_dns_record_set.foobar",
+				ImportStateId:     fmt.Sprintf("%s/%s/test-record.%s.hashicorptest.com./A", envvar.GetTestProjectFromEnv(), zoneName, zoneName),
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccDNSRecordSet_readOutOfBandRrDataChange(t *testing.T) {
+	t.Parallel()
+
+	zoneName := fmt.Sprintf("dnszone-test-%s", acctest.RandString(t, 10))
+	rrsetName := fmt.Sprintf("test-record.%s.hashicorptest.com.", zoneName)
+	ttl := 300
+	rrdata := []string{"127.0.0.1", "127.0.0.10"}
+	routingPolicy := &dns.RRSetRoutingPolicy{
+		Wrr: &dns.RRSetRoutingPolicyWrrPolicy{
+			Items: []*dns.RRSetRoutingPolicyWrrPolicyWrrPolicyItem{
+				{
+					Weight:  0,
+					Rrdatas: []string{"1.2.3.4", "4.3.2.1"},
+				},
+				{
+					Weight:  0,
+					Rrdatas: []string{"2.3.4.5", "5.4.3.2"},
+				},
+			},
+		},
+	}
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckDnsRecordSetDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDnsRecordSet_routingPolicy(zoneName, 300),
+			},
+			{
+				ResourceName:      "google_dns_record_set.foobar",
+				ImportStateId:     fmt.Sprintf("%s/%s/test-record.%s.hashicorptest.com./A", envvar.GetTestProjectFromEnv(), zoneName, zoneName),
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				PreConfig: testAccCheckDnsRecordSetSetRrdataOutOfBand(t, zoneName, rrsetName, ttl, rrdata, routingPolicy),
+				Config:    testAccDnsRecordSet_routingPolicy(zoneName, 300),
+			},
+			{
+				ResourceName:      "google_dns_record_set.foobar",
+				ImportStateId:     fmt.Sprintf("%s/%s/test-record.%s.hashicorptest.com./A", envvar.GetTestProjectFromEnv(), zoneName, zoneName),
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccCheckDnsRecordSetSetRoutingPolicyOutOfBand(t *testing.T, zoneName, rrsetName string, ttl int, rrdata []string, routingPolicy *dns.RRSetRoutingPolicy) func() {
+	return func() {
+		config := acctest.GoogleProviderConfig(t)
+		service := config.NewDnsClient(config.UserAgent).Changes
+		chg := &dns.Change{
+			Deletions: []*dns.ResourceRecordSet{
+				{
+					Name:    rrsetName,
+					Type:    "A",
+					Ttl:     int64(ttl),
+					Rrdatas: rrdata,
+				},
+			},
+			Additions: []*dns.ResourceRecordSet{
+				{
+					Name:          rrsetName,
+					Type:          "A",
+					Ttl:           int64(ttl),
+					RoutingPolicy: routingPolicy,
+				},
+			},
+		}
+		chg, err := service.Create(config.Project, zoneName, chg).Do()
+		if err != nil {
+			t.Errorf("Error while changing rrset %s/%s/%s out of band: %s", config.Project, zoneName, rrsetName, err)
+			return
+		}
+		w := &tpgdns.DnsChangeWaiter{
+			Service:     config.NewDnsClient(config.UserAgent),
+			Change:      chg,
+			Project:     config.Project,
+			ManagedZone: zoneName,
+		}
+		if _, err = w.Conf().WaitForState(); err != nil {
+			t.Errorf("Error waiting for out of band Google DNS change: %s", err)
+		}
+	}
+}
+
+func testAccCheckDnsRecordSetSetRrdataOutOfBand(t *testing.T, zoneName, rrsetName string, ttl int, rrdata []string, routingPolicy *dns.RRSetRoutingPolicy) func() {
+	return func() {
+		config := acctest.GoogleProviderConfig(t)
+		service := config.NewDnsClient(config.UserAgent).Changes
+		chg := &dns.Change{
+			Deletions: []*dns.ResourceRecordSet{
+				{
+					Name:          rrsetName,
+					Type:          "A",
+					Ttl:           int64(ttl),
+					RoutingPolicy: routingPolicy,
+				},
+			},
+			Additions: []*dns.ResourceRecordSet{
+				{
+					Name:    rrsetName,
+					Type:    "A",
+					Ttl:     int64(ttl),
+					Rrdatas: rrdata,
+				},
+			},
+		}
+		chg, err := service.Create(config.Project, zoneName, chg).Do()
+		if err != nil {
+			t.Errorf("Error while changing rrset %s/%s/%s out of band: %s", config.Project, zoneName, rrsetName, err)
+			return
+		}
+		w := &tpgdns.DnsChangeWaiter{
+			Service:     config.NewDnsClient(config.UserAgent),
+			Change:      chg,
+			Project:     config.Project,
+			ManagedZone: zoneName,
+		}
+		if _, err = w.Conf().WaitForState(); err != nil {
+			t.Errorf("Error waiting for out of band Google DNS change: %s", err)
+		}
+	}
+}
 
 func testAccCheckDnsRecordSetDestroyProducer(t *testing.T) func(s *terraform.State) error {
 
diff --git a/mmv1/third_party/terraform/services/dns/resource_dns_response_policy_test.go.erb b/mmv1/third_party/terraform/services/dns/resource_dns_response_policy_test.go.erb
index 3bc78da05c1a..5029770f1cef 100644
--- a/mmv1/third_party/terraform/services/dns/resource_dns_response_policy_test.go.erb
+++ b/mmv1/third_party/terraform/services/dns/resource_dns_response_policy_test.go.erb
@@ -125,6 +125,7 @@ resource "google_container_cluster" "cluster-1" {
     cluster_secondary_range_name  = google_compute_subnetwork.subnetwork-1.secondary_ip_range[0].range_name
     services_secondary_range_name = google_compute_subnetwork.subnetwork-1.secondary_ip_range[1].range_name
   }
+  deletion_protection = false
 }
 `, suffix, network, suffix, suffix, suffix)
 }
@@ -203,6 +204,7 @@ resource "google_container_cluster" "cluster-1" {
     cluster_secondary_range_name  = google_compute_subnetwork.subnetwork-1.secondary_ip_range[0].range_name
     services_secondary_range_name = google_compute_subnetwork.subnetwork-1.secondary_ip_range[1].range_name
   }
+  deletion_protection = false
 }
 `, suffix, suffix, suffix, suffix)
 }
diff --git a/mmv1/third_party/terraform/services/eventarc/resource_eventarc_trigger_test.go.erb b/mmv1/third_party/terraform/services/eventarc/resource_eventarc_trigger_test.go.erb
index b5aabe2cba4a..bff74bdd841a 100644
--- a/mmv1/third_party/terraform/services/eventarc/resource_eventarc_trigger_test.go.erb
+++ b/mmv1/third_party/terraform/services/eventarc/resource_eventarc_trigger_test.go.erb
@@ -125,11 +125,11 @@ resource "google_eventarc_trigger" "primary" {
 			region = "%{region}"
 		}
 	}
-	service_account= "%{service_account}"
+	service_account = "%{service_account}"
 
     channel = "projects/${data.google_project.test_project.project_id}/locations/%{region}/channels/${google_eventarc_channel.test_channel.name}"
 
-    depends_on =[google_cloud_run_service.default,google_eventarc_channel.test_channel]
+    depends_on = [google_cloud_run_service.default,google_eventarc_channel.test_channel]
 }
 `, context)
 }
@@ -152,15 +152,16 @@ func testAccCheckEventarcChannelTriggerDestroyProducer(t *testing.T) func(s *ter
 			}
 
 			obj := &eventarc.Trigger{
-				Location:       dcl.String(rs.Primary.Attributes["location"]),
-				Name:           dcl.String(rs.Primary.Attributes["name"]),
-				Project:        dcl.StringOrNil(rs.Primary.Attributes["project"]),
-				ServiceAccount: dcl.String(rs.Primary.Attributes["service_account"]),
-				CreateTime:     dcl.StringOrNil(rs.Primary.Attributes["create_time"]),
-				Etag:           dcl.StringOrNil(rs.Primary.Attributes["etag"]),
-				Uid:            dcl.StringOrNil(rs.Primary.Attributes["uid"]),
-				UpdateTime:     dcl.StringOrNil(rs.Primary.Attributes["update_time"]),
-				Channel:        dcl.StringOrNil(rs.Primary.Attributes["channel"]),
+				Location:             dcl.String(rs.Primary.Attributes["location"]),
+				Name:                 dcl.String(rs.Primary.Attributes["name"]),
+				Project:              dcl.StringOrNil(rs.Primary.Attributes["project"]),
+				ServiceAccount:       dcl.String(rs.Primary.Attributes["service_account"]),
+				CreateTime:           dcl.StringOrNil(rs.Primary.Attributes["create_time"]),
+				Etag:                 dcl.StringOrNil(rs.Primary.Attributes["etag"]),
+				Uid:                  dcl.StringOrNil(rs.Primary.Attributes["uid"]),
+				UpdateTime:           dcl.StringOrNil(rs.Primary.Attributes["update_time"]),
+				Channel:              dcl.StringOrNil(rs.Primary.Attributes["channel"]),
+				EventDataContentType: dcl.StringOrNil(rs.Primary.Attributes["event_data_content_type"]),
 			}
 
 			client := transport_tpg.NewDCLEventarcClient(config, config.UserAgent, billingProject, 0)
diff --git a/mmv1/third_party/terraform/services/filestore/resource_filestore_backup_test.go b/mmv1/third_party/terraform/services/filestore/resource_filestore_backup_test.go
index fc024f291721..768b61b89f8f 100644
--- a/mmv1/third_party/terraform/services/filestore/resource_filestore_backup_test.go
+++ b/mmv1/third_party/terraform/services/filestore/resource_filestore_backup_test.go
@@ -35,7 +35,7 @@ func TestAccFilestoreBackup_update(t *testing.T) {
 				ResourceName:            "google_filestore_backup.backup",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"labels", "description", "location"},
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels", "description", "location"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/filestore/resource_filestore_instance_test.go b/mmv1/third_party/terraform/services/filestore/resource_filestore_instance_test.go
index 96d44c1c8244..6f52889d72ae 100644
--- a/mmv1/third_party/terraform/services/filestore/resource_filestore_instance_test.go
+++ b/mmv1/third_party/terraform/services/filestore/resource_filestore_instance_test.go
@@ -56,7 +56,7 @@ func TestAccFilestoreInstance_update(t *testing.T) {
 				ResourceName:            "google_filestore_instance.instance",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"zone", "location"},
+				ImportStateVerifyIgnore: []string{"zone", "location", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccFilestoreInstance_update2(name),
diff --git a/mmv1/third_party/terraform/services/firebase/data_source_google_firebase_android_app.go.erb b/mmv1/third_party/terraform/services/firebase/data_source_google_firebase_android_app.go.erb
index e9167e5d8d3e..1c8ca39a6f46 100644
--- a/mmv1/third_party/terraform/services/firebase/data_source_google_firebase_android_app.go.erb
+++ b/mmv1/third_party/terraform/services/firebase/data_source_google_firebase_android_app.go.erb
@@ -37,6 +37,14 @@ func dataSourceGoogleFirebaseAndroidAppRead(d *schema.ResourceData, meta interfa
 	if err := d.Set("name", name); err != nil {
 		return fmt.Errorf("Error setting name: %s", err)
 	}
-	return resourceFirebaseAndroidAppRead(d, meta)
+	err = resourceFirebaseAndroidAppRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", name)
+	}
+	return nil
 }
 <% end -%>
diff --git a/mmv1/third_party/terraform/services/firebase/data_source_google_firebase_apple_app.go.erb b/mmv1/third_party/terraform/services/firebase/data_source_google_firebase_apple_app.go.erb
index 9d2351c22011..8737c2800b1a 100644
--- a/mmv1/third_party/terraform/services/firebase/data_source_google_firebase_apple_app.go.erb
+++ b/mmv1/third_party/terraform/services/firebase/data_source_google_firebase_apple_app.go.erb
@@ -37,6 +37,14 @@ func dataSourceGoogleFirebaseAppleAppRead(d *schema.ResourceData, meta interface
         if err := d.Set("name", name); err != nil {
                 return fmt.Errorf("Error setting name: %s", err)
         }
-        return resourceFirebaseAppleAppRead(d, meta)
+        err = resourceFirebaseAppleAppRead(d, meta)
+        if err != nil {
+                return err
+        }
+
+        if d.Id() == "" {
+                return fmt.Errorf("%s not found", name)
+        }
+        return nil
 }
 <% end -%>
diff --git a/mmv1/third_party/terraform/services/firebase/data_source_google_firebase_web_app.go.erb b/mmv1/third_party/terraform/services/firebase/data_source_google_firebase_web_app.go.erb
index d6da3622e83c..4c5616580314 100644
--- a/mmv1/third_party/terraform/services/firebase/data_source_google_firebase_web_app.go.erb
+++ b/mmv1/third_party/terraform/services/firebase/data_source_google_firebase_web_app.go.erb
@@ -37,6 +37,14 @@ func dataSourceGoogleFirebaseWebAppRead(d *schema.ResourceData, meta interface{}
 	if err := d.Set("name", name); err != nil {
 		return fmt.Errorf("Error setting name: %s", err)
 	}
-	return resourceFirebaseWebAppRead(d, meta)
+	err = resourceFirebaseWebAppRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", name)
+	}
+	return nil
 }
 <% end -%>
diff --git a/mmv1/third_party/terraform/services/firebase/data_source_google_firebase_web_app_test.go.erb b/mmv1/third_party/terraform/services/firebase/data_source_google_firebase_web_app_test.go.erb
index 6d387d96fe0b..2314f6bd26c1 100644
--- a/mmv1/third_party/terraform/services/firebase/data_source_google_firebase_web_app_test.go.erb
+++ b/mmv1/third_party/terraform/services/firebase/data_source_google_firebase_web_app_test.go.erb
@@ -44,7 +44,6 @@ func testAccDataSourceGoogleFirebaseWebApp(context map[string]interface{}) strin
 resource "google_firebase_web_app" "my_app" {
   project = "%{project_id}"
   display_name = "%{display_name}"
-  deletion_policy = "DELETE"
 }
 
 data "google_firebase_web_app" "my_app" {
diff --git a/mmv1/third_party/terraform/services/firebase/resource_firebase_web_app_test.go.erb b/mmv1/third_party/terraform/services/firebase/resource_firebase_web_app_test.go.erb
index 540580925560..c0b25c6d74a4 100644
--- a/mmv1/third_party/terraform/services/firebase/resource_firebase_web_app_test.go.erb
+++ b/mmv1/third_party/terraform/services/firebase/resource_firebase_web_app_test.go.erb
@@ -22,13 +22,14 @@ func TestAccFirebaseWebApp_firebaseWebAppFull(t *testing.T) {
 	t.Parallel()
 
 	context := map[string]interface{}{
-		"org_id":        envvar.GetTestOrgFromEnv(t),
+		"project_id":    envvar.GetTestProjectFromEnv(),
 		"random_suffix": acctest.RandString(t, 10),
 		"display_name":  "tf-test Display Name N",
 	}
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccFirebaseWebApp_firebaseWebAppFull(context, "", "key1"),
@@ -42,11 +43,9 @@ func TestAccFirebaseWebApp_firebaseWebAppFull(t *testing.T) {
 				),
 			},
 			{
-				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 				Config: testAccFirebaseWebApp_firebaseWebAppFull(context, "", "key1"),
 			},
 			{
-				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 				Config: testAccFirebaseWebApp_firebaseWebAppFull(context, "2", "key2"),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrSet("data.google_firebase_web_app_config.default", "api_key"),
@@ -62,27 +61,11 @@ func testAccFirebaseWebApp_firebaseWebAppFull(context map[string]interface{}, up
 	context["display_name"] = context["display_name"].(string) + update
 	context["api_key_label"] = apiKeyLabel
 	return acctest.Nprintf(`
-resource "google_project" "default" {
-	provider = google-beta
-
-	project_id = "tf-test%{random_suffix}"
-	name       = "tf-test%{random_suffix}"
-	org_id     = "%{org_id}"
-	labels     = {
-		"firebase" = "enabled"
-	}
-}
-
-resource "google_firebase_project" "default" {
-	provider = google-beta
-	project  = google_project.default.project_id
-}
-
 resource "google_apikeys_key" "key1" {
 	provider     = google-beta
 	name         = "tf-test-api-key1%{random_suffix}"
 	display_name = "Test api key 1"
-	project      = google_project.default.project_id
+	project      = "%{project_id}"
 
 	restrictions {
 		browser_key_restrictions {
@@ -106,11 +89,10 @@ resource "google_apikeys_key" "key2" {
 
 resource "google_firebase_web_app" "default" {
 	provider = google-beta
-	project = google_project.default.project_id
+	project = "%{project_id}"
 	display_name = "%{display_name} %{random_suffix}"
 	api_key_id = google_apikeys_key.%{api_key_label}.uid
-
-	depends_on = [google_firebase_project.default]
+	deletion_policy = "DELETE"
 }
 
 data "google_firebase_web_app_config" "default" {
@@ -124,7 +106,7 @@ func TestAccFirebaseWebApp_firebaseWebAppSkipDelete(t *testing.T) {
 	t.Parallel()
 
 	context := map[string]interface{}{
-		"project_id": envvar.GetTestProjectFromEnv(),
+		"org_id":        envvar.GetTestOrgFromEnv(t),
 		"random_suffix": acctest.RandString(t, 10),
 		"display_name":  "tf-test Display Name N",
 	}
@@ -148,11 +130,29 @@ func TestAccFirebaseWebApp_firebaseWebAppSkipDelete(t *testing.T) {
 }
 
 func testAccFirebaseWebApp_firebaseWebAppSkipDelete(context map[string]interface{}, update string) string {
+	// Create a new project so we can clean up the project entirely
 	return acctest.Nprintf(`
+resource "google_project" "default" {
+	provider = google-beta
+
+	project_id = "tf-test%{random_suffix}"
+	name       = "tf-test%{random_suffix}"
+	org_id     = "%{org_id}"
+	labels     = {
+		"firebase" = "enabled"
+	}
+}
+
+resource "google_firebase_project" "default" {
+	provider = google-beta
+	project  = google_project.default.project_id
+}
+
 resource "google_firebase_web_app" "skip_delete" {
 	provider = google-beta
-	project = "%{project_id}"
+	project = google_firebase_project.default.project
 	display_name = "%{display_name} %{random_suffix}"
+	deletion_policy = "ABANDON"
 }
 `, context)
 }
diff --git a/mmv1/third_party/terraform/services/firebaseextensions/resource_firebase_extensions_instance_test.go.erb b/mmv1/third_party/terraform/services/firebaseextensions/resource_firebase_extensions_instance_test.go.erb
index 902eb21a3382..ca50487125fc 100644
--- a/mmv1/third_party/terraform/services/firebaseextensions/resource_firebase_extensions_instance_test.go.erb
+++ b/mmv1/third_party/terraform/services/firebaseextensions/resource_firebase_extensions_instance_test.go.erb
@@ -7,7 +7,7 @@ import (
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 
-	"<%= import_path() -%>/acctest"
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
 	"github.com/hashicorp/terraform-provider-google/google/envvar"
 )
 
diff --git a/mmv1/third_party/terraform/services/firebasehosting/data_source_google_firebase_hosting_channel.go.erb b/mmv1/third_party/terraform/services/firebasehosting/data_source_google_firebase_hosting_channel.go.erb
index c8cd9e60a3a1..1a888cbd4f6c 100644
--- a/mmv1/third_party/terraform/services/firebasehosting/data_source_google_firebase_hosting_channel.go.erb
+++ b/mmv1/third_party/terraform/services/firebasehosting/data_source_google_firebase_hosting_channel.go.erb
@@ -31,6 +31,18 @@ func dataSourceGoogleFirebaseHostingChannelRead(d *schema.ResourceData, meta int
 	}
 	d.SetId(id)
 
-	return resourceFirebaseHostingChannelRead(d, meta)
+	err = resourceFirebaseHostingChannelRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if err := tpgresource.SetDataSourceLabels(d); err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
 }
 <% end -%>
diff --git a/mmv1/third_party/terraform/services/firebasehosting/data_source_google_firebase_hosting_channel_test.go.erb b/mmv1/third_party/terraform/services/firebasehosting/data_source_google_firebase_hosting_channel_test.go.erb
index ecb0f42ddd07..dc9adf02ea9e 100644
--- a/mmv1/third_party/terraform/services/firebasehosting/data_source_google_firebase_hosting_channel_test.go.erb
+++ b/mmv1/third_party/terraform/services/firebasehosting/data_source_google_firebase_hosting_channel_test.go.erb
@@ -44,6 +44,10 @@ resource "google_firebase_hosting_site" "default" {
 resource "google_firebase_hosting_channel" "channel" {
 	site_id = google_firebase_hosting_site.default.site_id
 	channel_id = "tf-test-channel%{random_suffix}"
+
+	labels = {
+		foo = "bar"
+	}
 }
 
 data "google_firebase_hosting_channel" "channel" {
diff --git a/mmv1/third_party/terraform/services/firebasehosting/resource_firebase_hosting_channel_test.go.erb b/mmv1/third_party/terraform/services/firebasehosting/resource_firebase_hosting_channel_test.go.erb
index 97dfe64fa86e..93169502da64 100644
--- a/mmv1/third_party/terraform/services/firebasehosting/resource_firebase_hosting_channel_test.go.erb
+++ b/mmv1/third_party/terraform/services/firebasehosting/resource_firebase_hosting_channel_test.go.erb
@@ -75,7 +75,7 @@ func TestAccFirebaseHostingChannel_firebasehostingChannelUpdate(t *testing.T) {
 				ResourceName:            "google_firebase_hosting_channel.update",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"ttl", "site_id", "channel_id"},
+				ImportStateVerifyIgnore: []string{"ttl", "site_id", "channel_id", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccFirebaseHostingChannel_firebasehostingChannelMultipleFields(context),
@@ -84,7 +84,7 @@ func TestAccFirebaseHostingChannel_firebasehostingChannelUpdate(t *testing.T) {
 				ResourceName:            "google_firebase_hosting_channel.update",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"ttl", "site_id", "channel_id"},
+				ImportStateVerifyIgnore: []string{"ttl", "site_id", "channel_id", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccFirebaseHostingChannel_firebasehostingChannelBasic(context),
diff --git a/mmv1/third_party/terraform/services/firebasehosting/resource_firebase_hosting_custom_domain_test.go.erb b/mmv1/third_party/terraform/services/firebasehosting/resource_firebase_hosting_custom_domain_test.go.erb
new file mode 100644
index 000000000000..7b42ace8511c
--- /dev/null
+++ b/mmv1/third_party/terraform/services/firebasehosting/resource_firebase_hosting_custom_domain_test.go.erb
@@ -0,0 +1,82 @@
+<% autogen_exception -%>
+package firebasehosting_test
+<% unless version == 'ga' -%>
+
+import (
+	"testing"
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+	"github.com/hashicorp/terraform-provider-google/google/envvar"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+)
+
+func TestAccFirebaseHostingCustomDomain_firebasehostingCustomdomainUpdate(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"project_id":      envvar.GetTestProjectFromEnv(),
+		"site_id":         envvar.GetTestProjectFromEnv(),
+		"custom_domain":   "update.source.domain.com",
+		"random_suffix":   acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
+		CheckDestroy:             testAccCheckFirebaseHostingCustomDomainDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccFirebaseHostingCustomDomain_firebasehostingCustomdomainBeforeUpdate(context),
+			},
+			{
+				ResourceName:            "google_firebase_hosting_custom_domain.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"site_id", "custom_domain", "wait_dns_verification"},
+			},
+			{
+				Config: testAccFirebaseHostingCustomDomain_firebasehostingCustomdomainAfterUpdate(context),
+			},
+			{
+				ResourceName:            "google_firebase_hosting_custom_domain.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"site_id", "custom_domain", "wait_dns_verification"},
+			},
+		},
+	})
+}
+
+func testAccFirebaseHostingCustomDomain_firebasehostingCustomdomainBeforeUpdate(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_firebase_hosting_custom_domain" "default" {
+  provider = google-beta
+
+  project  = "%{project_id}"
+  site_id = "%{site_id}"
+  custom_domain = "%{custom_domain}"
+  cert_preference = "GROUPED"
+  redirect_target = "destination.domain.com"
+
+  wait_dns_verification = false
+}
+`, context)
+}
+
+func testAccFirebaseHostingCustomDomain_firebasehostingCustomdomainAfterUpdate(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_firebase_hosting_custom_domain" "default" {
+  provider = google-beta
+
+  project  = "%{project_id}"
+  site_id = "%{site_id}"
+  custom_domain = "%{custom_domain}"
+  cert_preference = "PROJECT_GROUPED"
+  redirect_target = "destination2.domain.com"
+
+  wait_dns_verification = false
+}
+`, context)
+}
+
+<% end -%>
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/services/firebasehosting/resource_firebase_hosting_site_test.go.erb b/mmv1/third_party/terraform/services/firebasehosting/resource_firebase_hosting_site_test.go.erb
index 0bdd29754f5d..c12e002acaa2 100644
--- a/mmv1/third_party/terraform/services/firebasehosting/resource_firebase_hosting_site_test.go.erb
+++ b/mmv1/third_party/terraform/services/firebasehosting/resource_firebase_hosting_site_test.go.erb
@@ -52,7 +52,6 @@ resource "google_firebase_web_app" "before" {
   provider = google-beta
   project  = "%{project_id}"
   display_name = "tf-test Test web app before for Firebase Hosting"
-  deletion_policy = "DELETE"
 }
 
 resource "google_firebase_hosting_site" "update" {
@@ -70,7 +69,6 @@ resource "google_firebase_web_app" "after" {
   provider = google-beta
   project  = "%{project_id}"
   display_name = "tf-test Test web app after for Firebase Hosting"
-  deletion_policy = "DELETE"
 }
 
 resource "google_firebase_hosting_site" "update" {
diff --git a/mmv1/third_party/terraform/services/firestore/resource_firestore_database_update_test.go.erb b/mmv1/third_party/terraform/services/firestore/resource_firestore_database_update_test.go.erb
index 66ef2cf86766..a4e6cbe2aed5 100644
--- a/mmv1/third_party/terraform/services/firestore/resource_firestore_database_update_test.go.erb
+++ b/mmv1/third_party/terraform/services/firestore/resource_firestore_database_update_test.go.erb
@@ -10,10 +10,10 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 )
 
-func TestAccFirestoreDatabase_update(t *testing.T) {
+func TestAccFirestoreDatabase_updateConcurrencyMode(t *testing.T) {
 	t.Parallel()
 
-	orgId := envvar.GetTestOrgFromEnv(t)
+	projectId := envvar.GetTestProjectFromEnv()
 	randomSuffix := acctest.RandString(t, 10)
 
 	acctest.VcrTest(t, resource.TestCase{
@@ -24,19 +24,19 @@ func TestAccFirestoreDatabase_update(t *testing.T) {
 		},
 		Steps: []resource.TestStep{
 			{
-				Config: testAccFirestoreDatabase_concurrencyMode(orgId, randomSuffix, "OPTIMISTIC"),
+				Config: testAccFirestoreDatabase_concurrencyMode(projectId, randomSuffix, "OPTIMISTIC"),
 			},
 			{
-				ResourceName:      "google_firestore_database.default",
+				ResourceName:      "google_firestore_database.database",
 				ImportState:       true,
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{"etag", "project"},
 			},
 			{
-				Config: testAccFirestoreDatabase_concurrencyMode(orgId, randomSuffix, "PESSIMISTIC"),
+				Config: testAccFirestoreDatabase_concurrencyMode(projectId, randomSuffix, "PESSIMISTIC"),
 			},
 			{
-				ResourceName:      "google_firestore_database.default",
+				ResourceName:      "google_firestore_database.database",
 				ImportState:       true,
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{"etag", "project"},
@@ -45,37 +45,108 @@ func TestAccFirestoreDatabase_update(t *testing.T) {
 	})
 }
 
-func testAccFirestoreDatabase_concurrencyMode(orgId string, randomSuffix string, concurrencyMode string) string {
-	return fmt.Sprintf(`
-resource "google_project" "default" {
-  project_id = "tf-test%s"
-  name       = "tf-test%s"
-  org_id     = "%s"
-}
+func TestAccFirestoreDatabase_updatePitrEnablement(t *testing.T) {
+	t.Parallel()
 
-resource "time_sleep" "wait_60_seconds" {
-  depends_on = [google_project.default]
+	projectId := envvar.GetTestProjectFromEnv()
+	randomSuffix := acctest.RandString(t, 10)
 
-  create_duration = "60s"
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		ExternalProviders: map[string]resource.ExternalProvider{
+			"time": {},
+		},
+		Steps: []resource.TestStep{
+			{
+				Config: testAccFirestoreDatabase_pitrEnablement(projectId, randomSuffix, "POINT_IN_TIME_RECOVERY_ENABLED"),
+			},
+			{
+				ResourceName:      "google_firestore_database.database",
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"etag", "project"},
+			},
+			{
+				Config: testAccFirestoreDatabase_pitrEnablement(projectId, randomSuffix, "POINT_IN_TIME_RECOVERY_DISABLED"),
+			},
+			{
+				ResourceName:      "google_firestore_database.database",
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"etag", "project"},
+			},
+		},
+	})
 }
 
-resource "google_project_service" "firestore" {
-  project = google_project.default.project_id
-  service = "firestore.googleapis.com"
+func TestAccFirestoreDatabase_updateDeleteProtectionState(t *testing.T) {
+	t.Parallel()
+
+	projectId := envvar.GetTestProjectFromEnv()
+	randomSuffix := acctest.RandString(t, 10)
 
-  # Needed for CI tests for permissions to propagate, should not be needed for actual usage
-  depends_on = [time_sleep.wait_60_seconds]
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		ExternalProviders: map[string]resource.ExternalProvider{
+			"time": {},
+		},
+		Steps: []resource.TestStep{
+			{
+				Config: testAccFirestoreDatabase_deleteProtectionState(projectId, randomSuffix, "DELETE_PROTECTION_ENABLED"),
+			},
+			{
+				ResourceName:      "google_firestore_database.database",
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"etag", "project"},
+			},
+			{
+				Config: testAccFirestoreDatabase_deleteProtectionState(projectId, randomSuffix, "DELETE_PROTECTION_DISABLED"),
+			},
+			{
+				ResourceName:      "google_firestore_database.database",
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"etag", "project"},
+			},
+		},
+	})
 }
 
-resource "google_firestore_database" "default" {
-  name             = "(default)"
+func testAccFirestoreDatabase_concurrencyMode(projectId string, randomSuffix string, concurrencyMode string) string {
+	return fmt.Sprintf(`
+resource "google_firestore_database" "database" {
+  project          = "%s"
+  name             = "tf-test-%s"
   type             = "DATASTORE_MODE"
   location_id      = "nam5"
   concurrency_mode = "%s"
+}
+`, projectId, randomSuffix, concurrencyMode)
+}
 
-  project = google_project.default.project_id
+func testAccFirestoreDatabase_pitrEnablement(projectId string, randomSuffix string, pointInTimeRecoveryEnablement string) string {
+	return fmt.Sprintf(`
+resource "google_firestore_database" "database" {
+  project                           = "%s"
+  name                              = "tf-test-%s"
+  type                              = "DATASTORE_MODE"
+  location_id                       = "nam5"
+  point_in_time_recovery_enablement = "%s"
+}
+`, projectId, randomSuffix, pointInTimeRecoveryEnablement)
+}
 
-  depends_on = [google_project_service.firestore]
+func testAccFirestoreDatabase_deleteProtectionState(projectId string, randomSuffix string, deleteProtectionState string) string {
+	return fmt.Sprintf(`
+resource "google_firestore_database" "database" {
+  project                 = "%s"
+  name                    = "tf-test-%s"
+  type                    = "DATASTORE_MODE"
+  location_id             = "nam5"
+  delete_protection_state = "%s"
 }
-`, randomSuffix, randomSuffix, orgId, concurrencyMode)
+`, projectId, randomSuffix, deleteProtectionState)
 }
diff --git a/mmv1/third_party/terraform/services/gameservices/data_source_google_game_services_game_server_deployment_rollout.go b/mmv1/third_party/terraform/services/gameservices/data_source_google_game_services_game_server_deployment_rollout.go
deleted file mode 100644
index ab8d406cafdb..000000000000
--- a/mmv1/third_party/terraform/services/gameservices/data_source_google_game_services_game_server_deployment_rollout.go
+++ /dev/null
@@ -1,33 +0,0 @@
-package gameservices
-
-import (
-	"fmt"
-
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
-	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
-)
-
-func DataSourceGameServicesGameServerDeploymentRollout() *schema.Resource {
-
-	dsSchema := tpgresource.DatasourceSchemaFromResourceSchema(ResourceGameServicesGameServerDeploymentRollout().Schema)
-	tpgresource.AddRequiredFieldsToSchema(dsSchema, "deployment_id")
-
-	return &schema.Resource{
-		Read:   dataSourceGameServicesGameServerDeploymentRolloutRead,
-		Schema: dsSchema,
-	}
-}
-
-func dataSourceGameServicesGameServerDeploymentRolloutRead(d *schema.ResourceData, meta interface{}) error {
-	config := meta.(*transport_tpg.Config)
-
-	id, err := tpgresource.ReplaceVars(d, config, "projects/{{project}}/locations/global/gameServerDeployments/{{deployment_id}}/rollout")
-	if err != nil {
-		return fmt.Errorf("Error constructing id: %s", err)
-	}
-
-	d.SetId(id)
-
-	return resourceGameServicesGameServerDeploymentRolloutRead(d, meta)
-}
diff --git a/mmv1/third_party/terraform/services/gkebackup/resource_gke_backup_backup_plan_test.go.erb b/mmv1/third_party/terraform/services/gkebackup/resource_gke_backup_backup_plan_test.go.erb
index ea1059fd8dac..9c8b4886b507 100644
--- a/mmv1/third_party/terraform/services/gkebackup/resource_gke_backup_backup_plan_test.go.erb
+++ b/mmv1/third_party/terraform/services/gkebackup/resource_gke_backup_backup_plan_test.go.erb
@@ -30,6 +30,7 @@ func TestAccGKEBackupBackupPlan_update(t *testing.T) {
 				ResourceName:      "google_gke_backup_backup_plan.backupplan",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccGKEBackupBackupPlan_full(context),
@@ -38,6 +39,7 @@ func TestAccGKEBackupBackupPlan_update(t *testing.T) {
 				ResourceName:      "google_gke_backup_backup_plan.backupplan",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -57,6 +59,7 @@ resource "google_container_cluster" "primary" {
 	  enabled = true
 	}
   }
+  deletion_protection = false
 }
 	
 resource "google_gke_backup_backup_plan" "backupplan" {
@@ -68,6 +71,9 @@ resource "google_gke_backup_backup_plan" "backupplan" {
 	include_secrets = false
 	all_namespaces = true
   }
+  labels = {
+    "some-key-1": "some-value-1"
+  }
 }
 `, context)
 }
@@ -86,6 +92,7 @@ resource "google_container_cluster" "primary" {
 	  enabled = true
 	}
   }
+  deletion_protection = false
 }
 	
 resource "google_gke_backup_backup_plan" "backupplan" {
@@ -113,6 +120,9 @@ resource "google_gke_backup_backup_plan" "backupplan" {
 	  }
     }
   }
+  labels = {
+    "some-key-2": "some-value-2"
+  }
 }
 `, context)
 }
diff --git a/mmv1/third_party/terraform/services/gkehub/resource_gke_hub_feature_membership_test.go.erb b/mmv1/third_party/terraform/services/gkehub/resource_gke_hub_feature_membership_test.go.erb
index 8d905fadbf77..66015707cc14 100644
--- a/mmv1/third_party/terraform/services/gkehub/resource_gke_hub_feature_membership_test.go.erb
+++ b/mmv1/third_party/terraform/services/gkehub/resource_gke_hub_feature_membership_test.go.erb
@@ -387,6 +387,7 @@ resource "google_container_cluster" "primary" {
   name               = "tf-test-cl%{random_suffix}"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
   depends_on = [google_project_service.mci, google_project_service.container, google_project_service.container, google_project_service.gkehub]
 }
 
@@ -452,6 +453,7 @@ resource "google_container_cluster" "primary" {
   name               = "tf-test-cl%{random_suffix}"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
   depends_on = [google_project_service.mci, google_project_service.container, google_project_service.container, google_project_service.gkehub]
 }
 
@@ -518,6 +520,7 @@ resource "google_container_cluster" "primary" {
   name               = "tf-test-cl%{random_suffix}"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
   depends_on = [google_project_service.mci, google_project_service.container, google_project_service.container, google_project_service.gkehub, google_project_service.acm]
 }
 
@@ -817,6 +820,7 @@ resource "google_container_cluster" "primary" {
   name               = "tf-test-cl%{random_suffix}"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
   depends_on = [google_project_service.container, google_project_service.gkehub]
 }
 
@@ -869,6 +873,7 @@ resource "google_container_cluster" "primary" {
   name               = "tf-test-cl%{random_suffix}"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
   depends_on = [google_project_service.container, google_project_service.gkehub]
 }
 
@@ -920,6 +925,7 @@ resource "google_container_cluster" "primary" {
   name               = "tf-test-cl%{random_suffix}"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
   depends_on = [google_project_service.container, google_project_service.gkehub]
 }
 
@@ -971,6 +977,7 @@ resource "google_container_cluster" "primary" {
   location           = "us-central1-a"
   initial_node_count = 1
   project = google_project.project.project_id
+  deletion_protection = false
   depends_on = [google_project_service.container, google_project_service.container, google_project_service.gkehub]
 }
 
@@ -979,6 +986,7 @@ resource "google_container_cluster" "secondary" {
   location           = "us-central1-a"
   initial_node_count = 1
   project = google_project.project.project_id
+  deletion_protection = false
   depends_on = [google_project_service.container, google_project_service.container, google_project_service.gkehub]
 }
 
@@ -987,6 +995,7 @@ resource "google_container_cluster" "tertiary" {
   location           = "us-central1-a"
   initial_node_count = 1
   project = google_project.project.project_id
+  deletion_protection = false
   depends_on = [google_project_service.container, google_project_service.container, google_project_service.gkehub]
 }
 
@@ -996,6 +1005,7 @@ resource "google_container_cluster" "quarternary" {
   location           = "us-central1-a"
   initial_node_count = 1
   project = google_project.project.project_id
+  deletion_protection = false
   depends_on = [google_project_service.container, google_project_service.container, google_project_service.gkehub]
 }
 
@@ -1069,6 +1079,7 @@ resource "google_container_cluster" "container_acmoci" {
   initial_node_count = 1
   network = google_compute_network.testnetwork.self_link
   project = google_project.project.project_id
+  deletion_protection = false
   depends_on = [google_project_service.container, google_project_service.container, google_project_service.gkehub]
 }
 
diff --git a/mmv1/third_party/terraform/services/gkehub2/resource_gke_hub_feature_test.go.erb b/mmv1/third_party/terraform/services/gkehub2/resource_gke_hub_feature_test.go.erb
index b9d2dce61ccf..6948ea1da0f4 100644
--- a/mmv1/third_party/terraform/services/gkehub2/resource_gke_hub_feature_test.go.erb
+++ b/mmv1/third_party/terraform/services/gkehub2/resource_gke_hub_feature_test.go.erb
@@ -231,7 +231,7 @@ func TestAccGKEHubFeature_gkehubFeatureMciUpdate(t *testing.T) {
 				ResourceName:      "google_gke_hub_feature.feature",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"update_time"},
+				ImportStateVerifyIgnore: []string{"update_time", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -245,6 +245,7 @@ resource "google_container_cluster" "primary" {
   location           = "us-central1-a"
   initial_node_count = 1
   project = google_project.project.project_id
+  deletion_protection = false
   depends_on = [google_project_service.mci, google_project_service.container, google_project_service.container, google_project_service.gkehub]
 }
 
@@ -253,6 +254,7 @@ resource "google_container_cluster" "secondary" {
   location           = "us-central1-a"
   initial_node_count = 1
   project = google_project.project.project_id
+  deletion_protection = false
   depends_on = [google_project_service.mci, google_project_service.container, google_project_service.container, google_project_service.gkehub]
 }
 
@@ -296,6 +298,7 @@ resource "google_container_cluster" "primary" {
   location           = "us-central1-a"
   initial_node_count = 1
   project = google_project.project.project_id
+  deletion_protection = false
   depends_on = [google_project_service.mci, google_project_service.container, google_project_service.container, google_project_service.gkehub]
 }
 
@@ -304,6 +307,7 @@ resource "google_container_cluster" "secondary" {
   location           = "us-central1-a"
   initial_node_count = 1
   project = google_project.project.project_id
+  deletion_protection = false
   depends_on = [google_project_service.mci, google_project_service.container, google_project_service.container, google_project_service.gkehub]
 }
 
@@ -343,6 +347,163 @@ resource "google_gke_hub_feature" "feature" {
 `, context)
 }
 
+func TestAccGKEHubFeature_FleetDefaultMemberConfigServiceMesh(t *testing.T) {
+	// VCR fails to handle batched project services
+	acctest.SkipIfVcr(t)
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix":   acctest.RandString(t, 10),
+		"org_id":          envvar.GetTestOrgFromEnv(t),
+		"billing_account": envvar.GetTestBillingAccountFromEnv(t),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckGKEHubFeatureDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccGKEHubFeature_FleetDefaultMemberConfigServiceMesh(context),
+			},
+			{
+				ResourceName:            "google_gke_hub_feature.feature",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"project"},
+			},
+			{
+				Config: testAccGKEHubFeature_FleetDefaultMemberConfigServiceMeshUpdate(context),
+			},
+			{
+				ResourceName:      "google_gke_hub_feature.feature",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccGKEHubFeature_FleetDefaultMemberConfigServiceMesh(context map[string]interface{}) string {
+	return gkeHubFeatureProjectSetupForGA(context) + acctest.Nprintf(`
+resource "google_gke_hub_feature" "feature" {
+  name = "servicemesh"
+  location = "global"
+  fleet_default_member_config {
+    mesh {
+      management = "MANAGEMENT_AUTOMATIC"
+    }
+  }
+  depends_on = [google_project_service.anthos, google_project_service.gkehub, google_project_service.mesh]
+  project = google_project.project.project_id
+}
+`, context)
+}
+
+func testAccGKEHubFeature_FleetDefaultMemberConfigServiceMeshUpdate(context map[string]interface{}) string {
+	return gkeHubFeatureProjectSetupForGA(context) + acctest.Nprintf(`
+resource "google_gke_hub_feature" "feature" {
+  name = "servicemesh"
+  location = "global"
+  fleet_default_member_config {
+    mesh {
+      management = "MANAGEMENT_MANUAL"
+    }
+  }
+  depends_on = [google_project_service.anthos, google_project_service.gkehub, google_project_service.mesh]
+  project = google_project.project.project_id
+}
+`, context)
+}
+
+func TestAccGKEHubFeature_FleetDefaultMemberConfigConfigManagement(t *testing.T) {
+	// VCR fails to handle batched project services
+	acctest.SkipIfVcr(t)
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix":   acctest.RandString(t, 10),
+		"org_id":          envvar.GetTestOrgFromEnv(t),
+		"billing_account": envvar.GetTestBillingAccountFromEnv(t),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckGKEHubFeatureDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccGKEHubFeature_FleetDefaultMemberConfigConfigManagement(context),
+			},
+			{
+				ResourceName:            "google_gke_hub_feature.feature",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"project"},
+			},
+			{
+				Config: testAccGKEHubFeature_FleetDefaultMemberConfigConfigManagementUpdate(context),
+			},
+			{
+				ResourceName:      "google_gke_hub_feature.feature",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccGKEHubFeature_FleetDefaultMemberConfigConfigManagement(context map[string]interface{}) string {
+	return gkeHubFeatureProjectSetupForGA(context) + acctest.Nprintf(`
+resource "google_gke_hub_feature" "feature" {
+  name = "configmanagement"
+  location = "global"
+  fleet_default_member_config {
+    configmanagement {
+      config_sync {
+        source_format = "hierarchy"
+        git {
+          sync_repo = "https://github.com/GoogleCloudPlatform/magic-modules"
+          sync_branch = "master"
+          policy_dir = "."
+          sync_rev = "HEAD"
+          secret_type = "none"
+          sync_wait_secs = "15"
+        }
+      }
+    }
+  }
+  depends_on = [google_project_service.anthos, google_project_service.gkehub, google_project_service.acm]
+  project = google_project.project.project_id
+}
+`, context)
+}
+
+func testAccGKEHubFeature_FleetDefaultMemberConfigConfigManagementUpdate(context map[string]interface{}) string {
+	return gkeHubFeatureProjectSetupForGA(context) + acctest.Nprintf(`
+resource "google_gke_hub_feature" "feature" {
+  name = "configmanagement"
+  location = "global"
+  fleet_default_member_config {
+    configmanagement {
+      config_sync {
+        source_format = "unstructured"
+        oci {
+          sync_repo = "us-central1-docker.pkg.dev/corp-gke-build-artifacts/acm/configs:latest"
+          policy_dir = "/acm/nonprod-root/"
+          secret_type = "gcpserviceaccount"
+          sync_wait_secs = "15"
+          gcp_service_account_email = "gke-cluster@gke-foo-nonprod.iam.gserviceaccount.com"
+        }
+      }
+    }
+  }
+  depends_on = [google_project_service.anthos, google_project_service.gkehub, google_project_service.acm]
+  project = google_project.project.project_id
+}
+`, context)
+}
+
 func TestAccGKEHubFeature_gkehubFeatureMcsd(t *testing.T) {
 	// VCR fails to handle batched project services
 	acctest.SkipIfVcr(t)
@@ -366,7 +527,7 @@ func TestAccGKEHubFeature_gkehubFeatureMcsd(t *testing.T) {
 				ResourceName:            "google_gke_hub_feature.feature",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"project"},
+				ImportStateVerifyIgnore: []string{"project", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccGKEHubFeature_gkehubFeatureMcsdUpdate(context),
@@ -375,6 +536,7 @@ func TestAccGKEHubFeature_gkehubFeatureMcsd(t *testing.T) {
 				ResourceName:      "google_gke_hub_feature.feature",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -450,6 +612,11 @@ resource "google_project_service" "container" {
   disable_on_destroy = false
 }
 
+resource "google_project_service" "anthos" {
+  project = google_project.project.project_id
+  service = "anthos.googleapis.com"
+}
+
 resource "google_project_service" "gkehub" {
   project = google_project.project.project_id
   service = "gkehub.googleapis.com"
diff --git a/mmv1/third_party/terraform/services/gkehub2/resource_gke_hub_fleet_test.go.erb b/mmv1/third_party/terraform/services/gkehub2/resource_gke_hub_fleet_test.go.erb
new file mode 100755
index 000000000000..d18e7c5ce5d7
--- /dev/null
+++ b/mmv1/third_party/terraform/services/gkehub2/resource_gke_hub_fleet_test.go.erb
@@ -0,0 +1,136 @@
+<% autogen_exception -%>
+package gkehub2_test
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+	"github.com/hashicorp/terraform-provider-google/google/envvar"
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
+)
+
+func TestAccGKEHub2Fleet_gkehubFleetBasicExample_update(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix":   acctest.RandString(t, 10),
+		"org_id":          envvar.GetTestOrgFromEnv(t),
+		"billing_account": envvar.GetTestBillingAccountFromEnv(t),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckGKEHub2FleetDestroyProducer(t),
+		ExternalProviders: map[string]resource.ExternalProvider{
+			"time":   {},
+		},
+		Steps: []resource.TestStep{
+			{
+				Config: testAccGKEHub2Fleet_basic(context),
+			},
+			{
+				ResourceName:      "google_gke_hub_fleet.default",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccGKEHub2Fleet_update(context),
+			},
+			{
+				ResourceName:      "google_gke_hub_fleet.default",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccGKEHub2Fleet_basic(context map[string]interface{}) string {
+	return gkeHubFleetProjectSetupForGA(context) + acctest.Nprintf(`
+resource "google_gke_hub_fleet" "default" {
+  project = google_project.project.project_id
+  display_name = "my production fleet"
+
+  depends_on = [time_sleep.wait_for_gkehub_enablement]
+}
+`, context)
+}
+
+func testAccGKEHub2Fleet_update(context map[string]interface{}) string {
+	return gkeHubFleetProjectSetupForGA(context) + acctest.Nprintf(`
+resource "google_gke_hub_fleet" "default" {
+  project = google_project.project.project_id
+  display_name = "my staging fleet"
+
+  depends_on = [time_sleep.wait_for_gkehub_enablement]
+}
+`, context)
+}
+
+func gkeHubFleetProjectSetupForGA(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_project" "project" {
+  name            = "tf-test-gkehub%{random_suffix}"
+  project_id      = "tf-test-gkehub%{random_suffix}"
+  org_id          = "%{org_id}"
+  billing_account = "%{billing_account}"
+}
+
+resource "google_project_service" "gkehub" {
+  project = google_project.project.project_id
+  service = "gkehub.googleapis.com"
+  disable_on_destroy = false
+}
+
+resource "time_sleep" "wait_for_gkehub_enablement" {
+  create_duration = "150s"
+  depends_on = [google_project_service.gkehub]
+}
+`, context)
+}
+
+func testAccCheckGKEHub2FleetDestroyProducer(t *testing.T) func(s *terraform.State) error {
+	return func(s *terraform.State) error {
+		for name, rs := range s.RootModule().Resources {
+			if rs.Type != "google_gke_hub_fleet" {
+				continue
+			}
+			if strings.HasPrefix(name, "data.") {
+				continue
+			}
+
+			config := acctest.GoogleProviderConfig(t)
+
+			url, err := tpgresource.ReplaceVarsForTest(config, rs, "{{GKEHub2BasePath}}projects/{{project}}/locations/global/fleets/default")
+			if err != nil {
+				return err
+			}
+
+			billingProject := ""
+
+			if config.BillingProject != "" {
+				billingProject = config.BillingProject
+			}
+
+			_, err = transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+				Config:    config,
+				Method:    "GET",
+				Project:   billingProject,
+				RawURL:    url,
+				UserAgent: config.UserAgent,
+			})
+			if err == nil {
+				return fmt.Errorf("GKEHub2Fleet still exists at %s", url)
+			}
+		}
+
+		return nil
+	}
+}
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/services/gkehub2/resource_gke_hub_membership_binding_test.go b/mmv1/third_party/terraform/services/gkehub2/resource_gke_hub_membership_binding_test.go
index 5834df3cb576..8f1a7bc10787 100644
--- a/mmv1/third_party/terraform/services/gkehub2/resource_gke_hub_membership_binding_test.go
+++ b/mmv1/third_party/terraform/services/gkehub2/resource_gke_hub_membership_binding_test.go
@@ -29,7 +29,7 @@ func TestAccGKEHub2MembershipBinding_gkehubMembershipBindingBasicExample_update(
 				ResourceName:            "google_gke_hub_membership_binding.example",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"membership_binding_id", "scope", "membership_id", "location"},
+				ImportStateVerifyIgnore: []string{"membership_binding_id", "scope", "membership_id", "location", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccGKEHub2MembershipBinding_gkehubMembershipBindingBasicExample_update(context),
@@ -38,7 +38,7 @@ func TestAccGKEHub2MembershipBinding_gkehubMembershipBindingBasicExample_update(
 				ResourceName:            "google_gke_hub_membership_binding.example",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"membership_binding_id", "scope", "membership_id", "location"},
+				ImportStateVerifyIgnore: []string{"membership_binding_id", "scope", "membership_id", "location", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -50,6 +50,7 @@ resource "google_container_cluster" "primary" {
   name               = "basiccluster%{random_suffix}"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
 }
 
 resource "google_gke_hub_membership" "example" {
@@ -91,6 +92,7 @@ resource "google_container_cluster" "primary" {
   name               = "basiccluster%{random_suffix}"
   location           = "us-central1-a"
   initial_node_count = 1
+  deletion_protection = false
 }
 
 resource "google_gke_hub_membership" "example" {
diff --git a/mmv1/third_party/terraform/services/gkehub2/resource_gke_hub_namespace_test.go b/mmv1/third_party/terraform/services/gkehub2/resource_gke_hub_namespace_test.go
index 5dcc01cd2b83..a80cb1393807 100644
--- a/mmv1/third_party/terraform/services/gkehub2/resource_gke_hub_namespace_test.go
+++ b/mmv1/third_party/terraform/services/gkehub2/resource_gke_hub_namespace_test.go
@@ -28,7 +28,7 @@ func TestAccGKEHub2Namespace_gkehubNamespaceBasicExample_update(t *testing.T) {
 				ResourceName:            "google_gke_hub_namespace.namespace",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"scope_namespace_id", "scope", "scope_id", "scope"},
+				ImportStateVerifyIgnore: []string{"scope_namespace_id", "scope", "scope_id", "scope", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccGKEHub2Namespace_gkehubNamespaceBasicExample_update(context),
@@ -37,7 +37,7 @@ func TestAccGKEHub2Namespace_gkehubNamespaceBasicExample_update(t *testing.T) {
 				ResourceName:            "google_gke_hub_namespace.namespace",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"scope_namespace_id", "scope", "scope_id", "scope"},
+				ImportStateVerifyIgnore: []string{"scope_namespace_id", "scope", "scope_id", "scope", "labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/gkehub2/resource_gke_hub_scope_rbac_role_binding_test.go b/mmv1/third_party/terraform/services/gkehub2/resource_gke_hub_scope_rbac_role_binding_test.go
index a1f9e6f5742e..5756e6c2a8b3 100644
--- a/mmv1/third_party/terraform/services/gkehub2/resource_gke_hub_scope_rbac_role_binding_test.go
+++ b/mmv1/third_party/terraform/services/gkehub2/resource_gke_hub_scope_rbac_role_binding_test.go
@@ -28,7 +28,7 @@ func TestAccGKEHub2ScopeRBACRoleBinding_gkehubScopeRbacRoleBindingBasicExample_u
 				ResourceName:            "google_gke_hub_scope_rbac_role_binding.scoperbacrolebinding",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"scope_rbac_role_binding_id", "scope_id"},
+				ImportStateVerifyIgnore: []string{"scope_rbac_role_binding_id", "scope_id", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccGKEHub2ScopeRBACRoleBinding_gkehubScopeRbacRoleBindingBasicExample_update(context),
@@ -37,7 +37,7 @@ func TestAccGKEHub2ScopeRBACRoleBinding_gkehubScopeRbacRoleBindingBasicExample_u
 				ResourceName:            "google_gke_hub_scope_rbac_role_binding.scoperbacrolebinding",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"scope_rbac_role_binding_id", "scope_id"},
+				ImportStateVerifyIgnore: []string{"scope_rbac_role_binding_id", "scope_id", "labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/gkehub2/resource_gke_hub_scope_test.go b/mmv1/third_party/terraform/services/gkehub2/resource_gke_hub_scope_test.go
new file mode 100644
index 000000000000..967fe08c4bc2
--- /dev/null
+++ b/mmv1/third_party/terraform/services/gkehub2/resource_gke_hub_scope_test.go
@@ -0,0 +1,70 @@
+package gkehub2_test
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+	"github.com/hashicorp/terraform-provider-google/google/envvar"
+)
+
+func TestAccGKEHub2Scope_gkehubScopeBasicExample_update(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"project":       envvar.GetTestProjectFromEnv(),
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccGKEHub2Scope_gkehubScopeBasicExample_basic(context),
+			},
+			{
+				ResourceName:            "google_gke_hub_scope.scope",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"scope_id", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccGKEHub2Scope_gkehubScopeBasicExample_update(context),
+			},
+			{
+				ResourceName:            "google_gke_hub_scope.scope",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"scope_id", "labels", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccGKEHub2Scope_gkehubScopeBasicExample_basic(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_gke_hub_scope" "scope" {
+  scope_id = "tf-test-scope%{random_suffix}"
+  labels = {
+    keyb = "valueb"
+    keya = "valuea"
+    keyc = "valuec" 
+  }
+}
+`, context)
+}
+
+func testAccGKEHub2Scope_gkehubScopeBasicExample_update(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_gke_hub_scope" "scope" {
+  scope_id = "tf-test-scope%{random_suffix}"
+  labels = {
+    updated_keyb = "updated_valueb"
+    updated_keya = "updated_valuea"
+    updated_keyc = "updated_valuec" 
+  }
+}
+`, context)
+}
diff --git a/mmv1/third_party/terraform/services/gkeonprem/gkeonprem_operation.go.erb b/mmv1/third_party/terraform/services/gkeonprem/gkeonprem_operation.go.erb
index 6f5bae0643af..b091680c39d6 100644
--- a/mmv1/third_party/terraform/services/gkeonprem/gkeonprem_operation.go.erb
+++ b/mmv1/third_party/terraform/services/gkeonprem/gkeonprem_operation.go.erb
@@ -1,6 +1,6 @@
 <% autogen_exception -%>
 package gkeonprem
-<% unless version == 'ga' -%>
+
 import (
 	"encoding/json"
 	"fmt"
@@ -144,4 +144,3 @@ func GkeonpremOperationWaitTime(config *transport_tpg.Config, op map[string]inte
 	}
 	return tpgresource.OperationWait(w, activity, timeout, config.PollInterval)
 }
-<% end -%>
diff --git a/mmv1/third_party/terraform/services/gkeonprem/resource_gkeonprem_bare_metal_cluster_test.go.erb b/mmv1/third_party/terraform/services/gkeonprem/resource_gkeonprem_bare_metal_cluster_test.go.erb
index be8905f2f378..38cb0b9890cc 100644
--- a/mmv1/third_party/terraform/services/gkeonprem/resource_gkeonprem_bare_metal_cluster_test.go.erb
+++ b/mmv1/third_party/terraform/services/gkeonprem/resource_gkeonprem_bare_metal_cluster_test.go.erb
@@ -1,6 +1,6 @@
 <% autogen_exception -%>
 package gkeonprem_test
-<% unless version == 'ga' -%>
+
 import (
 	"testing"
 
@@ -17,7 +17,7 @@ func TestAccGkeonpremBareMetalCluster_bareMetalClusterUpdateBasic(t *testing.T)
 
   acctest.VcrTest(t, resource.TestCase{
     PreCheck:                 func() { acctest.AccTestPreCheck(t) },
-    ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
+    ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
     CheckDestroy:             testAccCheckGkeonpremBareMetalClusterDestroyProducer(t),
     Steps: []resource.TestStep{
       {
@@ -27,6 +27,7 @@ func TestAccGkeonpremBareMetalCluster_bareMetalClusterUpdateBasic(t *testing.T)
         ResourceName:      "google_gkeonprem_bare_metal_cluster.cluster-metallb",
         ImportState:       true,
         ImportStateVerify: true,
+        ImportStateVerifyIgnore: []string{"annotations"},
       },
       {
         Config: testAccGkeonpremBareMetalCluster_bareMetalClusterUpdateMetalLb(context),
@@ -35,6 +36,7 @@ func TestAccGkeonpremBareMetalCluster_bareMetalClusterUpdateBasic(t *testing.T)
         ResourceName:      "google_gkeonprem_bare_metal_cluster.cluster-metallb",
         ImportState:       true,
         ImportStateVerify: true,
+        ImportStateVerifyIgnore: []string{"annotations"},
       },
     },
   })
@@ -49,7 +51,7 @@ func TestAccGkeonpremBareMetalCluster_bareMetalClusterUpdateManualLb(t *testing.
 
   acctest.VcrTest(t, resource.TestCase{
     PreCheck:                 func() { acctest.AccTestPreCheck(t) },
-    ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
+    ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
     CheckDestroy:             testAccCheckGkeonpremBareMetalClusterDestroyProducer(t),
     Steps: []resource.TestStep{
       {
@@ -81,7 +83,7 @@ func TestAccGkeonpremBareMetalCluster_bareMetalClusterUpdateBgpLb(t *testing.T)
 
   acctest.VcrTest(t, resource.TestCase{
     PreCheck:                 func() { acctest.AccTestPreCheck(t) },
-    ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
+    ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
     CheckDestroy:             testAccCheckGkeonpremBareMetalClusterDestroyProducer(t),
     Steps: []resource.TestStep{
       {
@@ -108,9 +110,11 @@ func testAccGkeonpremBareMetalCluster_bareMetalClusterUpdateMetalLbStart(context
   return acctest.Nprintf(`
 
   resource "google_gkeonprem_bare_metal_cluster" "cluster-metallb" {
-    provider = google-beta
     name = "cluster-metallb%{random_suffix}"
     location = "us-west1"
+    annotations = {
+      env = "test"
+    }
     admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
     bare_metal_version = "1.12.3"
     network_config {
@@ -184,9 +188,11 @@ func testAccGkeonpremBareMetalCluster_bareMetalClusterUpdateMetalLb(context map[
   return acctest.Nprintf(`
 
   resource "google_gkeonprem_bare_metal_cluster" "cluster-metallb" {
-    provider = google-beta
     name = "cluster-metallb%{random_suffix}"
     location = "us-west1"
+    annotations = {
+      env = "test-update"
+    }
     admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
     bare_metal_version = "1.12.3"
     network_config {
@@ -258,7 +264,6 @@ func testAccGkeonpremBareMetalCluster_bareMetalClusterUpdateManualLbStart(contex
   return acctest.Nprintf(`
 
   resource "google_gkeonprem_bare_metal_cluster" "cluster-manuallb" {
-    provider = google-beta
     name = "cluster-manuallb%{random_suffix}"
     location = "us-west1"
     admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
@@ -338,7 +343,6 @@ func testAccGkeonpremBareMetalCluster_bareMetalClusterUpdateManualLb(context map
   return acctest.Nprintf(`
 
   resource "google_gkeonprem_bare_metal_cluster" "cluster-manuallb" {
-    provider = google-beta
     name = "cluster-manuallb%{random_suffix}"
     location = "us-west1"
     admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
@@ -407,7 +411,6 @@ func testAccGkeonpremBareMetalCluster_bareMetalClusterUpdateBgpLbStart(context m
   return acctest.Nprintf(`
 
   resource "google_gkeonprem_bare_metal_cluster" "cluster-bgplb" {
-    provider = google-beta
     name = "cluster-bgplb%{random_suffix}"
     location = "us-west1"
     admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
@@ -492,7 +495,6 @@ func testAccGkeonpremBareMetalCluster_bareMetalClusterUpdateBgpLb(context map[st
   return acctest.Nprintf(`
 
   resource "google_gkeonprem_bare_metal_cluster" "cluster-bgplb" {
-    provider = google-beta
     name = "cluster-bgplb%{random_suffix}"
     location = "us-west1"
     admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
@@ -572,4 +574,3 @@ func testAccGkeonpremBareMetalCluster_bareMetalClusterUpdateBgpLb(context map[st
   }
 `, context)
 }
-<% end -%>
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/services/gkeonprem/resource_gkeonprem_bare_metal_node_pool_test.go.erb b/mmv1/third_party/terraform/services/gkeonprem/resource_gkeonprem_bare_metal_node_pool_test.go.erb
index 2819f8f66a34..f0135b115440 100644
--- a/mmv1/third_party/terraform/services/gkeonprem/resource_gkeonprem_bare_metal_node_pool_test.go.erb
+++ b/mmv1/third_party/terraform/services/gkeonprem/resource_gkeonprem_bare_metal_node_pool_test.go.erb
@@ -1,6 +1,6 @@
 <% autogen_exception -%>
 package gkeonprem_test
-<% unless version == 'ga' -%>
+
 import (
 	"testing"
 
@@ -17,7 +17,7 @@ func TestAccGkeonpremBareMetalNodePool_bareMetalNodePoolUpdate(t *testing.T) {
 
   acctest.VcrTest(t, resource.TestCase{
     PreCheck:                 func() { acctest.AccTestPreCheck(t) },
-    ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
+    ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
     CheckDestroy:             testAccCheckGkeonpremBareMetalNodePoolDestroyProducer(t),
     Steps: []resource.TestStep{
       {
@@ -27,6 +27,7 @@ func TestAccGkeonpremBareMetalNodePool_bareMetalNodePoolUpdate(t *testing.T) {
         ResourceName:      "google_gkeonprem_bare_metal_node_pool.nodepool",
         ImportState:       true,
         ImportStateVerify: true,
+        ImportStateVerifyIgnore: []string{"annotations"},
       },
       {
         Config: testAccGkeonpremBareMetalNodePool_bareMetalNodePoolUpdate(context),
@@ -35,6 +36,7 @@ func TestAccGkeonpremBareMetalNodePool_bareMetalNodePoolUpdate(t *testing.T) {
         ResourceName:      "google_gkeonprem_bare_metal_node_pool.nodepool",
         ImportState:       true,
         ImportStateVerify: true,
+        ImportStateVerifyIgnore: []string{"annotations"},
       },
     },
   })
@@ -44,8 +46,6 @@ func testAccGkeonpremBareMetalNodePool_bareMetalNodePoolUpdateStart(context map[
   return acctest.Nprintf(`
 
   resource "google_gkeonprem_bare_metal_cluster" "cluster" {
-    provider = google-beta
-
     name = "tf-test-cluster-%{random_suffix}"
     location = "us-west1"
     admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
@@ -116,12 +116,12 @@ func testAccGkeonpremBareMetalNodePool_bareMetalNodePoolUpdateStart(context map[
   }
 
   resource "google_gkeonprem_bare_metal_node_pool" "nodepool" {
-    provider = google-beta
-
     name = "tf-test-nodepool-%{random_suffix}"
     location = "us-west1"
     bare_metal_cluster = google_gkeonprem_bare_metal_cluster.cluster.name
-    annotations = {}
+    annotations = {
+      env = "test"
+    }
     node_pool_config {
       operating_system = "LINUX"
       labels = {}
@@ -138,8 +138,6 @@ func testAccGkeonpremBareMetalNodePool_bareMetalNodePoolUpdate(context map[strin
   return acctest.Nprintf(`
 
   resource "google_gkeonprem_bare_metal_cluster" "cluster" {
-    provider = google-beta
-
     name = "tf-test-cluster-%{random_suffix}"
     location = "us-west1"
     admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
@@ -210,12 +208,12 @@ func testAccGkeonpremBareMetalNodePool_bareMetalNodePoolUpdate(context map[strin
   }
 
   resource "google_gkeonprem_bare_metal_node_pool" "nodepool" {
-    provider = google-beta
-
     name = "tf-test-nodepool-%{random_suffix}"
     location = "us-west1"
     bare_metal_cluster = google_gkeonprem_bare_metal_cluster.cluster.name
-    annotations = {}
+    annotations = {
+      env = "test-update"
+    }
     node_pool_config {
       operating_system = "LINUX"
       labels = {}
@@ -227,4 +225,3 @@ func testAccGkeonpremBareMetalNodePool_bareMetalNodePoolUpdate(context map[strin
   }
 `, context)
 }
-<% end -%>
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/services/gkeonprem/resource_gkeonprem_vmware_cluster_test.go.erb b/mmv1/third_party/terraform/services/gkeonprem/resource_gkeonprem_vmware_cluster_test.go.erb
index a2cc7e50f7e9..31d111d3a4c7 100644
--- a/mmv1/third_party/terraform/services/gkeonprem/resource_gkeonprem_vmware_cluster_test.go.erb
+++ b/mmv1/third_party/terraform/services/gkeonprem/resource_gkeonprem_vmware_cluster_test.go.erb
@@ -1,6 +1,6 @@
 <% autogen_exception -%>
 package gkeonprem_test
-<% unless version == 'ga' -%>
+
 import (
 	"testing"
 
@@ -17,7 +17,7 @@ func TestAccGkeonpremVmwareCluster_vmwareClusterUpdateBasic(t *testing.T) {
 
   acctest.VcrTest(t, resource.TestCase{
     PreCheck:                 func() { acctest.AccTestPreCheck(t) },
-    ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
+    ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
     CheckDestroy:             testAccCheckGkeonpremVmwareClusterDestroyProducer(t),
     Steps: []resource.TestStep{
       {
@@ -27,6 +27,7 @@ func TestAccGkeonpremVmwareCluster_vmwareClusterUpdateBasic(t *testing.T) {
         ResourceName:      "google_gkeonprem_vmware_cluster.cluster",
         ImportState:       true,
         ImportStateVerify: true,
+        ImportStateVerifyIgnore: []string{"annotations"},
       },
       {
         Config: testAccGkeonpremVmwareCluster_vmwareClusterUpdateMetalLb(context),
@@ -35,6 +36,7 @@ func TestAccGkeonpremVmwareCluster_vmwareClusterUpdateBasic(t *testing.T) {
         ResourceName:      "google_gkeonprem_vmware_cluster.cluster",
         ImportState:       true,
         ImportStateVerify: true,
+        ImportStateVerifyIgnore: []string{"annotations"},
       },
     },
   })
@@ -49,7 +51,7 @@ func TestAccGkeonpremVmwareCluster_vmwareClusterUpdateF5Lb(t *testing.T) {
 
   acctest.VcrTest(t, resource.TestCase{
     PreCheck:                 func() { acctest.AccTestPreCheck(t) },
-    ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
+    ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
     CheckDestroy:             testAccCheckGkeonpremVmwareClusterDestroyProducer(t),
     Steps: []resource.TestStep{
       {
@@ -83,7 +85,7 @@ func TestAccGkeonpremVmwareCluster_vmwareClusterUpdateManualLb(t *testing.T) {
 
   acctest.VcrTest(t, resource.TestCase{
     PreCheck:                 func() { acctest.AccTestPreCheck(t) },
-    ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
+    ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
     CheckDestroy:             testAccCheckGkeonpremVmwareClusterDestroyProducer(t),
     Steps: []resource.TestStep{
       {
@@ -110,14 +112,14 @@ func testAccGkeonpremVmwareCluster_vmwareClusterUpdateMetalLbStart(context map[s
   return acctest.Nprintf(`
 
   resource "google_gkeonprem_vmware_cluster" "cluster" {
-    provider = google-beta
-
     name = "tf-test-cluster-%{random_suffix}"
     location = "us-west1"
     admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
     description = "test cluster"
     on_prem_version = "1.13.1-gke.35"
-    annotations = {}
+    annotations = {
+      env = "test"
+    }
     network_config {
       service_address_cidr_blocks = ["10.96.0.0/12"]
       pod_address_cidr_blocks = ["192.168.0.0/16"]
@@ -158,14 +160,14 @@ func testAccGkeonpremVmwareCluster_vmwareClusterUpdateMetalLb(context map[string
   return acctest.Nprintf(`
 
   resource "google_gkeonprem_vmware_cluster" "cluster" {
-    provider = google-beta
-
     name = "tf-test-cluster-%{random_suffix}"
     location = "us-west1"
     admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
     description = "test cluster updated"
     on_prem_version = "1.13.1-gke.36"
-    annotations = {}
+    annotations = {
+      env = "test-update"
+    }
     network_config {
       service_address_cidr_blocks = ["10.96.0.0/16"]
       pod_address_cidr_blocks = ["192.168.0.0/20"]
@@ -206,8 +208,6 @@ func testAccGkeonpremVmwareCluster_vmwareClusterUpdateF5LbStart(context map[stri
   return acctest.Nprintf(`
 
   resource "google_gkeonprem_vmware_cluster" "cluster" {
-    provider = google-beta
-
     name = "tf-test-cluster-%{random_suffix}"
     location = "us-west1"
     admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
@@ -255,8 +255,6 @@ func testAccGkeonpremVmwareCluster_vmwareClusterUpdateF5lb(context map[string]in
   return acctest.Nprintf(`
 
   resource "google_gkeonprem_vmware_cluster" "cluster" {
-    provider = google-beta
-
     name = "tf-test-cluster-%{random_suffix}"
     location = "us-west1"
     admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
@@ -304,8 +302,6 @@ func testAccGkeonpremVmwareCluster_vmwareClusterUpdateManualLbStart(context map[
   return acctest.Nprintf(`
 
   resource "google_gkeonprem_vmware_cluster" "cluster" {
-    provider = google-beta
-
     name = "tf-test-cluster-%{random_suffix}"
     location = "us-west1"
     admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
@@ -360,6 +356,15 @@ func testAccGkeonpremVmwareCluster_vmwareClusterUpdateManualLbStart(context map[
         konnectivity_server_node_port = 30008
       }
     }
+    vcenter {
+      resource_pool = "test-resource-pool"
+      datastore = "test-datastore"
+      datacenter = "test-datacenter"
+      cluster = "test-cluster"
+      folder = "test-folder"
+      ca_cert_data = "test-ca-cert-data"
+      storage_policy_name = "test-storage-policy-name"
+    }
     dataplane_v2 {
       dataplane_v2_enabled = true
       windows_dataplane_v2_enabled = true
@@ -389,8 +394,6 @@ func testAccGkeonpremVmwareCluster_vmwareClusterUpdateManualLb(context map[strin
   return acctest.Nprintf(`
 
   resource "google_gkeonprem_vmware_cluster" "cluster" {
-    provider = google-beta
-
     name = "tf-test-cluster-%{random_suffix}"
     location = "us-west1"
     admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
@@ -445,6 +448,15 @@ func testAccGkeonpremVmwareCluster_vmwareClusterUpdateManualLb(context map[strin
         konnectivity_server_node_port = 30009
       }
     }
+    vcenter {
+      resource_pool = "test-resource-pool-updated"
+      datastore = "test-datastore-updated"
+      datacenter = "test-datacenter-updated"
+      cluster = "test-cluster-updated"
+      folder = "test-folder-updated"
+      ca_cert_data = "test-ca-cert-data-updated"
+      storage_policy_name = "test-storage-policy-name-updated"
+    }
     dataplane_v2 {
       dataplane_v2_enabled = true
       windows_dataplane_v2_enabled = true
@@ -469,4 +481,3 @@ func testAccGkeonpremVmwareCluster_vmwareClusterUpdateManualLb(context map[strin
   }
 `, context)
 }
-<% end -%>
diff --git a/mmv1/third_party/terraform/services/gkeonprem/resource_gkeonprem_vmware_node_pool_test.go.erb b/mmv1/third_party/terraform/services/gkeonprem/resource_gkeonprem_vmware_node_pool_test.go.erb
index 4be86f65a2c1..d57ca27bcb01 100644
--- a/mmv1/third_party/terraform/services/gkeonprem/resource_gkeonprem_vmware_node_pool_test.go.erb
+++ b/mmv1/third_party/terraform/services/gkeonprem/resource_gkeonprem_vmware_node_pool_test.go.erb
@@ -1,6 +1,6 @@
 <% autogen_exception -%>
 package gkeonprem_test
-<% unless version == 'ga' -%>
+
 import (
 	"testing"
 
@@ -17,7 +17,7 @@ func TestAccGkeonpremVmwareNodePool_vmwareNodePoolUpdate(t *testing.T) {
 
   acctest.VcrTest(t, resource.TestCase{
     PreCheck:                 func() { acctest.AccTestPreCheck(t) },
-    ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
+    ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
     CheckDestroy:             testAccCheckGkeonpremVmwareNodePoolDestroyProducer(t),
     Steps: []resource.TestStep{
       {
@@ -27,6 +27,7 @@ func TestAccGkeonpremVmwareNodePool_vmwareNodePoolUpdate(t *testing.T) {
         ResourceName:      "google_gkeonprem_vmware_node_pool.nodepool",
         ImportState:       true,
         ImportStateVerify: true,
+        ImportStateVerifyIgnore: []string{"annotations"},
       },
       {
         Config: testAccGkeonpremVmwareNodePool_vmwareNodePoolUpdate(context),
@@ -35,6 +36,7 @@ func TestAccGkeonpremVmwareNodePool_vmwareNodePoolUpdate(t *testing.T) {
         ResourceName:      "google_gkeonprem_vmware_node_pool.nodepool",
         ImportState:       true,
         ImportStateVerify: true,
+        ImportStateVerifyIgnore: []string{"annotations"},
       },
     },
   })
@@ -44,8 +46,6 @@ func testAccGkeonpremVmwareNodePool_vmwareNodePoolUpdateStart(context map[string
   return acctest.Nprintf(`
 
   resource "google_gkeonprem_vmware_cluster" "cluster" {
-    provider = google-beta
-
     name = "tf-test-cluster-%{random_suffix}"
     location = "us-west1"
     admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
@@ -87,12 +87,12 @@ func testAccGkeonpremVmwareNodePool_vmwareNodePoolUpdateStart(context map[string
   }
 
   resource "google_gkeonprem_vmware_node_pool" "nodepool" {
-    provider = google-beta
-
     name = "tf-test-nodepool-%{random_suffix}"
     location = "us-west1"
     vmware_cluster = google_gkeonprem_vmware_cluster.cluster.name
-    annotations = {}
+    annotations = {
+      env = "test"
+    }
     config {
         cpus = 4
         memory_mb = 8196
@@ -119,8 +119,6 @@ func testAccGkeonpremVmwareNodePool_vmwareNodePoolUpdate(context map[string]inte
   return acctest.Nprintf(`
 
   resource "google_gkeonprem_vmware_cluster" "cluster" {
-    provider = google-beta
-
     name = "tf-test-cluster-%{random_suffix}"
     location = "us-west1"
     admin_cluster_membership = "projects/870316890899/locations/global/memberships/gkeonprem-terraform-test"
@@ -162,12 +160,12 @@ func testAccGkeonpremVmwareNodePool_vmwareNodePoolUpdate(context map[string]inte
   }
 
   resource "google_gkeonprem_vmware_node_pool" "nodepool" {
-    provider = google-beta
-
     name = "tf-test-nodepool-%{random_suffix}"
     location = "us-west1"
     vmware_cluster = google_gkeonprem_vmware_cluster.cluster.name
-    annotations = {}
+    annotations = {
+      env = "test-update"
+    }
     config {
         cpus = 5
         memory_mb = 4096
@@ -189,4 +187,3 @@ func testAccGkeonpremVmwareNodePool_vmwareNodePoolUpdate(context map[string]inte
   }
 `, context)
 }
-<% end -%>
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/services/healthcare/resource_healthcare_dicom_store_test.go b/mmv1/third_party/terraform/services/healthcare/resource_healthcare_dicom_store_test.go
index 4b7584d72d1a..39dd582532da 100644
--- a/mmv1/third_party/terraform/services/healthcare/resource_healthcare_dicom_store_test.go
+++ b/mmv1/third_party/terraform/services/healthcare/resource_healthcare_dicom_store_test.go
@@ -91,9 +91,10 @@ func TestAccHealthcareDicomStore_basic(t *testing.T) {
 				Config: testGoogleHealthcareDicomStore_basic(dicomStoreName, datasetName),
 			},
 			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testGoogleHealthcareDicomStore_update(dicomStoreName, datasetName, pubsubTopic),
@@ -102,17 +103,19 @@ func TestAccHealthcareDicomStore_basic(t *testing.T) {
 				),
 			},
 			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testGoogleHealthcareDicomStore_basic(dicomStoreName, datasetName),
 			},
 			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/healthcare/resource_healthcare_fhir_store_test.go.erb b/mmv1/third_party/terraform/services/healthcare/resource_healthcare_fhir_store_test.go.erb
index 16fe33421493..470d123a5cde 100644
--- a/mmv1/third_party/terraform/services/healthcare/resource_healthcare_fhir_store_test.go.erb
+++ b/mmv1/third_party/terraform/services/healthcare/resource_healthcare_fhir_store_test.go.erb
@@ -95,6 +95,7 @@ func TestAccHealthcareFhirStore_basic(t *testing.T) {
 				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testGoogleHealthcareFhirStore_update(fhirStoreName, datasetName, pubsubTopic),
@@ -106,6 +107,7 @@ func TestAccHealthcareFhirStore_basic(t *testing.T) {
 				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testGoogleHealthcareFhirStore_basic(fhirStoreName, datasetName),
@@ -114,6 +116,7 @@ func TestAccHealthcareFhirStore_basic(t *testing.T) {
 				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/healthcare/resource_healthcare_hl7_v2_store_test.go.erb b/mmv1/third_party/terraform/services/healthcare/resource_healthcare_hl7_v2_store_test.go.erb
index e3b6468de56f..aec48d059681 100644
--- a/mmv1/third_party/terraform/services/healthcare/resource_healthcare_hl7_v2_store_test.go.erb
+++ b/mmv1/third_party/terraform/services/healthcare/resource_healthcare_hl7_v2_store_test.go.erb
@@ -95,6 +95,7 @@ func TestAccHealthcareHl7V2Store_basic(t *testing.T) {
 				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testGoogleHealthcareHl7V2Store_update(hl7_v2StoreName, datasetName, pubsubTopic),
@@ -106,6 +107,7 @@ func TestAccHealthcareHl7V2Store_basic(t *testing.T) {
 				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testGoogleHealthcareHl7V2Store_basic(hl7_v2StoreName, datasetName),
@@ -114,6 +116,7 @@ func TestAccHealthcareHl7V2Store_basic(t *testing.T) {
 				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/iam2/resource_iam_deny_policy_test.go.erb b/mmv1/third_party/terraform/services/iam2/resource_iam_deny_policy_test.go.erb
index 1e0d4c3c7752..8d18239df3af 100644
--- a/mmv1/third_party/terraform/services/iam2/resource_iam_deny_policy_test.go.erb
+++ b/mmv1/third_party/terraform/services/iam2/resource_iam_deny_policy_test.go.erb
@@ -111,7 +111,7 @@ resource "google_iam_deny_policy" "example" {
         title = "Some expr"
         expression = "!resource.matchTag('12345678/env', 'test')"
       }
-      denied_permissions = ["cloudresourcemanager.googleapis.com/projects.delete"]
+      denied_permissions = ["cloudresourcemanager.googleapis.com/projects.update"]
     }
   }
   rules {
@@ -122,7 +122,7 @@ resource "google_iam_deny_policy" "example" {
         title = "Some expr"
         expression = "!resource.matchTag('12345678/env', 'test')"
       }
-      denied_permissions = ["cloudresourcemanager.googleapis.com/projects.delete"]
+      denied_permissions = ["cloudresourcemanager.googleapis.com/projects.update"]
       exception_principals = ["principal://iam.googleapis.com/projects/-/serviceAccounts/${google_service_account.test-account.email}"]
     }
   }
@@ -159,7 +159,7 @@ resource "google_iam_deny_policy" "example" {
         location = "/some/file"
         description = "A denial condition"
       }
-      denied_permissions = ["cloudresourcemanager.googleapis.com/projects.delete"]
+      denied_permissions = ["cloudresourcemanager.googleapis.com/projects.update"]
     }
   }
 }
diff --git a/mmv1/third_party/terraform/services/iambeta/data_source_iam_beta_workload_identity_pool.go.erb b/mmv1/third_party/terraform/services/iambeta/data_source_iam_beta_workload_identity_pool.go.erb
index 88588781b10d..6df5264d41b5 100644
--- a/mmv1/third_party/terraform/services/iambeta/data_source_iam_beta_workload_identity_pool.go.erb
+++ b/mmv1/third_party/terraform/services/iambeta/data_source_iam_beta_workload_identity_pool.go.erb
@@ -31,7 +31,15 @@ func dataSourceIAMBetaWorkloadIdentityPoolRead(d *schema.ResourceData, meta inte
 		return fmt.Errorf("Error constructing id: %s", err)
 	}
 	d.SetId(id)
-	return resourceIAMBetaWorkloadIdentityPoolRead(d, meta)
+	err = resourceIAMBetaWorkloadIdentityPoolRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
 
+	return nil
 }
 <% end -%>
diff --git a/mmv1/third_party/terraform/services/iambeta/data_source_iam_beta_workload_identity_pool_provider.go.erb b/mmv1/third_party/terraform/services/iambeta/data_source_iam_beta_workload_identity_pool_provider.go.erb
index 0aef39e9cfbc..582cd395c5fb 100644
--- a/mmv1/third_party/terraform/services/iambeta/data_source_iam_beta_workload_identity_pool_provider.go.erb
+++ b/mmv1/third_party/terraform/services/iambeta/data_source_iam_beta_workload_identity_pool_provider.go.erb
@@ -32,7 +32,15 @@ func dataSourceIAMBetaWorkloadIdentityPoolProviderRead(d *schema.ResourceData, m
 		return fmt.Errorf("Error constructing id: %s", err)
 	}
 	d.SetId(id)
-	return resourceIAMBetaWorkloadIdentityPoolProviderRead(d, meta)
+	err = resourceIAMBetaWorkloadIdentityPoolProviderRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
 
+	return nil
 }
 <% end -%>
diff --git a/mmv1/third_party/terraform/services/iap/data_source_iap_client.go b/mmv1/third_party/terraform/services/iap/data_source_iap_client.go
index 6cd3a863188d..736e18da0fe3 100644
--- a/mmv1/third_party/terraform/services/iap/data_source_iap_client.go
+++ b/mmv1/third_party/terraform/services/iap/data_source_iap_client.go
@@ -27,5 +27,13 @@ func dataSourceGoogleIapClientRead(d *schema.ResourceData, meta interface{}) err
 		return fmt.Errorf("Error constructing id: %s", err)
 	}
 	d.SetId(id)
-	return resourceIapClientRead(d, meta)
+	err = resourceIapClientRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/identityplatform/resource_identity_platform_config_test.go b/mmv1/third_party/terraform/services/identityplatform/resource_identity_platform_config_test.go
new file mode 100644
index 000000000000..d161713635bb
--- /dev/null
+++ b/mmv1/third_party/terraform/services/identityplatform/resource_identity_platform_config_test.go
@@ -0,0 +1,143 @@
+package identityplatform_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+	"github.com/hashicorp/terraform-provider-google/google/envvar"
+)
+
+func TestAccIdentityPlatformConfig_update(t *testing.T) {
+	acctest.SkipIfVcr(t)
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"org_id":           envvar.GetTestOrgFromEnv(t),
+		"billing_acct":     envvar.GetTestBillingAccountFromEnv(t),
+		"quota_start_time": time.Now().AddDate(0, 0, 1).Format(time.RFC3339),
+		"random_suffix":    acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccIdentityPlatformConfig_basic(context),
+			},
+			{
+				ResourceName:      "google_identity_platform_config.basic",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccIdentityPlatformConfig_update(context),
+			},
+			{
+				ResourceName:      "google_identity_platform_config.basic",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccIdentityPlatformConfig_basic(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_project" "basic" {
+  project_id = "tf-test-my-project%{random_suffix}"
+  name       = "tf-test-my-project%{random_suffix}"
+  org_id     = "%{org_id}"
+  billing_account =  "%{billing_acct}"
+  labels = {
+    firebase = "enabled"
+  }
+}
+
+resource "google_project_service" "identitytoolkit" {
+  project = google_project.basic.project_id
+  service = "identitytoolkit.googleapis.com"
+}
+
+resource "google_identity_platform_config" "basic" {
+  project = google_project.basic.project_id
+  autodelete_anonymous_users = true
+  sign_in {
+    allow_duplicate_emails = true
+
+    anonymous {
+        enabled = true
+    }
+    email {
+        enabled = true
+        password_required = false
+    }
+    phone_number {
+        enabled = true
+        test_phone_numbers = {
+            "+11231231234" = "000000"
+        }
+    }
+  }
+  sms_region_config {
+    allow_by_default {
+      disallowed_regions = [
+        "CA",
+        "US",
+      ]
+    }
+  }
+}
+`, context)
+}
+
+func testAccIdentityPlatformConfig_update(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_project" "basic" {
+  project_id = "tf-test-my-project%{random_suffix}"
+  name       = "tf-test-my-project%{random_suffix}"
+  org_id     = "%{org_id}"
+  billing_account =  "%{billing_acct}"
+  labels = {
+    firebase = "enabled"
+  }
+}
+
+resource "google_project_service" "identitytoolkit" {
+  project = google_project.basic.project_id
+  service = "identitytoolkit.googleapis.com"
+}
+
+resource "google_identity_platform_config" "basic" {
+  project = google_project.basic.project_id
+  sign_in {
+    allow_duplicate_emails = false
+
+    anonymous {
+        enabled = false
+    }
+    email {
+        enabled = true
+        password_required = true
+    }
+    phone_number {
+        enabled = true
+        test_phone_numbers = {
+	    "+17651212343" = "111111"
+        }
+    }
+  }
+  sms_region_config {
+    allowlist_only {
+      allowed_regions = [
+        "AU",
+        "NZ",
+      ]
+    }
+  }
+}
+`, context)
+}
diff --git a/mmv1/third_party/terraform/services/integrationconnectors/resource_integration_connectors_connection_test.go b/mmv1/third_party/terraform/services/integrationconnectors/resource_integration_connectors_connection_test.go
new file mode 100644
index 000000000000..be84a69b54e5
--- /dev/null
+++ b/mmv1/third_party/terraform/services/integrationconnectors/resource_integration_connectors_connection_test.go
@@ -0,0 +1,463 @@
+package integrationconnectors_test
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+)
+
+func TestAccIntegrationConnectorsConnection_update(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckIntegrationConnectorsConnectionDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccIntegrationConnectorsConnection_full(context),
+			},
+			{
+				ResourceName:            "google_integration_connectors_connection.zendeskconnection",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"location", "name", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccIntegrationConnectorsConnection_update(context),
+			},
+			{
+				ResourceName:            "google_integration_connectors_connection.zendeskconnection",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"location", "name", "labels", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccIntegrationConnectorsConnection_full(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+  data "google_project" "test_project" {
+  }
+
+  resource "google_secret_manager_secret" "secret-basic" {
+    secret_id = "tf-test-test-secret%{random_suffix}"
+    replication {
+      user_managed {
+        replicas {
+          location = "us-central1"
+        }
+      }
+    }
+  }
+
+
+  resource "google_secret_manager_secret_version" "secret-version-basic" {
+    secret = google_secret_manager_secret.secret-basic.id
+    secret_data = "dummypassword"
+  }
+
+  resource "google_secret_manager_secret_iam_member" "secret_iam" {
+    secret_id  = google_secret_manager_secret.secret-basic.id
+    role       = "roles/secretmanager.admin"
+    member     = "serviceAccount:${data.google_project.test_project.number}-compute@developer.gserviceaccount.com"
+    depends_on = [google_secret_manager_secret_version.secret-version-basic]
+  }
+
+  resource "google_integration_connectors_connection" "zendeskconnection" {
+    name     = "tf-test-test-zendesk%{random_suffix}"
+    description = "tf description"
+    location = "us-central1"
+    service_account = "${data.google_project.test_project.number}-compute@developer.gserviceaccount.com"
+    connector_version = "projects/${data.google_project.test_project.project_id}/locations/global/providers/zendesk/connectors/zendesk/versions/1"
+    config_variable {
+        key = "proxy_enabled"
+        boolean_value = false
+    }
+    config_variable {
+      key = "sample_integer_value"
+      integer_value = 1
+    }
+
+    config_variable {
+        key = "sample_encryption_key_value"
+        encryption_key_value {
+          type = "GOOGLE_MANAGED"
+          kms_key_name = "sampleKMSKkey"
+        }
+    }
+
+    config_variable {
+      key = "sample_secret_value"
+      secret_value {
+        secret_version = google_secret_manager_secret_version.secret-version-basic.name
+      }
+    }
+
+    suspended = false
+    auth_config {
+      auth_type = "USER_PASSWORD"
+      auth_key = "sampleAuthKey"
+      user_password {
+        username = "user@xyz.com"
+        password {
+          secret_version = google_secret_manager_secret_version.secret-version-basic.name
+        }
+      }
+    }
+
+    destination_config {
+      key = "url"
+      destination {
+          host = "https://test.zendesk.com"
+      }
+    }
+    lock_config {
+      locked = false
+      reason = "Its for sure not locked"
+    }
+    log_config {
+      enabled = true
+    }
+    node_config {
+      min_node_count = 2
+      max_node_count = 50
+    }
+    labels = {
+      foo = "bar"
+    }
+    ssl_config {
+      additional_variable {
+        key = "sample_string"
+        string_value = "sampleString"
+      }
+      additional_variable {
+        key = "sample_boolean"
+        boolean_value = false
+      }
+      additional_variable {
+        key = "sample_integer"
+        integer_value = 1
+      }
+      additional_variable {
+        key = "sample_secret_value"
+        secret_value {
+          secret_version = google_secret_manager_secret_version.secret-version-basic.name
+        }
+      }
+      additional_variable {
+        key = "sample_encryption_key_value"
+        encryption_key_value {
+          type = "GOOGLE_MANAGED"
+          kms_key_name = "sampleKMSKkey"
+        }
+      }
+      client_cert_type = "PEM"
+      client_certificate {
+        secret_version = google_secret_manager_secret_version.secret-version-basic.name
+      }
+      client_private_key {
+        secret_version = google_secret_manager_secret_version.secret-version-basic.name
+      }
+      client_private_key_pass {
+        secret_version = google_secret_manager_secret_version.secret-version-basic.name
+      }
+      private_server_certificate {
+        secret_version = google_secret_manager_secret_version.secret-version-basic.name
+      }
+      server_cert_type = "PEM"
+      trust_model      = "PRIVATE"
+      type             = "TLS"
+      use_ssl          = true
+    }
+
+    eventing_enablement_type = "EVENTING_AND_CONNECTION"
+    eventing_config {
+      additional_variable {
+        key = "sample_string"
+        string_value = "sampleString"
+      }
+      additional_variable {
+        key = "sample_boolean"
+        boolean_value = false
+      }
+      additional_variable {
+        key = "sample_integer"
+        integer_value = 1
+      }
+      additional_variable {
+        key = "sample_secret_value"
+        secret_value {
+          secret_version = google_secret_manager_secret_version.secret-version-basic.name
+        }
+      }
+      additional_variable {
+        key = "sample_encryption_key_value"
+        encryption_key_value {
+          type = "GOOGLE_MANAGED"
+          kms_key_name = "sampleKMSKkey"
+        }
+      }
+      registration_destination_config {
+        key = "registration_destination_config"
+        destination {
+          host = "https://test.zendesk.com"
+        }
+      }
+      auth_config {
+        auth_type = "USER_PASSWORD"
+        auth_key = "sampleAuthKey"
+        user_password {
+          username = "user@xyz.com"
+          password {
+            secret_version = google_secret_manager_secret_version.secret-version-basic.name
+          }
+        }
+        additional_variable {
+          key = "sample_string"
+          string_value = "sampleString"
+        }
+        additional_variable {
+          key = "sample_boolean"
+          boolean_value = false
+        }
+        additional_variable {
+          key = "sample_integer"
+          integer_value = 1
+        }
+        additional_variable {
+          key = "sample_secret_value"
+          secret_value {
+            secret_version = google_secret_manager_secret_version.secret-version-basic.name
+          }
+        }
+        additional_variable {
+          key = "sample_encryption_key_value"
+          encryption_key_value {
+            type = "GOOGLE_MANAGED"
+            kms_key_name = "sampleKMSKkey"
+          }
+        }
+      }
+      enrichment_enabled = true
+    }
+  }
+`, context)
+}
+
+func testAccIntegrationConnectorsConnection_update(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+  data "google_project" "test_project" {
+  }
+
+  resource "google_secret_manager_secret" "secret-basic" {
+    secret_id = "tf-test-test-secret%{random_suffix}"
+    replication {
+      user_managed {
+        replicas {
+          location = "us-central1"
+        }
+      }
+    }
+  }
+
+
+  resource "google_secret_manager_secret_version" "secret-version-basic" {
+    secret = google_secret_manager_secret.secret-basic.id
+    secret_data = "dummypassword"
+  }
+
+  resource "google_secret_manager_secret_iam_member" "secret_iam" {
+    secret_id  = google_secret_manager_secret.secret-basic.id
+    role       = "roles/secretmanager.admin"
+    member     = "serviceAccount:${data.google_project.test_project.number}-compute@developer.gserviceaccount.com"
+    depends_on = [google_secret_manager_secret_version.secret-version-basic]
+  }
+
+  resource "google_integration_connectors_connection" "zendeskconnection" {
+    name     = "tf-test-test-zendesk%{random_suffix}"
+    description = "tf updated description"
+    location = "us-central1"
+    service_account = "${data.google_project.test_project.number}-compute@developer.gserviceaccount.com"
+    connector_version = "projects/${data.google_project.test_project.project_id}/locations/global/providers/zendesk/connectors/zendesk/versions/1"
+    config_variable {
+        key = "proxy_enabled"
+        boolean_value = true
+    }
+    config_variable {
+      key = "sample_integer_value"
+      integer_value = 2
+    }
+
+    config_variable {
+        key = "sample_encryption_key_value"
+        encryption_key_value {
+          type = "CUSTOMER_MANAGED"
+          kms_key_name = "sampleKMSKkey1"
+        }
+    }
+
+    config_variable {
+      key = "sample_secret_value"
+      secret_value {
+        secret_version = google_secret_manager_secret_version.secret-version-basic.name
+      }
+    }
+
+    suspended = false
+    auth_config {
+      auth_type = "USER_PASSWORD"
+      auth_key = "sampleNewAuthKey"
+      user_password {
+        username = "user1@xyz.com"
+        password {
+          secret_version = google_secret_manager_secret_version.secret-version-basic.name
+        }
+      }
+    }
+
+    destination_config {
+      key = "url"
+      destination {
+          host = "https://test1.zendesk.com"
+      }
+    }
+    lock_config {
+      locked = false
+      reason = "Its for sure not locked"
+    }
+    log_config {
+      enabled = true
+    }
+    node_config {
+      min_node_count = 3
+      max_node_count = 49
+    }
+    labels = {
+      bar = "foo"
+    }
+    ssl_config {
+      additional_variable {
+        key = "sample_string"
+        string_value = "sampleString1"
+      }
+      additional_variable {
+        key = "sample_boolean"
+        boolean_value = true
+      }
+      additional_variable {
+        key = "sample_integer"
+        integer_value = 2
+      }
+      additional_variable {
+        key = "sample_secret_value"
+        secret_value {
+          secret_version = google_secret_manager_secret_version.secret-version-basic.name
+        }
+      }
+      additional_variable {
+        key = "sample_encryption_key_value"
+        encryption_key_value {
+          type = "CUSTOMER_MANAGED"
+          kms_key_name = "sampleNewKMSKkey"
+        }
+      }
+      client_cert_type = "PEM"
+      client_certificate {
+        secret_version = google_secret_manager_secret_version.secret-version-basic.name
+      }
+      client_private_key {
+        secret_version = google_secret_manager_secret_version.secret-version-basic.name
+      }
+      client_private_key_pass {
+        secret_version = google_secret_manager_secret_version.secret-version-basic.name
+      }
+      private_server_certificate {
+        secret_version = google_secret_manager_secret_version.secret-version-basic.name
+      }
+      server_cert_type = "PEM"
+      trust_model      = "INSECURE"
+      type             = "MTLS"
+      use_ssl          = false
+    }
+
+    eventing_enablement_type = "EVENTING_AND_CONNECTION"
+    eventing_config {
+      additional_variable {
+        key = "sample_string"
+        string_value = "sampleString1"
+      }
+      additional_variable {
+        key = "sample_boolean"
+        boolean_value = true
+      }
+      additional_variable {
+        key = "sample_integer"
+        integer_value = 2
+      }
+      additional_variable {
+        key = "sample_secret_value"
+        secret_value {
+          secret_version = google_secret_manager_secret_version.secret-version-basic.name
+        }
+      }
+      additional_variable {
+        key = "sample_encryption_key_value"
+        encryption_key_value {
+          type = "CUSTOMER_MANAGED"
+          kms_key_name = "sampleNewKMSKkey"
+        }
+      }
+      registration_destination_config {
+        key = "registration_destination_config"
+        destination {
+          host = "https://test1.zendesk.com"
+        }
+      }
+      auth_config {
+        auth_type = "USER_PASSWORD"
+        auth_key = "sampleAuthKey1"
+        user_password {
+          username = "user1@xyz.com"
+          password {
+            secret_version = google_secret_manager_secret_version.secret-version-basic.name
+          }
+        }
+        additional_variable {
+          key = "sample_string"
+          string_value = "sampleString1"
+        }
+        additional_variable {
+          key = "sample_boolean"
+          boolean_value = true
+        }
+        additional_variable {
+          key = "sample_integer"
+          integer_value = 2
+        }
+        additional_variable {
+          key = "sample_secret_value"
+          secret_value {
+            secret_version = google_secret_manager_secret_version.secret-version-basic.name
+          }
+        }
+        additional_variable {
+          key = "sample_encryption_key_value"
+          encryption_key_value {
+            type = "CUSTOMER_MANAGED"
+            kms_key_name = "sampleNewKMSKkey"
+          }
+        }
+      }
+      enrichment_enabled = false
+    }
+  }
+`, context)
+}
diff --git a/mmv1/third_party/terraform/services/kms/data_source_google_kms_crypto_key.go b/mmv1/third_party/terraform/services/kms/data_source_google_kms_crypto_key.go
index 84c124eba250..670d67f40e66 100644
--- a/mmv1/third_party/terraform/services/kms/data_source_google_kms_crypto_key.go
+++ b/mmv1/third_party/terraform/services/kms/data_source_google_kms_crypto_key.go
@@ -1,6 +1,8 @@
 package kms
 
 import (
+	"fmt"
+
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
@@ -31,7 +33,20 @@ func dataSourceGoogleKmsCryptoKeyRead(d *schema.ResourceData, meta interface{})
 		Name:      d.Get("name").(string),
 	}
 
-	d.SetId(cryptoKeyId.CryptoKeyId())
+	id := cryptoKeyId.CryptoKeyId()
+	d.SetId(id)
+
+	err = resourceKMSCryptoKeyRead(d, meta)
+	if err != nil {
+		return err
+	}
 
-	return resourceKMSCryptoKeyRead(d, meta)
+	if err := tpgresource.SetDataSourceLabels(d); err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/kms/data_source_google_kms_crypto_key_version.go b/mmv1/third_party/terraform/services/kms/data_source_google_kms_crypto_key_version.go
index eb7253f2c674..21192c68ea48 100644
--- a/mmv1/third_party/terraform/services/kms/data_source_google_kms_crypto_key_version.go
+++ b/mmv1/third_party/terraform/services/kms/data_source_google_kms_crypto_key_version.go
@@ -87,7 +87,7 @@ func dataSourceGoogleKmsCryptoKeyVersionRead(d *schema.ResourceData, meta interf
 		UserAgent: userAgent,
 	})
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("KmsCryptoKeyVersion %q", d.Id()))
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("KmsCryptoKeyVersion %q", d.Id()), url)
 	}
 
 	if err := d.Set("version", flattenKmsCryptoKeyVersionVersion(res["name"], d)); err != nil {
@@ -120,7 +120,7 @@ func dataSourceGoogleKmsCryptoKeyVersionRead(d *schema.ResourceData, meta interf
 		UserAgent: userAgent,
 	})
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("KmsCryptoKey %q", d.Id()))
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("KmsCryptoKey %q", d.Id()), url)
 	}
 
 	if res["purpose"] == "ASYMMETRIC_SIGN" || res["purpose"] == "ASYMMETRIC_DECRYPT" {
diff --git a/mmv1/third_party/terraform/services/kms/data_source_google_kms_key_ring.go b/mmv1/third_party/terraform/services/kms/data_source_google_kms_key_ring.go
index ae1bc4f73199..7a47f9b798ef 100644
--- a/mmv1/third_party/terraform/services/kms/data_source_google_kms_key_ring.go
+++ b/mmv1/third_party/terraform/services/kms/data_source_google_kms_key_ring.go
@@ -1,6 +1,8 @@
 package kms
 
 import (
+	"fmt"
+
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
@@ -31,7 +33,16 @@ func dataSourceGoogleKmsKeyRingRead(d *schema.ResourceData, meta interface{}) er
 		Location: d.Get("location").(string),
 		Project:  project,
 	}
-	d.SetId(keyRingId.KeyRingId())
+	id := keyRingId.KeyRingId()
+	d.SetId(id)
+
+	err = resourceKMSKeyRingRead(d, meta)
+	if err != nil {
+		return err
+	}
 
-	return resourceKMSKeyRingRead(d, meta)
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/kms/resource_kms_crypto_key_test.go b/mmv1/third_party/terraform/services/kms/resource_kms_crypto_key_test.go
index 6f84c616dc29..d067dbcdb9af 100644
--- a/mmv1/third_party/terraform/services/kms/resource_kms_crypto_key_test.go
+++ b/mmv1/third_party/terraform/services/kms/resource_kms_crypto_key_test.go
@@ -152,16 +152,18 @@ func TestAccKmsCryptoKey_basic(t *testing.T) {
 				Config: testGoogleKmsCryptoKey_basic(projectId, projectOrg, projectBillingAccount, keyRingName, cryptoKeyName),
 			},
 			{
-				ResourceName:      "google_kms_crypto_key.crypto_key",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_kms_crypto_key.crypto_key",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			// Test importing with a short id
 			{
-				ResourceName:      "google_kms_crypto_key.crypto_key",
-				ImportState:       true,
-				ImportStateId:     fmt.Sprintf("%s/%s/%s/%s", projectId, location, keyRingName, cryptoKeyName),
-				ImportStateVerify: true,
+				ResourceName:            "google_kms_crypto_key.crypto_key",
+				ImportState:             true,
+				ImportStateId:           fmt.Sprintf("%s/%s/%s/%s", projectId, location, keyRingName, cryptoKeyName),
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			// Use a separate TestStep rather than a CheckDestroy because we need the project to still exist.
 			{
@@ -294,9 +296,10 @@ func TestAccKmsCryptoKey_destroyDuration(t *testing.T) {
 				Config: testGoogleKmsCryptoKey_destroyDuration(projectId, projectOrg, projectBillingAccount, keyRingName, cryptoKeyName),
 			},
 			{
-				ResourceName:      "google_kms_crypto_key.crypto_key",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_kms_crypto_key.crypto_key",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			// Use a separate TestStep rather than a CheckDestroy because we need the project to still exist.
 			{
@@ -332,7 +335,7 @@ func TestAccKmsCryptoKey_importOnly(t *testing.T) {
 				ResourceName:            "google_kms_crypto_key.crypto_key",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"skip_initial_version_creation"},
+				ImportStateVerifyIgnore: []string{"skip_initial_version_creation", "labels", "terraform_labels"},
 			},
 			// Use a separate TestStep rather than a CheckDestroy because we need the project to still exist.
 			{
@@ -426,9 +429,10 @@ func TestAccKmsCryptoKeyVersion_basic(t *testing.T) {
 				Config: testGoogleKmsCryptoKeyVersion_basic(projectId, projectOrg, projectBillingAccount, keyRingName, cryptoKeyName),
 			},
 			{
-				ResourceName:      "google_kms_crypto_key_version.crypto_key_version",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_kms_crypto_key_version.crypto_key_version",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testGoogleKmsCryptoKeyVersion_removed(projectId, projectOrg, projectBillingAccount, keyRingName, cryptoKeyName),
@@ -454,9 +458,10 @@ func TestAccKmsCryptoKeyVersion_skipInitialVersion(t *testing.T) {
 				Config: testGoogleKmsCryptoKeyVersion_skipInitialVersion(projectId, projectOrg, projectBillingAccount, keyRingName, cryptoKeyName),
 			},
 			{
-				ResourceName:      "google_kms_crypto_key_version.crypto_key_version",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_kms_crypto_key_version.crypto_key_version",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -480,17 +485,19 @@ func TestAccKmsCryptoKeyVersion_patch(t *testing.T) {
 				Config: testGoogleKmsCryptoKeyVersion_patchInitialize(projectId, projectOrg, projectBillingAccount, keyRingName, cryptoKeyName),
 			},
 			{
-				ResourceName:      "google_kms_crypto_key_version.crypto_key_version",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_kms_crypto_key_version.crypto_key_version",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testGoogleKmsCryptoKeyVersion_patch("true", projectId, projectOrg, projectBillingAccount, keyRingName, cryptoKeyName, state),
 			},
 			{
-				ResourceName:      "google_kms_crypto_key_version.crypto_key_version",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_kms_crypto_key_version.crypto_key_version",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testGoogleKmsCryptoKeyVersion_patch("false", projectId, projectOrg, projectBillingAccount, keyRingName, cryptoKeyName, state),
diff --git a/mmv1/third_party/terraform/services/logging/data_source_google_logging_project_cmek_settings.go b/mmv1/third_party/terraform/services/logging/data_source_google_logging_project_cmek_settings.go
index a2b30a6e414a..f839cbe7a868 100644
--- a/mmv1/third_party/terraform/services/logging/data_source_google_logging_project_cmek_settings.go
+++ b/mmv1/third_party/terraform/services/logging/data_source_google_logging_project_cmek_settings.go
@@ -85,7 +85,7 @@ func dataSourceGoogleLoggingProjectCmekSettingsRead(d *schema.ResourceData, meta
 		UserAgent: userAgent,
 	})
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("LoggingProjectCmekSettings %q", d.Id()))
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("LoggingProjectCmekSettings %q", d.Id()), url)
 	}
 
 	d.SetId(fmt.Sprintf("projects/%s/cmekSettings", project))
diff --git a/mmv1/third_party/terraform/services/logging/data_source_google_logging_sink.go b/mmv1/third_party/terraform/services/logging/data_source_google_logging_sink.go
index 64788602d8d7..95cf8663a709 100644
--- a/mmv1/third_party/terraform/services/logging/data_source_google_logging_sink.go
+++ b/mmv1/third_party/terraform/services/logging/data_source_google_logging_sink.go
@@ -33,7 +33,7 @@ func dataSourceGoogleLoggingSinkRead(d *schema.ResourceData, meta interface{}) e
 
 	sink, err := config.NewLoggingClient(userAgent).Sinks.Get(sinkId).Do()
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("Logging Sink %s", d.Id()))
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("Logging Sink %s", d.Id()), sinkId)
 	}
 
 	if err := flattenResourceLoggingSink(d, sink); err != nil {
diff --git a/mmv1/third_party/terraform/services/logging/resource_logging_bucket_config.go b/mmv1/third_party/terraform/services/logging/resource_logging_bucket_config.go
index 9ad5ebb08f29..78258975e396 100644
--- a/mmv1/third_party/terraform/services/logging/resource_logging_bucket_config.go
+++ b/mmv1/third_party/terraform/services/logging/resource_logging_bucket_config.go
@@ -6,6 +6,7 @@ import (
 	"regexp"
 	"strings"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
@@ -88,6 +89,28 @@ See [Enabling CMEK for Logging Buckets](https://cloud.google.com/logging/docs/ro
 			},
 		},
 	},
+	"index_configs": {
+		Type:        schema.TypeSet,
+		MaxItems:    20,
+		Optional:    true,
+		Description: `A list of indexed fields and related configuration data.`,
+		Elem: &schema.Resource{
+			Schema: map[string]*schema.Schema{
+				"field_path": {
+					Type:        schema.TypeString,
+					Required:    true,
+					Description: `The LogEntry field path to index.`,
+				},
+				"type": {
+					Type:     schema.TypeString,
+					Required: true,
+					Description: `The type of data in this index
+Note that some paths are automatically indexed, and other paths are not eligible for indexing. See [indexing documentation]( https://cloud.google.com/logging/docs/view/advanced-queries#indexed-fields) for details.
+For example: jsonPayload.request.status`,
+				},
+			},
+		},
+	},
 }
 
 type loggingBucketConfigIDFunc func(d *schema.ResourceData, config *transport_tpg.Config) (string, error)
@@ -105,6 +128,9 @@ func ResourceLoggingBucketConfig(parentType string, parentSpecificSchema map[str
 		},
 		Schema:        tpgresource.MergeSchemas(loggingBucketConfigSchema, parentSpecificSchema),
 		UseJSONNumber: true,
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+		),
 	}
 }
 
@@ -203,6 +229,7 @@ func resourceLoggingBucketConfigCreate(d *schema.ResourceData, meta interface{},
 	obj["description"] = d.Get("description")
 	obj["retentionDays"] = d.Get("retention_days")
 	obj["cmekSettings"] = expandCmekSettings(d.Get("cmek_settings"))
+	obj["indexConfigs"] = expandIndexConfigs(d.Get("index_configs"))
 
 	url, err := tpgresource.ReplaceVars(d, config, "{{LoggingBasePath}}projects/{{project}}/locations/{{location}}/buckets?bucketId={{bucket_id}}")
 	if err != nil {
@@ -287,6 +314,10 @@ func resourceLoggingBucketConfigRead(d *schema.ResourceData, meta interface{}) e
 		return fmt.Errorf("Error setting cmek_settings: %s", err)
 	}
 
+	if err := d.Set("index_configs", flattenIndexConfigs(res["indexConfigs"])); err != nil {
+		return fmt.Errorf("Error setting index_configs: %s", err)
+	}
+
 	return nil
 }
 
@@ -307,6 +338,7 @@ func resourceLoggingBucketConfigUpdate(d *schema.ResourceData, meta interface{})
 	obj["retentionDays"] = d.Get("retention_days")
 	obj["description"] = d.Get("description")
 	obj["cmekSettings"] = expandCmekSettings(d.Get("cmek_settings"))
+	obj["indexConfigs"] = expandIndexConfigs(d.Get("index_configs"))
 
 	updateMask := []string{}
 	if d.HasChange("retention_days") {
@@ -318,6 +350,10 @@ func resourceLoggingBucketConfigUpdate(d *schema.ResourceData, meta interface{})
 	if d.HasChange("cmek_settings") {
 		updateMask = append(updateMask, "cmekSettings")
 	}
+	if d.HasChange("index_configs") {
+		updateMask = append(updateMask, "indexConfigs")
+	}
+
 	url, err = transport_tpg.AddQueryParams(url, map[string]string{"updateMask": strings.Join(updateMask, ",")})
 	if err != nil {
 		return err
@@ -405,3 +441,44 @@ func flattenCmekSettings(cmekSettings interface{}) []map[string]interface{} {
 
 	return []map[string]interface{}{data}
 }
+
+func expandIndexConfigs(maybeIndexConfigs interface{}) []map[string]interface{} {
+	if maybeIndexConfigs == nil {
+		return nil
+	}
+
+	indexConfigs := maybeIndexConfigs.(*schema.Set).List()
+	transformedIndexConfigs := make([]map[string]interface{}, 0, len(indexConfigs))
+
+	for _, entry := range indexConfigs {
+		original := entry.(map[string]interface{})
+
+		transformed := map[string]interface{}{
+			"fieldPath": original["field_path"],
+			"type":      original["type"],
+		}
+		transformedIndexConfigs = append(transformedIndexConfigs, transformed)
+	}
+	return transformedIndexConfigs
+}
+
+func flattenIndexConfigs(maybeIndexConfigs interface{}) []map[string]interface{} {
+	if maybeIndexConfigs == nil {
+		return nil
+	}
+
+	indexConfigs := maybeIndexConfigs.([]interface{})
+	flattenedIndexConfigs := make([]map[string]interface{}, 0, len(indexConfigs))
+
+	for _, entry := range indexConfigs {
+		indexConfig := entry.(map[string]interface{})
+		if len(indexConfig) < 1 {
+			continue
+		}
+		flattenedIndexConfigs = append(flattenedIndexConfigs, map[string]interface{}{
+			"field_path": indexConfig["fieldPath"],
+			"type":       indexConfig["type"],
+		})
+	}
+	return flattenedIndexConfigs
+}
diff --git a/mmv1/third_party/terraform/services/logging/resource_logging_bucket_config_test.go b/mmv1/third_party/terraform/services/logging/resource_logging_bucket_config_test.go
index e9f8da482821..b4556484a999 100644
--- a/mmv1/third_party/terraform/services/logging/resource_logging_bucket_config_test.go
+++ b/mmv1/third_party/terraform/services/logging/resource_logging_bucket_config_test.go
@@ -123,42 +123,6 @@ func TestAccLoggingBucketConfigProject_analyticsEnabled(t *testing.T) {
 	})
 }
 
-func TestAccLoggingBucketConfigProject_locked(t *testing.T) {
-	t.Parallel()
-
-	context := map[string]interface{}{
-		"random_suffix":   acctest.RandString(t, 10),
-		"project_name":    "tf-test-" + acctest.RandString(t, 10),
-		"org_id":          envvar.GetTestOrgFromEnv(t),
-		"billing_account": envvar.GetTestBillingAccountFromEnv(t),
-	}
-
-	acctest.VcrTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
-		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
-		Steps: []resource.TestStep{
-			{
-				Config: testAccLoggingBucketConfigProject_locked(context, false),
-			},
-			{
-				ResourceName:            "google_logging_project_bucket_config.variable_locked",
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"project"},
-			},
-			{
-				Config: testAccLoggingBucketConfigProject_locked(context, true),
-			},
-			{
-				ResourceName:            "google_logging_project_bucket_config.variable_locked",
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"project"},
-			},
-		},
-	})
-}
-
 func TestAccLoggingBucketConfigProject_cmekSettings(t *testing.T) {
 	t.Parallel()
 
@@ -523,3 +487,129 @@ func getLoggingBucketConfigs(context map[string]interface{}) map[string]string {
 	}
 
 }
+
+func TestAccLoggingBucketConfigOrganization_indexConfigs(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+		"org_id":        envvar.GetTestOrgFromEnv(t),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccLoggingBucketConfigOrganization_indexConfigs(context, "INDEX_TYPE_STRING", "INDEX_TYPE_STRING"),
+			},
+			{
+				ResourceName:            "google_logging_organization_bucket_config.basic",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"organization"},
+			},
+			{
+				Config: testAccLoggingBucketConfigOrganization_indexConfigs(context, "INDEX_TYPE_STRING", "INDEX_TYPE_INTEGER"),
+			},
+			{
+				ResourceName:            "google_logging_organization_bucket_config.basic",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"organization"},
+			},
+		},
+	})
+}
+
+func testAccLoggingBucketConfigOrganization_indexConfigs(context map[string]interface{}, urlIndexType, statusIndexType string) string {
+	return fmt.Sprintf(acctest.Nprintf(`
+data "google_organization" "default" {
+	organization = "%{org_id}"
+}
+
+resource "google_logging_organization_bucket_config" "basic" {
+	organization    = data.google_organization.default.organization
+	location  = "global"
+	retention_days = 30
+	description = "retention test 30 days"
+	bucket_id = "_Default"
+
+	index_configs {
+		field_path 	= "jsonPayload.request.url"
+		type		= "%s"
+	}
+
+	index_configs {
+		field_path 	= "jsonPayload.response.status"
+		type		= "%s"
+	}
+}
+`, context), urlIndexType, statusIndexType)
+}
+
+func TestAccLoggingBucketConfigProject_indexConfigs(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"project_name":    "tf-test-" + acctest.RandString(t, 10),
+		"org_id":          envvar.GetTestOrgFromEnv(t),
+		"billing_account": envvar.GetTestBillingAccountFromEnv(t),
+		"bucket_id":       "tf-test-bucket-" + acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccLoggingBucketConfigProject_indexConfigs(context, "INDEX_TYPE_STRING", "INDEX_TYPE_STRING"),
+			},
+			{
+				ResourceName:            "google_logging_project_bucket_config.basic",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"project"},
+			},
+			{
+				Config: testAccLoggingBucketConfigProject_indexConfigs(context, "INDEX_TYPE_STRING", "INDEX_TYPE_INTEGER"),
+			},
+			{
+				ResourceName:            "google_logging_project_bucket_config.basic",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"project"},
+			},
+		},
+	})
+}
+
+func testAccLoggingBucketConfigProject_indexConfigs(context map[string]interface{}, urlIndexType, statusIndexType string) string {
+	return fmt.Sprintf(acctest.Nprintf(`
+
+resource "google_project" "default" {
+	project_id      = "%{project_name}"
+	name            = "%{project_name}"
+	org_id          = "%{org_id}"
+	billing_account = "%{billing_account}"
+}
+
+resource "google_logging_project_bucket_config" "basic" {
+	project        	= google_project.default.name
+	location       	= "us-east1"
+	retention_days 	= 30
+	description    	= "retention test 30 days"
+	bucket_id      	= "%{bucket_id}"
+
+	index_configs {
+		field_path 	= "jsonPayload.request.url"
+		type		= "%s"
+	}
+
+	index_configs {
+		field_path 	= "jsonPayload.response.status"
+		type		= "%s"
+	}
+}
+`, context), urlIndexType, statusIndexType)
+}
diff --git a/mmv1/third_party/terraform/services/logging/resource_logging_project_bucket_config.go b/mmv1/third_party/terraform/services/logging/resource_logging_project_bucket_config.go
index 0397e956f4da..a2d62b6de97f 100644
--- a/mmv1/third_party/terraform/services/logging/resource_logging_project_bucket_config.go
+++ b/mmv1/third_party/terraform/services/logging/resource_logging_project_bucket_config.go
@@ -106,6 +106,28 @@ See [Enabling CMEK for Logging Buckets](https://cloud.google.com/logging/docs/ro
 			},
 		},
 	},
+	"index_configs": {
+		Type:        schema.TypeSet,
+		MaxItems:    20,
+		Optional:    true,
+		Description: `A list of indexed fields and related configuration data.`,
+		Elem: &schema.Resource{
+			Schema: map[string]*schema.Schema{
+				"field_path": {
+					Type:        schema.TypeString,
+					Required:    true,
+					Description: `The LogEntry field path to index.`,
+				},
+				"type": {
+					Type:     schema.TypeString,
+					Required: true,
+					Description: `The type of data in this index
+Note that some paths are automatically indexed, and other paths are not eligible for indexing. See [indexing documentation]( https://cloud.google.com/logging/docs/view/advanced-queries#indexed-fields) for details.
+For example: jsonPayload.request.status`,
+				},
+			},
+		},
+	},
 }
 
 func projectBucketConfigID(d *schema.ResourceData, config *transport_tpg.Config) (string, error) {
@@ -192,6 +214,7 @@ func resourceLoggingProjectBucketConfigCreate(d *schema.ResourceData, meta inter
 	obj["retentionDays"] = d.Get("retention_days")
 	obj["analyticsEnabled"] = d.Get("enable_analytics")
 	obj["cmekSettings"] = expandCmekSettings(d.Get("cmek_settings"))
+	obj["indexConfigs"] = expandIndexConfigs(d.Get("index_configs"))
 
 	url, err := tpgresource.ReplaceVars(d, config, "{{LoggingBasePath}}projects/{{project}}/locations/{{location}}/buckets?bucketId={{bucket_id}}")
 	if err != nil {
@@ -282,6 +305,10 @@ func resourceLoggingProjectBucketConfigRead(d *schema.ResourceData, meta interfa
 		return fmt.Errorf("Error setting cmek_settings: %s", err)
 	}
 
+	if err := d.Set("index_configs", flattenIndexConfigs(res["indexConfigs"])); err != nil {
+		return fmt.Errorf("Error setting index_configs: %s", err)
+	}
+
 	return nil
 }
 
@@ -325,6 +352,8 @@ func resourceLoggingProjectBucketConfigUpdate(d *schema.ResourceData, meta inter
 	obj["retentionDays"] = d.Get("retention_days")
 	obj["description"] = d.Get("description")
 	obj["cmekSettings"] = expandCmekSettings(d.Get("cmek_settings"))
+	obj["indexConfigs"] = expandIndexConfigs(d.Get("index_configs"))
+
 	updateMask := []string{}
 	if d.HasChange("retention_days") {
 		updateMask = append(updateMask, "retentionDays")
@@ -335,6 +364,10 @@ func resourceLoggingProjectBucketConfigUpdate(d *schema.ResourceData, meta inter
 	if d.HasChange("cmek_settings") {
 		updateMask = append(updateMask, "cmekSettings")
 	}
+	if d.HasChange("index_configs") {
+		updateMask = append(updateMask, "indexConfigs")
+	}
+
 	url, err = transport_tpg.AddQueryParams(url, map[string]string{"updateMask": strings.Join(updateMask, ",")})
 	if err != nil {
 		return err
diff --git a/mmv1/third_party/terraform/services/logging/resource_logging_project_sink.go b/mmv1/third_party/terraform/services/logging/resource_logging_project_sink.go
index 5968089b847a..f58bd2bd642d 100644
--- a/mmv1/third_party/terraform/services/logging/resource_logging_project_sink.go
+++ b/mmv1/third_party/terraform/services/logging/resource_logging_project_sink.go
@@ -1,3 +1,5 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 package logging
 
 import (
@@ -36,8 +38,13 @@ func ResourceLoggingProjectSink() *schema.Resource {
 	schm.Schema["unique_writer_identity"] = &schema.Schema{
 		Type:        schema.TypeBool,
 		Optional:    true,
-		Default:     false,
-		Description: `Whether or not to create a unique identity associated with this sink. If false (the default), then the writer_identity used is serviceAccount:cloud-logs@system.gserviceaccount.com. If true, then a unique service account is created and used for this sink. If you wish to publish logs across projects, you must set unique_writer_identity to true.`,
+		Default:     true,
+		Description: `Whether or not to create a unique identity associated with this sink. If false (the legacy behavior), then the writer_identity used is serviceAccount:cloud-logs@system.gserviceaccount.com. If true (default), then a unique service account is created and used for this sink. If you wish to publish logs across projects, you must set unique_writer_identity to true.`,
+	}
+	schm.Schema["custom_writer_identity"] = &schema.Schema{
+		Type:        schema.TypeString,
+		Optional:    true,
+		Description: `A service account provided by the caller that will be used to write the log entries. The format must be serviceAccount:some@email. This field can only be specified if you are routing logs to a destination outside this sink's project. If not specified, a Logging service account will automatically be generated.`,
 	}
 	return schm
 }
@@ -56,8 +63,20 @@ func resourceLoggingProjectSinkCreate(d *schema.ResourceData, meta interface{})
 
 	id, sink := expandResourceLoggingSink(d, "projects", project)
 	uniqueWriterIdentity := d.Get("unique_writer_identity").(bool)
+	customWriterIdentity := d.Get("custom_writer_identity").(string)
+
+	projectSinkCreateRequest := config.NewLoggingClient(userAgent).Projects.Sinks.Create(id.parent(), sink)
+
+	// if custom-sa is specified, use it to write log and it requires uniqueWriterIdentity to be set as well
+	// otherwise set the uniqueWriter identity
+	if customWriterIdentity != "" {
+		projectSinkCreateRequest = projectSinkCreateRequest.UniqueWriterIdentity(uniqueWriterIdentity).CustomWriterIdentity(customWriterIdentity)
+	} else {
+		projectSinkCreateRequest = projectSinkCreateRequest.UniqueWriterIdentity(uniqueWriterIdentity)
+	}
+
+	_, err = projectSinkCreateRequest.Do()
 
-	_, err = config.NewLoggingClient(userAgent).Projects.Sinks.Create(id.parent(), sink).UniqueWriterIdentity(uniqueWriterIdentity).Do()
 	if err != nil {
 		return err
 	}
@@ -134,9 +153,20 @@ func resourceLoggingProjectSinkUpdate(d *schema.ResourceData, meta interface{})
 
 	sink, updateMask := expandResourceLoggingSinkForUpdate(d)
 	uniqueWriterIdentity := d.Get("unique_writer_identity").(bool)
+	customWriterIdentity := d.Get("custom_writer_identity").(string)
+
+	projectSinkUpdateRequest := config.NewLoggingClient(userAgent).Projects.Sinks.Patch(d.Id(), sink).UpdateMask(updateMask)
+
+	// if custom-sa is specified, use it to write log and it reqiures uniqueWriterIdentity to be set as well
+	// otherwise set the uniqueWriter identity
+	if customWriterIdentity != "" {
+		projectSinkUpdateRequest = projectSinkUpdateRequest.UniqueWriterIdentity(uniqueWriterIdentity).CustomWriterIdentity(customWriterIdentity)
+	} else {
+		projectSinkUpdateRequest = projectSinkUpdateRequest.UniqueWriterIdentity(uniqueWriterIdentity)
+	}
+
+	_, err = projectSinkUpdateRequest.Do()
 
-	_, err = config.NewLoggingClient(userAgent).Projects.Sinks.Patch(d.Id(), sink).
-		UpdateMask(updateMask).UniqueWriterIdentity(uniqueWriterIdentity).Do()
 	if err != nil {
 		return err
 	}
diff --git a/mmv1/third_party/terraform/services/logging/resource_logging_project_sink_test.go b/mmv1/third_party/terraform/services/logging/resource_logging_project_sink_test.go
index f2934f4d1573..d18000692673 100644
--- a/mmv1/third_party/terraform/services/logging/resource_logging_project_sink_test.go
+++ b/mmv1/third_party/terraform/services/logging/resource_logging_project_sink_test.go
@@ -142,6 +142,57 @@ func TestAccLoggingProjectSink_updatePreservesUniqueWriter(t *testing.T) {
 	})
 }
 
+func TestAccLoggingProjectSink_updatePreservesCustomWriter(t *testing.T) {
+	t.Parallel()
+
+	sinkName := "tf-test-sink-" + acctest.RandString(t, 10)
+	account := "tf-test-sink-sa" + acctest.RandString(t, 10)
+	accountUpdated := "tf-test-sink-sa" + acctest.RandString(t, 10)
+	testProject := envvar.GetTestProjectFromEnv()
+
+	// custom_writer_identity is write-only, and writer_dietity is an output only field
+	// verify that the value of writer_identity matches the expected custom_writer_identity.
+	expectedWriterIdentity := fmt.Sprintf("serviceAccount:%s@%s.iam.gserviceaccount.com", account, testProject)
+	expectedUpdatedWriterIdentity := fmt.Sprintf("serviceAccount:%s@%s.iam.gserviceaccount.com", accountUpdated, testProject)
+
+	org := envvar.GetTestOrgFromEnv(t)
+	billingId := envvar.GetTestBillingAccountFromEnv(t)
+	project := fmt.Sprintf("tf-test-%d", acctest.RandInt(t))
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckLoggingProjectSinkDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccLoggingProjectSink_customWriter(org, billingId, project, sinkName, account),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_logging_project_sink.custom_writer", "writer_identity", expectedWriterIdentity),
+				),
+			},
+			{
+				ResourceName:      "google_logging_project_sink.custom_writer",
+				ImportState:       true,
+				ImportStateVerify: true,
+				// Logging sink create API doesn't return this field in response
+				ImportStateVerifyIgnore: []string{"custom_writer_identity"},
+			},
+			{
+				Config: testAccLoggingProjectSink_customWriterUpdated(org, billingId, project, sinkName, accountUpdated),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("google_logging_project_sink.custom_writer", "writer_identity", expectedUpdatedWriterIdentity),
+				),
+			},
+			{
+				ResourceName:            "google_logging_project_sink.custom_writer",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"custom_writer_identity"},
+			},
+		},
+	})
+}
+
 func TestAccLoggingProjectSink_updateBigquerySink(t *testing.T) {
 	t.Parallel()
 
@@ -292,13 +343,11 @@ func testAccLoggingProjectSink_basic(name, project, bucketName string) string {
 resource "google_logging_project_sink" "basic" {
   name        = "%s"
   project     = "%s"
-  destination = "storage.googleapis.com/${google_storage_bucket.log-bucket.name}"
+  destination = "storage.googleapis.com/${google_storage_bucket.gcs-bucket.name}"
   filter      = "logName=\"projects/%s/logs/compute.googleapis.com%%2Factivity_log\" AND severity>=ERROR"
-
-  unique_writer_identity = false
 }
 
-resource "google_storage_bucket" "log-bucket" {
+resource "google_storage_bucket" "gcs-bucket" {
   name     = "%s"
   location = "US"
 }
@@ -310,14 +359,14 @@ func testAccLoggingProjectSink_described(name, project, bucketName string) strin
 resource "google_logging_project_sink" "described" {
   name        = "%s"
   project     = "%s"
-  destination = "storage.googleapis.com/${google_storage_bucket.log-bucket.name}"
+  destination = "storage.googleapis.com/${google_storage_bucket.gcs-bucket.name}"
   filter      = "logName=\"projects/%s/logs/compute.googleapis.com%%2Factivity_log\" AND severity>=ERROR"
   description = "this is a description for a project level logging sink"
-
+  
   unique_writer_identity = false
 }
 
-resource "google_storage_bucket" "log-bucket" {
+resource "google_storage_bucket" "gcs-bucket" {
   name     = "%s"
   location = "US"
 }
@@ -329,14 +378,14 @@ func testAccLoggingProjectSink_described_update(name, project, bucketName string
 resource "google_logging_project_sink" "described" {
   name        = "%s"
   project     = "%s"
-  destination = "storage.googleapis.com/${google_storage_bucket.log-bucket.name}"
+  destination = "storage.googleapis.com/${google_storage_bucket.gcs-bucket.name}"
   filter      = "logName=\"projects/%s/logs/compute.googleapis.com%%2Factivity_log\" AND severity>=ERROR"
   description = "description updated"
-
+  
   unique_writer_identity = true
 }
 
-resource "google_storage_bucket" "log-bucket" {
+resource "google_storage_bucket" "gcs-bucket" {
   name     = "%s"
   location = "US"
 }
@@ -348,14 +397,14 @@ func testAccLoggingProjectSink_disabled(name, project, bucketName string) string
 resource "google_logging_project_sink" "disabled" {
   name        = "%s"
   project     = "%s"
-  destination = "storage.googleapis.com/${google_storage_bucket.log-bucket.name}"
+  destination = "storage.googleapis.com/${google_storage_bucket.gcs-bucket.name}"
   filter      = "logName=\"projects/%s/logs/compute.googleapis.com%%2Factivity_log\" AND severity>=ERROR"
   disabled    = true
 
   unique_writer_identity = false
 }
 
-resource "google_storage_bucket" "log-bucket" {
+resource "google_storage_bucket" "gcs-bucket" {
   name     = "%s"
   location = "US"
 }
@@ -367,14 +416,14 @@ func testAccLoggingProjectSink_disabled_update(name, project, bucketName, disabl
 resource "google_logging_project_sink" "disabled" {
   name        = "%s"
   project     = "%s"
-  destination = "storage.googleapis.com/${google_storage_bucket.log-bucket.name}"
+  destination = "storage.googleapis.com/${google_storage_bucket.gcs-bucket.name}"
   filter      = "logName=\"projects/%s/logs/compute.googleapis.com%%2Factivity_log\" AND severity>=ERROR"
   disabled    = "%s"
 
   unique_writer_identity = true
 }
 
-resource "google_storage_bucket" "log-bucket" {
+resource "google_storage_bucket" "gcs-bucket" {
   name     = "%s"
   location = "US"
 }
@@ -385,13 +434,13 @@ func testAccLoggingProjectSink_uniqueWriter(name, bucketName string) string {
 	return fmt.Sprintf(`
 resource "google_logging_project_sink" "unique_writer" {
   name        = "%s"
-  destination = "storage.googleapis.com/${google_storage_bucket.log-bucket.name}"
+  destination = "storage.googleapis.com/${google_storage_bucket.gcs-bucket.name}"
   filter      = "logName=\"projects/%s/logs/compute.googleapis.com%%2Factivity_log\" AND severity>=ERROR"
 
   unique_writer_identity = true
 }
 
-resource "google_storage_bucket" "log-bucket" {
+resource "google_storage_bucket" "gcs-bucket" {
   name     = "%s"
   location = "US"
 }
@@ -402,25 +451,133 @@ func testAccLoggingProjectSink_uniqueWriterUpdated(name, bucketName string) stri
 	return fmt.Sprintf(`
 resource "google_logging_project_sink" "unique_writer" {
   name        = "%s"
-  destination = "storage.googleapis.com/${google_storage_bucket.log-bucket.name}"
+  destination = "storage.googleapis.com/${google_storage_bucket.gcs-bucket.name}"
   filter      = "logName=\"projects/%s/logs/compute.googleapis.com%%2Factivity_log\" AND severity>=WARNING"
 
   unique_writer_identity = true
 }
 
-resource "google_storage_bucket" "log-bucket" {
+resource "google_storage_bucket" "gcs-bucket" {
   name     = "%s"
   location = "US"
 }
 `, name, envvar.GetTestProjectFromEnv(), bucketName)
 }
 
+func testAccLoggingProjectSink_customWriter(org, billingId, project, name, serviceAccount string) string {
+	return fmt.Sprintf(`
+resource "google_project" "destination-project" {
+  project_id      = "%s"
+  name            = "%s"
+  org_id          = "%s"
+  billing_account = "%s"
+}	
+
+resource "google_logging_project_bucket_config" "destination-bucket" {
+  project    = google_project.destination-project.project_id
+  location  = "us-central1"
+  retention_days = 30
+  bucket_id = "shared-bucket"
+}
+
+resource "google_service_account" "test-account1" {
+  account_id   = "%s"
+  display_name = "Log Sink Custom WriterIdentity Testing Account"
+}
+
+resource "google_project_iam_member" "custom-sa-logbucket-binding" {
+  project = google_project.destination-project.project_id
+  role   = "roles/logging.bucketWriter"
+  member = "serviceAccount:${google_service_account.test-account1.email}"
+}
+
+data "google_project" "testing_project" {
+  project_id = "%s"
+}
+
+locals {
+  project_number = data.google_project.testing_project.number
+}
+
+resource "google_service_account_iam_member" "loggingsa-customsa-binding" {
+  service_account_id = google_service_account.test-account1.name
+  role   = "roles/iam.serviceAccountTokenCreator"
+  member = "serviceAccount:service-${local.project_number}@gcp-sa-logging.iam.gserviceaccount.com"
+}
+
+resource "google_logging_project_sink" "custom_writer" {
+  name        = "%s"
+  destination = "logging.googleapis.com/projects/${google_project.destination-project.project_id}/locations/us-central1/buckets/shared-bucket"
+  filter      = "logName=\"projects/%s/logs/compute.googleapis.com%%2Factivity_log\" AND severity>=ERROR"
+
+  unique_writer_identity = true
+  custom_writer_identity = "serviceAccount:${google_service_account.test-account1.email}"
+
+  depends_on = [google_logging_project_bucket_config.destination-bucket]
+}
+`, project, project, org, billingId, serviceAccount, envvar.GetTestProjectFromEnv(), name, envvar.GetTestProjectFromEnv())
+}
+
+func testAccLoggingProjectSink_customWriterUpdated(org, billingId, project, name, serviceAccount string) string {
+	return fmt.Sprintf(`
+resource "google_project" "destination-project" {
+  project_id      = "%s"
+  name            = "%s"
+  org_id          = "%s"
+  billing_account = "%s"
+}	
+
+resource "google_logging_project_bucket_config" "destination-bucket" {
+  project    = google_project.destination-project.project_id
+  location  = "us-central1"
+  retention_days = 30
+  bucket_id = "shared-bucket"
+}
+
+resource "google_service_account" "test-account2" {
+  account_id   = "%s"
+  display_name = "Updated Log Sink Custom WriterIdentity Testing Account"
+}
+
+resource "google_project_iam_member" "custom-sa-logbucket-binding" {
+  project = google_project.destination-project.project_id
+  role   = "roles/logging.bucketWriter"
+  member = "serviceAccount:${google_service_account.test-account2.email}"
+}
+
+data "google_project" "testing_project" {
+  project_id = "%s"
+}
+
+locals {
+  project_number = data.google_project.testing_project.number
+}
+
+resource "google_service_account_iam_member" "loggingsa-customsa-binding" {
+  service_account_id = google_service_account.test-account2.name
+  role   = "roles/iam.serviceAccountTokenCreator"
+  member = "serviceAccount:service-${local.project_number}@gcp-sa-logging.iam.gserviceaccount.com"
+}
+
+resource "google_logging_project_sink" "custom_writer" {
+  name        = "%s"
+  destination = "logging.googleapis.com/projects/${google_project.destination-project.project_id}/locations/us-central1/buckets/shared-bucket"
+  filter      = "logName=\"projects/%s/logs/compute.googleapis.com%%2Factivity_log\" AND severity>=WARNING"
+
+  unique_writer_identity = true
+  custom_writer_identity = "serviceAccount:${google_service_account.test-account2.email}"
+
+  depends_on = [google_logging_project_bucket_config.destination-bucket]
+}
+`, project, project, org, billingId, serviceAccount, envvar.GetTestProjectFromEnv(), name, envvar.GetTestProjectFromEnv())
+}
+
 func testAccLoggingProjectSink_heredoc(name, project, bucketName string) string {
 	return fmt.Sprintf(`
 resource "google_logging_project_sink" "heredoc" {
   name        = "%s"
   project     = "%s"
-  destination = "storage.googleapis.com/${google_storage_bucket.log-bucket.name}"
+  destination = "storage.googleapis.com/${google_storage_bucket.gcs-bucket.name}"
 
   filter = <<EOS
 
@@ -433,7 +590,7 @@ EOS
   unique_writer_identity = false
 }
 
-resource "google_storage_bucket" "log-bucket" {
+resource "google_storage_bucket" "gcs-bucket" {
   name     = "%s"
   location = "US"
 }
@@ -444,7 +601,7 @@ func testAccLoggingProjectSink_bigquery_before(sinkName, bqDatasetID string) str
 	return fmt.Sprintf(`
 resource "google_logging_project_sink" "bigquery" {
   name        = "%s"
-  destination = "bigquery.googleapis.com/projects/%s/datasets/${google_bigquery_dataset.logging_sink.dataset_id}"
+  destination = "bigquery.googleapis.com/projects/%s/datasets/${google_bigquery_dataset.bq_dataset.dataset_id}"
   filter      = "logName=\"projects/%s/logs/compute.googleapis.com%%2Factivity_log\" AND severity>=ERROR"
 
   unique_writer_identity = true
@@ -454,7 +611,7 @@ resource "google_logging_project_sink" "bigquery" {
   }
 }
 
-resource "google_bigquery_dataset" "logging_sink" {
+resource "google_bigquery_dataset" "bq_dataset" {
   dataset_id  = "%s"
   description = "Log sink (generated during acc test of terraform-provider-google(-beta))."
 }
@@ -465,13 +622,13 @@ func testAccLoggingProjectSink_bigquery_after(sinkName, bqDatasetID string) stri
 	return fmt.Sprintf(`
 resource "google_logging_project_sink" "bigquery" {
   name        = "%s"
-  destination = "bigquery.googleapis.com/projects/%s/datasets/${google_bigquery_dataset.logging_sink.dataset_id}"
+  destination = "bigquery.googleapis.com/projects/%s/datasets/${google_bigquery_dataset.bq_dataset.dataset_id}"
   filter      = "logName=\"projects/%s/logs/compute.googleapis.com%%2Factivity_log\" AND severity>=WARNING"
 
   unique_writer_identity = true
 }
 
-resource "google_bigquery_dataset" "logging_sink" {
+resource "google_bigquery_dataset" "bq_dataset" {
   dataset_id  = "%s"
   description = "Log sink (generated during acc test of terraform-provider-google(-beta))."
 }
@@ -495,8 +652,6 @@ resource "google_logging_project_sink" "loggingbucket" {
     description = "test-2"
     filter = "resource.type = k8s_container"
   }
-
-  unique_writer_identity = true
 }
 
 `, name, project, project)
diff --git a/mmv1/third_party/terraform/services/memcache/resource_memcache_instance_test.go b/mmv1/third_party/terraform/services/memcache/resource_memcache_instance_test.go
index 51b78686511e..585f0f114603 100644
--- a/mmv1/third_party/terraform/services/memcache/resource_memcache_instance_test.go
+++ b/mmv1/third_party/terraform/services/memcache/resource_memcache_instance_test.go
@@ -13,7 +13,7 @@ func TestAccMemcacheInstance_update(t *testing.T) {
 
 	prefix := fmt.Sprintf("%d", acctest.RandInt(t))
 	name := fmt.Sprintf("tf-test-%s", prefix)
-	network := acctest.BootstrapSharedTestNetwork(t, "memcache-instance-update")
+	network := acctest.BootstrapSharedServiceNetworkingConnection(t, "memcache-instance-update-1")
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -42,24 +42,10 @@ func TestAccMemcacheInstance_update(t *testing.T) {
 
 func testAccMemcacheInstance_update(prefix, name, network string) string {
 	return fmt.Sprintf(`
-resource "google_compute_global_address" "service_range" {
-  name          = "tf-test%s"
-  purpose       = "VPC_PEERING"
-  address_type  = "INTERNAL"
-  prefix_length = 16
-  network       = data.google_compute_network.memcache_network.id
-}
-
-resource "google_service_networking_connection" "private_service_connection" {
-  network                 = data.google_compute_network.memcache_network.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.service_range.name]
-}
-
 resource "google_memcache_instance" "test" {
   name = "%s"
   region = "us-central1"
-  authorized_network = google_service_networking_connection.private_service_connection.network
+  authorized_network = data.google_compute_network.memcache_network.id
 
   node_config {
     cpu_count      = 1
@@ -78,29 +64,15 @@ resource "google_memcache_instance" "test" {
 data "google_compute_network" "memcache_network" {
   name = "%s"
 }
-`, prefix, name, network)
+`, name, network)
 }
 
 func testAccMemcacheInstance_update2(prefix, name, network string) string {
 	return fmt.Sprintf(`
-resource "google_compute_global_address" "service_range" {
-  name          = "tf-test%s"
-  purpose       = "VPC_PEERING"
-  address_type  = "INTERNAL"
-  prefix_length = 16
-  network       = data.google_compute_network.memcache_network.id
-}
-
-resource "google_service_networking_connection" "private_service_connection" {
-  network                 = data.google_compute_network.memcache_network.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.service_range.name]
-}
-
 resource "google_memcache_instance" "test" {
   name = "%s"
   region = "us-central1"
-  authorized_network = google_service_networking_connection.private_service_connection.network
+  authorized_network = data.google_compute_network.memcache_network.id
 
   node_config {
     cpu_count      = 1
@@ -119,5 +91,5 @@ resource "google_memcache_instance" "test" {
 data "google_compute_network" "memcache_network" {
   name = "%s"
 }
-`, prefix, name, network)
+`, name, network)
 }
diff --git a/mmv1/third_party/terraform/services/monitoring/resource_monitoring_alert_policy_test.go b/mmv1/third_party/terraform/services/monitoring/resource_monitoring_alert_policy_test.go
index fa773fb57d52..857d40c00b24 100644
--- a/mmv1/third_party/terraform/services/monitoring/resource_monitoring_alert_policy_test.go
+++ b/mmv1/third_party/terraform/services/monitoring/resource_monitoring_alert_policy_test.go
@@ -322,6 +322,7 @@ resource "google_monitoring_alert_policy" "full" {
   documentation {
     content   = "test content"
     mime_type = "text/markdown"
+    subject = "test subject"
   }
 }
 `, alertName, conditionName1, conditionName2)
@@ -350,6 +351,7 @@ resource "google_monitoring_alert_policy" "mql" {
   documentation {
     content   = "test content"
     mime_type = "text/markdown"
+    subject = "test subject"
   }
 }
 `, alertName, conditionName)
@@ -383,6 +385,7 @@ resource "google_monitoring_alert_policy" "log" {
   documentation {
     content   = "test content"
     mime_type = "text/markdown"
+    subject = "test subject"    
   }
 }
 `, alertName, conditionName)
@@ -441,6 +444,7 @@ resource "google_monitoring_alert_policy" "promql" {
   documentation {
     content   = "test content"
     mime_type = "text/markdown"
+    subject = "test subject"
   }
 }
 `, alertName, conditionName)
diff --git a/mmv1/third_party/terraform/services/monitoring/resource_monitoring_dashboard.go b/mmv1/third_party/terraform/services/monitoring/resource_monitoring_dashboard.go
index b0a06770882d..458b5cfbb1c8 100644
--- a/mmv1/third_party/terraform/services/monitoring/resource_monitoring_dashboard.go
+++ b/mmv1/third_party/terraform/services/monitoring/resource_monitoring_dashboard.go
@@ -8,29 +8,51 @@ import (
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 )
 
-func monitoringDashboardDiffSuppress(k, old, new string, d *schema.ResourceData) bool {
-	computedFields := []string{"etag", "name"}
+// This recursive function takes an old map and a new map and is intended to remove the computed keys
+// from the old json string (stored in state) so that it doesn't show a diff if it's not defined in the
+// new map's json string (defined in config)
+func removeComputedKeys(old map[string]interface{}, new map[string]interface{}) map[string]interface{} {
+	for k, v := range old {
+		if _, ok := old[k]; ok && new[k] == nil {
+			delete(old, k)
+			continue
+		}
+
+		if reflect.ValueOf(v).Kind() == reflect.Map {
+			old[k] = removeComputedKeys(v.(map[string]interface{}), new[k].(map[string]interface{}))
+			continue
+		}
+
+		if reflect.ValueOf(v).Kind() == reflect.Slice {
+			for i, j := range v.([]interface{}) {
+				if reflect.ValueOf(j).Kind() == reflect.Map {
+					old[k].([]interface{})[i] = removeComputedKeys(j.(map[string]interface{}), new[k].([]interface{})[i].(map[string]interface{}))
+				}
+			}
+			continue
+		}
+	}
 
+	return old
+}
+
+func monitoringDashboardDiffSuppress(k, old, new string, d *schema.ResourceData) bool {
 	oldMap, err := structure.ExpandJsonFromString(old)
 	if err != nil {
 		return false
 	}
-
 	newMap, err := structure.ExpandJsonFromString(new)
 	if err != nil {
 		return false
 	}
 
-	for _, f := range computedFields {
-		delete(oldMap, f)
-		delete(newMap, f)
-	}
-
+	oldMap = removeComputedKeys(oldMap, newMap)
 	return reflect.DeepEqual(oldMap, newMap)
 }
 
@@ -51,6 +73,10 @@ func ResourceMonitoringDashboard() *schema.Resource {
 			Delete: schema.DefaultTimeout(4 * time.Minute),
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+		),
+
 		Schema: map[string]*schema.Schema{
 			"dashboard_json": {
 				Type:             schema.TypeString,
diff --git a/mmv1/third_party/terraform/services/monitoring/resource_monitoring_dashboard_test.go b/mmv1/third_party/terraform/services/monitoring/resource_monitoring_dashboard_test.go
index 1f8caaa86759..5c1a5d28afd7 100644
--- a/mmv1/third_party/terraform/services/monitoring/resource_monitoring_dashboard_test.go
+++ b/mmv1/third_party/terraform/services/monitoring/resource_monitoring_dashboard_test.go
@@ -83,8 +83,6 @@ func TestAccMonitoringDashboard_rowLayout(t *testing.T) {
 }
 
 func TestAccMonitoringDashboard_update(t *testing.T) {
-	// TODO: Fix requires a breaking change https://github.com/hashicorp/terraform-provider-google/issues/9976
-	t.Skip()
 	t.Parallel()
 
 	acctest.VcrTest(t, resource.TestCase{
diff --git a/mmv1/third_party/terraform/services/monitoring/resource_monitoring_metric_descriptor_test.go b/mmv1/third_party/terraform/services/monitoring/resource_monitoring_metric_descriptor_test.go
index a34cc21f54db..53ad4f17478e 100644
--- a/mmv1/third_party/terraform/services/monitoring/resource_monitoring_metric_descriptor_test.go
+++ b/mmv1/third_party/terraform/services/monitoring/resource_monitoring_metric_descriptor_test.go
@@ -9,8 +9,6 @@ import (
 )
 
 func TestAccMonitoringMetricDescriptor_update(t *testing.T) {
-	// TODO: Fix requires a breaking change https://github.com/hashicorp/terraform-provider-google/issues/12139
-	t.Skip()
 
 	t.Parallel()
 	acctest.VcrTest(t, resource.TestCase{
@@ -19,8 +17,7 @@ func TestAccMonitoringMetricDescriptor_update(t *testing.T) {
 		CheckDestroy:             testAccCheckMonitoringMetricDescriptorDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccMonitoringMetricDescriptor_update("key1", "STRING",
-					"description1", "30s", "30s"),
+				Config: testAccMonitoringMetricDescriptor_update("30s", "30s"),
 			},
 			{
 				ResourceName:            "google_monitoring_metric_descriptor.basic",
@@ -29,8 +26,7 @@ func TestAccMonitoringMetricDescriptor_update(t *testing.T) {
 				ImportStateVerifyIgnore: []string{"metadata", "launch_stage"},
 			},
 			{
-				Config: testAccMonitoringMetricDescriptor_update("key2", "INT64",
-					"description2", "60s", "60s"),
+				Config: testAccMonitoringMetricDescriptor_update("60s", "60s"),
 			},
 			{
 				ResourceName:            "google_monitoring_metric_descriptor.basic",
@@ -42,8 +38,7 @@ func TestAccMonitoringMetricDescriptor_update(t *testing.T) {
 	})
 }
 
-func testAccMonitoringMetricDescriptor_update(key, valueType, description,
-	samplePeriod, ingestDelay string) string {
+func testAccMonitoringMetricDescriptor_update(samplePeriod, ingestDelay string) string {
 	return fmt.Sprintf(`
 resource "google_monitoring_metric_descriptor" "basic" {
 	description = "Daily sales records from all branch stores."
@@ -53,9 +48,9 @@ resource "google_monitoring_metric_descriptor" "basic" {
 	value_type = "DOUBLE"
 	unit = "{USD}"
 	labels {
-		key = "%s"
-		value_type = "%s"
-		description = "%s"
+		key = "key"
+		value_type = "STRING"
+		description = "description"
 	}
 	launch_stage = "BETA"
 	metadata {
@@ -63,6 +58,6 @@ resource "google_monitoring_metric_descriptor" "basic" {
 		ingest_delay = "%s"
 	}
 }
-`, key, valueType, description, samplePeriod, ingestDelay,
+`, samplePeriod, ingestDelay,
 	)
 }
diff --git a/mmv1/third_party/terraform/services/networkconnectivity/resource_network_connectivity_service_connection_policies_test.go b/mmv1/third_party/terraform/services/networkconnectivity/resource_network_connectivity_service_connection_policies_test.go
index 6344f761585b..0894eeab35d5 100644
--- a/mmv1/third_party/terraform/services/networkconnectivity/resource_network_connectivity_service_connection_policies_test.go
+++ b/mmv1/third_party/terraform/services/networkconnectivity/resource_network_connectivity_service_connection_policies_test.go
@@ -27,25 +27,28 @@ func TestAccNetworkConnectivityServiceConnectionPolicy_update(t *testing.T) {
 				Config: testAccNetworkConnectivityServiceConnectionPolicy_basic(context),
 			},
 			{
-				ResourceName:      "google_network_connectivity_service_connection_policy.default",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_network_connectivity_service_connection_policy.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccNetworkConnectivityServiceConnectionPolicy_update(context),
 			},
 			{
-				ResourceName:      "google_network_connectivity_service_connection_policy.default",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_network_connectivity_service_connection_policy.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccNetworkConnectivityServiceConnectionPolicy_basic(context),
 			},
 			{
-				ResourceName:      "google_network_connectivity_service_connection_policy.default",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_network_connectivity_service_connection_policy.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/networksecurity/network_security_address_group_operation.go.erb b/mmv1/third_party/terraform/services/networksecurity/network_security_address_group_operation.go.erb
deleted file mode 100644
index 2f98e9be1803..000000000000
--- a/mmv1/third_party/terraform/services/networksecurity/network_security_address_group_operation.go.erb
+++ /dev/null
@@ -1,14 +0,0 @@
-<% autogen_exception -%>
-package networksecurity
-
-import (
-	"time"
-
-	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
-)
-
-// NetworkSecurityAddressGroupOperationWaitTime is specific for address group resource because the only difference is that it does not need project param.
-func NetworkSecurityAddressGroupOperationWaitTime(config *transport_tpg.Config, op map[string]interface{}, activity, userAgent string, timeout time.Duration) error {
-	// project is not necessary for this operation.
-	return NetworkSecurityOperationWaitTime(config, op, "", activity, userAgent, timeout)
-}
diff --git a/mmv1/third_party/terraform/services/networksecurity/resource_network_security_address_group_test.go b/mmv1/third_party/terraform/services/networksecurity/resource_network_security_address_group_test.go
index 106848e01d65..15d35521d161 100644
--- a/mmv1/third_party/terraform/services/networksecurity/resource_network_security_address_group_test.go
+++ b/mmv1/third_party/terraform/services/networksecurity/resource_network_security_address_group_test.go
@@ -24,17 +24,19 @@ func TestAccNetworkSecurityAddressGroups_update(t *testing.T) {
 				Config: testAccNetworkSecurityAddressGroups_basic(addressGroupsName, projectName),
 			},
 			{
-				ResourceName:      "google_network_security_address_group.foobar",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_network_security_address_group.foobar",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccNetworkSecurityAddressGroups_update(addressGroupsName, projectName),
 			},
 			{
-				ResourceName:      "google_network_security_address_group.foobar",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_network_security_address_group.foobar",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/networksecurity/resource_network_security_authorization_policy_test.go.erb b/mmv1/third_party/terraform/services/networksecurity/resource_network_security_authorization_policy_test.go.erb
index b4993f5084d8..2d1c4af67055 100644
--- a/mmv1/third_party/terraform/services/networksecurity/resource_network_security_authorization_policy_test.go.erb
+++ b/mmv1/third_party/terraform/services/networksecurity/resource_network_security_authorization_policy_test.go.erb
@@ -27,6 +27,7 @@ func TestAccNetworkSecurityAuthorizationPolicy_update(t *testing.T) {
 				ResourceName:      "google_network_security_authorization_policy.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccNetworkSecurityAuthorizationPolicy_update(authorizationPolicyName),
@@ -35,6 +36,7 @@ func TestAccNetworkSecurityAuthorizationPolicy_update(t *testing.T) {
 				ResourceName:      "google_network_security_authorization_policy.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/networksecurity/resource_network_security_client_tls_policy_test.go.erb b/mmv1/third_party/terraform/services/networksecurity/resource_network_security_client_tls_policy_test.go.erb
index 67de18513d1d..d91d8e030965 100644
--- a/mmv1/third_party/terraform/services/networksecurity/resource_network_security_client_tls_policy_test.go.erb
+++ b/mmv1/third_party/terraform/services/networksecurity/resource_network_security_client_tls_policy_test.go.erb
@@ -21,12 +21,13 @@ func TestAccNetworkSecurityClientTlsPolicy_update(t *testing.T) {
 		CheckDestroy: testAccCheckNetworkSecurityClientTlsPolicyDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-                               Config: testAccNetworkSecurityClientTlsPolicy_basic(clientTlsPolicyName),
+				Config: testAccNetworkSecurityClientTlsPolicy_basic(clientTlsPolicyName),
 			},
 			{
 				ResourceName:      "google_network_security_client_tls_policy.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccNetworkSecurityClientTlsPolicy_update(clientTlsPolicyName),
@@ -35,6 +36,7 @@ func TestAccNetworkSecurityClientTlsPolicy_update(t *testing.T) {
 				ResourceName:      "google_network_security_client_tls_policy.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/networksecurity/resource_network_security_server_tls_policy_test.go.erb b/mmv1/third_party/terraform/services/networksecurity/resource_network_security_server_tls_policy_test.go.erb
index 00f7755bf324..f1000f4665de 100644
--- a/mmv1/third_party/terraform/services/networksecurity/resource_network_security_server_tls_policy_test.go.erb
+++ b/mmv1/third_party/terraform/services/networksecurity/resource_network_security_server_tls_policy_test.go.erb
@@ -27,6 +27,7 @@ func TestAccNetworkSecurityServerTlsPolicy_update(t *testing.T) {
 				ResourceName:      "google_network_security_server_tls_policy.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccNetworkSecurityServerTlsPolicy_update(serverTlsPolicyName),
@@ -35,6 +36,7 @@ func TestAccNetworkSecurityServerTlsPolicy_update(t *testing.T) {
 				ResourceName:      "google_network_security_server_tls_policy.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/networksecurity/test-fixtures/ca_cert.pem b/mmv1/third_party/terraform/services/networksecurity/test-fixtures/ca_cert.pem
new file mode 100644
index 000000000000..ac1e36438259
--- /dev/null
+++ b/mmv1/third_party/terraform/services/networksecurity/test-fixtures/ca_cert.pem
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDDzCCAfegAwIBAgIUDOiCLH9QNMMYnjPZVf4VwO9blsEwDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAwwLZXhhbXBsZS5jb20wIBcNMjIwODI0MDg0MDUxWhgPMzAy
+MTEyMjUwODQwNTFaMBYxFDASBgNVBAMMC2V4YW1wbGUuY29tMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvOT925GG4lKV9HvAHsbecMhGPAqjhVRC26iZ
+UJC8oSWOu95lWJSX5ZhbiF6Nz192wDGV/VAh3Lxj8RYtcn75eDxQKTcKouDld+To
+CGIStPFWbR6rbysLuZqFVEXVOTvp2QIegInfrvnGC4j7Qpic7zrFB9HzJx+0HpeE
+yO4gkdzJfEK/gMmolUgJrKX59o+0+Rj+Jq3EtcQxL1fVBVJSx0NvpoR1eYpnHMr/
+rJKZkUUZ2xE86hrtpiP6OEYQTi00rmf4GnZF5QfGGD0xuoQXtR7Tu+XhKibXIhxc
+D4RzPLX1QS040PXvmMPLDb4YlUQ6V3Rs42JDvkkDwIMXZvn8awIDAQABo1MwUTAd
+BgNVHQ4EFgQURuo1CCZZAUv7xi02f2nC5tRbf18wHwYDVR0jBBgwFoAURuo1CCZZ
+AUv7xi02f2nC5tRbf18wDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC
+AQEAqx3tDxurnYr9EUPhF5/LlDPYM+VI7EgrKdRnuIqUlZI0tm3vOGME0te6dBTC
+YLNaHLW3m/4Tm4M2eg0Kpz6CxJfn3109G31dCi0xwzSDHf5TPUWvqIVhq5WRgMIf
+n8KYBlQSmqdJBRztUIQH/UPFnSbxymlS4s5qwDgTH5ag9EEBcnWsQ2LZjKi0eqve
+MaqAvvB+j8RGZzYY4re94bSJI42zIZ6nMWPtXwRuDc30xl/u+E0jWIgWbPwSd6Km
+3wnJnGiU2ezPGq3zEU+Rc39VVIFKQpciNeYuF3neHPJvYOf58qW2Z8s0VH0MR1x3
+3DoO/e30FIr9j+PRD+s5BPKF2A==
+-----END CERTIFICATE-----
diff --git a/mmv1/third_party/terraform/services/networkservices/resource_network_services_edge_cache_keyset_test.go b/mmv1/third_party/terraform/services/networkservices/resource_network_services_edge_cache_keyset_test.go
index f12e0cec4b04..56b1cd8bfcd3 100644
--- a/mmv1/third_party/terraform/services/networkservices/resource_network_services_edge_cache_keyset_test.go
+++ b/mmv1/third_party/terraform/services/networkservices/resource_network_services_edge_cache_keyset_test.go
@@ -26,7 +26,7 @@ func TestAccNetworkServicesEdgeCacheKeyset_update(t *testing.T) {
 				ResourceName:            "google_network_services_edge_cache_keyset.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name"},
+				ImportStateVerifyIgnore: []string{"name", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccNetworkServicesEdgeCacheKeyset_update(context),
@@ -35,7 +35,7 @@ func TestAccNetworkServicesEdgeCacheKeyset_update(t *testing.T) {
 				ResourceName:            "google_network_services_edge_cache_keyset.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name"},
+				ImportStateVerifyIgnore: []string{"name", "labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/networkservices/resource_network_services_edge_cache_origin_test.go b/mmv1/third_party/terraform/services/networkservices/resource_network_services_edge_cache_origin_test.go
index 9e68d59853d6..6ad86ecb883f 100644
--- a/mmv1/third_party/terraform/services/networkservices/resource_network_services_edge_cache_origin_test.go
+++ b/mmv1/third_party/terraform/services/networkservices/resource_network_services_edge_cache_origin_test.go
@@ -23,7 +23,7 @@ func TestAccNetworkServicesEdgeCacheOrigin_updateAndImport(t *testing.T) {
 				ResourceName:            "google_network_services_edge_cache_origin.instance",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name"},
+				ImportStateVerifyIgnore: []string{"name", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccNetworkServicesEdgeCacheOrigin_update_1(name),
@@ -32,7 +32,7 @@ func TestAccNetworkServicesEdgeCacheOrigin_updateAndImport(t *testing.T) {
 				ResourceName:            "google_network_services_edge_cache_origin.instance",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name"},
+				ImportStateVerifyIgnore: []string{"name", "labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/networkservices/resource_network_services_endpoint_policy_test.go.erb b/mmv1/third_party/terraform/services/networkservices/resource_network_services_endpoint_policy_test.go.erb
index 5ca9e8290821..3369b28dc114 100644
--- a/mmv1/third_party/terraform/services/networkservices/resource_network_services_endpoint_policy_test.go.erb
+++ b/mmv1/third_party/terraform/services/networkservices/resource_network_services_endpoint_policy_test.go.erb
@@ -27,6 +27,7 @@ func TestAccNetworkServicesEndpointPolicy_update(t *testing.T) {
 				ResourceName:      "google_network_services_endpoint_policy.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccNetworkServicesEndpointPolicy_update(endpointPolicyName),
@@ -35,6 +36,7 @@ func TestAccNetworkServicesEndpointPolicy_update(t *testing.T) {
 				ResourceName:      "google_network_services_endpoint_policy.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/networkservices/resource_network_services_gateway_test.go b/mmv1/third_party/terraform/services/networkservices/resource_network_services_gateway_test.go
index 9aae107edfc1..d572021996d1 100644
--- a/mmv1/third_party/terraform/services/networkservices/resource_network_services_gateway_test.go
+++ b/mmv1/third_party/terraform/services/networkservices/resource_network_services_gateway_test.go
@@ -23,17 +23,19 @@ func TestAccNetworkServicesGateway_update(t *testing.T) {
 				Config: testAccNetworkServicesGateway_basic(gatewayName),
 			},
 			{
-				ResourceName:      "google_network_services_gateway.foobar",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_network_services_gateway.foobar",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccNetworkServicesGateway_update(gatewayName),
 			},
 			{
-				ResourceName:      "google_network_services_gateway.foobar",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_network_services_gateway.foobar",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/networkservices/resource_network_services_grpc_route_test.go.erb b/mmv1/third_party/terraform/services/networkservices/resource_network_services_grpc_route_test.go.erb
index 3220d937b433..e2a10dd024e7 100644
--- a/mmv1/third_party/terraform/services/networkservices/resource_network_services_grpc_route_test.go.erb
+++ b/mmv1/third_party/terraform/services/networkservices/resource_network_services_grpc_route_test.go.erb
@@ -27,6 +27,7 @@ func TestAccNetworkServicesGrpcRoute_update(t *testing.T) {
 				ResourceName:      "google_network_services_grpc_route.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccNetworkServicesGrpcRoute_update(grpcRouteName),
@@ -35,6 +36,7 @@ func TestAccNetworkServicesGrpcRoute_update(t *testing.T) {
 				ResourceName:      "google_network_services_grpc_route.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/networkservices/resource_network_services_http_route_test.go.erb b/mmv1/third_party/terraform/services/networkservices/resource_network_services_http_route_test.go.erb
index f94075ec67ee..2f0c54530c64 100644
--- a/mmv1/third_party/terraform/services/networkservices/resource_network_services_http_route_test.go.erb
+++ b/mmv1/third_party/terraform/services/networkservices/resource_network_services_http_route_test.go.erb
@@ -27,6 +27,7 @@ func TestAccNetworkServicesHttpRoute_update(t *testing.T) {
 				ResourceName:      "google_network_services_http_route.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccNetworkServicesHttpRoute_update(httpRouteName),
@@ -35,6 +36,7 @@ func TestAccNetworkServicesHttpRoute_update(t *testing.T) {
 				ResourceName:      "google_network_services_http_route.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/networkservices/resource_network_services_mesh_test.go.erb b/mmv1/third_party/terraform/services/networkservices/resource_network_services_mesh_test.go.erb
index 240f5b94887e..87451e4ee1a0 100644
--- a/mmv1/third_party/terraform/services/networkservices/resource_network_services_mesh_test.go.erb
+++ b/mmv1/third_party/terraform/services/networkservices/resource_network_services_mesh_test.go.erb
@@ -27,6 +27,7 @@ func TestAccNetworkServicesMesh_update(t *testing.T) {
 				ResourceName:      "google_network_services_mesh.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccNetworkServicesMesh_update(meshName),
@@ -35,6 +36,7 @@ func TestAccNetworkServicesMesh_update(t *testing.T) {
 				ResourceName:      "google_network_services_mesh.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/networkservices/resource_network_services_tcp_route_test.go.erb b/mmv1/third_party/terraform/services/networkservices/resource_network_services_tcp_route_test.go.erb
index 0b7aa52cfc9e..27f545faed8a 100644
--- a/mmv1/third_party/terraform/services/networkservices/resource_network_services_tcp_route_test.go.erb
+++ b/mmv1/third_party/terraform/services/networkservices/resource_network_services_tcp_route_test.go.erb
@@ -23,12 +23,13 @@ func TestAccNetworkServicesTcpRoute_update(t *testing.T) {
 		CheckDestroy: testAccCheckNetworkServicesTcpRouteDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-  Config: testAccNetworkServicesTcpRoute_basic(tcpServiceName, tcpHealthCheckName, tcpRouteName),
+				Config: testAccNetworkServicesTcpRoute_basic(tcpServiceName, tcpHealthCheckName, tcpRouteName),
 			},
 			{
 				ResourceName:      "google_network_services_tcp_route.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccNetworkServicesTcpRoute_update(tcpServiceName, tcpHealthCheckName, tcpRouteName),
@@ -37,6 +38,7 @@ func TestAccNetworkServicesTcpRoute_update(t *testing.T) {
 				ResourceName:      "google_network_services_tcp_route.foobar",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/notebooks/resource_notebooks_instance_test.go.erb b/mmv1/third_party/terraform/services/notebooks/resource_notebooks_instance_test.go.erb
index 63857df18d57..705d632e51db 100644
--- a/mmv1/third_party/terraform/services/notebooks/resource_notebooks_instance_test.go.erb
+++ b/mmv1/third_party/terraform/services/notebooks/resource_notebooks_instance_test.go.erb
@@ -47,7 +47,7 @@ func TestAccNotebooksInstance_update(t *testing.T) {
 				ResourceName:            "google_notebooks_instance.instance",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"vm_image", "metadata"},
+				ImportStateVerifyIgnore: []string{"vm_image", "metadata", "update_time"},
 			},
 			{
 				Config: testAccNotebooksInstance_update(context, true),
@@ -56,7 +56,7 @@ func TestAccNotebooksInstance_update(t *testing.T) {
 				ResourceName:            "google_notebooks_instance.instance",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"vm_image", "metadata"},
+				ImportStateVerifyIgnore: []string{"vm_image", "metadata", "labels", "terraform_labels", "update_time"},
 			},
 			{
 				Config: testAccNotebooksInstance_update(context, false),
@@ -65,7 +65,7 @@ func TestAccNotebooksInstance_update(t *testing.T) {
 				ResourceName:            "google_notebooks_instance.instance",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"vm_image", "metadata"},
+				ImportStateVerifyIgnore: []string{"vm_image", "metadata", "labels", "terraform_labels", "update_time"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/orgpolicy/resource_org_policy_custom_constraint_test.go.erb b/mmv1/third_party/terraform/services/orgpolicy/resource_org_policy_custom_constraint_test.go.erb
index 1b39462b3709..346bc5f6e527 100644
--- a/mmv1/third_party/terraform/services/orgpolicy/resource_org_policy_custom_constraint_test.go.erb
+++ b/mmv1/third_party/terraform/services/orgpolicy/resource_org_policy_custom_constraint_test.go.erb
@@ -1,6 +1,5 @@
 <% autogen_exception -%>
 package orgpolicy_test
-<% unless version == 'ga' -%>
 
 import (
 	"testing"
@@ -77,4 +76,3 @@ resource "google_org_policy_custom_constraint" "constraint" {
 `, context)
 }
 
-<% end -%>
diff --git a/mmv1/third_party/terraform/services/osconfig/resource_os_config_os_policy_assignment.go b/mmv1/third_party/terraform/services/osconfig/resource_os_config_os_policy_assignment.go
index c3e8e143c89d..9ea349cdbce8 100644
--- a/mmv1/third_party/terraform/services/osconfig/resource_os_config_os_policy_assignment.go
+++ b/mmv1/third_party/terraform/services/osconfig/resource_os_config_os_policy_assignment.go
@@ -7,6 +7,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
@@ -30,6 +31,10 @@ func ResourceOSConfigOSPolicyAssignment() *schema.Resource {
 			Delete: schema.DefaultTimeout(20 * time.Minute),
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+		),
+
 		Schema: map[string]*schema.Schema{
 			"instance_filter": {
 				Type:        schema.TypeList,
diff --git a/mmv1/third_party/terraform/services/privateca/data_source_certificate_authority.go b/mmv1/third_party/terraform/services/privateca/data_source_certificate_authority.go
index 1c72eda30b86..062930dca191 100644
--- a/mmv1/third_party/terraform/services/privateca/data_source_certificate_authority.go
+++ b/mmv1/third_party/terraform/services/privateca/data_source_certificate_authority.go
@@ -45,6 +45,10 @@ func dataSourcePrivatecaCertificateAuthorityRead(d *schema.ResourceData, meta in
 		return err
 	}
 
+	if err := tpgresource.SetDataSourceLabels(d); err != nil {
+		return err
+	}
+
 	// pem_csr is only applicable for SUBORDINATE CertificateAuthorities when their state is AWAITING_USER_ACTIVATION
 	if d.Get("type") == "SUBORDINATE" && d.Get("state") == "AWAITING_USER_ACTIVATION" {
 		url, err := tpgresource.ReplaceVars(d, config, "{{PrivatecaBasePath}}projects/{{project}}/locations/{{location}}/caPools/{{pool}}/certificateAuthorities/{{certificate_authority_id}}:fetch")
@@ -73,7 +77,7 @@ func dataSourcePrivatecaCertificateAuthorityRead(d *schema.ResourceData, meta in
 			UserAgent: userAgent,
 		})
 		if err != nil {
-			return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("PrivatecaCertificateAuthority %q", d.Id()))
+			return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("PrivatecaCertificateAuthority %q", d.Id()), url)
 		}
 		if err := d.Set("pem_csr", res["pemCsr"]); err != nil {
 			return fmt.Errorf("Error fetching CertificateAuthority: %s", err)
diff --git a/mmv1/third_party/terraform/services/privateca/data_source_certificate_authority_test.go b/mmv1/third_party/terraform/services/privateca/data_source_certificate_authority_test.go
index 2a7cdfb4c2d1..e50ba6119073 100644
--- a/mmv1/third_party/terraform/services/privateca/data_source_certificate_authority_test.go
+++ b/mmv1/third_party/terraform/services/privateca/data_source_certificate_authority_test.go
@@ -81,6 +81,9 @@ resource "google_privateca_certificate_authority" "default" {
   key_spec {
     algorithm = "RSA_PKCS1_4096_SHA256"
   }
+  labels = {
+    my-label = "my-label-value"
+  }
 }
 
 data "google_privateca_certificate_authority" "default" {
diff --git a/mmv1/third_party/terraform/services/privateca/resource_privateca_ca_pool_test.go b/mmv1/third_party/terraform/services/privateca/resource_privateca_ca_pool_test.go
index b288d24fb7cb..8466df22a917 100644
--- a/mmv1/third_party/terraform/services/privateca/resource_privateca_ca_pool_test.go
+++ b/mmv1/third_party/terraform/services/privateca/resource_privateca_ca_pool_test.go
@@ -26,7 +26,7 @@ func TestAccPrivatecaCaPool_privatecaCapoolUpdate(t *testing.T) {
 				ResourceName:            "google_privateca_ca_pool.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name", "location"},
+				ImportStateVerifyIgnore: []string{"name", "location", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccPrivatecaCaPool_privatecaCapoolEnd(context),
@@ -35,7 +35,7 @@ func TestAccPrivatecaCaPool_privatecaCapoolUpdate(t *testing.T) {
 				ResourceName:            "google_privateca_ca_pool.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name", "location"},
+				ImportStateVerifyIgnore: []string{"name", "location", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccPrivatecaCaPool_privatecaCapoolStart(context),
@@ -44,7 +44,7 @@ func TestAccPrivatecaCaPool_privatecaCapoolUpdate(t *testing.T) {
 				ResourceName:            "google_privateca_ca_pool.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name", "location"},
+				ImportStateVerifyIgnore: []string{"name", "location", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -233,7 +233,7 @@ func TestAccPrivatecaCaPool_privatecaCapoolEmptyBaseline(t *testing.T) {
 				ResourceName:            "google_privateca_ca_pool.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name", "location"},
+				ImportStateVerifyIgnore: []string{"name", "location", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -297,7 +297,7 @@ func TestAccPrivatecaCaPool_privatecaCapoolEmptyPublishingOptions(t *testing.T)
 				ResourceName:            "google_privateca_ca_pool.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name", "location"},
+				ImportStateVerifyIgnore: []string{"name", "location", "labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/privateca/resource_privateca_certificate_authority_test.go b/mmv1/third_party/terraform/services/privateca/resource_privateca_certificate_authority_test.go
index b43ca328de94..44dafcc2edd9 100644
--- a/mmv1/third_party/terraform/services/privateca/resource_privateca_certificate_authority_test.go
+++ b/mmv1/third_party/terraform/services/privateca/resource_privateca_certificate_authority_test.go
@@ -34,7 +34,7 @@ func TestAccPrivatecaCertificateAuthority_privatecaCertificateAuthorityUpdate(t
 				ResourceName:            "google_privateca_certificate_authority.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"ignore_active_certificates_on_deletion", "location", "certificate_authority_id", "pool", "deletion_protection", "skip_grace_period"},
+				ImportStateVerifyIgnore: []string{"ignore_active_certificates_on_deletion", "location", "certificate_authority_id", "pool", "deletion_protection", "skip_grace_period", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccPrivatecaCertificateAuthority_privatecaCertificateAuthorityEnd(context),
@@ -43,7 +43,7 @@ func TestAccPrivatecaCertificateAuthority_privatecaCertificateAuthorityUpdate(t
 				ResourceName:            "google_privateca_certificate_authority.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"ignore_active_certificates_on_deletion", "location", "certificate_authority_id", "pool", "deletion_protection", "skip_grace_period"},
+				ImportStateVerifyIgnore: []string{"ignore_active_certificates_on_deletion", "location", "certificate_authority_id", "pool", "deletion_protection", "skip_grace_period", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccPrivatecaCertificateAuthority_privatecaCertificateAuthorityBasicRoot(context),
@@ -52,7 +52,7 @@ func TestAccPrivatecaCertificateAuthority_privatecaCertificateAuthorityUpdate(t
 				ResourceName:            "google_privateca_certificate_authority.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"ignore_active_certificates_on_deletion", "location", "certificate_authority_id", "pool", "deletion_protection", "skip_grace_period"},
+				ImportStateVerifyIgnore: []string{"ignore_active_certificates_on_deletion", "location", "certificate_authority_id", "pool", "deletion_protection", "skip_grace_period", "labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/privateca/resource_privateca_certificate_test.go b/mmv1/third_party/terraform/services/privateca/resource_privateca_certificate_test.go
index 0e955d5ed745..e6c0c5f76c36 100644
--- a/mmv1/third_party/terraform/services/privateca/resource_privateca_certificate_test.go
+++ b/mmv1/third_party/terraform/services/privateca/resource_privateca_certificate_test.go
@@ -36,7 +36,7 @@ func TestAccPrivatecaCertificate_privatecaCertificateUpdate(t *testing.T) {
 				ResourceName:            "google_privateca_certificate.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"pool", "name", "location", "certificate_authority"},
+				ImportStateVerifyIgnore: []string{"pool", "name", "location", "certificate_authority", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccPrivatecaCertificate_privatecaCertificateStart(context),
diff --git a/mmv1/third_party/terraform/services/pubsub/data_source_pubsub_subscription.go b/mmv1/third_party/terraform/services/pubsub/data_source_pubsub_subscription.go
index 745315ad39fd..dde9618c8327 100644
--- a/mmv1/third_party/terraform/services/pubsub/data_source_pubsub_subscription.go
+++ b/mmv1/third_party/terraform/services/pubsub/data_source_pubsub_subscription.go
@@ -28,5 +28,17 @@ func dataSourceGooglePubsubSubscriptionRead(d *schema.ResourceData, meta interfa
 		return fmt.Errorf("Error constructing id: %s", err)
 	}
 	d.SetId(id)
-	return resourcePubsubSubscriptionRead(d, meta)
+	err = resourcePubsubSubscriptionRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if err := tpgresource.SetDataSourceLabels(d); err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/pubsub/data_source_pubsub_subscription_test.go b/mmv1/third_party/terraform/services/pubsub/data_source_pubsub_subscription_test.go
index a5c976e9241e..ffe48a0bae3a 100644
--- a/mmv1/third_party/terraform/services/pubsub/data_source_pubsub_subscription_test.go
+++ b/mmv1/third_party/terraform/services/pubsub/data_source_pubsub_subscription_test.go
@@ -60,6 +60,9 @@ resource "google_pubsub_topic" "foo" {
 resource "google_pubsub_subscription" "foo" {
   name     = "tf-test-pubsub-subscription-%{random_suffix}"
   topic    = google_pubsub_topic.foo.name
+  labels   = {
+    my-label = "my-label-value"
+  }
 }
 
 data "google_pubsub_subscription" "foo" {
diff --git a/mmv1/third_party/terraform/services/pubsub/data_source_pubsub_topic.go b/mmv1/third_party/terraform/services/pubsub/data_source_pubsub_topic.go
index 9e0fbb909b11..a813bc152dca 100644
--- a/mmv1/third_party/terraform/services/pubsub/data_source_pubsub_topic.go
+++ b/mmv1/third_party/terraform/services/pubsub/data_source_pubsub_topic.go
@@ -28,5 +28,17 @@ func dataSourceGooglePubsubTopicRead(d *schema.ResourceData, meta interface{}) e
 		return fmt.Errorf("Error constructing id: %s", err)
 	}
 	d.SetId(id)
-	return resourcePubsubTopicRead(d, meta)
+	err = resourcePubsubTopicRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if err := tpgresource.SetDataSourceLabels(d); err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/pubsub/data_source_pubsub_topic_test.go b/mmv1/third_party/terraform/services/pubsub/data_source_pubsub_topic_test.go
index b5f6efa8504c..e3b4614d1ca6 100644
--- a/mmv1/third_party/terraform/services/pubsub/data_source_pubsub_topic_test.go
+++ b/mmv1/third_party/terraform/services/pubsub/data_source_pubsub_topic_test.go
@@ -55,6 +55,9 @@ func testAccDataSourceGooglePubsubTopic_basic(context map[string]interface{}) st
 	return acctest.Nprintf(`
 resource "google_pubsub_topic" "foo" {
   name     = "tf-test-pubsub-%{random_suffix}"
+  labels   = {
+    my-label = "my-label-value"
+  }
 }
 
 data "google_pubsub_topic" "foo" {
diff --git a/mmv1/third_party/terraform/services/pubsub/resource_pubsub_schema_test.go b/mmv1/third_party/terraform/services/pubsub/resource_pubsub_schema_test.go
index abd7ad5a212e..68b193d71afd 100644
--- a/mmv1/third_party/terraform/services/pubsub/resource_pubsub_schema_test.go
+++ b/mmv1/third_party/terraform/services/pubsub/resource_pubsub_schema_test.go
@@ -48,17 +48,6 @@ func testAccPubsubSchema_basic(schema string) string {
 		type = "PROTOCOL_BUFFER"
 		definition = "syntax = \"proto3\";\nmessage Results {\nstring message_request = 1;\nstring message_response = 2;\n}"
 	}
-
-	# Need to introduce delay for updates in order for tests to complete
-	# successfully due to caching effects.
-	resource "time_sleep" "wait_121_seconds" {
-		create_duration = "121s"
-		lifecycle {
-			replace_triggered_by = [
-				google_pubsub_schema.foo
-			]
-		}
-	}
 `, schema)
 }
 
@@ -69,16 +58,5 @@ func testAccPubsubSchema_updated(schema string) string {
 		type = "PROTOCOL_BUFFER"
 		definition = "syntax = \"proto3\";\nmessage Results {\nstring message_request = 1;\nstring message_response = 2;\nstring timestamp_request = 3;\n}"
 	}
-
-	# Need to introduce delay for updates in order for tests to complete
-	# successfully due to caching effects.
-	resource "time_sleep" "wait_121_seconds" {
-		create_duration = "121s"
-		lifecycle {
-			replace_triggered_by = [
-				google_pubsub_schema.foo
-			]
-		}
-	}
 `, schema)
 }
diff --git a/mmv1/third_party/terraform/services/pubsub/resource_pubsub_subscription_test.go b/mmv1/third_party/terraform/services/pubsub/resource_pubsub_subscription_test.go
index 5ac29b2b44b3..19f15a66fd45 100644
--- a/mmv1/third_party/terraform/services/pubsub/resource_pubsub_subscription_test.go
+++ b/mmv1/third_party/terraform/services/pubsub/resource_pubsub_subscription_test.go
@@ -51,10 +51,11 @@ func TestAccPubsubSubscription_basic(t *testing.T) {
 				Config: testAccPubsubSubscription_basic(topic, subscription, "bar", 20, false),
 			},
 			{
-				ResourceName:      "google_pubsub_subscription.foo",
-				ImportStateId:     subscription,
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_pubsub_subscription.foo",
+				ImportStateId:           subscription,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -75,19 +76,21 @@ func TestAccPubsubSubscription_update(t *testing.T) {
 				Config: testAccPubsubSubscription_basic(topic, subscriptionShort, "bar", 20, false),
 			},
 			{
-				ResourceName:      "google_pubsub_subscription.foo",
-				ImportStateId:     subscriptionShort,
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_pubsub_subscription.foo",
+				ImportStateId:           subscriptionShort,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccPubsubSubscription_basic(topic, subscriptionShort, "baz", 30, true),
 			},
 			{
-				ResourceName:      "google_pubsub_subscription.foo",
-				ImportStateId:     subscriptionShort,
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_pubsub_subscription.foo",
+				ImportStateId:           subscriptionShort,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/pubsub/resource_pubsub_topic_test.go b/mmv1/third_party/terraform/services/pubsub/resource_pubsub_topic_test.go
index 059eee101f5f..b5f13d882c1f 100644
--- a/mmv1/third_party/terraform/services/pubsub/resource_pubsub_topic_test.go
+++ b/mmv1/third_party/terraform/services/pubsub/resource_pubsub_topic_test.go
@@ -22,19 +22,21 @@ func TestAccPubsubTopic_update(t *testing.T) {
 				Config: testAccPubsubTopic_update(topic, "foo", "bar"),
 			},
 			{
-				ResourceName:      "google_pubsub_topic.foo",
-				ImportStateId:     topic,
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_pubsub_topic.foo",
+				ImportStateId:           topic,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccPubsubTopic_updateWithRegion(topic, "wibble", "wobble", "us-central1"),
 			},
 			{
-				ResourceName:      "google_pubsub_topic.foo",
-				ImportStateId:     topic,
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_pubsub_topic.foo",
+				ImportStateId:           topic,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -101,6 +103,43 @@ func TestAccPubsubTopic_schema(t *testing.T) {
 	})
 }
 
+func TestAccPubsubTopic_migration(t *testing.T) {
+	acctest.SkipIfVcr(t)
+	t.Parallel()
+
+	topic := fmt.Sprintf("tf-test-topic-%s", acctest.RandString(t, 10))
+
+	oldVersion := map[string]resource.ExternalProvider{
+		"google": {
+			VersionConstraint: "4.84.0", // a version that doesn't separate user defined labels and system labels
+			Source:            "registry.terraform.io/hashicorp/google",
+		},
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:     func() { acctest.AccTestPreCheck(t) },
+		CheckDestroy: testAccCheckPubsubTopicDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config:            testAccPubsubTopic_update(topic, "foo", "bar"),
+				ExternalProviders: oldVersion,
+			},
+			{
+				Config:                   testAccPubsubTopic_update(topic, "foo", "bar"),
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+			},
+			{
+				ResourceName:             "google_pubsub_topic.foo",
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+				ImportStateId:            topic,
+				ImportState:              true,
+				ImportStateVerify:        true,
+				ImportStateVerifyIgnore:  []string{"labels", "terraform_labels"},
+			},
+		},
+	})
+}
+
 func testAccPubsubTopic_update(topic, key, value string) string {
 	return fmt.Sprintf(`
 resource "google_pubsub_topic" "foo" {
diff --git a/mmv1/third_party/terraform/services/redis/data_source_redis_instance.go b/mmv1/third_party/terraform/services/redis/data_source_redis_instance.go
index b3da20ecba44..1d16a177a860 100644
--- a/mmv1/third_party/terraform/services/redis/data_source_redis_instance.go
+++ b/mmv1/third_party/terraform/services/redis/data_source_redis_instance.go
@@ -1,6 +1,8 @@
 package redis
 
 import (
+	"fmt"
+
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
@@ -29,5 +31,17 @@ func dataSourceGoogleRedisInstanceRead(d *schema.ResourceData, meta interface{})
 	}
 	d.SetId(id)
 
-	return resourceRedisInstanceRead(d, meta)
+	err = resourceRedisInstanceRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if err := tpgresource.SetDataSourceLabels(d); err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/redis/data_source_redis_instance_test.go b/mmv1/third_party/terraform/services/redis/data_source_redis_instance_test.go
index 0c03762b0021..35942e513aec 100644
--- a/mmv1/third_party/terraform/services/redis/data_source_redis_instance_test.go
+++ b/mmv1/third_party/terraform/services/redis/data_source_redis_instance_test.go
@@ -30,6 +30,10 @@ func testAccRedisInstanceDatasourceConfig(suffix string) string {
 resource "google_redis_instance" "redis" {
   name               = "redis-test-%s"
   memory_size_gb     = 1
+
+  labels   = {
+    my-label = "my-label-value"
+  }
 }
 
 data "google_redis_instance" "redis" {
diff --git a/mmv1/third_party/terraform/services/redis/resource_redis_cluster_test.go.erb b/mmv1/third_party/terraform/services/redis/resource_redis_cluster_test.go.erb
index 105025ed90d1..b84720d92321 100644
--- a/mmv1/third_party/terraform/services/redis/resource_redis_cluster_test.go.erb
+++ b/mmv1/third_party/terraform/services/redis/resource_redis_cluster_test.go.erb
@@ -45,6 +45,20 @@ func TestAccRedisCluster_updateReplicaCount(t *testing.T) {
 				// clean up the resource
 				Config: createOrUpdateRedisCluster(name /* replicaCount = */, 2 /* shardCount = */, 3, false),
 			},
+			{
+				// update replica count to 0
+				Config: createOrUpdateRedisCluster(name /* replicaCount = */, 0 /* shardCount = */, 3, true),
+			},
+			{
+				ResourceName:      "google_redis_cluster.test",
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"psc_configs"},
+			},
+			{
+				// clean up the resource
+				Config: createOrUpdateRedisCluster(name /* replicaCount = */, 0 /* shardCount = */, 3, false),
+			},
 		},
 	})
 }
diff --git a/mmv1/third_party/terraform/services/redis/resource_redis_instance_test.go b/mmv1/third_party/terraform/services/redis/resource_redis_instance_test.go
index f5f4e9fe8821..dd5579c54cf2 100644
--- a/mmv1/third_party/terraform/services/redis/resource_redis_instance_test.go
+++ b/mmv1/third_party/terraform/services/redis/resource_redis_instance_test.go
@@ -23,17 +23,19 @@ func TestAccRedisInstance_update(t *testing.T) {
 				Config: testAccRedisInstance_update(name, true),
 			},
 			{
-				ResourceName:      "google_redis_instance.test",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_redis_instance.test",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccRedisInstance_update2(name, true),
 			},
 			{
-				ResourceName:      "google_redis_instance.test",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_redis_instance.test",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccRedisInstance_update2(name, false),
diff --git a/mmv1/third_party/terraform/services/resourcemanager/data_source_google_folder.go b/mmv1/third_party/terraform/services/resourcemanager/data_source_google_folder.go
index fa3099bb8bd5..fb95137a83cc 100644
--- a/mmv1/third_party/terraform/services/resourcemanager/data_source_google_folder.go
+++ b/mmv1/third_party/terraform/services/resourcemanager/data_source_google_folder.go
@@ -61,13 +61,14 @@ func dataSourceFolderRead(d *schema.ResourceData, meta interface{}) error {
 		return err
 	}
 
-	d.SetId(canonicalFolderName(d.Get("folder").(string)))
+	id := canonicalFolderName(d.Get("folder").(string))
+	d.SetId(id)
 	if err := resourceGoogleFolderRead(d, meta); err != nil {
 		return err
 	}
 	// If resource doesn't exist, read will not set ID and we should return error.
 	if d.Id() == "" {
-		return nil
+		return fmt.Errorf("%s not found", id)
 	}
 
 	if v, ok := d.GetOk("lookup_organization"); ok && v.(bool) {
diff --git a/mmv1/third_party/terraform/services/resourcemanager/data_source_google_folder_organization_policy.go b/mmv1/third_party/terraform/services/resourcemanager/data_source_google_folder_organization_policy.go
index a0bbf3fbd779..aa7249c8e99b 100644
--- a/mmv1/third_party/terraform/services/resourcemanager/data_source_google_folder_organization_policy.go
+++ b/mmv1/third_party/terraform/services/resourcemanager/data_source_google_folder_organization_policy.go
@@ -22,7 +22,16 @@ func DataSourceGoogleFolderOrganizationPolicy() *schema.Resource {
 
 func datasourceGoogleFolderOrganizationPolicyRead(d *schema.ResourceData, meta interface{}) error {
 
-	d.SetId(fmt.Sprintf("%s/%s", d.Get("folder"), d.Get("constraint")))
+	id := fmt.Sprintf("%s/%s", d.Get("folder"), d.Get("constraint"))
+	d.SetId(id)
 
-	return resourceGoogleFolderOrganizationPolicyRead(d, meta)
+	err := resourceGoogleFolderOrganizationPolicyRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/resourcemanager/data_source_google_iam_role.go b/mmv1/third_party/terraform/services/resourcemanager/data_source_google_iam_role.go
index 83639d864e95..aad1818e1624 100644
--- a/mmv1/third_party/terraform/services/resourcemanager/data_source_google_iam_role.go
+++ b/mmv1/third_party/terraform/services/resourcemanager/data_source_google_iam_role.go
@@ -43,7 +43,7 @@ func dataSourceGoogleIamRoleRead(d *schema.ResourceData, meta interface{}) error
 	roleName := d.Get("name").(string)
 	role, err := config.NewIamClient(userAgent).Roles.Get(roleName).Do()
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("Error reading IAM Role %s: %s", roleName, err))
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("Error reading IAM Role %s: %s", roleName, err), roleName)
 	}
 
 	d.SetId(role.Name)
diff --git a/mmv1/third_party/terraform/services/resourcemanager/data_source_google_organization.go b/mmv1/third_party/terraform/services/resourcemanager/data_source_google_organization.go
index d600eebddaa9..294a1b652aef 100644
--- a/mmv1/third_party/terraform/services/resourcemanager/data_source_google_organization.go
+++ b/mmv1/third_party/terraform/services/resourcemanager/data_source_google_organization.go
@@ -103,7 +103,7 @@ func dataSourceOrganizationRead(d *schema.ResourceData, meta interface{}) error
 			Timeout: d.Timeout(schema.TimeoutRead),
 		})
 		if err != nil {
-			return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("Organization Not Found : %s", v))
+			return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("Organization Not Found : %s", v), canonicalOrganizationName(v.(string)))
 		}
 
 		organization = resp
diff --git a/mmv1/third_party/terraform/services/resourcemanager/data_source_google_project.go b/mmv1/third_party/terraform/services/resourcemanager/data_source_google_project.go
index 03584ed4b02a..d5cd9c738087 100644
--- a/mmv1/third_party/terraform/services/resourcemanager/data_source_google_project.go
+++ b/mmv1/third_party/terraform/services/resourcemanager/data_source_google_project.go
@@ -42,6 +42,10 @@ func datasourceGoogleProjectRead(d *schema.ResourceData, meta interface{}) error
 		return err
 	}
 
+	if err := tpgresource.SetDataSourceLabels(d); err != nil {
+		return err
+	}
+
 	if d.Id() == "" {
 		return fmt.Errorf("%s not found or not in ACTIVE state", id)
 	}
diff --git a/mmv1/third_party/terraform/services/resourcemanager/data_source_google_project_organization_policy.go b/mmv1/third_party/terraform/services/resourcemanager/data_source_google_project_organization_policy.go
index 597b51beb943..6aaa7d54dcfc 100644
--- a/mmv1/third_party/terraform/services/resourcemanager/data_source_google_project_organization_policy.go
+++ b/mmv1/third_party/terraform/services/resourcemanager/data_source_google_project_organization_policy.go
@@ -22,7 +22,16 @@ func DataSourceGoogleProjectOrganizationPolicy() *schema.Resource {
 
 func datasourceGoogleProjectOrganizationPolicyRead(d *schema.ResourceData, meta interface{}) error {
 
-	d.SetId(fmt.Sprintf("%s:%s", d.Get("project"), d.Get("constraint")))
+	id := fmt.Sprintf("%s:%s", d.Get("project"), d.Get("constraint"))
+	d.SetId(id)
 
-	return resourceGoogleProjectOrganizationPolicyRead(d, meta)
+	err := resourceGoogleProjectOrganizationPolicyRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/resourcemanager/data_source_google_project_service.go b/mmv1/third_party/terraform/services/resourcemanager/data_source_google_project_service.go
index d056b6489828..7bcaa985ca2d 100644
--- a/mmv1/third_party/terraform/services/resourcemanager/data_source_google_project_service.go
+++ b/mmv1/third_party/terraform/services/resourcemanager/data_source_google_project_service.go
@@ -28,5 +28,13 @@ func dataSourceGoogleProjectServiceRead(d *schema.ResourceData, meta interface{}
 		return fmt.Errorf("Error constructing id: %s", err)
 	}
 	d.SetId(id)
-	return resourceGoogleProjectServiceRead(d, meta)
+	err = resourceGoogleProjectServiceRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/resourcemanager/data_source_google_project_test.go b/mmv1/third_party/terraform/services/resourcemanager/data_source_google_project_test.go
index 033ce759d4fb..513be054caaa 100644
--- a/mmv1/third_party/terraform/services/resourcemanager/data_source_google_project_test.go
+++ b/mmv1/third_party/terraform/services/resourcemanager/data_source_google_project_test.go
@@ -41,6 +41,9 @@ resource "google_project" "project" {
   project_id = "%s"
   name       = "%s"
   org_id     = "%s"
+  labels = {
+    my-label = "my-label-value"
+  }
 }
 
 data "google_project" "project" {
diff --git a/mmv1/third_party/terraform/services/resourcemanager/data_source_google_service_account.go b/mmv1/third_party/terraform/services/resourcemanager/data_source_google_service_account.go
index c917c396dfbc..15b075a1e763 100644
--- a/mmv1/third_party/terraform/services/resourcemanager/data_source_google_service_account.go
+++ b/mmv1/third_party/terraform/services/resourcemanager/data_source_google_service_account.go
@@ -59,7 +59,7 @@ func dataSourceGoogleServiceAccountRead(d *schema.ResourceData, meta interface{}
 
 	sa, err := config.NewIamClient(userAgent).Projects.ServiceAccounts.Get(serviceAccountName).Do()
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("Service Account %q", serviceAccountName))
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("Service Account %q", serviceAccountName), serviceAccountName)
 	}
 
 	d.SetId(sa.Name)
diff --git a/mmv1/third_party/terraform/services/resourcemanager/data_source_google_service_account_key.go b/mmv1/third_party/terraform/services/resourcemanager/data_source_google_service_account_key.go
index d3ab027a8cf0..95b47a88cc79 100644
--- a/mmv1/third_party/terraform/services/resourcemanager/data_source_google_service_account_key.go
+++ b/mmv1/third_party/terraform/services/resourcemanager/data_source_google_service_account_key.go
@@ -66,7 +66,7 @@ func dataSourceGoogleServiceAccountKeyRead(d *schema.ResourceData, meta interfac
 	// Confirm the service account key exists
 	sak, err := config.NewIamClient(userAgent).Projects.ServiceAccounts.Keys.Get(keyName).PublicKeyType(publicKeyType).Do()
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("Service Account Key %q", keyName))
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("Service Account Key %q", keyName), keyName)
 	}
 
 	d.SetId(sak.Name)
diff --git a/mmv1/third_party/terraform/services/resourcemanager/resource_google_project.go b/mmv1/third_party/terraform/services/resourcemanager/resource_google_project.go
index cb88fc4c14f8..acf1db96fa56 100644
--- a/mmv1/third_party/terraform/services/resourcemanager/resource_google_project.go
+++ b/mmv1/third_party/terraform/services/resourcemanager/resource_google_project.go
@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"github.com/hashicorp/errwrap"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 
 	tpgcompute "github.com/hashicorp/terraform-provider-google/google/services/compute"
@@ -40,6 +41,10 @@ func ResourceGoogleProject() *schema.Resource {
 		Update: resourceGoogleProjectUpdate,
 		Delete: resourceGoogleProjectDelete,
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.SetLabelsDiff,
+		),
+
 		Importer: &schema.ResourceImporter{
 			State: resourceProjectImportState,
 		},
@@ -103,10 +108,27 @@ func ResourceGoogleProject() *schema.Resource {
 				Description: `The alphanumeric ID of the billing account this project belongs to. The user or service account performing this operation with Terraform must have Billing Account Administrator privileges (roles/billing.admin) in the organization. See Google Cloud Billing API Access Control for more details.`,
 			},
 			"labels": {
+				Type:     schema.TypeMap,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Description: `A set of key/value label pairs to assign to the project.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+			},
+
+			"terraform_labels": {
 				Type:        schema.TypeMap,
-				Optional:    true,
+				Computed:    true,
+				Description: `The combination of labels configured directly on the resource and default labels configured on the provider.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+			},
+
+			"effective_labels": {
+				Type:        schema.TypeMap,
+				Computed:    true,
+				Description: `All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.`,
 				Elem:        &schema.Schema{Type: schema.TypeString},
-				Description: `A set of key/value label pairs to assign to the project.`,
 			},
 		},
 		UseJSONNumber: true,
@@ -137,8 +159,8 @@ func resourceGoogleProjectCreate(d *schema.ResourceData, meta interface{}) error
 		return err
 	}
 
-	if _, ok := d.GetOk("labels"); ok {
-		project.Labels = tpgresource.ExpandLabels(d)
+	if _, ok := d.GetOk("effective_labels"); ok {
+		project.Labels = tpgresource.ExpandEffectiveLabels(d)
 	}
 
 	var op *cloudresourcemanager.Operation
@@ -286,9 +308,15 @@ func resourceGoogleProjectRead(d *schema.ResourceData, meta interface{}) error {
 	if err := d.Set("name", p.Name); err != nil {
 		return fmt.Errorf("Error setting name: %s", err)
 	}
-	if err := d.Set("labels", p.Labels); err != nil {
+	if err := tpgresource.SetLabels(p.Labels, d, "labels"); err != nil {
 		return fmt.Errorf("Error setting labels: %s", err)
 	}
+	if err := tpgresource.SetLabels(p.Labels, d, "terraform_labels"); err != nil {
+		return fmt.Errorf("Error setting terraform_labels: %s", err)
+	}
+	if err := d.Set("effective_labels", p.Labels); err != nil {
+		return fmt.Errorf("Error setting effective_labels: %s", err)
+	}
 
 	if p.Parent != nil {
 		switch p.Parent.Type {
@@ -431,8 +459,8 @@ func resourceGoogleProjectUpdate(d *schema.ResourceData, meta interface{}) error
 	}
 
 	// Project Labels have changed
-	if ok := d.HasChange("labels"); ok {
-		p.Labels = tpgresource.ExpandLabels(d)
+	if ok := d.HasChange("effective_labels"); ok {
+		p.Labels = tpgresource.ExpandEffectiveLabels(d)
 
 		// Do Update on project
 		if p, err = updateProject(config, d, project_name, userAgent, p); err != nil {
diff --git a/mmv1/third_party/terraform/services/resourcemanager/resource_google_project_iam_custom_role.go b/mmv1/third_party/terraform/services/resourcemanager/resource_google_project_iam_custom_role.go
index 121919258376..ef27f2aacb9a 100644
--- a/mmv1/third_party/terraform/services/resourcemanager/resource_google_project_iam_custom_role.go
+++ b/mmv1/third_party/terraform/services/resourcemanager/resource_google_project_iam_custom_role.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
@@ -23,6 +24,10 @@ func ResourceGoogleProjectIamCustomRole() *schema.Resource {
 			State: resourceGoogleProjectIamCustomRoleImport,
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+		),
+
 		Schema: map[string]*schema.Schema{
 			"role_id": {
 				Type:         schema.TypeString,
diff --git a/mmv1/third_party/terraform/services/resourcemanager/resource_google_project_service.go b/mmv1/third_party/terraform/services/resourcemanager/resource_google_project_service.go
index a24765e16f6d..94d5d4873e18 100644
--- a/mmv1/third_party/terraform/services/resourcemanager/resource_google_project_service.go
+++ b/mmv1/third_party/terraform/services/resourcemanager/resource_google_project_service.go
@@ -6,6 +6,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 
 	tpgserviceusage "github.com/hashicorp/terraform-provider-google/google/services/serviceusage"
@@ -93,6 +94,10 @@ func ResourceGoogleProjectService() *schema.Resource {
 			Delete: schema.DefaultTimeout(20 * time.Minute),
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+		),
+
 		Schema: map[string]*schema.Schema{
 			"service": {
 				Type:         schema.TypeString,
diff --git a/mmv1/third_party/terraform/services/resourcemanager/resource_google_project_service_test.go b/mmv1/third_party/terraform/services/resourcemanager/resource_google_project_service_test.go
index 7c0c49106796..0f11ad42f689 100644
--- a/mmv1/third_party/terraform/services/resourcemanager/resource_google_project_service_test.go
+++ b/mmv1/third_party/terraform/services/resourcemanager/resource_google_project_service_test.go
@@ -78,7 +78,7 @@ func TestAccProjectService_disableDependentServices(t *testing.T) {
 	org := envvar.GetTestOrgFromEnv(t)
 	billingId := envvar.GetTestBillingAccountFromEnv(t)
 	pid := fmt.Sprintf("tf-test-%d", acctest.RandInt(t))
-	services := []string{"cloudbuild.googleapis.com", "containerregistry.googleapis.com"}
+	services := []string{"bigquerystorage.googleapis.com", "bigquery.googleapis.com"}
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
diff --git a/mmv1/third_party/terraform/services/resourcemanager/resource_google_project_test.go b/mmv1/third_party/terraform/services/resourcemanager/resource_google_project_test.go
index 5bb17b86c28e..12489e663f6e 100644
--- a/mmv1/third_party/terraform/services/resourcemanager/resource_google_project_test.go
+++ b/mmv1/third_party/terraform/services/resourcemanager/resource_google_project_test.go
@@ -136,7 +136,7 @@ func TestAccProject_labels(t *testing.T) {
 				ResourceName:            "google_project.acceptance",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"skip_delete"},
+				ImportStateVerifyIgnore: []string{"skip_delete", "labels", "terraform_labels"},
 			},
 			// update project with labels
 			{
diff --git a/mmv1/third_party/terraform/services/resourcemanager/resource_google_service_account.go b/mmv1/third_party/terraform/services/resourcemanager/resource_google_service_account.go
index cb7113fea0aa..e2a9531732f3 100644
--- a/mmv1/third_party/terraform/services/resourcemanager/resource_google_service_account.go
+++ b/mmv1/third_party/terraform/services/resourcemanager/resource_google_service_account.go
@@ -9,6 +9,7 @@ import (
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 	"github.com/hashicorp/terraform-provider-google/google/verify"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"google.golang.org/api/iam/v1"
@@ -26,6 +27,9 @@ func ResourceGoogleServiceAccount() *schema.Resource {
 		Timeouts: &schema.ResourceTimeout{
 			Create: schema.DefaultTimeout(5 * time.Minute),
 		},
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+		),
 		Schema: map[string]*schema.Schema{
 			"email": {
 				Type:        schema.TypeString,
diff --git a/mmv1/third_party/terraform/services/resourcemanager/resource_project_service_identity.go.erb b/mmv1/third_party/terraform/services/resourcemanager/resource_project_service_identity.go.erb
index 9a22928cca5f..351fa637401c 100644
--- a/mmv1/third_party/terraform/services/resourcemanager/resource_project_service_identity.go.erb
+++ b/mmv1/third_party/terraform/services/resourcemanager/resource_project_service_identity.go.erb
@@ -11,6 +11,7 @@ import (
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 )
 
@@ -26,6 +27,10 @@ func ResourceProjectServiceIdentity() *schema.Resource {
 			Delete: schema.DefaultTimeout(20 * time.Minute),
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+		),
+
 		Schema: map[string]*schema.Schema{
 			"service": {
 				Type:     schema.TypeString,
diff --git a/mmv1/third_party/terraform/services/resourcemanager/resource_project_service_identity_test.go.erb b/mmv1/third_party/terraform/services/resourcemanager/resource_project_service_identity_test.go.erb
index 3b22e3f81ce9..2e2308058981 100644
--- a/mmv1/third_party/terraform/services/resourcemanager/resource_project_service_identity_test.go.erb
+++ b/mmv1/third_party/terraform/services/resourcemanager/resource_project_service_identity_test.go.erb
@@ -3,6 +3,8 @@ package resourcemanager_test
 
 <% unless version == 'ga' -%>
 import (
+	"fmt"
+	"strings"
 	"testing"
 	"github.com/hashicorp/terraform-provider-google/google/acctest"
 
@@ -19,6 +21,13 @@ func TestAccProjectServiceIdentity_basic(t *testing.T) {
 			{
 				Config: testGoogleProjectServiceIdentity_basic(),
 				Check: resource.ComposeTestCheckFunc(
+					// Email field for healthcare service account should be non-empty and contain at least an "@".
+					resource.TestCheckResourceAttrWith("google_project_service_identity.hc_sa", "email", func(value string) error {
+						if strings.Contains(value, "@") {
+							return nil
+						}
+						return fmt.Errorf("hc_sa service identity email value was %s, expected a valid email", value)
+					}),
 					// Email field for logging service identity will be empty for as long as
 					// `gcloud beta services identity create --service=logging.googleapis.com` doesn't return an email address
 					resource.TestCheckNoResourceAttr("google_project_service_identity.log_sa", "email"),
@@ -38,12 +47,6 @@ resource "google_project_service_identity" "hc_sa" {
   service = "healthcare.googleapis.com"
 }
 
-resource "google_project_iam_member" "hc_sa_bq_jobuser" {
-  project = data.google_project.project.project_id
-  role    = "roles/bigquery.jobUser"
-  member  = "serviceAccount:${google_project_service_identity.hc_sa.email}"
-}
-
 # Service which does NOT have email returned from service identity API
 # Email attribute will be null - correct as of 2022-12-13
 resource "google_project_service_identity" "log_sa" {
diff --git a/mmv1/third_party/terraform/services/runtimeconfig/data_source_runtimeconfig_config.go.erb b/mmv1/third_party/terraform/services/runtimeconfig/data_source_runtimeconfig_config.go.erb
index 1d2ae6c688e4..eca8279a8ae3 100644
--- a/mmv1/third_party/terraform/services/runtimeconfig/data_source_runtimeconfig_config.go.erb
+++ b/mmv1/third_party/terraform/services/runtimeconfig/data_source_runtimeconfig_config.go.erb
@@ -31,6 +31,14 @@ func dataSourceGoogleRuntimeconfigConfigRead(d *schema.ResourceData, meta interf
 		return fmt.Errorf("Error constructing id: %s", err)
 	}
 	d.SetId(id)
-	return resourceRuntimeconfigConfigRead(d, meta)
+	err = resourceRuntimeconfigConfigRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
 }
 <% end %>
diff --git a/mmv1/third_party/terraform/services/runtimeconfig/data_source_runtimeconfig_variable.go.erb b/mmv1/third_party/terraform/services/runtimeconfig/data_source_runtimeconfig_variable.go.erb
index 3d3538dca306..9531af6cda41 100644
--- a/mmv1/third_party/terraform/services/runtimeconfig/data_source_runtimeconfig_variable.go.erb
+++ b/mmv1/third_party/terraform/services/runtimeconfig/data_source_runtimeconfig_variable.go.erb
@@ -33,7 +33,15 @@ func dataSourceGoogleRuntimeconfigVariableRead(d *schema.ResourceData, meta inte
 		return fmt.Errorf("Error constructing id: %s", err)
 	}
 	d.SetId(id)
-	return resourceRuntimeconfigVariableRead(d, meta)
+	err = resourceRuntimeconfigVariableRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
 }
 
 <% end -%>
diff --git a/mmv1/third_party/terraform/services/runtimeconfig/resource_runtimeconfig_config.go.erb b/mmv1/third_party/terraform/services/runtimeconfig/resource_runtimeconfig_config.go.erb
index 273ec7dc010b..f0d1aa31a902 100644
--- a/mmv1/third_party/terraform/services/runtimeconfig/resource_runtimeconfig_config.go.erb
+++ b/mmv1/third_party/terraform/services/runtimeconfig/resource_runtimeconfig_config.go.erb
@@ -10,6 +10,7 @@ import (
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 	"github.com/hashicorp/terraform-provider-google/google/verify"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	runtimeconfig "google.golang.org/api/runtimeconfig/v1beta1"
 )
@@ -27,6 +28,10 @@ func ResourceRuntimeconfigConfig() *schema.Resource {
 			State: resourceRuntimeconfigConfigImport,
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+		),
+
 		Schema: map[string]*schema.Schema{
 			"name": {
 				Type:         schema.TypeString,
diff --git a/mmv1/third_party/terraform/services/runtimeconfig/resource_runtimeconfig_variable.go.erb b/mmv1/third_party/terraform/services/runtimeconfig/resource_runtimeconfig_variable.go.erb
index fbabc5d7ee00..01c98fc45724 100644
--- a/mmv1/third_party/terraform/services/runtimeconfig/resource_runtimeconfig_variable.go.erb
+++ b/mmv1/third_party/terraform/services/runtimeconfig/resource_runtimeconfig_variable.go.erb
@@ -9,6 +9,7 @@ import (
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	runtimeconfig "google.golang.org/api/runtimeconfig/v1beta1"
 )
@@ -24,6 +25,10 @@ func ResourceRuntimeconfigVariable() *schema.Resource {
 			State: resourceRuntimeconfigVariableImport,
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+		),
+
 		Schema: map[string]*schema.Schema{
 			"name": {
 				Type:        schema.TypeString,
diff --git a/mmv1/third_party/terraform/services/secretmanager/data_source_secret_manager_secret.go b/mmv1/third_party/terraform/services/secretmanager/data_source_secret_manager_secret.go
index 6f424b7cd691..007bd1e2a8f1 100644
--- a/mmv1/third_party/terraform/services/secretmanager/data_source_secret_manager_secret.go
+++ b/mmv1/third_party/terraform/services/secretmanager/data_source_secret_manager_secret.go
@@ -26,5 +26,21 @@ func dataSourceSecretManagerSecretRead(d *schema.ResourceData, meta interface{})
 		return fmt.Errorf("Error constructing id: %s", err)
 	}
 	d.SetId(id)
-	return resourceSecretManagerSecretRead(d, meta)
+	err = resourceSecretManagerSecretRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if err := tpgresource.SetDataSourceLabels(d); err != nil {
+		return err
+	}
+
+	if err := tpgresource.SetDataSourceAnnotations(d); err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/secretmanager/data_source_secret_manager_secret_test.go b/mmv1/third_party/terraform/services/secretmanager/data_source_secret_manager_secret_test.go
index 413f69d98c7e..d175df4012a8 100644
--- a/mmv1/third_party/terraform/services/secretmanager/data_source_secret_manager_secret_test.go
+++ b/mmv1/third_party/terraform/services/secretmanager/data_source_secret_manager_secret_test.go
@@ -22,7 +22,11 @@ func TestAccDataSourceSecretManagerSecret_basic(t *testing.T) {
 			{
 				Config: testAccDataSourceSecretManagerSecret_basic(context),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckDataSourceStateMatchesResourceState("data.google_secret_manager_secret.foo", "google_secret_manager_secret.bar"),
+					acctest.CheckDataSourceStateMatchesResourceStateWithIgnores(
+						"data.google_secret_manager_secret.foo",
+						"google_secret_manager_secret.bar",
+						map[string]struct{}{"zone": {}},
+					),
 				),
 			},
 		},
@@ -38,6 +42,10 @@ resource "google_secret_manager_secret" "bar" {
     label = "my-label"
   }
 
+  annotations = {
+    annotation = "my-annotation"
+  }
+
   replication {
     user_managed {
       replicas {
diff --git a/mmv1/third_party/terraform/services/secretmanager/data_source_secret_manager_secret_version_access_test.go b/mmv1/third_party/terraform/services/secretmanager/data_source_secret_manager_secret_version_access_test.go
index 68dbc8b2bba5..5cce384fb01f 100644
--- a/mmv1/third_party/terraform/services/secretmanager/data_source_secret_manager_secret_version_access_test.go
+++ b/mmv1/third_party/terraform/services/secretmanager/data_source_secret_manager_secret_version_access_test.go
@@ -82,7 +82,7 @@ resource "google_secret_manager_secret" "secret-basic" {
     label = "my-label"
   }
   replication {
-    automatic = true
+    auto {}
   }
 }
 
@@ -112,7 +112,7 @@ resource "google_secret_manager_secret" "secret-basic" {
     label = "my-label"
   }
   replication {
-    automatic = true
+    auto {}
   }
 }
 
diff --git a/mmv1/third_party/terraform/services/secretmanager/data_source_secret_manager_secret_version_test.go b/mmv1/third_party/terraform/services/secretmanager/data_source_secret_manager_secret_version_test.go
index a63c713c05dd..835e0b2e37a0 100644
--- a/mmv1/third_party/terraform/services/secretmanager/data_source_secret_manager_secret_version_test.go
+++ b/mmv1/third_party/terraform/services/secretmanager/data_source_secret_manager_secret_version_test.go
@@ -82,7 +82,7 @@ resource "google_secret_manager_secret" "secret-basic" {
     label = "my-label"
   }
   replication {
-    automatic = true
+    auto {}
   }
 }
 
@@ -112,7 +112,7 @@ resource "google_secret_manager_secret" "secret-basic" {
     label = "my-label"
   }
   replication {
-    automatic = true
+    auto {}
   }
 }
 
diff --git a/mmv1/third_party/terraform/services/secretmanager/data_source_secret_manager_secrets.go b/mmv1/third_party/terraform/services/secretmanager/data_source_secret_manager_secrets.go
new file mode 100644
index 000000000000..877f9ed4b253
--- /dev/null
+++ b/mmv1/third_party/terraform/services/secretmanager/data_source_secret_manager_secrets.go
@@ -0,0 +1,167 @@
+package secretmanager
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
+)
+
+func DataSourceSecretManagerSecrets() *schema.Resource {
+
+	dsSchema := tpgresource.DatasourceSchemaFromResourceSchema(ResourceSecretManagerSecret().Schema)
+
+	return &schema.Resource{
+		Read: dataSourceSecretManagerSecretsRead,
+		Schema: map[string]*schema.Schema{
+			"project": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+			"filter": {
+				Type: schema.TypeString,
+				Description: `Filter string, adhering to the rules in List-operation filtering (https://cloud.google.com/secret-manager/docs/filtering).
+List only secrets matching the filter. If filter is empty, all secrets are listed.`,
+				Optional: true,
+			},
+			"secrets": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: dsSchema,
+				},
+			},
+		},
+	}
+}
+
+func dataSourceSecretManagerSecretsRead(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*transport_tpg.Config)
+	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
+	if err != nil {
+		return err
+	}
+
+	url, err := tpgresource.ReplaceVars(d, config, "{{SecretManagerBasePath}}projects/{{project}}/secrets")
+	if err != nil {
+		return err
+	}
+
+	filter, has_filter := d.GetOk("filter")
+
+	if has_filter {
+		url, err = transport_tpg.AddQueryParams(url, map[string]string{"filter": filter.(string)})
+		if err != nil {
+			return err
+		}
+	}
+
+	billingProject := ""
+
+	project, err := tpgresource.GetProject(d, config)
+	if err != nil {
+		return fmt.Errorf("Error fetching project for Secret: %s", err)
+	}
+	billingProject = project
+
+	// err == nil indicates that the billing_project value was found
+	if bp, err := tpgresource.GetBillingProject(d, config); err == nil {
+		billingProject = bp
+	}
+
+	// To handle the pagination locally
+	allSecrets := make([]interface{}, 0)
+	token := ""
+	for paginate := true; paginate; {
+		if token != "" {
+			url, err = transport_tpg.AddQueryParams(url, map[string]string{"pageToken": token})
+			if err != nil {
+				return err
+			}
+		}
+		secrets, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+			Config:    config,
+			Method:    "GET",
+			Project:   billingProject,
+			RawURL:    url,
+			UserAgent: userAgent,
+		})
+		if err != nil {
+			return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("SecretManagerSecrets %q", d.Id()))
+		}
+		secretsInterface := secrets["secrets"]
+		if secretsInterface == nil {
+			break
+		}
+		allSecrets = append(allSecrets, secretsInterface.([]interface{})...)
+		tokenInterface := secrets["nextPageToken"]
+		if tokenInterface == nil {
+			paginate = false
+		} else {
+			paginate = true
+			token = tokenInterface.(string)
+		}
+	}
+
+	if err := d.Set("secrets", flattenSecretManagerSecretsSecrets(allSecrets, d, config)); err != nil {
+		return fmt.Errorf("error setting secrets: %s", err)
+	}
+
+	if err := d.Set("project", project); err != nil {
+		return fmt.Errorf("error setting project: %s", err)
+	}
+
+	if err := d.Set("filter", filter); err != nil {
+		return fmt.Errorf("error setting filter: %s", err)
+	}
+
+	// Store the ID now
+	id, err := tpgresource.ReplaceVars(d, config, "projects/{{project}}/secrets")
+	if err != nil {
+		return fmt.Errorf("Error constructing id: %s", err)
+	}
+	if has_filter {
+		id += "/filter=" + filter.(string)
+	}
+	d.SetId(id)
+
+	return nil
+}
+
+func flattenSecretManagerSecretsSecrets(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	if v == nil {
+		return v
+	}
+	l := v.([]interface{})
+	transformed := make([]interface{}, 0, len(l))
+	for _, raw := range l {
+		original := raw.(map[string]interface{})
+		if len(original) < 1 {
+			// Do not include empty json objects coming back from the api
+			continue
+		}
+		transformed = append(transformed, map[string]interface{}{
+			"replication":     flattenSecretManagerSecretReplication(original["replication"], d, config),
+			"annotations":     flattenSecretManagerSecretAnnotations(original["annotations"], d, config),
+			"expire_time":     flattenSecretManagerSecretExpireTime(original["expireTime"], d, config),
+			"labels":          flattenSecretManagerSecretLabels(original["labels"], d, config),
+			"rotation":        flattenSecretManagerSecretRotation(original["rotation"], d, config),
+			"topics":          flattenSecretManagerSecretTopics(original["topics"], d, config),
+			"version_aliases": flattenSecretManagerSecretVersionAliases(original["versionAliases"], d, config),
+			"create_time":     flattenSecretManagerSecretCreateTime(original["createTime"], d, config),
+			"name":            flattenSecretManagerSecretName(original["name"], d, config),
+			"project":         getDataFromName(original["name"], 1),
+			"secret_id":       getDataFromName(original["name"], 3),
+		})
+	}
+	return transformed
+}
+
+func getDataFromName(v interface{}, part int) string {
+	name := v.(string)
+	split := strings.Split(name, "/")
+	return split[part]
+}
diff --git a/mmv1/third_party/terraform/services/secretmanager/data_source_secret_manager_secrets_test.go b/mmv1/third_party/terraform/services/secretmanager/data_source_secret_manager_secrets_test.go
new file mode 100644
index 000000000000..cb57c7688334
--- /dev/null
+++ b/mmv1/third_party/terraform/services/secretmanager/data_source_secret_manager_secrets_test.go
@@ -0,0 +1,243 @@
+package secretmanager_test
+
+import (
+	"errors"
+	"fmt"
+	"strconv"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+)
+
+func TestAccDataSourceSecretManagerSecrets_basic(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckSecretManagerSecretDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDataSourceSecretManagerSecrets_basic(context),
+				Check: resource.ComposeTestCheckFunc(
+					checkListDataSourceStateMatchesResourceStateWithIgnores(
+						"data.google_secret_manager_secrets.foo",
+						"google_secret_manager_secret.foo",
+						map[string]struct{}{
+							"id":      {},
+							"project": {},
+						},
+					),
+				),
+			},
+		},
+	})
+}
+
+func testAccDataSourceSecretManagerSecrets_basic(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_secret_manager_secret" "foo" {
+  secret_id = "tf-test-secret-%{random_suffix}"
+
+  replication {
+    user_managed {
+      replicas {
+        location = "us-central1"
+      }
+    }
+  }
+}
+
+data "google_secret_manager_secrets" "foo" {
+  depends_on = [
+    google_secret_manager_secret.foo
+  ]
+}
+`, context)
+}
+
+func TestAccDataSourceSecretManagerSecrets_filter(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckSecretManagerSecretDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDataSourceSecretManagerSecrets_filter(context),
+				Check: resource.ComposeTestCheckFunc(
+					checkListDataSourceStateMatchesResourceStateWithIgnoresForAppliedFilter(
+						"data.google_secret_manager_secrets.foo",
+						"google_secret_manager_secret.foo",
+						"google_secret_manager_secret.bar",
+						map[string]struct{}{
+							"id":      {},
+							"project": {},
+						},
+					),
+				),
+			},
+		},
+	})
+}
+
+func testAccDataSourceSecretManagerSecrets_filter(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_secret_manager_secret" "foo" {
+  secret_id = "tf-test-secret-%{random_suffix}"
+
+  replication {
+    user_managed {
+      replicas {
+        location = "us-central1"
+      }
+    }
+  }
+}
+
+resource "google_secret_manager_secret" "bar" {
+  secret_id = "tf-test-secret-2-%{random_suffix}"
+  
+  replication {
+    user_managed {
+      replicas {
+        location = "us-east5"
+      }
+    }
+  }
+}
+
+data "google_secret_manager_secrets" "foo" {
+  filter = "replication.user_managed.replicas.location:us-central1"
+  depends_on = [
+    google_secret_manager_secret.foo,
+    google_secret_manager_secret.bar
+  ]
+}
+`, context)
+}
+
+// This function checks data source state matches for resourceName secret manager secret state
+func checkListDataSourceStateMatchesResourceStateWithIgnores(dataSourceName, resourceName string, ignoreFields map[string]struct{}) func(*terraform.State) error {
+	return func(s *terraform.State) error {
+		ds, ok := s.RootModule().Resources[dataSourceName]
+		if !ok {
+			return fmt.Errorf("can't find %s in state", dataSourceName)
+		}
+
+		rs, ok := s.RootModule().Resources[resourceName]
+		if !ok {
+			return fmt.Errorf("can't find %s in state", resourceName)
+		}
+
+		dsAttr := ds.Primary.Attributes
+		rsAttr := rs.Primary.Attributes
+
+		err := checkFieldsMatchForDataSourceStateAndResourceState(dsAttr, rsAttr, ignoreFields)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+}
+
+// This function checks whether all the attributes of the secret manager secret resource and the attributes of the secret manager secret inside the data source list are the same
+func checkFieldsMatchForDataSourceStateAndResourceState(dsAttr, rsAttr map[string]string, ignoreFields map[string]struct{}) error {
+	totalSecrets, err := strconv.Atoi(dsAttr["secrets.#"])
+	if err != nil {
+		return errors.New("Couldn't convert length of secrets list to integer")
+	}
+	index := "-1"
+	for i := 0; i < totalSecrets; i++ {
+		if dsAttr["secrets."+strconv.Itoa(i)+".name"] == rsAttr["name"] {
+			index = strconv.Itoa(i)
+		}
+	}
+
+	if index == "-1" {
+		return errors.New("The newly created secret is not found in the data source")
+	}
+
+	errMsg := ""
+	// Data sources are often derived from resources, so iterate over the resource fields to
+	// make sure all fields are accounted for in the data source.
+	// If a field exists in the data source but not in the resource, its expected value should
+	// be checked separately.
+	for k := range rsAttr {
+		if _, ok := ignoreFields[k]; ok {
+			continue
+		}
+		if k == "%" {
+			continue
+		}
+		if dsAttr["secrets."+index+"."+k] != rsAttr[k] {
+			// ignore data sources where an empty list is being compared against a null list.
+			if k[len(k)-1:] == "#" && (dsAttr["secrets."+index+"."+k] == "" || dsAttr["secrets."+index+"."+k] == "0") && (rsAttr[k] == "" || rsAttr[k] == "0") {
+				continue
+			}
+			errMsg += fmt.Sprintf("%s is %s; want %s\n", k, dsAttr["secrets."+index+"."+k], rsAttr[k])
+		}
+	}
+
+	if errMsg != "" {
+		return errors.New(errMsg)
+	}
+
+	return nil
+}
+
+// This function checks state match for resourceName and asserts the absense of resourceName2 in data source
+func checkListDataSourceStateMatchesResourceStateWithIgnoresForAppliedFilter(dataSourceName, resourceName, resourceName2 string, ignoreFields map[string]struct{}) func(*terraform.State) error {
+	return func(s *terraform.State) error {
+		ds, ok := s.RootModule().Resources[dataSourceName]
+		if !ok {
+			return fmt.Errorf("can't find %s in state", dataSourceName)
+		}
+
+		rs, ok := s.RootModule().Resources[resourceName]
+		if !ok {
+			return fmt.Errorf("can't find %s in state", resourceName)
+		}
+
+		rs2, ok := s.RootModule().Resources[resourceName2]
+		if !ok {
+			return fmt.Errorf("can't find %s in state", resourceName2)
+		}
+
+		dsAttr := ds.Primary.Attributes
+		rsAttr := rs.Primary.Attributes
+		rsAttr2 := rs2.Primary.Attributes
+
+		err := checkFieldsMatchForDataSourceStateAndResourceState(dsAttr, rsAttr, ignoreFields)
+		if err != nil {
+			return err
+		}
+		err = checkResourceAbsentInDataSourceAfterFilterApplied(dsAttr, rsAttr2)
+		return err
+	}
+}
+
+// This function asserts the absence of the secret manager secret resource which would not be included in the data source list due to the filter applied.
+func checkResourceAbsentInDataSourceAfterFilterApplied(dsAttr, rsAttr map[string]string) error {
+	totalSecrets, err := strconv.Atoi(dsAttr["secrets.#"])
+	if err != nil {
+		return errors.New("Couldn't convert length of secrets list to integer")
+	}
+	for i := 0; i < totalSecrets; i++ {
+		if dsAttr["secrets."+strconv.Itoa(i)+".name"] == rsAttr["name"] {
+			return errors.New("The resource is present in the data source even after the filter is applied")
+		}
+	}
+	return nil
+}
diff --git a/mmv1/third_party/terraform/services/secretmanager/resource_secret_manager_secret_test.go.erb b/mmv1/third_party/terraform/services/secretmanager/resource_secret_manager_secret_test.go.erb
index 347d5e842a40..26f0baa820a4 100644
--- a/mmv1/third_party/terraform/services/secretmanager/resource_secret_manager_secret_test.go.erb
+++ b/mmv1/third_party/terraform/services/secretmanager/resource_secret_manager_secret_test.go.erb
@@ -29,7 +29,7 @@ func TestAccSecretManagerSecret_import(t *testing.T) {
 				ResourceName:      "google_secret_manager_secret.secret-basic",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"ttl"},
+				ImportStateVerifyIgnore: []string{"ttl", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -58,7 +58,7 @@ func TestAccSecretManagerSecret_cmek(t *testing.T) {
 				ResourceName:      "google_secret_manager_secret.secret-basic",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"ttl"},
+				ImportStateVerifyIgnore: []string{"ttl", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -83,7 +83,7 @@ func TestAccSecretManagerSecret_annotationsUpdate(t *testing.T) {
 				ResourceName:      "google_secret_manager_secret.secret-with-annotations",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"ttl"},
+				ImportStateVerifyIgnore: []string{"ttl", "labels", "terraform_labels", "annotations"},
 			},
 			{
 				Config: testAccSecretManagerSecret_annotationsUpdate(context),
@@ -92,7 +92,7 @@ func TestAccSecretManagerSecret_annotationsUpdate(t *testing.T) {
 				ResourceName:      "google_secret_manager_secret.secret-with-annotations",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"ttl"},
+				ImportStateVerifyIgnore: []string{"ttl", "labels", "terraform_labels", "annotations"},
 			},
 			{
 				Config: testAccSecretManagerSecret_annotationsBasic(context),
@@ -101,7 +101,7 @@ func TestAccSecretManagerSecret_annotationsUpdate(t *testing.T) {
 				ResourceName:      "google_secret_manager_secret.secret-with-annotations",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"ttl"},
+				ImportStateVerifyIgnore: []string{"ttl", "labels", "terraform_labels", "annotations"},
 			},
 		},
 	})
@@ -126,7 +126,7 @@ func TestAccSecretManagerSecret_versionAliasesUpdate(t *testing.T) {
 				ResourceName:      "google_secret_manager_secret.secret-basic",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"ttl"},
+				ImportStateVerifyIgnore: []string{"ttl", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccSecretManagerSecret_versionAliasesBasic(context),
@@ -135,7 +135,7 @@ func TestAccSecretManagerSecret_versionAliasesUpdate(t *testing.T) {
 				ResourceName:      "google_secret_manager_secret.secret-basic",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"ttl"},
+				ImportStateVerifyIgnore: []string{"ttl", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccSecretManagerSecret_versionAliasesUpdate(context),
@@ -144,7 +144,7 @@ func TestAccSecretManagerSecret_versionAliasesUpdate(t *testing.T) {
 				ResourceName:      "google_secret_manager_secret.secret-basic",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"ttl"},
+				ImportStateVerifyIgnore: []string{"ttl", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccSecretManagerSecret_basicWithSecretVersions(context),
@@ -153,7 +153,7 @@ func TestAccSecretManagerSecret_versionAliasesUpdate(t *testing.T) {
 				ResourceName:      "google_secret_manager_secret.secret-basic",
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{"ttl"},
+				ImportStateVerifyIgnore: []string{"ttl", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -184,7 +184,7 @@ func TestAccSecretManagerSecret_userManagedCmekUpdate(t *testing.T) {
 				ResourceName:            "google_secret_manager_secret.secret-basic",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"ttl"},
+				ImportStateVerifyIgnore: []string{"ttl", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccSecretMangerSecret_userManagedCmekUpdate(context),
@@ -193,7 +193,7 @@ func TestAccSecretManagerSecret_userManagedCmekUpdate(t *testing.T) {
 				ResourceName:            "google_secret_manager_secret.secret-basic",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"ttl"},
+				ImportStateVerifyIgnore: []string{"ttl", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccSecretMangerSecret_userManagedCmekUpdate2(context),
@@ -202,17 +202,222 @@ func TestAccSecretManagerSecret_userManagedCmekUpdate(t *testing.T) {
 				ResourceName:            "google_secret_manager_secret.secret-basic",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"ttl"},
+				ImportStateVerifyIgnore: []string{"ttl", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccSecretMangerSecret_userManagedCmekBasic(context),
 			},
+			{
+				ResourceName:            "google_secret_manager_secret.secret-basic",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"ttl", "labels", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func TestAccSecretManagerSecret_automaticCmekUpdate(t *testing.T) {
+	t.Parallel()
+
+	suffix := acctest.RandString(t, 10)
+	key1 := acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", "global", "tf-secret-manager-automatic-key1")
+	key2 := acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", "global", "tf-secret-manager-automatic-key2")
+	context := map[string]interface{}{
+		"pid":            envvar.GetTestProjectFromEnv(),
+		"random_suffix":  suffix,
+		"kms_key_name_1": key1.CryptoKey.Name,
+		"kms_key_name_2": key2.CryptoKey.Name,
+	}
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckSecretManagerSecretDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSecretMangerSecret_automaticCmekBasic(context),
+			},
+			{
+				ResourceName:            "google_secret_manager_secret.secret-basic",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"ttl", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccSecretMangerSecret_automaticCmekUpdate(context),
+			},
+			{
+				ResourceName:            "google_secret_manager_secret.secret-basic",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"ttl", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccSecretMangerSecret_automaticCmekUpdate2(context),
+			},
+			{
+				ResourceName:            "google_secret_manager_secret.secret-basic",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"ttl", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccSecretMangerSecret_automaticCmekBasic(context),
+			},
+			{
+				ResourceName:            "google_secret_manager_secret.secret-basic",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"ttl", "labels", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func TestAccSecretManagerSecret_rotationPeriodUpdate(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+		"timestamp":     "2122-11-26T19:58:16Z",
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckSecretManagerSecretDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSecretManagerSecret_withoutRotationPeriod(context),
+			},
+			{
+				ResourceName:            "google_secret_manager_secret.secret-basic",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"ttl"},
+			},
+			{
+				Config: testAccSecretManagerSecret_rotationPeriodBasic(context),
+			},
 			{
 				ResourceName:            "google_secret_manager_secret.secret-basic",
 				ImportState:             true,
 				ImportStateVerify:       true,
 				ImportStateVerifyIgnore: []string{"ttl"},
 			},
+			{
+				Config: testAccSecretManagerSecret_rotationPeriodUpdate(context),
+			},
+			{
+				ResourceName:            "google_secret_manager_secret.secret-basic",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"ttl"},
+			},
+			{
+				Config: testAccSecretManagerSecret_withoutRotationPeriod(context),
+			},
+			{
+				ResourceName:            "google_secret_manager_secret.secret-basic",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"ttl"},
+			},
+		},
+	})
+}
+
+func TestAccSecretManagerSecret_ttlUpdate(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckSecretManagerSecretDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSecretManagerSecret_withoutTtl(context),
+			},
+			{
+				ResourceName:            "google_secret_manager_secret.secret-basic",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"ttl", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccSecretManagerSecret_basic(context),
+			},
+			{
+				ResourceName:            "google_secret_manager_secret.secret-basic",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"ttl", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccSecretManagerSecret_ttlUpdate(context),
+			},
+			{
+				ResourceName:            "google_secret_manager_secret.secret-basic",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"ttl", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccSecretManagerSecret_withoutTtl(context),
+			},
+			{
+				ResourceName:            "google_secret_manager_secret.secret-basic",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"ttl", "labels", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func TestAccSecretManagerSecret_updateBetweenTtlAndExpireTime(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckSecretManagerSecretDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSecretManagerSecret_basic(context),
+			},
+			{
+				ResourceName:            "google_secret_manager_secret.secret-basic",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"ttl", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccSecretManagerSecret_expireTime(context),
+			},
+			{
+				ResourceName:            "google_secret_manager_secret.secret-basic",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"ttl", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccSecretManagerSecret_basic(context),
+			},
+			{
+				ResourceName:            "google_secret_manager_secret.secret-basic",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"ttl", "labels", "terraform_labels"},
+			},
 		},
 	})
 }
@@ -299,7 +504,7 @@ resource "google_secret_manager_secret" "secret-with-annotations" {
   }
 
   replication {
-    automatic = true
+    auto {}
   }
 }
 `, context)
@@ -322,7 +527,7 @@ resource "google_secret_manager_secret" "secret-with-annotations" {
   }
 
   replication {
-    automatic = true
+    auto {}
   }
 }
 `, context)
@@ -631,3 +836,296 @@ resource "google_secret_manager_secret" "secret-basic" {
 }
 `, context)
 }
+
+func testAccSecretMangerSecret_automaticCmekBasic(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+data "google_project" "project" {
+  project_id = "%{pid}"
+}
+resource "google_kms_crypto_key_iam_member" "kms-secret-binding-1" {
+  crypto_key_id = "%{kms_key_name_1}"
+  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+  member        = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-secretmanager.iam.gserviceaccount.com"
+}
+resource "google_kms_crypto_key_iam_member" "kms-secret-binding-2" {
+  crypto_key_id = "%{kms_key_name_2}"
+  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+  member        = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-secretmanager.iam.gserviceaccount.com"
+}
+resource "google_secret_manager_secret" "secret-basic" {
+  secret_id = "tf-test-secret-%{random_suffix}"
+  
+  labels = {
+    label = "my-label"
+  }
+  replication {
+    auto {}
+  }
+  depends_on = [
+    google_kms_crypto_key_iam_member.kms-secret-binding-1,
+    google_kms_crypto_key_iam_member.kms-secret-binding-2,
+  ]
+}
+`, context)
+}
+
+func testAccSecretMangerSecret_automaticCmekUpdate(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+data "google_project" "project" {
+  project_id = "%{pid}"
+}
+resource "google_kms_crypto_key_iam_member" "kms-secret-binding-1" {
+  crypto_key_id = "%{kms_key_name_1}"
+  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+  member        = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-secretmanager.iam.gserviceaccount.com"
+}
+resource "google_kms_crypto_key_iam_member" "kms-secret-binding-2" {
+  crypto_key_id = "%{kms_key_name_2}"
+  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+  member        = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-secretmanager.iam.gserviceaccount.com"
+}
+resource "google_secret_manager_secret" "secret-basic" {
+  secret_id = "tf-test-secret-%{random_suffix}"
+  
+  labels = {
+    label = "my-label"
+  }
+  replication {
+    auto {
+      customer_managed_encryption {
+        kms_key_name = "%{kms_key_name_1}"
+      }
+    }
+  }
+  depends_on = [
+    google_kms_crypto_key_iam_member.kms-secret-binding-1,
+    google_kms_crypto_key_iam_member.kms-secret-binding-2,
+  ]
+}
+`, context)
+}
+
+func testAccSecretMangerSecret_automaticCmekUpdate2(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+data "google_project" "project" {
+  project_id = "%{pid}"
+}
+resource "google_kms_crypto_key_iam_member" "kms-secret-binding-1" {
+  crypto_key_id = "%{kms_key_name_1}"
+  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+  member        = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-secretmanager.iam.gserviceaccount.com"
+}
+resource "google_kms_crypto_key_iam_member" "kms-secret-binding-2" {
+  crypto_key_id = "%{kms_key_name_2}"
+  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+  member        = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-secretmanager.iam.gserviceaccount.com"
+}
+resource "google_secret_manager_secret" "secret-basic" {
+  secret_id = "tf-test-secret-%{random_suffix}"
+  
+  labels = {
+    label = "my-label"
+  }
+  replication {
+    auto {
+      customer_managed_encryption {
+        kms_key_name = "%{kms_key_name_2}"
+      }
+    }
+  }
+  depends_on = [
+    google_kms_crypto_key_iam_member.kms-secret-binding-1,
+    google_kms_crypto_key_iam_member.kms-secret-binding-2,
+  ]
+}
+`, context)
+}
+
+func testAccSecretManagerSecret_withoutRotationPeriod(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+data "google_project" "project" {}
+
+resource "google_pubsub_topic_iam_member" "secrets_manager_access" {
+  topic  = google_pubsub_topic.topic.name
+  member = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-secretmanager.iam.gserviceaccount.com"
+  role   = "roles/pubsub.publisher"
+}
+
+resource "google_pubsub_topic" "topic" {
+  name = "tf-test-topic-%{random_suffix}"
+}
+
+resource "google_secret_manager_secret" "secret-basic" {
+  secret_id = "tf-test-secret-%{random_suffix}"
+
+  replication {
+    user_managed {
+      replicas {
+        location = "us-central1"
+      }
+    }
+  }
+
+  depends_on = [
+    google_pubsub_topic_iam_member.secrets_manager_access,
+  ]
+}
+`, context)
+}
+
+func testAccSecretManagerSecret_rotationPeriodBasic(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+data "google_project" "project" {}
+
+resource "google_pubsub_topic_iam_member" "secrets_manager_access" {
+  topic  = google_pubsub_topic.topic.name
+  member = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-secretmanager.iam.gserviceaccount.com"
+  role   = "roles/pubsub.publisher"
+}
+
+resource "google_pubsub_topic" "topic" {
+  name = "tf-test-topic-%{random_suffix}"
+}
+
+resource "google_secret_manager_secret" "secret-basic" {
+  secret_id = "tf-test-secret-%{random_suffix}"
+
+  topics {
+    name = google_pubsub_topic.topic.id
+  }
+
+  rotation {
+    rotation_period = "3600s"
+    next_rotation_time = "%{timestamp}"
+  }
+
+  replication {
+    user_managed {
+      replicas {
+        location = "us-central1"
+      }
+    }
+  }
+
+  depends_on = [
+    google_pubsub_topic_iam_member.secrets_manager_access,
+  ]
+}
+`, context)
+}
+
+func testAccSecretManagerSecret_rotationPeriodUpdate(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+data "google_project" "project" {}
+
+resource "google_pubsub_topic_iam_member" "secrets_manager_access" {
+  topic  = google_pubsub_topic.topic.name
+  member = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-secretmanager.iam.gserviceaccount.com"
+  role   = "roles/pubsub.publisher"
+}
+
+resource "google_pubsub_topic" "topic" {
+  name = "tf-test-topic-%{random_suffix}"
+}
+
+resource "google_secret_manager_secret" "secret-basic" {
+  secret_id = "tf-test-secret-%{random_suffix}"
+
+  topics {
+    name = google_pubsub_topic.topic.id
+  }
+
+  rotation {
+    rotation_period = "3700s"
+    next_rotation_time = "%{timestamp}"
+  }
+
+  replication {
+    user_managed {
+      replicas {
+        location = "us-central1"
+      }
+    }
+  }
+
+  depends_on = [
+    google_pubsub_topic_iam_member.secrets_manager_access,
+  ]
+}
+`, context)
+}
+
+func testAccSecretManagerSecret_withoutTtl(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_secret_manager_secret" "secret-basic" {
+  secret_id = "tf-test-secret-%{random_suffix}"
+
+  labels = {
+    label = "my-label"
+  }
+
+  replication {
+    user_managed {
+      replicas {
+        location = "us-central1"
+      }
+      replicas {
+        location = "us-east1"
+      }
+    }
+  }
+}
+`, context)
+}
+
+func testAccSecretManagerSecret_ttlUpdate(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_secret_manager_secret" "secret-basic" {
+  secret_id = "tf-test-secret-%{random_suffix}"
+
+  labels = {
+    label = "my-label"
+  }
+
+  replication {
+    user_managed {
+      replicas {
+        location = "us-central1"
+      }
+      replicas {
+        location = "us-east1"
+      }
+    }
+  }
+
+  ttl = "7200s"
+
+}
+`, context)
+}
+
+func testAccSecretManagerSecret_expireTime(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_secret_manager_secret" "secret-basic" {
+  secret_id = "tf-test-secret-%{random_suffix}"
+
+  labels = {
+    label = "my-label"
+  }
+
+  replication {
+    user_managed {
+      replicas {
+        location = "us-central1"
+      }
+      replicas {
+        location = "us-east1"
+      }
+    }
+  }
+
+  expire_time = "2122-09-26T10:55:55.163240682Z"
+
+}
+`, context)
+}
diff --git a/mmv1/third_party/terraform/services/secretmanager/resource_secret_manager_secret_version_test.go.erb b/mmv1/third_party/terraform/services/secretmanager/resource_secret_manager_secret_version_test.go.erb
index a32799872899..375e6b73b12f 100644
--- a/mmv1/third_party/terraform/services/secretmanager/resource_secret_manager_secret_version_test.go.erb
+++ b/mmv1/third_party/terraform/services/secretmanager/resource_secret_manager_secret_version_test.go.erb
@@ -61,7 +61,7 @@ resource "google_secret_manager_secret" "secret-basic" {
   }
 
   replication {
-    automatic = true
+    auto {}
   }
 }
 
@@ -84,7 +84,7 @@ resource "google_secret_manager_secret" "secret-basic" {
   }
 
   replication {
-    automatic = true
+    auto {}
   }
 }
 
diff --git a/mmv1/third_party/terraform/services/secretmanager/test-fixtures/binary-file.pfx b/mmv1/third_party/terraform/services/secretmanager/test-fixtures/binary-file.pfx
new file mode 100644
index 000000000000..5c1caa0337e6
Binary files /dev/null and b/mmv1/third_party/terraform/services/secretmanager/test-fixtures/binary-file.pfx differ
diff --git a/mmv1/third_party/terraform/services/securitycenter/resource_scc_folder_custom_module_test.go b/mmv1/third_party/terraform/services/securitycenter/resource_scc_folder_custom_module_test.go
new file mode 100644
index 000000000000..fbd53854fb12
--- /dev/null
+++ b/mmv1/third_party/terraform/services/securitycenter/resource_scc_folder_custom_module_test.go
@@ -0,0 +1,226 @@
+package securitycenter_test
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+	"github.com/hashicorp/terraform-provider-google/google/envvar"
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
+)
+
+// Custom Module tests cannot be run in parallel without running into 409 Conflict reponses.
+// Run them as individual steps of an update test instead.
+func TestAccSecurityCenterFolderCustomModule(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"org_id":        envvar.GetTestOrgFromEnv(t),
+		"sleep":         true,
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		ExternalProviders: map[string]resource.ExternalProvider{
+			"random": {},
+			"time":   {},
+		},
+		CheckDestroy: testAccCheckSecurityCenterFolderCustomModuleDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSecurityCenterFolderCustomModule_sccFolderCustomModuleBasicExample(context),
+			},
+			{
+				ResourceName:            "google_scc_folder_custom_module.example",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"folder"},
+			},
+			{
+				Config: testAccSecurityCenterFolderCustomModule_sccFolderCustomModuleFullExample(context),
+			},
+			{
+				ResourceName:            "google_scc_folder_custom_module.example",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"folder"},
+			},
+			{
+				Config: testAccSecurityCenterFolderCustomModule_sccFolderCustomModuleUpdate(context),
+			},
+			{
+				ResourceName:            "google_scc_folder_custom_module.example",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"folder"},
+			},
+		},
+	})
+}
+
+func testAccSecurityCenterFolderCustomModule_sccFolderCustomModuleBasicExample(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_folder" "folder" {
+  parent       = "organizations/%{org_id}"
+  display_name = "tf-test-folder-name%{random_suffix}"
+}
+
+resource "time_sleep" "wait_1_minute" {
+	depends_on = [google_folder.folder]
+
+	create_duration = "2m"
+}
+
+resource "google_scc_folder_custom_module" "example" {
+	folder = google_folder.folder.folder_id
+	display_name = "tf_test_basic_custom_module%{random_suffix}"
+	enablement_state = "ENABLED"
+	custom_config {
+		predicate {
+			expression = "resource.rotationPeriod > duration(\"2592000s\")"
+		}
+		resource_selector {
+			resource_types = [
+				"cloudkms.googleapis.com/CryptoKey",
+			]
+		}
+		description = "The rotation period of the identified cryptokey resource exceeds 30 days."
+		recommendation = "Set the rotation period to at most 30 days."
+		severity = "MEDIUM"
+	}
+
+
+	depends_on = [time_sleep.wait_1_minute]
+}
+`, context)
+}
+
+func testAccSecurityCenterFolderCustomModule_sccFolderCustomModuleFullExample(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_folder" "folder" {
+  parent       = "organizations/%{org_id}"
+  display_name = "tf-test-folder-name%{random_suffix}"
+}
+
+resource "google_scc_folder_custom_module" "example" {
+	folder = google_folder.folder.folder_id
+	display_name = "tf_test_full_custom_module%{random_suffix}"
+	enablement_state = "ENABLED"
+	custom_config {
+		predicate {
+			expression = "resource.rotationPeriod > duration(\"2592000s\")"
+			title = "Purpose of the expression"
+			description = "description of the expression"
+			location = "location of the expression"
+		}
+		custom_output {
+			properties {
+				name = "duration"
+				value_expression {
+					expression = "resource.rotationPeriod"
+					title = "Purpose of the expression"
+					description = "description of the expression"
+					location = "location of the expression"
+				}
+			}
+		}
+		resource_selector {
+			resource_types = [
+				"cloudkms.googleapis.com/CryptoKey",
+			]
+		}
+		severity = "LOW"
+		description = "Description of the custom module"
+		recommendation = "Steps to resolve violation"
+	}
+}
+`, context)
+}
+
+func testAccSecurityCenterFolderCustomModule_sccFolderCustomModuleUpdate(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_folder" "folder" {
+  parent       = "organizations/%{org_id}"
+  display_name = "tf-test-folder-name%{random_suffix}"
+}
+
+resource "google_scc_folder_custom_module" "example" {
+	folder = google_folder.folder.folder_id
+	display_name = "tf_test_full_custom_module%{random_suffix}"
+	enablement_state = "DISABLED"
+	custom_config {
+		predicate {
+			expression = "resource.name == \"updated-name\""
+			title = "Updated expression title"
+			description = "Updated description of the expression"
+			location = "Updated location of the expression"
+		}
+		custom_output {
+			properties {
+				name = "violation"
+				value_expression {
+					expression = "resource.name"
+					title = "Updated expression title"
+					description = "Updated description of the expression"
+					location = "Updated location of the expression"
+				}
+			}
+		}
+		resource_selector {
+			resource_types = [
+				"compute.googleapis.com/Instance",
+			]
+		}
+		severity = "CRITICAL"
+		description = "Updated description of the custom module"
+		recommendation = "Updated steps to resolve violation"
+	}
+}
+`, context)
+}
+
+func testAccCheckSecurityCenterFolderCustomModuleDestroyProducer(t *testing.T) func(s *terraform.State) error {
+	return func(s *terraform.State) error {
+		for name, rs := range s.RootModule().Resources {
+			if rs.Type != "google_scc_folder_custom_module" {
+				continue
+			}
+			if strings.HasPrefix(name, "data.") {
+				continue
+			}
+
+			config := acctest.GoogleProviderConfig(t)
+
+			url, err := tpgresource.ReplaceVarsForTest(config, rs, "{{SecurityCenterBasePath}}folders/{{folder}}/securityHealthAnalyticsSettings/customModules/{{name}}")
+			if err != nil {
+				return err
+			}
+
+			billingProject := ""
+
+			if config.BillingProject != "" {
+				billingProject = config.BillingProject
+			}
+
+			_, err = transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+				Config:    config,
+				Method:    "GET",
+				Project:   billingProject,
+				RawURL:    url,
+				UserAgent: config.UserAgent,
+			})
+			if err == nil {
+				return fmt.Errorf("SecurityCenterFolderCustomModule still exists at %s", url)
+			}
+		}
+
+		return nil
+	}
+}
diff --git a/mmv1/third_party/terraform/services/securitycenter/resource_scc_organization_custom_module_test.go b/mmv1/third_party/terraform/services/securitycenter/resource_scc_organization_custom_module_test.go
new file mode 100644
index 000000000000..8869eb7a5b96
--- /dev/null
+++ b/mmv1/third_party/terraform/services/securitycenter/resource_scc_organization_custom_module_test.go
@@ -0,0 +1,197 @@
+package securitycenter_test
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+	"github.com/hashicorp/terraform-provider-google/google/envvar"
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
+)
+
+// Custom Module tests cannot be run in parallel without running into 409 Conflict reponses.
+// Run them as individual steps of an update test instead.
+func TestAccSecurityCenterOrganizationCustomModule(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"org_id":        envvar.GetTestOrgFromEnv(t),
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckSecurityCenterOrganizationCustomModuleDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSecurityCenterOrganizationCustomModule_sccOrganizationCustomModuleBasicExample(context),
+			},
+			{
+				ResourceName:            "google_scc_organization_custom_module.example",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"organization"},
+			},
+			{
+				Config: testAccSecurityCenterOrganizationCustomModule_sccOrganizationCustomModuleFullExample(context),
+			},
+			{
+				ResourceName:            "google_scc_organization_custom_module.example",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"organization"},
+			},
+			{
+				Config: testAccSecurityCenterOrganizationCustomModule_sccOrganizationCustomModuleUpdate(context),
+			},
+			{
+				ResourceName:            "google_scc_organization_custom_module.example",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"organization"},
+			},
+		},
+	})
+}
+
+func testAccSecurityCenterOrganizationCustomModule_sccOrganizationCustomModuleBasicExample(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_scc_organization_custom_module" "example" {
+	organization = "%{org_id}"
+	display_name = "tf_test_basic_custom_module%{random_suffix}"
+	enablement_state = "ENABLED"
+	custom_config {
+		predicate {
+			expression = "resource.rotationPeriod > duration(\"2592000s\")"
+		}
+		resource_selector {
+			resource_types = [
+				"cloudkms.googleapis.com/CryptoKey",
+			]
+		}
+		description = "The rotation period of the identified cryptokey resource exceeds 30 days."
+		recommendation = "Set the rotation period to at most 30 days."
+		severity = "MEDIUM"
+	}
+}
+`, context)
+}
+
+func testAccSecurityCenterOrganizationCustomModule_sccOrganizationCustomModuleFullExample(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_scc_organization_custom_module" "example" {
+	organization = "%{org_id}"
+	display_name = "tf_test_full_custom_module%{random_suffix}"
+	enablement_state = "ENABLED"
+	custom_config {
+		predicate {
+			expression = "resource.rotationPeriod > duration(\"2592000s\")"
+			title = "Purpose of the expression"
+			description = "description of the expression"
+			location = "location of the expression"
+		}
+		custom_output {
+			properties {
+				name = "duration"
+				value_expression {
+					expression = "resource.rotationPeriod"
+					title = "Purpose of the expression"
+					description = "description of the expression"
+					location = "location of the expression"
+				}
+			}
+		}
+		resource_selector {
+			resource_types = [
+				"cloudkms.googleapis.com/CryptoKey",
+			]
+		}
+		severity = "LOW"
+		description = "Description of the custom module"
+		recommendation = "Steps to resolve violation"
+	}
+}
+`, context)
+}
+
+func testAccSecurityCenterOrganizationCustomModule_sccOrganizationCustomModuleUpdate(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_scc_organization_custom_module" "example" {
+	organization = "%{org_id}"
+	display_name = "tf_test_full_custom_module%{random_suffix}"
+	enablement_state = "DISABLED"
+	custom_config {
+		predicate {
+			expression = "resource.name == \"updated-name\""
+			title = "Updated expression title"
+			description = "Updated description of the expression"
+			location = "Updated location of the expression"
+		}
+		custom_output {
+			properties {
+				name = "violation"
+				value_expression {
+					expression = "resource.name"
+					title = "Updated expression title"
+					description = "Updated description of the expression"
+					location = "Updated location of the expression"
+				}
+			}
+		}
+		resource_selector {
+			resource_types = [
+				"compute.googleapis.com/Instance",
+			]
+		}
+		severity = "CRITICAL"
+		description = "Updated description of the custom module"
+		recommendation = "Updated steps to resolve violation"
+	}
+}
+`, context)
+}
+
+func testAccCheckSecurityCenterOrganizationCustomModuleDestroyProducer(t *testing.T) func(s *terraform.State) error {
+	return func(s *terraform.State) error {
+		for name, rs := range s.RootModule().Resources {
+			if rs.Type != "google_scc_organization_custom_module" {
+				continue
+			}
+			if strings.HasPrefix(name, "data.") {
+				continue
+			}
+
+			config := acctest.GoogleProviderConfig(t)
+
+			url, err := tpgresource.ReplaceVarsForTest(config, rs, "{{SecurityCenterBasePath}}organizations/{{organization}}/securityHealthAnalyticsSettings/customModules/{{name}}")
+			if err != nil {
+				return err
+			}
+
+			billingProject := ""
+
+			if config.BillingProject != "" {
+				billingProject = config.BillingProject
+			}
+
+			_, err = transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+				Config:    config,
+				Method:    "GET",
+				Project:   billingProject,
+				RawURL:    url,
+				UserAgent: config.UserAgent,
+			})
+			if err == nil {
+				return fmt.Errorf("SecurityCenterOrganizationCustomModule still exists at %s", url)
+			}
+		}
+
+		return nil
+	}
+}
diff --git a/mmv1/third_party/terraform/services/securitycenter/resource_scc_project_custom_module_test.go b/mmv1/third_party/terraform/services/securitycenter/resource_scc_project_custom_module_test.go
new file mode 100644
index 000000000000..84df80c79b06
--- /dev/null
+++ b/mmv1/third_party/terraform/services/securitycenter/resource_scc_project_custom_module_test.go
@@ -0,0 +1,189 @@
+package securitycenter_test
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
+)
+
+// Custom Module tests cannot be run in parallel without running into 409 Conflict reponses.
+// Run them as individual steps of an update test instead.
+func TestAccSecurityCenterProjectCustomModule(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckSecurityCenterProjectCustomModuleDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSecurityCenterProjectCustomModule_sccProjectCustomModuleBasicExample(context),
+			},
+			{
+				ResourceName:      "google_scc_project_custom_module.example",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccSecurityCenterProjectCustomModule_sccProjectCustomModuleFullExample(context),
+			},
+			{
+				ResourceName:      "google_scc_project_custom_module.example",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccSecurityCenterProjectCustomModule_sccProjectCustomModuleUpdate(context),
+			},
+			{
+				ResourceName:      "google_scc_project_custom_module.example",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccSecurityCenterProjectCustomModule_sccProjectCustomModuleBasicExample(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_scc_project_custom_module" "example" {
+	display_name = "tf_test_basic_custom_module%{random_suffix}"
+	enablement_state = "ENABLED"
+	custom_config {
+		predicate {
+			expression = "resource.rotationPeriod > duration(\"2592000s\")"
+		}
+		resource_selector {
+			resource_types = [
+				"cloudkms.googleapis.com/CryptoKey",
+			]
+		}
+		description = "The rotation period of the identified cryptokey resource exceeds 30 days."
+		recommendation = "Set the rotation period to at most 30 days."
+		severity = "MEDIUM"
+	}
+}
+`, context)
+}
+
+func testAccSecurityCenterProjectCustomModule_sccProjectCustomModuleFullExample(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_scc_project_custom_module" "example" {
+	display_name = "tf_test_full_custom_module%{random_suffix}"
+	enablement_state = "ENABLED"
+	custom_config {
+		predicate {
+			expression = "resource.rotationPeriod > duration(\"2592000s\")"
+			title = "Purpose of the expression"
+			description = "description of the expression"
+			location = "location of the expression"
+		}
+		custom_output {
+			properties {
+				name = "duration"
+				value_expression {
+					expression = "resource.rotationPeriod"
+					title = "Purpose of the expression"
+					description = "description of the expression"
+					location = "location of the expression"
+				}
+			}
+		}
+		resource_selector {
+			resource_types = [
+				"cloudkms.googleapis.com/CryptoKey",
+			]
+		}
+		severity = "LOW"
+		description = "Description of the custom module"
+		recommendation = "Steps to resolve violation"
+	}
+}
+`, context)
+}
+
+func testAccSecurityCenterProjectCustomModule_sccProjectCustomModuleUpdate(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_scc_project_custom_module" "example" {
+	display_name = "full_custom_module"
+	enablement_state = "DISABLED"
+	custom_config {
+		predicate {
+			expression = "resource.name == \"updated-name\""
+			title = "Updated expression title"
+			description = "Updated description of the expression"
+			location = "Updated location of the expression"
+		}
+		custom_output {
+			properties {
+				name = "violation"
+				value_expression {
+					expression = "resource.name"
+					title = "Updated expression title"
+					description = "Updated description of the expression"
+					location = "Updated location of the expression"
+				}
+			}
+		}
+		resource_selector {
+			resource_types = [
+				"compute.googleapis.com/Instance",
+			]
+		}
+		severity = "CRITICAL"
+		description = "Updated description of the custom module"
+		recommendation = "Updated steps to resolve violation"
+	}
+}
+`, context)
+}
+
+func testAccCheckSecurityCenterProjectCustomModuleDestroyProducer(t *testing.T) func(s *terraform.State) error {
+	return func(s *terraform.State) error {
+		for name, rs := range s.RootModule().Resources {
+			if rs.Type != "google_scc_project_custom_module" {
+				continue
+			}
+			if strings.HasPrefix(name, "data.") {
+				continue
+			}
+
+			config := acctest.GoogleProviderConfig(t)
+
+			url, err := tpgresource.ReplaceVarsForTest(config, rs, "{{SecurityCenterBasePath}}projects/{{project}}/securityHealthAnalyticsSettings/customModules/{{name}}")
+			if err != nil {
+				return err
+			}
+
+			billingProject := ""
+
+			if config.BillingProject != "" {
+				billingProject = config.BillingProject
+			}
+
+			_, err = transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+				Config:    config,
+				Method:    "GET",
+				Project:   billingProject,
+				RawURL:    url,
+				UserAgent: config.UserAgent,
+			})
+			if err == nil {
+				return fmt.Errorf("SecurityCenterProjectCustomModule still exists at %s", url)
+			}
+		}
+
+		return nil
+	}
+}
diff --git a/mmv1/third_party/terraform/services/servicedirectory/resource_service_directory_namespace_test.go.erb b/mmv1/third_party/terraform/services/servicedirectory/resource_service_directory_namespace_test.go.erb
index d056b18d33e7..5bf8e8868df9 100644
--- a/mmv1/third_party/terraform/services/servicedirectory/resource_service_directory_namespace_test.go.erb
+++ b/mmv1/third_party/terraform/services/servicedirectory/resource_service_directory_namespace_test.go.erb
@@ -53,6 +53,7 @@ func TestAccServiceDirectoryNamespace_serviceDirectoryNamespaceUpdateExample(t *
 				ResourceName:      "google_service_directory_namespace.example",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/servicenetworking/resource_google_service_networking_peered_dns_domain.go b/mmv1/third_party/terraform/services/servicenetworking/resource_google_service_networking_peered_dns_domain.go
index 108d5d343588..bb9aba314e34 100644
--- a/mmv1/third_party/terraform/services/servicenetworking/resource_google_service_networking_peered_dns_domain.go
+++ b/mmv1/third_party/terraform/services/servicenetworking/resource_google_service_networking_peered_dns_domain.go
@@ -10,6 +10,7 @@ import (
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"google.golang.org/api/servicenetworking/v1"
 )
@@ -30,6 +31,10 @@ func ResourceGoogleServiceNetworkingPeeredDNSDomain() *schema.Resource {
 			Delete: schema.DefaultTimeout(20 * time.Minute),
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+		),
+
 		Schema: map[string]*schema.Schema{
 			"project": {
 				Type:        schema.TypeString,
diff --git a/mmv1/third_party/terraform/services/servicenetworking/resource_service_networking_connection.go b/mmv1/third_party/terraform/services/servicenetworking/resource_service_networking_connection.go
index ac1ff4a07912..8482083fbdd7 100644
--- a/mmv1/third_party/terraform/services/servicenetworking/resource_service_networking_connection.go
+++ b/mmv1/third_party/terraform/services/servicenetworking/resource_service_networking_connection.go
@@ -8,13 +8,11 @@ import (
 	"strings"
 	"time"
 
-	tpgcompute "github.com/hashicorp/terraform-provider-google/google/services/compute"
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 
 	"github.com/hashicorp/errwrap"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"google.golang.org/api/compute/v1"
 	"google.golang.org/api/servicenetworking/v1"
 )
 
@@ -94,27 +92,16 @@ func resourceServiceNetworkingConnectionCreate(d *schema.ResourceData, meta inte
 	project := networkFieldValue.Project
 
 	parentService := formatParentService(d.Get("service").(string))
-	// We use Patch instead of Create, because we're getting
-	//  "Error waiting for Create Service Networking Connection:
-	//   Error code 9, message: Cannot modify allocated ranges in
-	//   CreateConnection. Please use UpdateConnection."
-	// if we're creating peerings to more than one VPC (like two
-	// CloudSQL instances within one project, peered with two
-	// clusters.)
-	//
-	// This is a workaround for:
-	// https://issuetracker.google.com/issues/131908322
-	//
-	// The API docs don't specify that you can do connections/-,
-	// but that's what gcloud does, and it's easier than grabbing
-	// the connection name.
+
+	// There is no blocker to use Create method, as the bug in CloudSQL has been fixed (https://b.corp.google.com/issues/123276199).
+	// Read more in https://stackoverflow.com/questions/55135559/unable-to-recreate-private-service-access-on-gcp
 
 	// err == nil indicates that the billing_project value was found
 	if bp, err := tpgresource.GetBillingProject(d, config); err == nil {
 		project = bp
 	}
 
-	createCall := config.NewServiceNetworkingClient(userAgent).Services.Connections.Patch(parentService+"/connections/-", connection).UpdateMask("reservedPeeringRanges").Force(true)
+	createCall := config.NewServiceNetworkingClient(userAgent).Services.Connections.Create(parentService, connection)
 	if config.UserProjectOverride {
 		createCall.Header().Add("X-Goog-User-Project", project)
 	}
@@ -272,42 +259,35 @@ func resourceServiceNetworkingConnectionDelete(d *schema.ResourceData, meta inte
 		return err
 	}
 
-	obj := make(map[string]interface{})
-	peering := d.Get("peering").(string)
-	obj["name"] = peering
-	url := fmt.Sprintf("%s%s/removePeering", config.ComputeBasePath, serviceNetworkingNetworkName)
-
 	networkFieldValue, err := tpgresource.ParseNetworkFieldValue(network, d, config)
 	if err != nil {
 		return errwrap.Wrapf("Failed to retrieve network field value, err: {{err}}", err)
 	}
 
 	project := networkFieldValue.Project
-	res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
-		Config:    config,
-		Method:    "POST",
-		Project:   project,
-		RawURL:    url,
-		UserAgent: userAgent,
-		Body:      obj,
-		Timeout:   d.Timeout(schema.TimeoutDelete),
-	})
+	connectionId, err := parseConnectionId(d.Id())
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("ServiceNetworkingConnection %q", d.Id()))
+		return errwrap.Wrapf("Unable to parse Service Networking Connection id, err: {{err}}", err)
 	}
+	parentService := formatParentService(connectionId.Service)
 
-	op := &compute.Operation{}
-	err = tpgresource.Convert(res, op)
-	if err != nil {
-		return err
+	deleteConnectionRequest := &servicenetworking.DeleteConnectionRequest{
+		ConsumerNetwork: serviceNetworkingNetworkName,
 	}
 
-	err = tpgcompute.ComputeOperationWaitTime(
-		config, op, project, "Updating Network", userAgent, d.Timeout(schema.TimeoutDelete))
+	deleteCall := config.NewServiceNetworkingClient(userAgent).Services.Connections.DeleteConnection(parentService+"/connections/servicenetworking-googleapis-com", deleteConnectionRequest)
+	if config.UserProjectOverride {
+		deleteCall.Header().Add("X-Goog-User-Project", project)
+	}
+	op, err := deleteCall.Do()
 	if err != nil {
 		return err
 	}
 
+	if err := ServiceNetworkingOperationWaitTime(config, op, "Delete Service Networking Connection", userAgent, project, d.Timeout(schema.TimeoutCreate)); err != nil {
+		return errwrap.Wrapf("Unable to remove Service Networking Connection, err: {{err}}", err)
+	}
+
 	d.SetId("")
 	log.Printf("[INFO] Service network connection removed.")
 
diff --git a/mmv1/third_party/terraform/services/servicenetworking/resource_service_networking_connection_test.go b/mmv1/third_party/terraform/services/servicenetworking/resource_service_networking_connection_test.go
index 374a8be52ac5..dbbe7c7c32fe 100644
--- a/mmv1/third_party/terraform/services/servicenetworking/resource_service_networking_connection_test.go
+++ b/mmv1/third_party/terraform/services/servicenetworking/resource_service_networking_connection_test.go
@@ -13,9 +13,11 @@ import (
 func TestAccServiceNetworkingConnection_create(t *testing.T) {
 	t.Parallel()
 
-	network := acctest.BootstrapSharedTestNetwork(t, "service-networking-connection-create")
+	network := fmt.Sprintf("tf-test-service-networking-connection-create-%s", acctest.RandString(t, 10))
 	addr := fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10))
 	service := "servicenetworking.googleapis.com"
+	org_id := envvar.GetTestOrgFromEnv(t)
+	billing_account := envvar.GetTestBillingAccountFromEnv(t)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -23,7 +25,7 @@ func TestAccServiceNetworkingConnection_create(t *testing.T) {
 		CheckDestroy:             testServiceNetworkingConnectionDestroy(t, service, network),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccServiceNetworkingConnection(network, addr, "servicenetworking.googleapis.com"),
+				Config: testAccServiceNetworkingConnection(network, addr, "servicenetworking.googleapis.com", org_id, billing_account),
 			},
 			{
 				ResourceName:      "google_service_networking_connection.foobar",
@@ -37,10 +39,12 @@ func TestAccServiceNetworkingConnection_create(t *testing.T) {
 func TestAccServiceNetworkingConnection_update(t *testing.T) {
 	t.Parallel()
 
-	network := acctest.BootstrapSharedTestNetwork(t, "service-networking-connection-update")
+	network := fmt.Sprintf("tf-test-service-networking-connection-update-%s", acctest.RandString(t, 10))
 	addr1 := fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10))
 	addr2 := fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10))
 	service := "servicenetworking.googleapis.com"
+	org_id := envvar.GetTestOrgFromEnv(t)
+	billing_account := envvar.GetTestBillingAccountFromEnv(t)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -48,7 +52,7 @@ func TestAccServiceNetworkingConnection_update(t *testing.T) {
 		CheckDestroy:             testServiceNetworkingConnectionDestroy(t, service, network),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccServiceNetworkingConnection(network, addr1, "servicenetworking.googleapis.com"),
+				Config: testAccServiceNetworkingConnection(network, addr1, "servicenetworking.googleapis.com", org_id, billing_account),
 			},
 			{
 				ResourceName:      "google_service_networking_connection.foobar",
@@ -56,7 +60,7 @@ func TestAccServiceNetworkingConnection_update(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccServiceNetworkingConnection(network, addr2, "servicenetworking.googleapis.com"),
+				Config: testAccServiceNetworkingConnection(network, addr2, "servicenetworking.googleapis.com", org_id, billing_account),
 			},
 			{
 				ResourceName:      "google_service_networking_connection.foobar",
@@ -92,10 +96,23 @@ func testServiceNetworkingConnectionDestroy(t *testing.T, parent, network string
 	}
 }
 
-func testAccServiceNetworkingConnection(networkName, addressRangeName, serviceName string) string {
+func testAccServiceNetworkingConnection(networkName, addressRangeName, serviceName, org_id, billing_account string) string {
 	return fmt.Sprintf(`
-data "google_compute_network" "servicenet" {
+resource "google_project" "project" {
+  project_id      = "%s"
+  name            = "%s"
+  org_id          = "%s"
+  billing_account = "%s"
+}
+
+resource "google_project_service" "servicenetworking" {
+  project = google_project.project.project_id
+  service = "servicenetworking.googleapis.com"
+}
+
+resource "google_compute_network" "servicenet" {
   name = "%s"
+  depends_on = [google_project_service.servicenetworking]
 }
 
 resource "google_compute_global_address" "foobar" {
@@ -103,13 +120,15 @@ resource "google_compute_global_address" "foobar" {
   purpose       = "VPC_PEERING"
   address_type  = "INTERNAL"
   prefix_length = 16
-  network       = data.google_compute_network.servicenet.self_link
+  network       = google_compute_network.servicenet.self_link
+  depends_on = [google_project_service.servicenetworking]
 }
 
 resource "google_service_networking_connection" "foobar" {
-  network                 = data.google_compute_network.servicenet.self_link
+  network                 = google_compute_network.servicenet.self_link
   service                 = "%s"
   reserved_peering_ranges = [google_compute_global_address.foobar.name]
+  depends_on = [google_project_service.servicenetworking]
 }
-`, networkName, addressRangeName, serviceName)
+`, addressRangeName, addressRangeName, org_id, billing_account, networkName, addressRangeName, serviceName)
 }
diff --git a/mmv1/third_party/terraform/services/sourcerepo/data_source_sourcerepo_repository.go b/mmv1/third_party/terraform/services/sourcerepo/data_source_sourcerepo_repository.go
index 5fa2a433c7bf..03dd46452142 100644
--- a/mmv1/third_party/terraform/services/sourcerepo/data_source_sourcerepo_repository.go
+++ b/mmv1/third_party/terraform/services/sourcerepo/data_source_sourcerepo_repository.go
@@ -31,5 +31,13 @@ func dataSourceGoogleSourceRepoRepositoryRead(d *schema.ResourceData, meta inter
 	}
 	d.SetId(id)
 
-	return resourceSourceRepoRepositoryRead(d, meta)
+	err = resourceSourceRepoRepositoryRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/spanner/data_source_spanner_instance.go b/mmv1/third_party/terraform/services/spanner/data_source_spanner_instance.go
index 26dff8a17c7d..afdbce7f040d 100644
--- a/mmv1/third_party/terraform/services/spanner/data_source_spanner_instance.go
+++ b/mmv1/third_party/terraform/services/spanner/data_source_spanner_instance.go
@@ -32,5 +32,17 @@ func dataSourceSpannerInstanceRead(d *schema.ResourceData, meta interface{}) err
 	}
 	d.SetId(id)
 
-	return resourceSpannerInstanceRead(d, meta)
+	err = resourceSpannerInstanceRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if err := tpgresource.SetDataSourceLabels(d); err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/spanner/resource_spanner_instance_test.go b/mmv1/third_party/terraform/services/spanner/resource_spanner_instance_test.go
index 53a531ed99e4..07d2e067bd19 100644
--- a/mmv1/third_party/terraform/services/spanner/resource_spanner_instance_test.go
+++ b/mmv1/third_party/terraform/services/spanner/resource_spanner_instance_test.go
@@ -47,7 +47,7 @@ func TestAccSpannerInstance_noNodeCountSpecified(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccSpannerInstance_noNodeCountSpecified(idName),
-				ExpectError: regexp.MustCompile("one of `num_nodes,processing_units` must be specified"),
+				ExpectError: regexp.MustCompile(".*one of `autoscaling_config,num_nodes,processing_units`\nmust be specified.*"),
 			},
 		},
 	})
@@ -95,17 +95,19 @@ func TestAccSpannerInstance_update(t *testing.T) {
 				Config: testAccSpannerInstance_update(dName1, 1, false),
 			},
 			{
-				ResourceName:      "google_spanner_instance.updater",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_spanner_instance.updater",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 			{
 				Config: testAccSpannerInstance_update(dName2, 2, true),
 			},
 			{
-				ResourceName:      "google_spanner_instance.updater",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_spanner_instance.updater",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -140,6 +142,67 @@ func TestAccSpannerInstance_virtualUpdate(t *testing.T) {
 	})
 }
 
+func TestAccSpannerInstance_basicWithAutoscalingUsingProcessingUnitConfig(t *testing.T) {
+	t.Parallel()
+
+	displayName := fmt.Sprintf("spanner-test-%s-dname", acctest.RandString(t, 10))
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckSpannerInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSpannerInstance_basicWithAutoscalerConfigUsingProcessingUnitsAsConfigs(displayName),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet("google_spanner_instance.basic", "state"),
+				),
+			},
+			{
+				ResourceName:      "google_spanner_instance.basic",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccSpannerInstance_basicWithAutoscalingUsingProcessingUnitConfigUpdate(t *testing.T) {
+	t.Parallel()
+
+	displayName := fmt.Sprintf("spanner-test-%s-dname", acctest.RandString(t, 10))
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckSpannerInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSpannerInstance_basicWithAutoscalerConfigUsingProcessingUnitsAsConfigsUpdate(displayName, 1000, 2000, 65, 95),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet("google_spanner_instance.basic", "state"),
+				),
+			},
+			{
+				ResourceName:            "google_spanner_instance.basic",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
+			},
+			{
+				Config: testAccSpannerInstance_basicWithAutoscalerConfigUsingProcessingUnitsAsConfigsUpdate(displayName, 2000, 3000, 75, 90),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet("google_spanner_instance.basic", "state"),
+				),
+			},
+			{
+				ResourceName:            "google_spanner_instance.basic",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
+			},
+		},
+	})
+}
+
 func testAccSpannerInstance_basic(name string) string {
 	return fmt.Sprintf(`
 resource "google_spanner_instance" "basic" {
@@ -201,3 +264,43 @@ resource "google_spanner_instance" "basic" {
 }
 `, name, name, virtual)
 }
+
+func testAccSpannerInstance_basicWithAutoscalerConfigUsingProcessingUnitsAsConfigs(name string) string {
+	return fmt.Sprintf(`
+resource "google_spanner_instance" "basic" {
+  name         = "%s"
+  config       = "regional-us-central1"
+  display_name = "%s"
+  autoscaling_config {
+    autoscaling_limits {
+      max_processing_units            = 2000
+      min_processing_units            = 1000
+    }
+    autoscaling_targets {
+      high_priority_cpu_utilization_percent = 65
+      storage_utilization_percent           = 95
+    }
+  }
+}
+`, name, name)
+}
+
+func testAccSpannerInstance_basicWithAutoscalerConfigUsingProcessingUnitsAsConfigsUpdate(name string, minProcessingUnits, maxProcessingUnits, cupUtilizationPercent, storageUtilizationPercent int) string {
+	return fmt.Sprintf(`
+resource "google_spanner_instance" "basic" {
+  name         = "%s"
+  config       = "regional-us-central1"
+  display_name = "%s"
+  autoscaling_config {
+    autoscaling_limits {
+      max_processing_units            = %v
+      min_processing_units            = %v
+    }
+    autoscaling_targets {
+      high_priority_cpu_utilization_percent = %v
+      storage_utilization_percent           = %v
+    }
+  }
+}
+`, name, name, maxProcessingUnits, minProcessingUnits, cupUtilizationPercent, storageUtilizationPercent)
+}
diff --git a/mmv1/third_party/terraform/services/sql/data_source_sql_database.go b/mmv1/third_party/terraform/services/sql/data_source_sql_database.go
index 264cde5a1f4f..5c4696314c59 100644
--- a/mmv1/third_party/terraform/services/sql/data_source_sql_database.go
+++ b/mmv1/third_party/terraform/services/sql/data_source_sql_database.go
@@ -27,11 +27,15 @@ func dataSourceSqlDatabaseRead(d *schema.ResourceData, meta interface{}) error {
 	if err != nil {
 		return fmt.Errorf("Error fetching project for Database: %s", err)
 	}
-	d.SetId(fmt.Sprintf("projects/%s/instances/%s/databases/%s", project, d.Get("instance").(string), d.Get("name").(string)))
+	id := fmt.Sprintf("projects/%s/instances/%s/databases/%s", project, d.Get("instance").(string), d.Get("name").(string))
+	d.SetId(id)
 	err = resourceSQLDatabaseRead(d, meta)
 	if err != nil {
 		return err
 	}
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
 	if err := d.Set("deletion_policy", nil); err != nil {
 		return fmt.Errorf("Error setting deletion_policy: %s", err)
 	}
diff --git a/mmv1/third_party/terraform/services/sql/data_source_sql_database_instance.go b/mmv1/third_party/terraform/services/sql/data_source_sql_database_instance.go
index 9aac126ad1e9..e9135ba07723 100644
--- a/mmv1/third_party/terraform/services/sql/data_source_sql_database_instance.go
+++ b/mmv1/third_party/terraform/services/sql/data_source_sql_database_instance.go
@@ -1,6 +1,8 @@
 package sql
 
 import (
+	"fmt"
+
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 )
@@ -18,7 +20,15 @@ func DataSourceSqlDatabaseInstance() *schema.Resource {
 }
 
 func dataSourceSqlDatabaseInstanceRead(d *schema.ResourceData, meta interface{}) error {
+	id := d.Get("name").(string)
+	err := resourceSqlDatabaseInstanceRead(d, meta)
+	if err != nil {
+		return err
+	}
 
-	return resourceSqlDatabaseInstanceRead(d, meta)
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
 
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/sql/data_source_sql_database_instances.go b/mmv1/third_party/terraform/services/sql/data_source_sql_database_instances.go
index fca1fe2cd35f..24e4e30f66f5 100644
--- a/mmv1/third_party/terraform/services/sql/data_source_sql_database_instances.go
+++ b/mmv1/third_party/terraform/services/sql/data_source_sql_database_instances.go
@@ -112,7 +112,7 @@ func dataSourceSqlDatabaseInstancesRead(d *schema.ResourceData, meta interface{}
 			return err
 		}
 
-		pageInstances := flattenDatasourceGoogleDatabaseInstancesList(instances.Items, project)
+		pageInstances := flattenDatasourceGoogleDatabaseInstancesList(instances.Items, project, d)
 		databaseInstances = append(databaseInstances, pageInstances...)
 
 		pageToken = instances.NextPageToken
@@ -130,7 +130,7 @@ func dataSourceSqlDatabaseInstancesRead(d *schema.ResourceData, meta interface{}
 	return nil
 }
 
-func flattenDatasourceGoogleDatabaseInstancesList(fetchedInstances []*sqladmin.DatabaseInstance, project string) []map[string]interface{} {
+func flattenDatasourceGoogleDatabaseInstancesList(fetchedInstances []*sqladmin.DatabaseInstance, project string, d *schema.ResourceData) []map[string]interface{} {
 	if fetchedInstances == nil {
 		return make([]map[string]interface{}, 0)
 	}
@@ -146,7 +146,7 @@ func flattenDatasourceGoogleDatabaseInstancesList(fetchedInstances []*sqladmin.D
 		instance["available_maintenance_versions"] = rawInstance.AvailableMaintenanceVersions
 		instance["instance_type"] = rawInstance.InstanceType
 		instance["service_account_email_address"] = rawInstance.ServiceAccountEmailAddress
-		instance["settings"] = flattenSettings(rawInstance.Settings)
+		instance["settings"] = flattenSettings(rawInstance.Settings, d)
 
 		if rawInstance.DiskEncryptionConfiguration != nil {
 			instance["encryption_key_name"] = rawInstance.DiskEncryptionConfiguration.KmsKeyName
diff --git a/mmv1/third_party/terraform/services/sql/data_source_sql_databases.go b/mmv1/third_party/terraform/services/sql/data_source_sql_databases.go
index ed4ecc4f4f9d..1662765ab489 100644
--- a/mmv1/third_party/terraform/services/sql/data_source_sql_databases.go
+++ b/mmv1/third_party/terraform/services/sql/data_source_sql_databases.go
@@ -60,7 +60,7 @@ func dataSourceSqlDatabasesRead(d *schema.ResourceData, meta interface{}) error
 	})
 
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("Databases in %q instance", d.Get("instance").(string)))
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, fmt.Sprintf("Databases in %q instance", d.Get("instance").(string)), fmt.Sprintf("Databases in %q instance", d.Get("instance").(string)))
 	}
 	flattenedDatabases := flattenDatabases(databases.Items)
 
diff --git a/mmv1/third_party/terraform/services/sql/resource_sql_database_instance.go.erb b/mmv1/third_party/terraform/services/sql/resource_sql_database_instance.go.erb
index 28004b4c275d..2e89cfea5ed3 100644
--- a/mmv1/third_party/terraform/services/sql/resource_sql_database_instance.go.erb
+++ b/mmv1/third_party/terraform/services/sql/resource_sql_database_instance.go.erb
@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"log"
+	"reflect"
 	"strings"
 	"time"
 
@@ -15,7 +16,6 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 
-	"github.com/hashicorp/terraform-provider-google/google/services/servicenetworking"
 	"github.com/hashicorp/terraform-provider-google/google/services/compute"
 	"github.com/hashicorp/terraform-provider-google/google/services/servicenetworking"
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
@@ -46,6 +46,21 @@ var sqlDatabaseAuthorizedNetWorkSchemaElem *schema.Resource = &schema.Resource{
 	},
 }
 
+var sqlDatabaseFlagSchemaElem *schema.Resource = &schema.Resource{
+	Schema: map[string]*schema.Schema{
+		"value": {
+			Type:        schema.TypeString,
+			Required:    true,
+			Description: `Value of the flag.`,
+		},
+		"name": {
+			Type:        schema.TypeString,
+			Required:    true,
+			Description: `Name of the flag.`,
+		},
+	},
+}
+
 var (
 	backupConfigurationKeys = []string{
 		"settings.0.backup_configuration.0.binary_log_enabled",
@@ -65,6 +80,7 @@ var (
 		"settings.0.ip_configuration.0.allocated_ip_range",
 		"settings.0.ip_configuration.0.enable_private_path_for_google_cloud_services",
 		"settings.0.ip_configuration.0.psc_config",
+                "settings.0.ip_configuration.0.ssl_mode",
 	}
 
 	maintenanceWindowKeys = []string{
@@ -119,6 +135,7 @@ func ResourceSqlDatabaseInstance() *schema.Resource {
 		},
 
 		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
 			customdiff.ForceNewIfChange("settings.0.disk_size", compute.IsDiskShrinkage),
 			customdiff.ForceNewIfChange("master_instance_name", isMasterInstanceNameSet),
 			customdiff.IfValueChange("instance_type", isReplicaPromoteRequested, checkPromoteConfigurationsAndUpdateDiff),
@@ -161,6 +178,7 @@ func ResourceSqlDatabaseInstance() *schema.Resource {
 						"edition": {
 							Type:         schema.TypeString,
 							Optional:     true,
+							Default:      "ENTERPRISE",
 							ValidateFunc: validation.StringInSlice([]string{"ENTERPRISE", "ENTERPRISE_PLUS"}, false),
 							Description:  `The edition of the instance, can be ENTERPRISE or ENTERPRISE_PLUS.`,
 						},
@@ -362,22 +380,10 @@ is set to true. Defaults to ZONAL.`,
 							Description:      `The name of server instance collation.`,
 						},
 						"database_flags": {
-							Type:     schema.TypeList,
+							Type:     schema.TypeSet,
 							Optional: true,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"value": {
-										Type:        schema.TypeString,
-										Required:    true,
-										Description: `Value of the flag.`,
-									},
-									"name": {
-										Type:        schema.TypeString,
-										Required:    true,
-										Description: `Name of the flag.`,
-									},
-								},
-							},
+							Set:      schema.HashResource(sqlDatabaseFlagSchemaElem),
+							Elem:     sqlDatabaseFlagSchemaElem,
 						},
 						"disk_autoresize": {
 							Type:             schema.TypeBool,
@@ -431,6 +437,7 @@ is set to true. Defaults to ZONAL.`,
 										Type:         schema.TypeBool,
 										Optional:     true,
 										AtLeastOneOf: ipConfigurationKeys,
+										Description:  `Whether SSL connections over IP are enforced or not. To change this field, also set the corresponding value in ssl_mode if it has been set too.`,
 									},
 									"private_network": {
 										Type:             schema.TypeString,
@@ -475,6 +482,14 @@ is set to true. Defaults to ZONAL.`,
 											},
 										},
 									},
+                                                                        "ssl_mode": {
+                                                                                Type:         schema.TypeString,
+                                                                                Optional:     true,
+                                                                                Computed:     true,
+                                                                                ValidateFunc: validation.StringInSlice([]string{"ALLOW_UNENCRYPTED_AND_ENCRYPTED", "ENCRYPTED_ONLY", "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"}, false),
+                                                                                Description:  `Specify how SSL connection should be enforced in DB connections. This field provides more SSL enforcment options compared to require_ssl. To change this field, also set the correspoding value in require_ssl.`,
+										AtLeastOneOf: ipConfigurationKeys,
+                                                                        },
 								},
 							},
 						},
@@ -946,6 +961,11 @@ is set to true. Defaults to ZONAL.`,
 							DiffSuppressFunc: tpgresource.TimestampDiffSuppress(time.RFC3339Nano),
 							Description:      `The timestamp of the point in time that should be restored.`,
 						},
+						"preferred_zone": {
+    						Type:        	  schema.TypeString,
+    						Optional:         true,
+    						Description:      `(Point-in-time recovery for PostgreSQL only) Clone to an instance in the specified zone. If no zone is specified, clone to the same zone as the source instance.`,
+   						},
 						"database_names": {
 							Type:             schema.TypeList,
 							Optional:         true,
@@ -1261,7 +1281,7 @@ func expandSqlDatabaseInstanceSettings(configured []interface{}, databaseVersion
 		DeletionProtectionEnabled:  _settings["deletion_protection_enabled"].(bool),
 		UserLabels:                 tpgresource.ConvertStringMap(_settings["user_labels"].(map[string]interface{})),
 		BackupConfiguration:        expandBackupConfiguration(_settings["backup_configuration"].([]interface{})),
-		DatabaseFlags:              expandDatabaseFlags(_settings["database_flags"].([]interface{})),
+		DatabaseFlags:              expandDatabaseFlags(_settings["database_flags"].(*schema.Set).List()),
 		IpConfiguration:            expandIpConfiguration(_settings["ip_configuration"].([]interface{}), databaseVersion),
 		LocationPreference:         expandLocationPreference(_settings["location_preference"].([]interface{})),
 		MaintenanceWindow:          expandMaintenanceWindow(_settings["maintenance_window"].([]interface{})),
@@ -1317,6 +1337,7 @@ func expandCloneContext(configured []interface{}) (*sqladmin.CloneContext, strin
 
 	return &sqladmin.CloneContext{
 		PointInTime: _cloneConfiguration["point_in_time"].(string),
+		PreferredZone: _cloneConfiguration["preferred_zone"].(string),
 		DatabaseNames: databaseNames,
 		AllocatedIpRange: _cloneConfiguration["allocated_ip_range"].(string),
 	}, _cloneConfiguration["source_instance_name"].(string)
@@ -1371,6 +1392,7 @@ func expandIpConfiguration(configured []interface{}, databaseVersion string) *sq
 		EnablePrivatePathForGoogleCloudServices: _ipConfiguration["enable_private_path_for_google_cloud_services"].(bool),
 		ForceSendFields:                         forceSendFields,
 		PscConfig:                               expandPscConfig(_ipConfiguration["psc_config"].(*schema.Set).List()),
+		SslMode:                                 _ipConfiguration["ssl_mode"].(string),
 	}
 }
 
@@ -1595,7 +1617,7 @@ func resourceSqlDatabaseInstanceRead(d *schema.ResourceData, meta interface{}) e
 	if err := d.Set("instance_type", instance.InstanceType); err != nil {
 		return fmt.Errorf("Error setting instance_type: %s", err)
 	}
-	if err := d.Set("settings", flattenSettings(instance.Settings)); err != nil {
+	if err := d.Set("settings", flattenSettings(instance.Settings, d)); err != nil {
 		log.Printf("[WARN] Failed to set SQL Database Instance Settings")
 	}
 
@@ -1991,11 +2013,11 @@ func resourceSqlDatabaseInstanceImport(d *schema.ResourceData, meta interface{})
 	return []*schema.ResourceData{d}, nil
 }
 
-func flattenSettings(settings *sqladmin.Settings) []map[string]interface{} {
+func flattenSettings(settings *sqladmin.Settings, d *schema.ResourceData) []map[string]interface{} {
 	data := map[string]interface{}{
 		"version":                      settings.SettingsVersion,
 		"tier":                         settings.Tier,
-		"edition":                      settings.Edition,
+		"edition":                      flattenEdition(settings.Edition),
 		"activation_policy":            settings.ActivationPolicy,
 		"availability_type":            settings.AvailabilityType,
 		"collation":                    settings.Collation,
@@ -2030,7 +2052,7 @@ func flattenSettings(settings *sqladmin.Settings) []map[string]interface{} {
 	}
 
 	if settings.IpConfiguration != nil {
-		data["ip_configuration"] = flattenIpConfiguration(settings.IpConfiguration)
+		data["ip_configuration"] = flattenIpConfiguration(settings.IpConfiguration, d)
 	}
 
 	if settings.LocationPreference != nil {
@@ -2171,7 +2193,7 @@ func flattenDatabaseFlags(databaseFlags []*sqladmin.DatabaseFlags) []map[string]
 	return flags
 }
 
-func flattenIpConfiguration(ipConfiguration *sqladmin.IpConfiguration) interface{} {
+func flattenIpConfiguration(ipConfiguration *sqladmin.IpConfiguration, d *schema.ResourceData) interface{} {
 	data := map[string]interface{}{
 		"ipv4_enabled":                                  ipConfiguration.Ipv4Enabled,
 		"private_network":                               ipConfiguration.PrivateNetwork,
@@ -2188,6 +2210,11 @@ func flattenIpConfiguration(ipConfiguration *sqladmin.IpConfiguration) interface
 		data["psc_config"] = flattenPscConfigs(ipConfiguration.PscConfig)
 	}
 
+        // We store the ssl_mode value only if the customer already uses `ssl_mode`.
+        if _, ok := d.GetOk("settings.0.ip_configuration.0.ssl_mode"); ok {
+                data["ssl_mode"] = ipConfiguration.SslMode
+        }
+
 	return []map[string]interface{}{data}
 }
 
@@ -2324,6 +2351,13 @@ func flattenPasswordValidationPolicy(passwordValidationPolicy *sqladmin.Password
 	return []map[string]interface{}{data}
 }
 
+func flattenEdition(v interface{}) string {
+	if v == nil || tpgresource.IsEmptyValue(reflect.ValueOf(v)) {
+		return "ENTERPRISE"
+	}
+
+	return v.(string)
+}
 
 func instanceMutexKey(project, instance_name string) string {
 	return fmt.Sprintf("google-sql-database-instance-%s-%s", project, instance_name)
diff --git a/mmv1/third_party/terraform/services/sql/resource_sql_database_instance_test.go b/mmv1/third_party/terraform/services/sql/resource_sql_database_instance_test.go
index 7f43e53d8870..6227aad58e80 100644
--- a/mmv1/third_party/terraform/services/sql/resource_sql_database_instance_test.go
+++ b/mmv1/third_party/terraform/services/sql/resource_sql_database_instance_test.go
@@ -178,8 +178,9 @@ func TestAccSqlDatabaseInstance_deleteDefaultUserBeforeSubsequentApiCalls(t *tes
 	t.Parallel()
 
 	databaseName := "tf-test-" + acctest.RandString(t, 10)
-	addressName := "tf-test-" + acctest.RandString(t, 10)
-	networkName := acctest.BootstrapSharedTestNetwork(t, "sql-instance-private-network-clone-2")
+	testId := "sql-instance-clone-2"
+	addressName := acctest.BootstrapSharedTestGlobalAddress(t, testId)
+	networkName := acctest.BootstrapSharedServiceNetworkingConnection(t, testId)
 
 	// 1. Create an instance.
 	// 2. Add a root@'%' user.
@@ -191,7 +192,7 @@ func TestAccSqlDatabaseInstance_deleteDefaultUserBeforeSubsequentApiCalls(t *tes
 		CheckDestroy:             testAccSqlDatabaseInstanceDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSqlDatabaseInstance_withPrivateNetwork_withoutAllocatedIpRange(databaseName, networkName, addressName, false, false),
+				Config: testAccSqlDatabaseInstance_withPrivateNetwork_withoutAllocatedIpRange(databaseName, networkName, false, false),
 			},
 			{
 				PreConfig: func() {
@@ -736,8 +737,7 @@ func TestAccSqlDatabaseInstance_withPrivateNetwork_withoutAllocatedIpRange(t *te
 	t.Parallel()
 
 	databaseName := "tf-test-" + acctest.RandString(t, 10)
-	addressName := "tf-test-" + acctest.RandString(t, 10)
-	networkName := acctest.BootstrapSharedTestNetwork(t, "sql-instance-private-network")
+	networkName := acctest.BootstrapSharedServiceNetworkingConnection(t, "sql-instance-1")
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -745,7 +745,7 @@ func TestAccSqlDatabaseInstance_withPrivateNetwork_withoutAllocatedIpRange(t *te
 		CheckDestroy:             testAccSqlDatabaseInstanceDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSqlDatabaseInstance_withPrivateNetwork_withoutAllocatedIpRange(databaseName, networkName, addressName, false, false),
+				Config: testAccSqlDatabaseInstance_withPrivateNetwork_withoutAllocatedIpRange(databaseName, networkName, false, false),
 			},
 			{
 				ResourceName:            "google_sql_database_instance.instance",
@@ -754,7 +754,7 @@ func TestAccSqlDatabaseInstance_withPrivateNetwork_withoutAllocatedIpRange(t *te
 				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccSqlDatabaseInstance_withPrivateNetwork_withoutAllocatedIpRange(databaseName, networkName, addressName, true, false),
+				Config: testAccSqlDatabaseInstance_withPrivateNetwork_withoutAllocatedIpRange(databaseName, networkName, true, false),
 			},
 			{
 				ResourceName:            "google_sql_database_instance.instance",
@@ -763,7 +763,7 @@ func TestAccSqlDatabaseInstance_withPrivateNetwork_withoutAllocatedIpRange(t *te
 				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccSqlDatabaseInstance_withPrivateNetwork_withoutAllocatedIpRange(databaseName, networkName, addressName, true, true),
+				Config: testAccSqlDatabaseInstance_withPrivateNetwork_withoutAllocatedIpRange(databaseName, networkName, true, true),
 			},
 			{
 				ResourceName:            "google_sql_database_instance.instance",
@@ -772,7 +772,7 @@ func TestAccSqlDatabaseInstance_withPrivateNetwork_withoutAllocatedIpRange(t *te
 				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccSqlDatabaseInstance_withPrivateNetwork_withoutAllocatedIpRange(databaseName, networkName, addressName, true, false),
+				Config: testAccSqlDatabaseInstance_withPrivateNetwork_withoutAllocatedIpRange(databaseName, networkName, true, false),
 			},
 			{
 				ResourceName:            "google_sql_database_instance.instance",
@@ -790,6 +790,7 @@ func TestAccSqlDatabaseInstance_withPSCEnabled_withoutAllowedConsumerProjects(t
 	instanceName := "tf-test-" + acctest.RandString(t, 10)
 	projectId := "psctestproject" + acctest.RandString(t, 10)
 	orgId := envvar.GetTestOrgFromEnv(t)
+	billingAccount := envvar.GetTestBillingAccountFromEnv(t)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -797,7 +798,7 @@ func TestAccSqlDatabaseInstance_withPSCEnabled_withoutAllowedConsumerProjects(t
 		CheckDestroy:             testAccSqlDatabaseInstanceDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSqlDatabaseInstance_withPSCEnabled_withoutAllowedConsumerProjects(instanceName, projectId, orgId),
+				Config: testAccSqlDatabaseInstance_withPSCEnabled_withoutAllowedConsumerProjects(instanceName, projectId, orgId, billingAccount),
 				Check:  resource.ComposeTestCheckFunc(verifyPscOperation("google_sql_database_instance.instance", true, true, nil)),
 			},
 			{
@@ -817,6 +818,7 @@ func TestAccSqlDatabaseInstance_withPSCEnabled_withEmptyAllowedConsumerProjects(
 	instanceName := "tf-test-" + acctest.RandString(t, 10)
 	projectId := "psctestproject" + acctest.RandString(t, 10)
 	orgId := envvar.GetTestOrgFromEnv(t)
+	billingAccount := envvar.GetTestBillingAccountFromEnv(t)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -824,7 +826,7 @@ func TestAccSqlDatabaseInstance_withPSCEnabled_withEmptyAllowedConsumerProjects(
 		CheckDestroy:             testAccSqlDatabaseInstanceDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSqlDatabaseInstance_withPSCEnabled_withEmptyAllowedConsumerProjects(instanceName, projectId, orgId),
+				Config: testAccSqlDatabaseInstance_withPSCEnabled_withEmptyAllowedConsumerProjects(instanceName, projectId, orgId, billingAccount),
 				Check:  resource.ComposeTestCheckFunc(verifyPscOperation("google_sql_database_instance.instance", true, true, []string{})),
 			},
 			{
@@ -844,6 +846,7 @@ func TestAccSqlDatabaseInstance_withPSCEnabled_withAllowedConsumerProjects(t *te
 	instanceName := "tf-test-" + acctest.RandString(t, 10)
 	projectId := "psctestproject" + acctest.RandString(t, 10)
 	orgId := envvar.GetTestOrgFromEnv(t)
+	billingAccount := envvar.GetTestBillingAccountFromEnv(t)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -851,7 +854,7 @@ func TestAccSqlDatabaseInstance_withPSCEnabled_withAllowedConsumerProjects(t *te
 		CheckDestroy:             testAccSqlDatabaseInstanceDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSqlDatabaseInstance_withPSCEnabled_withAllowedConsumerProjects(instanceName, projectId, orgId),
+				Config: testAccSqlDatabaseInstance_withPSCEnabled_withAllowedConsumerProjects(instanceName, projectId, orgId, billingAccount),
 				Check:  resource.ComposeTestCheckFunc(verifyPscOperation("google_sql_database_instance.instance", true, true, []string{envvar.GetTestProjectFromEnv()})),
 			},
 			{
@@ -871,6 +874,7 @@ func TestAccSqlDatabaseInstance_withPSCEnabled_thenAddAllowedConsumerProjects_th
 	instanceName := "tf-test-" + acctest.RandString(t, 10)
 	projectId := "psctestproject" + acctest.RandString(t, 10)
 	orgId := envvar.GetTestOrgFromEnv(t)
+	billingAccount := envvar.GetTestBillingAccountFromEnv(t)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -878,7 +882,7 @@ func TestAccSqlDatabaseInstance_withPSCEnabled_thenAddAllowedConsumerProjects_th
 		CheckDestroy:             testAccSqlDatabaseInstanceDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSqlDatabaseInstance_withPSCEnabled_withoutAllowedConsumerProjects(instanceName, projectId, orgId),
+				Config: testAccSqlDatabaseInstance_withPSCEnabled_withoutAllowedConsumerProjects(instanceName, projectId, orgId, billingAccount),
 				Check:  resource.ComposeTestCheckFunc(verifyPscOperation("google_sql_database_instance.instance", true, true, nil)),
 			},
 			{
@@ -889,7 +893,7 @@ func TestAccSqlDatabaseInstance_withPSCEnabled_thenAddAllowedConsumerProjects_th
 				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccSqlDatabaseInstance_withPSCEnabled_withAllowedConsumerProjects(instanceName, projectId, orgId),
+				Config: testAccSqlDatabaseInstance_withPSCEnabled_withAllowedConsumerProjects(instanceName, projectId, orgId, billingAccount),
 				Check:  resource.ComposeTestCheckFunc(verifyPscOperation("google_sql_database_instance.instance", true, true, []string{envvar.GetTestProjectFromEnv()})),
 			},
 			{
@@ -900,7 +904,7 @@ func TestAccSqlDatabaseInstance_withPSCEnabled_thenAddAllowedConsumerProjects_th
 				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config: testAccSqlDatabaseInstance_withPSCEnabled_withoutAllowedConsumerProjects(instanceName, projectId, orgId),
+				Config: testAccSqlDatabaseInstance_withPSCEnabled_withoutAllowedConsumerProjects(instanceName, projectId, orgId, billingAccount),
 				Check:  resource.ComposeTestCheckFunc(verifyPscOperation("google_sql_database_instance.instance", true, true, []string{})),
 			},
 			{
@@ -920,6 +924,7 @@ func TestAccSqlDatabaseInstance_basicInstance_thenPSCEnabled(t *testing.T) {
 	instanceName := "tf-test-" + acctest.RandString(t, 10)
 	projectId := "psctestproject" + acctest.RandString(t, 10)
 	orgId := envvar.GetTestOrgFromEnv(t)
+	billingAccount := envvar.GetTestBillingAccountFromEnv(t)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -927,7 +932,7 @@ func TestAccSqlDatabaseInstance_basicInstance_thenPSCEnabled(t *testing.T) {
 		CheckDestroy:             testAccSqlDatabaseInstanceDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSqlDatabaseInstance_basicInstanceForPsc(instanceName, projectId, orgId),
+				Config: testAccSqlDatabaseInstance_basicInstanceForPsc(instanceName, projectId, orgId, billingAccount),
 			},
 			{
 				ResourceName:            "google_sql_database_instance.instance",
@@ -937,7 +942,7 @@ func TestAccSqlDatabaseInstance_basicInstance_thenPSCEnabled(t *testing.T) {
 				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
-				Config:      testAccSqlDatabaseInstance_withPSCEnabled_withoutAllowedConsumerProjects(instanceName, projectId, orgId),
+				Config:      testAccSqlDatabaseInstance_withPSCEnabled_withoutAllowedConsumerProjects(instanceName, projectId, orgId, billingAccount),
 				ExpectError: regexp.MustCompile("PSC connectivity can not be enabled"),
 			},
 		},
@@ -950,6 +955,7 @@ func TestAccSqlDatabaseInstance_withPSCEnabled_withIpV4Enabled(t *testing.T) {
 	instanceName := "tf-test-" + acctest.RandString(t, 10)
 	projectId := "psctestproject" + acctest.RandString(t, 10)
 	orgId := envvar.GetTestOrgFromEnv(t)
+	billingAccount := envvar.GetTestBillingAccountFromEnv(t)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -957,7 +963,7 @@ func TestAccSqlDatabaseInstance_withPSCEnabled_withIpV4Enabled(t *testing.T) {
 		CheckDestroy:             testAccSqlDatabaseInstanceDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config:      testAccSqlDatabaseInstance_withPSCEnabled_withIpV4Enable(instanceName, projectId, orgId),
+				Config:      testAccSqlDatabaseInstance_withPSCEnabled_withIpV4Enable(instanceName, projectId, orgId, billingAccount),
 				ExpectError: regexp.MustCompile("PSC connectivity cannot be enabled together with public IP"),
 			},
 		},
@@ -969,10 +975,14 @@ func TestAccSqlDatabaseInstance_withPrivateNetwork_withAllocatedIpRange(t *testi
 	t.Parallel()
 
 	databaseName := "tf-test-" + acctest.RandString(t, 10)
-	addressName := "tf-test-" + acctest.RandString(t, 10)
-	networkName := acctest.BootstrapSharedTestNetwork(t, "sql-instance-private-network-allocated")
-	addressName_update := "tf-test-" + acctest.RandString(t, 10) + "update"
-	networkName_update := acctest.BootstrapSharedTestNetwork(t, "sql-instance-private-network-allocated-update")
+
+	testId := "sql-instance-allocated-1"
+	addressName := acctest.BootstrapSharedTestGlobalAddress(t, testId)
+	networkName := acctest.BootstrapSharedServiceNetworkingConnection(t, testId)
+
+	updateTestId := "sql-instance-allocated-update-1"
+	addressName_update := acctest.BootstrapSharedTestGlobalAddress(t, updateTestId)
+	networkName_update := acctest.BootstrapSharedServiceNetworkingConnection(t, updateTestId)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -1006,8 +1016,10 @@ func TestAccSqlDatabaseInstance_withPrivateNetwork_withAllocatedIpRangeReplica(t
 	t.Parallel()
 
 	databaseName := "tf-test-" + acctest.RandString(t, 10)
-	addressName := "tf-test-" + acctest.RandString(t, 10)
-	networkName := acctest.BootstrapSharedTestNetwork(t, "sql-instance-private-network-replica")
+
+	testId := "sql-instance-replica-1"
+	addressName := acctest.BootstrapSharedTestGlobalAddress(t, testId)
+	networkName := acctest.BootstrapSharedServiceNetworkingConnection(t, testId)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -1038,8 +1050,9 @@ func TestAccSqlDatabaseInstance_withPrivateNetwork_withAllocatedIpRangeClone(t *
 	t.Parallel()
 
 	databaseName := "tf-test-" + acctest.RandString(t, 10)
-	addressName := "tf-test-" + acctest.RandString(t, 10)
-	networkName := acctest.BootstrapSharedTestNetwork(t, "sql-instance-private-network-clone")
+	testId := "sql-instance-clone-1"
+	addressName := acctest.BootstrapSharedTestGlobalAddress(t, testId)
+	networkName := acctest.BootstrapSharedServiceNetworkingConnection(t, testId)
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -1439,8 +1452,7 @@ func TestAccSqlDatabaseInstance_ActiveDirectory(t *testing.T) {
 
 	t.Parallel()
 	databaseName := "tf-test-" + acctest.RandString(t, 10)
-	networkName := acctest.BootstrapSharedTestNetwork(t, "sql-instance-private-test-ad")
-	addressName := "tf-test-" + acctest.RandString(t, 10)
+	networkName := acctest.BootstrapSharedServiceNetworkingConnection(t, "sql-instance-ad-1")
 	rootPassword := acctest.RandString(t, 15)
 	adDomainName := acctest.BootstrapSharedTestADDomain(t, "test-domain", networkName)
 
@@ -1450,7 +1462,7 @@ func TestAccSqlDatabaseInstance_ActiveDirectory(t *testing.T) {
 		CheckDestroy:             testAccSqlDatabaseInstanceDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
-				Config: testGoogleSqlDatabaseInstance_ActiveDirectoryConfig(databaseName, networkName, addressName, rootPassword, adDomainName),
+				Config: testGoogleSqlDatabaseInstance_ActiveDirectoryConfig(databaseName, networkName, rootPassword, adDomainName),
 			},
 			{
 				ResourceName:            "google_sql_database_instance.instance-with-ad",
@@ -1492,13 +1504,30 @@ func TestAccSqlDatabaseInstance_Edition(t *testing.T) {
 	enterprisePlusTier := "db-perf-optimized-N-2"
 	enterpriseName := "tf-test-enterprise-" + acctest.RandString(t, 10)
 	enterpriseTier := "db-custom-2-13312"
+	noEditionName := "tf-test-enterprise-noedition-" + acctest.RandString(t, 10)
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
 		CheckDestroy:             testAccSqlDatabaseInstanceDestroyProducer(t),
 		Steps: []resource.TestStep{
+			{
+				Config: testGoogleSqlDatabaseInstance_EditionConfig_noEdition(noEditionName, enterpriseTier),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr("google_sql_database_instance.instance", "settings.0.edition", "ENTERPRISE"),
+				),
+			},
+			{
+				ResourceName:            "google_sql_database_instance.instance",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
+			},
+			// Delete and recreate (ForceNew) triggered by passing in a new `name` value
 			{
 				Config: testGoogleSqlDatabaseInstance_EditionConfig(enterprisePlusName, enterprisePlusTier, "ENTERPRISE_PLUS"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr("google_sql_database_instance.instance", "settings.0.edition", "ENTERPRISE_PLUS"),
+				),
 			},
 			{
 				ResourceName:            "google_sql_database_instance.instance",
@@ -1506,8 +1535,12 @@ func TestAccSqlDatabaseInstance_Edition(t *testing.T) {
 				ImportStateVerify:       true,
 				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
+			// Delete and recreate (ForceNew) triggered by passing in a new `name` value
 			{
 				Config: testGoogleSqlDatabaseInstance_EditionConfig(enterpriseName, enterpriseTier, "ENTERPRISE"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr("google_sql_database_instance.instance", "settings.0.edition", "ENTERPRISE"),
+				),
 			},
 			{
 				ResourceName:            "google_sql_database_instance.instance",
@@ -1540,6 +1573,38 @@ func TestAccSQLDatabaseInstance_sqlMysqlDataCacheConfig(t *testing.T) {
 	})
 }
 
+func TestAccSQLDatabaseInstance_sqlPostgresDataCacheConfig(t *testing.T) {
+	t.Parallel()
+	enterprisePlusInstanceName := "tf-test-enterprise-plus" + acctest.RandString(t, 10)
+	enterprisePlusTier := "db-perf-optimized-N-2"
+	enterpriseInstanceName := "tf-test-enterprise-" + acctest.RandString(t, 10)
+	enterpriseTier := "db-custom-2-13312"
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccSqlDatabaseInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testGoogleSqlDatabaseInstance_sqlPostgresDataCacheConfig(enterprisePlusInstanceName, enterprisePlusTier, "ENTERPRISE_PLUS"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr("google_sql_database_instance.instance", "settings.0.data_cache_config.0.data_cache_enabled", "true"),
+				),
+			},
+			{
+				ResourceName:            "google_sql_database_instance.instance",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
+			},
+			{
+				Config: testGoogleSqlDatabaseInstance_sqlPostgresDataCacheConfig(enterpriseInstanceName, enterpriseTier, "ENTERPRISE"),
+				ExpectError: regexp.MustCompile(
+					fmt.Sprintf("Error, failed to create instance %s: googleapi: Error 400: Invalid request: Only ENTERPRISE PLUS edition supports data cache.., invalid", enterpriseInstanceName)),
+			},
+		},
+	})
+}
+
 func TestAccSqlDatabaseInstance_SqlServerAuditConfig(t *testing.T) {
 	// Service Networking
 	acctest.SkipIfVcr(t)
@@ -1671,6 +1736,34 @@ func TestAccSqlDatabaseInstance_Timezone(t *testing.T) {
 	})
 }
 
+func TestAccSqlDatabaseInstance_updateDifferentFlagOrder(t *testing.T) {
+	t.Parallel()
+
+	instance := "tf-test-" + acctest.RandString(t, 10)
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccSqlDatabaseInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testGoogleSqlDatabaseInstance_flags(instance),
+			},
+			{
+				ResourceName:            "google_sql_database_instance.instance",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
+			},
+			{
+				Config:             testGoogleSqlDatabaseInstance_flags_update(instance),
+				PlanOnly:           true,
+				ExpectNonEmptyPlan: false,
+			},
+		},
+	})
+}
+
 func TestAccSqlDatabaseInstance_sqlMysqlInstancePvpExample(t *testing.T) {
 	t.Parallel()
 
@@ -2053,6 +2146,94 @@ func TestAccSqlDatabaseInstance_ReplicaPromoteSkippedWithNoMasterInstanceNameAnd
 	})
 }
 
+func TestAccSqlDatabaseInstance_updateSslOptionsForPostgreSQL(t *testing.T) {
+	t.Parallel()
+
+	databaseName := "tf-test-" + acctest.RandString(t, 10)
+	databaseVersion := "POSTGRES_14"
+	resourceName := "google_sql_database_instance.instance"
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccSqlDatabaseInstanceDestroyProducer(t),
+
+		// We don't do ImportStateVerify for the ssl_mode because of the implementation. The ssl_mode is expected to be discarded if the local state doesn't have it.
+		Steps: []resource.TestStep{
+			{
+				Config: testGoogleSqlDatabaseInstance_setSslOptionsForPostgreSQL(databaseName, databaseVersion, false, "ALLOW_UNENCRYPTED_AND_ENCRYPTED"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "settings.0.ip_configuration.0.require_ssl", "false"),
+					resource.TestCheckResourceAttr(resourceName, "settings.0.ip_configuration.0.ssl_mode", "ALLOW_UNENCRYPTED_AND_ENCRYPTED"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection", "settings.0.ip_configuration.0.ssl_mode"},
+			},
+			{
+				Config: testGoogleSqlDatabaseInstance_setSslOptionsForPostgreSQL(databaseName, databaseVersion, false, "ENCRYPTED_ONLY"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "settings.0.ip_configuration.0.require_ssl", "false"),
+					resource.TestCheckResourceAttr(resourceName, "settings.0.ip_configuration.0.ssl_mode", "ENCRYPTED_ONLY"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection", "settings.0.ip_configuration.0.ssl_mode"},
+			},
+			{
+				Config: testGoogleSqlDatabaseInstance_setSslOptionsForPostgreSQL(databaseName, databaseVersion, true, "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "settings.0.ip_configuration.0.require_ssl", "true"),
+					resource.TestCheckResourceAttr(resourceName, "settings.0.ip_configuration.0.ssl_mode", "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection", "settings.0.ip_configuration.0.ssl_mode"},
+			},
+			{
+				Config: testGoogleSqlDatabaseInstance_setSslOptionsForPostgreSQL(databaseName, databaseVersion, false, "ALLOW_UNENCRYPTED_AND_ENCRYPTED"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "settings.0.ip_configuration.0.require_ssl", "false"),
+					resource.TestCheckResourceAttr(resourceName, "settings.0.ip_configuration.0.ssl_mode", "ALLOW_UNENCRYPTED_AND_ENCRYPTED"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_protection", "settings.0.ip_configuration.0.ssl_mode"},
+			},
+		},
+	})
+}
+
+func testGoogleSqlDatabaseInstance_setSslOptionsForPostgreSQL(databaseName string, databaseVersion string, requireSsl bool, sslMode string) string {
+	return fmt.Sprintf(`
+resource "google_sql_database_instance" "instance" {
+  name                = "%s"
+  region              = "us-central1"
+  database_version    = "%s"
+  deletion_protection = false
+  settings {
+    tier = "db-f1-micro"
+    ip_configuration {
+      ipv4_enabled = true
+      require_ssl = %t
+      ssl_mode = "%s"
+    }
+  }
+}`, databaseName, databaseVersion, requireSsl, sslMode)
+}
+
 func testAccSqlDatabaseInstance_sqlMysqlInstancePvpExample(context map[string]interface{}) string {
 	return acctest.Nprintf(`
 resource "google_sql_database_instance" "mysql_pvp_instance_name" {
@@ -2140,28 +2321,13 @@ resource "google_sql_database_instance" "instance" {
 }
 `
 
-func testGoogleSqlDatabaseInstance_ActiveDirectoryConfig(databaseName, networkName, addressRangeName, rootPassword, adDomainName string) string {
+func testGoogleSqlDatabaseInstance_ActiveDirectoryConfig(databaseName, networkName, rootPassword, adDomainName string) string {
 	return fmt.Sprintf(`
 data "google_compute_network" "servicenet" {
   name                    = "%s"
 }
 
-resource "google_compute_global_address" "foobar" {
-  name          = "%s"
-  purpose       = "VPC_PEERING"
-  address_type  = "INTERNAL"
-  prefix_length = 16
-  network       = data.google_compute_network.servicenet.self_link
-}
-
-resource "google_service_networking_connection" "foobar" {
-  network                 = data.google_compute_network.servicenet.self_link
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.foobar.name]
-}
-
 resource "google_sql_database_instance" "instance-with-ad" {
-  depends_on = [google_service_networking_connection.foobar]
   name             = "%s"
   region           = "us-central1"
   database_version = "SQLSERVER_2017_STANDARD"
@@ -2178,7 +2344,7 @@ resource "google_sql_database_instance" "instance-with-ad" {
       domain = "%s"
     }
   }
-}`, networkName, addressRangeName, databaseName, rootPassword, adDomainName)
+}`, networkName, databaseName, rootPassword, adDomainName)
 }
 
 func testGoogleSqlDatabaseInstance_DenyMaintenancePeriodConfig(databaseName, endDate, startDate, time string) string {
@@ -2200,6 +2366,20 @@ resource "google_sql_database_instance" "instance" {
 }`, databaseName, endDate, startDate, time)
 }
 
+func testGoogleSqlDatabaseInstance_EditionConfig_noEdition(databaseName, tier string) string {
+	return fmt.Sprintf(`
+
+resource "google_sql_database_instance" "instance" {
+  name             = "%s"
+  region           = "us-east1"
+  database_version    = "POSTGRES_14"
+  deletion_protection = false
+  settings {
+    tier = "%s"
+  }
+}`, databaseName, tier)
+}
+
 func testGoogleSqlDatabaseInstance_EditionConfig(databaseName, tier, edition string) string {
 	return fmt.Sprintf(`
 
@@ -2233,6 +2413,24 @@ resource "google_sql_database_instance" "instance" {
 }`, instanceName)
 }
 
+func testGoogleSqlDatabaseInstance_sqlPostgresDataCacheConfig(instanceName, tier, edition string) string {
+	return fmt.Sprintf(`
+
+resource "google_sql_database_instance" "instance" {
+  name             = "%s"
+  region           = "us-east1"
+  database_version    = "POSTGRES_14"
+  deletion_protection = false
+  settings {
+    tier = "%s"
+    edition = "%s"
+    data_cache_config {
+        data_cache_enabled = true
+    }
+  }
+}`, instanceName, tier, edition)
+}
+
 func testGoogleSqlDatabaseInstance_SqlServerAuditConfig(databaseName, rootPassword, bucketName, uploadInterval, retentionInterval string) string {
 	return fmt.Sprintf(`
 resource "google_storage_bucket" "gs-bucket" {
@@ -2572,12 +2770,13 @@ resource "google_sql_database_instance" "instance-failover" {
 `, instanceName, failoverName)
 }
 
-func testAccSqlDatabaseInstance_basicInstanceForPsc(instanceName string, projectId string, orgId string) string {
+func testAccSqlDatabaseInstance_basicInstanceForPsc(instanceName string, projectId string, orgId string, billingAccount string) string {
 	return fmt.Sprintf(`
 resource "google_project" "testproject" {
   name                = "%s"
   project_id          = "%s"
   org_id              = "%s"
+  billing_account     = "%s"
 }
 
 resource "google_sql_database_instance" "instance" {
@@ -2595,15 +2794,16 @@ resource "google_sql_database_instance" "instance" {
 	availability_type = "REGIONAL"
   }
 }
-`, projectId, projectId, orgId, instanceName)
+`, projectId, projectId, orgId, billingAccount, instanceName)
 }
 
-func testAccSqlDatabaseInstance_withPSCEnabled_withIpV4Enable(instanceName string, projectId string, orgId string) string {
+func testAccSqlDatabaseInstance_withPSCEnabled_withIpV4Enable(instanceName string, projectId string, orgId string, billingAccount string) string {
 	return fmt.Sprintf(`
 resource "google_project" "testproject" {
   name                = "%s"
   project_id          = "%s"
   org_id              = "%s"
+  billing_account     = "%s"
 }
 
 resource "google_sql_database_instance" "instance" {
@@ -2627,15 +2827,16 @@ resource "google_sql_database_instance" "instance" {
 	availability_type = "REGIONAL"
   }
 }
-`, projectId, projectId, orgId, instanceName)
+`, projectId, projectId, orgId, billingAccount, instanceName)
 }
 
-func testAccSqlDatabaseInstance_withPSCEnabled_withoutAllowedConsumerProjects(instanceName string, projectId string, orgId string) string {
+func testAccSqlDatabaseInstance_withPSCEnabled_withoutAllowedConsumerProjects(instanceName string, projectId string, orgId string, billingAccount string) string {
 	return fmt.Sprintf(`
 resource "google_project" "testproject" {
   name                = "%s"
   project_id          = "%s"
   org_id              = "%s"
+  billing_account     = "%s"
 }
 
 resource "google_sql_database_instance" "instance" {
@@ -2659,15 +2860,16 @@ resource "google_sql_database_instance" "instance" {
 	availability_type = "REGIONAL"
   }
 }
-`, projectId, projectId, orgId, instanceName)
+`, projectId, projectId, orgId, billingAccount, instanceName)
 }
 
-func testAccSqlDatabaseInstance_withPSCEnabled_withEmptyAllowedConsumerProjects(instanceName string, projectId string, orgId string) string {
+func testAccSqlDatabaseInstance_withPSCEnabled_withEmptyAllowedConsumerProjects(instanceName string, projectId string, orgId string, billingAccount string) string {
 	return fmt.Sprintf(`
 resource "google_project" "testproject" {
   name                = "%s"
   project_id          = "%s"
   org_id              = "%s"
+  billing_account     = "%s"
 }
 
 resource "google_sql_database_instance" "instance" {
@@ -2692,16 +2894,18 @@ resource "google_sql_database_instance" "instance" {
 	availability_type = "REGIONAL"
   }
 }
-`, projectId, projectId, orgId, instanceName)
+`, projectId, projectId, orgId, billingAccount, instanceName)
 }
 
-func testAccSqlDatabaseInstance_withPSCEnabled_withAllowedConsumerProjects(instanceName string, projectId string, orgId string) string {
+func testAccSqlDatabaseInstance_withPSCEnabled_withAllowedConsumerProjects(instanceName string, projectId string, orgId string, billingAccount string) string {
 	return fmt.Sprintf(`
 resource "google_project" "testproject" {
   name                = "%s"
   project_id          = "%s"
   org_id              = "%s"
+  billing_account     = "%s"
 }
+
 resource "google_sql_database_instance" "instance" {
   project             = google_project.testproject.project_id
   name                = "%s"
@@ -2724,7 +2928,7 @@ resource "google_sql_database_instance" "instance" {
 	availability_type = "REGIONAL"
   }
 }
-`, projectId, projectId, orgId, instanceName, projectId)
+`, projectId, projectId, orgId, billingAccount, instanceName, projectId)
 }
 
 func verifyPscOperation(resourceName string, isPscConfigExpected bool, expectedPscEnabled bool, expectedAllowedConsumerProjects []string) func(*terraform.State) error {
@@ -2763,7 +2967,7 @@ func verifyPscOperation(resourceName string, isPscConfigExpected bool, expectedP
 	}
 }
 
-func testAccSqlDatabaseInstance_withPrivateNetwork_withoutAllocatedIpRange(databaseName, networkName, addressRangeName string, specifyPrivatePathOption bool, enablePrivatePath bool) string {
+func testAccSqlDatabaseInstance_withPrivateNetwork_withoutAllocatedIpRange(databaseName, networkName string, specifyPrivatePathOption bool, enablePrivatePath bool) string {
 	privatePathOption := ""
 	if specifyPrivatePathOption {
 		privatePathOption = fmt.Sprintf("enable_private_path_for_google_cloud_services = %t", enablePrivatePath)
@@ -2774,22 +2978,7 @@ data "google_compute_network" "servicenet" {
   name                    = "%s"
 }
 
-resource "google_compute_global_address" "foobar" {
-  name          = "%s"
-  purpose       = "VPC_PEERING"
-  address_type  = "INTERNAL"
-  prefix_length = 16
-  network       = data.google_compute_network.servicenet.self_link
-}
-
-resource "google_service_networking_connection" "foobar" {
-  network                 = data.google_compute_network.servicenet.self_link
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.foobar.name]
-}
-
 resource "google_sql_database_instance" "instance" {
-  depends_on = [google_service_networking_connection.foobar]
   name                = "%s"
   region              = "us-central1"
   database_version    = "MYSQL_5_7"
@@ -2803,7 +2992,7 @@ resource "google_sql_database_instance" "instance" {
     }
   }
 }
-`, networkName, addressRangeName, databaseName, privatePathOption)
+`, networkName, databaseName, privatePathOption)
 }
 
 func testAccSqlDatabaseInstance_withPrivateNetwork_withAllocatedIpRange(databaseName, networkName, addressRangeName string) string {
@@ -2812,22 +3001,7 @@ data "google_compute_network" "servicenet" {
   name                    = "%s"
 }
 
-resource "google_compute_global_address" "foobar" {
-  name          = "%s"
-  purpose       = "VPC_PEERING"
-  address_type  = "INTERNAL"
-  prefix_length = 16
-  network       = data.google_compute_network.servicenet.self_link
-}
-
-resource "google_service_networking_connection" "foobar" {
-  network                 = data.google_compute_network.servicenet.self_link
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.foobar.name]
-}
-
 resource "google_sql_database_instance" "instance" {
-  depends_on = [google_service_networking_connection.foobar]
   name                = "%s"
   region              = "us-central1"
   database_version    = "MYSQL_5_7"
@@ -2837,11 +3011,11 @@ resource "google_sql_database_instance" "instance" {
     ip_configuration {
       ipv4_enabled       = "false"
       private_network    = data.google_compute_network.servicenet.self_link
-      allocated_ip_range = google_compute_global_address.foobar.name
+      allocated_ip_range = "%s"
     }
   }
 }
-`, networkName, addressRangeName, databaseName)
+`, networkName, databaseName, addressRangeName)
 }
 
 func testAccSqlDatabaseInstance_withPrivateNetwork_withAllocatedIpRangeReplica(databaseName, networkName, addressRangeName string) string {
@@ -2850,22 +3024,7 @@ data "google_compute_network" "servicenet" {
   name                    = "%s"
 }
 
-resource "google_compute_global_address" "foobar" {
-  name          = "%s"
-  purpose       = "VPC_PEERING"
-  address_type  = "INTERNAL"
-  prefix_length = 16
-  network       = data.google_compute_network.servicenet.self_link
-}
-
-resource "google_service_networking_connection" "foobar" {
-  network                 = data.google_compute_network.servicenet.self_link
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.foobar.name]
-}
-
 resource "google_sql_database_instance" "instance" {
-  depends_on = [google_service_networking_connection.foobar]
   name                = "%s"
   region              = "us-central1"
   database_version    = "MYSQL_5_7"
@@ -2884,7 +3043,6 @@ resource "google_sql_database_instance" "instance" {
   }
 }
 resource "google_sql_database_instance" "replica1" {
-  depends_on = [google_service_networking_connection.foobar]
   name                = "%s-replica1"
   region              = "us-central1"
   database_version    = "MYSQL_5_7"
@@ -2894,7 +3052,7 @@ resource "google_sql_database_instance" "replica1" {
     ip_configuration {
       ipv4_enabled       = "false"
       private_network    = data.google_compute_network.servicenet.self_link
-      allocated_ip_range = google_compute_global_address.foobar.name
+      allocated_ip_range = "%s"
     }
   }
 
@@ -2909,7 +3067,7 @@ resource "google_sql_database_instance" "replica1" {
     verify_server_certificate = false
   }
 }
-`, networkName, addressRangeName, databaseName, databaseName)
+`, networkName, databaseName, databaseName, addressRangeName)
 }
 
 func testAccSqlDatabaseInstance_withPrivateNetwork_withAllocatedIpRangeClone(databaseName, networkName, addressRangeName string) string {
@@ -2918,22 +3076,7 @@ data "google_compute_network" "servicenet" {
   name                    = "%s"
 }
 
-resource "google_compute_global_address" "foobar" {
-  name          = "%s"
-  purpose       = "VPC_PEERING"
-  address_type  = "INTERNAL"
-  prefix_length = 16
-  network       = data.google_compute_network.servicenet.self_link
-}
-
-resource "google_service_networking_connection" "foobar" {
-  network                 = data.google_compute_network.servicenet.self_link
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.foobar.name]
-}
-
 resource "google_sql_database_instance" "instance" {
-  depends_on = [google_service_networking_connection.foobar]
   name                = "%s"
   region              = "us-central1"
   database_version    = "MYSQL_5_7"
@@ -2960,11 +3103,11 @@ resource "google_sql_database_instance" "clone1" {
 
   clone {
     source_instance_name = google_sql_database_instance.instance.name
-    allocated_ip_range   = google_compute_global_address.foobar.name
+    allocated_ip_range   = "%s"
   }
 
 }
-`, networkName, addressRangeName, databaseName, databaseName)
+`, networkName, databaseName, databaseName, addressRangeName)
 }
 
 func testAccSqlDatabaseInstance_withPrivateNetwork_withAllocatedIpRangeClone_withSettings(databaseName, networkName, addressRangeName string) string {
@@ -2973,22 +3116,7 @@ data "google_compute_network" "servicenet" {
   name                    = "%s"
 }
 
-resource "google_compute_global_address" "foobar" {
-  name          = "%s"
-  purpose       = "VPC_PEERING"
-  address_type  = "INTERNAL"
-  prefix_length = 16
-  network       = data.google_compute_network.servicenet.self_link
-}
-
-resource "google_service_networking_connection" "foobar" {
-  network                 = data.google_compute_network.servicenet.self_link
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.foobar.name]
-}
-
 resource "google_sql_database_instance" "instance" {
-  depends_on = [google_service_networking_connection.foobar]
   name                = "%s"
   region              = "us-central1"
   database_version    = "MYSQL_5_7"
@@ -3015,7 +3143,7 @@ resource "google_sql_database_instance" "clone1" {
 
   clone {
     source_instance_name = google_sql_database_instance.instance.name
-    allocated_ip_range   = google_compute_global_address.foobar.name
+    allocated_ip_range   = "%s"
   }
 
   settings {
@@ -3025,7 +3153,7 @@ resource "google_sql_database_instance" "clone1" {
     }
   }
 }
-`, networkName, addressRangeName, databaseName, databaseName)
+`, networkName, databaseName, databaseName, addressRangeName)
 }
 
 var testGoogleSqlDatabaseInstance_settings = `
@@ -3715,6 +3843,7 @@ resource "google_sql_database_instance" "instance" {
   clone {
     source_instance_name = data.google_sql_backup_run.backup.instance
     point_in_time = data.google_sql_backup_run.backup.start_time
+	preferred_zone = "us-central1-b"
   }
 
   deletion_protection = false
@@ -3830,6 +3959,50 @@ func checkInstanceTypeIsPresent(resourceName string) func(*terraform.State) erro
 	}
 }
 
+func testGoogleSqlDatabaseInstance_flags(instance string) string {
+	return fmt.Sprintf(`
+resource "google_sql_database_instance" "instance" {
+  name                = "%s"
+  region              = "us-central1"
+  database_version    = "MYSQL_5_7"
+  deletion_protection = false
+  settings {
+    tier = "db-f1-micro"
+
+    database_flags {
+      name  = "character_set_server"
+      value = "utf8mb4"
+    }
+    database_flags {
+      name  = "auto_increment_increment"
+      value = "2"
+    }
+  }
+}`, instance)
+}
+
+func testGoogleSqlDatabaseInstance_flags_update(instance string) string {
+	return fmt.Sprintf(`
+resource "google_sql_database_instance" "instance" {
+  name                = "%s"
+  region              = "us-central1"
+  database_version    = "MYSQL_5_7"
+  deletion_protection = false
+  settings {
+    tier = "db-f1-micro"
+
+    database_flags {
+      name  = "auto_increment_increment"
+      value = "2"
+    }
+    database_flags {
+      name  = "character_set_server"
+      value = "utf8mb4"
+    }
+  }
+}`, instance)
+}
+
 func testGoogleSqlDatabaseInstance_readReplica(instance string) string {
 	return fmt.Sprintf(`
 resource "google_sql_database_instance" "master" {
diff --git a/mmv1/third_party/terraform/services/sql/resource_sql_ssl_cert.go b/mmv1/third_party/terraform/services/sql/resource_sql_ssl_cert.go
index 116a9b682f86..374230343810 100644
--- a/mmv1/third_party/terraform/services/sql/resource_sql_ssl_cert.go
+++ b/mmv1/third_party/terraform/services/sql/resource_sql_ssl_cert.go
@@ -8,6 +8,7 @@ import (
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	sqladmin "google.golang.org/api/sqladmin/v1beta4"
 )
@@ -25,6 +26,10 @@ func ResourceSqlSslCert() *schema.Resource {
 			Delete: schema.DefaultTimeout(10 * time.Minute),
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+		),
+
 		Schema: map[string]*schema.Schema{
 			"common_name": {
 				Type:        schema.TypeString,
diff --git a/mmv1/third_party/terraform/services/sql/resource_sql_user.go b/mmv1/third_party/terraform/services/sql/resource_sql_user.go
index d0ee4d85bc0b..599e55df39f7 100644
--- a/mmv1/third_party/terraform/services/sql/resource_sql_user.go
+++ b/mmv1/third_party/terraform/services/sql/resource_sql_user.go
@@ -10,6 +10,7 @@ import (
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 
 	"github.com/hashicorp/errwrap"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	sqladmin "google.golang.org/api/sqladmin/v1beta4"
@@ -56,6 +57,10 @@ func ResourceSqlUser() *schema.Resource {
 			Delete: schema.DefaultTimeout(10 * time.Minute),
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+		),
+
 		SchemaVersion: 1,
 		MigrateState:  resourceSqlUserMigrateState,
 
diff --git a/mmv1/third_party/terraform/services/storage/data_source_google_storage_project_service_account.go b/mmv1/third_party/terraform/services/storage/data_source_google_storage_project_service_account.go
index 0b248d5b53ca..188627eb2838 100644
--- a/mmv1/third_party/terraform/services/storage/data_source_google_storage_project_service_account.go
+++ b/mmv1/third_party/terraform/services/storage/data_source_google_storage_project_service_account.go
@@ -55,7 +55,7 @@ func dataSourceGoogleStorageProjectServiceAccountRead(d *schema.ResourceData, me
 
 	serviceAccount, err := serviceAccountGetRequest.Do()
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, "GCS service account not found")
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, "GCS service account not found", fmt.Sprintf("Project %q GCS service account", project))
 	}
 
 	if err := d.Set("project", project); err != nil {
diff --git a/mmv1/third_party/terraform/services/storage/resource_storage_bucket.go.erb b/mmv1/third_party/terraform/services/storage/resource_storage_bucket.go.erb
index fcfc331523d7..7703e96c17f2 100644
--- a/mmv1/third_party/terraform/services/storage/resource_storage_bucket.go.erb
+++ b/mmv1/third_party/terraform/services/storage/resource_storage_bucket.go.erb
@@ -37,6 +37,7 @@ func ResourceStorageBucket() *schema.Resource {
 		},
 		CustomizeDiff: customdiff.All(
 			customdiff.ForceNewIfChange("retention_policy.0.is_locked", isPolicyLocked),
+			tpgresource.SetLabelsDiff,
 		),
 
 		Timeouts: &schema.ResourceTimeout{
@@ -45,6 +46,15 @@ func ResourceStorageBucket() *schema.Resource {
 			Read:   schema.DefaultTimeout(4 * time.Minute),
 		},
 
+		SchemaVersion: 1,
+		StateUpgraders: []schema.StateUpgrader{
+			{
+				Type:    resourceStorageBucketV0().CoreConfigSchema().ImpliedType(),
+				Upgrade: ResourceStorageBucketStateUpgradeV0,
+				Version: 0,
+			},
+		},
+
 		Schema: map[string]*schema.Schema{
 			"name": {
 				Type:        schema.TypeString,
@@ -85,13 +95,24 @@ func ResourceStorageBucket() *schema.Resource {
 			"labels": {
 				Type:        schema.TypeMap,
 				Optional:    true,
-				Computed:    true,
-				// GCP (Dataplex) automatically adds labels
-				DiffSuppressFunc: resourceDataplexLabelDiffSuppress,
 				Elem:        &schema.Schema{Type: schema.TypeString},
 				Description: `A set of key/value label pairs to assign to the bucket.`,
 			},
 
+			"terraform_labels": {
+				Type:        schema.TypeMap,
+				Computed:    true,
+				Description: `The combination of labels configured directly on the resource and default labels configured on the provider.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+			},
+
+			"effective_labels": {
+				Type:        schema.TypeMap,
+				Computed:    true,
+				Description: `All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+			},
+
 			"location": {
 				Type:     schema.TypeString,
 				Required: true,
@@ -235,6 +256,13 @@ func ResourceStorageBucket() *schema.Resource {
 				Description: `The bucket's Lifecycle Rules configuration.`,
 			},
 
+			"enable_object_retention": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				ForceNew:    true,
+				Description: `Enables each object in the bucket to have its own retention policy, which prevents deletion until stored for a specific length of time.`,
+			},
+
 			"versioning": {
 				Type:     schema.TypeList,
 				Optional: true,
@@ -263,6 +291,12 @@ func ResourceStorageBucket() *schema.Resource {
 							Required:    true,
 							Description: `While set to true, autoclass automatically transitions objects in your bucket to appropriate storage classes based on each object's access pattern.`,
 						},
+						"terminal_storage_class": {
+								Type:        schema.TypeString,
+								Optional:    true,
+								Computed:    true,
+								Description: `The storage class that objects in the bucket eventually transition to if they are not read for a certain length of time. Supported values include: NEARLINE, ARCHIVE.`,
+						},
 					},
 				},
 				Description: `The bucket's autoclass configuration.`,
@@ -442,7 +476,8 @@ func ResourceStorageBucket() *schema.Resource {
 	}
 }
 
-const resourceDataplexGoogleProvidedLabelPrefix = "labels.goog-dataplex"
+const resourceDataplexGoogleLabelPrefix = "goog-dataplex"
+const resourceDataplexGoogleProvidedLabelPrefix = "labels." + resourceDataplexGoogleLabelPrefix
 
 func resourceDataplexLabelDiffSuppress(k, old, new string, d *schema.ResourceData) bool {
 	if strings.HasPrefix(k, resourceDataplexGoogleProvidedLabelPrefix) && new == "" {
@@ -494,7 +529,7 @@ func resourceStorageBucketCreate(d *schema.ResourceData, meta interface{}) error
 	// Create a bucket, setting the labels, location and name.
 	sb := &storage.Bucket{
 		Name:             bucket,
-		Labels:           tpgresource.ExpandLabels(d),
+		Labels:           tpgresource.ExpandEffectiveLabels(d),
 		Location:         location,
 		IamConfiguration: expandIamConfiguration(d),
 	}
@@ -566,7 +601,11 @@ func resourceStorageBucketCreate(d *schema.ResourceData, meta interface{}) error
 
 	err = transport_tpg.Retry(transport_tpg.RetryOptions{
 		RetryFunc: func() error {
-			res, err = config.NewStorageClient(userAgent).Buckets.Insert(project, sb).Do()
+			insertCall := config.NewStorageClient(userAgent).Buckets.Insert(project, sb)
+			if d.Get("enable_object_retention").(bool) {
+				insertCall.EnableObjectRetention(true)
+			}
+			res, err = insertCall.Do()
 			return err
 		},
 	})
@@ -695,15 +734,15 @@ func resourceStorageBucketUpdate(d *schema.ResourceData, meta interface{}) error
 		}
 	}
 
-	if d.HasChange("labels") {
-		sb.Labels = tpgresource.ExpandLabels(d)
+	if d.HasChange("effective_labels") {
+		sb.Labels = tpgresource.ExpandEffectiveLabels(d)
 		if len(sb.Labels) == 0 {
 			sb.NullFields = append(sb.NullFields, "Labels")
 		}
 
 		// To delete a label using PATCH, we have to explicitly set its value
 		// to null.
-		old, _ := d.GetChange("labels")
+		old, _ := d.GetChange("effective_labels")
 		for k := range old.(map[string]interface{}) {
 			if _, ok := sb.Labels[k]; !ok {
 				sb.NullFields = append(sb.NullFields, fmt.Sprintf("Labels.%s", k))
@@ -1093,6 +1132,16 @@ func flattenBucketRetentionPolicy(bucketRetentionPolicy *storage.BucketRetention
 	return bucketRetentionPolicies
 }
 
+func flattenBucketObjectRetention(bucketObjectRetention *storage.BucketObjectRetention) bool {
+	if bucketObjectRetention == nil {
+		return false
+	}
+	if bucketObjectRetention.Mode == "Enabled" {
+		return true
+	}
+	return false
+}
+
 func expandBucketVersioning(configured interface{}) *storage.BucketVersioning {
 	versionings := configured.([]interface{})
 	if len(versionings) == 0 {
@@ -1120,6 +1169,9 @@ func expandBucketAutoclass(configured interface{}) *storage.BucketAutoclass {
 	bucketAutoclass := &storage.BucketAutoclass{}
 
 	bucketAutoclass.Enabled = autoclass["enabled"].(bool)
+	if autoclass["terminal_storage_class"] != "" {
+		bucketAutoclass.TerminalStorageClass = autoclass["terminal_storage_class"].(string)
+	}
 	bucketAutoclass.ForceSendFields = append(bucketAutoclass.ForceSendFields, "Enabled")
 
 	return bucketAutoclass
@@ -1147,7 +1199,8 @@ func flattenBucketAutoclass(bucketAutoclass *storage.BucketAutoclass) []map[stri
 	}
 
 	autoclass := map[string]interface{}{
-		"enabled": bucketAutoclass.Enabled,
+		"enabled":                bucketAutoclass.Enabled,
+		"terminal_storage_class": bucketAutoclass.TerminalStorageClass,
 	}
 	autoclassList = append(autoclassList, autoclass)
 	return autoclassList
@@ -1588,6 +1641,9 @@ func setStorageBucket(d *schema.ResourceData, config *transport_tpg.Config, res
 	if err := d.Set("logging", flattenBucketLogging(res.Logging)); err != nil {
 		return fmt.Errorf("Error setting logging: %s", err)
 	}
+	if err := d.Set("enable_object_retention", flattenBucketObjectRetention(res.ObjectRetention)); err != nil {
+		return fmt.Errorf("Error setting object retention: %s", err)
+	}
 	if err := d.Set("versioning", flattenBucketVersioning(res.Versioning)); err != nil {
 		return fmt.Errorf("Error setting versioning: %s", err)
 	}
@@ -1597,7 +1653,13 @@ func setStorageBucket(d *schema.ResourceData, config *transport_tpg.Config, res
 	if err := d.Set("lifecycle_rule", flattenBucketLifecycle(res.Lifecycle)); err != nil {
 		return fmt.Errorf("Error setting lifecycle_rule: %s", err)
 	}
-	if err := d.Set("labels", res.Labels); err != nil {
+	if err := tpgresource.SetLabels(res.Labels, d, "labels"); err != nil {
+		return fmt.Errorf("Error setting labels: %s", err)
+	}
+	if err := tpgresource.SetLabels(res.Labels, d, "terraform_labels"); err != nil {
+		return fmt.Errorf("Error setting terraform_labels: %s", err)
+	}
+	if err := d.Set("effective_labels", res.Labels); err != nil {
 		return fmt.Errorf("Error setting labels: %s", err)
 	}
 	if err := d.Set("website", flattenBucketWebsite(res.Website)); err != nil {
diff --git a/mmv1/third_party/terraform/services/storage/resource_storage_bucket_migrate.go b/mmv1/third_party/terraform/services/storage/resource_storage_bucket_migrate.go
new file mode 100644
index 000000000000..f59f8adba0c8
--- /dev/null
+++ b/mmv1/third_party/terraform/services/storage/resource_storage_bucket_migrate.go
@@ -0,0 +1,415 @@
+package storage
+
+import (
+	"context"
+	"math"
+	"strings"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+)
+
+func resourceStorageBucketV0() *schema.Resource {
+	return &schema.Resource{
+		Schema: map[string]*schema.Schema{
+			"name": {
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: `The name of the bucket.`,
+			},
+
+			"encryption": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"default_kms_key_name": {
+							Type:        schema.TypeString,
+							Required:    true,
+							Description: `A Cloud KMS key that will be used to encrypt objects inserted into this bucket, if no encryption method is specified. You must pay attention to whether the crypto key is available in the location that this bucket is created in. See the docs for more details.`,
+						},
+					},
+				},
+				Description: `The bucket's encryption configuration.`,
+			},
+
+			"requester_pays": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Description: `Enables Requester Pays on a storage bucket.`,
+			},
+
+			"force_destroy": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Default:     false,
+				Description: `When deleting a bucket, this boolean option will delete all contained objects. If you try to delete a bucket that contains objects, Terraform will fail that run.`,
+			},
+
+			"labels": {
+				Type:     schema.TypeMap,
+				Optional: true,
+				Computed: true,
+				// GCP (Dataplex) automatically adds labels
+				DiffSuppressFunc: resourceDataplexLabelDiffSuppress,
+				Elem:             &schema.Schema{Type: schema.TypeString},
+				Description:      `A set of key/value label pairs to assign to the bucket.`,
+			},
+
+			"location": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+				StateFunc: func(s interface{}) string {
+					return strings.ToUpper(s.(string))
+				},
+				Description: `The Google Cloud Storage location`,
+			},
+
+			"project": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Computed:    true,
+				ForceNew:    true,
+				Description: `The ID of the project in which the resource belongs. If it is not provided, the provider project is used.`,
+			},
+
+			"self_link": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: `The URI of the created resource.`,
+			},
+
+			"url": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: `The base URL of the bucket, in the format gs://<bucket-name>.`,
+			},
+
+			"storage_class": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Default:     "STANDARD",
+				Description: `The Storage Class of the new bucket. Supported values include: STANDARD, MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE.`,
+			},
+
+			"lifecycle_rule": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 100,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"action": {
+							Type:     schema.TypeSet,
+							Required: true,
+							MinItems: 1,
+							MaxItems: 1,
+							Set:      resourceGCSBucketLifecycleRuleActionHash,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"type": {
+										Type:        schema.TypeString,
+										Required:    true,
+										Description: `The type of the action of this Lifecycle Rule. Supported values include: Delete, SetStorageClass and AbortIncompleteMultipartUpload.`,
+									},
+									"storage_class": {
+										Type:        schema.TypeString,
+										Optional:    true,
+										Description: `The target Storage Class of objects affected by this Lifecycle Rule. Supported values include: MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE.`,
+									},
+								},
+							},
+							Description: `The Lifecycle Rule's action configuration. A single block of this type is supported.`,
+						},
+						"condition": {
+							Type:     schema.TypeSet,
+							Required: true,
+							MinItems: 1,
+							MaxItems: 1,
+							Set:      resourceGCSBucketLifecycleRuleConditionHash,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"age": {
+										Type:        schema.TypeInt,
+										Optional:    true,
+										Description: `Minimum age of an object in days to satisfy this condition.`,
+									},
+									"created_before": {
+										Type:        schema.TypeString,
+										Optional:    true,
+										Description: `Creation date of an object in RFC 3339 (e.g. 2017-06-13) to satisfy this condition.`,
+									},
+									"custom_time_before": {
+										Type:        schema.TypeString,
+										Optional:    true,
+										Description: `Creation date of an object in RFC 3339 (e.g. 2017-06-13) to satisfy this condition.`,
+									},
+									"days_since_custom_time": {
+										Type:        schema.TypeInt,
+										Optional:    true,
+										Description: `Number of days elapsed since the user-specified timestamp set on an object.`,
+									},
+									"days_since_noncurrent_time": {
+										Type:     schema.TypeInt,
+										Optional: true,
+										Description: `Number of days elapsed since the noncurrent timestamp of an object. This
+										condition is relevant only for versioned objects.`,
+									},
+									"noncurrent_time_before": {
+										Type:        schema.TypeString,
+										Optional:    true,
+										Description: `Creation date of an object in RFC 3339 (e.g. 2017-06-13) to satisfy this condition.`,
+									},
+									"with_state": {
+										Type:         schema.TypeString,
+										Computed:     true,
+										Optional:     true,
+										ValidateFunc: validation.StringInSlice([]string{"LIVE", "ARCHIVED", "ANY", ""}, false),
+										Description:  `Match to live and/or archived objects. Unversioned buckets have only live objects. Supported values include: "LIVE", "ARCHIVED", "ANY".`,
+									},
+									"matches_storage_class": {
+										Type:        schema.TypeList,
+										Optional:    true,
+										Elem:        &schema.Schema{Type: schema.TypeString},
+										Description: `Storage Class of objects to satisfy this condition. Supported values include: MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE, STANDARD, DURABLE_REDUCED_AVAILABILITY.`,
+									},
+									"num_newer_versions": {
+										Type:        schema.TypeInt,
+										Optional:    true,
+										Description: `Relevant only for versioned objects. The number of newer versions of an object to satisfy this condition.`,
+									},
+									"matches_prefix": {
+										Type:        schema.TypeList,
+										Optional:    true,
+										Elem:        &schema.Schema{Type: schema.TypeString},
+										Description: `One or more matching name prefixes to satisfy this condition.`,
+									},
+									"matches_suffix": {
+										Type:        schema.TypeList,
+										Optional:    true,
+										Elem:        &schema.Schema{Type: schema.TypeString},
+										Description: `One or more matching name suffixes to satisfy this condition.`,
+									},
+								},
+							},
+							Description: `The Lifecycle Rule's condition configuration.`,
+						},
+					},
+				},
+				Description: `The bucket's Lifecycle Rules configuration.`,
+			},
+
+			"versioning": {
+				Type:     schema.TypeList,
+				Optional: true,
+				Computed: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"enabled": {
+							Type:        schema.TypeBool,
+							Required:    true,
+							Description: `While set to true, versioning is fully enabled for this bucket.`,
+						},
+					},
+				},
+				Description: `The bucket's Versioning configuration.`,
+			},
+
+			"autoclass": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"enabled": {
+							Type:        schema.TypeBool,
+							Required:    true,
+							Description: `While set to true, autoclass automatically transitions objects in your bucket to appropriate storage classes based on each object's access pattern.`,
+						},
+					},
+				},
+				Description: `The bucket's autoclass configuration.`,
+				DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
+					_, n := d.GetChange(strings.TrimSuffix(k, ".#"))
+					if !strings.HasSuffix(k, ".#") {
+						return false
+					}
+					var l []interface{}
+					if new == "1" && old == "0" {
+						l = n.([]interface{})
+						contents, ok := l[0].(map[string]interface{})
+						if !ok {
+							return false
+						}
+						if contents["enabled"] == false {
+							return true
+						}
+					}
+					return false
+				},
+			},
+			"website": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"main_page_suffix": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							AtLeastOneOf: []string{"website.0.not_found_page", "website.0.main_page_suffix"},
+							Description:  `Behaves as the bucket's directory index where missing objects are treated as potential directories.`,
+							DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
+								return old != "" && new == ""
+							},
+						},
+						"not_found_page": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							AtLeastOneOf: []string{"website.0.main_page_suffix", "website.0.not_found_page"},
+							Description:  `The custom object to return when a requested resource is not found.`,
+							DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
+								return old != "" && new == ""
+							},
+						},
+					},
+				},
+				Description: `Configuration if the bucket acts as a website.`,
+			},
+
+			"retention_policy": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"is_locked": {
+							Type:        schema.TypeBool,
+							Optional:    true,
+							Default:     false,
+							Description: `If set to true, the bucket will be locked and permanently restrict edits to the bucket's retention policy.  Caution: Locking a bucket is an irreversible action.`,
+						},
+						"retention_period": {
+							Type:         schema.TypeInt,
+							Required:     true,
+							ValidateFunc: validation.IntBetween(1, math.MaxInt32),
+							Description:  `The period of time, in seconds, that objects in the bucket must be retained and cannot be deleted, overwritten, or archived. The value must be less than 3,155,760,000 seconds.`,
+						},
+					},
+				},
+				Description: `Configuration of the bucket's data retention policy for how long objects in the bucket should be retained.`,
+			},
+
+			"cors": {
+				Type:     schema.TypeList,
+				Optional: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"origin": {
+							Type:     schema.TypeList,
+							Optional: true,
+							Elem: &schema.Schema{
+								Type: schema.TypeString,
+							},
+							Description: `The list of Origins eligible to receive CORS response headers. Note: "*" is permitted in the list of origins, and means "any Origin".`,
+						},
+						"method": {
+							Type:     schema.TypeList,
+							Optional: true,
+							Elem: &schema.Schema{
+								Type: schema.TypeString,
+							},
+							Description: `The list of HTTP methods on which to include CORS response headers, (GET, OPTIONS, POST, etc) Note: "*" is permitted in the list of methods, and means "any method".`,
+						},
+						"response_header": {
+							Type:     schema.TypeList,
+							Optional: true,
+							Elem: &schema.Schema{
+								Type: schema.TypeString,
+							},
+							Description: `The list of HTTP headers other than the simple response headers to give permission for the user-agent to share across domains.`,
+						},
+						"max_age_seconds": {
+							Type:        schema.TypeInt,
+							Optional:    true,
+							Description: `The value, in seconds, to return in the Access-Control-Max-Age header used in preflight responses.`,
+						},
+					},
+				},
+				Description: `The bucket's Cross-Origin Resource Sharing (CORS) configuration.`,
+			},
+
+			"default_event_based_hold": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Description: `Whether or not to automatically apply an eventBasedHold to new objects added to the bucket.`,
+			},
+
+			"logging": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"log_bucket": {
+							Type:        schema.TypeString,
+							Required:    true,
+							Description: `The bucket that will receive log objects.`,
+						},
+						"log_object_prefix": {
+							Type:        schema.TypeString,
+							Optional:    true,
+							Computed:    true,
+							Description: `The object prefix for log objects. If it's not provided, by default Google Cloud Storage sets this to this bucket's name.`,
+						},
+					},
+				},
+				Description: `The bucket's Access & Storage Logs configuration.`,
+			},
+			"uniform_bucket_level_access": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Computed:    true,
+				Description: `Enables uniform bucket-level access on a bucket.`,
+			},
+			"custom_placement_config": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"data_locations": {
+							Type:     schema.TypeSet,
+							Required: true,
+							ForceNew: true,
+							MaxItems: 2,
+							MinItems: 2,
+							Elem: &schema.Schema{
+								Type: schema.TypeString,
+							},
+							Description: `The list of individual regions that comprise a dual-region bucket. See the docs for a list of acceptable regions. Note: If any of the data_locations changes, it will recreate the bucket.`,
+						},
+					},
+				},
+				Description: `The bucket's custom location configuration, which specifies the individual regions that comprise a dual-region bucket. If the bucket is designated a single or multi-region, the parameters are empty.`,
+			},
+			"public_access_prevention": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Computed:    true,
+				Description: `Prevents public access to a bucket.`,
+			},
+		},
+		UseJSONNumber: true,
+	}
+}
+
+func ResourceStorageBucketStateUpgradeV0(_ context.Context, rawState map[string]interface{}, meta interface{}) (map[string]interface{}, error) {
+	return tpgresource.LabelsStateUpgrade(rawState, resourceDataplexGoogleLabelPrefix)
+}
diff --git a/mmv1/third_party/terraform/services/storage/resource_storage_bucket_object.go b/mmv1/third_party/terraform/services/storage/resource_storage_bucket_object.go
index 4ec802ea0e5e..926e16c160bd 100644
--- a/mmv1/third_party/terraform/services/storage/resource_storage_bucket_object.go
+++ b/mmv1/third_party/terraform/services/storage/resource_storage_bucket_object.go
@@ -207,10 +207,33 @@ func ResourceStorageBucketObject() *schema.Resource {
 				},
 			},
 
+			"retention": {
+				Type:          schema.TypeList,
+				MaxItems:      1,
+				Optional:      true,
+				ConflictsWith: []string{"event_based_hold"},
+				Description:   `Object level retention configuration.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"retain_until_time": {
+							Type:        schema.TypeString,
+							Required:    true,
+							Description: `Time in RFC 3339 (e.g. 2030-01-01T02:03:04Z) until which object retention protects this object.`,
+						},
+						"mode": {
+							Type:        schema.TypeString,
+							Required:    true,
+							Description: `The object retention mode. Supported values include: "Unlocked", "Locked".`,
+						},
+					},
+				},
+			},
+
 			"event_based_hold": {
-				Type:        schema.TypeBool,
-				Optional:    true,
-				Description: `Whether an object is under event-based hold. Event-based hold is a way to retain objects until an event occurs, which is signified by the hold's release (i.e. this value is set to false). After being released (set to false), such objects will be subject to bucket-level retention (if any).`,
+				Type:          schema.TypeBool,
+				Optional:      true,
+				ConflictsWith: []string{"retention"},
+				Description:   `Whether an object is under event-based hold. Event-based hold is a way to retain objects until an event occurs, which is signified by the hold's release (i.e. this value is set to false). After being released (set to false), such objects will be subject to bucket-level retention (if any).`,
 			},
 
 			"temporary_hold": {
@@ -312,6 +335,10 @@ func resourceStorageBucketObjectCreate(d *schema.ResourceData, meta interface{})
 		object.KmsKeyName = v.(string)
 	}
 
+	if v, ok := d.GetOk("retention"); ok {
+		object.Retention = expandObjectRetention(v)
+	}
+
 	if v, ok := d.GetOk("event_based_hold"); ok {
 		object.EventBasedHold = v.(bool)
 	}
@@ -357,6 +384,16 @@ func resourceStorageBucketObjectUpdate(d *schema.ResourceData, meta interface{})
 		return fmt.Errorf("Error retrieving object during update %s: %s", name, err)
 	}
 
+	hasRetentionChanges := d.HasChange("retention")
+	if hasRetentionChanges {
+		if v, ok := d.GetOk("retention"); ok {
+			res.Retention = expandObjectRetention(v)
+		} else {
+			res.Retention = nil
+			res.NullFields = append(res.NullFields, "Retention")
+		}
+	}
+
 	if d.HasChange("event_based_hold") {
 		v := d.Get("event_based_hold")
 		res.EventBasedHold = v.(bool)
@@ -368,6 +405,9 @@ func resourceStorageBucketObjectUpdate(d *schema.ResourceData, meta interface{})
 	}
 
 	updateCall := objectsService.Update(bucket, name, res)
+	if hasRetentionChanges {
+		updateCall.OverrideUnlockedRetention(true)
+	}
 	_, err = updateCall.Do()
 
 	if err != nil {
@@ -443,6 +483,9 @@ func resourceStorageBucketObjectRead(d *schema.ResourceData, meta interface{}) e
 	if err := d.Set("media_link", res.MediaLink); err != nil {
 		return fmt.Errorf("Error setting media_link: %s", err)
 	}
+	if err := d.Set("retention", flattenObjectRetention(res.Retention)); err != nil {
+		return fmt.Errorf("Error setting retention: %s", err)
+	}
 	if err := d.Set("event_based_hold", res.EventBasedHold); err != nil {
 		return fmt.Errorf("Error setting event_based_hold: %s", err)
 	}
@@ -513,3 +556,34 @@ func expandCustomerEncryption(input []interface{}) map[string]string {
 	}
 	return expanded
 }
+
+func expandObjectRetention(configured interface{}) *storage.ObjectRetention {
+	retentions := configured.([]interface{})
+	if len(retentions) == 0 {
+		return nil
+	}
+	retention := retentions[0].(map[string]interface{})
+
+	objectRetention := &storage.ObjectRetention{
+		RetainUntilTime: retention["retain_until_time"].(string),
+		Mode:            retention["mode"].(string),
+	}
+
+	return objectRetention
+}
+
+func flattenObjectRetention(objectRetention *storage.ObjectRetention) []map[string]interface{} {
+	retentions := make([]map[string]interface{}, 0, 1)
+
+	if objectRetention == nil {
+		return retentions
+	}
+
+	retention := map[string]interface{}{
+		"mode":              objectRetention.Mode,
+		"retain_until_time": objectRetention.RetainUntilTime,
+	}
+
+	retentions = append(retentions, retention)
+	return retentions
+}
diff --git a/mmv1/third_party/terraform/services/storage/resource_storage_bucket_object_test.go b/mmv1/third_party/terraform/services/storage/resource_storage_bucket_object_test.go
index cb6a59d0b8a3..54d0dbd78dfc 100644
--- a/mmv1/third_party/terraform/services/storage/resource_storage_bucket_object_test.go
+++ b/mmv1/third_party/terraform/services/storage/resource_storage_bucket_object_test.go
@@ -415,6 +415,48 @@ func TestAccStorageObject_holds(t *testing.T) {
 	})
 }
 
+func TestAccStorageObject_retention(t *testing.T) {
+	t.Parallel()
+
+	bucketName := acctest.TestBucketName(t)
+	data := []byte(content)
+	h := md5.New()
+	if _, err := h.Write(data); err != nil {
+		t.Errorf("error calculating md5: %v", err)
+	}
+	dataMd5 := base64.StdEncoding.EncodeToString(h.Sum(nil))
+	testFile := getNewTmpTestFile(t, "tf-test")
+	if err := ioutil.WriteFile(testFile.Name(), data, 0644); err != nil {
+		t.Errorf("error writing file: %v", err)
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccStorageObjectDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testGoogleStorageBucketsObjectRetention(bucketName, "2040-01-01T02:03:04.000Z"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGoogleStorageObject(t, bucketName, objectName, dataMd5),
+				),
+			},
+			{
+				Config: testGoogleStorageBucketsObjectRetention(bucketName, "2040-01-02T02:03:04.000Z"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGoogleStorageObject(t, bucketName, objectName, dataMd5),
+				),
+			},
+			{
+				Config: testGoogleStorageBucketsObjectRetentionDisabled(bucketName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGoogleStorageObject(t, bucketName, objectName, dataMd5),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckGoogleStorageObject(t *testing.T, bucket, object, md5 string) resource.TestCheckFunc {
 	return testAccCheckGoogleStorageObjectWithEncryption(t, bucket, object, md5, "")
 }
@@ -646,6 +688,44 @@ resource "google_storage_bucket_object" "object" {
 `, bucketName, objectName, content, customerEncryptionKey)
 }
 
+func testGoogleStorageBucketsObjectRetention(bucketName string, retainUntilTime string) string {
+	return fmt.Sprintf(`
+resource "google_storage_bucket" "bucket" {
+  name                    = "%s"
+  location                = "US"
+  force_destroy           = true
+  enable_object_retention = true
+}
+
+resource "google_storage_bucket_object" "object" {
+  name      = "%s"
+  bucket    = google_storage_bucket.bucket.name
+  content   = "%s"
+  retention {
+	mode              = "Unlocked"
+	retain_until_time = "%s"
+  }      
+}
+`, bucketName, objectName, content, retainUntilTime)
+}
+
+func testGoogleStorageBucketsObjectRetentionDisabled(bucketName string) string {
+	return fmt.Sprintf(`
+resource "google_storage_bucket" "bucket" {
+  name                    = "%s"
+  location                = "US"
+  force_destroy           = true
+  enable_object_retention = true
+}
+
+resource "google_storage_bucket_object" "object" {
+  name      = "%s"
+  bucket    = google_storage_bucket.bucket.name
+  content   = "%s" 
+}
+`, bucketName, objectName, content)
+}
+
 func testGoogleStorageBucketsObjectHolds(bucketName string, eventBasedHold bool, temporaryHold bool) string {
 	return fmt.Sprintf(`
 resource "google_storage_bucket" "bucket" {
diff --git a/mmv1/third_party/terraform/services/storage/resource_storage_bucket_test.go.erb b/mmv1/third_party/terraform/services/storage/resource_storage_bucket_test.go.erb
index fb04f1bfa88c..9cbd43fe8aa7 100644
--- a/mmv1/third_party/terraform/services/storage/resource_storage_bucket_test.go.erb
+++ b/mmv1/third_party/terraform/services/storage/resource_storage_bucket_test.go.erb
@@ -56,6 +56,8 @@ func TestAccStorageBucket_basic(t *testing.T) {
 func TestAccStorageBucket_basicWithAutoclass(t *testing.T) {
 	t.Parallel()
 
+	var bucket storage.Bucket
+	var updated storage.Bucket
 	bucketName := acctest.TestBucketName(t)
 
 	acctest.VcrTest(t, resource.TestCase{
@@ -66,8 +68,8 @@ func TestAccStorageBucket_basicWithAutoclass(t *testing.T) {
 			{
 				Config: testAccStorageBucket_basicWithAutoclass(bucketName, true),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr(
-						"google_storage_bucket.bucket", "force_destroy", "false"),
+					testAccCheckStorageBucketExists(
+						t, "google_storage_bucket.bucket", bucketName, &bucket),
 				),
 			},
 			{
@@ -76,12 +78,12 @@ func TestAccStorageBucket_basicWithAutoclass(t *testing.T) {
 				ImportStateVerify:       true,
 				ImportStateVerifyIgnore: []string{"force_destroy"},
 			},
-			// Autoclass is ForceNew, so this destroys & recreates, but does test the explicitly disabled config
 			{
-				Config: testAccStorageBucket_basicWithAutoclass(bucketName, false),
+				Config: testAccStorageBucket_basicWithAutoclass_update(bucketName, true),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr(
-						"google_storage_bucket.bucket", "force_destroy", "false"),
+					testAccCheckStorageBucketExists(
+						t, "google_storage_bucket.bucket", bucketName, &updated),
+					testAccCheckStorageBucketWasUpdated(&updated, &bucket),
 				),
 			},
 			{
@@ -90,6 +92,15 @@ func TestAccStorageBucket_basicWithAutoclass(t *testing.T) {
 				ImportStateVerify:       true,
 				ImportStateVerifyIgnore: []string{"force_destroy"},
 			},
+			{
+				Config: testAccStorageBucket_basicWithAutoclass(bucketName, false),
+			},
+			{
+				ResourceName:            "google_storage_bucket.bucket",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"force_destroy"},
+			},
 		},
 	})
 }
@@ -680,6 +691,47 @@ func TestAccStorageBucket_forceDestroyObjectDeleteError(t *testing.T) {
 	})
 }
 
+func TestAccStorageBucket_enable_object_retention(t *testing.T) {
+	t.Parallel()
+
+	var bucket storage.Bucket
+	bucketName := acctest.TestBucketName(t)
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccStorageBucketDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccStorageBucket_enable_object_retention(bucketName, "true"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckStorageBucketExists(
+						t, "google_storage_bucket.bucket", bucketName, &bucket),
+				),
+			},
+			{
+				ResourceName:            "google_storage_bucket.bucket",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"force_destroy"},
+			},
+			{
+				Config: testAccStorageBucket_enable_object_retention(bucketName, "false"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckStorageBucketExists(
+						t, "google_storage_bucket.bucket", bucketName, &bucket),
+				),
+			},
+			{
+				ResourceName:            "google_storage_bucket.bucket",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"force_destroy"},
+			},
+		},
+	})
+}
+
 func TestAccStorageBucket_versioning(t *testing.T) {
 	t.Parallel()
 
@@ -687,9 +739,9 @@ func TestAccStorageBucket_versioning(t *testing.T) {
 	bucketName := fmt.Sprintf("tf-test-acl-bucket-%d", acctest.RandInt(t))
 
 	acctest.VcrTest(t, resource.TestCase{
-		PreCheck:                    func() { acctest.AccTestPreCheck(t) },
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
-		CheckDestroy:                testAccStorageBucketDestroyProducer(t),
+		CheckDestroy:             testAccStorageBucketDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccStorageBucket_versioning(bucketName, "true"),
@@ -708,7 +760,7 @@ func TestAccStorageBucket_versioning(t *testing.T) {
 				ImportStateVerify:       true,
 				ImportStateVerifyIgnore: []string{"force_destroy"},
 			},
-						{
+			{
 				Config: testAccStorageBucket_versioning_empty(bucketName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStorageBucketExists(
@@ -725,7 +777,7 @@ func TestAccStorageBucket_versioning(t *testing.T) {
 				ImportStateVerify:       true,
 				ImportStateVerifyIgnore: []string{"force_destroy"},
 			},
-						{
+			{
 				Config: testAccStorageBucket_versioning(bucketName, "false"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStorageBucketExists(
@@ -742,7 +794,7 @@ func TestAccStorageBucket_versioning(t *testing.T) {
 				ImportStateVerify:       true,
 				ImportStateVerifyIgnore: []string{"force_destroy"},
 			},
-						{
+			{
 				Config: testAccStorageBucket_versioning_empty(bucketName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStorageBucketExists(
@@ -768,9 +820,9 @@ func TestAccStorageBucket_logging(t *testing.T) {
 
 	bucketName := fmt.Sprintf("tf-test-acl-bucket-%d", acctest.RandInt(t))
 	acctest.VcrTest(t, resource.TestCase{
-		PreCheck:                    func() { acctest.AccTestPreCheck(t) },
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
-		CheckDestroy:                testAccStorageBucketDestroyProducer(t),
+		CheckDestroy:             testAccStorageBucketDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccStorageBucket_logging(bucketName, "log-bucket"),
@@ -829,9 +881,9 @@ func TestAccStorageBucket_cors(t *testing.T) {
 	bucketName := fmt.Sprintf("tf-test-acl-bucket-%d", acctest.RandInt(t))
 
 	acctest.VcrTest(t, resource.TestCase{
-		PreCheck:                    func() { acctest.AccTestPreCheck(t) },
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
-		CheckDestroy:                testAccStorageBucketDestroyProducer(t),
+		CheckDestroy:             testAccStorageBucketDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
 				Config: testGoogleStorageBucketsCors(bucketName),
@@ -861,9 +913,9 @@ func TestAccStorageBucket_defaultEventBasedHold(t *testing.T) {
 	bucketName := fmt.Sprintf("tf-test-acl-bucket-%d", acctest.RandInt(t))
 
 	acctest.VcrTest(t, resource.TestCase{
-		PreCheck:                    func() { acctest.AccTestPreCheck(t) },
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
-		CheckDestroy:                testAccStorageBucketDestroyProducer(t),
+		CheckDestroy:             testAccStorageBucketDestroyProducer(t),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccStorageBucket_defaultEventBasedHold(bucketName),
@@ -978,7 +1030,7 @@ func TestAccStorageBucket_labels(t *testing.T) {
 				ResourceName:            "google_storage_bucket.bucket",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"force_destroy"},
+				ImportStateVerifyIgnore: []string{"force_destroy", "labels", "terraform_labels"},
 			},
 			// Down to only one label (test single label deletion)
 			{
@@ -988,7 +1040,7 @@ func TestAccStorageBucket_labels(t *testing.T) {
 				ResourceName:            "google_storage_bucket.bucket",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"force_destroy"},
+				ImportStateVerifyIgnore: []string{"force_destroy", "labels", "terraform_labels"},
 			},
 			// And make sure deleting all labels work
 			{
@@ -998,7 +1050,7 @@ func TestAccStorageBucket_labels(t *testing.T) {
 				ResourceName:            "google_storage_bucket.bucket",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"force_destroy"},
+				ImportStateVerifyIgnore: []string{"force_destroy", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -1296,6 +1348,7 @@ func testAccStorageBucket_basicWithAutoclass(bucketName string, autoclass bool)
 resource "google_storage_bucket" "bucket" {
   name     = "%s"
   location = "US"
+  force_destroy = true
   autoclass  {
     enabled  = %t
   }
@@ -1303,6 +1356,20 @@ resource "google_storage_bucket" "bucket" {
 `, bucketName, autoclass)
 }
 
+func testAccStorageBucket_basicWithAutoclass_update(bucketName string, autoclass bool) string {
+	return fmt.Sprintf(`
+resource "google_storage_bucket" "bucket" {
+	name     = "%s"
+	location = "US"
+	force_destroy = true
+	autoclass  {
+		enabled  = %t
+		terminal_storage_class = "ARCHIVE"
+	}
+}
+`, bucketName, autoclass)
+}
+
 func testAccStorageBucket_requesterPays(bucketName string, pays bool) string {
 	return fmt.Sprintf(`
 resource "google_storage_bucket" "bucket" {
@@ -1469,6 +1536,17 @@ resource "google_storage_bucket" "bucket" {
 `, bucketName)
 }
 
+func testAccStorageBucket_enable_object_retention(bucketName string, enabled string) string {
+	return fmt.Sprintf(`
+resource "google_storage_bucket" "bucket" {
+  name                    = "%s"
+  location                = "US"
+  force_destroy           = "true"
+  enable_object_retention = "%s"
+}
+`, bucketName, enabled)
+}
+
 func testAccStorageBucket_versioning(bucketName, enabled string) string {
 	return fmt.Sprintf(`
 resource "google_storage_bucket" "bucket" {
diff --git a/mmv1/third_party/terraform/services/storageinsights/resource_storage_insights_report_config_test.go b/mmv1/third_party/terraform/services/storageinsights/resource_storage_insights_report_config_test.go
new file mode 100644
index 000000000000..16a2d727e84e
--- /dev/null
+++ b/mmv1/third_party/terraform/services/storageinsights/resource_storage_insights_report_config_test.go
@@ -0,0 +1,156 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+package storageinsights_test
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+)
+
+func TestAccStorageInsightsReportConfig_update(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccStorageInsightsReportConfig_full(context),
+			},
+			{
+				ResourceName:            "google_storage_insights_report_config.config",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"location"},
+			},
+			{
+				Config: testAccStorageInsightsReportConfig_update(context),
+			},
+			{
+				ResourceName:            "google_storage_insights_report_config.config",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"location"},
+			},
+		},
+	})
+}
+
+func testAccStorageInsightsReportConfig_full(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+data "google_project" "project" {
+}
+
+resource "google_storage_insights_report_config" "config" {
+  display_name = "Test Report Config"
+  location = "us-central1"
+  frequency_options {
+    frequency = "WEEKLY"
+    start_date {
+      day = 15
+      month = 3
+      year = 2050
+    }
+    end_date {
+      day = 15
+      month = 4
+      year = 2050
+    }
+  }
+  csv_options {
+    record_separator = "\n"
+    delimiter = ","
+    header_required = false
+  }
+  object_metadata_report_options {
+    metadata_fields = ["bucket", "name", "project"]
+    storage_filters {
+      bucket = google_storage_bucket.report_bucket.name
+    }
+    storage_destination_options {
+      bucket = google_storage_bucket.report_bucket.name
+      destination_path = "test-insights-reports"
+    }
+  }
+  depends_on = [
+	google_storage_bucket_iam_member.admin,
+  ]
+}
+
+resource "google_storage_bucket" "report_bucket" {
+  name                        = "tf-test-my-bucket%{random_suffix}"
+  location                    = "us-central1"
+  force_destroy               = true
+  uniform_bucket_level_access = true
+}
+
+resource "google_storage_bucket_iam_member" "admin" {
+  bucket = google_storage_bucket.report_bucket.name
+  role   = "roles/storage.admin"
+  member = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-storageinsights.iam.gserviceaccount.com"
+}
+`, context)
+}
+
+func testAccStorageInsightsReportConfig_update(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+data "google_project" "project" {
+}
+
+resource "google_storage_insights_report_config" "config" {
+  display_name = "Test Report Config Updated"
+  location = "us-central1"
+  frequency_options {
+    frequency = "DAILY"
+    start_date {
+      day = 14
+      month = 3
+      year = 2040
+    }
+    end_date {
+      day = 14
+      month = 4
+      year = 2040
+    }
+  }
+  csv_options {
+    record_separator = "\r\n"
+    delimiter = "."
+    header_required = true
+  }
+  object_metadata_report_options {
+    metadata_fields = ["bucket", "name", "project"]
+    storage_filters {
+      bucket = google_storage_bucket.report_bucket.name
+    }
+    storage_destination_options {
+      bucket = google_storage_bucket.report_bucket.name
+      destination_path = "test-insights-reports-updated"
+    }
+  }
+  depends_on = [
+	google_storage_bucket_iam_member.admin,
+  ]
+}
+
+resource "google_storage_bucket" "report_bucket" {
+  name                        = "tf-test-my-bucket%{random_suffix}"
+  location                    = "us-central1"
+  force_destroy               = true
+  uniform_bucket_level_access = true
+}
+  
+resource "google_storage_bucket_iam_member" "admin" {
+  bucket = google_storage_bucket.report_bucket.name
+  role   = "roles/storage.admin"
+  member = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-storageinsights.iam.gserviceaccount.com"
+}
+`, context)
+}
diff --git a/mmv1/third_party/terraform/services/storagetransfer/data_source_google_storage_transfer_project_service_account.go b/mmv1/third_party/terraform/services/storagetransfer/data_source_google_storage_transfer_project_service_account.go
index 4dc7ec9413b1..584791693df6 100644
--- a/mmv1/third_party/terraform/services/storagetransfer/data_source_google_storage_transfer_project_service_account.go
+++ b/mmv1/third_party/terraform/services/storagetransfer/data_source_google_storage_transfer_project_service_account.go
@@ -47,7 +47,7 @@ func dataSourceGoogleStorageTransferProjectServiceAccountRead(d *schema.Resource
 
 	serviceAccount, err := config.NewStorageTransferClient(userAgent).GoogleServiceAccounts.Get(project).Do()
 	if err != nil {
-		return transport_tpg.HandleNotFoundError(err, d, "Google Cloud Storage Transfer service account not found")
+		return transport_tpg.HandleDataSourceNotFoundError(err, d, "Google Cloud Storage Transfer service account not found", fmt.Sprintf("Project %q Google Cloud Storage Transfer account", project))
 	}
 
 	d.SetId(serviceAccount.AccountEmail)
diff --git a/mmv1/third_party/terraform/services/storagetransfer/resource_storage_transfer_job.go b/mmv1/third_party/terraform/services/storagetransfer/resource_storage_transfer_job.go
index 07b3c1dcc2b9..f0e1747ce96b 100644
--- a/mmv1/third_party/terraform/services/storagetransfer/resource_storage_transfer_job.go
+++ b/mmv1/third_party/terraform/services/storagetransfer/resource_storage_transfer_job.go
@@ -11,6 +11,7 @@ import (
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 	"github.com/hashicorp/terraform-provider-google/google/verify"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
@@ -61,6 +62,10 @@ func ResourceStorageTransferJob() *schema.Resource {
 			State: resourceStorageTransferJobStateImporter,
 		},
 
+		CustomizeDiff: customdiff.All(
+			tpgresource.DefaultProviderProject,
+		),
+
 		Schema: map[string]*schema.Schema{
 			"name": {
 				Type:        schema.TypeString,
@@ -80,6 +85,33 @@ func ResourceStorageTransferJob() *schema.Resource {
 				ForceNew:    true,
 				Description: `The project in which the resource belongs. If it is not provided, the provider project is used.`,
 			},
+			"event_stream": {
+				Type:          schema.TypeList,
+				Optional:      true,
+				MaxItems:      1,
+				ConflictsWith: []string{"schedule"},
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"name": {
+							Type:        schema.TypeString,
+							Required:    true,
+							Description: "Specifies a unique name of the resource such as AWS SQS ARN in the form 'arn:aws:sqs:region:account_id:queue_name', or Pub/Sub subscription resource name in the form 'projects/{project}/subscriptions/{sub}'",
+						},
+						"event_stream_start_time": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							Description:  "Specifies the date and time that Storage Transfer Service starts listening for events from this stream. If no start time is specified or start time is in the past, Storage Transfer Service starts listening immediately",
+							ValidateFunc: validation.IsRFC3339Time,
+						},
+						"event_stream_expiration_time": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							Description:  "Specifies the data and time at which Storage Transfer Service stops listening for events from this stream. After this time, any transfers in progress will complete, but no new transfers are initiated",
+							ValidateFunc: validation.IsRFC3339Time,
+						},
+					},
+				},
+			},
 			"transfer_spec": {
 				Type:     schema.TypeList,
 				Required: true,
@@ -193,9 +225,10 @@ func ResourceStorageTransferJob() *schema.Resource {
 				Description: `Notification configuration.`,
 			},
 			"schedule": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MaxItems: 1,
+				Type:          schema.TypeList,
+				Optional:      true,
+				MaxItems:      1,
+				ConflictsWith: []string{"event_stream"},
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"schedule_start_date": {
@@ -565,6 +598,7 @@ func resourceStorageTransferJobCreate(d *schema.ResourceData, meta interface{})
 		ProjectId:          project,
 		Status:             d.Get("status").(string),
 		Schedule:           expandTransferSchedules(d.Get("schedule").([]interface{})),
+		EventStream:        expandEventStream(d.Get("event_stream").([]interface{})),
 		TransferSpec:       expandTransferSpecs(d.Get("transfer_spec").([]interface{})),
 		NotificationConfig: expandTransferJobNotificationConfig(d.Get("notification_config").([]interface{})),
 	}
@@ -640,6 +674,11 @@ func resourceStorageTransferJobRead(d *schema.ResourceData, meta interface{}) er
 		return err
 	}
 
+	err = d.Set("event_stream", flattenTransferEventStream(res.EventStream))
+	if err != nil {
+		return err
+	}
+
 	err = d.Set("transfer_spec", flattenTransferSpec(res.TransferSpec, d))
 	if err != nil {
 		return err
@@ -668,6 +707,13 @@ func resourceStorageTransferJobUpdate(d *schema.ResourceData, meta interface{})
 	transferJob := &storagetransfer.TransferJob{}
 	fieldMask := []string{}
 
+	if d.HasChange("event_stream") {
+		fieldMask = append(fieldMask, "event_stream")
+		if v, ok := d.GetOk("event_stream"); ok {
+			transferJob.EventStream = expandEventStream(v.([]interface{}))
+		}
+	}
+
 	if d.HasChange("description") {
 		fieldMask = append(fieldMask, "description")
 		if v, ok := d.GetOk("description"); ok {
@@ -897,6 +943,39 @@ func flattenTransferSchedule(transferSchedule *storagetransfer.Schedule) []map[s
 	return []map[string]interface{}{data}
 }
 
+func expandEventStream(e []interface{}) *storagetransfer.EventStream {
+	if len(e) == 0 || e[0] == nil {
+		return nil
+	}
+
+	eventStream := e[0].(map[string]interface{})
+	return &storagetransfer.EventStream{
+		Name:                      eventStream["name"].(string),
+		EventStreamStartTime:      eventStream["event_stream_start_time"].(string),
+		EventStreamExpirationTime: eventStream["event_stream_expiration_time"].(string),
+	}
+}
+
+func flattenTransferEventStream(eventStream *storagetransfer.EventStream) []map[string]interface{} {
+	if eventStream == nil || reflect.DeepEqual(eventStream, &storagetransfer.EventStream{}) {
+		return nil
+	}
+
+	data := map[string]interface{}{
+		"name": eventStream.Name,
+	}
+
+	if eventStream.EventStreamStartTime != "" {
+		data["event_stream_start_time"] = eventStream.EventStreamStartTime
+	}
+
+	if eventStream.EventStreamExpirationTime != "" {
+		data["event_stream_expiration_time"] = eventStream.EventStreamExpirationTime
+	}
+
+	return []map[string]interface{}{data}
+}
+
 func expandGcsData(gcsDatas []interface{}) *storagetransfer.GcsData {
 	if len(gcsDatas) == 0 || gcsDatas[0] == nil {
 		return nil
diff --git a/mmv1/third_party/terraform/services/storagetransfer/resource_storage_transfer_job_test.go b/mmv1/third_party/terraform/services/storagetransfer/resource_storage_transfer_job_test.go
index 0346bb7e6b2b..60a30559d84d 100644
--- a/mmv1/third_party/terraform/services/storagetransfer/resource_storage_transfer_job_test.go
+++ b/mmv1/third_party/terraform/services/storagetransfer/resource_storage_transfer_job_test.go
@@ -199,6 +199,59 @@ func TestAccStorageTransferJob_transferOptions(t *testing.T) {
 	})
 }
 
+func TestAccStorageTransferJob_eventStream(t *testing.T) {
+	t.Parallel()
+
+	testDataSourceBucketName := acctest.RandString(t, 10)
+	testDataSinkName := acctest.RandString(t, 10)
+	testTransferJobDescription := acctest.RandString(t, 10)
+	testPubSubTopicName := fmt.Sprintf("tf-test-topic-%s", acctest.RandString(t, 10))
+	testEventStreamPubSubTopicName := fmt.Sprintf("tf-test-topic-%s", acctest.RandString(t, 10))
+	testPubSubSubscriptionName := fmt.Sprintf("tf-test-subscription-%s", acctest.RandString(t, 10))
+	eventStreamStart := []string{"2014-10-02T15:01:23Z", "2019-10-02T15:01:23Z"}
+	eventStreamEnd := []string{"2022-10-02T15:01:23Z", "2032-10-02T15:01:23Z"}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccStorageTransferJobDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccStorageTransferJob_basic(envvar.GetTestProjectFromEnv(), testDataSourceBucketName, testDataSinkName, testTransferJobDescription, testPubSubTopicName),
+			},
+			{
+				ResourceName:      "google_storage_transfer_job.transfer_job",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccStorageTransferJob_eventStream(envvar.GetTestProjectFromEnv(), testDataSourceBucketName, testDataSinkName, testEventStreamPubSubTopicName, testPubSubSubscriptionName, testTransferJobDescription, eventStreamStart[0], eventStreamEnd[0]),
+			},
+			{
+				ResourceName:      "google_storage_transfer_job.transfer_job",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccStorageTransferJob_eventStream(envvar.GetTestProjectFromEnv(), testDataSourceBucketName, testDataSinkName, testEventStreamPubSubTopicName, testPubSubSubscriptionName, testTransferJobDescription, eventStreamStart[1], eventStreamEnd[0]),
+			},
+			{
+				ResourceName:      "google_storage_transfer_job.transfer_job",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccStorageTransferJob_eventStream(envvar.GetTestProjectFromEnv(), testDataSourceBucketName, testDataSinkName, testEventStreamPubSubTopicName, testPubSubSubscriptionName, testTransferJobDescription, eventStreamStart[1], eventStreamEnd[1]),
+			},
+			{
+				ResourceName:      "google_storage_transfer_job.transfer_job",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func TestAccStorageTransferJob_objectConditions(t *testing.T) {
 	t.Parallel()
 
@@ -381,6 +434,99 @@ resource "google_storage_transfer_job" "transfer_job" {
 `, project, dataSourceBucketName, project, dataSinkBucketName, project, transferJobDescription, project)
 }
 
+func testAccStorageTransferJob_eventStream(project string, dataSourceBucketName string, dataSinkBucketName string, pubsubTopicName string, pubsubSubscriptionName string, transferJobDescription string, eventStreamStart string, eventStreamEnd string) string {
+	return fmt.Sprintf(`
+data "google_storage_transfer_project_service_account" "default" {
+  project = "%s"
+}
+
+resource "google_storage_bucket" "data_source" {
+  name          = "%s"
+  project       = "%s"
+  location      = "US"
+  force_destroy = true
+  uniform_bucket_level_access = true
+}
+
+resource "google_storage_bucket_iam_member" "data_source" {
+  bucket = google_storage_bucket.data_source.name
+  role   = "roles/storage.admin"
+  member = "serviceAccount:${data.google_storage_transfer_project_service_account.default.email}"
+}
+
+resource "google_storage_bucket" "data_sink" {
+  name          = "%s"
+  project       = "%s"
+  location      = "US"
+  force_destroy = true
+  uniform_bucket_level_access = true
+}
+
+resource "google_storage_bucket_iam_member" "data_sink" {
+  bucket = google_storage_bucket.data_sink.name
+  role   = "roles/storage.admin"
+  member = "serviceAccount:${data.google_storage_transfer_project_service_account.default.email}"
+}
+
+resource "google_pubsub_subscription_iam_member" "editor" {
+  subscription = google_pubsub_subscription.example.name
+  role         = "roles/editor"
+  member       = "serviceAccount:${data.google_storage_transfer_project_service_account.default.email}"
+}
+
+resource "google_pubsub_topic" "example" {
+  name = "%s"
+}
+
+resource "google_pubsub_subscription" "example" {
+  name  = "%s"
+  topic = google_pubsub_topic.example.name
+
+  ack_deadline_seconds = 20
+
+  labels = {
+    foo = "bar"
+  }
+
+  push_config {
+    push_endpoint = "https://example.com/push"
+
+    attributes = {
+      x-goog-version = "v1"
+    }
+  }
+}
+
+resource "google_storage_transfer_job" "transfer_job" {
+  description = "%s"
+  project     = "%s"
+
+  event_stream {
+    name = google_pubsub_subscription.example.id
+    event_stream_start_time = "%s"
+    event_stream_expiration_time = "%s"
+  }
+
+  transfer_spec {
+    gcs_data_source {
+      bucket_name = google_storage_bucket.data_source.name
+      path  = "foo/bar/"
+    }
+    gcs_data_sink {
+      bucket_name = google_storage_bucket.data_sink.name
+      path  = "foo/bar/"
+    }
+  }
+
+  depends_on = [
+    google_storage_bucket_iam_member.data_source,
+    google_storage_bucket_iam_member.data_sink,
+    google_pubsub_subscription_iam_member.editor,
+  ]
+}
+`, project, dataSourceBucketName, project, dataSinkBucketName, project, pubsubTopicName, pubsubSubscriptionName, transferJobDescription, project, eventStreamStart, eventStreamEnd)
+}
+
 func testAccStorageTransferJob_omitNotificationConfig(project string, dataSourceBucketName string, dataSinkBucketName string, transferJobDescription string) string {
 	return fmt.Sprintf(`
 data "google_storage_transfer_project_service_account" "default" {
diff --git a/mmv1/third_party/terraform/services/tpuv2/data_source_tpu_v2_accelerator_types.go.erb b/mmv1/third_party/terraform/services/tpuv2/data_source_tpu_v2_accelerator_types.go.erb
new file mode 100644
index 000000000000..3999f1a78887
--- /dev/null
+++ b/mmv1/third_party/terraform/services/tpuv2/data_source_tpu_v2_accelerator_types.go.erb
@@ -0,0 +1,96 @@
+<% autogen_exception -%>
+package tpuv2
+
+<% unless version == 'ga' -%>
+import (
+	"fmt"
+	"log"
+	"sort"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
+)
+
+func DataSourceTpuV2AcceleratorTypes() *schema.Resource {
+	return &schema.Resource{
+		Read: dataSourceTpuV2AcceleratorTypesRead,
+		Schema: map[string]*schema.Schema{
+			"project": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+			"zone": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+			"types": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+		},
+	}
+}
+
+func dataSourceTpuV2AcceleratorTypesRead(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*transport_tpg.Config)
+	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
+	if err != nil {
+		return err
+	}
+
+	project, err := tpgresource.GetProject(d, config)
+	if err != nil {
+		return err
+	}
+
+	zone, err := tpgresource.GetZone(d, config)
+	if err != nil {
+		return err
+	}
+
+	url, err := tpgresource.ReplaceVars(d, config, "{{TpuV2BasePath}}projects/{{project}}/locations/{{zone}}/acceleratorTypes")
+	if err != nil {
+		return err
+	}
+
+	typesRaw, err := tpgresource.PaginatedListRequest(project, url, userAgent, config, flattenTpuV2AcceleratorTypes)
+	if err != nil {
+		return fmt.Errorf("error listing TPU v2 accelerator types: %s", err)
+	}
+
+	types := make([]string, len(typesRaw))
+	for i, typeRaw := range typesRaw {
+		types[i] = typeRaw.(string)
+	}
+	sort.Strings(types)
+
+	log.Printf("[DEBUG] Received Google TPU v2 accelerator types: %q", types)
+
+	if err := d.Set("types", types); err != nil {
+		return fmt.Errorf("error setting types: %s", err)
+	}
+	if err := d.Set("zone", zone); err != nil {
+		return fmt.Errorf("error setting zone: %s", err)
+	}
+	if err := d.Set("project", project); err != nil {
+		return fmt.Errorf("error setting project: %s", err)
+	}
+	d.SetId(fmt.Sprintf("projects/%s/zones/%s", project, zone))
+
+	return nil
+}
+
+func flattenTpuV2AcceleratorTypes(resp map[string]interface{}) []interface{} {
+	typeObjList := resp["acceleratorTypes"].([]interface{})
+	types := make([]interface{}, len(typeObjList))
+	for i, typ := range typeObjList {
+		typeObj := typ.(map[string]interface{})
+		types[i] = typeObj["type"]
+	}
+	return types
+}
+<% end -%>
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/services/tpuv2/data_source_tpu_v2_accelerator_types_test.go.erb b/mmv1/third_party/terraform/services/tpuv2/data_source_tpu_v2_accelerator_types_test.go.erb
new file mode 100644
index 000000000000..839b1eff795b
--- /dev/null
+++ b/mmv1/third_party/terraform/services/tpuv2/data_source_tpu_v2_accelerator_types_test.go.erb
@@ -0,0 +1,73 @@
+<% autogen_exception -%>
+package tpuv2_test
+
+<% unless version == 'ga' -%>
+import (
+	"errors"
+	"fmt"
+	"strconv"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+)
+
+func TestAccTpuV2AcceleratorTypes_basic(t *testing.T) {
+	t.Parallel()
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTpuV2AcceleratorTypesConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTpuV2AcceleratorTypes("data.google_tpu_v2_accelerator_types.available"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckTpuV2AcceleratorTypes(n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("can't find TPU v2 accelerator types data source: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return errors.New("data source id not set")
+		}
+
+		count, ok := rs.Primary.Attributes["types.#"]
+		if !ok {
+			return errors.New("can't find 'types' attribute")
+		}
+
+		cnt, err := strconv.Atoi(count)
+		if err != nil {
+			return errors.New("failed to read number of types")
+		}
+		if cnt < 2 {
+			return fmt.Errorf("expected at least 2 types, received %d, this is most likely a bug", cnt)
+		}
+
+		for i := 0; i < cnt; i++ {
+			idx := fmt.Sprintf("types.%d", i)
+			_, ok := rs.Primary.Attributes[idx]
+			if !ok {
+				return fmt.Errorf("expected %q, type not found", idx)
+			}
+		}
+		return nil
+	}
+}
+
+const testAccTpuV2AcceleratorTypesConfig = `
+data "google_tpu_v2_accelerator_types" "available" {
+	provider = google-beta
+}
+`
+<% end -%>
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/services/tpuv2/data_source_tpu_v2_runtime_versions.go.erb b/mmv1/third_party/terraform/services/tpuv2/data_source_tpu_v2_runtime_versions.go.erb
new file mode 100644
index 000000000000..1068169ad253
--- /dev/null
+++ b/mmv1/third_party/terraform/services/tpuv2/data_source_tpu_v2_runtime_versions.go.erb
@@ -0,0 +1,96 @@
+<% autogen_exception -%>
+package tpuv2
+
+<% unless version == 'ga' -%>
+import (
+	"fmt"
+	"log"
+	"sort"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
+)
+
+func DataSourceTpuV2RuntimeVersions() *schema.Resource {
+	return &schema.Resource{
+		Read: dataSourceTpuV2RuntimeVersionsRead,
+		Schema: map[string]*schema.Schema{
+			"project": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+			"zone": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+			"versions": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+		},
+	}
+}
+
+func dataSourceTpuV2RuntimeVersionsRead(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*transport_tpg.Config)
+	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
+	if err != nil {
+		return err
+	}
+
+	project, err := tpgresource.GetProject(d, config)
+	if err != nil {
+		return err
+	}
+
+	zone, err := tpgresource.GetZone(d, config)
+	if err != nil {
+		return err
+	}
+
+	url, err := tpgresource.ReplaceVars(d, config, "{{TpuV2BasePath}}projects/{{project}}/locations/{{zone}}/runtimeVersions")
+	if err != nil {
+		return err
+	}
+
+	versionsRaw, err := tpgresource.PaginatedListRequest(project, url, userAgent, config, flattenTpuV2RuntimeVersions)
+	if err != nil {
+		return fmt.Errorf("error listing TPU v2 runtime versions: %s", err)
+	}
+
+	versions := make([]string, len(versionsRaw))
+	for i, ver := range versionsRaw {
+		versions[i] = ver.(string)
+	}
+	sort.Strings(versions)
+
+	log.Printf("[DEBUG] Received Google TPU v2 runtime versions: %q", versions)
+
+	if err := d.Set("versions", versions); err != nil {
+		return fmt.Errorf("error setting versions: %s", err)
+	}
+	if err := d.Set("zone", zone); err != nil {
+		return fmt.Errorf("error setting zone: %s", err)
+	}
+	if err := d.Set("project", project); err != nil {
+		return fmt.Errorf("error setting project: %s", err)
+	}
+	d.SetId(fmt.Sprintf("projects/%s/zones/%s", project, zone))
+
+	return nil
+}
+
+func flattenTpuV2RuntimeVersions(resp map[string]interface{}) []interface{} {
+	verObjList := resp["runtimeVersions"].([]interface{})
+	versions := make([]interface{}, len(verObjList))
+	for i, v := range verObjList {
+		verObj := v.(map[string]interface{})
+		versions[i] = verObj["version"]
+	}
+	return versions
+}
+<% end -%>
diff --git a/mmv1/third_party/terraform/services/tpuv2/data_source_tpu_v2_runtime_versions_test.go.erb b/mmv1/third_party/terraform/services/tpuv2/data_source_tpu_v2_runtime_versions_test.go.erb
new file mode 100644
index 000000000000..07f27570f68a
--- /dev/null
+++ b/mmv1/third_party/terraform/services/tpuv2/data_source_tpu_v2_runtime_versions_test.go.erb
@@ -0,0 +1,73 @@
+<% autogen_exception -%>
+package tpuv2_test
+
+<% unless version == 'ga' -%>
+import (
+	"errors"
+	"fmt"
+	"strconv"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+)
+
+func TestAccTpuV2RuntimeVersions_basic(t *testing.T) {
+	t.Parallel()
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTpuV2RuntimeVersionsConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTpuV2RuntimeVersions("data.google_tpu_v2_runtime_versions.available"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckTpuV2RuntimeVersions(n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("can't find TPU v2 runtime versions data source: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return errors.New("data source id not set")
+		}
+
+		count, ok := rs.Primary.Attributes["versions.#"]
+		if !ok {
+			return errors.New("can't find 'versions' attribute")
+		}
+
+		cnt, err := strconv.Atoi(count)
+		if err != nil {
+			return errors.New("failed to read number of versions")
+		}
+		if cnt < 2 {
+			return fmt.Errorf("expected at least 2 versions, received %d, this is most likely a bug", cnt)
+		}
+
+		for i := 0; i < cnt; i++ {
+			idx := fmt.Sprintf("versions.%d", i)
+			_, ok := rs.Primary.Attributes[idx]
+			if !ok {
+				return fmt.Errorf("expected %q, version not found", idx)
+			}
+		}
+		return nil
+	}
+}
+
+const testAccTpuV2RuntimeVersionsConfig = `
+data "google_tpu_v2_runtime_versions" "available" {
+	provider = google-beta
+}
+`
+<% end -%>
diff --git a/mmv1/third_party/terraform/services/tpuv2/resource_tpu_v2_vm_test.go.erb b/mmv1/third_party/terraform/services/tpuv2/resource_tpu_v2_vm_test.go.erb
new file mode 100644
index 000000000000..dec66383d1ee
--- /dev/null
+++ b/mmv1/third_party/terraform/services/tpuv2/resource_tpu_v2_vm_test.go.erb
@@ -0,0 +1,169 @@
+<% autogen_exception -%>
+package tpuv2_test
+
+<% unless version == 'ga' -%>
+import (
+	"testing"
+	"strconv"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+)
+
+func TestAccTpuV2Vm_update(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
+		CheckDestroy:             testAccCheckTpuV2VmDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTpuV2Vm_full(context),
+			},
+			{
+				ResourceName:            "google_tpu_v2_vm.tpu",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels", "zone"},
+			},
+			{
+				Config: testAccTpuV2Vm_update(context, true),
+			},
+			{
+				ResourceName:            "google_tpu_v2_vm.tpu",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels", "zone"},
+			},
+			{
+				Config: testAccTpuV2Vm_update(context, false),
+			},
+			{
+				ResourceName:            "google_tpu_v2_vm.tpu",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels", "zone"},
+			},
+		},
+	})
+}
+
+func testAccTpuV2Vm_full(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_tpu_v2_vm" "tpu" {
+  provider = google-beta
+
+  name        = "tf-test-tpu-%{random_suffix}"
+  zone        = "us-central1-c"
+  description = "Text description of the TPU."
+
+  runtime_version  = "tpu-vm-tf-2.13.0"
+  accelerator_type = "v2-8"
+
+  scheduling_config {
+    preemptible = true
+  }
+
+  data_disks {
+    source_disk = google_compute_disk.disk.id
+    mode        = "READ_ONLY"
+  }
+
+  labels = {
+    foo = "bar"
+  }
+
+  metadata = {
+    foo = "bar"
+  }
+
+  tags = ["foo"]
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "google_compute_disk" "disk" {
+  provider = google-beta
+
+  name  = "tf-test-tpu-disk-%{random_suffix}"
+  image = "debian-cloud/debian-11"
+  size  = 10
+  type  = "pd-ssd"
+  zone  = "us-central1-c"
+}
+`, context)
+}
+
+func testAccTpuV2Vm_update(context map[string]interface{}, preventDestroy bool) string {
+	context["prevent_destroy"] = strconv.FormatBool(preventDestroy)
+
+	return acctest.Nprintf(`
+resource "google_tpu_v2_vm" "tpu" {
+  provider = google-beta
+
+  name        = "tf-test-tpu-%{random_suffix}"
+  zone        = "us-central1-c"
+  description = "Text description of the TPU updated."
+
+  runtime_version  = "tpu-vm-tf-2.13.0"
+  accelerator_type = "v2-8"
+
+  scheduling_config {
+    preemptible = true
+  }
+
+  data_disks {
+    source_disk = google_compute_disk.disk.id
+    mode        = "READ_WRITE"
+  }
+
+  data_disks {
+    source_disk = google_compute_disk.disk2.id
+    mode        = "READ_ONLY"
+  }
+
+  labels = {
+    baz = "bar"
+  }
+
+  metadata = {
+    baz = "bar"
+  }
+
+  tags = ["baz"]
+
+  lifecycle {
+    prevent_destroy = %{prevent_destroy}
+  }
+}
+
+resource "google_compute_disk" "disk" {
+  provider = google-beta
+
+  name  = "tf-test-tpu-disk-%{random_suffix}"
+  image = "debian-cloud/debian-11"
+  size  = 10
+  type  = "pd-ssd"
+  zone  = "us-central1-c"
+}
+
+resource "google_compute_disk" "disk2" {
+  provider = google-beta
+
+  name  = "tf-test-tpu-disk2-%{random_suffix}"
+  image = "debian-cloud/debian-11"
+  size  = 10
+  type  = "pd-ssd"
+  zone  = "us-central1-c"
+}
+`, context)
+}
+<% end -%>
diff --git a/mmv1/third_party/terraform/services/vertexai/data_source_vertex_ai_index.go b/mmv1/third_party/terraform/services/vertexai/data_source_vertex_ai_index.go
index 50e58e12c221..8353f7598327 100644
--- a/mmv1/third_party/terraform/services/vertexai/data_source_vertex_ai_index.go
+++ b/mmv1/third_party/terraform/services/vertexai/data_source_vertex_ai_index.go
@@ -29,5 +29,17 @@ func dataSourceVertexAIIndexRead(d *schema.ResourceData, meta interface{}) error
 		return fmt.Errorf("Error constructing id: %s", err)
 	}
 	d.SetId(id)
-	return resourceVertexAIIndexRead(d, meta)
+	err = resourceVertexAIIndexRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if err := tpgresource.SetDataSourceLabels(d); err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/vertexai/resource_vertex_ai_endpoint_test.go b/mmv1/third_party/terraform/services/vertexai/resource_vertex_ai_endpoint_test.go
index 2cde7c0a6862..09ca7ccc3c05 100644
--- a/mmv1/third_party/terraform/services/vertexai/resource_vertex_ai_endpoint_test.go
+++ b/mmv1/third_party/terraform/services/vertexai/resource_vertex_ai_endpoint_test.go
@@ -18,7 +18,7 @@ func TestAccVertexAIEndpoint_vertexAiEndpointNetwork(t *testing.T) {
 	context := map[string]interface{}{
 		"endpoint_name": fmt.Sprint(acctest.RandInt(t) % 9999999999),
 		"kms_key_name":  acctest.BootstrapKMSKeyInLocation(t, "us-central1").CryptoKey.Name,
-		"network_name":  acctest.BootstrapSharedTestNetwork(t, "vertex-ai-endpoint-update"),
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "vertex-ai-endpoint-update-1"),
 		"random_suffix": acctest.RandString(t, 10),
 	}
 
@@ -34,7 +34,7 @@ func TestAccVertexAIEndpoint_vertexAiEndpointNetwork(t *testing.T) {
 				ResourceName:            "google_vertex_ai_endpoint.endpoint",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"etag", "location", "region"},
+				ImportStateVerifyIgnore: []string{"etag", "location", "region", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccVertexAIEndpoint_vertexAiEndpointNetworkUpdate(context),
@@ -43,7 +43,7 @@ func TestAccVertexAIEndpoint_vertexAiEndpointNetwork(t *testing.T) {
 				ResourceName:            "google_vertex_ai_endpoint.endpoint",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"etag", "location", "region"},
+				ImportStateVerifyIgnore: []string{"etag", "location", "region", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -64,23 +64,6 @@ resource "google_vertex_ai_endpoint" "endpoint" {
   encryption_spec {
     kms_key_name = "%{kms_key_name}"
   }
-  depends_on   = [
-    google_service_networking_connection.vertex_vpc_connection
-  ]
-}
-
-resource "google_service_networking_connection" "vertex_vpc_connection" {
-  network                 = data.google_compute_network.vertex_network.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.vertex_range.name]
-}
-
-resource "google_compute_global_address" "vertex_range" {
-  name          = "tf-test-address-name%{random_suffix}"
-  purpose       = "VPC_PEERING"
-  address_type  = "INTERNAL"
-  prefix_length = 24
-  network       = data.google_compute_network.vertex_network.id
 }
 
 data "google_compute_network" "vertex_network" {
@@ -112,23 +95,6 @@ resource "google_vertex_ai_endpoint" "endpoint" {
   encryption_spec {
     kms_key_name = "%{kms_key_name}"
   }
-  depends_on   = [
-    google_service_networking_connection.vertex_vpc_connection
-  ]
-}
-
-resource "google_service_networking_connection" "vertex_vpc_connection" {
-  network                 = data.google_compute_network.vertex_network.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.vertex_range.name]
-}
-
-resource "google_compute_global_address" "vertex_range" {
-  name          = "tf-test-address-name%{random_suffix}"
-  purpose       = "VPC_PEERING"
-  address_type  = "INTERNAL"
-  prefix_length = 24
-  network       = data.google_compute_network.vertex_network.id
 }
 
 data "google_compute_network" "vertex_network" {
diff --git a/mmv1/third_party/terraform/services/vertexai/resource_vertex_ai_index_endpoint_test.go b/mmv1/third_party/terraform/services/vertexai/resource_vertex_ai_index_endpoint_test.go
index 1e9aa0eb6f22..aac5eb5eeb8d 100644
--- a/mmv1/third_party/terraform/services/vertexai/resource_vertex_ai_index_endpoint_test.go
+++ b/mmv1/third_party/terraform/services/vertexai/resource_vertex_ai_index_endpoint_test.go
@@ -12,7 +12,7 @@ func TestAccVertexAIIndexEndpoint_updated(t *testing.T) {
 	t.Parallel()
 
 	context := map[string]interface{}{
-		"network_name":  acctest.BootstrapSharedTestNetwork(t, "vertex-ai-index-endpoint-update"),
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "vertex-ai-index-endpoint-update-1"),
 		"random_suffix": acctest.RandString(t, 10),
 	}
 
@@ -28,7 +28,7 @@ func TestAccVertexAIIndexEndpoint_updated(t *testing.T) {
 				ResourceName:            "google_vertex_ai_index_endpoint.index_endpoint",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"etag", "region"},
+				ImportStateVerifyIgnore: []string{"etag", "region", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccVertexAIIndexEndpoint_updated(context),
@@ -37,7 +37,7 @@ func TestAccVertexAIIndexEndpoint_updated(t *testing.T) {
 				ResourceName:            "google_vertex_ai_index_endpoint.index_endpoint",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"etag", "region"},
+				ImportStateVerifyIgnore: []string{"etag", "region", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -53,15 +53,8 @@ resource "google_vertex_ai_index_endpoint" "index_endpoint" {
     label-one = "value-one"
   }
   network      = "projects/${data.google_project.project.number}/global/networks/${data.google_compute_network.vertex_network.name}"
-  depends_on   = [
-    google_service_networking_connection.vertex_vpc_connection
-  ]
-}
-resource "google_service_networking_connection" "vertex_vpc_connection" {
-  network                 = data.google_compute_network.vertex_network.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.vertex_range.name]
 }
+
 resource "google_compute_global_address" "vertex_range" {
   name          = "tf-test-address-name%{random_suffix}"
   purpose       = "VPC_PEERING"
@@ -87,22 +80,8 @@ resource "google_vertex_ai_index_endpoint" "index_endpoint" {
     label-two = "value-two"
   }
   network      = "projects/${data.google_project.project.number}/global/networks/${data.google_compute_network.vertex_network.name}"
-  depends_on   = [
-    google_service_networking_connection.vertex_vpc_connection
-  ]
-}
-resource "google_service_networking_connection" "vertex_vpc_connection" {
-  network                 = data.google_compute_network.vertex_network.id
-  service                 = "servicenetworking.googleapis.com"
-  reserved_peering_ranges = [google_compute_global_address.vertex_range.name]
-}
-resource "google_compute_global_address" "vertex_range" {
-  name          = "tf-test-address-name%{random_suffix}"
-  purpose       = "VPC_PEERING"
-  address_type  = "INTERNAL"
-  prefix_length = 24
-  network       = data.google_compute_network.vertex_network.id
 }
+
 data "google_compute_network" "vertex_network" {
   name       = "%{network_name}"
 }
diff --git a/mmv1/third_party/terraform/services/vertexai/resource_vertex_ai_index_test.go b/mmv1/third_party/terraform/services/vertexai/resource_vertex_ai_index_test.go
index 09964869d97a..bd8f8d7e005c 100644
--- a/mmv1/third_party/terraform/services/vertexai/resource_vertex_ai_index_test.go
+++ b/mmv1/third_party/terraform/services/vertexai/resource_vertex_ai_index_test.go
@@ -34,7 +34,7 @@ func TestAccVertexAIIndex_updated(t *testing.T) {
 				ResourceName:            "google_vertex_ai_index.index",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"etag", "region", "metadata.0.contents_delta_uri", "metadata.0.is_complete_overwrite"},
+				ImportStateVerifyIgnore: []string{"etag", "region", "metadata.0.contents_delta_uri", "metadata.0.is_complete_overwrite", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccVertexAIIndex_updated(context),
@@ -43,7 +43,7 @@ func TestAccVertexAIIndex_updated(t *testing.T) {
 				ResourceName:            "google_vertex_ai_index.index",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"etag", "region", "metadata.0.contents_delta_uri", "metadata.0.is_complete_overwrite"},
+				ImportStateVerifyIgnore: []string{"etag", "region", "metadata.0.contents_delta_uri", "metadata.0.is_complete_overwrite", "labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/vertexai/resource_vertex_ai_tensorboard_test.go b/mmv1/third_party/terraform/services/vertexai/resource_vertex_ai_tensorboard_test.go
index d620fdfdeee7..a684ba95b623 100644
--- a/mmv1/third_party/terraform/services/vertexai/resource_vertex_ai_tensorboard_test.go
+++ b/mmv1/third_party/terraform/services/vertexai/resource_vertex_ai_tensorboard_test.go
@@ -25,7 +25,7 @@ func TestAccVertexAITensorboard_Update(t *testing.T) {
 				ResourceName:            "google_vertex_ai_tensorboard.tensorboard",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"region", "project"},
+				ImportStateVerifyIgnore: []string{"region", "project", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccVertexAITensorboard_Update(random_suffix+"new", random_suffix, random_suffix, random_suffix),
@@ -34,7 +34,7 @@ func TestAccVertexAITensorboard_Update(t *testing.T) {
 				ResourceName:            "google_vertex_ai_tensorboard.tensorboard",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"region", "project"},
+				ImportStateVerifyIgnore: []string{"region", "project", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccVertexAITensorboard_Update(random_suffix+"new", random_suffix+"new", random_suffix, random_suffix),
@@ -43,7 +43,7 @@ func TestAccVertexAITensorboard_Update(t *testing.T) {
 				ResourceName:            "google_vertex_ai_tensorboard.tensorboard",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"region", "project"},
+				ImportStateVerifyIgnore: []string{"region", "project", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccVertexAITensorboard_Update(random_suffix+"new", random_suffix+"new", random_suffix+"new", random_suffix),
@@ -52,7 +52,7 @@ func TestAccVertexAITensorboard_Update(t *testing.T) {
 				ResourceName:            "google_vertex_ai_tensorboard.tensorboard",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"region", "project"},
+				ImportStateVerifyIgnore: []string{"region", "project", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccVertexAITensorboard_Update(random_suffix+"new", random_suffix+"new", random_suffix+"new", random_suffix+"new"),
@@ -61,7 +61,7 @@ func TestAccVertexAITensorboard_Update(t *testing.T) {
 				ResourceName:            "google_vertex_ai_tensorboard.tensorboard",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"region", "project"},
+				ImportStateVerifyIgnore: []string{"region", "project", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccVertexAITensorboard_Update(random_suffix, random_suffix, random_suffix, random_suffix),
@@ -70,7 +70,7 @@ func TestAccVertexAITensorboard_Update(t *testing.T) {
 				ResourceName:            "google_vertex_ai_tensorboard.tensorboard",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"region", "project"},
+				ImportStateVerifyIgnore: []string{"region", "project", "labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/vmwareengine/data_source_google_vmwareengine_cluster.go.erb b/mmv1/third_party/terraform/services/vmwareengine/data_source_google_vmwareengine_cluster.go.erb
index b5668f99aaee..cdeff513d0e0 100644
--- a/mmv1/third_party/terraform/services/vmwareengine/data_source_google_vmwareengine_cluster.go.erb
+++ b/mmv1/third_party/terraform/services/vmwareengine/data_source_google_vmwareengine_cluster.go.erb
@@ -28,6 +28,14 @@ func dataSourceVmwareengineClusterRead(d *schema.ResourceData, meta interface{})
 		return fmt.Errorf("Error constructing id: %s", err)
 	}
 	d.SetId(id)
-	return resourceVmwareengineClusterRead(d, meta)
+	err = resourceVmwareengineClusterRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
 }
 <% end -%>
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/services/vmwareengine/data_source_google_vmwareengine_network.go.erb b/mmv1/third_party/terraform/services/vmwareengine/data_source_google_vmwareengine_network.go.erb
index dbbdfa4f2fd8..87465bef390a 100644
--- a/mmv1/third_party/terraform/services/vmwareengine/data_source_google_vmwareengine_network.go.erb
+++ b/mmv1/third_party/terraform/services/vmwareengine/data_source_google_vmwareengine_network.go.erb
@@ -30,6 +30,14 @@ func dataSourceVmwareengineNetworkRead(d *schema.ResourceData, meta interface{})
 		return fmt.Errorf("Error constructing id: %s", err)
 	}
 	d.SetId(id)
-	return resourceVmwareengineNetworkRead(d, meta)
+	err = resourceVmwareengineNetworkRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
 }
 <% end -%>
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/services/vmwareengine/data_source_google_vmwareengine_private_cloud.go.erb b/mmv1/third_party/terraform/services/vmwareengine/data_source_google_vmwareengine_private_cloud.go.erb
index 800536162504..915240857698 100644
--- a/mmv1/third_party/terraform/services/vmwareengine/data_source_google_vmwareengine_private_cloud.go.erb
+++ b/mmv1/third_party/terraform/services/vmwareengine/data_source_google_vmwareengine_private_cloud.go.erb
@@ -30,6 +30,14 @@ func dataSourceVmwareenginePrivateCloudRead(d *schema.ResourceData, meta interfa
 		return fmt.Errorf("Error constructing id: %s", err)
 	}
 	d.SetId(id)
-	return resourceVmwareenginePrivateCloudRead(d, meta)
+	err = resourceVmwareenginePrivateCloudRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
 }
 <% end -%>
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/services/vmwareengine/resource_vmwareengine_private_cloud_test.go.erb b/mmv1/third_party/terraform/services/vmwareengine/resource_vmwareengine_private_cloud_test.go.erb
index 6a0d8f1148fc..8f7ced9a58d0 100644
--- a/mmv1/third_party/terraform/services/vmwareengine/resource_vmwareengine_private_cloud_test.go.erb
+++ b/mmv1/third_party/terraform/services/vmwareengine/resource_vmwareengine_private_cloud_test.go.erb
@@ -11,24 +11,24 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 
 	"github.com/hashicorp/terraform-provider-google/google/acctest"
-	"github.com/hashicorp/terraform-provider-google/google/envvar"
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 )
 
 func TestAccVmwareenginePrivateCloud_vmwareEnginePrivateCloudUpdate(t *testing.T) {
+	acctest.SkipIfVcr(t)
 	t.Parallel()
+
 	context := map[string]interface{}{
-		"region":        "southamerica-west1", // using region with low node utilization.
-		"random_suffix": 	acctest.RandString(t, 10),
-		"organization":    envvar.GetTestOrgFromEnv(t),
-		"billing_account": envvar.GetTestBillingAccountFromEnv(t),
+		"region":          "southamerica-east1",
+		"random_suffix":   acctest.RandString(t, 10),
 	}
+
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
 		CheckDestroy:             testAccCheckVmwareenginePrivateCloudDestroyProducer(t),
-    ExternalProviders: map[string]resource.ExternalProvider {
+		ExternalProviders: map[string]resource.ExternalProvider {
 			"time":   {},
 		},
 		Steps: []resource.TestStep{
@@ -69,17 +69,16 @@ func testPrivateCloudUpdateConfig(context map[string]interface{}, description st
 
 	return acctest.Nprintf(`
 resource "google_vmwareengine_network" "default-nw" {
-   provider      	   = google-beta
-   project           = google_project_service.acceptance.project
-   name              = "%{region}-default"
-   location          = "%{region}"
-   type              = "LEGACY"
+  provider          = google-beta
+  name              = "%{region}-default"
+  location          = "%{region}"
+  type              = "LEGACY"
+  description       = "PC network description."
 }
 
 resource "google_vmwareengine_private_cloud" "vmw-engine-pc" {
   location = "%{region}-a"
   name = "tf-test-sample-pc%{random_suffix}"
-  project = google_project_service.acceptance.project
   provider = google-beta
   description = "%{description}"
   network_config {
@@ -95,30 +94,6 @@ resource "google_vmwareengine_private_cloud" "vmw-engine-pc" {
     }
   }
 }
-
-# there can be only 1 Legacy network per region for a given project, so creating new project to isolate tests.
-resource "google_project" "acceptance" {
-  name            = "tf-test-%{random_suffix}"
-  provider        = google-beta
-  project_id      = "tf-test-%{random_suffix}"
-  org_id          = "%{organization}"
-  billing_account = "%{billing_account}"
-}
-
-resource "google_project_service" "acceptance" {
-  project  = google_project.acceptance.project_id
-  provider = google-beta
-  service  = "vmwareengine.googleapis.com"
-
-  # Needed for CI tests for permissions to propagate, should not be needed for actual usage
-  depends_on = [time_sleep.wait_60_seconds]
-}
-
-resource "time_sleep" "wait_60_seconds" {
-  depends_on = [google_project.acceptance]
-
-  create_duration = "60s"
-}
 `, context)
 }
 
diff --git a/mmv1/third_party/terraform/services/vpcaccess/data_source_vpc_access_connector.go b/mmv1/third_party/terraform/services/vpcaccess/data_source_vpc_access_connector.go
index 7caa852d8ee7..b8b79401c819 100644
--- a/mmv1/third_party/terraform/services/vpcaccess/data_source_vpc_access_connector.go
+++ b/mmv1/third_party/terraform/services/vpcaccess/data_source_vpc_access_connector.go
@@ -30,5 +30,13 @@ func dataSourceVPCAccessConnectorRead(d *schema.ResourceData, meta interface{})
 
 	d.SetId(id)
 
-	return resourceVPCAccessConnectorRead(d, meta)
+	err = resourceVPCAccessConnectorRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	if d.Id() == "" {
+		return fmt.Errorf("%s not found", id)
+	}
+	return nil
 }
diff --git a/mmv1/third_party/terraform/services/workflows/resource_workflows_workflow_test.go b/mmv1/third_party/terraform/services/workflows/resource_workflows_workflow_test.go.erb
similarity index 95%
rename from mmv1/third_party/terraform/services/workflows/resource_workflows_workflow_test.go
rename to mmv1/third_party/terraform/services/workflows/resource_workflows_workflow_test.go.erb
index 98eca1b42649..c3a58e4a2bbc 100644
--- a/mmv1/third_party/terraform/services/workflows/resource_workflows_workflow_test.go
+++ b/mmv1/third_party/terraform/services/workflows/resource_workflows_workflow_test.go.erb
@@ -1,3 +1,4 @@
+<% autogen_exception -%>
 package workflows_test
 
 import (
@@ -39,6 +40,9 @@ resource "google_workflows_workflow" "example" {
   name          = "%s"
   region        = "us-central1"
   description   = "Magic"
+  user_env_vars = {
+    url = "https://timeapi.io/api/Time/current/zone?timeZone=Europe/Amsterdam"
+  }
   source_contents = <<-EOF
   # This is a sample workflow, feel free to replace it with your source code
   #
@@ -53,7 +57,7 @@ resource "google_workflows_workflow" "example" {
   - getCurrentTime:
       call: http.get
       args:
-          url: https://us-central1-workflowsample.cloudfunctions.net/datetime
+          url: $${sys.get_env("url")}
       result: CurrentDateTime
   - readWikipedia:
       call: http.get
@@ -76,6 +80,9 @@ resource "google_workflows_workflow" "example" {
   name          = "%s"
   region        = "us-central1"
   description   = "Magic"
+  user_env_vars = {
+    url = "https://timeapi.io/api/Time/current/zone?timeZone=Europe/Amsterdam"
+  }
   source_contents = <<-EOF
   # This is a sample workflow, feel free to replace it with your source code
   #
@@ -90,7 +97,7 @@ resource "google_workflows_workflow" "example" {
   - getCurrentTime:
       call: http.get
       args:
-          url: https://us-central1-workflowsample.cloudfunctions.net/datetime
+          url: $${sys.get_env("url")}
       result: CurrentDateTime
   - readWikipedia:
       call: http.get
@@ -211,3 +218,4 @@ EOF
 }
 `, workflowName, kmsKeyName)
 }
+
diff --git a/mmv1/third_party/terraform/services/workstations/resource_workstations_workstation_cluster_test.go.erb b/mmv1/third_party/terraform/services/workstations/resource_workstations_workstation_cluster_test.go.erb
index af09534de104..57f5de6e6381 100644
--- a/mmv1/third_party/terraform/services/workstations/resource_workstations_workstation_cluster_test.go.erb
+++ b/mmv1/third_party/terraform/services/workstations/resource_workstations_workstation_cluster_test.go.erb
@@ -28,7 +28,7 @@ func TestAccWorkstationsWorkstationCluster_update(t *testing.T) {
 				ResourceName:            "google_workstations_workstation_cluster.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"etag"},
+				ImportStateVerifyIgnore: []string{"etag", "annotations", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccWorkstationsWorkstationCluster_update(context),
@@ -37,7 +37,7 @@ func TestAccWorkstationsWorkstationCluster_update(t *testing.T) {
 				ResourceName:            "google_workstations_workstation_cluster.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"etag"},
+				ImportStateVerifyIgnore: []string{"etag", "annotations", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -62,7 +62,7 @@ func TestAccWorkstationsWorkstationCluster_Private_update(t *testing.T) {
 				ResourceName:            "google_workstations_workstation_cluster.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"etag"},
+				ImportStateVerifyIgnore: []string{"etag", "annotations", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccWorkstationsWorkstationCluster_private_update(context),
@@ -71,7 +71,7 @@ func TestAccWorkstationsWorkstationCluster_Private_update(t *testing.T) {
 				ResourceName:            "google_workstations_workstation_cluster.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"etag"},
+				ImportStateVerifyIgnore: []string{"etag", "annotations", "labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/mmv1/third_party/terraform/services/workstations/resource_workstations_workstation_config_test.go.erb b/mmv1/third_party/terraform/services/workstations/resource_workstations_workstation_config_test.go.erb
index ebdc135e6095..be4492fcff75 100644
--- a/mmv1/third_party/terraform/services/workstations/resource_workstations_workstation_config_test.go.erb
+++ b/mmv1/third_party/terraform/services/workstations/resource_workstations_workstation_config_test.go.erb
@@ -28,7 +28,7 @@ func TestAccWorkstationsWorkstationConfig_basic(t *testing.T) {
 				ResourceName:            "google_workstations_workstation_cluster.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"etag"},
+				ImportStateVerifyIgnore: []string{"etag", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -95,7 +95,7 @@ func TestAccWorkstationsWorkstationConfig_displayName(t *testing.T) {
 				ResourceName:            "google_workstations_workstation_cluster.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"etag"},
+				ImportStateVerifyIgnore: []string{"etag", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccWorkstationsWorkstationConfig_displayName(context, "2"),
@@ -104,7 +104,7 @@ func TestAccWorkstationsWorkstationConfig_displayName(t *testing.T) {
 				ResourceName:            "google_workstations_workstation_cluster.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"etag"},
+				ImportStateVerifyIgnore: []string{"etag", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -172,7 +172,7 @@ func TestAccWorkstationsWorkstationConfig_persistentDirectories(t *testing.T) {
 				ResourceName:            "google_workstations_workstation_cluster.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"etag"},
+				ImportStateVerifyIgnore: []string{"etag", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -223,6 +223,81 @@ resource "google_workstations_workstation_config" "default" {
 `, context)
 }
 
+
+func TestAccWorkstationsWorkstationConfig_serviceAccount(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
+		CheckDestroy:             testAccCheckWorkstationsWorkstationConfigDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccWorkstationsWorkstationConfig_serviceAccount(context),
+			},
+			{
+				ResourceName:            "google_workstations_workstation_cluster.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"etag"},
+			},
+		},
+	})
+}
+
+func testAccWorkstationsWorkstationConfig_serviceAccount(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+  resource "google_compute_network" "default" {
+    provider                = google-beta
+    name                    = "tf-test-workstation-cluster%{random_suffix}"
+    auto_create_subnetworks = false
+  }
+  
+  resource "google_compute_subnetwork" "default" {
+    provider      = google-beta
+    name          = "tf-test-workstation-cluster%{random_suffix}"
+    ip_cidr_range = "10.0.0.0/24"
+    region        = "us-central1"
+    network       = google_compute_network.default.name
+  }
+  
+  resource "google_workstations_workstation_cluster" "default" {
+    provider                   = google-beta
+    workstation_cluster_id     = "tf-test-workstation-cluster%{random_suffix}"
+    network                    = google_compute_network.default.id
+    subnetwork                 = google_compute_subnetwork.default.id
+    location                   = "us-central1"
+  }
+  
+  resource "google_service_account" "default" {
+    provider = google-beta
+  
+    account_id   = "tf-test-my-account%{random_suffix}"
+    display_name = "Service Account"
+  }
+  
+  resource "google_workstations_workstation_config" "default" {
+    provider               = google-beta
+    workstation_config_id  = "tf-test-workstation-config%{random_suffix}"
+    workstation_cluster_id = google_workstations_workstation_cluster.default.workstation_cluster_id
+    location               = "us-central1"
+
+    enable_audit_agent     = true
+  
+    host {
+      gce_instance {  
+        service_account             = google_service_account.default.email
+        service_account_scopes      = ["https://www.googleapis.com/auth/cloud-platform"]
+      }
+    }
+  }
+`, context)
+}
+
 func TestAccWorkstationsWorkstationConfig_update(t *testing.T) {
 	t.Parallel()
 
@@ -242,7 +317,7 @@ func TestAccWorkstationsWorkstationConfig_update(t *testing.T) {
 				ResourceName:            "google_workstations_workstation_cluster.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"etag"},
+				ImportStateVerifyIgnore: []string{"etag", "annotations", "labels", "terraform_labels"},
 			},
 			{
 				Config: testAccWorkstationsWorkstationConfig_update(context),
@@ -251,7 +326,7 @@ func TestAccWorkstationsWorkstationConfig_update(t *testing.T) {
 				ResourceName:            "google_workstations_workstation_cluster.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"etag"},
+				ImportStateVerifyIgnore: []string{"etag", "annotations", "labels", "terraform_labels"},
 			},
       {
 				Config: testAccWorkstationsWorkstationConfig_workstationConfigBasicExample(context),
@@ -260,7 +335,7 @@ func TestAccWorkstationsWorkstationConfig_update(t *testing.T) {
 				ResourceName:            "google_workstations_workstation_cluster.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"etag"},
+				ImportStateVerifyIgnore: []string{"etag", "annotations", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -387,6 +462,13 @@ resource "google_workstations_workstation_cluster" "default" {
   location                   = "us-central1"
 }
 
+resource "google_service_account" "default" {
+  provider = google-beta
+
+  account_id   = "tf-test-my-account%{random_suffix}"
+  display_name = "Service Account"
+}
+
 resource "google_workstations_workstation_config" "default" {
   provider               = google-beta
   workstation_config_id  = "tf-test-workstation-config%{random_suffix}"
@@ -399,6 +481,7 @@ resource "google_workstations_workstation_config" "default" {
       boot_disk_size_gb           = 35
       pool_size                   = 0
 
+      service_account             = google_service_account.default.email
       disable_public_ip_addresses = false
 
       shielded_instance_config {
@@ -780,4 +863,4 @@ resource "google_workstations_workstation_config" "default" {
 }
 `, context)
 }
-<% end -%>
+<% end -%>
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/services/workstations/resource_workstations_workstation_test.go.erb b/mmv1/third_party/terraform/services/workstations/resource_workstations_workstation_test.go.erb
index 1c0bc6af56dd..f1de41975189 100644
--- a/mmv1/third_party/terraform/services/workstations/resource_workstations_workstation_test.go.erb
+++ b/mmv1/third_party/terraform/services/workstations/resource_workstations_workstation_test.go.erb
@@ -28,7 +28,7 @@ func TestAccWorkstationsWorkstation_update(t *testing.T) {
 				ResourceName:            "google_workstations_workstation_cluster.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"etag"},
+				ImportStateVerifyIgnore: []string{"etag", "labels", "terraform_labels"},
 			},
       {
 				Config: testAccWorkstationsWorkstation_modified(context),
@@ -37,7 +37,7 @@ func TestAccWorkstationsWorkstation_update(t *testing.T) {
 				ResourceName:            "google_workstations_workstation_cluster.default",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"etag"},
+				ImportStateVerifyIgnore: []string{"etag", "labels", "terraform_labels"},
 			},
 		},
 	})
@@ -88,6 +88,10 @@ resource "google_workstations_workstation" "default" {
   labels = {
 	  foo = "bar"
   }
+
+  env = {
+    name = "bar"
+  }
 }
 `, context)
 }
@@ -137,6 +141,10 @@ resource "google_workstations_workstation" "default" {
   labels = {
 	  foo = "bar"
   }
+
+  env = {
+    name = "test"
+  }
 }
 `, context)
 }
diff --git a/mmv1/third_party/terraform/sweeper/gcp_sweeper_test.go.erb b/mmv1/third_party/terraform/sweeper/gcp_sweeper_test.go.erb
index 222990db0d95..d33b3ca37f7d 100644
--- a/mmv1/third_party/terraform/sweeper/gcp_sweeper_test.go.erb
+++ b/mmv1/third_party/terraform/sweeper/gcp_sweeper_test.go.erb
@@ -18,6 +18,7 @@ import (
 	_ "github.com/hashicorp/terraform-provider-google/google/services/container"
 	_ "github.com/hashicorp/terraform-provider-google/google/services/containeraws"
 	_ "github.com/hashicorp/terraform-provider-google/google/services/containerazure"
+	_ "github.com/hashicorp/terraform-provider-google/google/services/dataflow"
 	_ "github.com/hashicorp/terraform-provider-google/google/services/eventarc"
 	_ "github.com/hashicorp/terraform-provider-google/google/services/firebase"
 	_ "github.com/hashicorp/terraform-provider-google/google/services/firebaserules"
diff --git a/mmv1/third_party/terraform/tpgresource/annotations.go b/mmv1/third_party/terraform/tpgresource/annotations.go
new file mode 100644
index 000000000000..410fbd2355d4
--- /dev/null
+++ b/mmv1/third_party/terraform/tpgresource/annotations.go
@@ -0,0 +1,95 @@
+package tpgresource
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+func SetAnnotationsDiff(_ context.Context, d *schema.ResourceDiff, meta interface{}) error {
+	raw := d.Get("annotations")
+	if raw == nil {
+		return nil
+	}
+
+	if d.Get("effective_annotations") == nil {
+		return fmt.Errorf("`effective_annotations` field is not present in the resource schema.")
+	}
+
+	o, n := d.GetChange("annotations")
+	effectiveAnnotations := d.Get("effective_annotations").(map[string]interface{})
+
+	for k, v := range n.(map[string]interface{}) {
+		effectiveAnnotations[k] = v.(string)
+	}
+
+	for k := range o.(map[string]interface{}) {
+		if _, ok := n.(map[string]interface{})[k]; !ok {
+			delete(effectiveAnnotations, k)
+		}
+	}
+
+	if err := d.SetNew("effective_annotations", effectiveAnnotations); err != nil {
+		return fmt.Errorf("error setting new effective_annotations diff: %w", err)
+	}
+
+	return nil
+}
+
+func SetMetadataAnnotationsDiff(_ context.Context, d *schema.ResourceDiff, meta interface{}) error {
+	l := d.Get("metadata").([]interface{})
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
+
+	raw := d.Get("metadata.0.annotations")
+	if raw == nil {
+		return nil
+	}
+
+	if d.Get("metadata.0.effective_annotations") == nil {
+		return fmt.Errorf("`metadata.0.effective_annotations` field is not present in the resource schema.")
+	}
+
+	o, n := d.GetChange("metadata.0.annotations")
+	effectiveAnnotations := d.Get("metadata.0.effective_annotations").(map[string]interface{})
+
+	for k, v := range n.(map[string]interface{}) {
+		effectiveAnnotations[k] = v.(string)
+	}
+
+	for k := range o.(map[string]interface{}) {
+		if _, ok := n.(map[string]interface{})[k]; !ok {
+			delete(effectiveAnnotations, k)
+		}
+	}
+
+	original := l[0].(map[string]interface{})
+	original["effective_annotations"] = effectiveAnnotations
+
+	if err := d.SetNew("metadata", []interface{}{original}); err != nil {
+		return fmt.Errorf("error setting new metadata diff: %w", err)
+	}
+
+	return nil
+}
+
+// Sets the "annotations" field with the value of the field "effective_annotations" for data sources.
+// When reading data source, as the annotations field is unavailable in the configuration of the data source,
+// the "annotations" field will be empty. With this funciton, the labels "annotations" will have all of annotations in the resource.
+func SetDataSourceAnnotations(d *schema.ResourceData) error {
+	effectiveAnnotations := d.Get("effective_annotations")
+	if effectiveAnnotations == nil {
+		return nil
+	}
+
+	if d.Get("annotations") == nil {
+		return fmt.Errorf("`annotations` field is not present in the resource schema.")
+	}
+	if err := d.Set("annotations", effectiveAnnotations); err != nil {
+		return fmt.Errorf("Error setting annotations in data source: %s", err)
+	}
+
+	return nil
+}
diff --git a/mmv1/third_party/terraform/tpgresource/common_diff_suppress.go.erb b/mmv1/third_party/terraform/tpgresource/common_diff_suppress.go.erb
index b02b0204f400..35dac06e822f 100644
--- a/mmv1/third_party/terraform/tpgresource/common_diff_suppress.go.erb
+++ b/mmv1/third_party/terraform/tpgresource/common_diff_suppress.go.erb
@@ -13,6 +13,7 @@ import (
 	"strconv"
 	"strings"
 	"time"
+	"bytes"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 )
@@ -55,6 +56,11 @@ func EmptyOrDefaultStringSuppress(defaultVal string) schema.SchemaDiffSuppressFu
 	}
 }
 
+func EmptyOrFalseSuppressBoolean(k, old, new string, d *schema.ResourceData) bool {
+	o, n := d.GetChange(k)
+	return (o == nil && !n.(bool))
+}
+
 func IpCidrRangeDiffSuppress(k, old, new string, d *schema.ResourceData) bool {
 	// The range may be a:
 	// A) single IP address (e.g. 10.2.3.4)
@@ -173,9 +179,24 @@ func TimestampDiffSuppress(format string) schema.SchemaDiffSuppressFunc {
 	}
 }
 
-// suppress diff when saved is Ipv4 format while new is required a reference
+// suppress diff when saved is Ipv4 and Ipv6 format while new is required a reference
 // this happens for an internal ip for Private Services Connect
 func InternalIpDiffSuppress(_, old, new string, _ *schema.ResourceData) bool {
+	olds := strings.Split(old, "/")
+	news := strings.Split(new, "/")
+
+	if len(olds) == 2 {
+		if len(news) == 2 {
+			return bytes.Equal(net.ParseIP(olds[0]), net.ParseIP(news[0])) && olds[1] == news[1]
+		} else {
+			return (net.ParseIP(olds[0]) != nil) && (net.ParseIP(new) == nil)
+		}
+	}
+
+	if (net.ParseIP(old) != nil) && (net.ParseIP(new) != nil) {
+		return bytes.Equal(net.ParseIP(old), net.ParseIP(new))
+	}
+
 	return (net.ParseIP(old) != nil) && (net.ParseIP(new) == nil)
 }
 
diff --git a/mmv1/third_party/terraform/tpgresource/common_diff_suppress_test.go b/mmv1/third_party/terraform/tpgresource/common_diff_suppress_test.go
index 6315ada0dd6b..990003fd2264 100644
--- a/mmv1/third_party/terraform/tpgresource/common_diff_suppress_test.go
+++ b/mmv1/third_party/terraform/tpgresource/common_diff_suppress_test.go
@@ -285,6 +285,70 @@ func TestDurationDiffSuppress(t *testing.T) {
 	}
 }
 
+func TestInternalIpDiffSuppress(t *testing.T) {
+	cases := map[string]struct {
+		Old, New           string
+		ExpectDiffSuppress bool
+	}{
+		"same1 ipv6s": {
+			Old:                "2600:1900:4020:31cd:8000:0:0:0",
+			New:                "2600:1900:4020:31cd:8000::",
+			ExpectDiffSuppress: true,
+		},
+		"same2 ipv6s": {
+			Old:                "2600:1900:4020:31cd:8000:0:0:0/96",
+			New:                "2600:1900:4020:31cd:8000::/96",
+			ExpectDiffSuppress: true,
+		},
+		"same3 ipv6s": {
+			Old:                "2600:1900:4020:31cd:8000:0:0:0/96",
+			New:                "https://www.googleapis.com/compute/v1/projects/myproject/regions/us-central1/addresses/myaddress",
+			ExpectDiffSuppress: true,
+		},
+		"different1 ipv6s": {
+			Old:                "2600:1900:4020:31cd:8000:0:0:0",
+			New:                "2600:1900:4020:31cd:8001::",
+			ExpectDiffSuppress: false,
+		},
+		"different2 ipv6s": {
+			Old:                "2600:1900:4020:31cd:8000:0:0:0",
+			New:                "2600:1900:4020:31cd:8000:0:0:8000",
+			ExpectDiffSuppress: false,
+		},
+		"different3 ipv6s": {
+			Old:                "2600:1900:4020:31cd:8000:0:0:0/96",
+			New:                "2600:1900:4020:31cd:8001::/96",
+			ExpectDiffSuppress: false,
+		},
+		"different ipv4s": {
+			Old:                "1.2.3.4",
+			New:                "1.2.3.5",
+			ExpectDiffSuppress: false,
+		},
+		"same ipv4s": {
+			Old:                "1.2.3.4",
+			New:                "1.2.3.4",
+			ExpectDiffSuppress: true,
+		},
+		"ipv4 vs id": {
+			Old:                "1.2.3.4",
+			New:                "google_compute_address.my_ipv4_addr.address",
+			ExpectDiffSuppress: true,
+		},
+		"ipv6 vs id": {
+			Old:                "2600:1900:4020:31cd:8000:0:0:0",
+			New:                "google_compute_address.my_ipv6_addr.address",
+			ExpectDiffSuppress: true,
+		},
+	}
+
+	for tn, tc := range cases {
+		if InternalIpDiffSuppress("ipv4/v6_compare", tc.Old, tc.New, nil) != tc.ExpectDiffSuppress {
+			t.Fatalf("bad: %s, '%s' => '%s' expect %t", tn, tc.Old, tc.New, tc.ExpectDiffSuppress)
+		}
+	}
+}
+
 func TestLastSlashDiffSuppress(t *testing.T) {
 	cases := map[string]struct {
 		Old, New           string
diff --git a/mmv1/third_party/terraform/tpgresource/field_helpers.go b/mmv1/third_party/terraform/tpgresource/field_helpers.go
index a6e700c71ba4..427e492352cb 100644
--- a/mmv1/third_party/terraform/tpgresource/field_helpers.go
+++ b/mmv1/third_party/terraform/tpgresource/field_helpers.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"regexp"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 )
 
@@ -234,6 +235,61 @@ func ParseZonalFieldValue(resourceType, fieldValue, projectSchemaField, zoneSche
 	}, nil
 }
 
+// Parses a zonal field supporting 5 different formats:
+// - https://www.googleapis.com/compute/ANY_VERSION/projects/{my_project}/zones/{zone}/{resource_type}/{resource_name}
+// - projects/{my_project}/zones/{zone}/{resource_type}/{resource_name}
+// - zones/{zone}/{resource_type}/{resource_name}
+// - resource_name
+// - "" (empty string). RelativeLink() returns empty if isEmptyValid is true.
+//
+// If the project is not specified, it first tries to get the project from the `projectSchemaField` and then fallback on the default project.
+// If the zone is not specified, it takes the value of `zoneSchemaField`.
+func ParseZonalFieldValueDiff(resourceType, fieldValue, projectSchemaField, zoneSchemaField string, d *schema.ResourceDiff, config *transport_tpg.Config, isEmptyValid bool) (*ZonalFieldValue, error) {
+	r := regexp.MustCompile(fmt.Sprintf(ZonalLinkBasePattern, resourceType))
+	if parts := r.FindStringSubmatch(fieldValue); parts != nil {
+		return &ZonalFieldValue{
+			Project:      parts[1],
+			Zone:         parts[2],
+			Name:         parts[3],
+			ResourceType: resourceType,
+		}, nil
+	}
+
+	project, err := GetProjectFromDiff(d, config)
+	if err != nil {
+		return nil, err
+	}
+
+	r = regexp.MustCompile(fmt.Sprintf(ZonalPartialLinkBasePattern, resourceType))
+	if parts := r.FindStringSubmatch(fieldValue); parts != nil {
+		return &ZonalFieldValue{
+			Project:      project,
+			Zone:         parts[1],
+			Name:         parts[2],
+			ResourceType: resourceType,
+		}, nil
+	}
+
+	if len(zoneSchemaField) == 0 {
+		return nil, fmt.Errorf("Invalid field format. Got '%s', expected format '%s'", fieldValue, fmt.Sprintf(GlobalLinkTemplate, "{project}", resourceType, "{name}"))
+	}
+
+	zone, ok := d.GetOk(zoneSchemaField)
+	if !ok {
+		zone = config.Zone
+		if zone == "" {
+			return nil, fmt.Errorf("A zone must be specified")
+		}
+	}
+
+	return &ZonalFieldValue{
+		Project:      project,
+		Zone:         zone.(string),
+		Name:         GetResourceNameFromSelfLink(fieldValue),
+		ResourceType: resourceType,
+	}, nil
+}
+
 func GetProjectFromSchema(projectSchemaField string, d TerraformResourceData, config *transport_tpg.Config) (string, error) {
 	res, ok := d.GetOk(projectSchemaField)
 	if ok && projectSchemaField != "" {
@@ -245,6 +301,20 @@ func GetProjectFromSchema(projectSchemaField string, d TerraformResourceData, co
 	return "", fmt.Errorf("%s: required field is not set", projectSchemaField)
 }
 
+func GetUniverseDomainFromSchema(universeSchemaField string, d TerraformResourceData, config *transport_tpg.Config) (string, error) {
+	res, ok := d.GetOk(universeSchemaField)
+	if ok && universeSchemaField != "" {
+		return res.(string), nil
+	}
+	if config.UniverseDomain != "" {
+		return config.UniverseDomain, nil
+	}
+	if config.UniverseDomain == "" {
+		return "googleapis.com", nil
+	}
+	return "", fmt.Errorf("%s: Error getting the provider field ", universeSchemaField)
+}
+
 func GetBillingProjectFromSchema(billingProjectSchemaField string, d TerraformResourceData, config *transport_tpg.Config) (string, error) {
 	res, ok := d.GetOk(billingProjectSchemaField)
 	if ok && billingProjectSchemaField != "" {
@@ -387,7 +457,8 @@ func GetRegionFromSchema(regionSchemaField, zoneSchemaField string, d TerraformR
 		return GetResourceNameFromSelfLink(v.(string)), nil
 	}
 	if v, ok := d.GetOk(zoneSchemaField); ok && zoneSchemaField != "" {
-		return GetRegionFromZone(v.(string)), nil
+		zone := GetResourceNameFromSelfLink(v.(string))
+		return GetRegionFromZone(zone), nil
 	}
 	if config.Region != "" {
 		return config.Region, nil
diff --git a/mmv1/third_party/terraform/tpgresource/labels.go b/mmv1/third_party/terraform/tpgresource/labels.go
new file mode 100644
index 000000000000..d8ff6bab6f43
--- /dev/null
+++ b/mmv1/third_party/terraform/tpgresource/labels.go
@@ -0,0 +1,198 @@
+package tpgresource
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"strings"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
+)
+
+// SetLabels is called in the READ method of the resources to set
+// the field "labels" and "terraform_labels" in the state based on the labels field in the configuration.
+// So the field "labels" and "terraform_labels" in the state will only have the user defined labels.
+// param "labels" is all of labels returned from API read reqeust.
+// param "lineage" is the terraform lineage of the field and could be "labels" or "terraform_labels".
+func SetLabels(labels map[string]string, d *schema.ResourceData, lineage string) error {
+	transformed := make(map[string]interface{})
+
+	if v, ok := d.GetOk(lineage); ok {
+		if labels != nil {
+			for k := range v.(map[string]interface{}) {
+				transformed[k] = labels[k]
+			}
+		}
+	}
+
+	return d.Set(lineage, transformed)
+}
+
+// Sets the "labels" field and "terraform_labels" with the value of the field "effective_labels" for data sources.
+// When reading data source, as the labels field is unavailable in the configuration of the data source,
+// the "labels" field will be empty. With this funciton, the labels "field" will have all of labels in the resource.
+func SetDataSourceLabels(d *schema.ResourceData) error {
+	effectiveLabels := d.Get("effective_labels")
+	if effectiveLabels == nil {
+		return nil
+	}
+
+	if d.Get("labels") == nil {
+		return fmt.Errorf("`labels` field is not present in the resource schema.")
+	}
+	if err := d.Set("labels", effectiveLabels); err != nil {
+		return fmt.Errorf("Error setting labels in data source: %s", err)
+	}
+
+	if d.Get("terraform_labels") == nil {
+		return fmt.Errorf("`terraform_labels` field is not present in the resource schema.")
+	}
+	if err := d.Set("terraform_labels", effectiveLabels); err != nil {
+		return fmt.Errorf("Error setting terraform_labels in data source: %s", err)
+	}
+
+	return nil
+}
+
+func SetLabelsDiff(_ context.Context, d *schema.ResourceDiff, meta interface{}) error {
+	raw := d.Get("labels")
+	if raw == nil {
+		return nil
+	}
+
+	if d.Get("terraform_labels") == nil {
+		return fmt.Errorf("`terraform_labels` field is not present in the resource schema.")
+	}
+
+	if d.Get("effective_labels") == nil {
+		return fmt.Errorf("`effective_labels` field is not present in the resource schema.")
+	}
+
+	config := meta.(*transport_tpg.Config)
+
+	// Merge provider default labels with the user defined labels in the resource to get terraform managed labels
+	terraformLabels := make(map[string]string)
+	for k, v := range config.DefaultLabels {
+		terraformLabels[k] = v
+	}
+
+	labels := raw.(map[string]interface{})
+	for k, v := range labels {
+		terraformLabels[k] = v.(string)
+	}
+
+	if err := d.SetNew("terraform_labels", terraformLabels); err != nil {
+		return fmt.Errorf("error setting new terraform_labels diff: %w", err)
+	}
+
+	o, n := d.GetChange("terraform_labels")
+	effectiveLabels := d.Get("effective_labels").(map[string]interface{})
+
+	for k, v := range n.(map[string]interface{}) {
+		effectiveLabels[k] = v.(string)
+	}
+
+	for k := range o.(map[string]interface{}) {
+		if _, ok := n.(map[string]interface{})[k]; !ok {
+			delete(effectiveLabels, k)
+		}
+	}
+
+	if err := d.SetNew("effective_labels", effectiveLabels); err != nil {
+		return fmt.Errorf("error setting new effective_labels diff: %w", err)
+	}
+
+	return nil
+}
+
+func SetMetadataLabelsDiff(_ context.Context, d *schema.ResourceDiff, meta interface{}) error {
+	l := d.Get("metadata").([]interface{})
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
+
+	raw := d.Get("metadata.0.labels")
+	if raw == nil {
+		return nil
+	}
+
+	if d.Get("metadata.0.terraform_labels") == nil {
+		return fmt.Errorf("`metadata.0.terraform_labels` field is not present in the resource schema.")
+	}
+
+	if d.Get("metadata.0.effective_labels") == nil {
+		return fmt.Errorf("`metadata.0.effective_labels` field is not present in the resource schema.")
+	}
+
+	config := meta.(*transport_tpg.Config)
+
+	// Merge provider default labels with the user defined labels in the resource to get terraform managed labels
+	terraformLabels := make(map[string]string)
+	for k, v := range config.DefaultLabels {
+		terraformLabels[k] = v
+	}
+
+	labels := raw.(map[string]interface{})
+	for k, v := range labels {
+		terraformLabels[k] = v.(string)
+	}
+
+	original := l[0].(map[string]interface{})
+
+	original["terraform_labels"] = terraformLabels
+	if err := d.SetNew("metadata", []interface{}{original}); err != nil {
+		return fmt.Errorf("error setting new metadata diff: %w", err)
+	}
+
+	o, n := d.GetChange("metadata.0.terraform_labels")
+	effectiveLabels := d.Get("metadata.0.effective_labels").(map[string]interface{})
+
+	for k, v := range n.(map[string]interface{}) {
+		effectiveLabels[k] = v.(string)
+	}
+
+	for k := range o.(map[string]interface{}) {
+		if _, ok := n.(map[string]interface{})[k]; !ok {
+			delete(effectiveLabels, k)
+		}
+	}
+
+	original["effective_labels"] = effectiveLabels
+	if err := d.SetNew("metadata", []interface{}{original}); err != nil {
+		return fmt.Errorf("error setting new metadata diff: %w", err)
+	}
+
+	return nil
+}
+
+// Upgrade the field "labels" in the state to exclude the labels with the labels prefix
+// and the field "effective_labels" to have all of labels, including the labels with the labels prefix
+func LabelsStateUpgrade(rawState map[string]interface{}, labesPrefix string) (map[string]interface{}, error) {
+	log.Printf("[DEBUG] Attributes before migration: %#v", rawState)
+	log.Printf("[DEBUG] Attributes before migration labels: %#v", rawState["labels"])
+	log.Printf("[DEBUG] Attributes before migration effective_labels: %#v", rawState["effective_labels"])
+
+	if rawState["labels"] != nil {
+		rawLabels := rawState["labels"].(map[string]interface{})
+		labels := make(map[string]interface{})
+		effectiveLabels := make(map[string]interface{})
+
+		for k, v := range rawLabels {
+			effectiveLabels[k] = v
+
+			if !strings.HasPrefix(k, labesPrefix) {
+				labels[k] = v
+			}
+		}
+
+		rawState["labels"] = labels
+		rawState["effective_labels"] = effectiveLabels
+	}
+
+	log.Printf("[DEBUG] Attributes after migration: %#v", rawState)
+	log.Printf("[DEBUG] Attributes after migration labels: %#v", rawState["labels"])
+	log.Printf("[DEBUG] Attributes after migration effective_labels: %#v", rawState["effective_labels"])
+
+	return rawState, nil
+}
diff --git a/mmv1/third_party/terraform/tpgresource/regional_utils.go b/mmv1/third_party/terraform/tpgresource/regional_utils.go
index e9c98e615b90..b771a84c8bea 100644
--- a/mmv1/third_party/terraform/tpgresource/regional_utils.go
+++ b/mmv1/third_party/terraform/tpgresource/regional_utils.go
@@ -17,17 +17,25 @@ func IsZone(location string) bool {
 // - location argument in the resource config
 // - region argument in the resource config
 // - zone argument in the resource config
+// - region argument in the provider config
 // - zone argument set in the provider config
 func GetLocation(d TerraformResourceData, config *transport_tpg.Config) (string, error) {
 	if v, ok := d.GetOk("location"); ok {
-		return v.(string), nil
+		return GetResourceNameFromSelfLink(v.(string)), nil
 	} else if v, isRegionalCluster := d.GetOk("region"); isRegionalCluster {
-		return v.(string), nil
+		return GetResourceNameFromSelfLink(v.(string)), nil
 	} else {
-		// If region is not explicitly set, use "zone" (or fall back to the provider-level zone).
-		// For now, to avoid confusion, we require region to be set in the config to create a regional
-		// cluster rather than falling back to the provider-level region.
-		return GetZone(d, config)
+		if v, ok := d.GetOk("zone"); ok {
+			return GetResourceNameFromSelfLink(v.(string)), nil
+		} else {
+			if config.Region != "" {
+				return GetResourceNameFromSelfLink(config.Region), nil
+			} else if config.Zone != "" {
+				return GetResourceNameFromSelfLink(config.Zone), nil
+			} else {
+				return "", fmt.Errorf("Unable to determine location: region/zone not configured in resource/provider config")
+			}
+		}
 	}
 }
 
diff --git a/mmv1/third_party/terraform/tpgresource/tpgtools_custom_flattens.go.erb b/mmv1/third_party/terraform/tpgresource/tpgtools_custom_flattens.go.erb
new file mode 100644
index 000000000000..744d61c084ed
--- /dev/null
+++ b/mmv1/third_party/terraform/tpgresource/tpgtools_custom_flattens.go.erb
@@ -0,0 +1,40 @@
+<% autogen_exception -%>
+package tpgresource
+
+import (
+	containeraws "github.com/GoogleCloudPlatform/declarative-resource-client-library/services/google/containeraws<%= dcl_version(version) -%>"
+	containerazure "github.com/GoogleCloudPlatform/declarative-resource-client-library/services/google/containerazure<%= dcl_version(version) -%>"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
+)
+
+func FlattenContainerAwsNodePoolManagement(obj *containeraws.NodePoolManagement, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	if obj == nil {
+		return nil
+	}
+	transformed := make(map[string]interface{})
+
+	if obj.AutoRepair == nil || obj.Empty() {
+		transformed["auto_repair"] = false
+	} else {
+		transformed["auto_repair"] = obj.AutoRepair
+	}
+
+	return []interface{}{transformed}
+}
+
+func FlattenContainerAzureNodePoolManagement(obj *containerazure.NodePoolManagement, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	if obj == nil {
+		return nil
+	}
+	transformed := make(map[string]interface{})
+
+	if obj.AutoRepair == nil || obj.Empty() {
+		transformed["auto_repair"] = false
+	} else {
+		transformed["auto_repair"] = obj.AutoRepair
+	}
+
+	return []interface{}{transformed}
+}
diff --git a/mmv1/third_party/terraform/tpgresource/utils.go b/mmv1/third_party/terraform/tpgresource/utils.go
index 3722678026c7..934ebd0250a4 100644
--- a/mmv1/third_party/terraform/tpgresource/utils.go
+++ b/mmv1/third_party/terraform/tpgresource/utils.go
@@ -1,6 +1,7 @@
 package tpgresource
 
 import (
+	"context"
 	"crypto/md5"
 	"encoding/base64"
 	"errors"
@@ -18,9 +19,9 @@ import (
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 
 	"github.com/hashicorp/errwrap"
+	"github.com/hashicorp/go-cty/cty"
 	fwDiags "github.com/hashicorp/terraform-plugin-framework/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 	"google.golang.org/api/googleapi"
@@ -83,6 +84,13 @@ func GetProject(d TerraformResourceData, config *transport_tpg.Config) (string,
 	return GetProjectFromSchema("project", d, config)
 }
 
+// GetUniverse reads the "universe_domain" field from the given resource data and falls
+// back to the provider's value if not given. If the provider's value is not
+// given, an error is returned.
+func GetUniverseDomain(d TerraformResourceData, config *transport_tpg.Config) (string, error) {
+	return GetUniverseDomainFromSchema("universe_domain", d, config)
+}
+
 // GetBillingProject reads the "billing_project" field from the given resource data and falls
 // back to the provider's value if not given. If no value is found, an error is returned.
 func GetBillingProject(d TerraformResourceData, config *transport_tpg.Config) (string, error) {
@@ -97,12 +105,49 @@ func GetProjectFromDiff(d *schema.ResourceDiff, config *transport_tpg.Config) (s
 	if ok {
 		return res.(string), nil
 	}
+	if d.GetRawConfig().GetAttr("project") == cty.UnknownVal(cty.String) {
+		return res.(string), nil
+	}
 	if config.Project != "" {
 		return config.Project, nil
 	}
 	return "", fmt.Errorf("%s: required field is not set", "project")
 }
 
+// getRegionFromDiff reads the "region" field from the given diff and falls
+// back to the provider's value if not given. If the provider's value is not
+// given, an error is returned.
+func GetRegionFromDiff(d *schema.ResourceDiff, config *transport_tpg.Config) (string, error) {
+	res, ok := d.GetOk("region")
+	if ok {
+		return res.(string), nil
+	}
+	if d.GetRawConfig().GetAttr("region") == cty.UnknownVal(cty.String) {
+		return res.(string), nil
+	}
+	if config.Region != "" {
+		return config.Region, nil
+	}
+	return "", fmt.Errorf("%s: required field is not set", "region")
+}
+
+// getZoneFromDiff reads the "zone" field from the given diff and falls
+// back to the provider's value if not given. If the provider's value is not
+// given, an error is returned.
+func GetZoneFromDiff(d *schema.ResourceDiff, config *transport_tpg.Config) (string, error) {
+	res, ok := d.GetOk("zone")
+	if ok {
+		return res.(string), nil
+	}
+	if d.GetRawConfig().GetAttr("zone") == cty.UnknownVal(cty.String) {
+		return res.(string), nil
+	}
+	if config.Zone != "" {
+		return config.Zone, nil
+	}
+	return "", fmt.Errorf("%s: required field is not set", "zone")
+}
+
 func GetRouterLockName(region string, router string) string {
 	return fmt.Sprintf("router/%s/%s", region, router)
 }
@@ -126,6 +171,20 @@ func IsFailedPreconditionError(err error) bool {
 	return false
 }
 
+func IsQuotaError(err error) bool {
+	gerr, ok := errwrap.GetType(err, &googleapi.Error{}).(*googleapi.Error)
+	if !ok {
+		return false
+	}
+	if gerr == nil {
+		return false
+	}
+	if gerr.Code != 429 {
+		return false
+	}
+	return true
+}
+
 func IsConflictError(err error) bool {
 	if e, ok := err.(*googleapi.Error); ok && (e.Code == 409 || e.Code == 412) {
 		return true
@@ -152,6 +211,11 @@ func ExpandLabels(d TerraformResourceData) map[string]string {
 	return ExpandStringMap(d, "labels")
 }
 
+// ExpandEffectiveLabels pulls the value of "effective_labels" out of a TerraformResourceData as a map[string]string.
+func ExpandEffectiveLabels(d TerraformResourceData) map[string]string {
+	return ExpandStringMap(d, "effective_labels")
+}
+
 // ExpandEnvironmentVariables pulls the value of "environment_variables" out of a schema.ResourceData as a map[string]string.
 func ExpandEnvironmentVariables(d *schema.ResourceData) map[string]string {
 	return ExpandStringMap(d, "environment_variables")
@@ -501,22 +565,6 @@ func CheckGoogleIamPolicy(value string) error {
 	return nil
 }
 
-// Retries an operation while the canonical error code is FAILED_PRECONDTION
-// which indicates there is an incompatible operation already running on the
-// cluster. This error can be safely retried until the incompatible operation
-// completes, and the newly requested operation can begin.
-func RetryWhileIncompatibleOperation(timeout time.Duration, lockKey string, f func() error) error {
-	return resource.Retry(timeout, func() *resource.RetryError {
-		if err := transport_tpg.LockedCall(lockKey, f); err != nil {
-			if IsFailedPreconditionError(err) {
-				return resource.RetryableError(err)
-			}
-			return resource.NonRetryableError(err)
-		}
-		return nil
-	})
-}
-
 func FrameworkDiagsToSdkDiags(fwD fwDiags.Diagnostics) *diag.Diagnostics {
 	var diags diag.Diagnostics
 	for _, e := range fwD.Errors() {
@@ -580,7 +628,7 @@ func ReplaceVarsForId(d TerraformResourceData, config *transport_tpg.Config, lin
 // substitution as 10+ calls to allow for future use cases.
 func ReplaceVarsRecursive(d TerraformResourceData, config *transport_tpg.Config, linkTmpl string, shorten bool, depth int) (string, error) {
 	if depth > 10 {
-		return "", errors.New("Recursive substitution detcted")
+		return "", errors.New("Recursive substitution detected")
 	}
 
 	// https://github.com/google/re2/wiki/Syntax
@@ -702,3 +750,61 @@ func GetContentMd5Hash(content []byte) string {
 	}
 	return base64.StdEncoding.EncodeToString(h.Sum(nil))
 }
+
+func DefaultProviderProject(_ context.Context, diff *schema.ResourceDiff, meta interface{}) error {
+
+	config := meta.(*transport_tpg.Config)
+
+	//project
+	if project := diff.Get("project"); project != nil {
+		project2, err := GetProjectFromDiff(diff, config)
+		if err != nil {
+			return fmt.Errorf("Failed to retrieve project, pid: %s, err: %s", project, err)
+		}
+		if CompareSelfLinkRelativePaths("", project.(string), project2, nil) {
+			return nil
+		}
+
+		err = diff.SetNew("project", project2)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func DefaultProviderRegion(_ context.Context, diff *schema.ResourceDiff, meta interface{}) error {
+
+	config := meta.(*transport_tpg.Config)
+	//region
+	if region := diff.Get("region"); region != nil {
+		region, err := GetRegionFromDiff(diff, config)
+		if err != nil {
+			return fmt.Errorf("Failed to retrieve region, pid: %s, err: %s", region, err)
+		}
+		err = diff.SetNew("region", region)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func DefaultProviderZone(_ context.Context, diff *schema.ResourceDiff, meta interface{}) error {
+
+	config := meta.(*transport_tpg.Config)
+	// zone
+	if zone := diff.Get("zone"); zone != nil {
+		zone, err := GetZoneFromDiff(diff, config)
+		if err != nil {
+			return fmt.Errorf("Failed to retrieve zone, pid: %s, err: %s", zone, err)
+		}
+		err = diff.SetNew("zone", zone)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/mmv1/third_party/terraform/tpgresource/utils_test.go b/mmv1/third_party/terraform/tpgresource/utils_test.go
index f5b5a6ccf825..b815ff762473 100644
--- a/mmv1/third_party/terraform/tpgresource/utils_test.go
+++ b/mmv1/third_party/terraform/tpgresource/utils_test.go
@@ -239,11 +239,11 @@ func TestGetLocation(t *testing.T) {
 			},
 			ExpectedLocation: "resource-location",
 		},
-		"does not shorten the location value when it is set as a self link in the resource config": {
+		"shortens the location value when it is set as a self link in the resource config": {
 			ResourceConfig: map[string]interface{}{
 				"location": "https://www.googleapis.com/compute/v1/projects/my-project/locations/resource-location",
 			},
-			ExpectedLocation: "https://www.googleapis.com/compute/v1/projects/my-project/locations/resource-location", // No shortening takes place
+			ExpectedLocation: "resource-location",
 		},
 		"returns the region value set in the resource config when location is not in the schema": {
 			ResourceConfig: map[string]interface{}{
@@ -252,11 +252,11 @@ func TestGetLocation(t *testing.T) {
 			},
 			ExpectedLocation: "resource-region",
 		},
-		"does not shorten the region value when it is set as a self link in the resource config": {
+		"shortens the region value when it is set as a self link in the resource config": {
 			ResourceConfig: map[string]interface{}{
 				"region": "https://www.googleapis.com/compute/v1/projects/my-project/region/resource-region",
 			},
-			ExpectedLocation: "https://www.googleapis.com/compute/v1/projects/my-project/region/resource-region", // No shortening takes place
+			ExpectedLocation: "resource-region",
 		},
 		"returns the zone value set in the resource config when neither location nor region in the schema": {
 			ResourceConfig: map[string]interface{}{
@@ -278,13 +278,23 @@ func TestGetLocation(t *testing.T) {
 			},
 			ExpectedLocation: "provider-zone-a",
 		},
-		"does not shorten the zone value when it is set as a self link in the provider config": {
-			// This behaviour makes sense because provider config values don't originate from APIs
-			// Users should always configure the provider with the short names of regions/zones
+		"returns the region value from the provider config when none of location/region/zone are set in the resource config": {
+			ProviderConfig: map[string]string{
+				"region": "provider-region",
+			},
+			ExpectedLocation: "provider-region",
+		},
+		"shortens the region value when it is set as a self link in the provider config": {
+			ProviderConfig: map[string]string{
+				"region": "https://www.googleapis.com/compute/v1/projects/my-project/region/provider-region",
+			},
+			ExpectedLocation: "provider-region",
+		},
+		"shortens the zone value when it is set as a self link in the provider config": {
 			ProviderConfig: map[string]string{
 				"zone": "https://www.googleapis.com/compute/v1/projects/my-project/zones/provider-zone-a",
 			},
-			ExpectedLocation: "https://www.googleapis.com/compute/v1/projects/my-project/zones/provider-zone-a",
+			ExpectedLocation: "provider-zone-a",
 		},
 		// Handling of empty strings
 		"returns the region value set in the resource config when location is an empty string": {
@@ -313,13 +323,18 @@ func TestGetLocation(t *testing.T) {
 			},
 			ExpectedLocation: "provider-zone-a",
 		},
-		// Error states
-		"returns an error when only a region value is set in the the provider config and none of location/region/zone are set in the resource config": {
+		"returns the region value when only a region value is set in the the provider config and none of location/region/zone are set in the resource config": {
+			ResourceConfig: map[string]interface{}{
+				"location": "",
+				"region":   "",
+				"zone":     "",
+			},
 			ProviderConfig: map[string]string{
 				"region": "provider-region",
 			},
-			ExpectError: true,
+			ExpectedLocation: "provider-region",
 		},
+		// Error states
 		"returns an error when none of location/region/zone are set on the resource, and neither region or zone is set on the provider": {
 			ExpectError: true,
 		},
@@ -498,11 +513,11 @@ func TestGetRegion(t *testing.T) {
 			},
 			ExpectedRegion: "resource-zone", // is truncated
 		},
-		"does not shorten region values when derived from a zone self link set in the resource config": {
+		"shortens region values when derived from a zone self link set in the resource config": {
 			ResourceConfig: map[string]interface{}{
 				"zone": "https://www.googleapis.com/compute/v1/projects/my-project/zones/us-central1-a",
 			},
-			ExpectedRegion: "https://www.googleapis.com/compute/v1/projects/my-project/zones/us-central1", // Value is not shortenedfrom URI to name
+			ExpectedRegion: "us-central1",
 		},
 		"returns the value of the region field in provider config when region/zone is unset in resource config": {
 			ProviderConfig: map[string]string{
diff --git a/mmv1/third_party/terraform/transport/config.go.erb b/mmv1/third_party/terraform/transport/config.go.erb
index ee330cd4a26d..dbecac42f63f 100644
--- a/mmv1/third_party/terraform/transport/config.go.erb
+++ b/mmv1/third_party/terraform/transport/config.go.erb
@@ -24,6 +24,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/sirupsen/logrus"
 	"google.golang.org/api/option"
+	"google.golang.org/api/option/internaloption"
 
 	"github.com/hashicorp/terraform-provider-google/google/verify"
 
@@ -184,11 +185,13 @@ type Config struct {
 	Region                              string
 	BillingProject                      string
 	Zone                                string
+	UniverseDomain                      string
 	Scopes                              []string
 	BatchingConfig                      *BatchingConfig
 	UserProjectOverride                 bool
 	RequestReason                       string
 	RequestTimeout                      time.Duration
+	DefaultLabels                       map[string]string
 	// PollInterval is passed to resource.StateChangeConf in common_operation.go
 	// It controls the interval at which we poll for successful operations
 	PollInterval time.Duration
@@ -1161,14 +1164,24 @@ func (c *Config) GetCredentials(clientScopes []string, initialCredentialsOnly bo
 			return *creds, nil
 		}
 
-		creds, err := transport.Creds(c.Context, option.WithCredentialsJSON([]byte(contents)), option.WithScopes(clientScopes...))
-		if err != nil {
-			return googleoauth.Credentials{}, fmt.Errorf("unable to parse credentials from '%s': %s", contents, err)
+		if c.UniverseDomain != "" && c.UniverseDomain != "googleapis.com" {
+			creds, err := transport.Creds(c.Context, option.WithCredentialsJSON([]byte(contents)), option.WithScopes(clientScopes...), internaloption.EnableJwtWithScope())
+			if err != nil {
+				return googleoauth.Credentials{}, fmt.Errorf("unable to parse credentials from '%s': %s", contents, err)
+			}
+			log.Printf("[INFO] Authenticating using configured Google JSON 'credentials'...")
+			log.Printf("[INFO]   -- Scopes: %s", clientScopes)
+			log.Printf("[INFO]   -- Sending EnableJwtWithScope option")
+			return *creds, nil
+		} else {
+			creds, err := transport.Creds(c.Context, option.WithCredentialsJSON([]byte(contents)), option.WithScopes(clientScopes...))
+			if err != nil {
+				return googleoauth.Credentials{}, fmt.Errorf("unable to parse credentials from '%s': %s", contents, err)
+			}
+			log.Printf("[INFO] Authenticating using configured Google JSON 'credentials'...")
+			log.Printf("[INFO]   -- Scopes: %s", clientScopes)
+			return *creds, nil
 		}
-
-		log.Printf("[INFO] Authenticating using configured Google JSON 'credentials'...")
-		log.Printf("[INFO]   -- Scopes: %s", clientScopes)
-		return *creds, nil
 	}
 
 	if c.ImpersonateServiceAccount != "" && !initialCredentialsOnly {
@@ -1183,11 +1196,21 @@ func (c *Config) GetCredentials(clientScopes []string, initialCredentialsOnly bo
 
 	log.Printf("[INFO] Authenticating using DefaultClient...")
 	log.Printf("[INFO]   -- Scopes: %s", clientScopes)
+
+	if c.UniverseDomain != "" && c.UniverseDomain != "googleapis.com" {
+		log.Printf("[INFO]   -- Sending JwtWithScope option")
+		creds, err := transport.Creds(context.Background(), option.WithScopes(clientScopes...), internaloption.EnableJwtWithScope())
+		if err != nil {
+			return googleoauth.Credentials{}, fmt.Errorf("Attempted to load application default credentials since neither `credentials` nor `access_token` was set in the provider block.  No credentials loaded. To use your gcloud credentials, run 'gcloud auth application-default login'.  Original error: %w", err)
+		}
+		return *creds, nil
+	}
+
 	creds, err := transport.Creds(context.Background(), option.WithScopes(clientScopes...))
 	if err != nil {
 		return googleoauth.Credentials{}, fmt.Errorf("Attempted to load application default credentials since neither `credentials` nor `access_token` was set in the provider block.  No credentials loaded. To use your gcloud credentials, run 'gcloud auth application-default login'.  Original error: %w", err)
 	}
-
+	
 	return *creds, nil
 }
 
diff --git a/mmv1/third_party/terraform/transport/config_test.go b/mmv1/third_party/terraform/transport/config_test.go
index 849b902672b4..90d458bb5a31 100644
--- a/mmv1/third_party/terraform/transport/config_test.go
+++ b/mmv1/third_party/terraform/transport/config_test.go
@@ -700,3 +700,34 @@ func TestRemoveBasePathVersion(t *testing.T) {
 		}
 	}
 }
+
+func TestGetRegionFromRegionSelfLink(t *testing.T) {
+	cases := map[string]struct {
+		Input          string
+		ExpectedOutput string
+	}{
+		"A short region name is returned unchanged": {
+			Input:          "us-central1",
+			ExpectedOutput: "us-central1",
+		},
+		"A selflink is shortened to a region name": {
+			Input:          "https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1",
+			ExpectedOutput: "us-central1",
+		},
+		"Logic is specific to region selflinks; zone selflinks are not shortened": {
+			Input:          "https://www.googleapis.com/compute/v1/projects/my-project/zones/asia-east1-a",
+			ExpectedOutput: "https://www.googleapis.com/compute/v1/projects/my-project/zones/asia-east1-a",
+		},
+	}
+
+	for tn, tc := range cases {
+		t.Run(tn, func(t *testing.T) {
+
+			region := transport_tpg.GetRegionFromRegionSelfLink(tc.Input)
+
+			if region != tc.ExpectedOutput {
+				t.Fatalf("want %s,  got %s", region, tc.ExpectedOutput)
+			}
+		})
+	}
+}
diff --git a/mmv1/third_party/terraform/transport/error_retry_predicates.go b/mmv1/third_party/terraform/transport/error_retry_predicates.go
index c1674aa80fd7..d7c21e6fef94 100644
--- a/mmv1/third_party/terraform/transport/error_retry_predicates.go
+++ b/mmv1/third_party/terraform/transport/error_retry_predicates.go
@@ -320,6 +320,16 @@ func DatastoreIndex409Contention(err error) (bool, string) {
 	return false, ""
 }
 
+// relevant for firestore in datastore mode
+func FirestoreField409RetryUnderlyingDataChanged(err error) (bool, string) {
+	if gerr, ok := err.(*googleapi.Error); ok {
+		if gerr.Code == 409 && strings.Contains(gerr.Body, "Please retry, underlying data changed") {
+			return true, "underlying data changed - retrying"
+		}
+	}
+	return false, ""
+}
+
 func IapClient409Operation(err error) (bool, string) {
 	if gerr, ok := err.(*googleapi.Error); ok {
 		if gerr.Code == 409 && strings.Contains(strings.ToLower(gerr.Body), "operation was aborted") {
diff --git a/mmv1/third_party/terraform/transport/error_retry_predicates_test.go b/mmv1/third_party/terraform/transport/error_retry_predicates_test.go
index 8288bfc1e19d..a5f9b61e044a 100644
--- a/mmv1/third_party/terraform/transport/error_retry_predicates_test.go
+++ b/mmv1/third_party/terraform/transport/error_retry_predicates_test.go
@@ -170,3 +170,14 @@ func TestIsSwgAutogenRouterRetryableError_notReady(t *testing.T) {
 		t.Errorf("Error not detected as retryable")
 	}
 }
+
+func TestFirestoreField409_retryUnderlyingDataChanged(t *testing.T) {
+	err := googleapi.Error{
+		Code: 409,
+		Body: "Please retry, underlying data changed",
+	}
+	isRetryable, _ := FirestoreField409RetryUnderlyingDataChanged(&err)
+	if !isRetryable {
+		t.Errorf("Error not detected as retryable")
+	}
+}
diff --git a/mmv1/third_party/terraform/transport/transport.go b/mmv1/third_party/terraform/transport/transport.go
index 374841b34ec1..01f0fd1a1aa6 100644
--- a/mmv1/third_party/terraform/transport/transport.go
+++ b/mmv1/third_party/terraform/transport/transport.go
@@ -136,6 +136,15 @@ func HandleNotFoundError(err error, d *schema.ResourceData, resource string) err
 		fmt.Sprintf("Error when reading or editing %s: {{err}}", resource), err)
 }
 
+func HandleDataSourceNotFoundError(err error, d *schema.ResourceData, resource, url string) error {
+	if IsGoogleApiErrorWithCode(err, 404) {
+		return fmt.Errorf("%s not found", url)
+	}
+
+	return errwrap.Wrapf(
+		fmt.Sprintf("Error when reading or editing %s: {{err}}", resource), err)
+}
+
 func IsGoogleApiErrorWithCode(err error, errCode int) bool {
 	gerr, ok := errwrap.GetType(err, &googleapi.Error{}).(*googleapi.Error)
 	return ok && gerr != nil && gerr.Code == errCode
diff --git a/mmv1/third_party/terraform/utils/provider_versionfive_upgrade_test.go.erb b/mmv1/third_party/terraform/utils/provider_versionfive_upgrade_test.go.erb
new file mode 100644
index 000000000000..161ec6ccf34d
--- /dev/null
+++ b/mmv1/third_party/terraform/utils/provider_versionfive_upgrade_test.go.erb
@@ -0,0 +1,646 @@
+<% autogen_exception -%>
+package google
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+	"github.com/hashicorp/terraform-provider-google/google/envvar"
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+)
+
+func TestProvider_versionfive_upgrade(t *testing.T) {
+	acctest.SkipIfVcr(t)
+	t.Parallel()
+
+	org := envvar.GetTestOrgFromEnv(t)
+	billingId := envvar.GetTestBillingAccountFromEnv(t)
+	project := fmt.Sprintf("tf-test-%d", acctest.RandInt(t))
+
+	name1 := fmt.Sprintf("tf-test-%d", acctest.RandInt(t))
+	name2 := fmt.Sprintf("tf-test-%d", acctest.RandInt(t))
+	name3 := fmt.Sprintf("tf-test-%d", acctest.RandInt(t))
+	name4 := fmt.Sprintf("tf-test-%d", acctest.RandInt(t))
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck: func() { acctest.AccTestPreCheck(t) },
+		Steps: []resource.TestStep{
+			{
+				ExternalProviders: map[string]resource.ExternalProvider{
+					"google": {
+						VersionConstraint: "4.80.0",
+						Source:            "hashicorp/google-beta",
+					},
+				},
+				Config: testProvider_versionfive_upgrades(project, org, billingId, name1, name2, name3, name4),
+			},
+			{
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+				Config:                   testProvider_versionfive_upgrades(project, org, billingId, name1, name2, name3, name4),
+				PlanOnly:									true,
+			},
+			{
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+				ResourceName:             "google_data_fusion_instance.unset",
+				ImportState:              true,
+				ImportStateVerify:        true,
+			},
+			{
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+				ResourceName:             "google_data_fusion_instance.set",
+				ImportState:              true,
+				ImportStateVerify:        true,
+			},
+			{
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+				ResourceName:             "google_data_fusion_instance.reference",
+				ImportState:              true,
+				ImportStateVerify:        true,
+			},
+		},
+	})
+}
+
+func TestProvider_versionfive_ignorereads_upgrade(t *testing.T) {
+	acctest.SkipIfVcr(t)
+	t.Parallel()
+
+	var itName = fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10))
+	var tpName = fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10))
+	var igmName = fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10))
+	var autoscalerName = fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10))
+
+	diskName := fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10))
+	policyName := fmt.Sprintf("tf-test-policy-%s", acctest.RandString(t, 10))
+
+	endpointContext := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	var itNameRegion = fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10))
+	var tpNameRegion = fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10))
+	var igmNameRegion = fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10))
+	var autoscalerNameRegion = fmt.Sprintf("tf-test-region-autoscaler-%s", acctest.RandString(t, 10))
+
+	policyContext := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	attachmentContext := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck: func() { acctest.AccTestPreCheck(t) },
+		CheckDestroy: resource.ComposeTestCheckFunc(testAccCheckComputeResourcePolicyDestroyProducer(t),
+			testAccCheckComputeRegionAutoscalerDestroyProducer(t),
+			testAccCheckComputeNetworkEndpointGroupDestroyProducer(t),
+			testAccCheckComputeAutoscalerDestroyProducer(t),
+		),
+		Steps: []resource.TestStep{
+			{
+				ExternalProviders: map[string]resource.ExternalProvider{
+					"google": {
+						VersionConstraint: "4.80.0",
+						Source:            "hashicorp/google-beta",
+					},
+				},
+				Config: testProvider_versionfive_upgrades_ignorereads(itName, tpName, igmName, autoscalerName, diskName, policyName,
+					itNameRegion, tpNameRegion, igmNameRegion, autoscalerNameRegion, endpointContext,
+					policyContext, attachmentContext),
+			},
+			{
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+				Config: 	testProvider_versionfive_upgrades_ignorereads(itName, tpName, igmName, autoscalerName, diskName, policyName,
+					itNameRegion, tpNameRegion, igmNameRegion, autoscalerNameRegion, endpointContext,
+					policyContext, attachmentContext),
+				PlanOnly:	true,
+			},
+		},
+	})
+}
+
+func testProvider_versionfive_upgrades(project, org, billing, name1, name2, name3, name4 string) string {
+	return fmt.Sprintf(`
+resource "google_project" "host" {
+  project_id      = "%s"
+  name            = "%s"
+  org_id          = "%s"
+  billing_account = "%s"
+}
+
+resource "google_project_service" "dfapi" {
+  project = google_project.host.project_id
+  service = "datafusion.googleapis.com"
+
+  disable_dependent_services = false
+}
+
+resource "google_data_fusion_instance" "unset" {
+  name   = "%s"
+  type   = "BASIC"
+  options = {
+  	prober_test_run = "true"
+  }
+}
+
+resource "google_data_fusion_instance" "set" {
+  name   = "%s"
+  region = "us-west1"
+  type   = "BASIC"
+  options = {
+  	prober_test_run = "true"
+  }
+}
+
+resource "google_data_fusion_instance" "reference" {
+  project = google_project.host.project_id
+  name   = "%s"
+  type   = "DEVELOPER"
+  options = {
+  	prober_test_run = "true"
+  }
+  zone   = "us-west1-a"
+  depends_on = [
+    google_project_service.dfapi
+  ]
+}
+
+resource "google_redis_instance" "overridewithnonstandardlogic" {
+  name           = "%s"
+  memory_size_gb = 1
+  location_id    = "us-south1-a"
+}
+
+
+`, project, project, org, billing, name1, name2, name3, name4)
+}
+
+func testProvider_versionfive_upgrades_ignorereads(itName, tpName, igmName, autoscalerName, diskName, policyName, itNameRegion, tpNameRegion, igmNameRegion, autoscalerNameRegion string, endpointContext, policyContext, attachmentContext map[string]interface{}) string {
+	return testAccComputeAutoscaler_basic(itName, tpName, igmName, autoscalerName) +
+		testAccComputeDiskResourcePolicyAttachment_basic(diskName, policyName) +
+		testAccComputeNetworkEndpointGroup_networkEndpointGroup(endpointContext) +
+		testAccComputeRegionAutoscaler_basic(itNameRegion, tpNameRegion, igmNameRegion, autoscalerNameRegion) +
+		testAccComputeResourcePolicy_resourcePolicyBasicExample(policyContext) +
+		testAccComputeServiceAttachment_serviceAttachmentBasicExample(attachmentContext)
+}
+
+// need to make copies of all the respective resource functions within here as *_test.go files can not be imported
+// checkdestroys
+func testAccCheckComputeResourcePolicyDestroyProducer(t *testing.T) func(s *terraform.State) error {
+	return func(s *terraform.State) error {
+		for name, rs := range s.RootModule().Resources {
+			if rs.Type != "google_compute_resource_policy" {
+				continue
+			}
+			if strings.HasPrefix(name, "data.") {
+				continue
+			}
+
+			config := acctest.GoogleProviderConfig(t)
+
+			url, err := tpgresource.ReplaceVarsForTest(config, rs, "{{ComputeBasePath}}projects/{{project}}/regions/{{region}}/resourcePolicies/{{name}}")
+			if err != nil {
+				return err
+			}
+
+			billingProject := ""
+
+			if config.BillingProject != "" {
+				billingProject = config.BillingProject
+			}
+
+			_, err = transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+				Config:    config,
+				Method:    "GET",
+				Project:   billingProject,
+				RawURL:    url,
+				UserAgent: config.UserAgent,
+			})
+			if err == nil {
+				return fmt.Errorf("ComputeResourcePolicy still exists at %s", url)
+			}
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckComputeRegionAutoscalerDestroyProducer(t *testing.T) func(s *terraform.State) error {
+	return func(s *terraform.State) error {
+		for name, rs := range s.RootModule().Resources {
+			if rs.Type != "google_compute_region_autoscaler" {
+				continue
+			}
+			if strings.HasPrefix(name, "data.") {
+				continue
+			}
+
+			config := acctest.GoogleProviderConfig(t)
+
+			url, err := tpgresource.ReplaceVarsForTest(config, rs, "{{ComputeBasePath}}projects/{{project}}/regions/{{region}}/autoscalers/{{name}}")
+			if err != nil {
+				return err
+			}
+
+			billingProject := ""
+
+			if config.BillingProject != "" {
+				billingProject = config.BillingProject
+			}
+
+			_, err = transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+				Config:    config,
+				Method:    "GET",
+				Project:   billingProject,
+				RawURL:    url,
+				UserAgent: config.UserAgent,
+			})
+			if err == nil {
+				return fmt.Errorf("ComputeRegionAutoscaler still exists at %s", url)
+			}
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckComputeNetworkEndpointGroupDestroyProducer(t *testing.T) func(s *terraform.State) error {
+	return func(s *terraform.State) error {
+		for name, rs := range s.RootModule().Resources {
+			if rs.Type != "google_compute_network_endpoint_group" {
+				continue
+			}
+			if strings.HasPrefix(name, "data.") {
+				continue
+			}
+
+			config := acctest.GoogleProviderConfig(t)
+
+			url, err := tpgresource.ReplaceVarsForTest(config, rs, "{{ComputeBasePath}}projects/{{project}}/zones/{{zone}}/networkEndpointGroups/{{name}}")
+			if err != nil {
+				return err
+			}
+
+			billingProject := ""
+
+			if config.BillingProject != "" {
+				billingProject = config.BillingProject
+			}
+
+			_, err = transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+				Config:    config,
+				Method:    "GET",
+				Project:   billingProject,
+				RawURL:    url,
+				UserAgent: config.UserAgent,
+			})
+			if err == nil {
+				return fmt.Errorf("ComputeNetworkEndpointGroup still exists at %s", url)
+			}
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckComputeAutoscalerDestroyProducer(t *testing.T) func(s *terraform.State) error {
+	return func(s *terraform.State) error {
+		for name, rs := range s.RootModule().Resources {
+			if rs.Type != "google_compute_autoscaler" {
+				continue
+			}
+			if strings.HasPrefix(name, "data.") {
+				continue
+			}
+
+			config := acctest.GoogleProviderConfig(t)
+
+			url, err := tpgresource.ReplaceVarsForTest(config, rs, "{{ComputeBasePath}}projects/{{project}}/zones/{{zone}}/autoscalers/{{name}}")
+			if err != nil {
+				return err
+			}
+
+			billingProject := ""
+
+			if config.BillingProject != "" {
+				billingProject = config.BillingProject
+			}
+
+			_, err = transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+				Config:    config,
+				Method:    "GET",
+				Project:   billingProject,
+				RawURL:    url,
+				UserAgent: config.UserAgent,
+			})
+			if err == nil {
+				return fmt.Errorf("ComputeAutoscaler still exists at %s", url)
+			}
+		}
+
+		return nil
+	}
+}
+
+// tests
+func testAccComputeAutoscaler_scaffolding(itName, tpName, igmName string) string {
+	return fmt.Sprintf(`
+data "google_compute_image" "my_image1" {
+  family  = "debian-11"
+  project = "debian-cloud"
+}
+
+resource "google_compute_instance_template" "foobar1" {
+  name           = "%s"
+  machine_type   = "e2-medium"
+  can_ip_forward = false
+  tags           = ["foo", "bar"]
+
+  disk {
+    source_image = data.google_compute_image.my_image1.self_link
+    auto_delete  = true
+    boot         = true
+  }
+
+  network_interface {
+    network = "default"
+  }
+
+  service_account {
+    scopes = ["userinfo-email", "compute-ro", "storage-ro"]
+  }
+}
+
+resource "google_compute_target_pool" "foobar1" {
+  description      = "Resource created for Terraform acceptance testing"
+  name             = "%s"
+  session_affinity = "CLIENT_IP_PROTO"
+  region					 = "us-west1"
+}
+
+resource "google_compute_instance_group_manager" "foobar1" {
+  description = "Terraform test instance group manager"
+  name        = "%s"
+  version {
+    instance_template = google_compute_instance_template.foobar1.self_link
+    name              = "primary"
+  }
+  target_pools       = [google_compute_target_pool.foobar1.self_link]
+  base_instance_name = "foobar1"
+  zone               = "us-west1-a"
+}
+`, itName, tpName, igmName)
+
+}
+
+func testAccComputeAutoscaler_basic(itName, tpName, igmName, autoscalerName string) string {
+	return testAccComputeAutoscaler_scaffolding(itName, tpName, igmName) + fmt.Sprintf(`
+resource "google_compute_autoscaler" "foobar1" {
+  description = "Resource created for Terraform acceptance testing"
+  name        = "%s"
+  zone        = "us-west1-a"
+  target      = google_compute_instance_group_manager.foobar1.self_link
+  autoscaling_policy {
+    max_replicas    = 5
+    min_replicas    = 1
+    cooldown_period = 60
+    cpu_utilization {
+      target = 0.5
+    }
+  }
+}
+`, autoscalerName)
+}
+
+func testAccComputeDiskResourcePolicyAttachment_basic(diskName, policyName string) string {
+	return fmt.Sprintf(`
+data "google_compute_image" "my_image2" {
+  family  = "debian-11"
+  project = "debian-cloud"
+}
+
+resource "google_compute_disk" "foobar2" {
+  name  = "%s"
+  image = data.google_compute_image.my_image2.self_link
+  size  = 1000
+  type  = "pd-extreme"
+  zone  = "us-west1-c"
+  labels = {
+    my-label = "my-label-value"
+  }
+  provisioned_iops = 90000
+}
+
+resource "google_compute_resource_policy" "foobar2" {
+  name = "%s"
+  region = "us-west1"
+  snapshot_schedule_policy {
+    schedule {
+      daily_schedule {
+        days_in_cycle = 1
+        start_time = "04:00"
+      }
+    }
+  }
+}
+
+resource "google_compute_disk_resource_policy_attachment" "foobar2" {
+  name = google_compute_resource_policy.foobar2.name
+  disk = google_compute_disk.foobar2.name
+  zone = "us-west1-c"
+}
+`, diskName, policyName)
+}
+
+func testAccComputeNetworkEndpointGroup_networkEndpointGroup(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_compute_network_endpoint_group" "neg3" {
+  name         = "tf-test-my-lb-neg%{random_suffix}"
+  network      = google_compute_network.default3.id
+  default_port = "90"
+  zone         = "us-west1-a"
+}
+
+resource "google_compute_network" "default3" {
+  name                    = "tf-test-neg-network%{random_suffix}"
+  auto_create_subnetworks = true
+}
+`, context)
+}
+
+func testAccComputeRegionAutoscaler_scaffolding(itName, tpName, igmName string) string {
+	return fmt.Sprintf(`
+data "google_compute_image" "my_image4" {
+  family  = "debian-11"
+  project = "debian-cloud"
+}
+
+resource "google_compute_instance_template" "foobar4" {
+  name           = "%s"
+  machine_type   = "e2-medium"
+  can_ip_forward = false
+  tags           = ["foo", "bar"]
+
+  disk {
+    source_image = data.google_compute_image.my_image4.self_link
+    auto_delete  = true
+    boot         = true
+  }
+
+  network_interface {
+    network = "default"
+  }
+
+  service_account {
+    scopes = ["userinfo-email", "compute-ro", "storage-ro"]
+  }
+}
+
+resource "google_compute_target_pool" "foobar4" {
+  description      = "Resource created for Terraform acceptance testing"
+  name             = "%s"
+  session_affinity = "CLIENT_IP_PROTO"
+  region					 = "us-west1"
+}
+
+resource "google_compute_region_instance_group_manager" "foobar4" {
+  description = "Terraform test instance group manager"
+  name        = "%s"
+  version {
+    instance_template = google_compute_instance_template.foobar4.self_link
+    name              = "primary"
+  }
+  target_pools       = [google_compute_target_pool.foobar4.self_link]
+  base_instance_name = "tf-test-foobar4"
+  region             = "us-west1"
+}
+
+`, itName, tpName, igmName)
+}
+
+func testAccComputeRegionAutoscaler_basic(itName, tpName, igmName, autoscalerName string) string {
+	return testAccComputeRegionAutoscaler_scaffolding(itName, tpName, igmName) + fmt.Sprintf(`
+resource "google_compute_region_autoscaler" "foobar4" {
+  description = "Resource created for Terraform acceptance testing"
+  name        = "%s"
+  region      = "us-west1"
+  target      = google_compute_region_instance_group_manager.foobar4.self_link
+  autoscaling_policy {
+    max_replicas    = 5
+    min_replicas    = 0
+    cooldown_period = 60
+    cpu_utilization {
+      target = 0.5
+    }
+  }
+}
+`, autoscalerName)
+}
+
+func testAccComputeResourcePolicy_resourcePolicyBasicExample(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_compute_resource_policy" "foo5" {
+  name   = "tf-test-gce-policy%{random_suffix}"
+  region = "us-west1"
+  snapshot_schedule_policy {
+    schedule {
+      daily_schedule {
+        days_in_cycle = 1
+        start_time    = "04:00"
+      }
+    }
+  }
+}
+`, context)
+}
+
+func testAccComputeServiceAttachment_serviceAttachmentBasicExample(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_compute_service_attachment" "psc_ilb_service_attachment6" {
+  name        = "tf-test-my-psc-ilb%{random_suffix}"
+  region      = "us-west2"
+  description = "A service attachment configured with Terraform"
+
+  enable_proxy_protocol    = true
+  connection_preference    = "ACCEPT_AUTOMATIC"
+  nat_subnets              = [google_compute_subnetwork.psc_ilb_nat6.id]
+  target_service           = google_compute_forwarding_rule.psc_ilb_target_service6.id
+  reconcile_connections    = true
+}
+
+resource "google_compute_address" "psc_ilb_consumer_address6" {
+  name   = "tf-test-psc-ilb-consumer-address%{random_suffix}"
+  region = "us-west2"
+
+  subnetwork   = "default"
+  address_type = "INTERNAL"
+}
+
+resource "google_compute_forwarding_rule" "psc_ilb_consumer6" {
+  name   = "tf-test-psc-ilb-consumer-forwarding-rule%{random_suffix}"
+  region = "us-west2"
+
+  target                = google_compute_service_attachment.psc_ilb_service_attachment6.id
+  load_balancing_scheme = "" # need to override EXTERNAL default when target is a service attachment
+  network               = "default"
+  ip_address            = google_compute_address.psc_ilb_consumer_address6.id
+}
+
+resource "google_compute_forwarding_rule" "psc_ilb_target_service6" {
+  name   = "tf-test-producer-forwarding-rule%{random_suffix}"
+  region = "us-west2"
+
+  load_balancing_scheme = "INTERNAL"
+  backend_service       = google_compute_region_backend_service.producer_service_backend6.id
+  all_ports             = true
+  network               = google_compute_network.psc_ilb_network6.name
+  subnetwork            = google_compute_subnetwork.psc_ilb_producer_subnetwork6.name
+}
+
+resource "google_compute_region_backend_service" "producer_service_backend6" {
+  name   = "tf-test-producer-service%{random_suffix}"
+  region = "us-west2"
+
+  health_checks = [google_compute_health_check.producer_service_health_check6.id]
+}
+
+resource "google_compute_health_check" "producer_service_health_check6" {
+  name = "tf-test-producer-service-health-check%{random_suffix}"
+
+  check_interval_sec = 1
+  timeout_sec        = 1
+  tcp_health_check {
+    port = "80"
+  }
+}
+
+resource "google_compute_network" "psc_ilb_network6" {
+  name = "tf-test-psc-ilb-network%{random_suffix}"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "psc_ilb_producer_subnetwork6" {
+  name   = "tf-test-psc-ilb-producer-subnetwork%{random_suffix}"
+  region = "us-west2"
+
+  network       = google_compute_network.psc_ilb_network6.id
+  ip_cidr_range = "10.0.0.0/16"
+}
+
+resource "google_compute_subnetwork" "psc_ilb_nat6" {
+  name   = "tf-test-psc-ilb-nat%{random_suffix}"
+  region = "us-west2"
+
+  network       = google_compute_network.psc_ilb_network6.id
+  purpose       =  "PRIVATE_SERVICE_CONNECT"
+  ip_cidr_range = "10.1.0.0/16"
+}
+`, context)
+}
diff --git a/mmv1/third_party/terraform/website/docs/d/backup_dr_management_server.html.markdown b/mmv1/third_party/terraform/website/docs/d/backup_dr_management_server.html.markdown
new file mode 100644
index 000000000000..72c481acbacf
--- /dev/null
+++ b/mmv1/third_party/terraform/website/docs/d/backup_dr_management_server.html.markdown
@@ -0,0 +1,32 @@
+---
+subcategory: "BackupDR Management Server"
+description: |-
+  Get information about a Backupdr Management server.
+---
+
+# google\_backup\_dr\_management\_server
+
+Get information about a Google Backup DR Management server.
+
+~> **Warning:** This resource is in beta, and should be used with the terraform-provider-google-beta provider.
+See [Provider Versions](https://terraform.io/docs/providers/google/guides/provider_versions.html) for more details on beta resources.
+
+## Example Usage
+
+```hcl
+data google_backup_dr_management_server my-backup-dr-management-server {
+   location =  "us-central1"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `region` - (Required) The region in which the management server resource belongs.
+
+- - -
+
+## Attributes Reference
+
+See [google_backupdr_management_server](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/backup_dr_management_server) resource for details of the available attributes.
diff --git a/mmv1/third_party/terraform/website/docs/d/bigquery_dataset.html.markdown b/mmv1/third_party/terraform/website/docs/d/bigquery_dataset.html.markdown
new file mode 100644
index 000000000000..93df0f62a202
--- /dev/null
+++ b/mmv1/third_party/terraform/website/docs/d/bigquery_dataset.html.markdown
@@ -0,0 +1,33 @@
+---
+subcategory: "BigQuery"
+description: |-
+  A datasource to retrieve information about a BigQuery dataset.
+---
+
+# `google_bigquery_dataset`
+
+Get information about a BigQuery dataset. For more information see
+the [official documentation](https://cloud.google.com/bigquery/docs)
+and [API](https://cloud.google.com/bigquery/docs/reference/rest/v2/datasets).
+
+## Example Usage
+
+```hcl
+data "google_bigquery_dataset" "dataset" {
+  dataset_id = "my-bq-dataset"
+  project = "my-project"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `dataset_id` - (Required) The dataset ID.
+
+* `project` - (Optional) The ID of the project in which the resource belongs.
+    If it is not provided, the provider project is used.
+
+## Attributes Reference
+
+See [google_bigquery_dataset](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/bigquery_dataset) resource for details of the available attributes.
diff --git a/mmv1/third_party/terraform/website/docs/d/certificate_manager_certificate_map.html.markdown b/mmv1/third_party/terraform/website/docs/d/certificate_manager_certificate_map.html.markdown
new file mode 100644
index 000000000000..20e2e4fe5b0c
--- /dev/null
+++ b/mmv1/third_party/terraform/website/docs/d/certificate_manager_certificate_map.html.markdown
@@ -0,0 +1,30 @@
+---
+subcategory: "Certificate manager"
+description: |-
+  Contains the data that describes a Certificate Map
+---
+# google_certificate_manager_certificate_map
+
+Get info about a Google Certificate Manager Certificate Map resource.
+
+## Example Usage
+
+```tf
+data "google_certificate_manager_certificate_map" "default" {
+ name = "cert-map"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the certificate map.
+
+- - -
+* `project` - (Optional) The ID of the project in which the resource belongs. If it
+    is not provided, the provider project is used.
+
+## Attributes Reference
+
+See [google_certificate_manager_certificate_map](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/certificate_manager_certificate_map) resource for details of the available attributes.
diff --git a/mmv1/third_party/terraform/website/docs/d/cloud_identity_group_lookup.html.markdown b/mmv1/third_party/terraform/website/docs/d/cloud_identity_group_lookup.html.markdown
new file mode 100644
index 000000000000..b51478ce1bc1
--- /dev/null
+++ b/mmv1/third_party/terraform/website/docs/d/cloud_identity_group_lookup.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "Cloud Identity"
+description: |-
+  Look up a Cloud Identity Group using its email and namespace.
+---
+
+# google_cloud_identity_group_lookup
+
+Use this data source to look up the resource name of a Cloud Identity Group by its [EntityKey](https://cloud.google.com/identity/docs/reference/rest/v1/EntityKey), i.e. the group's email.
+
+https://cloud.google.com/identity/docs/concepts/overview#groups
+
+## Example Usage
+
+```tf
+data "google_cloud_identity_group_lookup" "group" {
+  group_key {
+    id = "my-group@example.com"
+  }
+}
+```
+
+## Argument Reference
+
+* `group_key` - (Required) The EntityKey of the Group to lookup. A unique identifier for an entity in the Cloud Identity Groups API.
+An entity can represent either a group with an optional namespace or a user without a namespace.
+The combination of id and namespace must be unique; however, the same id can be used with different namespaces. Structure is [documented below](#nested_group_key).
+
+<a name="nested_group_key"></a>The `group_key` block supports:
+
+* `id` -
+  (Required) The ID of the entity.
+  For Google-managed entities, the id is the email address of an existing group or user.
+  For external-identity-mapped entities, the id is a string conforming
+  to the Identity Source's requirements.
+
+* `namespace` -
+  (Optional) The namespace in which the entity exists.
+  If not populated, the EntityKey represents a Google-managed entity
+  such as a Google user or a Google Group.
+  If populated, the EntityKey represents an external-identity-mapped group.
+  The namespace must correspond to an identity source created in Admin Console
+  and must be in the form of `identitysources/{identity_source_id}`.
+
+
+## Attributes Reference
+
+In addition to the arguments listed above, the following attributes are exported:
+
+* `name` -
+  Resource name of the Group in the format: groups/{group_id}, where `group_id` is the unique ID assigned to the Group.
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/website/docs/d/cloud_run_v2_job.html.markdown b/mmv1/third_party/terraform/website/docs/d/cloud_run_v2_job.html.markdown
new file mode 100644
index 000000000000..b28f8748ae02
--- /dev/null
+++ b/mmv1/third_party/terraform/website/docs/d/cloud_run_v2_job.html.markdown
@@ -0,0 +1,37 @@
+---
+subcategory: "Cloud Run"
+description: |-
+  Get information about a Google Cloud Run v2 Job.
+---
+
+# google\_cloud\_run\_v2\_job
+
+Get information about a Google Cloud Run v2 Job. For more information see
+the [official documentation](https://cloud.google.com/run/docs/)
+and [API](https://cloud.google.com/run/docs/apis).
+
+## Example Usage
+
+```hcl
+data "google_cloud_run_v2_job" "my_job" {
+  name     = "my-job"
+  location = "us-central1"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the Cloud Run v2 Job.
+
+* `location` - (Required) The location of the instance. eg us-central1
+
+- - -
+
+* `project` - (Optional) The project in which the resource belongs. If it
+    is not provided, the provider project is used.
+
+## Attributes Reference
+
+See [google_cloud_run_v2_job](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloud_run_v2_job#argument-reference) resource for details of the available attributes.
diff --git a/mmv1/third_party/terraform/website/docs/d/cloud_run_v2_service.html.markdown b/mmv1/third_party/terraform/website/docs/d/cloud_run_v2_service.html.markdown
new file mode 100644
index 000000000000..87f20702fb6c
--- /dev/null
+++ b/mmv1/third_party/terraform/website/docs/d/cloud_run_v2_service.html.markdown
@@ -0,0 +1,37 @@
+---
+subcategory: "Cloud Run"
+description: |-
+  Get information about a Google Cloud Run v2 Service.
+---
+
+# google\_cloud\_run\_v2\_service
+
+Get information about a Google Cloud Run v2 Service. For more information see
+the [official documentation](https://cloud.google.com/run/docs/)
+and [API](https://cloud.google.com/run/docs/apis).
+
+## Example Usage
+
+```hcl
+data "google_cloud_run_v2_service" "my_service" {
+  name     = "my-service"
+  location = "us-central1"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the Cloud Run v2 Service.
+
+* `location` - (Required) The location of the instance. eg us-central1
+
+- - -
+
+* `project` - (Optional) The project in which the resource belongs. If it
+    is not provided, the provider project is used.
+
+## Attributes Reference
+
+See [google_cloud_run_v2_service](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloud_run_v2_service#argument-reference) resource for details of the available attributes.
diff --git a/mmv1/third_party/terraform/website/docs/d/cloudfunctions_function.html.markdown b/mmv1/third_party/terraform/website/docs/d/cloudfunctions_function.html.markdown
index e3ca05447d0c..1b4e2f7dd5b2 100644
--- a/mmv1/third_party/terraform/website/docs/d/cloudfunctions_function.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/d/cloudfunctions_function.html.markdown
@@ -49,7 +49,7 @@ exported:
 * `event_trigger` - A source that fires events in response to a condition in another service. Structure is [documented below](#nested_event_trigger).
 * `https_trigger_url` - If function is triggered by HTTP, trigger URL is set here.
 * `ingress_settings` - Controls what traffic can reach the function.
-* `labels` - A map of labels applied to this function.
+* `labels` - All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
 * `service_account_email` - The service account email to be assumed by the cloud function.
 * `vpc_connector` - The VPC Network Connector that this cloud function can connect to. 
 * `vpc_connector_egress_settings` - The egress settings for the connector, controlling what traffic is diverted through it.
diff --git a/mmv1/third_party/terraform/website/docs/d/compute_default_service_account.html.markdown b/mmv1/third_party/terraform/website/docs/d/compute_default_service_account.html.markdown
index 3edee46bdea2..655e1964dcdb 100644
--- a/mmv1/third_party/terraform/website/docs/d/compute_default_service_account.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/d/compute_default_service_account.html.markdown
@@ -37,3 +37,5 @@ The following attributes are exported:
 * `name` - The fully-qualified name of the service account.
 
 * `display_name` - The display name for the service account.
+
+* `member` - The Identity of the service account in the form `serviceAccount:{email}`. This value is often used to refer to the service account in order to grant IAM permissions.
diff --git a/mmv1/third_party/terraform/website/docs/d/compute_disk.html.markdown b/mmv1/third_party/terraform/website/docs/d/compute_disk.html.markdown
index 65596b090bfa..33ad9dc772af 100644
--- a/mmv1/third_party/terraform/website/docs/d/compute_disk.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/d/compute_disk.html.markdown
@@ -82,7 +82,7 @@ In addition to the arguments listed above, the following computed attributes are
 * `description` -
   The optional description of this resource.
 
-* `labels` - A map of labels applied to this disk.
+* `labels` - All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
 
 * `size` -
   Size of the persistent disk, specified in GB.
diff --git a/mmv1/third_party/terraform/website/docs/d/compute_image.html.markdown b/mmv1/third_party/terraform/website/docs/d/compute_image.html.markdown
index e9cdc9616ad6..883e99fc0bfd 100644
--- a/mmv1/third_party/terraform/website/docs/d/compute_image.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/d/compute_image.html.markdown
@@ -71,7 +71,7 @@ exported:
 * `source_disk_id` - The ID value of the disk used to create this image.
 * `creation_timestamp` - The creation timestamp in RFC3339 text format.
 * `description` - An optional description of this image.
-* `labels` - A map of labels applied to this image.
+* `labels` - All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
 * `label_fingerprint` - A fingerprint for the labels being applied to this image.
 * `licenses` - A list of applicable license URI.
 * `status` - The status of the image. Possible values are **FAILED**, **PENDING**, or **READY**.
diff --git a/mmv1/third_party/terraform/website/docs/d/compute_instance.html.markdown b/mmv1/third_party/terraform/website/docs/d/compute_instance.html.markdown
index d478a3eca5ae..1d3e8dc06205 100644
--- a/mmv1/third_party/terraform/website/docs/d/compute_instance.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/d/compute_instance.html.markdown
@@ -57,7 +57,7 @@ The following arguments are supported:
 
 * `guest_accelerator` - List of the type and count of accelerator cards attached to the instance. Structure is [documented below](#nested_guest_accelerator).
 
-* `labels` - A set of key/value label pairs assigned to the instance.
+* `labels` - All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
 
 * `metadata` - Metadata key/value pairs made available within the instance.
 
diff --git a/mmv1/third_party/terraform/website/docs/d/compute_instance_template.html.markdown b/mmv1/third_party/terraform/website/docs/d/compute_instance_template.html.markdown
index 2af65eaae691..7249ae2c5301 100644
--- a/mmv1/third_party/terraform/website/docs/d/compute_instance_template.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/d/compute_instance_template.html.markdown
@@ -6,6 +6,8 @@ description: |-
 
 # google\_compute\_instance\_template
 
+-> **Note**: Global instance templates can be used in any region. To lower the impact of outages outside your region and gain data residency within your region, use [google_compute_region_instance_template](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_region_instance_template).
+
 Get information about a VM instance template resource within GCE. For more information see
 [the official documentation](https://cloud.google.com/compute/docs/instance-templates)
 and
@@ -76,8 +78,7 @@ The following arguments are supported:
 * `instance_description` - A brief description to use for instances
     created from this template.
 
-* `labels` - A set of key/value label pairs to assign to instances
-    created from this template,
+* `labels` - All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
 
 * `metadata` - Metadata key/value pairs to make available from
     within instances created from this template.
@@ -138,6 +139,11 @@ The following arguments are supported:
 * `disk_name` - Name of the disk. When not provided, this defaults
     to the name of the instance.
 
+* `provisioned_iops` - Indicates how many IOPS to provision for the disk. This
+    sets the number of I/O operations per second that the disk can handle.
+    Values must be between 10,000 and 120,000. For more details, see the
+    [Extreme persistent disk documentation](https://cloud.google.com/compute/docs/disks/extreme-persistent-disk).
+
 * `source_image` - The image from which to
     initialize this disk. This can be one of: the image's `self_link`,
     `projects/{project}/global/images/{image}`,
diff --git a/mmv1/third_party/terraform/website/docs/d/compute_network.html.markdown b/mmv1/third_party/terraform/website/docs/d/compute_network.html.markdown
index b9e10b1bcca6..39f1b0e6e63d 100644
--- a/mmv1/third_party/terraform/website/docs/d/compute_network.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/d/compute_network.html.markdown
@@ -38,6 +38,8 @@ In addition to the arguments listed above, the following attributes are exported
 
 * `gateway_ipv4` - The IP address of the gateway.
 
+* `internal_ipv6_range` - The ula internal ipv6 range assigned to this network.
+
 * `subnetworks_self_links` - the list of subnetworks which belong to the network
 
 * `self_link` - The URI of the resource.
diff --git a/mmv1/third_party/terraform/website/docs/d/compute_networks.html.markdown b/mmv1/third_party/terraform/website/docs/d/compute_networks.html.markdown
new file mode 100644
index 000000000000..83705e4f79e9
--- /dev/null
+++ b/mmv1/third_party/terraform/website/docs/d/compute_networks.html.markdown
@@ -0,0 +1,35 @@
+---
+subcategory: "Compute Engine"
+description: |-
+  List networks in a Google Cloud project.
+---
+
+# google\_compute\_networks
+
+List all networks in a specified Google Cloud project.
+
+## Example Usage
+
+```tf
+data "google_compute_networks" "my-networks" {
+  project = "my-cloud-project"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `project` - (Optional) The name of the project.
+
+## Attributes Reference
+
+In addition to the arguments listed above, the following attributes are exported:
+
+* `id` - an identifier for the resource with format projects/{{project}}/global/networks
+
+* `networks` - The list of networks in the specified project.
+
+* `project` - The project name being queried.
+
+* `self_link` - The URI of the resource.
diff --git a/mmv1/third_party/terraform/website/docs/d/compute_region_instance_template.html.markdown b/mmv1/third_party/terraform/website/docs/d/compute_region_instance_template.html.markdown
index 1f2f628e23d1..9910a0372830 100644
--- a/mmv1/third_party/terraform/website/docs/d/compute_region_instance_template.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/d/compute_region_instance_template.html.markdown
@@ -125,6 +125,11 @@ The following arguments are supported:
 * `disk_name` - Name of the disk. When not provided, this defaults
     to the name of the instance.
 
+* `provisioned_iops` - Indicates how many IOPS to provision for the disk. This
+    sets the number of I/O operations per second that the disk can handle.
+    Values must be between 10,000 and 120,000. For more details, see the
+    [Extreme persistent disk documentation](https://cloud.google.com/compute/docs/disks/extreme-persistent-disk).
+
 * `source_image` - The image from which to
     initialize this disk. This can be one of: the image's `self_link`,
     `projects/{project}/global/images/{image}`,
diff --git a/mmv1/third_party/terraform/website/docs/d/compute_subnetwork.html.markdown b/mmv1/third_party/terraform/website/docs/d/compute_subnetwork.html.markdown
index 00eea711e18f..beaf67ff5737 100644
--- a/mmv1/third_party/terraform/website/docs/d/compute_subnetwork.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/d/compute_subnetwork.html.markdown
@@ -45,6 +45,8 @@ In addition to the arguments listed above, the following attributes are exported
 * `ip_cidr_range` - The IP address range that machines in this
     network are assigned to, represented as a CIDR block.
 
+* `internal_ipv6_prefix` - The internal IPv6 address range that is assigned to this subnetwork.
+
 * `gateway_address` - The IP address of the gateway.
 
 * `private_ip_google_access` - Whether the VMs in this subnet
diff --git a/mmv1/third_party/terraform/website/docs/d/dns_keys.html.markdown b/mmv1/third_party/terraform/website/docs/d/dns_keys.html.markdown
index ce3b70e4defd..24c52fc80086 100644
--- a/mmv1/third_party/terraform/website/docs/d/dns_keys.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/d/dns_keys.html.markdown
@@ -6,10 +6,16 @@ description: |-
 
 # google\_dns\_keys
 
-Get the DNSKEY and DS records of DNSSEC-signed managed zones. For more information see the
+Get the DNSKEY and DS records of DNSSEC-signed managed zones.
+
+For more information see the
 [official documentation](https://cloud.google.com/dns/docs/dnskeys/)
 and [API](https://cloud.google.com/dns/docs/reference/v1/dnsKeys).
 
+~> A google_dns_managed_zone resource must have DNSSEC enabled in order
+to contain any DNSKEYs. Queries to managed zones without this setting
+enabled will result in a 404 error as the collection of DNSKEYs does
+not exist in the DNS API.
 
 ## Example Usage
 
diff --git a/mmv1/third_party/terraform/website/docs/d/game_services_game_server_deployment_rollout.html.markdown b/mmv1/third_party/terraform/website/docs/d/game_services_game_server_deployment_rollout.html.markdown
deleted file mode 100644
index 263c218a36da..000000000000
--- a/mmv1/third_party/terraform/website/docs/d/game_services_game_server_deployment_rollout.html.markdown
+++ /dev/null
@@ -1,68 +0,0 @@
----
-subcategory: "Game Servers"
-description: |-
-  Get the rollout state.
----
-
-# google\_game\_services\_game\_server\_deployment\_rollout
-
-Use this data source to get the rollout state. 
-
-https://cloud.google.com/game-servers/docs/reference/rest/v1beta/GameServerDeploymentRollout
-
-## Example Usage 
-
-
-```hcl
-data "google_game_services_game_server_deployment_rollout" "qa" {
-    deployment_id = "tf-test-deployment-s8sn12jt2c"
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-
-* `deployment_id` - (Required)
-  The deployment to get the rollout state from. Only 1 rollout must be associated with each deployment.
-
-
-## Attributes Reference
-
-In addition to the arguments listed above, the following attributes are exported:
-
-* `default_game_server_config` -
-  This field points to the game server config that is
-  applied by default to all realms and clusters. For example,
-  `projects/my-project/locations/global/gameServerDeployments/my-game/configs/my-config`.
-
-
-* `game_server_config_overrides` -
-  The game_server_config_overrides contains the per game server config
-  overrides. The overrides are processed in the order they are listed. As
-  soon as a match is found for a cluster, the rest of the list is not
-  processed.  Structure is [documented below](#nested_game_server_config_overrides).
-
-* `project` - The ID of the project in which the resource belongs.
-    If it is not provided, the provider project is used.
-
-
-<a name="nested_game_server_config_overrides"></a>The `game_server_config_overrides` block contains:
-
-* `realms_selector` -
-  Selection by realms.  Structure is [documented below](#nested_realms_selector).
-
-* `config_version` -
-  Version of the configuration.
-
-<a name="nested_realms_selector"></a>The `realms_selector` block contains:
-
-* `realms` -
-  List of realms to match against.
-
-* `id` - an identifier for the resource with format `projects/{{project}}/locations/global/gameServerDeployments/{{deployment_id}}/rollout`
-
-* `name` -
-  The resource id of the game server deployment
-  eg: `projects/my-project/locations/global/gameServerDeployments/my-deployment/rollout`.
diff --git a/mmv1/third_party/terraform/website/docs/d/secret_manager_secrets.html.markdown b/mmv1/third_party/terraform/website/docs/d/secret_manager_secrets.html.markdown
new file mode 100644
index 000000000000..faba72ec868d
--- /dev/null
+++ b/mmv1/third_party/terraform/website/docs/d/secret_manager_secrets.html.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "Secret Manager"
+description: |-
+  List the Secret Manager Secrets.
+---
+
+# google\_secret\_manager\_secrets
+
+Use this data source to list the Secret Manager Secrets
+
+## Example Usage 
+
+
+```hcl
+data "google_secret_manager_secrets" "secrets" {
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `project` - (optional) The ID of the project.
+
+* `filter` - (optional) Filter string, adhering to the rules in [List-operation filtering](https://cloud.google.com/secret-manager/docs/filtering). List only secrets matching the filter. If filter is empty, all secrets are listed.
+
+## Attributes Reference
+
+In addition to the arguments listed above, the following computed attributes are
+exported:
+
+* `secrets` - A list of secrets matching the filter. Structure is [defined below](#nested_secrets).
+
+<a name="nested_secrets"></a>The `secrets` block supports:
+
+* `replication` -
+  The replication policy of the secret data attached to the Secret.
+  Structure is [documented below](#nested_replication).
+
+* `labels` - The labels assigned to this Secret.
+
+* `annotations` - Custom metadata about the secret.
+
+* `version_aliases` - Mapping from version alias to version name.
+
+* `topics` -
+  A list of up to 10 Pub/Sub topics to which messages are published when control plane operations are called on the secret or its versions.
+  Structure is [documented below](#nested_topics).
+
+* `expire_time` - Timestamp in UTC when the Secret is scheduled to expire.
+
+* `create_time` - The time at which the Secret was created.
+
+* `rotation` -
+  The rotation time and period for a Secret.
+  Structure is [documented below](#nested_rotation).
+
+* `project` - The ID of the project in which the resource belongs.
+
+
+<a name="nested_replication"></a>The `replication` block supports:
+
+* `auto` -
+  The Secret will automatically be replicated without any restrictions.
+  Structure is [documented below](#nested_auto).
+
+* `user_managed` -
+  The Secret will be replicated to the regions specified by the user.
+  Structure is [documented below](#nested_user_managed).
+
+
+<a name="nested_auto"></a>The `auto` block supports:
+
+* `customer_managed_encryption` -
+  The customer-managed encryption configuration of the Secret.
+  Structure is [documented below](#nested_customer_managed_encryption).
+
+<a name="nested_customer_managed_encryption"></a>The `customer_managed_encryption` block supports:
+
+* `kms_key_name` -
+  The resource name of the Cloud KMS CryptoKey used to encrypt secret payloads.
+
+<a name="nested_user_managed"></a>The `user_managed` block supports:
+
+* `replicas` -
+  The list of Replicas for this Secret.
+  Structure is [documented below](#nested_replicas).
+
+<a name="nested_replicas"></a>The `replicas` block supports:
+
+* `location` -
+  The canonical IDs of the location to replicate data.
+
+* `customer_managed_encryption` -
+  Customer Managed Encryption for the secret.
+  Structure is [documented below](#nested_customer_managed_encryption_user_managed).
+
+<a name="nested_customer_managed_encryption_user_managed"></a>The `customer_managed_encryption` block supports:
+
+* `kms_key_name` -
+  Describes the Cloud KMS encryption key that will be used to protect destination secret.
+
+<a name="nested_topics"></a>The `topics` block supports:
+
+* `name` - The resource name of the Pub/Sub topic that will be published to.
+
+<a name="nested_rotation"></a>The `rotation` block supports:
+
+* `next_rotation_time` - Timestamp in UTC at which the Secret is scheduled to rotate.
+
+* `rotation_period` - The Duration between rotation notifications.
diff --git a/mmv1/third_party/terraform/website/docs/d/tpu_v2_accelerator_types.html.markdown b/mmv1/third_party/terraform/website/docs/d/tpu_v2_accelerator_types.html.markdown
new file mode 100644
index 000000000000..f953bcdc7aac
--- /dev/null
+++ b/mmv1/third_party/terraform/website/docs/d/tpu_v2_accelerator_types.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "Cloud TPU v2"
+description: |-
+  Get available accelerator types.
+---
+
+# google\_tpu\_v2\_accelerator\_types
+
+Get accelerator types available for a project. For more information see the [official documentation](https://cloud.google.com/tpu/docs/) and [API](https://cloud.google.com/tpu/docs/reference/rest/v2/projects.locations.acceleratorTypes).
+
+## Example Usage
+
+```hcl
+data "google_tpu_v2_accelerator_types" "available" {
+}
+```
+
+## Example Usage: Configure Basic TPU VM with available type
+
+```hcl
+data "google_tpu_v2_accelerator_types" "available" {
+}
+
+data "google_tpu_v2_runtime_versions" "available" {
+}
+
+resource "google_tpu_v2_vm" "tpu" {
+  name = "test-tpu"
+  zone = "us-central1-b"
+  runtime_version = data.google_tpu_v2_runtime_versions.available.versions[0]
+  accelerator_type = data.google_tpu_v2_accelerator_types.available.types[0]
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `project` - (Optional) The project to list types for. If it
+    is not provided, the provider project is used.
+
+* `zone` - (Optional) The zone to list types for. If it
+    is not provided, the provider zone is used.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `types` - The list of accelerator types available for the given project and zone.
diff --git a/mmv1/third_party/terraform/website/docs/d/tpu_v2_runtime_versions.html.markdown b/mmv1/third_party/terraform/website/docs/d/tpu_v2_runtime_versions.html.markdown
new file mode 100644
index 000000000000..b4d6358b2f79
--- /dev/null
+++ b/mmv1/third_party/terraform/website/docs/d/tpu_v2_runtime_versions.html.markdown
@@ -0,0 +1,45 @@
+---
+subcategory: "Cloud TPU v2"
+description: |-
+  Get available runtime versions.
+---
+
+# google\_tpu\_v2\_runtime\_versions
+
+Get runtime versions available for a project. For more information see the [official documentation](https://cloud.google.com/tpu/docs/) and [API](https://cloud.google.com/tpu/docs/reference/rest/v2/projects.locations.runtimeVersions).
+
+## Example Usage
+
+```hcl
+data "google_tpu_v2_runtime_versions" "available" {
+}
+```
+
+## Example Usage: Configure Basic TPU VM with available version
+
+```hcl
+data "google_tpu_v2_runtime_versions" "available" {
+}
+
+resource "google_tpu_v2_vm" "tpu" {
+  name = "test-tpu"
+  zone = "us-central1-b"
+  runtime_version = data.google_tpu_v2_runtime_versions.available.versions[0]
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `project` - (Optional) The project to list versions for. If it
+    is not provided, the provider project is used.
+
+* `zone` - (Optional) The zone to list versions for. If it
+    is not provided, the provider zone is used.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `versions` - The list of runtime versions available for the given project and zone.
diff --git a/mmv1/third_party/terraform/website/docs/guides/provider_reference.html.markdown b/mmv1/third_party/terraform/website/docs/guides/provider_reference.html.markdown
index ae8f9a5ec2e4..63f601a03b89 100644
--- a/mmv1/third_party/terraform/website/docs/guides/provider_reference.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/guides/provider_reference.html.markdown
@@ -240,6 +240,34 @@ following ordered by precedence.
     * GCLOUD_ZONE
     * CLOUDSDK_COMPUTE_ZONE
 
+---
+
+* `default_labels` (Optional) Labels that will be applied to all resources
+with a top level `labels` field or a `labels` field nested inside a top level
+`metadata` field. Setting the same key as a default label at the resource level
+will override the default value for that label. These values will be recorded in 
+individual resource plans through the `terraform_labels` and `effective_labels`
+fields.
+
+```
+provider "google" {
+  default_labels = {
+    my_global_key = "one"
+    my_default_key = "two"
+  }
+}
+
+resource "google_compute_address" "my_address" {
+  name     = "my-address"
+
+  labels = {
+    my_key = "three"
+    # overrides provider-wide setting
+    my_default_key = "four"
+  }
+}
+```
+
 ## Advanced Settings Configuration
 
 * `request_timeout` - (Optional) A duration string controlling the amount of time
@@ -287,6 +315,10 @@ being considered a breaking change.
 
 ---
 
+* `universe_domain` - (Optional) Specify the GCP universe to deploy in.
+
+---
+
 * `batching` - (Optional) Controls batching for specific GCP request types
 where users have encountered quota or speed issues using many resources of
 the same type, typically `google_project_service`.
diff --git a/mmv1/third_party/terraform/website/docs/guides/version_5_upgrade.html.markdown b/mmv1/third_party/terraform/website/docs/guides/version_5_upgrade.html.markdown
index f1aed2ca0784..d82b2bf62e7d 100644
--- a/mmv1/third_party/terraform/website/docs/guides/version_5_upgrade.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/guides/version_5_upgrade.html.markdown
@@ -68,7 +68,7 @@ For example, given this previous configuration:
 terraform {
   required_providers {
     google = {
-      version = "~> 4.70.0"
+      version = "~> 4.84.0"
     }
   }
 }
@@ -90,172 +90,376 @@ terraform {
 
 ### Provider-level Labels Rework
 
-Labels and annotations are key-value pairs attached on Google cloud resources. Cloud labels are used for organizing resources, filtering resources, breaking down billing, and so on. Annotations are used to attach metadata to Kubernetes resources.
+Label and annotation fields across the provider have been reworked with impact
+across numerous resources. Two notable cases from this upgrade are covered
+immediately, with more details in dedicated headers below:
 
-Not all of Google cloud resources support labels and annotations. Please check the Terraform Google provider resource documentation to figure out if the resource supports the `labels` and `annotations` fields.
+!> For resources with **any** `labels` values previously defined, running
+`terraform plan` or `terraform apply` on Google provider `5.0.0` or later with
+an existing pre-`5.0.0` resource before an `apply`, the plan will show an
+update adding your current `labels` values to `terraform_labels`. This change
+will result in a no-op update on most resources, which can be safely applied.
+However, some resources are immutable. Before 5.6.0 this would fail. After
+5.6.0, a plan that includes recreating the resource will be created. This may
+be applied to move forward with the upgrade but will recreate the resource if
+you do so. We plan to make a change for these resources that will be recreated
+that will compute the terraform_labels value as part of the upgrade, and will
+come out for affected resources in the following releases after 5.6.0.
+
+
+!> This change introduced a regression we were unable to resolve, and labels
+with an empty value (`""`) should be avoided, as they will be ignored and not
+included in requests to the API. Replacing those labels' values with `_` or
+`true` are recommended.
+
+Not all of Google Cloud resources support labels and annotations. Please check
+the Terraform Google provider resource documentation to figure out if a given
+resource supports `labels` or `annotations` fields.
 
 #### Provider default labels
 
-Default labels configured on the provider through the new `default_labels` field are now supported. The default labels configured on the provider will be applied to all of the resources with the top level `labels` field or the nested `labels` field inside the top level `metadata` field.
+Default labels configured on the provider through a new `default_labels` field
+are now supported. The default labels configured on the provider will be applied
+to all  resources with a top level `labels` field or a `labels` field nested
+inside a top level `metadata` field.
 
-Provider-level default annotations are not supported.
+Setting the same key as a default label at the resource level will override the
+default value for that label.
 
-#### Resource labels
+These values will be recorded in individual resource plans through the
+`terraform_labels` and `effective_labels` fields.
 
-The new labels model will be applied to all of the resources with the top level `labels` field or the nested `labels` field inside the top level `metadata` field. Some labels fields are for child resources, so the new model will not be applied to labels fields for child resources.
+```
+provider "google" {
+  default_labels = {
+    my_global_key = "one"
+    my_default_key = "two"
+  }
+}
 
-There are now three label-related fields with the new model:
+resource "google_compute_address" "my_address" {
+  name     = "my-address"
 
-* The `labels` field will be non-authoritative and only manage the labels defined by the users on the resource through Terraform.
-* The output-only `effective_labels` will list all of labels present on the resource in GCP, including the labels configured through Terraform, other clients and services.
-* The output-only `terraform_labels` will merge the labels defined by the users on the resource through Terraform and the default labels configured on the provider. If the same label exists on both the resource labels and provider default labels, the label on the resource will override the provider label.
+  labels = {
+    my_key = "three"
+    # overrides provider-wide setting
+    my_default_key = "four"
+  }
+}
+```
 
-After upgrading to `5.0.0`, and then running `terraform refresh` or `terraform apply`, these three fields should show in the state file of the resources with a self-applying `labels` field.
+```
+# google_compute_address.my_address will be created
+  + resource "google_compute_address" "my_address" {
+      + address            = (known after apply)
+      + address_type       = "EXTERNAL"
+      + creation_timestamp = (known after apply)
+      + effective_labels   = {
+          + "my_default_key" = "four"
+          + "my_global_key"  = "one"
+          + "my_key"         = "three"
+        }
+      + id                 = (known after apply)
+      + label_fingerprint  = (known after apply)
+      + labels             = {
+          + "my_default_key" = "four"
+          + "my_key"         = "three"
+        }
+      + name               = "my-address"
+      + network_tier       = (known after apply)
+      + prefix_length      = (known after apply)
+      + project            = "my-project"
+      + purpose            = (known after apply)
+      + region             = (known after apply)
+      + self_link          = (known after apply)
+      + subnetwork         = (known after apply)
+      + terraform_labels   = {
+          + "my_default_key" = "four"
+          + "my_global_key"  = "one"
+          + "my_key"         = "three"
+        }
+      + users              = (known after apply)
+    }
+
+Plan: 1 to add, 0 to change, 0 to destroy.
+```
+
+Provider-level default annotations are not supported at this time.
+
+#### Resource labels
+
+Previously, `labels` and `annotations` fields in the Terraform Google provider
+were authoritative and Terraform thought it was the only owner of the fields.
+This model worked well initially, but with the introduction of system labels and
+other client-managed labels, Terraform would conflict with their labels and show
+a diff. We've reworked the `labels` field to resolve this class of problem.
+
+This reworked labels model has been applied to all resources with a top level
+`labels` field or a nested `labels` field inside a top level `metadata` field.
+Non-standard labels fields are unaffected, for example the `node_labels` GKE
+field that affects child resources.
+
+Resources that previously contained a single `labels` field will now contain
+three fields:
+
+* The `labels` field is now non-authoritative and only manages the label keys
+defined in your configuration for the resource. If a label was added outside of
+Terraform, it will not be managed by Terraform, unless it is added to the
+`labels` field in the configuration.
+* The `terraform_labels` cannot be specified directly by the user. It merges the
+labels defined in the resource's configuration and the default labels configured
+in the provider block. If the same label key exists on both the resource level
+and provider level, the value on the resource will override the
+provider-level default.
+* The output-only `effective_labels` will list all the labels present on the
+resource in GCP, including the labels configured through Terraform, the system,
+and other clients.
+
+~> **Note:** `ignore_changes` can be applied to `labels` field to ignore the
+changes of the user defined labels. It is not recommended to apply
+`ignore_changes` to `terraform_labels` or `effective_labels`, as it may
+unintuitively affect the final API call.
+
+The following changes will be observed in applicable resources after upgrading to `5.0.0`:
+* Running `terraform refresh` on Google provider `5.0.0` or later with an existing pre-`5.0.0` resource before an `apply`, these three fields will show in the state file. `labels` field will have your current labels, `terraform_labels` will be empty, and `effective_labels` will have all of labels present on the resource in GCP.
+* For resources with **any** `labels` values previously defined, running `terraform plan` or `terraform apply` on Google provider `5.0.0` or later with an existing pre-`5.0.0` resource before an `apply`, the plan will show an updated adding your current labels to `terraform_labels`. After running `terraform apply`, these three fields will show in the state file. `labels` will have your current labels, `terraform_labels` will have the combination of `labels` and your provider-default labels, and `effective_labels` will have all of labels present on the resource in GCP.
+* Running `terraform import` on Google provider `5.0.0` or later, these three fields will show in the state file with an empty `labels` and `terraform_labels` value. `effective_labels` will have all the labels present on the resource in GCP. You can update the resource to bring labels defined in your configuration under management by Terraform.
+
+The following are resource-specific label changes:
+* In the resource `google_cloud_run_domain_mapping`, the system labels `cloud.googleapis.com/location` and `run.googleapis.com/overrideAt` will be removed from `labels` inside `metadata` field in the state file as part of a one-time resource schema upgrade. If any of these label keys are in the configuration, after upgrading to `5.0.0`, the plan will show that these keys will be added. You can safely accept this change, and Terraform will begin to manage them again.
+* In the resource `google_cloud_run_service`, the system label `cloud.googleapis.com/location` will be removed from `labels` inside `metadata` field in the state file as part of a one-time resource schema upgrade. If this system label key is in the configuration, after upgrading to `5.0.0`, the plan will show that this key will be added. You can safely accept this change, and Terraform will begin to manage it again.
+* In the resource `google_dataflow_flex_template_job`, the system labels with the prefix `goog-dataflow-provided` are removed from `labels` field in the state file as part of a one-time resource schema upgrade. If any of these label keys are in the configuration, after upgrading to `5.0.0`, the plan will show that these keys will be added. You can safely accept this change, and Terraform will begin to manage them again.
+* In the resource `google_dataflow_job`, the system labels with the prefix `goog-dataflow-provided` will be removed from `labels` field in the state file as part of a one-time resource schema upgrade. If any of these label keys are in the configuration, after upgrading to `5.0.0`, the plan will show that these keys will be added. You can safely accept this change, and Terraform will begin to manage them again.
+* In the resource `google_dataproc_cluster`, the system labels with the prefix `goog-dataproc` will be removed from `labels` field in the state file as part of a one-time resource schema upgrade. If any of these label keys are in the configuration, after upgrading to `5.0.0`, the plan will show that these keys will be added. You can safely accept this change.
+* In the resource `google_notebooks_instance`, the system labels with the prefix `goog-caip-notebook` will be removed from `labels` field in the state file as part of a one-time resource schema upgrade. If any of these label keys are in the configuration, after upgrading to `5.0.0`, the plan will show that these keys will be added. You can safely accept this change, and Terraform will begin to manage them again.
+* In the resource `google_storage_bucket`, the system labels with the prefix `goog-dataplex` will be removed from `labels` field in the state file as part of a one-time resource schema upgrade. If any of these label keys are in the configuration, after upgrading to `5.0.0`, the plan will show that these keys will be added. You can safely accept this change, and Terraform will begin to manage them again.
+
+#### Data source labels
+
+For most resource-based datasources, all three of `labels`, `effective_labels`
+and `terraform_labels` will now be present. All of these three fields include
+all of the labels present on the resource in GCP including the labels configured
+through Terraform, the system, and other clients, equivalent to
+`effective_labels` on the resource.
 
 #### Resource annotations
 
-The new annotations model is similar to the new labels model and will be applied to all of the resources with the top level `annotations` field or the nested `annotations` field inside the top level `metadata` field.
+Annotations have been reworked similarly to `labels`, and `annotations` fields
+will now manage only the keys included in configuration. This model has been
+applied to top level `annotations` fields and those nested in `metadata` blocks.
 
-There are now two annotation-related fields with the new model, the `annotations` and the output-only `effective_annotations` fields.
+Resources that previously contained a single `annotations` field will now contain
+two fields:
 
-## Datasources
+* The `annotations` field is now non-authoritative and only manage the keys
+defined in your configuration for the resource. If an annotations entry was
+added outside of Terraform, it will not be managed by Terraform, unless it is
+added to the `annotations` field in the configuration.
+* The output-only `effective_annotations` will list all the annotations present
+on the resource in GCP, including the entries configured through Terraform, the
+system, and other clients.
 
-## Datasource: `google_product_datasource`
+**Note:** `ignore_changes` can be applied to `annotations` field to ignore the
+changes of the user defined annotations. It is not recommended to apply
+`ignore_changes` to `effective_annotations`, as it may unintuitively affect the
+final API call.
 
-### Datasource-level change example header
+The following changes will be observed after upgrading to `5.0.0`.
+* Running `terraform import` on Google provider `5.0.0` or later, these two fields will show in the state file with an empty `annotations` value. `effective_annotations` will have all of annotations present on the resource in GCP. You can update the resource to bring annotations defined in your configuration under management by Terraform.
+* Running `terraform refresh` on Google provider `5.0.0` or later with an existing pre-`5.0.0` resource before an `apply`, these two fields will show in the state file. `annotations` field will have your current annotations and `effective_annotations` will have all of annotations present on the resource in GCP.
+* Running `terraform apply` on Google provider `5.0.0` or later with an existing pre-`5.0.0` resource before an `apply`, these two fields will show in the state file. `annotations` field will have your current annotations and `effective_annotations` will have all of annotations present on the resource in GCP.
+* In the resource `google_cloud_run_domain_mapping`, the system annotations `serving.knative.dev/creator`, `serving.knative.dev/lastModifier`, `run.googleapis.com/operation-id`, `run.googleapis.com/ingress-status`, `run.googleapis.com/ingress` with the value `all` will be removed from `annotations` inside `metadata` field in the state file as part of a one-time resource schema upgrade. If any of these annotation keys are in the configuration, after upgrading to `5.0.0`, the plan will show that these keys will be added. You can safely accept this change, and Terraform will begin to manage them again.
+* In the resource `google_cloud_run_service`, the system annotations `serving.knative.dev/creator`, `serving.knative.dev/lastModifier`, `run.googleapis.com/operation-id`, `run.googleapis.com/ingress-status`, `run.googleapis.com/ingress` with the value `all` will be removed from `annotations` inside `metadata` field in the state file as part of a one-time resource schema upgrade. If any of these annotation keys are in the configuration, after upgrading to `5.0.0`, the plan will show that these keys will be added. You can safely accept this change, and Terraform will begin to manage them again.
 
-Description of the change and how users should adjust their configuration (if needed).
+#### Data source annotations
 
-## Resources
+For most resource-based datasources, both `annotations` and
+`effective_annotations` will now be present. Both fields will have all the
+annotations present on the resource in GCP including the annotations configured
+through Terraform, the system, and other clients, equivalent to
+`effective_annotations` on the resource.
 
-## Resource: `google_product_resource`
+#### Example
 
-### Resource-level change example header
+##### Mixing resource, provider, and system labels
 
-Description of the change and how users should adjust their configuration (if needed).
+```hcl
+provider "google" {
+  default_labels = {
+    default_key = "default_value"
+  }
+}
 
-## Resource: `google_access_context_manager_service_perimeters`
+resource "google_dataproc_cluster" "with_labels" {
+  name   = "tf-test-dproc-test-1"
+  region = "us-central1"
 
-### Fields changed from lists to sets where appropriate
+  labels = {
+    key1 = "value1"
+    key2 = "value2"
+  }
+}
+```
 
-The following fields have been changed from a list to a set:
-
-`google_access_context_manager_service_perimeters.spec.access_levels`
-`google_access_context_manager_service_perimeters.spec.resources`
-`google_access_context_manager_service_perimeters.spec.restricted_services`
-`google_access_context_manager_service_perimeters.spec.vpc_accessible_services.allowed_services`
-`google_access_context_manager_service_perimeters.spec.egress_policies.egress_from.identities`
-`google_access_context_manager_service_perimeters.spec.egress_policies.egress_to.external_resources`
-`google_access_context_manager_service_perimeters.spec.egress_policies.egress_to.resources`
-`google_access_context_manager_service_perimeters.spec.ingress_policies.ingress_from.identities`
-`google_access_context_manager_service_perimeters.spec.ingress_policies.ingress_to.resources`
-`google_access_context_manager_service_perimeters.status.access_levels`
-`google_access_context_manager_service_perimeters.status.resources`
-`google_access_context_manager_service_perimeters.status.restricted_services`
-`google_access_context_manager_service_perimeters.status.egress_policies.egress_from.identities`
-`google_access_context_manager_service_perimeters.status.egress_policies.egress_to.external_resources`
-`google_access_context_manager_service_perimeters.status.egress_policies.egress_to.resources`
-`google_access_context_manager_service_perimeters.status.ingress_policies.ingress_from.identities`
-`google_access_context_manager_service_perimeters.status.ingress_policies.ingress_to.resources`
+After the configuration is applied, Terraform is managing `key1` and `key2` in
+the `labels` field. `terraform_labels` field has the keys `default_key`, `key1`
+and `key2`. `effective_labels` has the keys `default_key`, `key1`, `key2` and
+any system labels added by GCP.
 
-If you were relying on accessing an individual field by index (for example, google_access_context_manager_service_perimeters.spec.access_levels.0, then that will now need to by hash (for example, google_access_context_manager_service_perimeters.spec.access_levels.\<some-hash\>).
+##### Removing a key
 
-## Resource: `google_access_context_manager_service_perimeter`
+```hcl
+provider "google" {
+  default_labels = {
+    default_key = "default_value"
+  }
+}
 
-### Fields changed from lists to sets where appropriate
+resource "google_dataproc_cluster" "with_labels" {
+  name   = "tf-test-dproc-test-1"
+  region = "us-central1"
 
-The following fields have been changed from a list to a set:
-
-`google_access_context_manager_service_perimeter.spec.access_levels`
-`google_access_context_manager_service_perimeter.spec.resources`
-`google_access_context_manager_service_perimeter.spec.restricted_services`
-`google_access_context_manager_service_perimeter.spec.vpc_accessible_services.allowed_services`
-`google_access_context_manager_service_perimeter.spec.egress_policies.egress_from.identities`
-`google_access_context_manager_service_perimeter.spec.egress_policies.egress_to.external_resources`
-`google_access_context_manager_service_perimeter.spec.egress_policies.egress_to.resources`
-`google_access_context_manager_service_perimeter.spec.ingress_policies.ingress_from.identities`
-`google_access_context_manager_service_perimeter.spec.ingress_policies.ingress_to.resources`
-`google_access_context_manager_service_perimeter.status.access_levels`
-`google_access_context_manager_service_perimeter.status.resources`
-`google_access_context_manager_service_perimeter.status.restricted_services`
-`google_access_context_manager_service_perimeter.status.egress_policies.egress_from.identities`
-`google_access_context_manager_service_perimeter.status.egress_policies.egress_to.external_resources`
-`google_access_context_manager_service_perimeter.status.egress_policies.egress_to.resources`
-`google_access_context_manager_service_perimeter.status.ingress_policies.ingress_from.identities`
-`google_access_context_manager_service_perimeter.status.ingress_policies.ingress_to.resources`
-
-If you were relying on accessing an individual field by index (for example, google_access_context_manager_service_perimeter.spec.access_levels.0, then that will now need to by hash (for example, google_access_context_manager_service_perimeter.spec.access_levels.\<some-hash\>).
+  labels = {
+    key1 = "value1"
+  }
+}
+```
 
+Applying this configuration **after** the previous example, Terraform will clear
+the value of `key2`. Other values are unaffected.
 
-## Resource: `google_bigquery_table`
+```
+      ~ effective_labels   = {
+          - "key2" = "value2" -> null
+            # (5 unchanged elements hidden)
+        }
+      ~ labels             = {
+          - "key2" = "value2" -> null
+            # (1 unchanged element hidden)
+        }
+      ~ terraform_labels   = {
+          - "key2" = "value2" -> null
+            # (2 unchanged elements hidden)
+        }
+```
 
-### At most one of `view`, `materialized_view`, and `schema` can be set.
+### Updates to how empty strings are handled in the `provider` block
 
-The provider will now enforce at plan time that at most one of these fields be set.
+In 5.0.0+ any empty strings set in the `provider` block will be used and not ignored. Previously any empty strings used as arguments in the `provider` block were ignored and did not contribute to configuration of the provider. 
 
-### `schema` can only be represented as a JSON array with non-null elements.
+Users should remove empty string arguments to avoid errors during plan/apply stages.
 
-The provider will now enforce at plan time that `schema` is a valid JSON array with non-null elements.
+```tf
+provider "google" {
+  credentials = "" # this line should be removed
+  project = "my-project"
+  region = "us-central1"
+  zone = "" # this line should be removed
+}
+```
 
-## Resource: `google_bigquery_routine`
+### Changes to how default `location`, `region` and `zone` values are obtained for resources
 
-### `routine_type` is now required.
+Currently, when configuring resources that require a `location`, `region` or `zone` field you have the choice of specifying it in the resource block or allowing default values to be used. Default [region](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/provider_reference#region) or [zone](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/provider_reference#zone) values can be configured in the provider block or by providing values through environment variables.
 
-The provider will now enforce at plan time that `routine_type` be set.
+Changes in 5.0.0 make the way the provider handles `location`/`region`/`zone` values more consistent:
 
-## Resource: `google_firebaserules_release`
+* Resources that have a `location` field will now use the default `region` value preferentially over the default `zone` value set on the provider. This is only relevant to resources where `location` is not provided in the resource block directly.
+* Previously, default `region` and `zone` values set as URIs were incompatible with resources that have `location` or `region` arguments. In 5.0.0+ those values will now be valid and won't result in errors during plan/apply stages.
 
-### Changing `ruleset_name` now triggers replacement
 
-In 4.X.X, changing the `ruleset_name` in `google_firebaserules_release` updates the `Release` in place, which prevents the old `Ruleset` referred to by `ruleset_name` from being destroyed. A workaround is to use a `replace_triggered_by` lifecycle field on the `google_firebaserules_release`. In version 5.0.0, changing `ruleset_name` will trigger a replacement, which allows the `Ruleset` to be deleted. The `replace_triggered_by` workaround becomes unnecessary.
+#### When you may need to take action
 
-#### Old Config
+There is only one change that we anticipate can lead to unexpected diffs in Terraform plans after upgrading to 5.0.0, which is:
 
-```hcl
-resource "google_firebaserules_release" "primary" {
-  name         = "cloud.firestore"
-  ruleset_name = "projects/my-project-name/rulesets/${google_firebaserules_ruleset.firestore.name}"
-  project      = "my-project-name"
+> Resources that have a `location` field will now use the default `region` value preferentially over the default `zone` value set on the provider. This is only relevant to resources where `location` is not provided in the resource block directly.
 
-  lifecycle {
-    replace_triggered_by = [
-      google_firebaserules_ruleset.firestore
-    ]
-  }
-}
+Users will need to check for unexpected `location` changes for resources. If an unexpected change is seen, the solution is to explicitly set the `location` value in that resource's configuration block to match the desired value.
 
-resource "google_firebaserules_ruleset" "firestore" {
-  source {
-    files {
-      content = "service cloud.firestore {match /databases/{database}/documents { match /{document=**} { allow read, write: if false; } } }"
-      name    = "firestore.rules"
-    }
-  }
+This will only affect users whose configuration contains resource blocks that have missing `location` values and whose [default zone](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/provider_reference#zone) value belongs to a region that's different than the [default region](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/provider_reference#region) value. For example, if you set `us-central1-a` as the default zone and `us-central2` as the default region on the provider you may see plans that contain unexpected diffs to move resources from `us-central1` to `us-central2`.
 
-  project = "my-project-name"
-}
-```
 
-#### New Config
+### Provider default values shown at plan-time
 
-```hcl
-resource "google_firebaserules_release" "primary" {
-  name         = "cloud.firestore"
-  ruleset_name = "projects/my-project-name/rulesets/${google_firebaserules_ruleset.firestore.name}"
-  project      = "my-project-name"
-}
+The `project`, `region`, and `zone` fields will now display their values during
+plan-time instead of the placeholder `(known after apply)` value normally
+displayed for fields without fixed Terraform default values. These values will
+be taken from either the Terraform resource config file, provider config, or
+local environment variables, depending on which variables are supplied by the
+user, matching the existing per-resource functionality for what default values
+are used in execution of a Terraform plan.
 
-resource "google_firebaserules_ruleset" "firestore" {
-  source {
-    files {
-      content = "service cloud.firestore {match /databases/{database}/documents { match /{document=**} { allow read, write: if false; } } }"
-      name    = "firestore.rules"
-    }
-  }
+Before `5.0.0`:
 
-  project = "my-project-name"
-}
 ```
+project = (known after apply)
+```
+
+After `5.0.0` (when possible):
+
+```
+project = "my-project"
+```
+
+### Resource import formats have improved validation
+
+Throughout the provider there were many resources which erroneously gave false positives to poorly formatted import input if a subset of the provided input was valid to their configured import formats. All GCP resource IDs supplied to "terraform import" must match the documentation specified import formats exactly.
+
+### Datasources now error universally on 404
+
+All non-IAM data sources have been updated to return an error when a target resource URI can not be reached. Previously this was inconsistent between different datasources in whether an empty value was returned to Terraform state upon 404 or if an error was returned, but this has been standardized. Any plans that reference datasources which no longer exist (or do not exist yet) will need to be revised to have these datasources removed from configuration files.
+
+## Removals
+
+### Product: `gameservices` is now removed
+
+This change involved the following resources: `google_game_services_game_server_cluster`, `google_game_services_game_server_deployment`, `google_game_services_game_server_config`, `google_game_services_realm` and `google_game_services_game_server_deployment_rollout`.
+
+### Product: `cloudiot` is now removed
+
+This change involved the following: `google_cloudiot_device`, `google_cloudiot_registry`, `google_cloudiot_registry_iam_*`, and `data.google_cloudiot_registry_iam_policy`.
+
+
+## Resource: `google_access_context_manager_service_perimeters` and `google_access_context_manager_service_perimeter`
+
+### Fields changed from lists to sets where appropriate
+
+The following fields have been changed from a list to a set in both `google_access_context_manager_service_perimeters` and `google_access_context_manager_service_perimeter`:
+
+`spec.access_levels`
+`spec.resources`
+`spec.restricted_services`
+`spec.vpc_accessible_services.allowed_services`
+`spec.egress_policies.egress_from.identities`
+`spec.egress_policies.egress_to.external_resources`
+`spec.egress_policies.egress_to.resources`
+`spec.ingress_policies.ingress_from.identities`
+`spec.ingress_policies.ingress_to.resources`
+`status.access_levels`
+`status.resources`
+`status.restricted_services`
+`status.egress_policies.egress_from.identities`
+`status.egress_policies.egress_to.external_resources`
+`status.egress_policies.egress_to.resources`
+`status.ingress_policies.ingress_from.identities`
+`status.ingress_policies.ingress_to.resources`
+
+If you were relying on accessing an individual field by index (for example, google_access_context_manager_service_perimeters.spec.access_levels.0, then that will now need to by hash (for example, google_access_context_manager_service_perimeters.spec.access_levels.\<some-hash\>).
+
+
+## Resource: `google_bigquery_routine`
+
+### `routine_type` is now required.
+
+The provider will now enforce at plan time that `routine_type` be set.
+
+
+## Resource: `google_bigquery_table`
+
+### `schema` can only be represented as a JSON array with non-null elements.
+
+The provider will now enforce at plan time that `schema` is a valid JSON array with non-null elements.
+
 
 ## Resource: `google_cloud_run_v2_job`
 
@@ -263,17 +467,48 @@ resource "google_firebaserules_ruleset" "firestore" {
 
 These two unsupported fields were introduced incorrectly. They are now removed.
 
+
 ## Resource: `google_cloud_run_v2_service`
 
 ### `liveness_probe.tcp_socket` is now removed
 
 This unsupported field was introduced incorrectly. It is now removed.
 
-## Resource: `google_dataplex_datascan`
+### retyped `volumes.cloud_sql_instance.instances` to SET from ARRAY for `google_cloud_run_v2_service`
 
-### `dataQualityResult` and `dataProfileResult` output fields are now removed 
+Previously, `database_flags` was a list, making it order-dependent. It is now a set.
+
+If you were relying on accessing an individual flag by index (for example, `google_sql_database_instance.instance.settings.0.database_flags.0.name`), then that will now need to by hash (for example, `google_sql_database_instance.instance.settings.0.database_flags.<some-hash>.name`).
+
+## Resource: `google_cloudfunctions2_function`
+
+### `location` now a required field
+Deployment would fail if this field was unspecified. Marked this field as requied to align with implementation. This value cannot be inferred from any provider level config. No change is necessary for upgrade as this field is already needed for any deployments.
+
+
+## Resource: `google_compute_autoscaler`
+
+### `metric.filter` now defaults to `resource.type = gce_instance` (beta-only)
+
+Previously, `metric.filter` doesn't have the defult value and causes a UI error.
+
+
+## Resource: `google_compute_node_group`
+
+### Node groups are now mutable
+
+Due to limitations in previous field configurations, the only field that could be updated previously was `node_template`. It is now possible to adjust the `autoscaling_policy` without recreating the group, nor will any adjustment to the `size` of the nodepool prompt resource recration.
+
+### `size` is now an output only field.
+
+`size` previously served as an alias for `initial_size` on resource creation, and users would be required to recreate the resource if the `size` value ever adjusted due to either direct user update or auto-scaling adjustment outside of Terraform.
+
+It will now mirror its API functionality and serve as an output only field to show how many nodes currently exist within the resource. All existing configurations which used `size` as an input field must be updated for its removal.
+
+### One of `initial_size` or `autoscaling_policy{}` must be configured on resource creation.
+
+These fields will supply the base node-count for a node group and one of them will be required for successful resource creation. Both will be freely updateable or removable on future state changes that do not require recreation.
 
-`dataQualityResult` and `dataProfileResult` were output-only fields which listed results for the latest job created under a Datascan. These were problematic fields that are unlikely to be relevant in a Terraform context. Removing them reduces the likelihood of additional parsing errors, and reduces maintenance overhead for the API surface.
 
 ## Resource: `google_compute_router_nat`
 
@@ -285,6 +520,202 @@ enable endpoint independent mapping, then explicity set the value of
 `enable_endpoint_independent_mapping` field to `TRUE`.
 
 
+## Resource: `google_compute_security_policy`
+
+### `rule.rate_limit_options.encorce_on_key` no longer has default value
+
+Previously, the default value for `rule.rate_limit_options.encorce_on_key` is "ALL", now this field no longer has a default value.
+
+
+## Resource: `google_compute_service_attachment`
+
+### `reconcile_connections` now defaults from API
+
+`reconcile_connections` previously defaulted to true. Now it will default from the API.
+
+### Retyped `consumer_accept_lists` to SET from ARRAY
+
+Previously, `consumer_accept_lists` was a list, making it order-dependent. It is now a set.
+
+If you were relying on accessing an individual flag by index (for example, `google_compute_service_attachment.consumer_accept_lists.0.project_id_or_num`), then that will now need to by hash (for example, `google_compute_service_attachment.consumer_accept_lists.<some-hash>.project_id_or_num`).
+
+
+## Resource: `google_container_cluster`
+
+### Cluster deletion now prevented by default with `deletion_protection`
+
+The field `deletion_protection` has been added with a default of `true`. This field prevents
+Terraform from destroying or recreating the cluster. In 5.0.0, existing clusters will have 
+`deletion_protection` set to `true` during the next refresh unless otherwise set in configuration.
+
+**`deletion_protection` does NOT prevent deletion outside of Terraform.**
+
+To disable deletion protection, explicitly set this field to `false` in configuration
+and then run `terraform apply` to apply the change.
+
+### Clusters created in error states are now tainted rather than deleted
+
+GKE clusters that are created but do not become healthy will now be recorded in
+state and marked as tainted for cleanup on next apply rather than immediately
+deleted.
+
+This behavior was changed to allow users to collect internal logs from the
+cluster and/or manually resolve the issues and untaint their failed clusters.
+
+### `node_config.0.taint` and `node_pool.0.node_config.0.taint` field change
+
+The `taint` field has been changed to manage a subset of the taint keys on a node pool
+and the `effective_taints` output field has been added to record the complete set of
+taints applied to the node pool by GKE.
+
+Previously, the field was authoritative and would require every taint on the node pool
+to be recorded, causing friction when users used GPUs or configured sandbox settings,
+actions which added taints. After this change, only "Terraform-managed" taints will be
+managed by the `taint` field. Other taints, including new taints injected by the
+server, will not have drift detected.
+
+Currently, the set of managed taints and their values are immutable in Terraform, and
+any changes will cause a recreate to be planned. However, taints can be unmanaged by
+simultaneously removing the taint entry from GKE and your Terraform configuration at
+the same time.
+
+The set of taints Terraform manages (and their values) will be determined based on
+how the cluster or node pool resource was added to your Terraform state file:
+
+* If you created the cluster or node pool with Terraform with Google provider 5.0.0
+or later, the set of taints specified during resource creation will be managed.
+* If you imported the cluster or node pool with Google provider 5.0.0 or later, no
+taints will be managed by Terraform
+* If you upgraded from an earlier version, the complete set of taint values applied to the
+node pool at the time of your last refresh will be managed by Terraform
+
+Most existing configurations will not be affected with this change as they already specify
+the whole set of managed taints, or are already ignoring changes with `lifecycle.ignore_changes`,
+preventing a diff.
+
+A limited number of users may see a diff if they are using the `google-beta` provider
+and have specified a `sandbox_config` value. If that's the case, you can safely add the
+proposed value to configuration (below) or apply `lifecycle.ignore_changes` to the field to resolve.
+
+
+```diff
++    taint {
++      key    = "sandbox.gke.io/runtime"
++      value  = "gvisor"
++      effect = "NO_SCHEDULE"
++    }
+```
+
+### `networking_mode` defaults to `VPC_NATIVE` for newly created clusters
+
+New clusters will default to `VPC_NATIVE` which enables [IP aliasing](https://cloud.google.com/kubernetes-engine/docs/how-to/ip-aliases). Previously, `google_container_cluster` would default to using routes as
+the networking mode unless `ip_allocation_policy` policy was set. Now, `networking_mode` will
+default to `VPC_NATIVE` and `ip_allocation_policy` will be set by the server if unset in
+configuration. Existing clusters should not be affected.
+
+#### New Minimal Config for VPC-native cluster
+
+```hcl
+resource "google_container_cluster" "primary" {
+  name               = "my_cluster"
+  location           = "us-central1-a"
+  initial_node_count = 1
+}
+```
+
+#### New Minimal Config for Routes-based cluster
+
+```hcl
+resource "google_container_cluster" "primary" {
+  name               = "my_cluster"
+  location           = "us-central1-a"
+  initial_node_count = 1
+  networking_mode    = "ROUTES"
+}
+```
+
+### `enable_binary_authorization` is now removed
+
+`enable_binary_authorization` has been removed in favor of `binary_authorization.enabled`.
+
+### Default value of `network_policy.provider` is now removed
+
+Previously `network_policy.provider` defaulted to "PROVIDER_UNSPECIFIED". It no longer
+has a default value.
+
+
+## Resource: `google_container_node_pool`
+
+### `management.auto_repair` and `management.auto_upgrade` now default to true
+
+Previously both fields defaulted to false if `management` was set as an empty block.
+They now default to true.
+
+### `logging_variant` no longer has a provider default value
+
+The provider no longer shows a default value at plan-time, and defers to the 
+API server default.
+
+### `node_config.0.taint` field change
+
+The `taint` field has been changed to manage a subset of the taint keys on a node pool
+and the `effective_taints` output field has been added to record the complete set of
+taints applied to the node pool by GKE.
+
+Previously, the field was authoritative and would require every taint on the node pool
+to be recorded, causing friction when users used GPUs or configured sandbox settings,
+actions which added taints. After this change, only "Terraform-managed" taints will be
+managed by the `taint` field. Other taints, including new taints injected by the
+server, will not have drift detected.
+
+Currently, the set of managed taints and their values are immutable in Terraform, and
+any changes will cause a recreate to be planned. However, taints can be unmanaged by
+simultaneously removing the taint entry from GKE and your Terraform configuration at
+the same time.
+
+The set of taints Terraform manages (and their values) will be determined based on
+how the cluster or node pool resource was added to your Terraform state file:
+
+* If you created the cluster or node pool with Terraform with Google provider 5.0.0
+or later, the set of taints specified during resource creation will be managed.
+* If you imported the cluster or node pool with Google provider 5.0.0 or later, no
+taints will be managed by Terraform
+* If you upgraded from an earlier version, the complete set of taint values applied to the
+node pool at the time of your last refresh will be managed by Terraform
+
+Most existing configurations will not be affected with this change as they already specify
+the whole set of managed taints, or are already ignoring changes with `lifecycle.ignore_changes`,
+preventing a diff.
+
+A limited number of users may see a diff if they are using the `google-beta` provider
+and have specified a `sandbox_config` value. If that's the case, you can safely add the
+proposed value to configuration (below) or apply `lifecycle.ignore_changes` to the field to resolve.
+
+
+```diff
++    taint {
++      key    = "sandbox.gke.io/runtime"
++      value  = "gvisor"
++      effect = "NO_SCHEDULE"
++    }
+```
+
+## Resource: `google_dataflow_flex_template_job`
+
+### Fields that are a part of the [environment block](https://cloud.google.com/dataflow/docs/reference/rest/v1b3/projects.locations.flexTemplates/launch#FlexTemplateRuntimeEnvironment) will be overriden to be sent via their fields even when supplied via parameters.
+
+Several fields within the `google_dataflow_flex_template_job` resource can be supplied through either the `parameters{}` block or a field on the resource object. Support for these fields on the resource object was added in the `4.66.0` release of the Google provider. That version introduced an issue where the values were being double-sent to the API due to being recorded in Terraform state in two places. To resolve this issue, these fields will be deduplicated and sent to the API through the resource object.
+
+Additionally, due to the API returning these fields to the user they will now be considered computed and users will see values twice within their state when configuring these fields' values via the `parameters{}` block.
+
+
+## Resource: `google_dataplex_datascan`
+
+### `dataQualityResult` and `dataProfileResult` output fields are now removed 
+
+`dataQualityResult` and `dataProfileResult` were output-only fields which listed results for the latest job created under a Datascan. These were problematic fields that are unlikely to be relevant in a Terraform context. Removing them reduces the likelihood of additional parsing errors, and reduces maintenance overhead for the API surface.
+
+
 ## Resource: `google_firebase_project_location`
 
 ### `google_firebase_project_location` is now removed
@@ -298,6 +729,7 @@ For more information on configuring Firebase resources with Terraform, see [Get
 If you have existing resources created using `google_firebase_project_location`:
 1. Remove the `google_firebase_project_location` block
 1. Add blocks according to "New config" in this section for any of the following that you need: `google_app_engine_application`, `google_firebase_storage_bucket`, and/or `google_firestore_database`.
+1. Run `terraform state rm` for your existing `google_firebase_project_location` resource
 1. Import the existing resources corresponding to the blocks added in the previous step:
    `terraform import google_app_engine_application.default <project-id>`
    `terraform import google_firebase_storage_bucket.default-bucket <project-id>/<project-id>.appspot.com`
@@ -344,46 +776,86 @@ resource "google_firestore_database" "default" {
 }
 ```
 
+
 ## Resource: `google_firebase_web_app`
 
 ### `deletion_policy` now defaults to `DELETE`
 
 Previously, `google_firebase_web_app` deletions default to `ABANDON`, which means to only stop tracking the WebApp in Terraform. The actual app is not deleted from the Firebase project. If you are relying on this behavior, set `deletion_policy` to `ABANDON` explicitly in the new version.
-## Resource: `google_compute_autoscaler` (beta)
 
-### `metric.filter` now defaults to `resource.type = gce_instance`
 
-Previously, `metric.filter` doesn't have the defult value and causes a UI error.
+## Resource: `google_firebaserules_release`
 
-## Resource: `google_privateca_certificate`
+### Changing `ruleset_name` now triggers replacement
 
-### `config_values` is now removed
+In 4.X.X, changing the `ruleset_name` in `google_firebaserules_release` updates the `Release` in place, which prevents the old `Ruleset` referred to by `ruleset_name` from being destroyed. A workaround is to use a `replace_triggered_by` lifecycle field on the `google_firebaserules_release`. In version 5.0.0, changing `ruleset_name` will trigger a replacement, which allows the `Ruleset` to be deleted. The `replace_triggered_by` workaround becomes unnecessary.
 
-Deprecated in favor of field `x509_description`. It is now removed.
+#### Old Config
 
-### `pem_certificates` is now removed
+```hcl
+resource "google_firebaserules_release" "primary" {
+  name         = "cloud.firestore"
+  ruleset_name = "projects/my-project-name/rulesets/${google_firebaserules_ruleset.firestore.name}"
+  project      = "my-project-name"
+
+  lifecycle {
+    replace_triggered_by = [
+      google_firebaserules_ruleset.firestore
+    ]
+  }
+}
+
+resource "google_firebaserules_ruleset" "firestore" {
+  source {
+    files {
+      content = "service cloud.firestore {match /databases/{database}/documents { match /{document=**} { allow read, write: if false; } } }"
+      name    = "firestore.rules"
+    }
+  }
 
-Deprecated in favor of field `pem_certificate_chain`. It is now removed.
+  project = "my-project-name"
+}
+```
 
-## Product: `gameservices`
+#### New Config
 
-### `gameservices` is now removed
+```hcl
+resource "google_firebaserules_release" "primary" {
+  name         = "cloud.firestore"
+  ruleset_name = "projects/my-project-name/rulesets/${google_firebaserules_ruleset.firestore.name}"
+  project      = "my-project-name"
+}
 
-This change involved the following resources: `google_game_services_game_server_cluster`, `google_game_services_game_server_deployment`, `google_game_services_game_server_config`, `google_game_services_realm` and `google_game_services_game_server_deployment_rollout`.
+resource "google_firebaserules_ruleset" "firestore" {
+  source {
+    files {
+      content = "service cloud.firestore {match /databases/{database}/documents { match /{document=**} { allow read, write: if false; } } }"
+      name    = "firestore.rules"
+    }
+  }
 
-## Resource: `google_sql_database`
+  project = "my-project-name"
+}
+```
 
-### `database_flags` is now a set
 
-Previously, `database_flags` was a list, making it order-dependent. It is now a set.
+## Resource: `google_gkeonprem_bare_metal_admin_cluster`
 
-If you were relying on accessing an individual flag by index (for example, `google_sql_database_instance.instance.settings.0.database_flags.0.name`), then that will now need to by hash (for example, `google_sql_database_instance.instance.settings.0.database_flags.<some-hash>.name`).
+Delete operation is disabled. The command `terraform destroy` maps to no-op. Users need to delete resource manually. Please refer to the [user guide](https://cloud.google.com/anthos/clusters/docs/bare-metal/latest/how-to/reset-nodes) for the instructions of cluster deletion.
 
-## Resource: `google_compute_security_policy`
 
-### `rule.rate_limit_options.encorce_on_key` no longer has default value
+## Resource: `google_logging_metric`
+
+### Additional `bucket_options` subfields are now properly required
+
+When setting the `bucket_options` block, the following fields may be required:
+
+* `num_finite_buckets`, `width`, and `offset` are now required when `bucket_options.linear_buckets` is set.
+
+* `num_finite_buckets`, `growth_factor`, and `scale` are now required when `bucket_options.exponential_buckets` is set.
+
+Previously these fields should have been required but were not, which allowed for invalid `google_logging_metric` configurations.
 
-Previously, the default value for `rule.rate_limit_options.encorce_on_key` is "ALL", now this field no longer has a default value.
 
 ## Resource: `google_logging_project_sink`
 
@@ -423,18 +895,90 @@ resource "google_project_iam_binding" "gcs-bucket-writer" {
   ]
 }
 ```
-## Product: `cloudiot`
 
-### resource `google_cloudiot_device` is now removed
 
-### resource `google_cloudiot_registry` is now removed
+## Resource: `google_looker_instance`
+
+### `LOOKER_MODELER` has been removed as a platform edition.
+
+Looker Modeler edition is deprecated as a platform edition.
+
+
+## Resource: `google_monitoring_dashboard`
+
+### `dashboard_json` suppresses removal diffs more aggressively
+
+To prevent permanent diffs from default values, Terraform will now attempt to suppress diffs where the value is returned in the JSON
+string but doesn't exist in the configuration. Consequently, legitmate remove-only diffs will also be suppressed.
+For Terraform to detect the diff, JSON key removals must also be accompanied by a non-removal change (trivial or not).
+
 
-### resource `google_cloudiot_registry_iam_*` is now removed
+## Resource: `google_monitoring_metric_descriptor`
+
+### Changing `labels` now triggers replacement
+
+Previously, attempting to update `labels` failed and created a permadiff. The `labels` 
+field is now immutable without destroying and recreating the resource.
+
+
+## Resource: `google_privateca_certificate`
+
+### `config_values` is now removed
+
+Removed in favor of field `x509_description`.
+
+### `pem_certificates` is now removed
+
+Removed in favor of field `pem_certificate_chain`.
 
-### datasource `google_cloudiot_registry_iam_policy` is now removed
 
 ## Resource: `google_service_networking_connection`
 
 ### `Create` endpoint is used to create the resource
 
-`google_service_networking_connection` now uses the Create endpoint instead of the Patch endpoint during the creation step. Previously, Patch was used as a workaround for an issue that has since been resolved.
\ No newline at end of file
+`google_service_networking_connection` now uses the Create endpoint instead of the Patch endpoint during the creation step. Previously, Patch was used as a workaround for an issue that has since been resolved.
+
+### "terraform destroy" now fully deletes the resource instead of abandoning
+
+`google_service_networking_connection` now uses API `deleteConnection` method instead of `removePeering` method during the deletion step. Previously, `removePeering` method was used because `deleteConnection` method was unavailable. In some cases a private connection cannot be deleted immediately after the resource using that connection is deleted, and users may have to delete the private connection after a waiting period.
+
+
+## Resource: `google_secret_manager_secret`
+
+### `replication.automatic` is now removed
+
+Removed in favor of field `replication.auto`.
+
+#### Old Config
+
+```hcl
+resource "google_secret_manager_secret" "my-secret" {
+  secret_id = "tf-secret"
+  
+  replication {
+    automatic = true
+  }
+}
+```
+
+#### New Config
+
+```hcl
+resource "google_secret_manager_secret" "my-secret" {
+  secret_id = "tf-secret"
+  
+  replication {
+    auto {}
+  }
+}
+```
+
+
+## Resource: `google_sql_database`
+
+### `database_flags` is now a set
+
+Previously, `database_flags` was a list, making it order-dependent. It is now a set.
+
+If you were relying on accessing an individual flag by index (for example, `google_sql_database_instance.instance.settings.0.database_flags.0.name`), then that will now need to by hash (for example, `google_sql_database_instance.instance.settings.0.database_flags.<some-hash>.name`).
+
diff --git a/mmv1/third_party/terraform/website/docs/index.html.markdown b/mmv1/third_party/terraform/website/docs/index.html.markdown
index be87ca84a1d4..db9c0e41fbab 100644
--- a/mmv1/third_party/terraform/website/docs/index.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/index.html.markdown
@@ -49,7 +49,7 @@ If you have configuration questions, or general questions about using the provid
 
 Interested in the provider's latest features, or want to make sure you're up to date?
 Check out the [`google` provider Releases](https://github.com/hashicorp/terraform-provider-google/releases)
-and the [`google-beta` provider Releases](https://github.com/hashicorp/terraform-provider-google-beta/releases
+and the [`google-beta` provider Releases](https://github.com/hashicorp/terraform-provider-google-beta/releases)
 for release notes and additional information.
 
 Per [Terraform Provider Versioning](https://www.hashicorp.com/blog/hashicorp-terraform-provider-versioning),
diff --git a/mmv1/third_party/terraform/website/docs/r/apigee_flowhook.html.markdown b/mmv1/third_party/terraform/website/docs/r/apigee_flowhook.html.markdown
index 380a65ed82fe..444327f6d6dc 100644
--- a/mmv1/third_party/terraform/website/docs/r/apigee_flowhook.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/apigee_flowhook.html.markdown
@@ -65,6 +65,20 @@ This resource provides the following
 
 Flowhook can be imported using any of these accepted formats:
 
+* `organizations/{{org_id}}/environments/{{environment}}/flowhooks/{{flow_hook_point}}`
+* `{{org_id}}/{{environment}}/{{flow_hook_point}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Flowhook using one of the formats above. For example:
+
+```tf
+import {
+  id = "organizations/{{org_id}}/environments/{{environment}}/flowhooks/{{flow_hook_point}}"
+  to = google_apigee_flowhook.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Flowhook can be imported using one of the formats above. For example:
+
 ```
 $ terraform import google_apigee_flowhook.default organizations/{{org_id}}/environments/{{environment}}/flowhooks/{{flow_hook_point}}
 $ terraform import google_apigee_flowhook.default {{org_id}}/{{environment}}/{{flow_hook_point}}
diff --git a/mmv1/third_party/terraform/website/docs/r/apigee_keystores_aliases_key_cert_file.html.markdown b/mmv1/third_party/terraform/website/docs/r/apigee_keystores_aliases_key_cert_file.html.markdown
index 1329a5a11e02..b8989bfa558e 100644
--- a/mmv1/third_party/terraform/website/docs/r/apigee_keystores_aliases_key_cert_file.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/apigee_keystores_aliases_key_cert_file.html.markdown
@@ -135,6 +135,20 @@ This resource provides the following
 
 KeystoresAliasesKeyCertFile can be imported using any of these accepted formats:
 
+* `organizations/{{org_id}}/environments/{{environment}}/keystores/{{keystore}}/aliases/{{alias}}`
+* `{{org_id}}/{{environment}}/{{keystore}}/{{alias}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KeystoresAliasesKeyCertFile using one of the formats above. For example:
+
+```tf
+import {
+  id = "organizations/{{org_id}}/environments/{{environment}}/keystores/{{keystore}}/aliases/{{alias}}"
+  to = google_apigee_keystores_aliases_key_cert_file.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), KeystoresAliasesKeyCertFile can be imported using one of the formats above. For example:
+
 ```
 $ terraform import google_apigee_keystores_aliases_key_cert_file.default organizations/{{org_id}}/environments/{{environment}}/keystores/{{keystore}}/aliases/{{alias}}
 $ terraform import google_apigee_keystores_aliases_key_cert_file.default {{org_id}}/{{environment}}/{{keystore}}/{{alias}}
diff --git a/mmv1/third_party/terraform/website/docs/r/apigee_keystores_aliases_pkcs12.html.markdown b/mmv1/third_party/terraform/website/docs/r/apigee_keystores_aliases_pkcs12.html.markdown
index d5de37d940ff..370516a0b497 100644
--- a/mmv1/third_party/terraform/website/docs/r/apigee_keystores_aliases_pkcs12.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/apigee_keystores_aliases_pkcs12.html.markdown
@@ -128,6 +128,21 @@ This resource provides the following
 
 KeystoresAliasesPkcs12 can be imported using any of these accepted formats:
 
+* `organizations/{{org_id}}/environments/{{environment}}/keystores/{{keystore}}/aliases/{{alias}}`
+* `{{org_id}}/{{environment}}/{{keystore}}/{{alias}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KeystoresAliasesPkcs12 using one of the formats above. For example:
+
+```tf
+import {
+  id = "organizations/{{org_id}}/environments/{{environment}}/keystores/{{keystore}}/aliases/{{alias}}"
+  to = google_apigee_keystores_aliases_pkcs12.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), KeystoresAliasesPkcs12 can be imported using one of the formats above. For example:
+
+
 ```
 $ terraform import google_apigee_keystores_aliases_pkcs12.default organizations/{{org_id}}/environments/{{environment}}/keystores/{{keystore}}/aliases/{{alias}}
 $ terraform import google_apigee_keystores_aliases_pkcs12.default {{org_id}}/{{environment}}/{{keystore}}/{{alias}}
diff --git a/mmv1/third_party/terraform/website/docs/r/apigee_sharedflow.html.markdown b/mmv1/third_party/terraform/website/docs/r/apigee_sharedflow.html.markdown
index bfa62e9830de..7726575ae547 100644
--- a/mmv1/third_party/terraform/website/docs/r/apigee_sharedflow.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/apigee_sharedflow.html.markdown
@@ -88,6 +88,20 @@ This resource provides the following
 
 SharedFlow can be imported using any of these accepted formats:
 
+* `{{org_id}}/sharedflows/{{name}}`
+* `{{org_id}}/{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SharedFlow using one of the formats above. For example:
+
+```tf
+import {
+  id = "{{org_id}}/sharedflows/{{name}}"
+  to = google_apigee_sharedflow.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), SharedFlow can be imported using one of the formats above. For example:
+
 ```
 $ terraform import google_apigee_sharedflow.default {{org_id}}/sharedflows/{{name}}
 $ terraform import google_apigee_sharedflow.default {{org_id}}/{{name}}
diff --git a/mmv1/third_party/terraform/website/docs/r/apigee_sharedflow_deployment.html.markdown b/mmv1/third_party/terraform/website/docs/r/apigee_sharedflow_deployment.html.markdown
index d5abbd852590..313162586d16 100644
--- a/mmv1/third_party/terraform/website/docs/r/apigee_sharedflow_deployment.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/apigee_sharedflow_deployment.html.markdown
@@ -66,6 +66,20 @@ This resource provides the following
 
 SharedflowDeployment can be imported using any of these accepted formats:
 
+* `organizations/{{org_id}}/environments/{{environment}}/sharedflows/{{sharedflow_id}}/revisions/{{revision}}/deployments/{{name}}`
+* `{{org_id}}/{{environment}}/{{sharedflow_id}}/{{revision}}/{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SharedflowDeployment using one of the formats above. For example:
+
+```tf
+import {
+  id = "organizations/{{org_id}}/environments/{{environment}}/sharedflows/{{sharedflow_id}}/revisions/{{revision}}/deployments/{{name}}"
+  to = google_apigee_flowhook.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), SharedflowDeployment can be imported using one of the formats above. For example:
+
 ```
 $ terraform import google_apigee_sharedflow_deployment.default organizations/{{org_id}}/environments/{{environment}}/sharedflows/{{sharedflow_id}}/revisions/{{revision}}/deployments/{{name}}
 $ terraform import google_apigee_sharedflow_deployment.default {{org_id}}/{{environment}}/{{sharedflow_id}}/{{revision}}/{{name}}
diff --git a/mmv1/third_party/terraform/website/docs/r/app_engine_application.html.markdown b/mmv1/third_party/terraform/website/docs/r/app_engine_application.html.markdown
index fb45b44d1864..de386e9ff7ac 100644
--- a/mmv1/third_party/terraform/website/docs/r/app_engine_application.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/app_engine_application.html.markdown
@@ -105,6 +105,19 @@ This resource provides the following
 
 Applications can be imported using the ID of the project the application belongs to, e.g.
 
+* `{{project-id}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an Application using one of the formats above. For example:
+
+```tf
+import {
+  id = "{{project-id}}"
+  to = google_app_engine_application.default
+}
 ```
-$ terraform import google_app_engine_application.app your-project-id
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Applications can be imported using one of the formats above. For example:
+
 ```
+$ terraform import google_app_engine_application.default {{project-id}}
+```
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/website/docs/r/bigquery_dataset_iam.html.markdown b/mmv1/third_party/terraform/website/docs/r/bigquery_dataset_iam.html.markdown
index b5962881d537..e911137bdfae 100644
--- a/mmv1/third_party/terraform/website/docs/r/bigquery_dataset_iam.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/bigquery_dataset_iam.html.markdown
@@ -4,7 +4,7 @@ description: |-
  Collection of resources to manage IAM policy for a BigQuery dataset.
 ---
 
-# IAM policy for BigQuery dataset
+# IAM policy for BigQuery Dataset
 
 Three different resources help you manage your IAM policy for BigQuery dataset. Each of these resources serves a different use case:
 
@@ -112,23 +112,68 @@ exported:
 
 ## Import
 
-IAM member imports use space-delimited identifiers; the resource in question, the role, and the account.  This member resource can be imported using the `dataset_id`, role, and account e.g.
+-> **Custom Roles** If you're importing a IAM resource with a custom role, make sure to use the full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
 
-```
-$ terraform import google_bigquery_dataset_iam_member.dataset_iam "projects/your-project-id/datasets/dataset-id roles/viewer user:foo@example.com"
+### Importing IAM members
+
+IAM member imports use space-delimited identifiers that contains the `dataset_id`, `role`, and `member`. For example:
+
+* `"projects/{{project_id}}/datasets/{{dataset_id}} roles/viewer user:foo@example.com"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM members:
+
+```tf
+import {
+  id = "projects/{{project_id}}/datasets/{{dataset_id}} roles/viewer user:foo@example.com"
+  to = google_bigquery_dataset_iam_member.default
+}
 ```
 
-IAM binding imports use space-delimited identifiers; the resource in question and the role.  This binding resource can be imported using the `dataset_id` and role, e.g.
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
 
 ```
-$ terraform import google_bigquery_dataset_iam_binding.dataset_iam "projects/your-project-id/datasets/dataset-id roles/viewer"
+$ terraform import google_bigquery_dataset_iam_member.default "projects/{{project_id}}/datasets/{{dataset_id}} roles/viewer user:foo@example.com"
 ```
 
-IAM policy imports use the identifier of the resource in question.  This policy resource can be imported using the `dataset_id`, role, and account e.g.
+### Importing IAM bindings
 
+IAM binding imports use space-delimited identifiers that contain the resource's `dataset_id` and `role`. For example:
+
+* `"projects/{{project_id}}/datasets/{{dataset_id}} roles/viewer
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM bindings:
+
+```tf
+import {
+  id = "projects/{{project_id}}/datasets/{{dataset_id}} roles/viewer"
+  to = google_bigquery_dataset_iam_binding.default
+}
 ```
-$ terraform import google_bigquery_dataset_iam_policy.dataset_iam projects/your-project-id/datasets/dataset-id
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
 ```
+$ terraform import google_bigquery_dataset_iam_binding.default "projects/{{project_id}}/datasets/{{dataset_id}} roles/viewer"
+```
+
+### Importing IAM policies
+
+IAM policy imports use the identifier of the BigQuery Dataset resource. For example:
+
+* `projects/{{project_id}}/datasets/{{dataset_id}}`
+
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM policies:
 
--> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
- full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
+```tf
+import {
+  id = projects/{{project_id}}/datasets/{{dataset_id}}
+  to = google_bigquery_dataset_iam_policy.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+$ terraform import google_bigquery_dataset_iam_policy.default projects/{{project_id}}/datasets/{{dataset_id}}
+```
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/website/docs/r/bigquery_table.html.markdown b/mmv1/third_party/terraform/website/docs/r/bigquery_table.html.markdown
index 0e277c0f1d40..525f395d8a8d 100644
--- a/mmv1/third_party/terraform/website/docs/r/bigquery_table.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/bigquery_table.html.markdown
@@ -106,7 +106,10 @@ The following arguments are supported:
 
 * `friendly_name` - (Optional) A descriptive name for the table.
 
-* `max_staleness`: (Optional) The maximum staleness of data that could be returned when the table (or stale MV) is queried. Staleness encoded as a string encoding of sql IntervalValue type.
+* `max_staleness`: (Optional) The maximum staleness of data that could be
+  returned when the table (or stale MV) is queried. Staleness encoded as a
+  string encoding of [SQL IntervalValue
+  type](https://cloud.google.com/bigquery/docs/reference/standard-sql/data-types#interval_type).
 
 * `encryption_configuration` - (Optional) Specifies how the table should be encrypted.
     If left blank, the table will be encrypted with a Google-managed key; that process
@@ -114,6 +117,15 @@ The following arguments are supported:
 
 * `labels` - (Optional) A mapping of labels to assign to the resource.
 
+    **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+    Please refer to the field 'effective_labels' for all of the labels present on the resource.
+
+* `terraform_labels` -
+  The combination of labels configured directly on the resource and default labels configured on the provider.
+
+* `effective_labels` -
+  All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
+
 * <a name="schema"></a>`schema` - (Optional) A JSON schema for the table.
 
     ~>**NOTE:** Because this field expects a JSON string, any changes to the
@@ -135,6 +147,10 @@ The following arguments are supported:
 * `range_partitioning` - (Optional) If specified, configures range-based
     partitioning for this table. Structure is [documented below](#nested_range_partitioning).
 
+* `require_partition_filter` - (Optional) If set to true, queries over this table
+    require a partition filter that can be used for partition elimination to be
+    specified.
+
 * `clustering` - (Optional) Specifies column names to use for data clustering.
     Up to four top-level columns are allowed, and should be specified in
     descending priority order.
@@ -148,6 +164,9 @@ The following arguments are supported:
 * `deletion_protection` - (Optional) Whether or not to allow Terraform to destroy the instance. Unless this field is set to false
 in Terraform state, a `terraform destroy` or `terraform apply` that would delete the instance will fail.
 
+* `table_constraints` - (Optional) Defines the primary key and foreign keys. 
+    Structure is [documented below](#nested_table_constraints).
+
 <a name="nested_external_data_configuration"></a>The `external_data_configuration` block supports:
 
 * `autodetect` - (Required) - Let BigQuery try to autodetect the schema
@@ -320,7 +339,8 @@ in Terraform state, a `terraform destroy` or `terraform apply` that would delete
 
 * `require_partition_filter` - (Optional) If set to true, queries over this table
     require a partition filter that can be used for partition elimination to be
-    specified.
+    specified. `require_partition_filter` is deprecated and will be removed in
+    a future major release. Use the top level field with the same name instead.
 
 <a name="nested_range_partitioning"></a>The `range_partitioning` block supports:
 
@@ -355,6 +375,9 @@ in Terraform state, a `terraform destroy` or `terraform apply` that would delete
 * `refresh_interval_ms` - (Optional) The maximum frequency at which this materialized view will be refreshed.
     The default value is 1800000
 
+* `allow_non_incremental_definition` - (Optional) Allow non incremental materialized view definition.
+    The default value is false.
+
 <a name="nested_encryption_configuration"></a>The `encryption_configuration` block supports the following arguments:
 
 * `kms_key_name` - (Required) The self link or full name of a key which should be used to
@@ -363,6 +386,51 @@ in Terraform state, a `terraform destroy` or `terraform apply` that would delete
     `google_bigquery_default_service_account` datasource and the
     `google_kms_crypto_key_iam_binding` resource.
 
+<a name="nested_table_constraints"></a>The `table_constraints` block supports:
+
+* `primary_key` - (Optional) Represents the primary key constraint
+    on a table's columns. Present only if the table has a primary key.
+    The primary key is not enforced.
+    Structure is [documented below](#nested_primary_key).
+
+* `foreign_keys` - (Optional) Present only if the table has a foreign key.
+    The foreign key is not enforced.
+    Structure is [documented below](#nested_foreign_keys).
+
+<a name="nested_primary_key"></a>The `primary_key` block supports:
+
+* `columns`: (Required) The columns that are composed of the primary key constraint.
+
+<a name="nested_foreign_keys"></a>The `foreign_keys` block supports:
+
+* `name`: (Optional) Set only if the foreign key constraint is named.
+
+* `referenced_table`: (Required) The table that holds the primary key
+    and is referenced by this foreign key.
+    Structure is [documented below](#nested_referenced_table).
+
+* `column_references`: (Required) The pair of the foreign key column and primary key column.
+    Structure is [documented below](#nested_column_references).
+
+<a name="nested_referenced_table"></a>The `referenced_table` block supports:
+
+* `project_id`: (Required) The ID of the project containing this table.
+
+* `dataset_id`: (Required) The ID of the dataset containing this table.
+
+* `table_id`: (Required) The ID of the table. The ID must contain only
+	letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum
+	length is 1,024 characters. Certain operations allow suffixing of
+	the table ID with a partition decorator, such as
+	sample_table$20190123.
+
+<a name="nested_column_references"></a>The `column_references` block supports:
+
+* `referencing_column`: (Required) The column that composes the foreign key.
+
+* `referenced_column`: (Required) The column in the primary key that are
+    referenced by the referencingColumn
+
 ## Attributes Reference
 
 In addition to the arguments listed above, the following computed attributes are
@@ -392,7 +460,22 @@ exported:
 
 ## Import
 
-BigQuery tables imported using any of these accepted formats:
+BigQuery tables can be imported using any of these accepted formats:
+
+* `projects/{{project}}/datasets/{{dataset_id}}/tables/{{table_id}}`
+* `{{project}}/{{dataset_id}}/{{table_id}}`
+* `{{dataset_id}}/{{table_id}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import BigQuery tables using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project}}/datasets/{{dataset_id}}/tables/{{table_id}}"
+  to = google_bigquery_table.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), BigQuery tables can be imported using one of the formats above. For example:
 
 ```
 $ terraform import google_bigquery_table.default projects/{{project}}/datasets/{{dataset_id}}/tables/{{table_id}}
diff --git a/mmv1/third_party/terraform/website/docs/r/bigtable_instance.html.markdown b/mmv1/third_party/terraform/website/docs/r/bigtable_instance.html.markdown
index 6536a90b7800..c04a97d504bf 100644
--- a/mmv1/third_party/terraform/website/docs/r/bigtable_instance.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/bigtable_instance.html.markdown
@@ -102,6 +102,14 @@ in Terraform state, a `terraform destroy` or `terraform apply` that would delete
 
 * `labels` - (Optional) A set of key/value label pairs to assign to the resource. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field 'effective_labels' for all of the labels present on the resource.
+
+* `terraform_labels` -
+  The combination of labels configured directly on the resource and default labels configured on the provider.
+
+* `effective_labels` -
+  All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
 
 -----
 
@@ -142,6 +150,7 @@ If no value is set, Cloud Bigtable automatically allocates nodes based on your d
 In addition to the arguments listed above, the following computed attributes are exported:
 
 * `id` - an identifier for the resource with format `projects/{{project}}/instances/{{name}}`
+* `cluster.0.state` - describes the current state of the cluster.
 
 ## Timeouts
 
@@ -150,6 +159,7 @@ This resource provides the following
 
 - `create` - Default is 60 minutes.
 - `update` - Default is 60 minutes.
+- `read` - Default is 60 minutes.
 
 Adding clusters to existing instances can take a long time. Consider setting a higher value to timeouts if you plan on doing that.
 
@@ -157,6 +167,21 @@ Adding clusters to existing instances can take a long time. Consider setting a h
 
 Bigtable Instances can be imported using any of these accepted formats:
 
+* `projects/{{project}}/instances/{{name}}`
+* `{{project}}/{{name}}`
+* `{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to Bigtable Instances using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project}}/instances/{{name}}"
+  to = google_bigtable_instance.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Bigtable Instances can be imported using one of the formats above. For example:
+
 ```
 $ terraform import google_bigtable_instance.default projects/{{project}}/instances/{{name}}
 $ terraform import google_bigtable_instance.default {{project}}/{{name}}
diff --git a/mmv1/third_party/terraform/website/docs/r/bigtable_instance_iam.html.markdown b/mmv1/third_party/terraform/website/docs/r/bigtable_instance_iam.html.markdown
index cf4259ba3b56..4e7c62c6b2f9 100644
--- a/mmv1/third_party/terraform/website/docs/r/bigtable_instance_iam.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/bigtable_instance_iam.html.markdown
@@ -4,7 +4,7 @@ description: |-
  Collection of resources to manage IAM policy for a Bigtable instance.
 ---
 
-# IAM policy for Bigtable instance
+# IAM policy for Bigtable Instance
 
 Three different resources help you manage IAM policies on bigtable instances. Each of these resources serves a different use case:
 
@@ -95,15 +95,69 @@ exported:
 
 ## Import
 
-Instance IAM resources can be imported using the project, instance name, role and/or member.
+-> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
+ full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
+
+### Importing IAM members
+
+IAM member imports use space-delimited identifiers that contain the resource's `instance`, `role`, and `member`. For example:
 
+* `"projects/{project}/instances/{instance} roles/editor user:jane@example.com"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM members:
+
+```tf
+import {
+  id = "projects/{project}/instances/{instance} roles/editor user:jane@example.com"
+  to = google_bigtable_instance_iam_member.default
+}
 ```
-$ terraform import google_bigtable_instance_iam_policy.editor "projects/{project}/instances/{instance}"
 
-$ terraform import google_bigtable_instance_iam_binding.editor "projects/{project}/instances/{instance} roles/editor"
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
 
-$ terraform import google_bigtable_instance_iam_member.editor "projects/{project}/instances/{instance} roles/editor user:jane@example.com"
+```
+$ terraform import google_bigtable_instance_iam_member.default "projects/{project}/instances/{instance} roles/editor user:jane@example.com"
+```
+
+### Importing IAM bindings
+
+IAM binding imports use space-delimited identifiers that contain the resource's `instance` and `role`. For example:
+
+* `"projects/{project}/instances/{instance} roles/editor"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM bindings:
+
+```tf
+import {
+  id = "projects/{project}/instances/{instance} roles/editor"
+  to = google_bigtable_instance_iam_binding.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+$ terraform import google_bigtable_instance_iam_binding.default "projects/{project}/instances/{instance} roles/editor"
+```
+
+### Importing IAM policies
+
+IAM policy imports use the `instance` identifier of the Bigtable Instance resource only. For example:
+
+* `"projects/{project}/instances/{instance}"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM policies:
+
+```tf
+import {
+  id = "projects/{project}/instances/{instance}"
+  to = google_bigtable_instance_iam_policy.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+$ terraform import google_bigtable_instance_iam_policy.default projects/{project}/instances/{instance}
 ```
 
--> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
- full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
diff --git a/mmv1/third_party/terraform/website/docs/r/bigtable_table.html.markdown b/mmv1/third_party/terraform/website/docs/r/bigtable_table.html.markdown
index ce88083ec89b..b7253bb12eea 100644
--- a/mmv1/third_party/terraform/website/docs/r/bigtable_table.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/bigtable_table.html.markdown
@@ -99,14 +99,29 @@ This resource provides the following
 
 ## Import
 
+-> **Fields affected by import** The following fields can't be read and will show diffs if set in config when imported: `split_keys`
+
 Bigtable Tables can be imported using any of these accepted formats:
 
+* `projects/{{project}}/instances/{{instance_name}}/tables/{{name}}`
+* `{{project}}/{{instance_name}}/{{name}}`
+* `{{instance_name}}/{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Bigtable Tables using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project}}/instances/{{instance_name}}/tables/{{name}}"
+  to = google_bigtable_table.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Bigtable Tables can be imported using one of the formats above. For example:
+
 ```
 $ terraform import google_bigtable_table.default projects/{{project}}/instances/{{instance_name}}/tables/{{name}}
 $ terraform import google_bigtable_table.default {{project}}/{{instance_name}}/{{name}}
 $ terraform import google_bigtable_table.default {{instance_name}}/{{name}}
 ```
 
-The following fields can't be read and will show diffs if set in config when imported:
 
-- `split_keys`
diff --git a/mmv1/third_party/terraform/website/docs/r/bigtable_table_iam.html.markdown b/mmv1/third_party/terraform/website/docs/r/bigtable_table_iam.html.markdown
index b4e7a56ac470..160329c401a4 100644
--- a/mmv1/third_party/terraform/website/docs/r/bigtable_table_iam.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/bigtable_table_iam.html.markdown
@@ -100,15 +100,69 @@ exported:
 
 ## Import
 
-Table IAM resources can be imported using the project, table name, role and/or member.
 
+-> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
+ full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
+
+### Importing IAM members
+
+IAM member imports use space-delimited identifiers that contain the resource's `table`, `role`, and `member`. For example:
+
+* `"projects/{project}/tables/{table} roles/editor user:jane@example.com"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM members:
+
+```tf
+import {
+  id = "projects/{project}/tables/{table} roles/editor user:jane@example.com"
+  to = google_bigtable_table_iam_member.default
+}
 ```
-$ terraform import google_bigtable_table_iam_policy.editor "projects/{project}/tables/{table}"
 
-$ terraform import google_bigtable_table_iam_binding.editor "projects/{project}/tables/{table} roles/editor"
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
 
-$ terraform import google_bigtable_table_iam_member.editor "projects/{project}/tables/{table} roles/editor user:jane@example.com"
+```
+$ terraform import google_bigtable_table_iam_member.default "projects/{project}/tables/{table} roles/editor user:jane@example.com"
 ```
 
--> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
- full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
+### Importing IAM bindings
+
+IAM binding imports use space-delimited identifiers that contain the resource's `table` and `role`. For example:
+
+* `"projects/{project}/tables/{table} roles/editor"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM bindings:
+
+```tf
+import {
+  id = "projects/{project}/tables/{table} roles/editor"
+  to = google_bigtable_table_iam_binding.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+$ terraform import google_bigtable_table_iam_binding.default "projects/{project}/tables/{table} roles/editor"
+```
+
+### Importing IAM policies
+
+IAM policy imports use the `table` identifier of the Bigtable Table resource only. For example:
+
+* `"projects/{project}/tables/{table}"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM policies:
+
+```tf
+import {
+  id = "projects/{project}/tables/{table}"
+  to = google_bigtable_table_iam_policy.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+$ terraform import google_bigtable_table_iam_policy.default projects/{project}/tables/{table}
+```
diff --git a/mmv1/third_party/terraform/website/docs/r/billing_account_iam.html.markdown b/mmv1/third_party/terraform/website/docs/r/billing_account_iam.html.markdown
index 0a56dcfda856..aa7a3e22fd97 100644
--- a/mmv1/third_party/terraform/website/docs/r/billing_account_iam.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/billing_account_iam.html.markdown
@@ -89,15 +89,69 @@ exported:
 
 ## Import
 
-Instance IAM resources can be imported using the project, table name, role and/or member.
 
+-> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
+ full name of the custom role, e.g. `organizations/my-org-id/roles/my-custom-role`.
+
+### Importing IAM members
+
+IAM member imports use space-delimited identifiers that contain the resource's `billing_account_id`, `role`, and `member`. For example:
+
+* `"{{billing_account_id}} roles/billing.user user:jane@example.com"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM members:
+
+```tf
+import {
+  id = "{{billing_account_id}} roles/billing.user user:jane@example.com"
+  to = google_billing_account_iam_member.default
+}
 ```
-$ terraform import google_billing_account_iam_policy.binding "your-billing-account-id"
 
-$ terraform import google_billing_account_iam_binding.binding "your-billing-account-id roles/billing.user"
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
 
-$ terraform import google_billing_account_iam_member.binding "your-billing-account-id roles/billing.user user:jane@example.com"
+```
+$ terraform import google_billing_account_iam_member.default "{{billing_account_id}} roles/billing.user user:jane@example.com"
 ```
 
--> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
- full name of the custom role, e.g. `organizations/my-org-id/roles/my-custom-role`.
+### Importing IAM bindings
+
+IAM binding imports use space-delimited identifiers that contain the resource's `billing_account_id` and `role`. For example:
+
+* `"{{billing_account_id}} roles/billing.user"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM bindings:
+
+```tf
+import {
+  id = "{{billing_account_id}} roles/billing.user"
+  to = google_billing_account_iam_binding.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+$ terraform import google_billing_account_iam_binding.default "{{billing_account_id}} roles/billing.user"
+```
+
+### Importing IAM policies
+
+IAM policy imports use the `billing_account_id` identifier of the Billing Account resource only. For example:
+
+* `{{billing_account_id}}`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM policies:
+
+```tf
+import {
+  id = {{billing_account_id}}
+  to = google_billing_account_iam_policy.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+$ terraform import google_billing_account_iam_policy.default {{billing_account_id}}
+```
diff --git a/mmv1/third_party/terraform/website/docs/r/cloudbuild_worker_pool.html.markdown b/mmv1/third_party/terraform/website/docs/r/cloudbuild_worker_pool.html.markdown
index 160fa35a4df6..ad465bb0f879 100644
--- a/mmv1/third_party/terraform/website/docs/r/cloudbuild_worker_pool.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/cloudbuild_worker_pool.html.markdown
@@ -151,6 +151,21 @@ This resource provides the following
 
 WorkerPool can be imported using any of these accepted formats:
 
+* `projects/{{project}}/locations/{{location}}/workerPools/{{name}}`
+* `{{project}}/{{location}}/{{name}}`
+* `{{location}}/{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WorkerPool using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project}}/locations/{{location}}/workerPools/{{name}}"
+  to = google_cloudbuild_worker_pool.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), WorkerPool can be imported using one of the formats above. For example:
+
 ```
 $ terraform import google_cloudbuild_worker_pool.default projects/{{project}}/locations/{{location}}/workerPools/{{name}}
 $ terraform import google_cloudbuild_worker_pool.default {{project}}/{{location}}/{{name}}
diff --git a/mmv1/third_party/terraform/website/docs/r/cloudfunctions_function.html.markdown b/mmv1/third_party/terraform/website/docs/r/cloudfunctions_function.html.markdown
index 40d8a29bd42b..8a8b26b87091 100644
--- a/mmv1/third_party/terraform/website/docs/r/cloudfunctions_function.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/cloudfunctions_function.html.markdown
@@ -134,6 +134,15 @@ Eg. `"nodejs16"`, `"python39"`, `"dotnet3"`, `"go116"`, `"java11"`, `"ruby30"`,
 
 * `labels` - (Optional) A set of key/value label pairs to assign to the function. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements.
 
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.
+
+* `terraform_labels` -
+  The combination of labels configured directly on the resource and default labels configured on the provider.
+
+* `effective_labels` -
+  All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
+
 * `service_account_email` - (Optional) If provided, the self-provided service account to run the function with.
 
 * `environment_variables` - (Optional) A set of key/value environment variable pairs to assign to the function.
@@ -243,7 +252,21 @@ This resource provides the following
 
 Functions can be imported using the `name` or `{{project}}/{{region}}/name`, e.g.
 
+* `{{project}}/{{region}}/{{name}}`
+* `{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Functions using one of the formats above. For example:
+
+```tf
+import {
+  id = "{{project}}/{{region}}/{{name}}"
+  to = google_cloudfunctions_function.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Functions can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_cloudfunctions_function.default function-test
-$ terraform import google_cloudfunctions_function.default {{project}}/{{region}}/function-test
+$ terraform import google_cloudfunctions_function.default {{project}}/{{region}}/{{name}}
+$ terraform import google_cloudfunctions_function.default {{name}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/composer_environment.html.markdown b/mmv1/third_party/terraform/website/docs/r/composer_environment.html.markdown
index 438b688d9f7c..907ec29f293e 100644
--- a/mmv1/third_party/terraform/website/docs/r/composer_environment.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/composer_environment.html.markdown
@@ -262,6 +262,15 @@ The following arguments are supported:
   No more than 64 labels can be associated with a given environment.
   Both keys and values must be <= 128 bytes in size.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+	Please refer to the field 'effective_labels' for all of the labels present on the resource.
+
+* `terraform_labels` -
+  The combination of labels configured directly on the resource and default labels configured on the provider.
+
+* `effective_labels` -
+  All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
+
 * `region` -
   (Optional)
   The location or Compute Engine region for the environment.
@@ -613,7 +622,7 @@ The `web_server_network_access_control` supports:
 
 * `cidr_block` -
   (Required)
-  `cidr_block< must be specified in CIDR notation.
+  `cidr_block` must be specified in CIDR notation.
 
 ## Argument Reference - Cloud Composer 2
 
@@ -647,6 +656,11 @@ The following arguments are supported:
   (Optional) The ID of the project in which the resource belongs.
   If it is not provided, the provider project is used.
 
+* `storage_config` -
+  (Optional)
+  Configuration options for storage used by Composer environment. Structure is documented below.
+
+
 The `config` block supports:
 
 * `node_config` -
@@ -699,6 +713,13 @@ The `config` block supports:
   Google Compute Engine Public IPs and Google Prod IPs. Structure is
   documented below.
 
+The `storage_config` block supports:
+
+* `bucket` -
+  (Required)
+  Name of an existing Cloud Storage bucket to be used by the environment.
+
+
 The `node_config` block supports:
 
 * `network` -
@@ -939,7 +960,7 @@ The `workloads_config` block supports:
   Configuration for resources used by Airflow schedulers.
 
 * `triggerer` -
-  (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html))
+  (Optional)
   Configuration for resources used by Airflow triggerer.
 
 * `web_server` -
@@ -1054,6 +1075,21 @@ This resource provides the following
 
 Environment can be imported using any of these accepted formats:
 
+* `projects/{{project}}/locations/{{region}}/environments/{{name}}`
+* `{{project}}/{{region}}/{{name}}`
+* `{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Environment using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project}}/locations/{{region}}/environments/{{name}}"
+  to = google_composer_environment.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Environment can be imported using one of the formats above. For example:
+
 ```
 $ terraform import google_composer_environment.default projects/{{project}}/locations/{{region}}/environments/{{name}}
 $ terraform import google_composer_environment.default {{project}}/{{region}}/{{name}}
diff --git a/mmv1/third_party/terraform/website/docs/r/compute_attached_disk.html.markdown b/mmv1/third_party/terraform/website/docs/r/compute_attached_disk.html.markdown
index fa57b98d4b3e..73e1550931dd 100644
--- a/mmv1/third_party/terraform/website/docs/r/compute_attached_disk.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/compute_attached_disk.html.markdown
@@ -119,6 +119,22 @@ This resource provides the following
 
 Attached Disk can be imported the following ways:
 
+* `projects/{{project}}/zones/{{zone}}/instances/{{instance.name}}/{{disk.name}}`
+* `{{project}}/{{zone}}/{{instance.name}}/{{disk.name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Attached Disk using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project}}/zones/{{zone}}/instances/{{instance.name}}/{{disk.name}}"
+  to = google_compute_attached_disk.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Attached Disk can be imported using one of the formats above. For example:
+
+
+
 ```
 $ terraform import google_compute_attached_disk.default projects/{{project}}/zones/{{zone}}/instances/{{instance.name}}/{{disk.name}}
 $ terraform import google_compute_attached_disk.default {{project}}/{{zone}}/{{instance.name}}/{{disk.name}}
diff --git a/mmv1/third_party/terraform/website/docs/r/compute_firewall_policy_association.html.markdown b/mmv1/third_party/terraform/website/docs/r/compute_firewall_policy_association.html.markdown
index 6543ddc9b633..3fb53cf6af5b 100644
--- a/mmv1/third_party/terraform/website/docs/r/compute_firewall_policy_association.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/compute_firewall_policy_association.html.markdown
@@ -84,6 +84,20 @@ This resource provides the following
 
 FirewallPolicyAssociation can be imported using any of these accepted formats:
 
+* `locations/global/firewallPolicies/{{firewall_policy}}/associations/{{name}}`
+* `{{firewall_policy}}/{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FirewallPolicyAssociation using one of the formats above. For example:
+
+```tf
+import {
+  id = "locations/global/firewallPolicies/{{firewall_policy}}/associations/{{name}}"
+  to = google_compute_firewall_policy_association.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), FirewallPolicyAssociation can be imported using one of the formats above. For example:
+
 ```
 $ terraform import google_compute_firewall_policy_association.default locations/global/firewallPolicies/{{firewall_policy}}/associations/{{name}}
 $ terraform import google_compute_firewall_policy_association.default {{firewall_policy}}/{{name}}
diff --git a/mmv1/third_party/terraform/website/docs/r/compute_instance.html.markdown b/mmv1/third_party/terraform/website/docs/r/compute_instance.html.markdown
index aa1c929d2db8..35f71e01f709 100644
--- a/mmv1/third_party/terraform/website/docs/r/compute_instance.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/compute_instance.html.markdown
@@ -15,13 +15,13 @@ and
 
 ```hcl
 resource "google_service_account" "default" {
-  account_id   = "service_account_id"
-  display_name = "Service Account"
+  account_id   = "my-custom-sa"
+  display_name = "Custom SA for VM Instance"
 }
 
 resource "google_compute_instance" "default" {
-  name         = "test"
-  machine_type = "e2-medium"
+  name         = "my-instance"
+  machine_type = "n2-standard-2"
   zone         = "us-central1-a"
 
   tags = ["foo", "bar"]
@@ -37,7 +37,7 @@ resource "google_compute_instance" "default" {
 
   // Local SSD disk
   scratch_disk {
-    interface = "SCSI"
+    interface = "NVME"
   }
 
   network_interface {
@@ -73,9 +73,9 @@ The following arguments are supported:
 
     **Note:** If you want to update this value (resize the VM) after initial creation, you must set [`allow_stopping_for_update`](#allow_stopping_for_update) to `true`.
 
-    [Custom machine types][custom-vm-types] can be formatted as `custom-NUMBER_OF_CPUS-AMOUNT_OF_MEMORY_MB`, e.g. `custom-6-20480` for 6 vCPU and 20GB of RAM.
+    [Custom machine types](https://cloud.google.com/dataproc/docs/concepts/compute/custom-machine-types) can be formatted as `custom-NUMBER_OF_CPUS-AMOUNT_OF_MEMORY_MB`, e.g. `custom-6-20480` for 6 vCPU and 20GB of RAM.
 
-    There is a limit of 6.5 GB per CPU unless you add [extended memory][extended-custom-vm-type]. You must do this explicitly by adding the suffix `-ext`, e.g. `custom-2-15360-ext` for 2 vCPU and 15 GB of memory.
+    There is a limit of 6.5 GB per CPU unless you add [extended memory](https://cloud.google.com/compute/docs/instances/creating-instance-with-custom-machine-type#extendedmemory). You must do this explicitly by adding the suffix `-ext`, e.g. `custom-2-15360-ext` for 2 vCPU and 15 GB of memory.
 
 * `name` - (Required) A unique name for the resource, required by GCE.
     Changing this forces a new resource to be created.
@@ -117,6 +117,14 @@ The following arguments are supported:
     For more details about this behavior, see [this section](https://www.terraform.io/docs/configuration/attr-as-blocks.html#defining-a-fixed-object-collection-value).
 
 * `labels` - (Optional) A map of key/value label pairs to assign to the instance.
+    **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+	Please refer to the field 'effective_labels' for all of the labels present on the resource.
+
+* `terraform_labels` -
+  The combination of labels configured directly on the resource and default labels configured on the provider.
+
+* `effective_labels` -
+  All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
 
 * `metadata` - (Optional) Metadata key/value pairs to make available from
     within the instance. Ssh keys attached in the Cloud Console will be removed.
@@ -236,7 +244,7 @@ is desired, you will need to modify your state file manually using
     For instance, the image `centos-6-v20180104` includes its family name `centos-6`.
     These images can be referred by family name here.
 
-* `labels` - (Optional) A set of key/value label pairs assigned to the disk. This  
+* `labels` - (Optional) A set of key/value label pairs assigned to the disk. This
     field is only applicable for persistent disks.
 
 * `resource_manager_tags` - (Optional) A tag is a key-value pair that can be attached to a Google Cloud resource. You can use tags to conditionally allow or deny policies based on whether a resource has a specific tag. This value is not returned by the API. In Terraform, this value cannot be updated and changing it will recreate the resource.
@@ -285,6 +293,7 @@ is desired, you will need to modify your state file manually using
     network is in auto subnet mode, specifying the subnetwork is optional. If the network is
     in custom subnet mode, specifying the subnetwork is required.
 
+
 *  `subnetwork_project` - (Optional) The project in which the subnetwork belongs.
    If the `subnetwork` is a self_link, this field is ignored in favor of the project
    defined in the subnetwork self_link. If the `subnetwork` is a name and this
@@ -306,6 +315,8 @@ is desired, you will need to modify your state file manually using
 
 * `nic_type` - (Optional) The type of vNIC to be used on this interface. Possible values: GVNIC, VIRTIO_NET.
 
+* `network_attachment` - (Optional) [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html) The URL of the network attachment that this interface should connect to in the following format: `projects/{projectNumber}/regions/{region_name}/networkAttachments/{network_attachment_name}`.
+
 * `stack_type` - (Optional) The stack type for this network interface to identify whether the IPv6 feature is enabled or not. Values are IPV4_IPV6 or IPV4_ONLY. If not specified, IPV4_ONLY will be used.
 
 * `ipv6_access_config` - (Optional) An array of IPv6 access configurations for this interface.
@@ -314,6 +325,7 @@ specified, then this instance will have no external IPv6 Internet access. Struct
 
 * `queue_count` - (Optional) The networking queue count that's specified by users for the network interface. Both Rx and Tx queues will be set to this number. It will be empty if not specified.
 
+* `security_policy` - (Optional) [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html) A full or partial URL to a security policy to add to this instance. If this field is set to an empty string it will remove the associated security policy.
 
 <a name="nested_access_config"></a>The `access_config` block supports:
 
@@ -325,20 +337,20 @@ specified, then this instance will have no external IPv6 Internet access. Struct
     See [the docs](https://cloud.google.com/compute/docs/instances/create-ptr-record) for how
     to become verified as a domain owner.
 
-* `network_tier` - (Optional) The [networking tier][network-tier] used for configuring this instance.
+* `network_tier` - (Optional) The [networking tier](https://cloud.google.com/network-tiers/docs/overview) used for configuring this instance.
     This field can take the following values: PREMIUM, FIXED_STANDARD or STANDARD. If this field is
     not specified, it is assumed to be PREMIUM.
 
 <a name="nested_ipv6_access_config"></a>The `ipv6_access_config` block supports:
 
-* `external_ipv6` - (Optional) The first IPv6 address of the external IPv6 range associated 
-    with this instance, prefix length is stored in externalIpv6PrefixLength in ipv6AccessConfig. 
-    To use a static external IP address, it must be unused and in the same region as the instance's zone. 
+* `external_ipv6` - (Optional) The first IPv6 address of the external IPv6 range associated
+    with this instance, prefix length is stored in externalIpv6PrefixLength in ipv6AccessConfig.
+    To use a static external IP address, it must be unused and in the same region as the instance's zone.
     If not specified, Google Cloud will automatically assign an external IPv6 address from the instance's subnetwork.
 
 * `external_ipv6_prefix_length` - (Optional) The prefix length of the external IPv6 range.
 
-* `name` - (Optional) The name of this access configuration. In ipv6AccessConfigs, the recommended name 
+* `name` - (Optional) The name of this access configuration. In ipv6AccessConfigs, the recommended name
     is "External IPv6".
 
 * `network_tier` - (Optional) The service-level to be provided for IPv6 traffic when the
@@ -390,12 +402,12 @@ specified, then this instance will have no external IPv6 Internet access. Struct
 
 * `min_node_cpus` - (Optional) The minimum number of virtual CPUs this instance will consume when running on a sole-tenant node.
 
-* `provisioning_model` - (Optional) Describe the type of preemptible VM. This field accepts the value `STANDARD` or `SPOT`. If the value is `STANDARD`, there will be no discount. If this   is set to `SPOT`, 
+* `provisioning_model` - (Optional) Describe the type of preemptible VM. This field accepts the value `STANDARD` or `SPOT`. If the value is `STANDARD`, there will be no discount. If this   is set to `SPOT`,
     `preemptible` should be `true` and `automatic_restart` should be
     `false`. For more info about
     `SPOT`, read [here](https://cloud.google.com/compute/docs/instances/spot)
-    
-* `instance_termination_action` - (Optional) Describe the type of termination action for VM. Can be `STOP` or `DELETE`.  Read more on [here](https://cloud.google.com/compute/docs/instances/create-use-spot) 
+
+* `instance_termination_action` - (Optional) Describe the type of termination action for VM. Can be `STOP` or `DELETE`.  Read more on [here](https://cloud.google.com/compute/docs/instances/create-use-spot)
 
 * `max_run_duration` -  (Optional) [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html) The duration of the instance. Instance will run and be terminated after then, the termination action could be defined in `instance_termination_action`. Only support `DELETE` `instance_termination_action` at this point. Structure is [documented below](#nested_max_run_duration).
 <a name="nested_max_run_duration"></a>The `max_run_duration` block supports:
@@ -535,12 +547,23 @@ This resource provides the following
 
 Instances can be imported using any of these accepted formats:
 
+* `projects/{{project}}/zones/{{zone}}/instances/{{name}}`
+* `{{project}}/{{zone}}/{{name}}`
+* `{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import instances using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project}}/zones/{{zone}}/instances/{{name}}"
+  to = google_compute_instance.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), instances can be imported using one of the formats above. For example:
+
 ```
 $ terraform import google_compute_instance.default projects/{{project}}/zones/{{zone}}/instances/{{name}}
 $ terraform import google_compute_instance.default {{project}}/{{zone}}/{{name}}
 $ terraform import google_compute_instance.default {{name}}
 ```
-
-[custom-vm-types]: https://cloud.google.com/dataproc/docs/concepts/compute/custom-machine-types
-[network-tier]: https://cloud.google.com/network-tiers/docs/overview
-[extended-custom-vm-type]: https://cloud.google.com/compute/docs/instances/creating-instance-with-custom-machine-type#extendedmemory
diff --git a/mmv1/third_party/terraform/website/docs/r/compute_instance_group.html.markdown b/mmv1/third_party/terraform/website/docs/r/compute_instance_group.html.markdown
index ceb3b5c1a20b..aa3317fd162d 100644
--- a/mmv1/third_party/terraform/website/docs/r/compute_instance_group.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/compute_instance_group.html.markdown
@@ -174,10 +174,25 @@ This resource provides the following
 
 ## Import
 
-Instance group can be imported using the `zone` and `name` with an optional `project`, e.g.
+Instance groups can be imported using the `zone` and `name` with an optional `project`, e.g.
+
+* `projects/{{project_id}}/zones/{{zone}}/instanceGroups/{{instance_group_id}}`
+* `{{project_id}}/{{zone}}/{{instance_group_id}}`
+* `{{zone}}/{{instance_group_id}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import instance groups using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project_id}}/zones/{{zone}}/instanceGroups/{{instance_group_id}}"
+  to = google_compute_instance_group.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), instance groups can be imported using one of the formats above. For example:
 
 ```
-$ terraform import google_compute_instance_group.webservers us-central1-a/terraform-webservers
-$ terraform import google_compute_instance_group.webservers big-project/us-central1-a/terraform-webservers
-$ terraform import google_compute_instance_group.webservers projects/big-project/zones/us-central1-a/instanceGroups/terraform-webservers
+$ terraform import google_compute_instance_group.default {{zone}}/{{instance_group_id}}
+$ terraform import google_compute_instance_group.default {{project_id}}/{{zone}}/{{instance_group_id}}
+$ terraform import google_compute_instance_group.default projects/{{project_id}}/zones/{{zone}}/instanceGroups/{{instance_group_id}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/compute_instance_group_manager.html.markdown b/mmv1/third_party/terraform/website/docs/r/compute_instance_group_manager.html.markdown
index 2b7d656a644f..f6dead3b4382 100644
--- a/mmv1/third_party/terraform/website/docs/r/compute_instance_group_manager.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/compute_instance_group_manager.html.markdown
@@ -160,9 +160,9 @@ group. You can specify only one value. Structure is [documented below](#nested_a
 
 * `stateful_disk` - (Optional) Disks created on the instances that will be preserved on instance delete, update, etc. Structure is [documented below](#nested_stateful_disk). For more information see the [official documentation](https://cloud.google.com/compute/docs/instance-groups/configuring-stateful-disks-in-migs).
 
-* `stateful_internal_ip` - (Optional, [Beta](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/provider_versions.html)) Internal network IPs assigned to the instances that will be preserved on instance delete, update, etc. This map is keyed with the network interface name. Structure is [documented below](#nested_stateful_internal_ip).
+* `stateful_internal_ip` - (Optional) Internal network IPs assigned to the instances that will be preserved on instance delete, update, etc. This map is keyed with the network interface name. Structure is [documented below](#nested_stateful_internal_ip).
 
-* `stateful_external_ip` - (Optional, [Beta](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/provider_versions.html)) External network IPs assigned to the instances that will be preserved on instance delete, update, etc. This map is keyed with the network interface name. Structure is [documented below](#nested_stateful_external_ip).
+* `stateful_external_ip` - (Optional) External network IPs assigned to the instances that will be preserved on instance delete, update, etc. This map is keyed with the network interface name. Structure is [documented below](#nested_stateful_external_ip).
 
 * `update_policy` - (Optional) The update policy for this managed instance group. Structure is [documented below](#nested_update_policy). For more information, see the [official documentation](https://cloud.google.com/compute/docs/instance-groups/updating-managed-instance-groups) and [API](https://cloud.google.com/compute/docs/reference/rest/v1/instanceGroupManagers/patch)
 
@@ -357,8 +357,25 @@ This resource provides the following
 Instance group managers can be imported using any of these accepted formats:
 
 ```
-$ terraform import google_compute_instance_group_manager.appserver projects/{{project}}/zones/{{zone}}/instanceGroupManagers/{{name}}
-$ terraform import google_compute_instance_group_manager.appserver {{project}}/{{zone}}/{{name}}
-$ terraform import google_compute_instance_group_manager.appserver {{project}}/{{name}}
-$ terraform import google_compute_instance_group_manager.appserver {{name}}
+* `projects/{{project}}/zones/{{zone}}/instanceGroupManagers/{{name}}`
+* `{{project}}/{{zone}}/{{name}}`
+* `{{project}}/{{name}}`
+* `{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import instance group managers using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project}}/zones/{{zone}}/instanceGroupManagers/{{name}}"
+  to = google_compute_instance_group_manager.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), instance group managers can be imported using one of the formats above. For example:
+
+```
+$ terraform import google_compute_instance_group_manager.default projects/{{project}}/zones/{{zone}}/instanceGroupManagers/{{name}}
+$ terraform import google_compute_instance_group_manager.default {{project}}/{{zone}}/{{name}}
+$ terraform import google_compute_instance_group_manager.default {{project}}/{{name}}
+$ terraform import google_compute_instance_group_manager.default {{name}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/compute_instance_template.html.markdown b/mmv1/third_party/terraform/website/docs/r/compute_instance_template.html.markdown
index 34c4bafdaa77..e67b1b98c4fd 100644
--- a/mmv1/third_party/terraform/website/docs/r/compute_instance_template.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/compute_instance_template.html.markdown
@@ -6,6 +6,8 @@ description: |-
 
 # google\_compute\_instance\_template
 
+-> **Note**: Global instance templates can be used in any region. To lower the impact of outages outside your region and gain data residency within your region, use [google_compute_region_instance_template](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_region_instance_template).
+
 Manages a VM instance template resource within GCE. For more information see
 [the official documentation](https://cloud.google.com/compute/docs/instance-templates)
 and
@@ -286,7 +288,7 @@ The following arguments are supported:
 
 * `machine_type` - (Required) The machine type to create.
 
-    To create a machine with a [custom type][custom-vm-types] (such as extended memory), format the value like `custom-VCPUS-MEM_IN_MB` like `custom-6-20480` for 6 vCPU and 20GB of RAM.
+    To create a machine with a [custom type](https://cloud.google.com/dataproc/docs/concepts/compute/custom-machine-types) (such as extended memory), format the value like `custom-VCPUS-MEM_IN_MB` like `custom-6-20480` for 6 vCPU and 20GB of RAM.
 
 - - -
 * `name` - (Optional) The name of the instance template. If you leave
@@ -306,6 +308,15 @@ The following arguments are supported:
 * `labels` - (Optional) A set of key/value label pairs to assign to instances
     created from this template.
 
+    **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+    Please refer to the field 'effective_labels' for all of the labels present on the resource.
+
+* `terraform_labels` -
+  The combination of labels configured directly on the resource and default labels configured on the provider.
+
+* `effective_labels` -
+  All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
+
 * `metadata` - (Optional) Metadata key/value pairs to make available from
     within instances created from this template.
 
@@ -318,8 +329,7 @@ The following arguments are supported:
     this template. This can be specified multiple times for multiple networks.
     Structure is [documented below](#nested_network_interface).
 
-* `network_performance_config` (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)
-    Configures network performance settings for the instance created from the
+* `network_performance_config` (Optional, Configures network performance settings for the instance created from the
     template. Structure is [documented below](#nested_network_performance_config). **Note**: [`machine_type`](#machine_type)
     must be a [supported type](https://cloud.google.com/compute/docs/networking/configure-vm-with-high-bandwidth-configuration),
     the [`image`](#image) used must include the [`GVNIC`](https://cloud.google.com/compute/docs/networking/using-gvnic#create-instance-gvnic-image)
@@ -377,6 +387,11 @@ The following arguments are supported:
 * `disk_name` - (Optional) Name of the disk. When not provided, this defaults
     to the name of the instance.
 
+* `provisioned_iops` - (Optional) Indicates how many IOPS to provision for the disk. This
+    sets the number of I/O operations per second that the disk can handle.
+    Values must be between 10,000 and 120,000. For more details, see the
+    [Extreme persistent disk documentation](https://cloud.google.com/compute/docs/disks/extreme-persistent-disk).
+
 * `source_image` - (Optional) The image from which to
     initialize this disk. This can be one of: the image's `self_link`,
     `projects/{project}/global/images/{image}`,
@@ -470,8 +485,8 @@ The following arguments are supported:
 * `subnetwork` - (Optional) the name of the subnetwork to attach this interface
     to. The subnetwork must exist in the same `region` this instance will be
     created in. Either `network` or `subnetwork` must be provided.
-    
-* `network_interface` - (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)) The URL of the network attachment that this interface should connect to in the following format: projects/{projectNumber}/regions/{region_name}/networkAttachments/{network_attachment_name}.  
+
+* `network_attachment` - (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)) The URL of the network attachment that this interface should connect to in the following format: projects/{projectNumber}/regions/{region_name}/networkAttachments/{network_attachment_name}.
 
 * `subnetwork_project` - (Optional) The ID of the project in which the subnetwork belongs.
     If it is not provided, the provider project is used.
@@ -505,7 +520,7 @@ specified, then this instance will have no external IPv6 Internet access. Struct
 * `nat_ip` - (Optional) The IP address that will be 1:1 mapped to the instance's
     network ip. If not given, one will be generated.
 
-* `network_tier` - (Optional) The [networking tier][network-tier] used for configuring
+* `network_tier` - (Optional) The [networking tier](https://cloud.google.com/network-tiers/docs/overview) used for configuring
     this instance template. This field can take the following values: PREMIUM,
     STANDARD or FIXED_STANDARD. If this field is not specified, it is assumed to be PREMIUM.
 
@@ -560,13 +575,13 @@ specified, then this instance will have no external IPv6 Internet access. Struct
    groups will use as host systems. Read more on sole-tenant node creation
    [here](https://cloud.google.com/compute/docs/nodes/create-nodes).
    Structure [documented below](#nested_node_affinities).
-   
-* `provisioning_model` - (Optional) Describe the type of preemptible VM. This field accepts the value `STANDARD` or `SPOT`. If the value is `STANDARD`, there will be no discount. If this   is set to `SPOT`, 
+
+* `provisioning_model` - (Optional) Describe the type of preemptible VM. This field accepts the value `STANDARD` or `SPOT`. If the value is `STANDARD`, there will be no discount. If this   is set to `SPOT`,
     `preemptible` should be `true` and `automatic_restart` should be
     `false`. For more info about
     `SPOT`, read [here](https://cloud.google.com/compute/docs/instances/spot)
-    
-* `instance_termination_action` - (Optional) Describe the type of termination action for `SPOT` VM. Can be `STOP` or `DELETE`.  Read more on [here](https://cloud.google.com/compute/docs/instances/create-use-spot) 
+
+* `instance_termination_action` - (Optional) Describe the type of termination action for `SPOT` VM. Can be `STOP` or `DELETE`.  Read more on [here](https://cloud.google.com/compute/docs/instances/create-use-spot)
 
 * `max_run_duration` -  (Optional) [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html) The duration of the instance. Instance will run and be terminated after then, the termination action could be defined in `instance_termination_action`. Only support `DELETE` `instance_termination_action` at this point. Structure is [documented below](#nested_max_run_duration).
 <a name="nested_max_run_duration"></a>The `max_run_duration` block supports:
@@ -580,7 +595,7 @@ specified, then this instance will have no external IPv6 Internet access. Struct
    315,576,000,000 inclusive. Note: these bounds are computed from: 60
    sec/min * 60 min/hr * 24 hr/day * 365.25 days/year * 10000 years.
 
-* `maintenance_interval` - (Optional) [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html) Specifies the frequency of planned maintenance events. The accepted values are: `PERIODIC`. 
+* `maintenance_interval` - (Optional) [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html) Specifies the frequency of planned maintenance events. The accepted values are: `PERIODIC`.
 <a name="nested_guest_accelerator"></a>The `guest_accelerator` block supports:
 
 * `local_ssd_recovery_timeout` -  (Optional) (https://terraform.io/docs/providers/google/guides/provider_versions.html) Specifies the maximum amount of time a Local Ssd Vm should wait while recovery of the Local Ssd state is attempted. Its value should be in between 0 and 168 hours with hour granularity and the default value being 1 hour. Structure is [documented below](#nested_local_ssd_recovery_timeout).
@@ -676,11 +691,23 @@ This resource provides the following
 
 Instance templates can be imported using any of these accepted formats:
 
+* `projects/{{project}}/global/instanceTemplates/{{name}}`
+* `{{project}}/{{name}}`
+* `{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import instance templates using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project}}/global/instanceTemplates/{{name}}"
+  to = google_compute_instance_template.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), instance templates can be imported using one of the formats above. For example:
+
 ```
 $ terraform import google_compute_instance_template.default projects/{{project}}/global/instanceTemplates/{{name}}
 $ terraform import google_compute_instance_template.default {{project}}/{{name}}
 $ terraform import google_compute_instance_template.default {{name}}
 ```
-
-[custom-vm-types]: https://cloud.google.com/dataproc/docs/concepts/compute/custom-machine-types
-[network-tier]: https://cloud.google.com/network-tiers/docs/overview
diff --git a/mmv1/third_party/terraform/website/docs/r/compute_network_peering.html.markdown b/mmv1/third_party/terraform/website/docs/r/compute_network_peering.html.markdown
index 96220f65a2c2..b199bcaa67b4 100644
--- a/mmv1/third_party/terraform/website/docs/r/compute_network_peering.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/compute_network_peering.html.markdown
@@ -92,6 +92,19 @@ This resource provides the following
 
 VPC network peerings can be imported using the name and project of the primary network the peering exists in and the name of the network peering
 
+* `{{project_id}}/{{network_id}}/{{peering_id}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC network peerings using one of the formats above. For example:
+
+```tf
+import {
+  id = "{{project_id}}/{{network_id}}/{{peering_id}}"
+  to = google_compute_network_peering.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), VPC network peerings can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_compute_network_peering.peering_network project-name/network-name/peering-name
+$ terraform import google_compute_network_peering.default {{project_id}}/{{network_id}}/{{peering_id}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/compute_project_default_network_tier.html.markdown b/mmv1/third_party/terraform/website/docs/r/compute_project_default_network_tier.html.markdown
index eaff2e8b3ede..55d247ba7fba 100644
--- a/mmv1/third_party/terraform/website/docs/r/compute_project_default_network_tier.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/compute_project_default_network_tier.html.markdown
@@ -48,6 +48,21 @@ This resource provides the following
 
 ## Import
 
-This resource can be imported using the project ID:
+Compute Engine Default Network Tier can be imported using any of these accepted formats:
 
-`terraform import google_compute_project_default_network_tier.default project-id`
+* `{{project_id}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Compute Engine Default Network Tier using one of the formats above. For example:
+
+```tf
+import {
+  id = "{{project_id}}"
+  to = google_compute_project_default_network_tier.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Compute Engine Default Network Tier can be imported using one of the formats above. For example:
+
+```
+$ terraform import google_compute_project_default_network_tier.default {{project_id}}
+```
diff --git a/mmv1/third_party/terraform/website/docs/r/compute_project_metadata.html.markdown b/mmv1/third_party/terraform/website/docs/r/compute_project_metadata.html.markdown
index c3383f77170d..7a01995cfd9e 100644
--- a/mmv1/third_party/terraform/website/docs/r/compute_project_metadata.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/compute_project_metadata.html.markdown
@@ -73,6 +73,21 @@ This resource provides the following
 
 ## Import
 
-This resource can be imported using the project ID:
+Project metadata can be imported using the project ID:
 
-`terraform import google_compute_project_metadata.foo my-project-id`
+* `{{project_id}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import project metadata using one of the formats above. For example:
+
+```tf
+import {
+  id = "{{project_id}}"
+  to = google_compute_project_metadata.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), project metadata can be imported using one of the formats above. For example:
+
+```
+$ terraform import google_compute_project_metadata.default {{project_id}}
+```
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/website/docs/r/compute_project_metadata_item.html.markdown b/mmv1/third_party/terraform/website/docs/r/compute_project_metadata_item.html.markdown
index 6db989502deb..221b8025a4e2 100644
--- a/mmv1/third_party/terraform/website/docs/r/compute_project_metadata_item.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/compute_project_metadata_item.html.markdown
@@ -43,8 +43,21 @@ In addition to the arguments listed above, the following computed attributes are
 
 Project metadata items can be imported using the `key`, e.g.
 
+* `{{key}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import project metadata items using one of the formats above. For example:
+
+```tf
+import {
+  id = "{{key}}"
+  to = google_compute_project_metadata_item.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), project metadata items can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_compute_project_metadata_item.default my_metadata
+$ terraform import google_compute_project_metadata_item.default {{key}}
 ```
 
 ## Timeouts
diff --git a/mmv1/third_party/terraform/website/docs/r/compute_region_instance_group_manager.html.markdown b/mmv1/third_party/terraform/website/docs/r/compute_region_instance_group_manager.html.markdown
index 383c1c3f4a52..0a16ac30b14f 100644
--- a/mmv1/third_party/terraform/website/docs/r/compute_region_instance_group_manager.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/compute_region_instance_group_manager.html.markdown
@@ -169,9 +169,9 @@ group. You can specify one or more values. For more information, see the [offici
 
 * `stateful_disk` - (Optional) Disks created on the instances that will be preserved on instance delete, update, etc. Structure is [documented below](#nested_stateful_disk). For more information see the [official documentation](https://cloud.google.com/compute/docs/instance-groups/configuring-stateful-disks-in-migs). Proactive cross zone instance redistribution must be disabled before you can update stateful disks on existing instance group managers. This can be controlled via the `update_policy`.
 
-* `stateful_internal_ip` - (Optional, [Beta](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/provider_versions.html)) Internal network IPs assigned to the instances that will be preserved on instance delete, update, etc. This map is keyed with the network interface name. Structure is [documented below](#nested_stateful_internal_ip).
+* `stateful_internal_ip` - (Optional) Internal network IPs assigned to the instances that will be preserved on instance delete, update, etc. This map is keyed with the network interface name. Structure is [documented below](#nested_stateful_internal_ip).
 
-* `stateful_external_ip` - (Optional, [Beta](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/provider_versions.html)) External network IPs assigned to the instances that will be preserved on instance delete, update, etc. This map is keyed with the network interface name. Structure is [documented below](#nested_stateful_external_ip).
+* `stateful_external_ip` - (Optional) External network IPs assigned to the instances that will be preserved on instance delete, update, etc. This map is keyed with the network interface name. Structure is [documented below](#nested_stateful_external_ip).
 
 - - -
 
@@ -319,7 +319,7 @@ one of which has a `target_size.percent` of `60` will create 2 instances of that
 In addition to the arguments listed above, the following computed attributes are
 exported:
 
-* `id` - an identifier for the resource with format `{{disk.name}}`
+* `id` - an identifier for the resource with format `projects/{{project}}/regions/{{region}}/instanceGroupManagers/{{name}}`
 
 * `fingerprint` - The fingerprint of the instance group manager.
 
@@ -361,8 +361,21 @@ This resource provides the following
 
 ## Import
 
-Instance group managers can be imported using the `name`, e.g.
+Instance group managers can be imported using any of these accepted formats:
+
+* `{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import instance group managers using one of the formats above. For example:
+
+```tf
+import {
+  id = "{{name}}"
+  to = google_compute_region_instance_group_manager.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), instance group managers can be imported using one of the formats above. For example:
 
 ```
-$ terraform import google_compute_region_instance_group_manager.appserver appserver-igm
+$ terraform import google_compute_region_instance_group_manager.default {{name}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/compute_region_instance_template.html.markdown b/mmv1/third_party/terraform/website/docs/r/compute_region_instance_template.html.markdown
index 4e1c3a29838f..d0a097aef4bf 100644
--- a/mmv1/third_party/terraform/website/docs/r/compute_region_instance_template.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/compute_region_instance_template.html.markdown
@@ -300,7 +300,7 @@ The following arguments are supported:
 
 * `machine_type` - (Required) The machine type to create.
 
-    To create a machine with a [custom type][custom-vm-types] (such as extended memory), format the value like `custom-VCPUS-MEM_IN_MB` like `custom-6-20480` for 6 vCPU and 20GB of RAM.
+    To create a machine with a [custom type](https://cloud.google.com/dataproc/docs/concepts/compute/custom-machine-types) (such as extended memory), format the value like `custom-VCPUS-MEM_IN_MB` like `custom-6-20480` for 6 vCPU and 20GB of RAM.
 
 - - -
 * `name` - (Optional) The name of the instance template. If you leave
@@ -320,6 +320,15 @@ The following arguments are supported:
 * `labels` - (Optional) A set of key/value label pairs to assign to instances
     created from this template.
 
+    **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+    Please refer to the field 'effective_labels' for all of the labels present on the resource.
+
+* `terraform_labels` -
+  The combination of labels configured directly on the resource and default labels configured on the provider.
+
+* `effective_labels` -
+  All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
+
 * `metadata` - (Optional) Metadata key/value pairs to make available from
     within instances created from this template.
 
@@ -387,6 +396,11 @@ The following arguments are supported:
 * `disk_name` - (Optional) Name of the disk. When not provided, this defaults
     to the name of the instance.
 
+* `provisioned_iops` - (Optional) Indicates how many IOPS to provision for the disk. This
+    sets the number of I/O operations per second that the disk can handle.
+    Values must be between 10,000 and 120,000. For more details, see the
+    [Extreme persistent disk documentation](https://cloud.google.com/compute/docs/disks/extreme-persistent-disk).
+
 * `source_image` - (Optional) The image from which to
     initialize this disk. This can be one of: the image's `self_link`,
     `projects/{project}/global/images/{image}`,
@@ -513,7 +527,7 @@ specified, then this instance will have no external IPv6 Internet access. Struct
 * `nat_ip` - (Optional) The IP address that will be 1:1 mapped to the instance's
     network ip. If not given, one will be generated.
 
-* `network_tier` - (Optional) The [networking tier][network-tier] used for configuring
+* `network_tier` - (Optional) The [networking tier](https://cloud.google.com/network-tiers/docs/overview) used for configuring
     this instance template. This field can take the following values: PREMIUM,
     STANDARD or FIXED_STANDARD. If this field is not specified, it is assumed to be PREMIUM.
 
@@ -682,11 +696,23 @@ This resource provides the following
 
 Instance templates can be imported using any of these accepted formats:
 
+* `projects/{{project}}/regions/{{region}}/instanceTemplates/{{name}}`
+* `{{project}}/{{name}}`
+* `{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import instance templates using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project}}/regions/{{region}}/instanceTemplates/{{name}}"
+  to = google_compute_region_instance_template.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), instance templates can be imported using one of the formats above. For example:
+
 ```
 $ terraform import google_compute_region_instance_template.default projects/{{project}}/regions/{{region}}/instanceTemplates/{{name}}
 $ terraform import google_compute_region_instance_template.default {{project}}/{{name}}
 $ terraform import google_compute_region_instance_template.default {{name}}
-```
-
-[custom-vm-types]: https://cloud.google.com/dataproc/docs/concepts/compute/custom-machine-types
-[network-tier]: https://cloud.google.com/network-tiers/docs/overview
+```
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/website/docs/r/compute_router_interface.html.markdown b/mmv1/third_party/terraform/website/docs/r/compute_router_interface.html.markdown
index 14464543b5f1..736f9a10fca6 100644
--- a/mmv1/third_party/terraform/website/docs/r/compute_router_interface.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/compute_router_interface.html.markdown
@@ -84,7 +84,21 @@ This resource provides the following
 
 Router interfaces can be imported using the `project` (optional), `region`, `router`, and `name`, e.g.
 
+* `{{project_id}}/{{region}}/{{router}}/{{name}}`
+* `{{region}}/{{router}}/{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import router interfaces using one of the formats above. For example:
+
+```tf
+import {
+  id = "{{project_id}}/{{region}}/{{router}}/{{name}}"
+  to = google_compute_router_interface.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), router interfaces can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_compute_router_interface.foobar my-project/us-central1/router-1/interface-1
-$ terraform import google_compute_router_interface.foobar us-central1/router-1/interface-1
+$ terraform import google_compute_router_interface.default {{project_id}}/{{region}}/{{router}}/{{name}}
+$ terraform import google_compute_router_interface.default {{region}}/{{router}}/{{name}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/compute_security_policy.html.markdown b/mmv1/third_party/terraform/website/docs/r/compute_security_policy.html.markdown
index c6015c30522f..98af03c92186 100644
--- a/mmv1/third_party/terraform/website/docs/r/compute_security_policy.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/compute_security_policy.html.markdown
@@ -183,26 +183,26 @@ The following arguments are supported:
 * `recaptcha_options_config` - (Optional) [reCAPTCHA Configuration Options](https://cloud.google.com/armor/docs/configure-security-policies?hl=en#use_a_manual_challenge_to_distinguish_between_human_or_automated_clients). Structure is [documented below](#nested_recaptcha_options_config).
 
 * `type` - The type indicates the intended use of the security policy. This field can be set only at resource creation time.
-  * CLOUD_ARMOR - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services.
+  * `CLOUD_ARMOR` - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services.
     They filter requests before they hit the origin servers.
-  * CLOUD_ARMOR_EDGE - Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services
+  * `CLOUD_ARMOR_EDGE` - Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services
     (including Cloud CDN-enabled) as well as backend buckets (Cloud Storage).
     They filter requests before the request is served from Google's cache.
-  * CLOUD_ARMOR_INTERNAL_SERVICE - Cloud Armor internal service policies can be configured to filter HTTP requests targeting services 
+  * `CLOUD_ARMOR_INTERNAL_SERVICE` - Cloud Armor internal service policies can be configured to filter HTTP requests targeting services
     managed by Traffic Director in a service mesh. They filter requests before the request is served from the application.
 
 <a name="nested_advanced_options_config"></a>The `advanced_options_config` block supports:
 
 * `json_parsing` - Whether or not to JSON parse the payload body. Defaults to `DISABLED`.
-  * DISABLED - Don't parse JSON payloads in POST bodies.
-  * STANDARD - Parse JSON payloads in POST bodies.
+  * `DISABLED` - Don't parse JSON payloads in POST bodies.
+  * `STANDARD` - Parse JSON payloads in POST bodies.
 
 * `json_custom_config` - Custom configuration to apply the JSON parsing. Only applicable when
     `json_parsing` is set to `STANDARD`. Structure is [documented below](#nested_json_custom_config).
 
 * `log_level` - Log level to use. Defaults to `NORMAL`.
-  * NORMAL - Normal log level.
-  * VERBOSE - Verbose log level.
+  * `NORMAL` - Normal log level.
+  * `VERBOSE` - Verbose log level.
 
 * `user_ip_request_headers` - (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)) An optional list of case-insensitive request header names to use for resolving the callers client IP address.
 
@@ -216,11 +216,11 @@ The following arguments are supported:
 <a name="nested_rule"></a>The `rule` block supports:
 
 * `action` - (Required) Action to take when `match` matches the request. Valid values:
-    * allow: allow access to target.
-    * deny(): deny access to target, returns the HTTP response code specified (valid values are 403, 404, and 502).
-    * rate_based_ban: limit client traffic to the configured threshold and ban the client if the traffic exceeds the threshold. Configure parameters for this action in RateLimitOptions. Requires rateLimitOptions to be set.
-    * redirect: redirect to a different target. This can either be an internal reCAPTCHA redirect, or an external URL-based redirect via a 302 response. Parameters for this action can be configured via redirectOptions.
-    * throttle: limit client traffic to the configured threshold. Configure parameters for this action in rateLimitOptions. Requires rateLimitOptions to be set for this.
+    * `allow`: allow access to target.
+    * `deny()`: deny access to target, returns the HTTP response code specified (valid values are 403, 404, and 502).
+    * `rate_based_ban`: limit client traffic to the configured threshold and ban the client if the traffic exceeds the threshold. Configure parameters for this action in [`rate_limit_options`](#nested_rate_limit_options). Requires [`rate_limit_options`](#nested_rate_limit_options) to be set.
+    * `redirect`: redirect to a different target. This can either be an internal reCAPTCHA redirect, or an external URL-based redirect via a 302 response. Parameters for this action can be configured via [`redirect_options`](#nested_redirect_options).
+    * `throttle`: limit client traffic to the configured threshold. Configure parameters for this action in [`rate_limit_options`](#nested_rate_limit_options). Requires [`rate_limit_options`](#nested_rate_limit_options) to be set for this.
 
 * `priority` - (Required) An unique positive integer indicating the priority of evaluation for a rule.
     Rules are evaluated from highest priority (lowest numerically) to lowest priority (highest numerically) in order.
@@ -228,7 +228,7 @@ The following arguments are supported:
 * `match` - (Required) A match condition that incoming traffic is evaluated against.
     If it evaluates to true, the corresponding `action` is enforced. Structure is [documented below](#nested_match).
 
-* `preconfigured_waf_config` - (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)) Preconfigured WAF configuration to be applied for the rule. If the rule does not evaluate preconfigured WAF rules, i.e., if evaluatePreconfiguredWaf() is not used, this field will have no effect. Structure is [documented below](#nested_preconfigured_waf_config).
+* `preconfigured_waf_config` - (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)) Preconfigured WAF configuration to be applied for the rule. If the rule does not evaluate preconfigured WAF rules, i.e., if `evaluatePreconfiguredWaf()` is not used, this field will have no effect. Structure is [documented below](#nested_preconfigured_waf_config).
 
 * `description` - (Optional) An optional description of this rule. Max size is 64.
 
@@ -236,10 +236,10 @@ The following arguments are supported:
     Stackdriver logs for requests that trigger a preview action are annotated as such.
 
 * `rate_limit_options` - (Optional)
-    Must be specified if the `action` is "rate_based_ban" or "throttle". Cannot be specified for other actions. Structure is [documented below](#nested_rate_limit_options).
+    Must be specified if the `action` is `rate_based_ban` or `throttle`. Cannot be specified for other actions. Structure is [documented below](#nested_rate_limit_options).
 
 * `redirect_options` - (Optional)
-    Can be specified if the `action` is "redirect". Cannot be specified for other actions. Structure is [documented below](#nested_redirect_options).
+    Can be specified if the `action` is `redirect`. Cannot be specified for other actions. Structure is [documented below](#nested_redirect_options).
 
 * `header_action` - (Optional)
     Additional actions that are performed on headers. Structure is [documented below](#nested_header_action).
@@ -252,16 +252,17 @@ The following arguments are supported:
 
 * `versioned_expr` - (Optional) Predefined rule expression. If this field is specified, `config` must also be specified.
     Available options:
-    * SRC_IPS_V1: Must specify the corresponding `src_ip_ranges` field in `config`.
+
+    * `SRC_IPS_V1`: Must specify the corresponding `src_ip_ranges` field in `config`.
 
 * `expr` - (Optional) User defined CEVAL expression. A CEVAL expression is used to specify match criteria
-    such as origin.ip, source.region_code and contents in the request header.
+    such as `origin.ip`, `source.region_code` and `contents` in the request header.
     Structure is [documented below](#nested_expr).
 
 <a name="nested_config"></a>The `config` block supports:
 
 * `src_ip_ranges` - (Required) Set of IP addresses or ranges (IPV4 or IPV6) in CIDR notation
-    to match against inbound traffic. There is a limit of 10 IP ranges per rule. A value of '\*' matches all IPs
+    to match against inbound traffic. There is a limit of 10 IP ranges per rule. A value of `*` matches all IPs
     (can be used to override the default behavior).
 
 <a name="nested_expr"></a>The `expr` block supports:
@@ -291,62 +292,68 @@ The following arguments are supported:
 
 * `operator` - (Required) You can specify an exact match or a partial match by using a field operator and a field value.
 
-  * EQUALS: The operator matches if the field value equals the specified value.
-  * STARTS_WITH: The operator matches if the field value starts with the specified value.
-  * ENDS_WITH: The operator matches if the field value ends with the specified value.
-  * CONTAINS: The operator matches if the field value contains the specified value.
-  * EQUALS_ANY: The operator matches if the field value is any value.
+  * `EQUALS`: The operator matches if the field value equals the specified value.
+  * `STARTS_WITH`: The operator matches if the field value starts with the specified value.
+  * `ENDS_WITH`: The operator matches if the field value ends with the specified value.
+  * `CONTAINS`: The operator matches if the field value contains the specified value.
+  * `EQUALS_ANY`: The operator matches if the field value is any value.
 
 * `value` - (Optional) A request field matching the specified value will be excluded from inspection during preconfigured WAF evaluation.
-    The field value must be given if the field `operator` is not "EQUALS_ANY", and cannot be given if the field `operator` is "EQUALS_ANY".
+    The field value must be given if the field `operator` is not `EQUALS_ANY`, and cannot be given if the field `operator` is `EQUALS_ANY`.
 
 <a name="nested_rate_limit_options"></a>The `rate_limit_options` block supports:
 
-* `conform_action` - (Required) Action to take for requests that are under the configured rate limit threshold. Valid option is "allow" only.
+* `conform_action` - (Required) Action to take for requests that are under the configured rate limit threshold. Valid option is `allow` only.
 
 * `exceed_action` - (Required) When a request is denied, returns the HTTP response code specified.
-    Valid options are "deny()" where valid values for status are 403, 404, 429, and 502.
+    Valid options are `deny()` where valid values for status are 403, 404, 429, and 502.
 
 * `rate_limit_threshold` - (Required) Threshold at which to begin ratelimiting. Structure is [documented below](#nested_threshold).
 
-* `ban_duration_sec` - (Optional) Can only be specified if the `action` for the rule is "rate_based_ban".
+* `ban_duration_sec` - (Optional) Can only be specified if the `action` for the rule is `rate_based_ban`.
     If specified, determines the time (in seconds) the traffic will continue to be banned by the rate limit after the rate falls below the threshold.
 
-* `ban_threshold` - (Optional) Can only be specified if the `action` for the rule is "rate_based_ban".
-    If specified, the key will be banned for the configured 'ban_duration_sec' when the number of requests that exceed the 'rate_limit_threshold' also
-    exceed this 'ban_threshold'. Structure is [documented below](#nested_threshold).
+* `ban_threshold` - (Optional) Can only be specified if the `action` for the rule is `rate_based_ban`.
+    If specified, the key will be banned for the configured `ban_duration_sec` when the number of requests that exceed the `rate_limit_threshold` also
+    exceed this `ban_threshold`. Structure is [documented below](#nested_threshold).
+
+* `enforce_on_key` - (Optional) Determines the key to enforce the rate_limit_threshold on. If not specified, defaults to `ALL`.
 
-* `enforce_on_key` - (Optional) Determines the key to enforce the rate_limit_threshold on. If not specified, defaults to "ALL".
+  * `ALL`: A single rate limit threshold is applied to all the requests matching this rule.
+  * `IP`: The source IP address of the request is the key. Each IP has this limit enforced separately.
+  * `HTTP_HEADER`: The value of the HTTP header whose name is configured under `enforce_on_key_name`. The key value is truncated to the first 128 bytes of the header value. If no such header is present in the request, the key type defaults to `ALL`.
+  * `XFF_IP`: The first IP address (i.e. the originating client IP address) specified in the list of IPs under `X-Forwarded-For` HTTP header. If no such header is present or the value is not a valid IP, the key type defaults to `ALL`.
+  * `HTTP_COOKIE`: The value of the HTTP cookie whose name is configured under `enforce_on_key_name`. The key value is truncated to the first 128 bytes of the cookie value. If no such cookie is present in the request, the key type defaults to `ALL`.
+  * `HTTP_PATH`: The URL path of the HTTP request. The key value is truncated to the first 128 bytes
+  * `SNI`: Server name indication in the TLS session of the HTTPS request. The key value is truncated to the first 128 bytes. The key type defaults to `ALL` on a HTTP session.
+  * `REGION_CODE`: The country/region from which the request originates.
 
-    * ALL: A single rate limit threshold is applied to all the requests matching this rule.
-    * IP: The source IP address of the request is the key. Each IP has this limit enforced separately.
-    * HTTP_HEADER: The value of the HTTP header whose name is configured under "enforceOnKeyName". The key value is truncated to the first 128 bytes of the header value. If no such header is present in the request, the key type defaults to ALL.
-    * XFF_IP: The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP header. If no such header is present or the value is not a valid IP, the key type defaults to ALL.
-    * HTTP_COOKIE: The value of the HTTP cookie whose name is configured under "enforceOnKeyName". The key value is truncated to the first 128 bytes of the cookie value. If no such cookie is present in the request, the key type defaults to ALL.
-    * HTTP_PATH: The URL path of the HTTP request. The key value is truncated to the first 128 bytes
-    * SNI: Server name indication in the TLS session of the HTTPS request. The key value is truncated to the first 128 bytes. The key type defaults to ALL on a HTTP session.
-    * REGION_CODE: The country/region from which the request originates.
+* `enforce_on_key_name` - (Optional) Rate limit key name applicable only for the following key types:
 
-* `enforce_on_key_name` - (Optional) Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP header whose value is taken as the key value. HTTP_COOKIE -- Name of the HTTP cookie whose value is taken as the key value.
+  * `HTTP_HEADER` -- Name of the HTTP header whose value is taken as the key value.
+  * `HTTP_COOKIE` -- Name of the HTTP cookie whose value is taken as the key value.
 
-* `enforce_on_key_configs` - (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)) If specified, any combination of values of enforce_on_key_type/enforce_on_key_name is treated as the key on which ratelimit threshold/action is enforced. You can specify up to 3 enforce_on_key_configs. If `enforce_on_key_configs` is specified, enforce_on_key must be set to an empty string. Structure is [documented below](#nested_enforce_on_key_configs).
+* `enforce_on_key_configs` - (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)) If specified, any combination of values of enforce_on_key_type/enforce_on_key_name is treated as the key on which rate limit threshold/action is enforced. You can specify up to 3 enforce_on_key_configs. If `enforce_on_key_configs` is specified, `enforce_on_key` must be set to an empty string. Structure is [documented below](#nested_enforce_on_key_configs).
 
   **Note:** To avoid the conflict between `enforce_on_key` and `enforce_on_key_configs`, the field [`enforce_on_key`](#enforce_on_key) needs to be set to an empty string.
 
 <a name="nested_enforce_on_key_configs"></a>The `enforce_on_key_configs` block supports:
 
-* `enforce_on_key_name` - (Optional) Rate limit key name applicable only for the following key types: HTTP_HEADER: Name of the HTTP header whose value is taken as the key value. HTTP_COOKIE: Name of the HTTP cookie whose value is taken as the key value.
+* `enforce_on_key_name` - (Optional) Rate limit key name applicable only for the following key types:
+
+  * `HTTP_HEADER` -- Name of the HTTP header whose value is taken as the key value.
+  * `HTTP_COOKIE` -- Name of the HTTP cookie whose value is taken as the key value.
 
-* `enforce_on_key_type` - (Optional) Determines the key to enforce the rate_limit_threshold on. If not specified, defaults to "ALL".
+* `enforce_on_key_type` - (Optional) Determines the key to enforce the `rate_limit_threshold` on. If not specified, defaults to `ALL`.
 
-    * ALL: A single rate limit threshold is applied to all the requests matching this rule.
-    * IP: The source IP address of the request is the key. Each IP has this limit enforced separately.
-    * HTTP_HEADER: The value of the HTTP header whose name is configured under "enforceOnKeyName". The key value is truncated to the first 128 bytes of the header value. If no such header is present in the request, the key type defaults to ALL.
-    * XFF_IP: The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP header. If no such header is present or the value is not a valid IP, the key type defaults to ALL.
-    * HTTP_COOKIE: The value of the HTTP cookie whose name is configured under "enforceOnKeyName". The key value is truncated to the first 128 bytes of the cookie value. If no such cookie is present in the request, the key type defaults to ALL.
-    * HTTP_PATH: The URL path of the HTTP request. The key value is truncated to the first 128 bytes
-    * SNI: Server name indication in the TLS session of the HTTPS request. The key value is truncated to the first 128 bytes. The key type defaults to ALL on a HTTP session.
-    * REGION_CODE: The country/region from which the request originates.
+    * `ALL`: A single rate limit threshold is applied to all the requests matching this rule.
+    * `IP`: The source IP address of the request is the key. Each IP has this limit enforced separately.
+    * `HTTP_HEADER`: The value of the HTTP header whose name is configured on `enforce_on_key_name`. The key value is truncated to the first 128 bytes of the header value. If no such header is present in the request, the key type defaults to `ALL`.
+    * `XFF_IP`: The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP header. If no such header is present or the value is not a valid IP, the key type defaults to `ALL`.
+    * `HTTP_COOKIE`: The value of the HTTP cookie whose name is configured under `enforce_on_key_name`. The key value is truncated to the first 128 bytes of the cookie value. If no such cookie is present in the request, the key type defaults to `ALL`.
+    * `HTTP_PATH`: The URL path of the HTTP request. The key value is truncated to the first 128 bytes
+    * `SNI`: Server name indication in the TLS session of the HTTPS request. The key value is truncated to the first 128 bytes. The key type defaults to `ALL` on a HTTP session.
+    * `REGION_CODE`: The country/region from which the request originates.
 
 * `exceed_redirect_options` - (Optional) Parameters defining the redirect action that is used as the exceed action. Cannot be specified if the exceed action is not redirect. Structure is [documented below](#nested_exceed_redirect_options).
 
@@ -360,16 +367,16 @@ The following arguments are supported:
 
 * `type` - (Required) Type of the redirect action.
 
-* `target` - (Optional) Target for the redirect action. This is required if the type is EXTERNAL_302 and cannot be specified for GOOGLE_RECAPTCHA.
+* `target` - (Optional) Target for the redirect action. This is required if the type is `EXTERNAL_302` and cannot be specified for `GOOGLE_RECAPTCHA`.
 
 <a name="nested_redirect_options"></a>The `redirect_options` block supports:
 
 * `type` - (Required) Type of redirect action.
 
-    * EXTERNAL_302: Redirect to an external address, configured in 'target'.
-    * GOOGLE_RECAPTCHA: Redirect to Google reCAPTCHA.
+  * `EXTERNAL_302`: Redirect to an external address, configured in `target`.
+  * `GOOGLE_RECAPTCHA`: Redirect to Google reCAPTCHA.
 
-* `target` - (Optional) External redirection target when "EXTERNAL_302" is set in 'type'.
+* `target` - (Optional) External redirection target when `EXTERNAL_302` is set in `type`.
 
 <a name="nested_header_action"></a> The `header_action` block supports:
 
@@ -391,7 +398,10 @@ The following arguments are supported:
 
 * `enable` - (Optional) If set to true, enables CAAP for L7 DDoS detection.
 
-* `rule_visibility` - (Optional) Rule visibility can be one of the following: STANDARD - opaque rules. (default) PREMIUM - transparent rules.
+* `rule_visibility` - (Optional) Rule visibility can be one of the following:
+
+  * `STANDARD` - opaque rules. (default)
+  * `PREMIUM` - transparent rules.
 
 <a name="nested_auto_deploy_config"></a>The `auto_deploy_config` block supports:
 
@@ -405,7 +415,7 @@ The following arguments are supported:
 
 <a name="nested_recaptcha_options_config"></a>The `recaptcha_options_config` block supports:
 
-* `redirect_site_key` - (Required) A field to supply a reCAPTCHA site key to be used for all the rules using the redirect action with the type of GOOGLE_RECAPTCHA under the security policy. The specified site key needs to be created from the reCAPTCHA API. The user is responsible for the validity of the specified site key. If not specified, a Google-managed site key is used.
+* `redirect_site_key` - (Required) A field to supply a reCAPTCHA site key to be used for all the rules using the redirect action with the type of `GOOGLE_RECAPTCHA` under the security policy. The specified site key needs to be created from the reCAPTCHA API. The user is responsible for the validity of the specified site key. If not specified, a Google-managed site key is used.
 
 ## Attributes Reference
 
@@ -420,10 +430,25 @@ exported:
 
 ## Import
 
-Security policies can be imported using any of the following formats
+Security policies can be imported using any of these accepted formats:
+
+* `projects/{{project}}/global/securityPolicies/{{name}}`
+* `{{project}}/{{name}}`
+* `{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import security policies using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project}}/global/securityPolicies/{{name}}"
+  to = google_compute_security_policy.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), security policies can be imported using one of the formats above. For example:
 
 ```
-$ terraform import google_compute_security_policy.policy projects/{{project}}/global/securityPolicies/{{name}}
-$ terraform import google_compute_security_policy.policy {{project}}/{{name}}
-$ terraform import google_compute_security_policy.policy {{name}}
+$ terraform import google_compute_security_policy.default projects/{{project}}/global/securityPolicies/{{name}}
+$ terraform import google_compute_security_policy.default {{project}}/{{name}}
+$ terraform import google_compute_security_policy.default {{name}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/compute_shared_vpc_host_project.html.markdown b/mmv1/third_party/terraform/website/docs/r/compute_shared_vpc_host_project.html.markdown
index a0048db08df1..88d09437ee39 100644
--- a/mmv1/third_party/terraform/website/docs/r/compute_shared_vpc_host_project.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/compute_shared_vpc_host_project.html.markdown
@@ -57,8 +57,22 @@ This resource provides the following
 
 ## Import
 
-Google Compute Engine Shared VPC host project feature can be imported using the `project`, e.g.
+Google Compute Engine Shared VPC host project feature can be imported using `project`, e.g.
+
+* `{{project_id}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Google Compute Engine Shared VPC host projects using one of the formats above. For example:
+
+```tf
+import {
+  id = "{{project_id}}"
+  to = google_compute_shared_vpc_host_project.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Google Compute Engine Shared VPC host projects can be imported using one of the formats above. For example:
+
 
 ```
-$ terraform import google_compute_shared_vpc_host_project.host host-project-id
+$ terraform import google_compute_shared_vpc_host_project.default {{project_id}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/compute_shared_vpc_service_project.html.markdown b/mmv1/third_party/terraform/website/docs/r/compute_shared_vpc_service_project.html.markdown
index bec341cbe953..e54434c3e59d 100644
--- a/mmv1/third_party/terraform/website/docs/r/compute_shared_vpc_service_project.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/compute_shared_vpc_service_project.html.markdown
@@ -57,6 +57,19 @@ This resource provides the following
 
 Google Compute Engine Shared VPC service project feature can be imported using the `host_project` and `service_project`, e.g.
 
+* `{{host_project}/{{service_project}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Google Compute Engine Shared VPC service project using one of the formats above. For example:
+
+```tf
+import {
+  id = "{{host_project}/{{service_project}}"
+  to = google_compute_shared_vpc_service_project.default
+}
 ```
-$ terraform import google_compute_shared_vpc_service_project.service1 host-project-id/service-project-id-1
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Google Compute Engine Shared VPC service project can be imported using one of the formats above. For example:
+
 ```
+$ terraform import google_compute_shared_vpc_service_project.default {{host_project}/{{service_project}}
+``````
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/website/docs/r/compute_target_pool.html.markdown b/mmv1/third_party/terraform/website/docs/r/compute_target_pool.html.markdown
index 00c45b1c6caa..d282b9178e34 100644
--- a/mmv1/third_party/terraform/website/docs/r/compute_target_pool.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/compute_target_pool.html.markdown
@@ -97,6 +97,22 @@ This resource provides the following
 
 Target pools can be imported using any of the following formats:
 
+* `projects/{{project}}/regions/{{region}}/targetPools/{{name}}`
+* `{{project}}/{{region}}/{{name}}`
+* `{{region}}/{{name}}`
+* `{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import target pools using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project}}/regions/{{region}}/targetPools/{{name}}"
+  to = google_compute_target_pool.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), target pools can be imported using one of the formats above. For example:
+
 ```
 $ terraform import google_compute_target_pool.default projects/{{project}}/regions/{{region}}/targetPools/{{name}}
 $ terraform import google_compute_target_pool.default {{project}}/{{region}}/{{name}}
diff --git a/mmv1/third_party/terraform/website/docs/r/container_cluster.html.markdown b/mmv1/third_party/terraform/website/docs/r/container_cluster.html.markdown
index daec72bb7691..7ec0fb4e10f5 100644
--- a/mmv1/third_party/terraform/website/docs/r/container_cluster.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/container_cluster.html.markdown
@@ -16,6 +16,10 @@ Manages a Google Kubernetes Engine (GKE) cluster. For more information see
 [the official documentation](https://cloud.google.com/container-engine/docs/clusters)
 and [the API reference](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters).
 
+-> **Note**: On version 5.0.0+ of the provider, you must explicitly set `deletion_protection=false`
+(and run `terraform apply` to write the field to state) in order to destroy a cluster.
+It is recommended to not set this field (or set it to true) until you're ready to destroy.
+
 ~> **Warning:** All arguments and attributes, including basic auth username and
 passwords as well as certificate outputs will be stored in the raw state as
 plaintext. [Read more about sensitive data in state](https://www.terraform.io/language/state/sensitive-data).
@@ -118,17 +122,21 @@ locations. In contrast, in a regional cluster, cluster master nodes are present
 in multiple zones in the region. For that reason, regional clusters should be
 preferred.
 
+* `deletion_protection` - (Optional) Whether or not to allow Terraform to destroy
+the cluster. Unless this field is set to false in Terraform state, a
+`terraform destroy` or `terraform apply` that would delete the cluster will fail.
+
 * `addons_config` - (Optional) The configuration for addons supported by GKE.
     Structure is [documented below](#nested_addons_config).
 
-* `allow_net_admin` - (Optional) Enable NET_ADMIN for the cluster. Defaults to 
+* `allow_net_admin` - (Optional) Enable NET_ADMIN for the cluster. Defaults to
 `false`. This field should only be enabled for Autopilot clusters (`enable_autopilot`
 set to `true`).
 
 * `cluster_ipv4_cidr` - (Optional) The IP address range of the Kubernetes pods
 in this cluster in CIDR notation (e.g. `10.96.0.0/14`). Leave blank to have one
 automatically chosen or specify a `/14` block in `10.0.0.0/8`. This field will
-only work for routes-based clusters, where `ip_allocation_policy` is not defined.
+default a new cluster to routes-based, where `ip_allocation_policy` is not defined.
 
 * `cluster_autoscaling` - (Optional)
 Per-cluster configuration of Node Auto-Provisioning with Cluster Autoscaler to
@@ -156,10 +164,6 @@ per node in this cluster. This doesn't work on "routes-based" clusters, clusters
 that don't have IP Aliasing enabled. See the [official documentation](https://cloud.google.com/kubernetes-engine/docs/how-to/flexible-pod-cidr)
 for more information.
 
-* `enable_binary_authorization` - (DEPRECATED) Enable Binary Authorization for this cluster.
-    If enabled, all container images will be validated by Google Binary Authorization.
-    Deprecated in favor of `binary_authorization`.
-
 * `enable_kubernetes_alpha` - (Optional) Whether to enable Kubernetes Alpha features for
     this cluster. Note that when this option is enabled, the cluster cannot be upgraded
     and will be automatically deleted after 30 days.
@@ -190,13 +194,11 @@ set this to a value of at least `1`, alongside setting
 `remove_default_node_pool` to `true`.
 
 * `ip_allocation_policy` - (Optional) Configuration of cluster IP allocation for
-VPC-native clusters. Adding this block enables [IP aliasing](https://cloud.google.com/kubernetes-engine/docs/how-to/ip-aliases),
-making the cluster VPC-native instead of routes-based. Structure is [documented
-below](#nested_ip_allocation_policy).
+VPC-native clusters. If this block is unset during creation, it will be set by the GKE backend.
+Structure is [documented below](#nested_ip_allocation_policy).
 
 * `networking_mode` - (Optional) Determines whether alias IPs or routes will be used for pod IPs in the cluster.
-Options are `VPC_NATIVE` or `ROUTES`. `VPC_NATIVE` enables [IP aliasing](https://cloud.google.com/kubernetes-engine/docs/how-to/ip-aliases),
-and requires the `ip_allocation_policy` block to be defined. By default, when this field is unspecified and no `ip_allocation_policy` blocks are set, GKE will create a `ROUTES`-based cluster.
+Options are `VPC_NATIVE` or `ROUTES`. `VPC_NATIVE` enables [IP aliasing](https://cloud.google.com/kubernetes-engine/docs/how-to/ip-aliases). Newly created clusters will default to `VPC_NATIVE`.
 
 * `logging_config` - (Optional) Logging configuration for the cluster.
     Structure is [documented below](#nested_logging_config).
@@ -268,7 +270,7 @@ region are guaranteed to support the same version.
     to say "these are the _only_ node pools associated with this cluster", use the
     [google_container_node_pool](container_node_pool.html) resource instead of this property.
 
-* `node_pool_auto_config` - (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)) Node pool configs that apply to auto-provisioned node pools in
+* `node_pool_auto_config` - (Optional) Node pool configs that apply to auto-provisioned node pools in
     [autopilot](https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-overview#comparison) clusters and
     [node auto-provisioning](https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-provisioning)-enabled clusters. Structure is [documented below](#nested_node_pool_auto_config).
 
@@ -376,6 +378,9 @@ subnetwork in which the cluster's instances are launched.
 * `security_posture_config` - (Optional)
 Enable/Disable Security Posture API features for the cluster. Structure is [documented below](#nested_security_posture_config).
 
+* `fleet` - (Optional)
+Fleet configuration for the cluster. Structure is [documented below](#nested_fleet).
+
 <a name="nested_default_snat_status"></a>The `default_snat_status` block supports
 
 *  `disabled` - (Required) Whether the cluster disables default in-node sNAT rules. In-node sNAT rules will be disabled when defaultSnatStatus is disabled.When disabled is set to false, default IP masquerade rules will be applied to the nodes to prevent sNAT on cluster internal traffic
@@ -409,14 +414,16 @@ Enable/Disable Security Posture API features for the cluster. Structure is [docu
 
 * `gcs_fuse_csi_driver_config` - (Optional) The status of the GCSFuse CSI driver addon,
     which allows the usage of a gcs bucket as volumes.
-    It is disabled by default; set `enabled = true` to enable.
+    It is disabled by default for Standard clusters; set `enabled = true` to enable.
+    It is enabled by default for Autopilot clusters with version 1.24 or later; set `enabled = true` to enable it explicitly.
+    See [Enable the Cloud Storage FUSE CSI driver](https://cloud.google.com/kubernetes-engine/docs/how-to/persistent-volumes/cloud-storage-fuse-csi-driver#enable) for more information.
 
 * `cloudrun_config` - (Optional). Structure is [documented below](#nested_cloudrun_config).
 
 * `istio_config` - (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)).
     Structure is [documented below](#nested_istio_config).
 
-* `identity_service_config` - (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)). Structure is [documented below](#nested_identity_service_config).
+* `identity_service_config` - (Optional). Structure is [documented below](#nested_identity_service_config).
 
 * `dns_cache_config` - (Optional).
     The status of the NodeLocal DNSCache addon. It is disabled by default.
@@ -426,7 +433,9 @@ Enable/Disable Security Posture API features for the cluster. Structure is [docu
     All cluster nodes running GKE 1.15 and higher are recreated.**
 
 * `gce_persistent_disk_csi_driver_config` - (Optional).
-    Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. Defaults to disabled; set `enabled = true` to enabled.
+    Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. Set `enabled = true` to enable.
+
+    **Note:** The Compute Engine persistent disk CSI Driver is enabled by default on newly created clusters for the following versions: Linux clusters: GKE version 1.18.10-gke.2100 or later, or 1.19.3-gke.2100 or later.
 
 *  `gke_backup_agent_config` -  (Optional).
     The status of the Backup for GKE agent addon. It is disabled by default; Set `enabled = true` to enable.
@@ -456,8 +465,7 @@ addons_config {
 * `enabled` - (DEPRECATED) Enable Binary Authorization for this cluster. Deprecated in favor of `evaluation_mode`.
 
 * `evaluation_mode` - (Optional) Mode of operation for Binary Authorization policy evaluation. Valid values are `DISABLED`
-  and `PROJECT_SINGLETON_POLICY_ENFORCE`. `PROJECT_SINGLETON_POLICY_ENFORCE` is functionally equivalent to the
-  deprecated `enable_binary_authorization` parameter being set to `true`.
+  and `PROJECT_SINGLETON_POLICY_ENFORCE`.
 
 <a name="nested_service_external_ips_config"></a>The `service_external_ips_config` block supports:
 
@@ -727,7 +735,7 @@ Default value is `IPV4`.
 Possible values are `IPV4` and `IPV4_IPV6`.
 
 * `additional_pod_ranges_config` - (Optional) The configuration for additional pod secondary ranges at
-the cluster level. Used for Autopilot clusters and Standard clusters with which control of the 
+the cluster level. Used for Autopilot clusters and Standard clusters with which control of the
 secondary Pod IP address assignment to node pools isn't needed. Structure is [documented below](#nested_additional_pod_ranges_config).
 
 
@@ -779,6 +787,9 @@ The `master_authorized_networks_config.cidr_blocks` block supports:
 * `disk_type` - (Optional) Type of the disk attached to each node
     (e.g. 'pd-standard', 'pd-balanced' or 'pd-ssd'). If unspecified, the default disk type is 'pd-standard'
 
+* `enable_confidential_storage` - (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html))
+Enabling Confidential Storage will create boot disk with confidential mode. It is disabled by default.
+
 * `ephemeral_storage_config` - (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)) Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk. Structure is [documented below](#nested_ephemeral_storage_config).
 
 ```hcl
@@ -793,6 +804,10 @@ ephemeral_storage_local_ssd_config {
   local_ssd_count = 2
 }
 ```
+* `fast_socket` - (Optional) Parameters for the NCCL Fast Socket feature. If unspecified, NCCL Fast Socket will not be enabled on the node pool.
+     Node Pool must enable gvnic.
+     GKE version 1.25.2-gke.1700 or later.
+     Structure is [documented below](#nested_fast_socket).
 
 * `local_nvme_ssd_block_config` - (Optional) Parameters for the local NVMe SSDs. Structure is [documented below](#nested_local_nvme_ssd_block_config).
 
@@ -887,14 +902,13 @@ gvnic {
 * `tags` - (Optional) The list of instance tags applied to all nodes. Tags are used to identify
     valid sources or targets for network firewalls.
 
-* `taint` - (Optional) A list of [Kubernetes taints](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
-to apply to nodes. GKE's API can only set this field on cluster creation.
-However, GKE will add taints to your nodes if you enable certain features such
-as GPUs. If this field is set, any diffs on this field will cause Terraform to
-recreate the underlying resource. Taint values can be updated safely in
-Kubernetes (eg. through `kubectl`), and it's recommended that you do not use
-this field to manage taints. If you do, `lifecycle.ignore_changes` is
-recommended. Structure is [documented below](#nested_taint).
+* `taint` - (Optional) A list of
+[Kubernetes taints](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
+to apply to nodes. This field will only report drift on taint keys that are
+already managed with Terraform, use `effective_taints` to view the list of
+GKE-managed taints on the node pool from all sources. Importing this resource
+will not record any taints as being Terraform-managed, and will cause drift with
+any configured taints. Structure is [documented below](#nested_taint).
 
 * `workload_metadata_config` - (Optional) Metadata configuration to expose to workloads on the node pool.
     Structure is [documented below](#nested_workload_metadata_config).
@@ -912,19 +926,7 @@ kubelet_config {
 }
 ```
 
-* `linux_node_config` - (Optional)
-Linux node configuration, currently supported attributes can be found [here](https://cloud.google.com/sdk/gcloud/reference/beta/container/node-pools/create#--system-config-from-file).
-Note that validations happen all server side. All attributes are optional.
-Structure is [documented below](#nested_linux_node_config).
-
-```hcl
-linux_node_config {
-  sysctls = {
-    "net.core.netdev_max_backlog" = "10000"
-    "net.core.rmem_max"           = "10000"
-  }
-}
-```
+* `linux_node_config` - (Optional) Parameters that can be configured on Linux nodes. Structure is [documented below](#nested_linux_node_config).
 
 * `node_group` - (Optional) Setting this field will assign instances of this pool to run on the specified node group. This is useful for running workloads on [sole tenant nodes](https://cloud.google.com/compute/docs/nodes/sole-tenant-nodes).
 
@@ -963,6 +965,10 @@ sole_tenant_config {
 
 * `local_ssd_count` (Required) - Number of local SSDs to use to back ephemeral storage. Uses NVMe interfaces. Each local SSD is 375 GB in size. If zero, it means to disable using local SSDs as ephemeral storage.
 
+<a name="nasted_fast_socket"></a>The `fast_socket` block supports:
+
+* `enabled` (Required) - Whether or not the NCCL Fast Socket is enabled
+
 <a name="nested_local_nvme_ssd_block_config"></a>The `local_nvme_ssd_block_config` block supports:
 
 * `local_ssd_count` (Required) - Number of raw-block local NVMe SSD disks to be attached to the node. Each local SSD is 375 GB in size. If zero, it means no raw-block local NVMe SSD disks to be attached to the node.
@@ -983,6 +989,10 @@ sole_tenant_config {
 * `count` (Required) - The number of the guest accelerator cards exposed to this instance.
 
 * `gpu_driver_installation_config` (Optional) - Configuration for auto installation of GPU driver. Structure is [documented below](#nested_gpu_driver_installation_config).
+  
+* `gpu_partition_size` (Optional) - Size of partitions to create on the GPU. Valid values are described in the NVIDIA mig [user guide](https://docs.nvidia.com/datacenter/tesla/mig-user-guide/#partitioning).
+
+* `gpu_sharing_config` (Optional) - Configuration for GPU sharing. Structure is [documented below](#nested_gpu_sharing_config).
 
 <a name="nested_gpu_driver_installation_config"></a>The `gpu_driver_installation_config` block supports:
 
@@ -993,10 +1003,6 @@ sole_tenant_config {
     * `"DEFAULT"`: "Default" GPU driver in COS and Ubuntu.
     * `"LATEST"`: "Latest" GPU driver in COS.
 
-* `gpu_partition_size` (Optional) - Size of partitions to create on the GPU. Valid values are described in the NVIDIA mig [user guide](https://docs.nvidia.com/datacenter/tesla/mig-user-guide/#partitioning).
-
-* `gpu_sharing_config` (Optional) - Configuration for GPU sharing. Structure is [documented below](#nested_gpu_sharing_config).
-
 <a name="nested_gpu_sharing_config"></a>The `gpu_sharing_config` block supports:
 
 * `gpu_sharing_strategy` (Required) - The type of GPU sharing strategy to enable on the GPU node.
@@ -1017,11 +1023,11 @@ workload_identity_config {
 
 <a name="nested_node_pool_auto_config"></a>The `node_pool_auto_config` block supports:
 
-* `network_tags` (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)) - The network tag config for the cluster's automatically provisioned node pools.
+* `network_tags` (Optional) - The network tag config for the cluster's automatically provisioned node pools.
 
 The `network_tags` block supports:
 
-* `tags` (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)) - List of network tags applied to auto-provisioned node pools.
+* `tags` (Optional) - List of network tags applied to auto-provisioned node pools.
 
 ```hcl
 node_pool_auto_config {
@@ -1226,9 +1232,25 @@ not specifying the `kubelet_config` block should be the equivalent of specifying
 
 <a name="nested_linux_node_config"></a>The `linux_node_config` block supports:
 
-* `sysctls` - (Required)  The Linux kernel parameters to be applied to the nodes
+* `sysctls` - (Optional) The Linux kernel parameters to be applied to the nodes
 and all pods running on the nodes. Specified as a map from the key, such as
-`net.core.wmem_max`, to a string value.
+`net.core.wmem_max`, to a string value. Currently supported attributes can be found [here](https://cloud.google.com/sdk/gcloud/reference/beta/container/node-pools/create#--system-config-from-file).
+Note that validations happen all server side. All attributes are optional.
+
+```hcl
+linux_node_config {
+  sysctls = {
+    "net.core.netdev_max_backlog" = "10000"
+    "net.core.rmem_max"           = "10000"
+  }
+}
+```
+
+* `cgroup_mode` - (Optional) Possible cgroup modes that can be used.
+    Accepted values are:
+    * `CGROUP_MODE_UNSPECIFIED`: CGROUP_MODE_UNSPECIFIED is when unspecified cgroup configuration is used. The default for the GKE node OS image will be used.
+    * `CGROUP_MODE_V1`: CGROUP_MODE_V1 specifies to use cgroupv1 for the cgroup configuration on the node image.
+    * `CGROUP_MODE_V2`: CGROUP_MODE_V2 specifies to use cgroupv2 for the cgroup configuration on the node image.
 
 <a name="nested_vertical_pod_autoscaling"></a>The `vertical_pod_autoscaling` block supports:
 
@@ -1261,7 +1283,11 @@ and all pods running on the nodes. Specified as a map from the key, such as
 * `mode` - (Optional) Sets the mode of the Kubernetes security posture API's off-cluster features. Available options include `DISABLED` and `BASIC`.
 
 
-* `vulnerability_mode` - (Optional) Sets the mode of the Kubernetes security posture API's workload vulnerability scanning. Available options include `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`.
+* `vulnerability_mode` - (Optional) Sets the mode of the Kubernetes security posture API's workload vulnerability scanning. Available options include `VULNERABILITY_DISABLED`, `VULNERABILITY_BASIC` and `VULNERABILITY_ENTERPRISE`.
+
+<a name="nested_fleet"></a>The `fleet` block supports:
+
+* `project` - (Optional) The name of the Fleet host project where this cluster will be registered.
 
 
 ## Attributes Reference
@@ -1305,6 +1331,10 @@ exported:
 
 * `cluster_autoscaling.0.auto_provisioning_defaults.0.management.0.upgrade_options` - Specifies the [Auto Upgrade knobs](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/NodeManagement#AutoUpgradeOptions) for the node pool.
 
+* `node_config.0.effective_taints` - List of kubernetes taints applied to each node. Structure is [documented above](#nested_taint).
+
+* `fleet.0.membership` - The resource name of the fleet Membership resource associated to this cluster with format `//gkehub.googleapis.com/projects/{{project}}/locations/{{location}}/memberships/{{name}}`. See the official doc for [fleet management](https://cloud.google.com/kubernetes-engine/docs/fleets-overview). 
+
 ## Timeouts
 
 This resource provides the following
@@ -1320,12 +1350,27 @@ This resource provides the following
 GKE clusters can be imported using the `project` , `location`, and `name`. If the project is omitted, the default
 provider value will be used. Examples:
 
+* `projects/{{project_id}}/locations/{{location}}/clusters/{{cluster_id}}`
+* `{{project_id}}/{{location}}/{{cluster_id}}`
+* `{{location}}/{{cluster_id}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GKE clusters using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project_id}}/locations/{{location}}/clusters/{{cluster_id}}"
+  to = google_container_cluster.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), GKE clusters can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_container_cluster.mycluster projects/my-gcp-project/locations/us-east1-a/clusters/my-cluster
+$ terraform import google_container_cluster.default projects/{{project_id}}/locations/{{location}}/clusters/{{cluster_id}}
 
-$ terraform import google_container_cluster.mycluster my-gcp-project/us-east1-a/my-cluster
+$ terraform import google_container_cluster.default {{project_id}}/{{location}}/{{cluster_id}}
 
-$ terraform import google_container_cluster.mycluster us-east1-a/my-cluster
+$ terraform import google_container_cluster.default {{location}}/{{cluster_id}}
 ```
 
 ~> **Note:** This resource has several fields that control Terraform-specific behavior and aren't present in the API. If they are set in config and you import a cluster, Terraform may need to perform an update immediately after import. Most of these updates should be no-ops but some may modify your cluster if the imported state differs.
diff --git a/mmv1/third_party/terraform/website/docs/r/container_node_pool.html.markdown b/mmv1/third_party/terraform/website/docs/r/container_node_pool.html.markdown
index 3f08b2c1dd89..c0e7fb8a90f1 100644
--- a/mmv1/third_party/terraform/website/docs/r/container_node_pool.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/container_node_pool.html.markdown
@@ -201,9 +201,9 @@ cluster.
 
 <a name="nested_management"></a>The `management` block supports:
 
-* `auto_repair` - (Optional) Whether the nodes will be automatically repaired.
+* `auto_repair` - (Optional) Whether the nodes will be automatically repaired. Enabled by default.
 
-* `auto_upgrade` - (Optional) Whether the nodes will be automatically upgraded.
+* `auto_upgrade` - (Optional) Whether the nodes will be automatically upgraded. Enabled by default.
 
 <a name="nested_network_config"></a>The `network_config` block supports:
 
@@ -273,7 +273,7 @@ cluster.
   The resource policy must be in the same project and region as the node pool.
   If not found, InvalidArgument error is returned.
 
-* `tpu_topology` - (Optional, Beta) The [TPU placement topology](https://cloud.google.com/tpu/docs/types-topologies#tpu_topologies) for pod slice node pool.
+* `tpu_topology` - (Optional) The [TPU placement topology](https://cloud.google.com/tpu/docs/types-topologies#tpu_topologies) for pod slice node pool.
 
 ## Attributes Reference
 
@@ -300,8 +300,22 @@ In addition to the arguments listed above, the following computed attributes are
 Node pools can be imported using the `project`, `location`, `cluster` and `name`. If
 the project is omitted, the project value in the provider configuration will be used. Examples:
 
+* `{{project_id}}/{{location}}/{{cluster_id}}/{{pool_id}}`
+* `{{location}}/{{cluster_id}}/{{pool_id}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import node pools using one of the formats above. For example:
+
+```tf
+import {
+  id = "{{project_id}}/{{location}}/{{cluster_id}}/{{pool_id}}"
+  to = google_container_node_pool.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), node pools can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_container_node_pool.mainpool my-gcp-project/us-east1-a/my-cluster/main-pool
+$ terraform import google_container_node_pool.default {{project_id}}/{{location}}/{{cluster_id}}/{{pool_id}}
 
-$ terraform import google_container_node_pool.mainpool us-east1/my-cluster/main-pool
+$ terraform import google_container_node_pool.default {{location}}/{{cluster_id}}/{{pool_id}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/dataflow_flex_template_job.html.markdown b/mmv1/third_party/terraform/website/docs/r/dataflow_flex_template_job.html.markdown
index 4064c913467c..d592b3fdb39c 100644
--- a/mmv1/third_party/terraform/website/docs/r/dataflow_flex_template_job.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/dataflow_flex_template_job.html.markdown
@@ -98,9 +98,13 @@ such as `serviceAccount`, `workerMachineType`, etc can be specified here.
 * `labels` - (Optional) User labels to be specified for the job. Keys and values
 should follow the restrictions specified in the [labeling restrictions](https://cloud.google.com/compute/docs/labeling-resources#restrictions)
 page. 
-**NOTE**: Google-provided Dataflow templates often provide default labels
-that begin with `goog-dataflow-provided`. Unless explicitly set in config, these
-labels will be ignored to prevent diffs on re-apply.
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration. Please refer to the field `effective_labels` for all of the labels present on the resource.
+
+* `terraform_labels` -
+  The combination of labels configured directly on the resource and default labels configured on the provider.
+
+* `effective_labels` -
+  All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
 
 * `on_delete` - (Optional) One of "drain" or "cancel". Specifies behavior of
 deletion during `terraform destroy`.  See above note.
diff --git a/mmv1/third_party/terraform/website/docs/r/dataflow_job.html.markdown b/mmv1/third_party/terraform/website/docs/r/dataflow_job.html.markdown
index 6000b964995a..b33badf77885 100644
--- a/mmv1/third_party/terraform/website/docs/r/dataflow_job.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/dataflow_job.html.markdown
@@ -102,8 +102,11 @@ The following arguments are supported:
 * `parameters` - (Optional) Key/Value pairs to be passed to the Dataflow job (as used in the template).
 * `labels` - (Optional) User labels to be specified for the job. Keys and values should follow the restrictions
    specified in the [labeling restrictions](https://cloud.google.com/compute/docs/labeling-resources#restrictions) page.
-   **NOTE**: Google-provided Dataflow templates often provide default labels that begin with `goog-dataflow-provided`.
-   Unless explicitly set in config, these labels will be ignored to prevent diffs on re-apply.
+   **Note**: This field is non-authoritative, and will only manage the labels present in your configuration. Please refer to the field `effective_labels` for all of the labels present on the resource.
+* `terraform_labels` -
+  The combination of labels configured directly on the resource and default labels configured on the provider.
+* `effective_labels` -
+  All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
 * `transform_name_mapping` - (Optional) Only applicable when updating a pipeline. Map of transform name prefixes of the job to be replaced with the corresponding name prefixes of the new job. This field is not used outside of update.
 * `max_workers` - (Optional) The number of workers permitted to work on the job.  More workers may improve processing speed at additional cost.
 * `on_delete` - (Optional) One of "drain" or "cancel".  Specifies behavior of deletion during `terraform destroy`.  See above note.
@@ -130,6 +133,19 @@ The following arguments are supported:
 
 Dataflow jobs can be imported using the job `id` e.g.
 
+* `{{id}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import dataflow jobs using one of the formats above. For example:
+
+```tf
+import {
+  id = "{{id}}"
+  to = google_dataflow_job.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), dataflow jobs can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_dataflow_job.example 2022-07-31_06_25_42-11926927532632678660
+$ terraform import google_dataflow_job.default {{id}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/dataproc_cluster.html.markdown b/mmv1/third_party/terraform/website/docs/r/dataproc_cluster.html.markdown
index 1aa6310d0b12..32762397ff06 100644
--- a/mmv1/third_party/terraform/website/docs/r/dataproc_cluster.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/dataproc_cluster.html.markdown
@@ -14,7 +14,7 @@ Manages a Cloud Dataproc cluster resource within GCP.
 
 
 !> **Warning:** Due to limitations of the API, all arguments except
-`labels`,`cluster_config.worker_config.num_instances` and `cluster_config.preemptible_worker_config.num_instances` are non-updatable. Changing others will cause recreation of the
+`labels`,`cluster_config.worker_config.num_instances` and `cluster_config.preemptible_worker_config.num_instances` are non-updatable. Changing `cluster_config.worker_config.min_num_instances` will be ignored. Changing others will cause recreation of the
 whole cluster!
 
 ## Example Usage - Basic
@@ -129,7 +129,14 @@ resource "google_dataproc_cluster" "accelerated_cluster" {
 * `region` - (Optional) The region in which the cluster and associated nodes will be created in.
    Defaults to `global`.
 
-* `labels` - (Optional, Computed) The list of labels (key/value pairs) to be applied to
+* `labels` - (Optional) The list of labels (key/value pairs) configured on the resource through Terraform and to be applied to
+   instances in the cluster.
+   **Note**: This field is non-authoritative, and will only manage the labels present in your configuration. Please refer to the field `effective_labels` for all of the labels present on the resource.
+
+* `terraform_labels` -
+  The combination of labels configured directly on the resource and default labels configured on the provider.
+
+* `effective_labels` - (Computed) The list of labels (key/value pairs) to be applied to
    instances in the cluster. GCP generates some itself including `goog-dataproc-cluster-name`
    which is the name of the cluster.
 
@@ -532,7 +539,7 @@ cluster_config {
     num_instances    = 3
     machine_type     = "e2-medium"
     min_cpu_platform = "Intel Skylake"
-
+    min_num_instance = 2
     disk_config {
       boot_disk_type    = "pd-standard"
       boot_disk_size_gb = 30
@@ -575,6 +582,8 @@ cluster_config {
 * `image_uri` (Optional) The URI for the image to use for this worker.  See [the guide](https://cloud.google.com/dataproc/docs/guides/dataproc-images)
     for more information.
 
+* `min_num_instances` (Optional) The minimum number of primary worker instances to create.  If `min_num_instances` is set, cluster creation will succeed if the number of primary workers created is at least equal to the `min_num_instances` number.
+
 * `accelerators` (Optional) The Compute Engine accelerator configuration for these instances. Can be specified multiple times.
 
     * `accelerator_type` - (Required) The short name of the accelerator type to expose to this instance. For example, `nvidia-tesla-k80`.
@@ -599,6 +608,16 @@ cluster_config {
       boot_disk_size_gb = 30
       num_local_ssds    = 1
     }
+    instance_flexibility_policy {
+      instance_selection_list {
+        machine_types = ["n2-standard-2","n1-standard-2"]
+        rank          = 1
+      }
+      instance_selection_list {
+        machine_types = ["n2d-standard-2"]
+        rank          = 3
+      }
+    }
   }
 }
 ```
@@ -629,6 +648,13 @@ will be set for you based on whatever was set for the `worker_config.machine_typ
 	* `num_local_ssds` - (Optional) The amount of local SSD disks that will be
 	attached to each preemptible worker node. Defaults to 0.
 
+* `instance_flexibility_policy` (Optional) Instance flexibility Policy allowing a mixture of VM shapes and provisioning models.
+
+    * `instance_selection_list` - (Optional) List of instance selection options that the group will use when creating new VMs.
+      * `machine_types` - (Optional) Full machine-type names, e.g. `"n1-standard-16"`.
+
+      * `rank` - (Optional) Preference of this instance selection. A lower number means higher preference. Dataproc will first try to create a VM based on the machine-type with priority rank and fallback to next rank based on availability. Machine types and instance selections with the same priority have the same preference.
+
 - - -
 
 <a name="nested_software_config"></a>The `cluster_config.software_config` block supports:
diff --git a/mmv1/third_party/terraform/website/docs/r/dataproc_cluster_iam.html.markdown b/mmv1/third_party/terraform/website/docs/r/dataproc_cluster_iam.html.markdown
index e71b4fc38163..055f18c71b27 100644
--- a/mmv1/third_party/terraform/website/docs/r/dataproc_cluster_iam.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/dataproc_cluster_iam.html.markdown
@@ -4,7 +4,7 @@ description: |-
  Collection of resources to manage IAM policy for a Dataproc cluster.
 ---
 
-# IAM policy for Dataproc cluster
+# IAM policy for Dataproc Cluster
 
 Three different resources help you manage IAM policies on dataproc clusters. Each of these resources serves a different use case:
 
@@ -99,15 +99,68 @@ exported:
 
 ## Import
 
-Cluster IAM resources can be imported using the project, region, cluster name, role and/or member.
+-> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
+ full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
+
+### Importing IAM members
+
+IAM member imports use space-delimited identifiers that contain the resource's `cluster`, `role`, and `member`. For example:
 
+* `"projects/{project}/regions/{region}/clusters/{cluster} roles/editor user:jane@example.com"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM members:
+
+```tf
+import {
+  id = "projects/{project}/regions/{region}/clusters/{cluster} roles/editor user:jane@example.com"
+  to = google_dataproc_cluster_iam_member.default
+}
 ```
-$ terraform import google_dataproc_cluster_iam_policy.editor "projects/{project}/regions/{region}/clusters/{cluster}"
 
-$ terraform import google_dataproc_cluster_iam_binding.editor "projects/{project}/regions/{region}/clusters/{cluster} roles/editor"
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
 
-$ terraform import google_dataproc_cluster_iam_member.editor "projects/{project}/regions/{region}/clusters/{cluster} roles/editor user:jane@example.com"
+```
+$ terraform import google_dataproc_cluster_iam_member.default "projects/{{project_id}}/datasets/{{dataset_id}} roles/viewer user:foo@example.com"
 ```
 
--> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
- full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
+### Importing IAM bindings
+
+IAM binding imports use space-delimited identifiers that contain the resource's `cluster`, `role`. For example:
+
+* `"projects/{project}/regions/{region}/clusters/{cluster} roles/editor"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM bindings:
+
+```tf
+import {
+  id = "projects/{project}/regions/{region}/clusters/{cluster} roles/editor"
+  to = google_dataproc_cluster_iam_binding.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+$ terraform import google_dataproc_cluster_iam_binding.default "projects/{project}/regions/{region}/clusters/{cluster} roles/editor"
+```
+
+### Importing IAM policies
+
+IAM policy imports use the `cluster` identifier of the Dataproc Cluster resource only. For example:
+
+* `projects/{project}/regions/{region}/clusters/{cluster}`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM policies:
+
+```tf
+import {
+  id = projects/{project}/regions/{region}/clusters/{cluster}
+  to = google_dataproc_cluster_iam_policy.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+$ terraform import google_dataproc_cluster_iam_policy.default projects/{project}/regions/{region}/clusters/{cluster}
+```
diff --git a/mmv1/third_party/terraform/website/docs/r/dataproc_job.html.markdown b/mmv1/third_party/terraform/website/docs/r/dataproc_job.html.markdown
index 3c8b99fee706..84094a189b4a 100644
--- a/mmv1/third_party/terraform/website/docs/r/dataproc_job.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/dataproc_job.html.markdown
@@ -102,6 +102,14 @@ output "pyspark_status" {
    job is first cancelled before issuing the delete.
 
 * `labels` - (Optional) The list of labels (key/value pairs) to add to the job.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+	Please refer to the field 'effective_labels' for all of the labels present on the resource.
+
+* `terraform_labels` -
+  The combination of labels configured directly on the resource and default labels configured on the provider.
+
+* `effective_labels` -
+  All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
 
 * `scheduling.max_failures_per_hour` - (Required) Maximum number of times per hour a driver may be restarted as a result of driver exiting with non-zero code before job is reported failed.
 
diff --git a/mmv1/third_party/terraform/website/docs/r/dataproc_job_iam.html.markdown b/mmv1/third_party/terraform/website/docs/r/dataproc_job_iam.html.markdown
index 277b7072c557..d3dbe728ee30 100644
--- a/mmv1/third_party/terraform/website/docs/r/dataproc_job_iam.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/dataproc_job_iam.html.markdown
@@ -4,7 +4,7 @@ description: |-
  Collection of resources to manage IAM policy for a Dataproc job.
 ---
 
-# IAM policy for Dataproc job
+# IAM policy for Dataproc Job
 
 Three different resources help you manage IAM policies on dataproc jobs. Each of these resources serves a different use case:
 
@@ -99,15 +99,68 @@ exported:
 
 ## Import
 
-Job IAM resources can be imported using the project, region, job id, role and/or member.
+-> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
+ full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
+
+### Importing IAM members
+
+IAM member imports use space-delimited identifiers that contain the resource's `job_id`, `role`, and `member`. For example:
 
+* `"projects/{project}/regions/{region}/jobs/{job_id} roles/editor user:jane@example.com"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM members:
+
+```tf
+import {
+  id = "projects/{project}/regions/{region}/jobs/{job_id} roles/editor user:jane@example.com"
+  to = google_dataproc_job_iam_member.default
+}
 ```
-$ terraform import google_dataproc_job_iam_policy.editor "projects/{project}/regions/{region}/jobs/{job_id}"
 
-$ terraform import google_dataproc_job_iam_binding.editor "projects/{project}/regions/{region}/jobs/{job_id} roles/editor"
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
 
-$ terraform import google_dataproc_job_iam_member.editor "projects/{project}/regions/{region}/jobs/{job_id} roles/editor user:jane@example.com"
+```
+$ terraform import google_dataproc_job_iam_member.default "projects/{project}/regions/{region}/jobs/{job_id} roles/editor user:jane@example.com"
 ```
 
--> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
- full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
+### Importing IAM bindings
+
+IAM binding imports use space-delimited identifiers that contain the resource's `job_id`, `role`. For example:
+
+* `"projects/{project}/regions/{region}/jobs/{job_id} roles/editor"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM bindings:
+
+```tf
+import {
+  id = "projects/{project}/regions/{region}/jobs/{job_id} roles/editor"
+  to = google_dataproc_job_iam_binding.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+$ terraform import google_dataproc_job_iam_binding.default "projects/{project}/regions/{region}/jobs/{job_id} roles/editor"
+```
+
+### Importing IAM policies
+
+IAM policy imports use the `job_id` identifier of the Dataproc Job resource only. For example:
+
+* `projects/{project}/regions/{region}/jobs/{job_id}`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM policies:
+
+```tf
+import {
+  id = "projects/{project}/regions/{region}/jobs/{job_id}"
+  to = google_dataproc_job_iam_policy.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+$ terraform import google_dataproc_job_iam_policy.default "projects/{project}/regions/{region}/jobs/{job_id}"
+```
diff --git a/mmv1/third_party/terraform/website/docs/r/dataproc_workflow_template.html.markdown b/mmv1/third_party/terraform/website/docs/r/dataproc_workflow_template.html.markdown
index 028b6eaabab1..da170d905d0b 100644
--- a/mmv1/third_party/terraform/website/docs/r/dataproc_workflow_template.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/dataproc_workflow_template.html.markdown
@@ -962,6 +962,21 @@ This resource provides the following
 
 WorkflowTemplate can be imported using any of these accepted formats:
 
+* `projects/{{project}}/locations/{{location}}/workflowTemplates/{{name}}`
+* `{{project}}/{{location}}/{{name}}`
+* `{{location}}/{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WorkflowTemplate using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project}}/locations/{{location}}/workflowTemplates/{{name}}"
+  to = google_dataproc_workflow_template.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), WorkflowTemplate can be imported using one of the formats above. For example:
+
 ```
 $ terraform import google_dataproc_workflow_template.default projects/{{project}}/locations/{{location}}/workflowTemplates/{{name}}
 $ terraform import google_dataproc_workflow_template.default {{project}}/{{location}}/{{name}}
diff --git a/mmv1/third_party/terraform/website/docs/r/dialogflow_cx_environment.html.markdown b/mmv1/third_party/terraform/website/docs/r/dialogflow_cx_environment.html.markdown
deleted file mode 100644
index fe119169bf7f..000000000000
--- a/mmv1/third_party/terraform/website/docs/r/dialogflow_cx_environment.html.markdown
+++ /dev/null
@@ -1,124 +0,0 @@
----
-subcategory: "Dialogflow CX"
-description: |-
-  Represents an environment for an agent.
----
-
-# google\_dialogflow\_cx\_environment
-
-Represents an environment for an agent. You can create multiple versions of your agent and publish them to separate environments.
-When you edit an agent, you are editing the draft agent. At any point, you can save the draft agent as an agent version, which is an immutable snapshot of your agent.
-When you save the draft agent, it is published to the default environment. When you create agent versions, you can publish them to custom environments. You can create a variety of custom environments for testing, development, production, etc.
-
-
-To get more information about Environment, see:
-
-* [API documentation](https://cloud.google.com/dialogflow/cx/docs/reference/rest/v3/projects.locations.agents.environments)
-* How-to Guides
-    * [Official Documentation](https://cloud.google.com/dialogflow/cx/docs)
-
-<div class = "oics-button" style="float: right; margin: 0 0 -15px">
-  <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=dialogflowcx_environment_full&cloudshell_image=gcr.io%2Fgraphite-cloud-shell-images%2Fterraform%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
-    <img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
-  </a>
-</div>
-## Example Usage - Dialogflowcx Environment Full
-
-
-```hcl
-resource "google_dialogflow_cx_agent" "agent" {
-  display_name = "dialogflowcx-agent"
-  location = "global"
-  default_language_code = "en"
-  supported_language_codes = ["fr","de","es"]
-  time_zone = "America/New_York"
-  description = "Example description."
-  avatar_uri = "https://cloud.google.com/_static/images/cloud/icons/favicons/onecloud/super_cloud.png"
-  enable_stackdriver_logging = true
-  enable_spell_correction    = true
-	speech_to_text_settings {
-		enable_speech_adaptation = true
-	}
-}
-
-resource "google_dialogflow_cx_version" "version_1" {
-  parent       = google_dialogflow_cx_agent.agent.start_flow
-  display_name = "1.0.0"
-  description  = "version 1.0.0"
-}
-
-resource "google_dialogflow_cx_environment" "development" {
-  parent       = google_dialogflow_cx_agent.agent.id
-  display_name = "Development"
-  description  = "Development Environment"
-  version_configs {
-    version = google_dialogflow_cx_version.version_1.id
-  }
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-
-* `display_name` -
-  (Required)
-  The human-readable name of the environment (unique in an agent). Limit of 64 characters.
-
-* `version_configs` -
-  (Required)
-  A list of configurations for flow versions. You should include version configs for all flows that are reachable from [Start Flow][Agent.start_flow] in the agent. Otherwise, an error will be returned.
-  Structure is [documented below](#nested_version_configs).
-
-
-<a name="nested_version_configs"></a>The `version_configs` block supports:
-
-* `version` -
-  (Required)
-  Format: projects/{{project}}/locations/{{location}}/agents/{{agent}}/flows/{{flow}}/versions/{{version}}.
-
-- - -
-
-
-* `description` -
-  (Optional)
-  The human-readable description of the environment. The maximum length is 500 characters. If exceeded, the request is rejected.
-
-* `parent` -
-  (Optional)
-  The Agent to create an Environment for.
-  Format: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>.
-
-
-## Attributes Reference
-
-In addition to the arguments listed above, the following computed attributes are exported:
-
-* `id` - an identifier for the resource with format `{{parent}}/environments/{{name}}`
-
-* `name` -
-  The name of the environment.
-
-* `update_time` -
-  Update time of this environment. A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
-
-
-## Timeouts
-
-This resource provides the following
-[Timeouts](https://developer.hashicorp.com/terraform/plugin/sdkv2/resources/retries-and-customizable-timeouts) configuration options: configuration options:
-
-- `create` - Default is 40 minutes.
-- `update` - Default is 40 minutes.
-- `delete` - Default is 20 minutes.
-
-## Import
-
-
-Environment can be imported using any of these accepted formats:
-
-```
-$ terraform import google_dialogflow_cx_environment.default {{parent}}/environments/{{name}}
-$ terraform import google_dialogflow_cx_environment.default {{parent}}/{{name}}
-```
diff --git a/mmv1/third_party/terraform/website/docs/r/dialogflow_cx_version.html.markdown b/mmv1/third_party/terraform/website/docs/r/dialogflow_cx_version.html.markdown
deleted file mode 100644
index a20ebb427cfa..000000000000
--- a/mmv1/third_party/terraform/website/docs/r/dialogflow_cx_version.html.markdown
+++ /dev/null
@@ -1,135 +0,0 @@
----
-subcategory: "Dialogflow CX"
-description: |-
-  You can create multiple versions of your agent flows and deploy them to separate serving environments.
----
-
-# google\_dialogflow\_cx\_version
-
-You can create multiple versions of your agent flows and deploy them to separate serving environments.
-When you edit a flow, you are editing a draft flow. At any point, you can save a draft flow as a flow version. A flow version is an immutable snapshot of your flow data and associated agent data like intents, entities, webhooks, pages, route groups, etc.
-
-
-To get more information about Version, see:
-
-* [API documentation](https://cloud.google.com/dialogflow/cx/docs/reference/rest/v3/projects.locations.agents.flows.versions)
-* How-to Guides
-    * [Official Documentation](https://cloud.google.com/dialogflow/cx/docs)
-
-<div class = "oics-button" style="float: right; margin: 0 0 -15px">
-  <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=dialogflowcx_version_full&cloudshell_image=gcr.io%2Fgraphite-cloud-shell-images%2Fterraform%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
-    <img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
-  </a>
-</div>
-## Example Usage - Dialogflowcx Version Full
-
-
-```hcl
-resource "google_dialogflow_cx_agent" "agent" {
-  display_name = "dialogflowcx-agent"
-  location = "global"
-  default_language_code = "en"
-  supported_language_codes = ["fr","de","es"]
-  time_zone = "America/New_York"
-  description = "Example description."
-  avatar_uri = "https://cloud.google.com/_static/images/cloud/icons/favicons/onecloud/super_cloud.png"
-  enable_stackdriver_logging = true
-  enable_spell_correction    = true
-	speech_to_text_settings {
-		enable_speech_adaptation = true
-	}
-}
-
-
-resource "google_dialogflow_cx_version" "version_1" {
-  parent       = google_dialogflow_cx_agent.agent.start_flow
-  display_name = "1.0.0"
-  description  = "version 1.0.0"
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-
-* `display_name` -
-  (Required)
-  The human-readable name of the version. Limit of 64 characters.
-
-
-- - -
-
-
-* `description` -
-  (Optional)
-  The description of the version. The maximum length is 500 characters. If exceeded, the request is rejected.
-
-* `parent` -
-  (Optional)
-  The Flow to create an Version for.
-  Format: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>.
-
-
-## Attributes Reference
-
-In addition to the arguments listed above, the following computed attributes are exported:
-
-* `id` - an identifier for the resource with format `{{parent}}/versions/{{name}}`
-
-* `name` -
-  Format: projects//locations//agents//flows//versions/. Version ID is a self-increasing number generated by Dialogflow upon version creation.
-
-* `nlu_settings` -
-  The NLU settings of the flow at version creation.
-  Structure is [documented below](#nested_nlu_settings).
-
-* `create_time` -
-  A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
-
-* `state` -
-  The state of this version.
-  * RUNNING: Version is not ready to serve (e.g. training is running).
-  * SUCCEEDED: Training has succeeded and this version is ready to serve.
-  * FAILED: Version training failed.
-
-
-<a name="nested_nlu_settings"></a>The `nlu_settings` block contains:
-
-* `model_type` -
-  (Optional)
-  Indicates the type of NLU model.
-  * MODEL_TYPE_STANDARD: Use standard NLU model.
-  * MODEL_TYPE_ADVANCED: Use advanced NLU model.
-  Possible values are `MODEL_TYPE_STANDARD` and `MODEL_TYPE_ADVANCED`.
-
-* `classification_threshold` -
-  (Optional)
-  To filter out false positive results and still get variety in matched natural language inputs for your agent, you can tune the machine learning classification threshold. If the returned score value is less than the threshold value, then a no-match event will be triggered.
-  The score values range from 0.0 (completely uncertain) to 1.0 (completely certain). If set to 0.0, the default of 0.3 is used.
-
-* `model_training_mode` -
-  (Optional)
-  Indicates NLU model training mode.
-  * MODEL_TRAINING_MODE_AUTOMATIC: NLU model training is automatically triggered when a flow gets modified. User can also manually trigger model training in this mode.
-  * MODEL_TRAINING_MODE_MANUAL: User needs to manually trigger NLU model training. Best for large flows whose models take long time to train.
-  Possible values are `MODEL_TRAINING_MODE_AUTOMATIC` and `MODEL_TRAINING_MODE_MANUAL`.
-
-## Timeouts
-
-This resource provides the following
-[Timeouts](https://developer.hashicorp.com/terraform/plugin/sdkv2/resources/retries-and-customizable-timeouts) configuration options: configuration options:
-
-- `create` - Default is 40 minutes.
-- `update` - Default is 40 minutes.
-- `delete` - Default is 20 minutes.
-
-## Import
-
-
-Version can be imported using any of these accepted formats:
-
-```
-$ terraform import google_dialogflow_cx_version.default {{parent}}/versions/{{name}}
-$ terraform import google_dialogflow_cx_version.default {{parent}}/{{name}}
-```
diff --git a/mmv1/third_party/terraform/website/docs/r/dns_record_set.html.markdown b/mmv1/third_party/terraform/website/docs/r/dns_record_set.html.markdown
index 05aed34e8b5f..d4823cb788b3 100644
--- a/mmv1/third_party/terraform/website/docs/r/dns_record_set.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/dns_record_set.html.markdown
@@ -341,10 +341,25 @@ The following arguments are supported:
 
 DNS record sets can be imported using either of these accepted formats:
 
+* `projects/{{project}}/managedZones/{{zone}}/rrsets/{{name}}/{{type}}`
+* `{{project}}/{{zone}}/{{name}}/{{type}}`
+* `{{zone}}/{{name}}/{{type}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DNS record sets using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project}}/managedZones/{{zone}}/rrsets/{{name}}/{{type}}"
+  to = google_dns_record_set.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), DNS record sets can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_dns_record_set.frontend projects/{{project}}/managedZones/{{zone}}/rrsets/{{name}}/{{type}}
-$ terraform import google_dns_record_set.frontend {{project}}/{{zone}}/{{name}}/{{type}}
-$ terraform import google_dns_record_set.frontend {{zone}}/{{name}}/{{type}}
+$ terraform import google_dns_record_set.default projects/{{project}}/managedZones/{{zone}}/rrsets/{{name}}/{{type}}
+$ terraform import google_dns_record_set.default {{project}}/{{zone}}/{{name}}/{{type}}
+$ terraform import google_dns_record_set.default {{zone}}/{{name}}/{{type}}
 ```
 
 Note: The record name must include the trailing dot at the end.
diff --git a/mmv1/third_party/terraform/website/docs/r/gke_hub_feature_membership.html.markdown b/mmv1/third_party/terraform/website/docs/r/gke_hub_feature_membership.html.markdown
index 314fc1f706a2..9d45db679f95 100644
--- a/mmv1/third_party/terraform/website/docs/r/gke_hub_feature_membership.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/gke_hub_feature_membership.html.markdown
@@ -8,10 +8,6 @@ description: |-
 
 Contains information about a GKEHub Feature Memberships. Feature Memberships configure GKEHub Features that apply to specific memberships rather than the project as a whole. The google_gke_hub is the Fleet API.
 
-~> **Warning:** This resource is in beta, and should be used with the terraform-provider-google-beta provider.
-See [Provider Versions](https://terraform.io/docs/providers/google/guides/provider_versions.html) for more details on beta resources.
-
-
 ## Example Usage - Config Management
 
 ```hcl
@@ -365,6 +361,21 @@ This resource provides the following
 
 FeatureMembership can be imported using any of these accepted formats:
 
+* `projects/{{project}}/locations/{{location}}/features/{{feature}}/membershipId/{{membership}}`
+* `{{project}}/{{location}}/{{feature}}/{{membership}}`
+* `{{location}}/{{feature}}/{{membership}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FeatureMembership using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project}}/locations/{{location}}/features/{{feature}}/membershipId/{{membership}}"
+  to = google_gke_hub_feature_membership.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), FeatureMembership can be imported using one of the formats above. For example:
+
 ```
 $ terraform import google_gke_hub_feature_membership.default projects/{{project}}/locations/{{location}}/features/{{feature}}/membershipId/{{membership}}
 $ terraform import google_gke_hub_feature_membership.default {{project}}/{{location}}/{{feature}}/{{membership}}
diff --git a/mmv1/third_party/terraform/website/docs/r/google_billing_subaccount.html.markdown b/mmv1/third_party/terraform/website/docs/r/google_billing_subaccount.html.markdown
index c28d3d3ed085..abe79ebf9084 100644
--- a/mmv1/third_party/terraform/website/docs/r/google_billing_subaccount.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/google_billing_subaccount.html.markdown
@@ -42,6 +42,19 @@ The following additional attributes are exported:
 
 Billing Subaccounts can be imported using any of these accepted formats:
 
+* `billingAccounts/{billing_account_id}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Billing Subaccounts using one of the formats above. For example:
+
+```tf
+import {
+  id = "billingAccounts/{billing_account_id}"
+  to = google_billing_subaccount.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Billing Subaccounts can be imported using one of the formats above. For example:
+
 ```
 $ terraform import google_billing_subaccount.default billingAccounts/{billing_account_id}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/google_folder.html.markdown b/mmv1/third_party/terraform/website/docs/r/google_folder.html.markdown
index 7d3b5c9b8e29..3c5dc24c4727 100644
--- a/mmv1/third_party/terraform/website/docs/r/google_folder.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/google_folder.html.markdown
@@ -52,6 +52,7 @@ In addition to the arguments listed above, the following computed attributes are
 exported:
 
 * `name` - The resource name of the Folder. Its format is folders/{folder_id}.
+* `folder_id` - The folder id from the name "folders/{folder_id}"
 * `lifecycle_state` - The lifecycle state of the folder such as `ACTIVE` or `DELETE_REQUESTED`.
 * `create_time` - Timestamp when the Folder was created. Assigned by the server.
     A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".
@@ -60,8 +61,21 @@ exported:
 
 Folders can be imported using the folder's id, e.g.
 
+* `folders/{{folder_id}}`
+* `{{folder_id}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Folders using one of the formats above. For example:
+
+```tf
+import {
+  id = "folders/{{folder_id}}"
+  to = google_folder.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Folders can be imported using one of the formats above. For example:
+
 ```
-# Both syntaxes are valid
-$ terraform import google_folder.department1 1234567
-$ terraform import google_folder.department1 folders/1234567
+$ terraform import google_folder.default {{folder_id}}
+$ terraform import google_folder.default folders/{{folder_id}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/google_folder_iam.html.markdown b/mmv1/third_party/terraform/website/docs/r/google_folder_iam.html.markdown
index 1c4b861ee466..8165d0c311d7 100644
--- a/mmv1/third_party/terraform/website/docs/r/google_folder_iam.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/google_folder_iam.html.markdown
@@ -212,33 +212,95 @@ exported:
 
 ## Import
 
-IAM member imports use space-delimited identifiers; the resource in question, the role, and the account.  This member resource can be imported using the `folder`, role, and member e.g.
+-> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
+ full name of the custom role, e.g. `organizations/{{org_id}}/roles/{{role_id}}`.
+ 
+-> **Conditional IAM Bindings**: If you're importing a IAM binding with a condition block, make sure
+ to include the title of condition, e.g. `terraform import google_folder_iam_binding.my_folder "folder roles/{{role_id}} condition-title"`
+ 
 
-```
-$ terraform import google_folder_iam_member.my_folder "folder roles/viewer user:foo@example.com"
+### Importing IAM members
+
+IAM member imports use space-delimited identifiers that contain the resource's `folder_id`, `role`, and `member` e.g.
+
+* `"folders/{{folder_id}} roles/viewer user:foo@example.com"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM members:
+
+```tf
+import {
+  id = "folders/{{folder_id}} roles/viewer user:foo@example.com"
+  to = google_folder_iam_member.default
+}
 ```
 
-IAM binding imports use space-delimited identifiers; the resource in question and the role.  This binding resource can be imported using the `folder` and role, e.g.
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
 
 ```
-terraform import google_folder_iam_binding.my_folder "folder roles/viewer"
+$ terraform import google_folder_iam_member.default "folder roles/viewer user:foo@example.com"
 ```
 
-IAM policy imports use the identifier of the resource in question.  This policy resource can be imported using the `folder`.
+### Importing IAM bindings
+
+IAM binding imports use space-delimited identifiers that contain the resource's `folder_id` and `role`, e.g.
+
+* `"folders/{{folder_id}} roles/viewer"`
 
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM bindings:
+
+```tf
+import {
+  id = "folders/{{folder_id}} roles/viewer"
+  to = google_folder_iam_binding.default
+}
 ```
-$ terraform import google_folder_iam_policy.my_folder folder
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+$ terraform import google_folder_iam_binding.default "folder roles/viewer"
 ```
 
-IAM audit config imports use the identifier of the resource in question and the service, e.g.
+### Importing IAM policies
+
+IAM policy imports use the identifier of the Folder only. For example:
+
+* `folders/{{folder_id}}`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM policies:
+
+```tf
+import {
+  id = "folders/{{folder_id}}"
+  to = google_folder_iam_policy.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
 
 ```
-terraform import google_folder_iam_audit_config.my_folder "folder foo.googleapis.com"
+$ terraform import google_folder_iam_policy.default folders/{{folder_id}}
 ```
 
--> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
- full name of the custom role, e.g. `organizations/{{org_id}}/roles/{{role_id}}`.
- 
--> **Conditional IAM Bindings**: If you're importing a IAM binding with a condition block, make sure
- to include the title of condition, e.g. `terraform import google_folder_iam_binding.my_folder "folder roles/{{role_id}} condition-title"`
- 
+
+### Importing Audit Configs
+
+An audit config can be imported into a `google_folder_iam_audit_config` resource using the resource's `folder_id` and the `service`, e.g:
+
+* `"folder/{{folder_id}} foo.googleapis.com"`
+
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import audit configs:
+
+```tf
+import {
+  id = "folder/{{folder_id}} foo.googleapis.com"
+  to = google_folder_iam_audit_config.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+terraform import google_folder_iam_audit_config.default "folder/{{folder_id}} foo.googleapis.com"
+```
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/website/docs/r/google_folder_organization_policy.html.markdown b/mmv1/third_party/terraform/website/docs/r/google_folder_organization_policy.html.markdown
index 88bcb7542712..bff1618dfd38 100644
--- a/mmv1/third_party/terraform/website/docs/r/google_folder_organization_policy.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/google_folder_organization_policy.html.markdown
@@ -138,7 +138,21 @@ exported:
 
 Folder organization policies can be imported using any of the follow formats:
 
+* `folders/{{folder_id}}/constraints/serviceuser.services`
+* `{{folder_id}}/serviceuser.services`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import folder organization policies using one of the formats above. For example:
+
+```tf
+import {
+  id = "folders/{{folder_id}}/constraints/serviceuser.services"
+  to = google_folder_organization_policy.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), folder organization policies can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_folder_organization_policy.policy folders/folder-1234/constraints/serviceuser.services
-$ terraform import google_folder_organization_policy.policy folder-1234/serviceuser.services
+* `$ terraform import google_folder_organization_policy.default folders/* ``{{folder_id}}/constraints/serviceuser.services`
+* `* `$ terraform import google_folder_organization_policy.default {{folder_id}}/``serviceuser.services
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/google_kms_crypto_key_iam.html.markdown b/mmv1/third_party/terraform/website/docs/r/google_kms_crypto_key_iam.html.markdown
index 1567f3ff1fee..875cc2938a46 100644
--- a/mmv1/third_party/terraform/website/docs/r/google_kms_crypto_key_iam.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/google_kms_crypto_key_iam.html.markdown
@@ -176,20 +176,65 @@ exported:
 
 ## Import
 
-IAM member imports use space-delimited identifiers; the resource in question, the role, and the account.  This member resource can be imported using the `crypto_key_id`, role, and member identity e.g.
+### Importing IAM members
 
+IAM member imports use space-delimited identifiers that contain the resource's `crypto_key_id`, `role`, and member identity e.g.
+
+* `"{{project_id}}/{{location}}/{{key_ring_name}}/{{crypto_key_name}} roles/viewer user:foo@example.com"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM members:
+
+```tf
+import {
+  id = "{{project_id}}/{{location}}/{{key_ring_name}}/{{crypto_key_name}} roles/viewer user:foo@example.com"
+  to = google_kms_crypto_key_iam_member.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+$ terraform import google_kms_crypto_key_iam_member.default "{{project_id}}/{{location}}/{{key_ring_name}}/{{crypto_key_name}} roles/viewer user:foo@example.com"
 ```
-$ terraform import google_kms_crypto_key_iam_member.crypto_key "your-project-id/location-name/key-ring-name/key-name roles/viewer user:foo@example.com"
+
+### Importing IAM bindings
+
+IAM binding imports use space-delimited identifiers that contain the `crypto_key_id` and role, e.g.
+
+* `"{{project_id}}/{{location}}/{{key_ring_name}}/{{crypto_key_name}} roles/viewer"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM bindings:
+
+```tf
+import {
+  id = "{{project_id}}/{{location}}/{{key_ring_name}}/{{crypto_key_name}} roles/viewer"
+  to = google_kms_crypto_key_iam_binding.default
+}
 ```
 
-IAM binding imports use space-delimited identifiers; first the resource in question and then the role.  These bindings can be imported using the `crypto_key_id` and role, e.g.
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
 
 ```
-$ terraform import google_kms_crypto_key_iam_binding.crypto_key "your-project-id/location-name/key-ring-name/key-name roles/editor"
+$ terraform import google_kms_crypto_key_iam_binding.default "{{project_id}}/{{location}}/{{key_ring_name}}/{{crypto_key_name}} roles/viewer"
 ```
 
-IAM policy imports use the identifier of the resource in question.  This policy resource can be imported using the `crypto_key_id`, e.g.
+### Importing IAM policies
+
+IAM policy imports use the identifier of the KMS crypto key only. For example:
 
+* `{{project_id}}/{{location}}/{{key_ring_name}}/{{crypto_key_name}}`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM policies:
+
+```tf
+import {
+  id = "{{project_id}}/{{location}}/{{key_ring_name}}/{{crypto_key_name}}"
+  to = google_kms_crypto_key_iam_policy.default
+}
 ```
-$ terraform import google_kms_crypto_key_iam_policy.crypto_key your-project-id/location-name/key-ring-name/key-name
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
 ```
+$ terraform import google_kms_crypto_key_iam_policy.default {{project_id}}/{{location}}/{{key_ring_name}}/{{crypto_key_name}}
+```
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/website/docs/r/google_kms_key_ring_iam.html.markdown b/mmv1/third_party/terraform/website/docs/r/google_kms_key_ring_iam.html.markdown
index 5a5d38d1850f..4d6ed617ea98 100644
--- a/mmv1/third_party/terraform/website/docs/r/google_kms_key_ring_iam.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/google_kms_key_ring_iam.html.markdown
@@ -179,20 +179,65 @@ exported:
 
 ## Import
 
-IAM member imports use space-delimited identifiers; the resource in question, the role, and the account.  This member resource can be imported using the `key_ring_id`, role, and account e.g.
+### Importing IAM members
 
+IAM member imports use space-delimited identifiers that contain the resource's  `key_ring_id`, `role`, and `member` e.g.
+
+* `"{{project_id}}/{{location}}/{{key_ring_name}} roles/viewer user:foo@example.com"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM members:
+
+```tf
+import {
+  id = "{{project_id}}/{{location}}/{{key_ring_name}} roles/viewer user:foo@example.com"
+  to = google_kms_key_ring_iam_member.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+$ terraform import google_kms_key_ring_iam_member.default "{{project_id}}/{{location}}/{{key_ring_name}} roles/viewer user:foo@example.com"
 ```
-$ terraform import google_kms_key_ring_iam_member.key_ring_iam "your-project-id/location-name/key-ring-name roles/viewer user:foo@example.com"
+
+### Importing IAM bindings
+
+IAM binding imports use space-delimited identifiers that contain the `key_ring_id` and role, e.g.
+
+* `"{{project_id}}/{{location}}/{{key_ring_name}} roles/viewer"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM bindings:
+
+```tf
+import {
+  id = "{{project_id}}/{{location}}/{{key_ring_name}} roles/viewer"
+  to = google_kms_key_ring_iam_binding.default
+}
 ```
 
-IAM binding imports use space-delimited identifiers; the resource in question and the role.  This binding resource can be imported using the `key_ring_id` and role, e.g.
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
 
 ```
-$ terraform import google_kms_key_ring_iam_binding.key_ring_iam "your-project-id/location-name/key-ring-name roles/cloudkms.admin"
+$ terraform import google_kms_key_ring_iam_binding.default "{{project_id}}/{{location}}/{{key_ring_name}} roles/viewer"
 ```
 
-IAM policy imports use the identifier of the resource in question.  This policy resource can be imported using the `key_ring_id`, e.g.
+### Importing IAM policies
+
+IAM policy imports use the identifier of the Cloud KMS key ring only. For example:
 
+* `{{project_id}}/{{location}}/{{key_ring_name}}`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM policies:
+
+```tf
+import {
+  id = "{{project_id}}/{{location}}/{{key_ring_name}}"
+  to = google_kms_key_ring_iam_policy.default
+}
 ```
-$ terraform import google_kms_key_ring_iam_policy.key_ring_iam your-project-id/location-name/key-ring-name
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
 ```
+$ terraform import google_kms_key_ring_iam_policy.default {{project_id}}/{{location}}/{{key_ring_name}}
+```
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/website/docs/r/google_organization_iam.html.markdown b/mmv1/third_party/terraform/website/docs/r/google_organization_iam.html.markdown
index 95c9802fe8b4..bb1527d00471 100644
--- a/mmv1/third_party/terraform/website/docs/r/google_organization_iam.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/google_organization_iam.html.markdown
@@ -215,32 +215,94 @@ exported:
 
 ## Import
 
-IAM member imports use space-delimited identifiers; the resource in question, the role, and the account.  This member resource can be imported using the `org_id`, role, and member e.g.
+-> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
+ full name of the custom role, e.g. `organizations/{{org_id}}/roles/{{role_id}}`.
 
-```
-$ terraform import google_organization_iam_member.my_organization "your-orgid roles/viewer user:foo@example.com"
+-> **Conditional IAM Bindings**: If you're importing a IAM binding with a condition block, make sure
+ to include the title of condition, e.g. `terraform import google_organization_iam_binding.my_organization "your-org-id roles/{{role_id}} condition-title"`
+
+### Importing IAM members
+
+IAM member imports use space-delimited identifiers that contain the resource's `org_id`, `role`, and `member` e.g.
+
+* `"{{org_id}} roles/viewer user:foo@example.com"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM members:
+
+```tf
+import {
+  id = "{{org_id}} roles/viewer user:foo@example.com"
+  to = google_organization_iam_member.default
+}
 ```
 
-IAM binding imports use space-delimited identifiers; the resource in question and the role.  This binding resource can be imported using the `org_id` and role, e.g.
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
 
 ```
-terraform import google_organization_iam_binding.my_organization "your-org-id roles/viewer"
+$ terraform import google_organization_iam_member.default "{{org_id}} roles/viewer user:foo@example.com"
+```
+
+### Importing IAM bindings
+
+IAM binding imports use space-delimited identifiers that contain the `org_id` and role, e.g.
+
+* `"{{org_id}} roles/viewer"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM bindings:
+
+```tf
+import {
+  id = "{{org_id}} roles/viewer"
+  to = google_organization_iam_binding.default
+}
 ```
 
-IAM policy imports use the identifier of the resource in question.  This policy resource can be imported using the `org_id`.
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
 
 ```
-$ terraform import google_organization_iam_policy.my_organization your-org-id
+terraform import google_organization_iam_binding.default "{{org_id}} roles/viewer"
 ```
 
-IAM audit config imports use the identifier of the resource in question and the service, e.g.
+### Importing IAM policies
+
+IAM policy imports use the identifier of the Organization only. For example:
+
+* `"{{org_id}}"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM policies:
+
+```tf
+import {
+  id = "{{org_id}}"
+  to = google_organization_iam_policy.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
 
 ```
-terraform import google_organization_iam_audit_config.my_organization "your-organization-id foo.googleapis.com"
+$ terraform import google_organization_iam_policy.default "{{org_id}}"
 ```
 
--> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
- full name of the custom role, e.g. `organizations/{{org_id}}/roles/{{role_id}}`.
 
--> **Conditional IAM Bindings**: If you're importing a IAM binding with a condition block, make sure
- to include the title of condition, e.g. `terraform import google_organization_iam_binding.my_organization "your-org-id roles/{{role_id}} condition-title"`
+### Importing Audit Configs
+
+An audit config can be imported into a `google_organization_iam_audit_config` resource using the resource's `org_id` and the `service`, e.g:
+
+* `"{{org_id}} foo.googleapis.com"`
+
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import audit configs:
+
+```tf
+import {
+  id = "{{org_id}} foo.googleapis.com"
+  to = google_organization_iam_audit_config.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+terraform import google_organization_iam_audit_config.default "{{org_id}} foo.googleapis.com"
+```
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/website/docs/r/google_organization_policy.html.markdown b/mmv1/third_party/terraform/website/docs/r/google_organization_policy.html.markdown
index 1aa2c2d43ff9..94350af6f286 100644
--- a/mmv1/third_party/terraform/website/docs/r/google_organization_policy.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/google_organization_policy.html.markdown
@@ -137,8 +137,21 @@ exported:
 
 Organization Policies can be imported using the `org_id` and the `constraint`, e.g.
 
+* `{{org_id}}/constraints/{{constraint}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Organization Policies using one of the formats above. For example:
+
+```tf
+import {
+  id = "{{org_id}}/constraints/{{constraint}}"
+  to = google_organization_policy.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Organization Policies can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_organization_policy.services_policy 123456789/constraints/serviceuser.services
+$ terraform import google_organization_policy.default {{org_id}}/constraints/{{constraint}}
 ```
 
 It is all right if the constraint contains a slash, as in the example above.
diff --git a/mmv1/third_party/terraform/website/docs/r/google_project.html.markdown b/mmv1/third_party/terraform/website/docs/r/google_project.html.markdown
index 36f5eb06919c..8972fdeecb08 100644
--- a/mmv1/third_party/terraform/website/docs/r/google_project.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/google_project.html.markdown
@@ -82,6 +82,14 @@ The following arguments are supported:
     without deleting the Project via the Google API.
 
 * `labels` - (Optional) A set of key/value label pairs to assign to the project.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+	Please refer to the field 'effective_labels' for all of the labels present on the resource.
+
+* `terraform_labels` -
+  The combination of labels configured directly on the resource and default labels configured on the provider.
+
+* `effective_labels` -
+  All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
 
 * `auto_create_network` - (Optional) Controls whether the 'default' network exists on the project. Defaults
     to `true`, where it is created. If set to `false`, the default network will still be created by GCP but
@@ -112,6 +120,19 @@ This resource provides the following
 
 Projects can be imported using the `project_id`, e.g.
 
+* `{{project_id}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Projects using one of the formats above. For example:
+
+```tf
+import {
+  id = "{{project_id}}"
+  to = google_project.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Projects can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_project.my_project your-project-id
+$ terraform import google_project.default {{project_id}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/google_project_iam.html.markdown b/mmv1/third_party/terraform/website/docs/r/google_project_iam.html.markdown
index f226bfeb518a..419315c503d7 100644
--- a/mmv1/third_party/terraform/website/docs/r/google_project_iam.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/google_project_iam.html.markdown
@@ -212,33 +212,93 @@ exported:
 
 ## Import
 
-IAM member imports use space-delimited identifiers; the resource in question, the role, and the account.  This member resource can be imported using the `project_id`, role, and member e.g.
+-> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
+ full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
 
-```
-$ terraform import google_project_iam_member.my_project "your-project-id roles/viewer user:foo@example.com"
+-> **Conditional IAM Bindings**: If you're importing a IAM binding with a condition block, make sure
+ to include the title of condition, e.g. `terraform import google_project_iam_binding.my_project "{{your-project-id}} roles/{{role_id}} condition-title"`
+ 
+### Importing IAM members
+
+IAM member imports use space-delimited identifiers that contain the resource's  `project_id`, `role`, and `member` e.g.
+
+* `"{{project_id}} roles/viewer user:foo@example.com"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM members:
+
+```tf
+import {
+  id = ""{{project_id}} roles/viewer user:foo@example.com"m"
+  to = google_project_iam_member.default
+}
 ```
 
-IAM binding imports use space-delimited identifiers; the resource in question and the role.  This binding resource can be imported using the `project_id` and role, e.g.
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
 
 ```
-terraform import google_project_iam_binding.my_project "your-project-id roles/viewer"
+$ terraform import google_project_iam_member.default "{{project_id}} roles/viewer user:foo@example.com"
+```
+
+### Importing IAM bindings
+
+IAM binding imports use space-delimited identifiers that contain the `org_id` and role, e.g.
+
+* `"{{project_id}} roles/viewer"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM bindings:
+
+```tf
+import {
+  id = "{{project_id}} roles/viewer"
+  to = google_project_iam_binding.default
+}
 ```
 
-IAM policy imports use the identifier of the resource in question.  This policy resource can be imported using the `project_id`.
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
 
 ```
-$ terraform import google_project_iam_policy.my_project your-project-id
+terraform import google_project_iam_binding.default "{{project_id}} roles/viewer"
 ```
 
-IAM audit config imports use the identifier of the resource in question and the service, e.g.
+### Importing IAM policies
+
+IAM policy imports use the identifier of the Project only. For example:
+
+* `"{{project_id}}"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM policies:
+
+```tf
+import {
+  id = "{{project_id}}"
+  to = google_project_iam_policy.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
 
 ```
-terraform import google_project_iam_audit_config.my_project "your-project-id foo.googleapis.com"
+$ terraform import google_project_iam_policy.default {{project_id}}
 ```
 
--> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
- full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
+### Importing Audit Configs
 
--> **Conditional IAM Bindings**: If you're importing a IAM binding with a condition block, make sure
- to include the title of condition, e.g. `terraform import google_project_iam_binding.my_project "{{your-project-id}} roles/{{role_id}} condition-title"`
- 
+An audit config can be imported into a `google_project_iam_audit_config` resource using the resource's `project_id` and the `service`, e.g:
+
+* `"{{project_id}} foo.googleapis.com"`
+
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import audit configs:
+
+```tf
+import {
+  id = "{{project_id}} foo.googleapis.com"
+  to = google_project_iam_audit_config.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+terraform import google_project_iam_audit_config.default "{{project_id}} foo.googleapis.com"
+```
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/website/docs/r/google_project_iam_custom_role.html.markdown b/mmv1/third_party/terraform/website/docs/r/google_project_iam_custom_role.html.markdown
index 33af6c36e9fd..a703f4cb76ad 100644
--- a/mmv1/third_party/terraform/website/docs/r/google_project_iam_custom_role.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/google_project_iam_custom_role.html.markdown
@@ -63,9 +63,23 @@ exported:
 
 ## Import
 
-
 Custom Roles can be imported using any of these accepted formats:
 
+* `projects/{{project}}/roles/{{role_id}}`
+* `{{project}}/{{role_id}}`
+* `{{role_id}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Custom Roles using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project}}/roles/{{role_id}}"
+  to = google_project_iam_custom_role.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Custom Roles can be imported using one of the formats above. For example:
+
 ```
 $ terraform import google_project_iam_custom_role.default projects/{{project}}/roles/{{role_id}}
 $ terraform import google_project_iam_custom_role.default {{project}}/{{role_id}}
diff --git a/mmv1/third_party/terraform/website/docs/r/google_project_organization_policy.html.markdown b/mmv1/third_party/terraform/website/docs/r/google_project_organization_policy.html.markdown
index 51fba389fe14..79547d12575e 100644
--- a/mmv1/third_party/terraform/website/docs/r/google_project_organization_policy.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/google_project_organization_policy.html.markdown
@@ -137,8 +137,23 @@ exported:
 
 Project organization policies can be imported using any of the follow formats:
 
+* `projects/{{project_id}}:constraints/{{constraint}}`
+* `{{project_id}}:constraints/{{constraint}}`
+* `{{project_id}}:{{constraint}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import project organization policies using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project_id}}:constraints/{{constraint}}"
+  to = google_project_organization_policy.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), project organization policies can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_project_organization_policy.policy projects/test-project:constraints/serviceuser.services
-$ terraform import google_project_organization_policy.policy test-project:constraints/serviceuser.services
-$ terraform import google_project_organization_policy.policy test-project:serviceuser.services
+$ terraform import google_project_organization_policy.default projects/{{project_id}}:constraints/{{constraint}}
+$ terraform import google_project_organization_policy.default {{project_id}}:constraints/{{constraint}}
+$ terraform import google_project_organization_policy.default {{project_id}}:{{constraint}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/google_project_service.html.markdown b/mmv1/third_party/terraform/website/docs/r/google_project_service.html.markdown
index 2099eb4e0903..0347f5f46082 100644
--- a/mmv1/third_party/terraform/website/docs/r/google_project_service.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/google_project_service.html.markdown
@@ -76,8 +76,21 @@ This resource provides the following
 
 Project services can be imported using the `project_id` and `service`, e.g.
 
+* `{{project_id}}/{{service}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import project services using one of the formats above. For example:
+
+```tf
+import {
+  id = "{{project_id}}/{{service}}"
+  to = google_project_service.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), project services can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_project_service.my_project your-project-id/iam.googleapis.com
+$ terraform import google_project_service.default {{project_id}}/{{service}}
 ```
 
 Note that unlike other resources that fail if they already exist,
diff --git a/mmv1/third_party/terraform/website/docs/r/google_service_account.html.markdown b/mmv1/third_party/terraform/website/docs/r/google_service_account.html.markdown
index d39b86fc40f8..95a409bc8bc7 100644
--- a/mmv1/third_party/terraform/website/docs/r/google_service_account.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/google_service_account.html.markdown
@@ -79,6 +79,19 @@ This resource provides the following
 
 Service accounts can be imported using their URI, e.g.
 
+* `projects/{{project_id}}/serviceAccounts/{{email}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import service accounts using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project_id}}/serviceAccounts/{{email}}"
+  to = google_service_account.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), service accounts can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_service_account.my_sa projects/my-project/serviceAccounts/my-sa@my-project.iam.gserviceaccount.com
+$ terraform import google_service_account.default projects/{{project_id}}/serviceAccounts/{{email}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/google_service_account_iam.html.markdown b/mmv1/third_party/terraform/website/docs/r/google_service_account_iam.html.markdown
index 669d2b99add9..a2c6d4c170ea 100644
--- a/mmv1/third_party/terraform/website/docs/r/google_service_account_iam.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/google_service_account_iam.html.markdown
@@ -4,7 +4,7 @@ description: |-
  Collection of resources to manage IAM policy for a service account.
 ---
 
-# IAM policy for service account
+# IAM policy for Service Account
 
 When managing IAM roles, you can treat a service account either as a resource or as an identity. This resource is to add iam policy bindings to a service account resource, such as allowing the members to run operations as or modify the service account. To configure permissions for a service account on other GCP resources, use the [google_project_iam](google_project_iam.html) set of resources.
 
@@ -176,22 +176,78 @@ exported:
 
 ## Import
 
-Service account IAM resources can be imported using the project, service account email, role, member identity, and condition (beta).
+-> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
+full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
+
+### Importing IAM members
+
+IAM member imports use space-delimited identifiers that contains the `service_account_id`, `role`, and `member`. For example:
+
+* `"projects/{{project_id}}/serviceAccounts/{{service_account_email}} roles/editor user:foo@example.com"`
 
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM members:
+
+```tf
+import {
+  id = "projects/{{project_id}}/serviceAccounts/{{service_account_email}} roles/editor user:foo@example.com"
+  to = google_service_account_iam_member.default
+}
 ```
-$ terraform import google_service_account_iam_policy.admin-account-iam projects/{your-project-id}/serviceAccounts/{your-service-account-email}
 
-$ terraform import google_service_account_iam_binding.admin-account-iam "projects/{your-project-id}/serviceAccounts/{your-service-account-email} roles/iam.serviceAccountUser"
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
 
-$ terraform import google_service_account_iam_member.admin-account-iam "projects/{your-project-id}/serviceAccounts/{your-service-account-email} roles/editor user:foo@example.com"
+```
+$ terraform import google_service_account_iam_member.default "projects/{{project_id}}/serviceAccounts/{{service_account_email}} roles/editor user:foo@example.com"
 ```
 
--> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
-full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
+### Importing IAM bindings
+
+IAM binding imports use space-delimited identifiers that contains the `service_account_id` and `role`. For example:
+
+* `"projects/{{project_id}}/serviceAccounts/{{service_account_email}} roles/editor"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM bindings:
+
+```tf
+import {
+  id = "projects/{{project_id}}/serviceAccounts/{{service_account_email}} roles/editor"
+  to = google_service_account_iam_binding.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+$ terraform import google_service_account_iam_binding.default "projects/{{project_id}}/serviceAccounts/{{service_account_email}} roles/editor"
+```
+
+### Importing IAM policies
+
+IAM policy imports use the identifier of the Service Account resource in question. For example:
+
+* `"projects/{{project_id}}/serviceAccounts/{{service_account_email}}"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM policies:
+
+```tf
+import {
+  id = "projects/{{project_id}}/serviceAccounts/{{service_account_email}}"
+  to = google_service_account_iam_policy.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+$ terraform import google_service_account_iam_policy.default projects/{{project_id}}/serviceAccounts/{{service_account_email}}
+```
+
+### Importing with conditions:
+
+Here are examples of importing IAM memberships and bindings that include conditions:
 
-With conditions:
 ```
 $ terraform import google_service_account_iam_binding.admin-account-iam "projects/{your-project-id}/serviceAccounts/{your-service-account-email} roles/iam.serviceAccountUser expires_after_2019_12_31"
 
 $ terraform import google_service_account_iam_member.admin-account-iam "projects/{your-project-id}/serviceAccounts/{your-service-account-email} roles/iam.serviceAccountUser user:foo@example.com expires_after_2019_12_31"
-```
+```
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/website/docs/r/google_service_networking_peered_dns_domain.html.markdown b/mmv1/third_party/terraform/website/docs/r/google_service_networking_peered_dns_domain.html.markdown
index 3c8fb0f250a4..1d72c6e7212d 100644
--- a/mmv1/third_party/terraform/website/docs/r/google_service_networking_peered_dns_domain.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/google_service_networking_peered_dns_domain.html.markdown
@@ -56,19 +56,31 @@ This resource provides the following
 
 ## Import
 
-Project peered DNS domains can be imported using the `service`, `project`, `network` and `name`, e.g.
-
-```
-$ terraform import google_service_networking_peered_dns_domain.my_domain services/{service}/projects/{project}/global/networks/{network}/peeredDnsDomains/{name}
-```
-
-Where:
+Project peered DNS domains can be imported using the `service`, `project`, `network` and `name`, where:
 
 - `service` is the service connection, defaults to `servicenetworking.googleapis.com`.
 - `project` is the producer project name.
 - `network` is the consumer network name.
 - `name` is the name of your peered DNS domain.
 
+* `services/{service}/projects/{project}/global/networks/{network}/peeredDnsDomains/{name}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import project peered DNS domains using one of the formats above. For example:
+
+```tf
+import {
+  id = "services/{service}/projects/{project}/global/networks/{network}/peeredDnsDomains/{name}"
+  to = google_service_networking_peered_dns_domain.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), project peered DNS domains can be imported using one of the formats above. For example:
+
+```
+$ terraform import google_service_networking_peered_dns_domain.default services/{service}/projects/{project}/global/networks/{network}/peeredDnsDomains/{name}
+```
+
+
 ## User Project Overrides
 
 This resource supports [User Project Overrides](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/provider_reference#user_project_override).
diff --git a/mmv1/third_party/terraform/website/docs/r/google_tags_location_tag_binding.html.markdown b/mmv1/third_party/terraform/website/docs/r/google_tags_location_tag_binding.html.markdown
index 19522be18f8f..1787e3696689 100644
--- a/mmv1/third_party/terraform/website/docs/r/google_tags_location_tag_binding.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/google_tags_location_tag_binding.html.markdown
@@ -1,23 +1,22 @@
 ---
 subcategory: "Tags"
 description: |-
-  A LocationTagBinding represents a connection between a TagValue and a Regional cloud resources.
+  A LocationTagBinding represents a connection between a TagValue and a non-global cloud resource.
 ---
 
 # google\_tags\_location\_tag\_binding
 
-A TagBinding represents a connection between a TagValue and a Regional cloud resource (currently project, folder, or organization). Once a TagBinding is created, the TagValue is applied to all the descendants of the cloud resource.
+A LocationTagBinding represents a connection between a TagValue and a non-global target such as a Cloud Run Service or Compute Instance. Once a LocationTagBinding is created, the TagValue is applied to all the descendants of the cloud resource.
 
-
-To get more information about TagBinding, see:
+To get more information about LocationTagBinding, see:
 
 * [API documentation](https://cloud.google.com/resource-manager/reference/rest/v3/tagBindings)
 * How-to Guides
     * [Official Documentation](https://cloud.google.com/resource-manager/docs/tags/tags-creating-and-managing)
 
-## Example Usage
+## Example Usage - Cloud Run Service
 
-To bind a tag to a Cloud Run instance:
+To bind a tag to a Cloud Run service:
 
 ```hcl
 resource "google_project" "project" {
@@ -45,7 +44,7 @@ resource "google_tags_location_tag_binding" "binding" {
 }
 ```
 
-To bind a (firewall) tag to compute instance:
+## Example Usage - Compute Instance
 
 ```hcl
 resource "google_project" "project" {
@@ -88,7 +87,7 @@ The following arguments are supported:
 
 * `location` -
   (Required)
-  Location of the resource.
+  Location of the target resource.
 
 - - -
 
@@ -115,7 +114,20 @@ This resource provides the following
 ## Import
 
 
-TagBinding can be imported using any of these accepted formats:
+LocationTagBinding can be imported using any of these accepted formats:
+
+* `{{location}}/{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import TagBinding using one of the formats above. For example:
+
+```tf
+import {
+  id = "{{location}}/{{name}}"
+  to = google_tags_location_tag_binding.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), TagBinding can be imported using one of the formats above. For example:
 
 ```
 $ terraform import google_tags_location_tag_binding.default {{location}}/{{name}}
diff --git a/mmv1/third_party/terraform/website/docs/r/healthcare_dataset_iam.html.markdown b/mmv1/third_party/terraform/website/docs/r/healthcare_dataset_iam.html.markdown
index 75eb160a2eff..df70efa0f97a 100644
--- a/mmv1/third_party/terraform/website/docs/r/healthcare_dataset_iam.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/healthcare_dataset_iam.html.markdown
@@ -95,23 +95,68 @@ exported:
 
 ## Import
 
-IAM member imports use space-delimited identifiers; the resource in question, the role, and the account.  This member resource can be imported using the `dataset_id`, role, and account e.g.
+-> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
+ full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
 
-```
-$ terraform import google_healthcare_dataset_iam_member.dataset_iam "your-project-id/location-name/dataset-name roles/viewer user:foo@example.com"
+### Importing IAM members
+
+IAM member imports use space-delimited identifiers that contains the `dataset_id`, `role`, and `member`. For example:
+
+* `"{{project_id}}/{{location}}/{{dataset}} roles/editor jane@example.com"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM members:
+
+```tf
+import {
+  id = "{{project_id}}/{{location}}/{{dataset}} roles/editor jane@example.com"
+  to = google_healthcare_dataset_iam_member.default
+}
 ```
 
-IAM binding imports use space-delimited identifiers; the resource in question and the role.  This binding resource can be imported using the `dataset_id` and role, e.g.
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
 
 ```
-$ terraform import google_healthcare_dataset_iam_binding.dataset_iam "your-project-id/location-name/dataset-name roles/viewer"
+$ terraform import google_healthcare_dataset_iam_member.default "{{project_id}}/{{location}}/{{dataset}} roles/editor jane@example.com"
+```
+
+### Importing IAM bindings
+
+IAM binding imports use space-delimited identifiers that contain the resource's `dataset_id` and `role`. For example:
+
+* `"{{project_id}}/{{location}}/{{dataset}} roles/editor"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM bindings:
+
+```tf
+import {
+  id = "{{project_id}}/{{location}}/{{dataset}} roles/editor"
+  to = google_healthcare_dataset_iam_binding.default
+}
 ```
 
-IAM policy imports use the identifier of the resource in question.  This policy resource can be imported using the `dataset_id`, role, and account e.g.
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
 
 ```
-$ terraform import google_healthcare_dataset_iam_policy.dataset_iam your-project-id/location-name/dataset-name
+$ terraform import google_healthcare_dataset_iam_binding.default "{{project_id}}/{{location}}/{{dataset}} roles/editor"
 ```
 
--> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
- full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
+### Importing IAM policies
+
+IAM policy imports use the identifier of the Healthcase Dataset resource. For example:
+
+* `"{{project_id}}/{{location}}/{{dataset}}"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM policies:
+
+```tf
+import {
+  id = "{{project_id}}/{{location}}/{{dataset}}"
+  to = google_healthcare_dataset_iam_policy.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+$ terraform import google_healthcare_dataset_iam_policy.default {{project_id}}/{{location}}/{{dataset}}
+```
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/website/docs/r/healthcare_dicom_store_iam.html.markdown b/mmv1/third_party/terraform/website/docs/r/healthcare_dicom_store_iam.html.markdown
index 3bf31ce4ede3..06121b26e9e7 100644
--- a/mmv1/third_party/terraform/website/docs/r/healthcare_dicom_store_iam.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/healthcare_dicom_store_iam.html.markdown
@@ -95,20 +95,68 @@ exported:
 
 ## Import
 
-IAM member imports use space-delimited identifiers; the resource in question, the role, and the account.  This member resource can be imported using the `dicom_store_id`, role, and account e.g.
+-> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
+ full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
 
+### Importing IAM members
+
+IAM member imports use space-delimited identifiers that contains the `dicom_store_id`, `role`, and `member`. For example:
+
+* `"{{project_id}}/{{location}}/{{dataset}}/{{dicom_store}} roles/editor jane@example.com"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM members:
+
+```tf
+import {
+  id = "{{project_id}}/{{location}}/{{dataset}}/{{dicom_store}} roles/editor jane@example.com"
+  to = google_healthcare_dicom_store_iam_member.default
+}
 ```
-$ terraform import google_healthcare_dicom_store_iam_member.dicom_store_iam "your-project-id/location-name/dataset-name/dicom-store-name roles/viewer user:foo@example.com"
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+$ terraform import google_healthcare_dicom_store_iam_member.default "{{project_id}}/{{location}}/{{dataset}}/{{dicom_store}} roles/editor jane@example.com"
 ```
 
-IAM binding imports use space-delimited identifiers; the resource in question and the role.  This binding resource can be imported using the `dicom_store_id` and role, e.g.
+### Importing IAM bindings
+
+IAM binding imports use space-delimited identifiers that contain the resource's `dicom_store_id` and `role`. For example:
+
+* `"{{project_id}}/{{location}}/{{dataset}}/{{dicom_store}} roles/editor"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM bindings:
 
+```tf
+import {
+  id = "{{project_id}}/{{location}}/{{dataset}}/{{dicom_store}} roles/editor"
+  to = google_healthcare_dicom_store_iam_binding.default
+}
 ```
-$ terraform import google_healthcare_dicom_store_iam_binding.dicom_store_iam "your-project-id/location-name/dataset-name/dicom-store-name roles/viewer"
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
 ```
+$ terraform import google_healthcare_dicom_store_iam_binding.default "{{project_id}}/{{location}}/{{dataset}}/{{dicom_store}} roles/editor"
+```
+
+### Importing IAM policies
 
-IAM policy imports use the identifier of the resource in question.  This policy resource can be imported using the `dicom_store_id`, role, and account e.g.
+IAM policy imports use the identifier of the Healthcare DICOM store resource. For example:
 
+* `"{{project_id}}/{{location}}/{{dataset}}/{{dicom_store}}"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM policies:
+
+```tf
+import {
+  id = "{{project_id}}/{{location}}/{{dataset}}/{{dicom_store}}"
+  to = google_healthcare_dicom_store_iam_policy.default
+}
 ```
-$ terraform import google_healthcare_dicom_store_iam_policy.dicom_store_iam your-project-id/location-name/dataset-name/dicom-store-name
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
 ```
+$ terraform import google_healthcare_dicom_store_iam_policy.default {{project_id}}/{{location}}/{{dataset}}/{{dicom_store}}
+```
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/website/docs/r/healthcare_fhir_store_iam.html.markdown b/mmv1/third_party/terraform/website/docs/r/healthcare_fhir_store_iam.html.markdown
index caa7c32dbc20..8987a66487aa 100644
--- a/mmv1/third_party/terraform/website/docs/r/healthcare_fhir_store_iam.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/healthcare_fhir_store_iam.html.markdown
@@ -95,20 +95,68 @@ exported:
 
 ## Import
 
-IAM member imports use space-delimited identifiers; the resource in question, the role, and the account.  This member resource can be imported using the `fhir_store_id`, role, and account e.g.
+-> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
+ full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
 
+### Importing IAM members
+
+IAM member imports use space-delimited identifiers that contains the `fhir_store_id`, `role`, and `member`. For example:
+
+* `"{{project_id}}/{{location}}/{{dataset}}/{{fhir_store}} roles/editor jane@example.com"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM members:
+
+```tf
+import {
+  id = "{{project_id}}/{{location}}/{{dataset}}/{{fhir_store}} roles/editor jane@example.com"
+  to = google_healthcare_fhir_store_iam_member.default
+}
 ```
-$ terraform import google_healthcare_fhir_store_iam_member.fhir_store_iam "your-project-id/location-name/dataset-name/fhir-store-name roles/viewer user:foo@example.com"
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+$ terraform import google_healthcare_fhir_store_iam_member.default "{{project_id}}/{{location}}/{{dataset}}/{{fhir_store}} roles/editor jane@example.com"
 ```
 
-IAM binding imports use space-delimited identifiers; the resource in question and the role.  This binding resource can be imported using the `fhir_store_id` and role, e.g.
+### Importing IAM bindings
+
+IAM binding imports use space-delimited identifiers that contain the resource's `fhir_store_id` and `role`. For example:
+
+* `"{{project_id}}/{{location}}/{{dataset}}/{{fhir_store}} roles/editor"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM bindings:
 
+```tf
+import {
+  id = "{{project_id}}/{{location}}/{{dataset}}/{{fhir_store}} roles/editor"
+  to = google_healthcare_fhir_store_iam_binding.default
+}
 ```
-$ terraform import google_healthcare_fhir_store_iam_binding.fhir_store_iam "your-project-id/location-name/dataset-name/fhir-store-name roles/viewer"
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
 ```
+$ terraform import google_healthcare_fhir_store_iam_binding.default "{{project_id}}/{{location}}/{{dataset}}/{{fhir_store}} roles/editor"
+```
+
+### Importing IAM policies
 
-IAM policy imports use the identifier of the resource in question.  This policy resource can be imported using the `fhir_store_id`, role, and account e.g.
+IAM policy imports use the identifier of the Healthcare FHIR store resource. For example:
 
+* `"{{project_id}}/{{location}}/{{dataset}}/{{fhir_store}}"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM policies:
+
+```tf
+import {
+  id = "{{project_id}}/{{location}}/{{dataset}}/{{fhir_store}}"
+  to = google_healthcare_fhir_store_iam_policy.default
+}
 ```
-$ terraform import google_healthcare_fhir_store_iam_policy.fhir_store_iam your-project-id/location-name/dataset-name/fhir-store-name
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
 ```
+$ terraform import google_healthcare_fhir_store_iam_policy.default {{project_id}}/{{location}}/{{dataset}}/{{fhir_store}}
+```
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/website/docs/r/healthcare_hl7_v2_store_iam.html.markdown b/mmv1/third_party/terraform/website/docs/r/healthcare_hl7_v2_store_iam.html.markdown
index 76960623b162..2eab2d0ada62 100644
--- a/mmv1/third_party/terraform/website/docs/r/healthcare_hl7_v2_store_iam.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/healthcare_hl7_v2_store_iam.html.markdown
@@ -96,20 +96,68 @@ exported:
 
 ## Import
 
-IAM member imports use space-delimited identifiers; the resource in question, the role, and the account.  This member resource can be imported using the `hl7_v2_store_id`, role, and account e.g.
+-> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
+ full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
 
+### Importing IAM members
+
+IAM member imports use space-delimited identifiers that contains the `hl7_v2_store_id`, `role`, and `member`. For example:
+
+* `"{{project_id}}/{{location}}/{{dataset}}/{{hl7_v2_store}} roles/editor jane@example.com"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM members:
+
+```tf
+import {
+  id = "{{project_id}}/{{location}}/{{dataset}}/{{hl7_v2_store}} roles/editor jane@example.com"
+  to = google_healthcare_hl7_v2_store_iam_member.default
+}
 ```
-$ terraform import google_healthcare_hl7_v2_store_iam_member.hl7_v2_store_iam "your-project-id/location-name/dataset-name/hl7-v2-store-name roles/viewer user:foo@example.com"
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+$ terraform import google_healthcare_hl7_v2_store_iam_member.default "{{project_id}}/{{location}}/{{dataset}}/{{hl7_v2_store}} roles/editor jane@example.com"
 ```
 
-IAM binding imports use space-delimited identifiers; the resource in question and the role.  This binding resource can be imported using the `hl7_v2_store_id` and role, e.g.
+### Importing IAM bindings
+
+IAM binding imports use space-delimited identifiers that contain the resource's `hl7_v2_store_id` and `role`. For example:
+
+* `"{{project_id}}/{{location}}/{{dataset}}/{{hl7_v2_store}} roles/editor"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM bindings:
 
+```tf
+import {
+  id = "{{project_id}}/{{location}}/{{dataset}}/{{hl7_v2_store}} roles/editor"
+  to = google_healthcare_hl7_v2_store_iam_binding.default
+}
 ```
-$ terraform import google_healthcare_hl7_v2_store_iam_binding.hl7_v2_store_iam "your-project-id/location-name/dataset-name/hl7-v2-store-name roles/viewer"
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
 ```
+$ terraform import google_healthcare_hl7_v2_store_iam_binding.default "{{project_id}}/{{location}}/{{dataset}}/{{hl7_v2_store}} roles/editor"
+```
+
+### Importing IAM policies
 
-IAM policy imports use the identifier of the resource in question.  This policy resource can be imported using the `hl7_v2_store_id`, role, and account e.g.
+IAM policy imports use the identifier of the Google Cloud Healthcare HL7v2 store resource. For example:
 
+* `"{{project_id}}/{{location}}/{{dataset}}/{{hl7_v2_store}}"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM policies:
+
+```tf
+import {
+  id = "{{project_id}}/{{location}}/{{dataset}}/{{hl7_v2_store}}"
+  to = google_healthcare_hl7_v2_store_iam_policy.default
+}
 ```
-$ terraform import google_healthcare_hl7_v2_store_iam_policy.hl7_v2_store_iam your-project-id/location-name/dataset-name/hl7-v2-store-name
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
 ```
+$ terraform import google_healthcare_hl7_v2_store_iam_policy.default {{project_id}}/{{location}}/{{dataset}}/{{hl7_v2_store}}
+```
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/website/docs/r/logging_billing_account_bucket_config.html.markdown b/mmv1/third_party/terraform/website/docs/r/logging_billing_account_bucket_config.html.markdown
index 90c5ac1285c3..d782ccd2f356 100644
--- a/mmv1/third_party/terraform/website/docs/r/logging_billing_account_bucket_config.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/logging_billing_account_bucket_config.html.markdown
@@ -16,14 +16,30 @@ Manages a billing account level logging bucket config. For more information see
 
 ```hcl
 data "google_billing_account" "default" {
-	billing_account = "00AA00-000AAA-00AA0A"
+  billing_account = "00AA00-000AAA-00AA0A"
 }
 
 resource "google_logging_billing_account_bucket_config" "basic" {
-	billing_account    = data.google_billing_account.default.billing_account
-	location  = "global"
-	retention_days = 30
-	bucket_id = "_Default"
+  billing_account = data.google_billing_account.default.billing_account
+  location        = "global"
+  retention_days  = 30
+  bucket_id       = "_Default"
+}
+```
+
+Create logging bucket with index configs
+
+```hcl
+resource "google_logging_billing_account_bucket_config" "example-billing-account-bucket-index-configs" {
+  folder          = data.google_billing_account.default.billing_account
+  location        = "global"
+  retention_days  = 30
+  bucket_id       = "_Default"
+	
+  index_configs   = {
+    file_path   = "jsonPayload.request.status"
+    type        = "INDEX_TYPE_STRING"
+  }
 }
 ```
 
@@ -41,6 +57,15 @@ The following arguments are supported:
 
 * `retention_days` - (Optional) Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. Bucket retention can not be increased on buckets outside of projects.
 
+* `index_configs` - (Optional) A list of indexed fields and related configuration data. Structure is [documented below](#nested_index_configs).
+
+<a name="nested_index_configs"></a>The `index_configs` block supports:
+
+* `field_path` - The LogEntry field path to index.
+  Note that some paths are automatically indexed, and other paths are not eligible for indexing. See [indexing documentation]( https://cloud.google.com/logging/docs/view/advanced-queries#indexed-fields) for details.
+
+* `type` - The type of data in this index. Allowed types include `INDEX_TYPE_UNSPECIFIED`, `INDEX_TYPE_STRING` and `INDEX_TYPE_INTEGER`.
+
 ## Attributes Reference
 
 In addition to the arguments listed above, the following computed attributes are
@@ -56,6 +81,19 @@ exported:
 
 This resource can be imported using the following format:
 
+* `billingAccounts/{{billingAccount}}/locations/{{location}}/buckets/{{bucket_id}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import this resource using one of the formats above. For example:
+
+```tf
+import {
+  id = "billingAccounts/{{billingAccount}}/locations/{{location}}/buckets/{{bucket_id}}"
+  to = google_logging_billing_account_bucket_config.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), this resource can be imported using one of the formats above. For example:
+
 ```
 $ terraform import google_logging_billing_account_bucket_config.default billingAccounts/{{billingAccount}}/locations/{{location}}/buckets/{{bucket_id}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/logging_billing_account_exclusion.html.markdown b/mmv1/third_party/terraform/website/docs/r/logging_billing_account_exclusion.html.markdown
index 9057b452c88c..ac55ca17f224 100644
--- a/mmv1/third_party/terraform/website/docs/r/logging_billing_account_exclusion.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/logging_billing_account_exclusion.html.markdown
@@ -55,6 +55,19 @@ In addition to the arguments listed above, the following computed attributes are
 
 Billing account logging exclusions can be imported using their URI, e.g.
 
+* `billingAccounts/{{billing_account}}/exclusions/{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import billing account logging exclusions using one of the formats above. For example:
+
+```tf
+import {
+  id = "billingAccounts/{{billing_account}}/exclusions/{{name}}"
+  to = google_logging_billing_account_exclusion.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), billing account logging exclusions can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_logging_billing_account_exclusion.my_exclusion billingAccounts/my-billing_account/exclusions/my-exclusion
+$ terraform import google_logging_billing_account_exclusion.default billingAccounts/{{billing_account}}/exclusions/{{name}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/logging_billing_account_sink.html.markdown b/mmv1/third_party/terraform/website/docs/r/logging_billing_account_sink.html.markdown
index a2a78c2a0a41..eb7749cb84c9 100644
--- a/mmv1/third_party/terraform/website/docs/r/logging_billing_account_sink.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/logging_billing_account_sink.html.markdown
@@ -101,6 +101,19 @@ exported:
 
 Billing account logging sinks can be imported using this format:
 
+* `billingAccounts/{{billing_account_id}}/sinks/{{sink_id}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import billing account logging sinks using one of the formats above. For example:
+
+```tf
+import {
+  id = "billingAccounts/{{billing_account_id}}/sinks/{{sink_id}}"
+  to = google_logging_billing_account_sink.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), billing account logging sinks can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_logging_billing_account_sink.my_sink billingAccounts/{{billing_account_id}}/sinks/{{sink_id}}
+$ terraform import google_logging_billing_account_sink.default billingAccounts/{{billing_account_id}}/sinks/{{sink_id}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/logging_folder_bucket_config.html.markdown b/mmv1/third_party/terraform/website/docs/r/logging_folder_bucket_config.html.markdown
index 7fa39b27eb8f..8824802a392c 100644
--- a/mmv1/third_party/terraform/website/docs/r/logging_folder_bucket_config.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/logging_folder_bucket_config.html.markdown
@@ -16,15 +16,20 @@ Manages a folder-level logging bucket config. For more information see
 
 ```hcl
 resource "google_folder" "default" {
-	display_name = "some-folder-name"
-	parent       = "organizations/123456789"
+  display_name = "some-folder-name"
+  parent       = "organizations/123456789"
 }
 
 resource "google_logging_folder_bucket_config" "basic" {
-	folder    = google_folder.default.name
-	location  = "global"
-	retention_days = 30
-	bucket_id = "_Default"
+  folder         = google_folder.default.name
+  location       = "global"
+  retention_days = 30
+  bucket_id      = "_Default"
+  
+  index_configs   = {
+    file_path   = "jsonPayload.request.status"
+    type        = "INDEX_TYPE_STRING"
+  }
 }
 ```
 
@@ -42,6 +47,15 @@ The following arguments are supported:
 
 * `retention_days` - (Optional) Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. Bucket retention can not be increased on buckets outside of projects.
 
+* `index_configs` - (Optional) A list of indexed fields and related configuration data. Structure is [documented below](#nested_index_configs).
+
+<a name="nested_index_configs"></a>The `index_configs` block supports:
+
+* `field_path` - The LogEntry field path to index.
+  Note that some paths are automatically indexed, and other paths are not eligible for indexing. See [indexing documentation]( https://cloud.google.com/logging/docs/view/advanced-queries#indexed-fields) for details.
+
+* `type` - The type of data in this index. Allowed types include `INDEX_TYPE_UNSPECIFIED`, `INDEX_TYPE_STRING` and `INDEX_TYPE_INTEGER`.
+
 ## Attributes Reference
 
 In addition to the arguments listed above, the following computed attributes are
@@ -57,6 +71,19 @@ exported:
 
 This resource can be imported using the following format:
 
+* `folders/{{folder}}/locations/{{location}}/buckets/{{bucket_id}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import this resource using one of the formats above. For example:
+
+```tf
+import {
+  id = "folders/{{folder}}/locations/{{location}}/buckets/{{bucket_id}}"
+  to = google_logging_folder_bucket_config.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), this resource can be imported using one of the formats above. For example:
+
 ```
 $ terraform import google_logging_folder_bucket_config.default folders/{{folder}}/locations/{{location}}/buckets/{{bucket_id}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/logging_folder_exclusion.html.markdown b/mmv1/third_party/terraform/website/docs/r/logging_folder_exclusion.html.markdown
index f3cd9d4818a3..3a1f8c969401 100644
--- a/mmv1/third_party/terraform/website/docs/r/logging_folder_exclusion.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/logging_folder_exclusion.html.markdown
@@ -61,6 +61,19 @@ In addition to the arguments listed above, the following computed attributes are
 
 Folder-level logging exclusions can be imported using their URI, e.g.
 
+* `folders/{{folder}}/exclusions/{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import folder-level logging exclusions using one of the formats above. For example:
+
+```tf
+import {
+  id = "folders/{{folder}}/exclusions/{{name}}"
+  to = google_logging_folder_exclusion.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), folder-level logging exclusions can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_logging_folder_exclusion.my_exclusion folders/my-folder/exclusions/my-exclusion
+$ terraform import google_logging_folder_exclusion.default folders/{{folder}}/exclusions/{{name}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/logging_folder_sink.html.markdown b/mmv1/third_party/terraform/website/docs/r/logging_folder_sink.html.markdown
index dd0f20f63ba6..ee10b92e4979 100644
--- a/mmv1/third_party/terraform/website/docs/r/logging_folder_sink.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/logging_folder_sink.html.markdown
@@ -110,6 +110,19 @@ exported:
 
 Folder-level logging sinks can be imported using this format:
 
+* `folders/{{folder_id}}/sinks/{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import folder-level logging sinks using one of the formats above. For example:
+
+```tf
+import {
+  id = "folders/{{folder_id}}/sinks/{{name}}"
+  to = google_logging_folder_sink.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), folder-level logging sinks can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_logging_folder_sink.my_sink folders/{{folder_id}}/sinks/{{name}}
+$ terraform import google_logging_folder_sink.default folders/{{folder_id}}/sinks/{{name}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/logging_organization_bucket_config.html.markdown b/mmv1/third_party/terraform/website/docs/r/logging_organization_bucket_config.html.markdown
index b8f7b760ee19..090154f9687a 100644
--- a/mmv1/third_party/terraform/website/docs/r/logging_organization_bucket_config.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/logging_organization_bucket_config.html.markdown
@@ -20,10 +20,15 @@ data "google_organization" "default" {
 }
 
 resource "google_logging_organization_bucket_config" "basic" {
-	organization    = data.google_organization.default.organization
-	location  = "global"
-	retention_days = 30
-	bucket_id = "_Default"
+  organization   = data.google_organization.default.organization
+  location       = "global"
+  retention_days = 30
+  bucket_id      = "_Default"
+  
+  index_configs  = {
+    file_path = "jsonPayload.request.status"
+    type      = "INDEX_TYPE_STRING"
+  }
 }
 ```
 
@@ -41,6 +46,15 @@ The following arguments are supported:
 
 * `retention_days` - (Optional) Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. Bucket retention can not be increased on buckets outside of projects.
 
+* `index_configs` - (Optional) A list of indexed fields and related configuration data. Structure is [documented below](#nested_index_configs).
+
+<a name="nested_index_configs"></a>The `index_configs` block supports:
+
+* `field_path` - The LogEntry field path to index.
+  Note that some paths are automatically indexed, and other paths are not eligible for indexing. See [indexing documentation]( https://cloud.google.com/logging/docs/view/advanced-queries#indexed-fields) for details.
+
+* `type` - The type of data in this index. Allowed types include `INDEX_TYPE_UNSPECIFIED`, `INDEX_TYPE_STRING` and `INDEX_TYPE_INTEGER`.
+
 ## Attributes Reference
 
 In addition to the arguments listed above, the following computed attributes are
@@ -54,9 +68,21 @@ exported:
 
 ## Import
 
-
 This resource can be imported using the following format:
 
+* `organizations/{{organization}}/locations/{{location}}/buckets/{{bucket_id}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import this resource using one of the formats above. For example:
+
+```tf
+import {
+  id = "organizations/{{organization}}/locations/{{location}}/buckets/{{bucket_id}}"
+  to = google_logging_organization_bucket_config.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), this resource can be imported using one of the formats above. For example:
+
 ```
 $ terraform import google_logging_organization_bucket_config.default organizations/{{organization}}/locations/{{location}}/buckets/{{bucket_id}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/logging_organization_exclusion.html.markdown b/mmv1/third_party/terraform/website/docs/r/logging_organization_exclusion.html.markdown
index 072cbd6431e2..539daa01d520 100644
--- a/mmv1/third_party/terraform/website/docs/r/logging_organization_exclusion.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/logging_organization_exclusion.html.markdown
@@ -55,6 +55,19 @@ In addition to the arguments listed above, the following computed attributes are
 
 Organization-level logging exclusions can be imported using their URI, e.g.
 
+* `organizations/{{organization}}/exclusions/{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import organization-level logging exclusions using one of the formats above. For example:
+
+```tf
+import {
+  id = "organizations/{{organization}}/exclusions/{{name}}"
+  to = google_logging_organization_exclusion.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), organization-level logging exclusions can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_logging_organization_exclusion.my_exclusion organizations/{{organization}}/exclusions/{{name}}
+$ terraform import google_logging_organization_exclusion.default organizations/{{organization}}/exclusions/{{name}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/logging_organization_sink.html.markdown b/mmv1/third_party/terraform/website/docs/r/logging_organization_sink.html.markdown
index 6fb564a37a70..b0ebf3646f32 100644
--- a/mmv1/third_party/terraform/website/docs/r/logging_organization_sink.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/logging_organization_sink.html.markdown
@@ -100,6 +100,19 @@ exported:
 
 Organization-level logging sinks can be imported using this format:
 
+* `organizations/{{organization_id}}/sinks/{{sink_id}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import organization-level logging sinks using one of the formats above. For example:
+
+```tf
+import {
+  id = "organizations/{{organization_id}}/sinks/{{sink_id}}"
+  to = google_logging_organization_sink.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), organization-level logging sinks can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_logging_organization_sink.my_sink organizations/{{organization_id}}/sinks/{{sink_id}}
+$ terraform import google_logging_organization_sink.default organizations/{{organization_id}}/sinks/{{sink_id}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/logging_project_bucket_config.html.markdown b/mmv1/third_party/terraform/website/docs/r/logging_project_bucket_config.html.markdown
index fc44ebec4477..f9781d54350e 100644
--- a/mmv1/third_party/terraform/website/docs/r/logging_project_bucket_config.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/logging_project_bucket_config.html.markdown
@@ -93,6 +93,22 @@ resource "google_logging_project_bucket_config" "example-project-bucket-cmek-set
 }
 ```
 
+Create logging bucket with index configs
+
+```hcl
+resource "google_logging_project_bucket_config" "example-project-bucket-index-configs" {
+  project          = "project_id"
+  location         = "global"
+  retention_days   = 30
+  bucket_id        = "custom-bucket"
+
+  index_configs   = {
+    file_path   = "jsonPayload.request.status"
+    type        = "INDEX_TYPE_STRING"
+  }
+}
+```
+
 ## Argument Reference
 
 The following arguments are supported:
@@ -113,6 +129,7 @@ The following arguments are supported:
 
 * `cmek_settings` - (Optional) The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. Structure is [documented below](#nested_cmek_settings).
 
+* `index_configs` - (Optional) A list of indexed fields and related configuration data. Structure is [documented below](#nested_index_configs).
 
 <a name="nested_cmek_settings"></a>The `cmek_settings` block supports:
 
@@ -136,6 +153,13 @@ This is a read-only field used to convey the specific configured CryptoKeyVersio
 Before enabling CMEK for a logging bucket, you must first assign the cloudkms.cryptoKeyEncrypterDecrypter role to the service account associated with the project for which CMEK will apply. Use [v2.getCmekSettings](https://cloud.google.com/logging/docs/reference/v2/rest/v2/TopLevel/getCmekSettings#google.logging.v2.ConfigServiceV2.GetCmekSettings) to obtain the service account ID.
 See [Enabling CMEK for Logging Buckets](https://cloud.google.com/logging/docs/routing/managed-encryption-storage) for more information.
 
+<a name="nested_index_configs"></a>The `index_configs` block supports:
+
+* `field_path` - The LogEntry field path to index.
+Note that some paths are automatically indexed, and other paths are not eligible for indexing. See [indexing documentation]( https://cloud.google.com/logging/docs/view/advanced-queries#indexed-fields) for details.
+
+* `type` - The type of data in this index. Allowed types include `INDEX_TYPE_UNSPECIFIED`, `INDEX_TYPE_STRING` and `INDEX_TYPE_INTEGER`.
+
 ## Attributes Reference
 
 In addition to the arguments listed above, the following computed attributes are
@@ -151,6 +175,19 @@ exported:
 
 This resource can be imported using the following format:
 
+* `projects/{{project}}/locations/{{location}}/buckets/{{bucket_id}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import this resource using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project}}/locations/{{location}}/buckets/{{bucket_id}}"
+  to = google_logging_project_bucket_config.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), this resource can be imported using one of the formats above. For example:
+
 ```
 $ terraform import google_logging_project_bucket_config.default projects/{{project}}/locations/{{location}}/buckets/{{bucket_id}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/logging_project_exclusion.html.markdown b/mmv1/third_party/terraform/website/docs/r/logging_project_exclusion.html.markdown
index ebd08f34b3e0..7be7b3b31386 100644
--- a/mmv1/third_party/terraform/website/docs/r/logging_project_exclusion.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/logging_project_exclusion.html.markdown
@@ -55,6 +55,19 @@ In addition to the arguments listed above, the following computed attributes are
 
 Project-level logging exclusions can be imported using their URI, e.g.
 
+* `projects/{{project_id}}/exclusions/{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import project-level logging exclusions using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project_id}}/exclusions/{{name}}"
+  to = google_logging_project_exclusion.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), project-level logging exclusions can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_logging_project_exclusion.my_exclusion projects/my-project/exclusions/my-exclusion
+$ terraform import google_logging_project_exclusion.default projects/{{project_id}}/exclusions/{{name}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/logging_project_sink.html.markdown b/mmv1/third_party/terraform/website/docs/r/logging_project_sink.html.markdown
index 66253de863c9..100fe2e71b4a 100644
--- a/mmv1/third_party/terraform/website/docs/r/logging_project_sink.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/logging_project_sink.html.markdown
@@ -18,7 +18,7 @@ Manages a project-level logging sink. For more information see:
 
 ~> **Note** You must [enable the Cloud Resource Manager API](https://console.cloud.google.com/apis/library/cloudresourcemanager.googleapis.com)
 
-## Example Usage
+## Example Usage - Basic Sink
 
 ```hcl
 resource "google_logging_project_sink" "my-sink" {
@@ -35,6 +35,8 @@ resource "google_logging_project_sink" "my-sink" {
 }
 ```
 
+## Example Usage - Cloud Storage Bucket Destination
+
 A more complete example follows: this creates a compute instance, as well as a log sink that logs all activity to a
 cloud storage bucket. Because we are using `unique_writer_identity`, we must grant it access to the bucket.
 
@@ -89,6 +91,50 @@ resource "google_project_iam_binding" "gcs-bucket-writer" {
 }
 ```
 
+## Example Usage - User-managed Service Account 
+
+The following example creates a sink that are configured with user-managed service accounts, by specifying
+the `custom_writer_identity` field.
+
+Note that you can only create a sink that uses a user-managed service account when the sink destination
+is a log bucket.
+
+```hcl
+resource "google_service_account" "custom-sa" {
+  project      = "other-project-id"
+  account_id   = "gce-log-bucket-sink"
+  display_name = "gce-log-bucket-sink"
+}
+
+# Create a sink that uses user-managed service account
+resource "google_logging_project_sink" "my-sink" {
+  name = "other-project-log-bucket-sink"
+
+  # Can export to log bucket in another project
+  destination = "logging.googleapis.com/projects/other-project-id/locations/global/buckets/gce-logs"
+
+  # Log all WARN or higher severity messages relating to instances
+  filter = "resource.type = gce_instance AND severity >= WARNING"
+
+  unique_writer_identity = true
+  
+  # Use a user-managed service account
+  custom_writer_identity = google_service_account.custom-sa.email
+}
+
+# grant writer access to the user-managed service account
+resource "google_project_iam_member" "custom-sa-logbucket-binding" {
+  project = "destination-project-id"
+  role   = "roles/logging.bucketWriter"
+  member = "serviceAccount:${google_service_account.custom-sa.email}"
+}
+```
+
+The above example will create a log sink that route logs to destination GCP project using
+an user-managed service account. 
+
+## Example Usage - Sink Exclusions
+
 The following example uses `exclusions` to filter logs that will not be exported. In this example logs are exported to a [log bucket](https://cloud.google.com/logging/docs/buckets) and there are 2 exclusions configured
 
 ```hcl
@@ -142,11 +188,15 @@ The following arguments are supported:
 * `project` - (Optional) The ID of the project to create the sink in. If omitted, the project associated with the provider is
     used.
 
-* `unique_writer_identity` - (Optional) Whether or not to create a unique identity associated with this sink. If `false`
-    (the default), then the `writer_identity` used is `serviceAccount:cloud-logs@system.gserviceaccount.com`. If `true`,
+* `unique_writer_identity` - (Optional) Whether or not to create a unique identity associated with this sink. If `false`, then the `writer_identity` used is `serviceAccount:cloud-logs@system.gserviceaccount.com`. If `true` (the default),
     then a unique service account is created and used for this sink. If you wish to publish logs across projects or utilize
     `bigquery_options`, you must set `unique_writer_identity` to true.
 
+* `custom_writer_identity` - (Optional) A user managed service account that will be used to write
+    the log entries. The format must be `serviceAccount:some@email`. This field can only be specified if you are
+    routing logs to a destination outside this sink's project. If not specified, a Logging service account 
+    will automatically be generated.
+
 * `bigquery_options` - (Optional) Options that affect sinks exporting data to BigQuery. Structure [documented below](#nested_bigquery_options).
 
 * `exclusions` - (Optional) Log entries that match any of the exclusion filters will not be exported. If a log entry is matched by both `filter` and one of `exclusions.filter`, it will not be exported.  Can be repeated multiple times for multiple exclusions. Structure is [documented below](#nested_exclusions).
@@ -180,6 +230,19 @@ exported:
 
 Project-level logging sinks can be imported using their URI, e.g.
 
+* `projects/{{project_id}}/sinks/{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import project-level logging sinks using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project_id}}/sinks/{{name}}"
+  to = google_logging_project_sink.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), project-level logging sinks can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_logging_project_sink.my_sink projects/my-project/sinks/my-sink
+$ terraform import google_logging_project_sink.default projects/{{project_id}}/sinks/{{name}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/monitoring_dashboard.html.markdown b/mmv1/third_party/terraform/website/docs/r/monitoring_dashboard.html.markdown
index b3d0e0dd63b6..ddc4223c6280 100644
--- a/mmv1/third_party/terraform/website/docs/r/monitoring_dashboard.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/monitoring_dashboard.html.markdown
@@ -114,6 +114,12 @@ The following arguments are supported:
   The JSON representation of a dashboard, following the format at https://cloud.google.com/monitoring/api/ref_v3/rest/v1/projects.dashboards.
   The representation of an existing dashboard can be found by using the [API Explorer](https://cloud.google.com/monitoring/api/ref_v3/rest/v1/projects.dashboards/get)
 
+  ~> **Warning:** Because this is represented as a JSON string, Terraform doesn't have underlying information to know
+    which fields in the string have defaults. To prevent permanent diffs from default values, Terraform will attempt to
+    suppress diffs where the value is returned in the JSON string but doesn't exist in the configuration. Consequently,
+    legitmate remove-only diffs will also be suppressed. For Terraform to detect the diff, key removals must also be
+    accompanied by a non-removal change (trivial or not).
+
 - - -
 
 
@@ -140,6 +146,20 @@ This resource provides the following
 
 Dashboard can be imported using any of these accepted formats:
 
+* `projects/{{project}}/dashboards/{{dashboard_id}}`
+* `{{dashboard_id}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Dashboard using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project}}/dashboards/{{dashboard_id}}"
+  to = google_monitoring_dashboard.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Dashboard can be imported using one of the formats above. For example:
+
 ```
 $ terraform import google_monitoring_dashboard.default projects/{{project}}/dashboards/{{dashboard_id}}
 $ terraform import google_monitoring_dashboard.default {{dashboard_id}}
diff --git a/mmv1/third_party/terraform/website/docs/r/os_config_os_policy_assignment.html.markdown b/mmv1/third_party/terraform/website/docs/r/os_config_os_policy_assignment.html.markdown
index 666b5964ccb5..229383c34847 100644
--- a/mmv1/third_party/terraform/website/docs/r/os_config_os_policy_assignment.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/os_config_os_policy_assignment.html.markdown
@@ -20,12 +20,6 @@ To get more information about OSPolicyAssignment, see:
 *   How-to Guides
     *   [Official Documentation](https://cloud.google.com/compute/docs/os-configuration-management/create-os-policy-assignment)
 
-<div class = "oics-button" style="float: right; margin: 0 0 -15px">
-  <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=os_config_os_policy_assignment_basic&cloudshell_image=gcr.io%2Fgraphite-cloud-shell-images%2Fterraform%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
-    <img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
-  </a>
-</div>
-
 ## Example Usage - Os Config Os Policy Assignment Basic
 
 ```hcl
@@ -712,6 +706,21 @@ configuration options:
 
 OSPolicyAssignment can be imported using any of these accepted formats:
 
+* `projects/{{project}}/locations/{{location}}/osPolicyAssignments/{{name}}`
+* `{{project}}/{{location}}/{{name}}`
+* `{{location}}/{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OSPolicyAssignment using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project}}/locations/{{location}}/osPolicyAssignments/{{name}}"
+  to = google_os_config_os_policy_assignment.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), OSPolicyAssignment can be imported using one of the formats above. For example:
+
 ```
 $ terraform import google_os_config_os_policy_assignment.default projects/{{project}}/locations/{{location}}/osPolicyAssignments/{{name}}
 $ terraform import google_os_config_os_policy_assignment.default {{project}}/{{location}}/{{name}}
diff --git a/mmv1/third_party/terraform/website/docs/r/pubsub_subscription_iam.html.markdown b/mmv1/third_party/terraform/website/docs/r/pubsub_subscription_iam.html.markdown
index 6cd753fa6201..ad2f11ee7e55 100644
--- a/mmv1/third_party/terraform/website/docs/r/pubsub_subscription_iam.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/pubsub_subscription_iam.html.markdown
@@ -92,15 +92,68 @@ exported:
 
 ## Import
 
-Pubsub subscription IAM resources can be imported using the project, subscription name, role and member.
+-> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
+ full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
+
+### Importing IAM members
+
+IAM member imports use space-delimited identifiers that contains the `subscription`, `role`, and `member`. For example:
 
+* `"projects/{{project_id}}/subscriptions/{{subscription}} roles/editor jane@example.com"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM members:
+
+```tf
+import {
+  id = "projects/{{project_id}}/subscriptions/{{subscription}} roles/editor jane@example.com"
+  to = google_pubsub_subscription_iam_member.default
+}
 ```
-$ terraform import google_pubsub_subscription_iam_policy.editor projects/{your-project-id}/subscriptions/{your-subscription-name}
 
-$ terraform import google_pubsub_subscription_iam_binding.editor "projects/{your-project-id}/subscriptions/{your-subscription-name} roles/editor"
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
 
-$ terraform import google_pubsub_subscription_iam_member.editor "projects/{your-project-id}/subscriptions/{your-subscription-name} roles/editor jane@example.com"
+```
+$ terraform import google_pubsub_subscription_iam_member.default "projects/{{project_id}}/subscriptions/{{subscription}} roles/editor jane@example.com"
 ```
 
--> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
- full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
+### Importing IAM bindings
+
+IAM binding imports use space-delimited identifiers that contain the resource's `subscription` and `role`. For example:
+
+* `"projects/{{project_id}}/subscriptions/{{subscription}} roles/editor"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM bindings:
+
+```tf
+import {
+  id = "projects/{{project_id}}/subscriptions/{{subscription}} roles/editor"
+  to = google_pubsub_subscription_iam_binding.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+$ terraform import google_pubsub_subscription_iam_binding.default "projects/{{project_id}}/subscriptions/{{subscription}} roles/editor"
+```
+
+### Importing IAM policies
+
+IAM policy imports use the identifier of the Pubsub Subscription resource. For example:
+
+* `"projects/{{project_id}}/subscriptions/{{subscription}}"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM policies:
+
+```tf
+import {
+  id = "projects/{{project_id}}/subscriptions/{{subscription}}"
+  to = google_pubsub_subscription_iam_policy.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+$ terraform import google_pubsub_subscription_iam_policy.default projects/{{project_id}}/subscriptions/{{subscription}}
+```
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/website/docs/r/runtimeconfig_config.html.markdown b/mmv1/third_party/terraform/website/docs/r/runtimeconfig_config.html.markdown
index 164e51c7c4c9..ac17059308ed 100644
--- a/mmv1/third_party/terraform/website/docs/r/runtimeconfig_config.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/runtimeconfig_config.html.markdown
@@ -52,10 +52,23 @@ In addition to the arguments listed above, the following computed attributes are
 
 Runtime Configs can be imported using the `name` or full config name, e.g.
 
+* `projects/{{project_id}}/configs/{{name}}`
+* `{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Runtime Configs using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project_id}}/configs/{{name}}"
+  to = google_runtimeconfig_config.default
+}
 ```
-$ terraform import google_runtimeconfig_config.myconfig myconfig
-```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Runtime Configs can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_runtimeconfig_config.myconfig projects/my-gcp-project/configs/myconfig
+$ terraform import google_runtimeconfig_config.default projects/{{project_id}}/configs/{{name}}
+$ terraform import google_runtimeconfig_config.default {{name}}
 ```
+
 When importing using only the name, the provider project must be set.
diff --git a/mmv1/third_party/terraform/website/docs/r/runtimeconfig_variable.html.markdown b/mmv1/third_party/terraform/website/docs/r/runtimeconfig_variable.html.markdown
index c012fa9d5e20..270bfd8ff972 100644
--- a/mmv1/third_party/terraform/website/docs/r/runtimeconfig_variable.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/runtimeconfig_variable.html.markdown
@@ -84,10 +84,22 @@ Example: "2016-10-09T12:33:37.578138407Z".
 
 Runtime Config Variables can be imported using the `name` or full variable name, e.g.
 
+* `projects/my-gcp-project/configs/{{config_id}}/variables/{{name}}`
+* `{{config_id}}/{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Runtime Config Variables using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/my-gcp-project/configs/{{config_id}}/variables/{{name}}"
+  to = google_runtimeconfig_variable.default
+}
 ```
-$ terraform import google_runtimeconfig_variable.myvariable myconfig/myvariable
-```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Runtime Config Variables can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_runtimeconfig_variable.myvariable projects/my-gcp-project/configs/myconfig/variables/myvariable
+$ terraform import google_runtimeconfig_variable.default projects/my-gcp-project/configs/{{config_id}}/variables/{{name}}
+$ terraform import google_runtimeconfig_variable.default {{config_id}}/{{name}}
 ```
 When importing using only the name, the provider project must be set.
diff --git a/mmv1/third_party/terraform/website/docs/r/service_networking_connection.html.markdown b/mmv1/third_party/terraform/website/docs/r/service_networking_connection.html.markdown
index afe4ef20fee0..0c9abcbce605 100644
--- a/mmv1/third_party/terraform/website/docs/r/service_networking_connection.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/service_networking_connection.html.markdown
@@ -67,12 +67,26 @@ In addition to the arguments listed above, the following computed attributes are
 
 
 ## Import
+
 ServiceNetworkingConnection can be imported using any of these accepted formats
 
+* `{{peering-network}}:{{service}}`
+* `projects/{{project}}/global/networks/{{peering-network}}:{{service}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import NAME_HERE using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project}}/global/networks/{{peering-network}}:{{service}}"
+  to = google_service_networking_connection.default
+}
 ```
-$ terraform import google_service_networking_connection.peering_connection {{peering-network}}:{{service}}
 
-$ terraform import google_service_networking_connection.peering_connection /projects/{{project}}/global/networks/{{peering-network}}:{{service}}
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), NAME_HERE can be imported using one of the formats above. For example:
+
+```
+$ terraform import google_service_networking_connection.default {{peering-network}}:{{service}}
+$ terraform import google_service_networking_connection.default /projects/{{project}}/global/networks/{{peering-network}}:{{service}}
 ```
 
 
diff --git a/mmv1/third_party/terraform/website/docs/r/spanner_database_iam.html.markdown b/mmv1/third_party/terraform/website/docs/r/spanner_database_iam.html.markdown
index a5da366d00d8..1de101713eb3 100644
--- a/mmv1/third_party/terraform/website/docs/r/spanner_database_iam.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/spanner_database_iam.html.markdown
@@ -4,7 +4,7 @@ description: |-
  Collection of resources to manage IAM policy for a Spanner database.
 ---
 
-# IAM policy for Spanner databases
+# IAM policy for Spanner Databases
 
 Three different resources help you manage your IAM policy for a Spanner database. Each of these resources serves a different use case:
 
@@ -100,29 +100,74 @@ exported:
 
 ## Import
 
+-> **Custom Roles:** If you're importing a IAM resource with a custom role, make sure to use the
+ full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
+
 For all import syntaxes, the "resource in question" can take any of the following forms:
 
 * {{project}}/{{instance}}/{{database}}
 * {{instance}}/{{database}} (project is taken from provider project)
 
-IAM member imports use space-delimited identifiers; the resource in question, the role, and the member identity, e.g.
+### Importing IAM members
 
-```
-$ terraform import google_spanner_database_iam_member.database "project-name/instance-name/database-name roles/viewer user:foo@example.com"
+IAM member imports use space-delimited identifiers that contains the `database`, `role`, and `member`. For example:
+
+* `"{{project}}/{{instance}}/{{database}} roles/viewer user:foo@example.com"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM members:
+
+```tf
+import {
+  id = "{{project}}/{{instance}}/{{database}} roles/viewer user:foo@example.com"
+  to = google_spanner_database_iam_member.default
+}
 ```
 
-IAM binding imports use space-delimited identifiers; the resource in question and the role, e.g.
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
 
 ```
-$ terraform import google_spanner_database_iam_binding.database "project-name/instance-name/database-name roles/viewer"
+$ terraform import google_spanner_database_iam_member.default "{{project}}/{{instance}}/{{database}} roles/viewer user:foo@example.com"
+```
+
+### Importing IAM bindings
+
+IAM binding imports use space-delimited identifiers that contain the resource's `database` and `role`. For example:
+
+* `"{{project}}/{{instance}}/{{database}} roles/viewer"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM bindings:
+
+```tf
+import {
+  id = "{{project}}/{{instance}}/{{database}} roles/viewer"
+  to = google_spanner_database_iam_binding.default
+}
 ```
 
-IAM policy imports use the identifier of the resource in question, e.g.
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
 
 ```
-$ terraform import google_spanner_database_iam_policy.database project-name/instance-name/database-name
+$ terraform import google_spanner_database_iam_binding.default "{{project}}/{{instance}}/{{database}} roles/viewer"
 ```
 
--> **Custom Roles:** If you're importing a IAM resource with a custom role, make sure to use the
- full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
+### Importing IAM policies
+
+IAM policy imports use the identifier of the Spanner Database resource in question. For example:
+
+* `{{project}}/{{instance}}/{{database}}`
+
 
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM policies:
+
+```tf
+import {
+  id = {{project}}/{{instance}}/{{database}}
+  to = google_spanner_database_iam_policy.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+$ terraform import google_spanner_database_iam_policy.default {{project}}/{{instance}}/{{database}}
+```
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/website/docs/r/spanner_instance_iam.html.markdown b/mmv1/third_party/terraform/website/docs/r/spanner_instance_iam.html.markdown
index 3f09c37e1611..42faa0d2b95e 100644
--- a/mmv1/third_party/terraform/website/docs/r/spanner_instance_iam.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/spanner_instance_iam.html.markdown
@@ -95,28 +95,69 @@ exported:
 
 ## Import
 
-For all import syntaxes, the "resource in question" can take any of the following forms:
+-> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
+ full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
 
-* {{project}}/{{name}}
-* {{name}} (project is taken from provider project)
+### Importing IAM members
 
-IAM member imports use space-delimited identifiers; the resource in question, the role, and the account, e.g.
+IAM member imports use space-delimited identifiers that contains the `instance`, `role`, and `member`. For example:
 
-```
-$ terraform import google_spanner_instance_iam_member.instance "project-name/instance-name roles/viewer user:foo@example.com"
+* `"{{project}}/{{instance}} roles/viewer user:foo@example.com"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM members:
+
+```tf
+import {
+  id = "{{project}}/{{instance}} roles/viewer user:foo@example.com"
+  to = google_spanner_instance_iam_member.default
+}
 ```
 
-IAM binding imports use space-delimited identifiers; the resource in question and the role, e.g.
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
 
 ```
-$ terraform import google_spanner_instance_iam_binding.instance "project-name/instance-name roles/viewer"
+$ terraform import google_spanner_instance_iam_member.default "{{project}}/{{instance}} roles/viewer user:foo@example.com"
+```
+
+### Importing IAM bindings
+
+IAM binding imports use space-delimited identifiers that contain the resource's `instance` and `role`. For example:
+
+* `"{{project}}/{{instance}} roles/viewer"`
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM bindings:
+
+```tf
+import {
+  id = "{{project}}/{{instance}} roles/viewer"
+  to = google_spanner_instance_iam_binding.default
+}
 ```
 
-IAM policy imports use the identifier of the resource in question, e.g.
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
 
 ```
-$ terraform import google_spanner_instance_iam_policy.instance project-name/instance-name
+$ terraform import google_spanner_instance_iam_binding.default "{{project}}/{{instance}} roles/viewer"
 ```
 
--> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
- full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.
+### Importing IAM policies
+
+IAM policy imports use the identifier of the Spanner Instances resource . For example:
+
+* `{{project}}/{{instance}}`
+
+
+An [`import` block](https://developer.hashicorp.com/terraform/language/import) (Terraform v1.5.0 and later) can be used to import IAM policies:
+
+```tf
+import {
+  id = {{project}}/{{instance}}
+  to = google_spanner_instance_iam_policy.default
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can also be used:
+
+```
+$ terraform import google_spanner_instance_iam_policy.default {{project}}/{{instance}}
+```
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/website/docs/r/sql_database_instance.html.markdown b/mmv1/third_party/terraform/website/docs/r/sql_database_instance.html.markdown
index 7cf741ed9260..67b1c0a27da3 100644
--- a/mmv1/third_party/terraform/website/docs/r/sql_database_instance.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/sql_database_instance.html.markdown
@@ -317,8 +317,7 @@ The optional `settings.active_directory_config` subblock supports:
 
 The optional `settings.data_cache_config` subblock supports:
 
-* `data_cache_enabled` - (Optional) Whether data cache is enabled for the instance. Defaults to `false`
-    Can only be used with MYSQL.
+* `data_cache_enabled` - (Optional) Whether data cache is enabled for the instance. Defaults to `false`. Can be used with MYSQL and PostgreSQL only.
 
 The optional `settings.deny_maintenance_period` subblock supports:
 
@@ -372,7 +371,12 @@ Specifying a network enables private IP.
 At least `ipv4_enabled` must be enabled or a `private_network` must be configured.
 This setting can be updated, but it cannot be removed after it is set.
 
-* `require_ssl` - (Optional) Whether SSL connections over IP are enforced or not.
+* `require_ssl` - (Optional) Whether SSL connections over IP are enforced or not. To change this field, also set the corresponding value in `ssl_mode`.
+
+* `ssl_mode` - (Optional) Specify how SSL connection should be enforced in DB connections. This field provides more SSL enforcment options compared to `require_ssl`. To change this field, also set the correspoding value in `require_ssl`.
+    * For PostgreSQL instances, the value pairs are listed in the [API reference doc](https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1beta4/instances#ipconfiguration) for `ssl_mode` field.
+    * For MySQL instances, use the same value pairs as the PostgreSQL instances.
+    * For SQL Server instances, set it to `ALLOW_UNENCRYPTED_AND_ENCRYPTED` when `require_ssl=false` and `ENCRYPTED_ONLY` otherwise.
 
 * `allocated_ip_range` - (Optional) The name of the allocated ip range for the private ip CloudSQL instance. For example: "google-managed-services-default". If set, the instance ip will be created in the allocated range. The range name must comply with [RFC 1035](https://datatracker.ietf.org/doc/html/rfc1035). Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?.
 
@@ -471,7 +475,7 @@ to work, cannot be updated, and supports:
 
 * `password` - (Optional) Password for the replication connection.
 
-* `sslCipher` - (Optional) Permissible ciphers for use in SSL encryption.
+* `ssl_cipher` - (Optional) Permissible ciphers for use in SSL encryption.
 
 * `username` - (Optional) Username for replication connection.
 
@@ -486,6 +490,8 @@ The optional `clone` block supports:
 
     A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
 
+* `preferred_zone` - (Optional) (Point-in-time recovery for PostgreSQL only) Clone to an instance in the specified zone. If no zone is specified, clone to the same zone as the source instance. [clone-unavailable-instance](https://cloud.google.com/sql/docs/postgres/clone-instance#clone-unavailable-instance)
+
 * `database_names` - (Optional) (SQL Server only, use with `point_in_time`) Clone only the specified databases from the source instance. Clone all databases if empty.
 
 * `allocated_ip_range` -  (Optional) The name of the allocated ip range for the private ip CloudSQL instance. For example: "google-managed-services-default". If set, the cloned instance ip will be created in the allocated range. The range name must comply with [RFC 1035](https://tools.ietf.org/html/rfc1035). Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?.
@@ -573,11 +579,25 @@ performing filtering in a Terraform config.
 
 Database instances can be imported using one of any of these accepted formats:
 
+* `projects/{{project}}/instances/{{name}}`
+* `{{project}}/{{name}}`
+* `{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Database instances using one of the formats above. For example:
+
+```tf
+import {
+  id = "projects/{{project}}/instances/{{name}}"
+  to = google_sql_database_instance.default
+}
 ```
-$ terraform import google_sql_database_instance.main projects/{{project}}/instances/{{name}}
-$ terraform import google_sql_database_instance.main {{project}}/{{name}}
-$ terraform import google_sql_database_instance.main {{name}}
 
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Database instances can be imported using one of the formats above. For example:
+
+```
+$ terraform import google_sql_database_instance.default projects/{{project}}/instances/{{name}}
+$ terraform import google_sql_database_instance.default {{project}}/{{name}}
+$ terraform import google_sql_database_instance.default {{name}}
 ```
 
 ~> **NOTE:** Some fields (such as `replica_configuration`) won't show a diff if they are unset in
diff --git a/mmv1/third_party/terraform/website/docs/r/sql_user.html.markdown b/mmv1/third_party/terraform/website/docs/r/sql_user.html.markdown
index be4fd5be3fe3..9b96d4463a22 100644
--- a/mmv1/third_party/terraform/website/docs/r/sql_user.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/sql_user.html.markdown
@@ -141,12 +141,34 @@ This resource provides the following
 
 SQL users for MySQL databases can be imported using the `project`, `instance`, `host` and `name`, e.g.
 
-```
-$ terraform import google_sql_user.users my-project/main-instance/my-domain.com/me
-```
+* `{{project_id}}/{{instance}}/{{host}}/{{name}}`
 
 SQL users for PostgreSQL databases can be imported using the `project`, `instance` and `name`, e.g.
 
+* `{{project_id}}/{{instance}}/{{name}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import NAME_HERE using one of the formats above. For example:
+
+```tf
+# MySQL database
+import {
+  id = "{{project_id}}/{{instance}}/{{host}}/{{name}}"
+  to = google_sql_user.default
+}
+
+# PostgreSQL database
+import {
+  id = "{{project_id}}/{{instance}}/{{name}}"
+  to = google_sql_user.default
+}
 ```
-$ terraform import google_sql_user.users my-project/main-instance/me
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), NAME_HERE can be imported using one of the formats above. For example:
+
 ```
+# MySQL database
+$ terraform import google_sql_user.default {{project_id}}/{{instance}}/{{host}}/{{name}}
+
+# PostgreSQL database
+$ terraform import google_sql_user.default {{project_id}}/{{instance}}/{{name}}
+```
\ No newline at end of file
diff --git a/mmv1/third_party/terraform/website/docs/r/storage_bucket.html.markdown b/mmv1/third_party/terraform/website/docs/r/storage_bucket.html.markdown
index 32275ea33bf5..0c2123fa25bf 100644
--- a/mmv1/third_party/terraform/website/docs/r/storage_bucket.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/storage_bucket.html.markdown
@@ -120,6 +120,9 @@ The following arguments are supported:
 
 * `encryption` - (Optional) The bucket's encryption configuration. Structure is [documented below](#nested_encryption).
 
+* `enable_object_retention` - (Optional, Default: false) Enables [object retention](https://cloud.google.com/storage/docs/object-lock) on a storage bucket.
+
+
 * `requester_pays` - (Optional, Default: false) Enables [Requester Pays](https://cloud.google.com/storage/docs/requester-pays) on a storage bucket.
 
 * `uniform_bucket_level_access` - (Optional, Default: false) Enables [Uniform bucket-level access](https://cloud.google.com/storage/docs/uniform-bucket-level-access) access to a bucket.
@@ -168,6 +171,8 @@ The following arguments are supported:
 
 * `enabled` - (Required) While set to `true`, autoclass automatically transitions objects in your bucket to appropriate storage classes based on each object's access pattern.
 
+* `terminal_storage_class` - (Optional) The storage class that objects in the bucket eventually transition to if they are not read for a certain length of time. Supported values include: `NEARLINE`, `ARCHIVE`.
+
 <a name="nested_versioning"></a>The `versioning` block supports:
 
 * `enabled` - (Required) While set to `true`, versioning is fully enabled for this bucket.
@@ -249,11 +254,23 @@ passed to the import command it will be inferred from the provider block or envi
 If it cannot be inferred it will be queried from the Compute API (this will fail if the API is
 not enabled).
 
-e.g.
+* `{{project_id}}/{{bucket}}`
+* `{{bucket}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Storage buckets using one of the formats above. For example:
+
+```tf
+import {
+  id = "{{project_id}}/{{bucket}}"
+  to = google_storage_bucket.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Storage buckets can be imported using one of the formats above. For example:
 
 ```
-$ terraform import google_storage_bucket.image-store image-store-bucket
-$ terraform import google_storage_bucket.image-store tf-test-project/image-store-bucket
+$ terraform import google_storage_bucket.default {{bucket}}
+$ terraform import google_storage_bucket.default {{project_id}}/{{bucket}}
 ```
 
 ~> **Note:** Terraform will import this resource with `force_destroy` set to
diff --git a/mmv1/third_party/terraform/website/docs/r/storage_bucket_object.html.markdown b/mmv1/third_party/terraform/website/docs/r/storage_bucket_object.html.markdown
index 57995a5d90b1..4832d1bdcf12 100644
--- a/mmv1/third_party/terraform/website/docs/r/storage_bucket_object.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/storage_bucket_object.html.markdown
@@ -67,7 +67,9 @@ One of the following is required:
 * `content_type` - (Optional) [Content-Type](https://tools.ietf.org/html/rfc7231#section-3.1.1.5) of the object data. Defaults to "application/octet-stream" or "text/plain; charset=utf-8".
 
 * `customer_encryption` - (Optional) Enables object encryption with Customer-Supplied Encryption Key (CSEK). [Google [documentation about](#nested_customer_encryption) CSEK.](https://cloud.google.com/storage/docs/encryption/customer-supplied-keys)
-    Structure is documented below.
+    Structure is [documented below](#nested_customer_encryption).
+
+* `retention` - (Optional) The [object retention](http://cloud.google.com/storage/docs/object-lock) settings for the object. The retention settings allow an object to be retained until a provided date. Structure is [documented below](#nested_retention).
 
 * `event_based_hold` - (Optional) Whether an object is under [event-based hold](https://cloud.google.com/storage/docs/object-holds#hold-types). Event-based hold is a way to retain objects until an event occurs, which is signified by the hold's release (i.e. this value is set to false). After being released (set to false), such objects will be subject to bucket-level retention (if any).
 
@@ -89,6 +91,14 @@ One of the following is required:
 
 * `encryption_key` - (Required) Base64 encoded Customer-Supplied Encryption Key.
 
+<a name="nested_retention"></a>The `retention` block supports:
+
+* `mode` - (Required) The retention policy mode. Either `Locked` or `Unlocked`.
+
+* `retain_until_time` - (Required) The time to retain the object until in RFC 3339 format, for example 2012-11-15T16:19:00.094Z.
+
+<a name>
+
 ## Attributes Reference
 
 In addition to the arguments listed above, the following computed attributes are
diff --git a/mmv1/third_party/terraform/website/docs/r/storage_notification.html.markdown b/mmv1/third_party/terraform/website/docs/r/storage_notification.html.markdown
index 7daa59006602..5259d8fa79d7 100644
--- a/mmv1/third_party/terraform/website/docs/r/storage_notification.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/storage_notification.html.markdown
@@ -92,8 +92,21 @@ exported:
 
 ## Import
 
-Storage notifications can be imported using the notification `id` in the format `<bucket_name>/notificationConfigs/<id>` e.g.
+Storage notifications can be imported using any of these accepted formats:
+
+* `{{bucket_name}}/notificationConfigs/{{id}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Storage notifications using one of the formats above. For example:
+
+```tf
+import {
+  id = "{{bucket_name}}/notificationConfigs/{{id}}"
+  to = google_storage_notification.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Storage notifications can be imported using one of the formats above. For example:
 
 ```
-$ terraform import google_storage_notification.notification default_bucket/notificationConfigs/102
+$ terraform import google_storage_notification.default {{bucket_name}}/notificationConfigs/{{id}}
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/storage_transfer_job.html.markdown b/mmv1/third_party/terraform/website/docs/r/storage_transfer_job.html.markdown
index 4d03338c69be..b9eafb0d2d3c 100644
--- a/mmv1/third_party/terraform/website/docs/r/storage_transfer_job.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/storage_transfer_job.html.markdown
@@ -116,10 +116,12 @@ The following arguments are supported:
 
 * `transfer_spec` - (Required) Transfer specification. Structure [documented below](#nested_transfer_spec).
 
-* `schedule` - (Required) Schedule specification defining when the Transfer Job should be scheduled to start, end and what time to run. Structure [documented below](#nested_schedule).
-
 - - -
 
+* `schedule` - (Optional) Schedule specification defining when the Transfer Job should be scheduled to start, end and what time to run. Structure [documented below](#nested_schedule). Either `schedule` or `event_stream` must be set.
+
+* `event_stream` - (Optional) Specifies the Event-driven transfer options. Event-driven transfers listen to an event stream to transfer updated files. Structure [documented below](#nested_event_stream) Either `event_stream` or `schedule` must be set.
+
 * `project` - (Optional) The project in which the resource belongs. If it
 	is not provided, the provider project is used.
 
@@ -161,6 +163,14 @@ The following arguments are supported:
 
 * `repeat_interval` - (Optional) Interval between the start of each scheduled transfer. If unspecified, the default value is 24 hours. This value may not be less than 1 hour. A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s".
 
+<a name="nested_event_stream"></a>The `event_stream` block supports:
+
+* `name` - (Required) Specifies a unique name of the resource such as AWS SQS ARN in the form 'arn:aws:sqs:region:account_id:queue_name', or Pub/Sub subscription resource name in the form 'projects/{project}/subscriptions/{sub}'.
+
+* `event_stream_start_time` - (Optional) Specifies the date and time that Storage Transfer Service starts listening for events from this stream. If no start time is specified or start time is in the past, Storage Transfer Service starts listening immediately. A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
+
+* `event_stream_expiration_time` - (Optional) Specifies the data and time at which Storage Transfer Service stops listening for events from this stream. After this time, any transfers in progress will complete, but no new transfers are initiated.A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
+
 <a name="nested_object_conditions"></a>The `object_conditions` block supports:
 
 * `max_time_elapsed_since_last_modification` - (Optional) A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s".
@@ -282,8 +292,21 @@ exported:
 
 ## Import
 
-Storage buckets can be imported using the Transfer Job's `project` and `name` without the `transferJob/` prefix, e.g.
+Storage Transfer Jobs can be imported using the Transfer Job's `project` and `name` (without the `transferJob/` prefix), e.g.
+
+* `{{project_id}}/{{name}}`, where `name` is a numeric value.
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Storage Transfer Jobs using one of the formats above. For example:
+
+```tf
+import {
+  id = "{{project_id}}/{{name}}"
+  to = google_storage_transfer_job.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Storage Transfer Jobs can be imported using one of the formats above. For example:
 
 ```
-$ terraform import google_storage_transfer_job.nightly-backup-transfer-job my-project-1asd32/8422144862922355674
+$ terraform import google_storage_transfer_job.default {{project_id}}/123456789
 ```
diff --git a/mmv1/third_party/terraform/website/docs/r/usage_export_bucket.html.markdown b/mmv1/third_party/terraform/website/docs/r/usage_export_bucket.html.markdown
index a5ac11179682..b360a36f9185 100644
--- a/mmv1/third_party/terraform/website/docs/r/usage_export_bucket.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/usage_export_bucket.html.markdown
@@ -48,6 +48,19 @@ This resource provides the following
 
 A project's Usage Export Bucket can be imported using this format:
 
+* `{{project_id}}`
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import NAME_HERE using one of the formats above. For example:
+
+```tf
+import {
+  id = "{{project_id}}"
+  to = google_project_usage_export_bucket.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), NAME_HERE can be imported using one of the formats above. For example:
+
 ```
-$ terraform import google_project_usage_export_bucket.usage_export {{project}}
+$ terraform import google_project_usage_export_bucket.default {{project_id}}
 ```
diff --git a/mmv1/third_party/tgc/container.go b/mmv1/third_party/tgc/container.go
index 86085212e70f..806b64e228b4 100644
--- a/mmv1/third_party/tgc/container.go
+++ b/mmv1/third_party/tgc/container.go
@@ -47,10 +47,6 @@ func expandContainerClusterEnableLegacyAbac(v interface{}, d tpgresource.Terrafo
 	return expandContainerEnabledObject(v, d, config)
 }
 
-func expandContainerClusterEnableBinaryAuthorization(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
-	return expandContainerEnabledObject(v, d, config)
-}
-
 func expandContainerMaxPodsConstraint(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
 	if val := reflect.ValueOf(v); !val.IsValid() || tpgresource.IsEmptyValue(val) {
 		return nil, nil
@@ -126,12 +122,6 @@ func GetContainerClusterCaiObject(d tpgresource.TerraformResourceData, config *t
 
 func GetContainerClusterApiObject(d tpgresource.TerraformResourceData, config *transport_tpg.Config) (map[string]interface{}, error) {
 	obj := make(map[string]interface{})
-	binaryAuthorizationProp, err := expandContainerClusterEnableBinaryAuthorization(d.Get("enable_binary_authorization"), d, config)
-	if err != nil {
-		return nil, err
-	} else if v, ok := d.GetOkExists("enable_binary_authorization"); !tpgresource.IsEmptyValue(reflect.ValueOf(binaryAuthorizationProp)) && (ok || !reflect.DeepEqual(v, binaryAuthorizationProp)) {
-		obj["binaryAuthorization"] = binaryAuthorizationProp
-	}
 	enableKubernetesAlphaProp, err := expandContainerClusterEnableKubernetesAlpha(d.Get("enable_kubernetes_alpha"), d, config)
 	if err != nil {
 		return nil, err
diff --git a/mmv1/third_party/tgc/getconfig.go b/mmv1/third_party/tgc/getconfig.go
index b44c902ea8ef..d001855ca6ad 100644
--- a/mmv1/third_party/tgc/getconfig.go
+++ b/mmv1/third_party/tgc/getconfig.go
@@ -32,8 +32,8 @@ func NewConfig(ctx context.Context, project, zone, region string, offline bool,
 		"GOOGLE_IMPERSONATE_SERVICE_ACCOUNT",
 	})
 
+	transport_tpg.ConfigureBasePaths(cfg)
 	if !offline {
-		transport_tpg.ConfigureBasePaths(cfg)
 		if err := cfg.LoadAndValidate(ctx); err != nil {
 			return nil, errors.Wrap(err, "load and validate config")
 		}
diff --git a/mmv1/third_party/tgc/getconfig_test.go b/mmv1/third_party/tgc/getconfig_test.go
index 4afa9529d762..ce6a7581346f 100644
--- a/mmv1/third_party/tgc/getconfig_test.go
+++ b/mmv1/third_party/tgc/getconfig_test.go
@@ -16,9 +16,11 @@ type configAttrGetter func(cfg *transport_tpg.Config) string
 func getCredentials(cfg *transport_tpg.Config) string {
 	return cfg.Credentials
 }
+
 func getAccessToken(cfg *transport_tpg.Config) string {
 	return cfg.AccessToken
 }
+
 func getImpersonateServiceAccount(cfg *transport_tpg.Config) string {
 	return cfg.ImpersonateServiceAccount
 }
@@ -29,6 +31,7 @@ func TestNewConfigExtractsEnvVars(t *testing.T) {
 	cases := []struct {
 		name           string
 		envKey         string
+		unsetKeys      []string // environment variables that must be unset before constructing config
 		envValue       string
 		expected       string
 		getConfigValue configAttrGetter
@@ -43,6 +46,7 @@ func TestNewConfigExtractsEnvVars(t *testing.T) {
 		{
 			name:           "GOOGLE_CLOUD_KEYFILE_JSON",
 			envKey:         "GOOGLE_CLOUD_KEYFILE_JSON",
+			unsetKeys:      []string{"GOOGLE_CREDENTIALS"},
 			envValue:       "whatever",
 			expected:       "whatever",
 			getConfigValue: getCredentials,
@@ -50,6 +54,7 @@ func TestNewConfigExtractsEnvVars(t *testing.T) {
 		{
 			name:           "GCLOUD_KEYFILE_JSON",
 			envKey:         "GCLOUD_KEYFILE_JSON",
+			unsetKeys:      []string{"GOOGLE_CREDENTIALS", "GOOGLE_CLOUD_KEYFILE_JSON"},
 			envValue:       "whatever",
 			expected:       "whatever",
 			getConfigValue: getCredentials,
@@ -72,7 +77,22 @@ func TestNewConfigExtractsEnvVars(t *testing.T) {
 
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
+			// Store existing state of environment variables.
+			existingEnv := make(map[string]string, len(c.unsetKeys)+1)
+			for _, key := range c.unsetKeys {
+				if originalValue, isSet := os.LookupEnv(key); isSet {
+					existingEnv[key] = originalValue
+					// Unset variables that would interfere with test.
+					err := os.Unsetenv(key)
+					if err != nil {
+						t.Fatalf("error unsetting env var %s: %s", key, err)
+					}
+				}
+			}
 			originalValue, isSet := os.LookupEnv(c.envKey)
+			if isSet {
+				existingEnv[c.envKey] = originalValue
+			}
 			err := os.Setenv(c.envKey, c.envValue)
 			if err != nil {
 				t.Fatalf("error setting env var %s=%s: %s", c.envKey, c.envValue, err)
@@ -85,17 +105,20 @@ func TestNewConfigExtractsEnvVars(t *testing.T) {
 
 			assert.Equal(t, c.expected, c.getConfigValue(cfg))
 
-			if isSet {
-				err = os.Setenv(c.envKey, originalValue)
-				if err != nil {
-					t.Fatalf("error setting env var %s=%s: %s", c.envKey, originalValue, err)
-				}
-			} else {
+			// Restore previous states of environment variables.
+			if !isSet {
+				// c.envKey was previously unset.
 				err = os.Unsetenv(c.envKey)
 				if err != nil {
 					t.Fatalf("error unsetting env var %s: %s", c.envKey, err)
 				}
 			}
+			for key, value := range existingEnv {
+				err = os.Setenv(key, value)
+				if err != nil {
+					t.Fatalf("error setting env var %s=%s: %s", key, value, err)
+				}
+			}
 		})
 	}
 }
@@ -130,6 +153,10 @@ func TestNewConfigUserAgent(t *testing.T) {
 }
 
 func TestNewConfigUserAgent_nilClientUsesDefault(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test in short mode.")
+		return
+	}
 	ctx := context.Background()
 	offline := false
 	cfg, err := NewConfig(ctx, "project", "", "", offline, "", nil)
@@ -141,6 +168,10 @@ func TestNewConfigUserAgent_nilClientUsesDefault(t *testing.T) {
 }
 
 func TestNewConfigUserAgent_usesPassedClient(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test in short mode.")
+		return
+	}
 	ctx := context.Background()
 	offline := false
 	client := &http.Client{}
diff --git a/mmv1/third_party/tgc/sql_database_instance.go b/mmv1/third_party/tgc/sql_database_instance.go
index 9eba9d623725..add0a43f459c 100644
--- a/mmv1/third_party/tgc/sql_database_instance.go
+++ b/mmv1/third_party/tgc/sql_database_instance.go
@@ -110,7 +110,7 @@ func expandSqlDatabaseInstanceSettings(configured []interface{}, secondGen bool)
 		PricingPlan:         _settings["pricing_plan"].(string),
 		UserLabels:          tpgresource.ConvertStringMap(_settings["user_labels"].(map[string]interface{})),
 		BackupConfiguration: expandBackupConfiguration(_settings["backup_configuration"].([]interface{})),
-		DatabaseFlags:       expandDatabaseFlags(_settings["database_flags"].([]interface{})),
+		DatabaseFlags:       expandDatabaseFlags(_settings["database_flags"].(*schema.Set).List()),
 		IpConfiguration:     expandIpConfiguration(_settings["ip_configuration"].([]interface{})),
 		LocationPreference:  expandLocationPreference(_settings["location_preference"].([]interface{})),
 		MaintenanceWindow:   expandMaintenanceWindow(_settings["maintenance_window"].([]interface{})),
diff --git a/mmv1/third_party/tgc/tests/data-ignored/example_compute_security_policy.tf b/mmv1/third_party/tgc/tests/data-ignored/example_compute_security_policy.tf
index 09759535df58..4431b34dd025 100644
--- a/mmv1/third_party/tgc/tests/data-ignored/example_compute_security_policy.tf
+++ b/mmv1/third_party/tgc/tests/data-ignored/example_compute_security_policy.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data-ignored/example_redis_instance.tf b/mmv1/third_party/tgc/tests/data-ignored/example_redis_instance.tf
index 4ac28c6ddcb3..03c1a927fbbe 100644
--- a/mmv1/third_party/tgc/tests/data-ignored/example_redis_instance.tf
+++ b/mmv1/third_party/tgc/tests/data-ignored/example_redis_instance.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/bucket.tf b/mmv1/third_party/tgc/tests/data/bucket.tf
index 4d30137f724b..3533e1fa3ca4 100644
--- a/mmv1/third_party/tgc/tests/data/bucket.tf
+++ b/mmv1/third_party/tgc/tests/data/bucket.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/bucket.tfplan.json b/mmv1/third_party/tgc/tests/data/bucket.tfplan.json
new file mode 100644
index 000000000000..18fd52e1d8d5
--- /dev/null
+++ b/mmv1/third_party/tgc/tests/data/bucket.tfplan.json
@@ -0,0 +1,173 @@
+{
+  "format_version": "1.1",
+  "terraform_version": "1.3.2",
+  "planned_values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_storage_bucket.my-test-bucket",
+          "mode": "managed",
+          "type": "google_storage_bucket",
+          "name": "my-test-bucket",
+          "provider_name": "registry.terraform.io/hashicorp/google",
+          "schema_version": 1,
+          "values": {
+            "autoclass": [],
+            "cors": [],
+            "custom_placement_config": [],
+            "default_event_based_hold": null,
+            "encryption": [],
+            "force_destroy": false,
+            "labels": null,
+            "lifecycle_rule": [],
+            "location": "EU",
+            "logging": [],
+            "name": "test-bucket",
+            "requester_pays": null,
+            "retention_policy": [],
+            "storage_class": "STANDARD",
+            "timeouts": null,
+            "website": [
+              {
+                "main_page_suffix": "index.html",
+                "not_found_page": "404.html"
+              }
+            ]
+          },
+          "sensitive_values": {
+            "autoclass": [],
+            "cors": [],
+            "custom_placement_config": [],
+            "effective_labels": {},
+            "encryption": [],
+            "lifecycle_rule": [],
+            "logging": [],
+            "retention_policy": [],
+            "terraform_labels": {},
+            "versioning": [],
+            "website": [
+              {}
+            ]
+          }
+        }
+      ]
+    }
+  },
+  "resource_changes": [
+    {
+      "address": "google_storage_bucket.my-test-bucket",
+      "mode": "managed",
+      "type": "google_storage_bucket",
+      "name": "my-test-bucket",
+      "provider_name": "registry.terraform.io/hashicorp/google",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "autoclass": [],
+          "cors": [],
+          "custom_placement_config": [],
+          "default_event_based_hold": null,
+          "encryption": [],
+          "force_destroy": false,
+          "labels": null,
+          "lifecycle_rule": [],
+          "location": "EU",
+          "logging": [],
+          "name": "test-bucket",
+          "requester_pays": null,
+          "retention_policy": [],
+          "storage_class": "STANDARD",
+          "timeouts": null,
+          "website": [
+            {
+              "main_page_suffix": "index.html",
+              "not_found_page": "404.html"
+            }
+          ]
+        },
+        "after_unknown": {
+          "autoclass": [],
+          "cors": [],
+          "custom_placement_config": [],
+          "effective_labels": true,
+          "encryption": [],
+          "id": true,
+          "lifecycle_rule": [],
+          "logging": [],
+          "project": true,
+          "public_access_prevention": true,
+          "retention_policy": [],
+          "self_link": true,
+          "terraform_labels": true,
+          "uniform_bucket_level_access": true,
+          "url": true,
+          "versioning": true,
+          "website": [
+            {}
+          ]
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "autoclass": [],
+          "cors": [],
+          "custom_placement_config": [],
+          "effective_labels": {},
+          "encryption": [],
+          "lifecycle_rule": [],
+          "logging": [],
+          "retention_policy": [],
+          "terraform_labels": {},
+          "versioning": [],
+          "website": [
+            {}
+          ]
+        }
+      }
+    }
+  ],
+  "configuration": {
+    "provider_config": {
+      "google": {
+        "name": "google",
+        "expressions": {
+          "project": {
+            "constant_value": "{{.Provider.project}}"
+          }
+        }
+      }
+    },
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_storage_bucket.my-test-bucket",
+          "mode": "managed",
+          "type": "google_storage_bucket",
+          "name": "my-test-bucket",
+          "provider_config_key": "google",
+          "expressions": {
+            "location": {
+              "constant_value": "EU"
+            },
+            "name": {
+              "constant_value": "test-bucket"
+            },
+            "website": [
+              {
+                "main_page_suffix": {
+                  "constant_value": "index.html"
+                },
+                "not_found_page": {
+                  "constant_value": "404.html"
+                }
+              }
+            ]
+          },
+          "schema_version": 1
+        }
+      ]
+    }
+  }
+}
diff --git a/mmv1/third_party/tgc/tests/data/disk.tf b/mmv1/third_party/tgc/tests/data/disk.tf
index befa7f0af536..d4b108bf3428 100644
--- a/mmv1/third_party/tgc/tests/data/disk.tf
+++ b/mmv1/third_party/tgc/tests/data/disk.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/disk.tfplan.json b/mmv1/third_party/tgc/tests/data/disk.tfplan.json
new file mode 100644
index 000000000000..4eec5f9e01fa
--- /dev/null
+++ b/mmv1/third_party/tgc/tests/data/disk.tfplan.json
@@ -0,0 +1,177 @@
+{
+  "format_version": "1.1",
+  "terraform_version": "1.3.2",
+  "planned_values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_compute_disk.my-disk-resource",
+          "mode": "managed",
+          "type": "google_compute_disk",
+          "name": "my-disk-resource",
+          "provider_name": "registry.terraform.io/hashicorp/google",
+          "schema_version": 0,
+          "values": {
+            "async_primary_disk": [],
+            "description": null,
+            "disk_encryption_key": [],
+            "effective_labels": {
+              "disk-label-key-a": "disk-label-val-a"
+            },
+            "image": "projects/debian-cloud/global/images/debian-8-jessie-v20170523",
+            "labels": {
+              "disk-label-key-a": "disk-label-val-a"
+            },
+            "name": "my-disk",
+            "project": "{{.Provider.project}}",
+            "snapshot": null,
+            "source_disk": null,
+            "source_image_encryption_key": [],
+            "source_snapshot_encryption_key": [],
+            "terraform_labels": {
+              "disk-label-key-a": "disk-label-val-a"
+            },
+            "timeouts": null,
+            "type": "pd-ssd",
+            "zone": "us-central1-a"
+          },
+          "sensitive_values": {
+            "async_primary_disk": [],
+            "disk_encryption_key": [],
+            "effective_labels": {},
+            "guest_os_features": [],
+            "labels": {},
+            "licenses": [],
+            "source_image_encryption_key": [],
+            "source_snapshot_encryption_key": [],
+            "terraform_labels": {},
+            "users": []
+          }
+        }
+      ]
+    }
+  },
+  "resource_changes": [
+    {
+      "address": "google_compute_disk.my-disk-resource",
+      "mode": "managed",
+      "type": "google_compute_disk",
+      "name": "my-disk-resource",
+      "provider_name": "registry.terraform.io/hashicorp/google",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "async_primary_disk": [],
+          "description": null,
+          "disk_encryption_key": [],
+          "effective_labels": {
+            "disk-label-key-a": "disk-label-val-a"
+          },
+          "image": "projects/debian-cloud/global/images/debian-8-jessie-v20170523",
+          "labels": {
+            "disk-label-key-a": "disk-label-val-a"
+          },
+          "name": "my-disk",
+          "project": "{{.Provider.project}}",
+          "snapshot": null,
+          "source_disk": null,
+          "source_image_encryption_key": [],
+          "source_snapshot_encryption_key": [],
+          "terraform_labels": {
+            "disk-label-key-a": "disk-label-val-a"
+          },
+          "timeouts": null,
+          "type": "pd-ssd",
+          "zone": "us-central1-a"
+        },
+        "after_unknown": {
+          "async_primary_disk": [],
+          "creation_timestamp": true,
+          "disk_encryption_key": [],
+          "effective_labels": {},
+          "guest_os_features": true,
+          "id": true,
+          "label_fingerprint": true,
+          "labels": {},
+          "last_attach_timestamp": true,
+          "last_detach_timestamp": true,
+          "licenses": true,
+          "physical_block_size_bytes": true,
+          "provisioned_iops": true,
+          "provisioned_throughput": true,
+          "self_link": true,
+          "size": true,
+          "source_disk_id": true,
+          "source_image_encryption_key": [],
+          "source_image_id": true,
+          "source_snapshot_encryption_key": [],
+          "source_snapshot_id": true,
+          "terraform_labels": {},
+          "users": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "async_primary_disk": [],
+          "disk_encryption_key": [],
+          "effective_labels": {},
+          "guest_os_features": [],
+          "labels": {},
+          "licenses": [],
+          "source_image_encryption_key": [],
+          "source_snapshot_encryption_key": [],
+          "terraform_labels": {},
+          "users": []
+        }
+      }
+    }
+  ],
+  "configuration": {
+    "provider_config": {
+      "google": {
+        "name": "google",
+        "expressions": {
+          "project": {
+            "constant_value": "{{.Provider.project}}"
+          }
+        }
+      }
+    },
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_compute_disk.my-disk-resource",
+          "mode": "managed",
+          "type": "google_compute_disk",
+          "name": "my-disk-resource",
+          "provider_config_key": "google",
+          "expressions": {
+            "image": {
+              "constant_value": "projects/debian-cloud/global/images/debian-8-jessie-v20170523"
+            },
+            "labels": {
+              "constant_value": {
+                "disk-label-key-a": "disk-label-val-a"
+              }
+            },
+            "name": {
+              "constant_value": "my-disk"
+            },
+            "project": {
+              "constant_value": "{{.Provider.project}}"
+            },
+            "type": {
+              "constant_value": "pd-ssd"
+            },
+            "zone": {
+              "constant_value": "us-central1-a"
+            }
+          },
+          "schema_version": 0
+        }
+      ]
+    }
+  }
+}
diff --git a/mmv1/third_party/tgc/tests/data/example_access_context_manager_access_policy.tf b/mmv1/third_party/tgc/tests/data/example_access_context_manager_access_policy.tf
index 9c4f0226a80e..e675291a8230 100644
--- a/mmv1/third_party/tgc/tests/data/example_access_context_manager_access_policy.tf
+++ b/mmv1/third_party/tgc/tests/data/example_access_context_manager_access_policy.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
@@ -31,4 +31,4 @@ resource "google_access_context_manager_access_policy" "access-policy" {
   parent = "organizations/{{.OrgID}}"
   title  = "Scoped Access Policy"
   scopes = ["projects/{{.Provider.project}}"]
-}
\ No newline at end of file
+}
diff --git a/mmv1/third_party/tgc/tests/data/example_access_context_manager_service_perimeter.json b/mmv1/third_party/tgc/tests/data/example_access_context_manager_service_perimeter.json
index 4dfc6f74802d..8e0990e72376 100644
--- a/mmv1/third_party/tgc/tests/data/example_access_context_manager_service_perimeter.json
+++ b/mmv1/third_party/tgc/tests/data/example_access_context_manager_service_perimeter.json
@@ -15,7 +15,13 @@
           "egressPolicies": [
             {
               "egressFrom": {
-                "identityType": "ANY_USER_ACCOUNT"
+                "identityType": "ANY_USER_ACCOUNT",
+                "sourceRestriction": "SOURCE_RESTRICTION_ENABLED",
+                "sources": [
+                    {
+                      "accessLevel": "accessPolicies/987654/accessLevels/restrict_storage"
+                    }
+                  ]
               }
             }
           ],
diff --git a/mmv1/third_party/tgc/tests/data/example_access_context_manager_service_perimeter.tf b/mmv1/third_party/tgc/tests/data/example_access_context_manager_service_perimeter.tf
index 84129b040882..ca8852445502 100644
--- a/mmv1/third_party/tgc/tests/data/example_access_context_manager_service_perimeter.tf
+++ b/mmv1/third_party/tgc/tests/data/example_access_context_manager_service_perimeter.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
@@ -57,6 +57,10 @@ resource "google_access_context_manager_service_perimeter" "service-perimeter" {
 
     egress_policies {
       egress_from {
+        sources {
+          access_level = "accessPolicies/987654/accessLevels/restrict_storage"
+        }
+	source_restriction = "SOURCE_RESTRICTION_ENABLED"
         identity_type = "ANY_USER_ACCOUNT"
       }
     }
diff --git a/mmv1/third_party/tgc/tests/data/example_access_context_manager_service_perimeter.tfplan.json b/mmv1/third_party/tgc/tests/data/example_access_context_manager_service_perimeter.tfplan.json
index b8f59687a9f8..f3f2736a30cb 100644
--- a/mmv1/third_party/tgc/tests/data/example_access_context_manager_service_perimeter.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_access_context_manager_service_perimeter.tfplan.json
@@ -25,7 +25,13 @@
                     "egress_from": [
                       {
                         "identities": null,
-                        "identity_type": "ANY_USER_ACCOUNT"
+                        "identity_type": "ANY_USER_ACCOUNT",
+                        "sources": [
+                          {
+                            "access_level": "accessPolicies/987654/accessLevels/restrict_storage"
+                          }
+                        ],
+                        "source_restriction": "SOURCE_RESTRICTION_ENABLED"
                       }
                     ],
                     "egress_to": []
@@ -110,7 +116,13 @@
                   "egress_from": [
                     {
                       "identities": null,
-                      "identity_type": "ANY_USER_ACCOUNT"
+                      "identity_type": "ANY_USER_ACCOUNT",
+                      "sources": [
+                        {
+                          "access_level": "accessPolicies/987654/accessLevels/restrict_storage"
+                        }
+                      ],
+                      "source_restriction": "SOURCE_RESTRICTION_ENABLED"
                     }
                   ],
                   "egress_to": []
@@ -174,7 +186,11 @@
               "egress_policies": [
                 {
                   "egress_from": [
-                    {}
+                    {
+                      "sources": [
+                        {}
+                      ]
+                    }
                   ],
                   "egress_to": []
                 }
@@ -252,6 +268,16 @@
                       {
                         "identity_type": {
                           "constant_value": "ANY_USER_ACCOUNT"
+                        },
+                        "sources": [
+                          {
+                            "access_level":{
+                              "constant_value": "accessPolicies/987654/accessLevels/restrict_storage"
+                            }
+                          }
+                        ],
+                        "source_restriction": {
+                          "constant_value": "SOURCE_RESTRICTION_ENABLED"
                         }
                       }
                     ]
@@ -321,4 +347,5 @@
       ]
     }
   }
-}
\ No newline at end of file
+}
+
diff --git a/mmv1/third_party/tgc/tests/data/example_bigquery_dataset.tf b/mmv1/third_party/tgc/tests/data/example_bigquery_dataset.tf
index 43fdc6d16449..44bd499f16c0 100644
--- a/mmv1/third_party/tgc/tests/data/example_bigquery_dataset.tf
+++ b/mmv1/third_party/tgc/tests/data/example_bigquery_dataset.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_bigquery_dataset.tfplan.json b/mmv1/third_party/tgc/tests/data/example_bigquery_dataset.tfplan.json
index 9249c8265cf9..af30e0797b5a 100644
--- a/mmv1/third_party/tgc/tests/data/example_bigquery_dataset.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_bigquery_dataset.tfplan.json
@@ -18,10 +18,16 @@
             "default_table_expiration_ms": 3600000,
             "delete_contents_on_destroy": false,
             "description": null,
+            "effective_labels": {
+              "env": "dev"
+            },
             "friendly_name": null,
             "labels": {
               "env": "dev"
             },
+            "terraform_labels": {
+              "env": "dev"
+            },
             "location": "EU",
             "timeouts": null
           }
@@ -48,22 +54,30 @@
           "default_table_expiration_ms": 3600000,
           "delete_contents_on_destroy": false,
           "description": null,
+          "effective_labels": {
+            "env": "dev"
+          },
           "friendly_name": null,
           "labels": {
             "env": "dev"
           },
+          "terraform_labels": {
+            "env": "dev"
+          },
           "location": "EU",
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "access": true,
           "creation_time": true,
           "default_encryption_configuration": [],
+          "effective_labels": {},
           "etag": true,
           "id": true,
           "labels": {},
+          "terraform_labels": {},
           "last_modified_time": true,
-          "project": true,
           "self_link": true
         }
       }
diff --git a/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_binding.tf b/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_binding.tf
index df14ceb21113..f8330b074568 100644
--- a/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_binding.tf
+++ b/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_binding.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
@@ -36,7 +36,7 @@ resource "google_bigquery_dataset" "example_dataset" {
   labels = {
     env = "dev"
   }
-  
+
 }
 
 resource "google_bigquery_dataset_iam_binding" "dataset" {
diff --git a/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_binding.tfplan.json b/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_binding.tfplan.json
index d3a1e114db80..2f1d6df487de 100644
--- a/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_binding.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_binding.tfplan.json
@@ -17,10 +17,16 @@
 					"default_table_expiration_ms": 3600000,
 					"delete_contents_on_destroy": false,
 					"description": null,
+					"effective_labels": {
+						"env": "dev"
+					},
 					"friendly_name": null,
 					"labels": {
 						"env": "dev"
 					},
+					"terraform_labels": {
+						"env": "dev"
+					},
 					"location": "EU",
 					"project": "{{.Provider.project}}",
 					"timeouts": null
@@ -57,10 +63,16 @@
 				"default_table_expiration_ms": 3600000,
 				"delete_contents_on_destroy": false,
 				"description": null,
+				"effective_labels": {
+					"env": "dev"
+				},
 				"friendly_name": null,
 				"labels": {
 					"env": "dev"
 				},
+				"terraform_labels": {
+					"env": "dev"
+				},
 				"location": "EU",
 				"project": "{{.Provider.project}}",
 				"timeouts": null
@@ -69,9 +81,11 @@
 				"access": true,
 				"creation_time": true,
 				"default_encryption_configuration": [],
+				"effective_labels": {},
 				"etag": true,
 				"id": true,
 				"labels": {},
+				"terraform_labels": {},
 				"last_modified_time": true,
 				"self_link": true
 			}
@@ -89,14 +103,14 @@
 				"condition": [],
 				"dataset_id": "test-dataset",
 				"members": ["allAuthenticatedUsers", "allUsers"],
-				"role": "roles/bigquery.dataViewer"
+				"role": "roles/bigquery.dataViewer",
+				"project": "{{.Provider.project}}"
 			},
 			"after_unknown": {
 				"condition": [],
 				"etag": true,
 				"id": true,
-				"members": [false, false],
-				"project": true
+				"members": [false, false]
 			}
 		}
 	}],
diff --git a/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_member.tf b/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_member.tf
index a362662893a5..f7d87317adeb 100644
--- a/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_member.tf
+++ b/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_member.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
@@ -36,14 +36,14 @@ resource "google_bigquery_dataset" "example_dataset" {
   labels = {
     env = "dev"
   }
-  
+
 }
 
 resource "google_bigquery_dataset_iam_member" "dataset" {
   dataset_id = google_bigquery_dataset.example_dataset.dataset_id
   role       = "roles/bigquery.dataEditor"
   member     = "allAuthenticatedUsers"
-    
+
 }
 
 
diff --git a/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_member.tfplan.json b/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_member.tfplan.json
index 5848f267fdd9..aab8eddd6502 100644
--- a/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_member.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_member.tfplan.json
@@ -17,10 +17,16 @@
 					"default_table_expiration_ms": 3600000,
 					"delete_contents_on_destroy": false,
 					"description": null,
+					"effective_labels": {
+						"env": "dev"
+					},
 					"friendly_name": null,
 					"labels": {
 						"env": "dev"
 					},
+					"terraform_labels": {
+						"env": "dev"
+					},
 					"location": "EU",
 					"project": "{{.Provider.project}}",
 					"timeouts": null
@@ -57,10 +63,16 @@
 				"default_table_expiration_ms": 3600000,
 				"delete_contents_on_destroy": false,
 				"description": null,
+				"effective_labels": {
+					"env": "dev"
+				},
 				"friendly_name": null,
 				"labels": {
 					"env": "dev"
 				},
+				"terraform_labels": {
+					"env": "dev"
+				},
 				"location": "EU",
 				"project": "{{.Provider.project}}",
 				"timeouts": null
@@ -69,9 +81,11 @@
 				"access": true,
 				"creation_time": true,
 				"default_encryption_configuration": [],
+				"effective_labels": {},
 				"etag": true,
 				"id": true,
 				"labels": {},
+				"terraform_labels": {},
 				"last_modified_time": true,
 				"self_link": true
 			}
@@ -89,13 +103,13 @@
 				"condition": [],
 				"dataset_id": "test-dataset",
 				"member": "allAuthenticatedUsers",
-				"role": "roles/bigquery.dataEditor"
+				"role": "roles/bigquery.dataEditor",
+				"project": "{{.Provider.project}}"
 			},
 			"after_unknown": {
 				"condition": [],
 				"etag": true,
-				"id": true,
-				"project": true
+				"id": true
 			}
 		}
 	}],
diff --git a/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_policy.tf b/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_policy.tf
index 73e61c45b67c..ae6554fe8d28 100644
--- a/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_policy.tf
+++ b/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_policy.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
@@ -36,7 +36,7 @@ resource "google_bigquery_dataset" "example-dataset" {
   labels = {
     env = "dev"
   }
-  
+
 }
 
 resource "google_bigquery_dataset_iam_policy" "dataset" {
diff --git a/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_policy.tfplan.json b/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_policy.tfplan.json
index 6a19eeda793f..5ed2c459f771 100644
--- a/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_policy.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_policy.tfplan.json
@@ -17,10 +17,16 @@
 					"default_table_expiration_ms": 3600000,
 					"delete_contents_on_destroy": false,
 					"description": null,
+					"effective_labels": {
+						"env": "dev"
+					},
 					"friendly_name": null,
 					"labels": {
 						"env": "dev"
 					},
+					"terraform_labels": {
+						"env": "dev"
+					},
 					"location": "EU",
 					"project": "{{.Provider.project}}",
 					"timeouts": null
@@ -55,10 +61,16 @@
 				"default_table_expiration_ms": 3600000,
 				"delete_contents_on_destroy": false,
 				"description": null,
+				"effective_labels": {
+					"env": "dev"
+				},
 				"friendly_name": null,
 				"labels": {
 					"env": "dev"
 				},
+				"terraform_labels": {
+					"env": "dev"
+				},
 				"location": "EU",
 				"project": "{{.Provider.project}}",
 				"timeouts": null
@@ -67,9 +79,11 @@
 				"access": true,
 				"creation_time": true,
 				"default_encryption_configuration": [],
+				"effective_labels": {},
 				"etag": true,
 				"id": true,
 				"labels": {},
+				"terraform_labels": {},
 				"last_modified_time": true,
 				"self_link": true
 			}
@@ -85,12 +99,12 @@
 			"before": null,
 			"after": {
 				"dataset_id": "test-dataset",
-				"policy_data": "{\"bindings\":[{\"members\":[\"serviceAccount:998476993360@cloudservices.gserviceaccount.com\",\"allAuthenticatedUsers\"],\"role\":\"roles/editor\"}]}"
+				"policy_data": "{\"bindings\":[{\"members\":[\"serviceAccount:998476993360@cloudservices.gserviceaccount.com\",\"allAuthenticatedUsers\"],\"role\":\"roles/editor\"}]}",
+				"project": "{{.Provider.project}}"
 			},
 			"after_unknown": {
 				"etag": true,
-				"id": true,
-				"project": true
+				"id": true
 			}
 		}
 	}],
diff --git a/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_policy_empty_policy_data.tf b/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_policy_empty_policy_data.tf
index 8c6c2e68885f..558b593d018d 100644
--- a/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_policy_empty_policy_data.tf
+++ b/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_policy_empty_policy_data.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_policy_empty_policy_data.tfplan.json b/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_policy_empty_policy_data.tfplan.json
index 46a3574de73e..da24d6b4e520 100644
--- a/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_policy_empty_policy_data.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_bigquery_dataset_iam_policy_empty_policy_data.tfplan.json
@@ -164,7 +164,8 @@
           "friendly_name": null,
           "labels": null,
           "location": "US",
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "access": true,
@@ -173,7 +174,6 @@
           "etag": true,
           "id": true,
           "last_modified_time": true,
-          "project": true,
           "self_link": true
         },
         "before_sensitive": false,
@@ -195,13 +195,13 @@
         ],
         "before": null,
         "after": {
-          "dataset_id": "example_dataset"
+          "dataset_id": "example_dataset",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "etag": true,
           "id": true,
-          "policy_data": true,
-          "project": true
+          "policy_data": true
         },
         "before_sensitive": false,
         "after_sensitive": {}
diff --git a/mmv1/third_party/tgc/tests/data/example_bigquery_table.tf b/mmv1/third_party/tgc/tests/data/example_bigquery_table.tf
index 0f49f7ac9404..6536318b48df 100644
--- a/mmv1/third_party/tgc/tests/data/example_bigquery_table.tf
+++ b/mmv1/third_party/tgc/tests/data/example_bigquery_table.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
@@ -48,4 +48,4 @@ schema = <<EOF
 ]
 EOF
 
-}
\ No newline at end of file
+}
diff --git a/mmv1/third_party/tgc/tests/data/example_bigtable_instance.tf b/mmv1/third_party/tgc/tests/data/example_bigtable_instance.tf
index abf81499acb9..4b240025117b 100644
--- a/mmv1/third_party/tgc/tests/data/example_bigtable_instance.tf
+++ b/mmv1/third_party/tgc/tests/data/example_bigtable_instance.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
@@ -40,4 +40,4 @@ resource "google_bigtable_instance" "test" {
   labels = {
     test-name = "test-value"
   }
-}
\ No newline at end of file
+}
diff --git a/mmv1/third_party/tgc/tests/data/example_bigtable_instance.tfplan.json b/mmv1/third_party/tgc/tests/data/example_bigtable_instance.tfplan.json
index 75386ef78ffb..8a4d4c7f77a6 100644
--- a/mmv1/third_party/tgc/tests/data/example_bigtable_instance.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_bigtable_instance.tfplan.json
@@ -57,7 +57,8 @@
           "labels": {
             "test-name": "test-value"
           },
-          "name": "tf-instance"
+          "name": "tf-instance",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "cluster": [
@@ -65,8 +66,7 @@
           ],
           "display_name": true,
           "id": true,
-          "labels": {},
-          "project": true
+          "labels": {}
         }
       }
     }
diff --git a/mmv1/third_party/tgc/tests/data/example_cloud_run_mapping.tf b/mmv1/third_party/tgc/tests/data/example_cloud_run_mapping.tf
index 4c721b01875b..74d8d0fda0f9 100644
--- a/mmv1/third_party/tgc/tests/data/example_cloud_run_mapping.tf
+++ b/mmv1/third_party/tgc/tests/data/example_cloud_run_mapping.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
@@ -58,4 +58,4 @@ resource "google_cloud_run_domain_mapping" "default" {
   spec {
     route_name = google_cloud_run_service.default.name
   }
-}
\ No newline at end of file
+}
diff --git a/mmv1/third_party/tgc/tests/data/example_cloud_run_service.tf b/mmv1/third_party/tgc/tests/data/example_cloud_run_service.tf
index aabbaf4f8728..c78454062fd9 100644
--- a/mmv1/third_party/tgc/tests/data/example_cloud_run_service.tf
+++ b/mmv1/third_party/tgc/tests/data/example_cloud_run_service.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
@@ -63,4 +63,4 @@ resource "google_cloud_run_service" "default" {
       metadata.0.annotations,
     ]
   }
-}
\ No newline at end of file
+}
diff --git a/mmv1/third_party/tgc/tests/data/example_cloud_run_service.tfplan.json b/mmv1/third_party/tgc/tests/data/example_cloud_run_service.tfplan.json
index 830211d59cad..1adfddbe14c4 100644
--- a/mmv1/third_party/tgc/tests/data/example_cloud_run_service.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_cloud_run_service.tfplan.json
@@ -19,6 +19,9 @@
                 "annotations": {
                   "generated-by": "magic-modules"
                 },
+                "effective_annotations": {
+                  "generated-by": "magic-modules"
+                },
                 "namespace": "{{.Provider.project}}"
               }
             ],
@@ -86,6 +89,9 @@
               "annotations": {
                 "generated-by": "magic-modules"
               },
+              "effective_annotations": {
+                "generated-by": "magic-modules"
+              },
               "namespace": "{{.Provider.project}}"
             }
           ],
@@ -134,6 +140,7 @@
           "metadata": [
             {
               "annotations": {},
+              "effective_annotations": {},
               "generation": true,
               "labels": true,
               "resource_version": true,
diff --git a/mmv1/third_party/tgc/tests/data/example_cloud_run_service_iam_binding.tf b/mmv1/third_party/tgc/tests/data/example_cloud_run_service_iam_binding.tf
index 14d9e774d2c7..1b89ab364e8a 100644
--- a/mmv1/third_party/tgc/tests/data/example_cloud_run_service_iam_binding.tf
+++ b/mmv1/third_party/tgc/tests/data/example_cloud_run_service_iam_binding.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_cloud_run_service_iam_binding.tfplan.json b/mmv1/third_party/tgc/tests/data/example_cloud_run_service_iam_binding.tfplan.json
index 341f5d1bf5a1..6c88f6ec49e5 100644
--- a/mmv1/third_party/tgc/tests/data/example_cloud_run_service_iam_binding.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_cloud_run_service_iam_binding.tfplan.json
@@ -142,12 +142,12 @@
               "percent": 100,
               "revision_name": null
             }
-          ]
+          ],
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "id": true,
           "metadata": true,
-          "project": true,
           "status": true,
           "template": [
             {
@@ -222,7 +222,8 @@
             "user:jane@example.com"
           ],
           "role": "roles/viewer",
-          "service": "cloudrun-srv"
+          "service": "cloudrun-srv",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "condition": [],
@@ -230,8 +231,7 @@
           "id": true,
           "members": [
             false
-          ],
-          "project": true
+          ]
         },
         "before_sensitive": false,
         "after_sensitive": {
diff --git a/mmv1/third_party/tgc/tests/data/example_cloud_run_service_iam_member.tf b/mmv1/third_party/tgc/tests/data/example_cloud_run_service_iam_member.tf
index 858c67c7e057..d0ae97df8078 100644
--- a/mmv1/third_party/tgc/tests/data/example_cloud_run_service_iam_member.tf
+++ b/mmv1/third_party/tgc/tests/data/example_cloud_run_service_iam_member.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_cloud_run_service_iam_member.tfplan.json b/mmv1/third_party/tgc/tests/data/example_cloud_run_service_iam_member.tfplan.json
index ac3b905fd64f..8b0f4bed1147 100644
--- a/mmv1/third_party/tgc/tests/data/example_cloud_run_service_iam_member.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_cloud_run_service_iam_member.tfplan.json
@@ -137,12 +137,12 @@
               "percent": 100,
               "revision_name": null
             }
-          ]
+          ],
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "id": true,
           "metadata": true,
-          "project": true,
           "status": true,
           "template": [
             {
@@ -215,13 +215,13 @@
           "location": "us-central1",
           "member": "user:jane@example.com",
           "role": "roles/viewer",
-          "service": "cloudrun-srv"
+          "service": "cloudrun-srv",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "condition": [],
           "etag": true,
-          "id": true,
-          "project": true
+          "id": true
         },
         "before_sensitive": false,
         "after_sensitive": {
diff --git a/mmv1/third_party/tgc/tests/data/example_cloud_run_service_iam_policy.tf b/mmv1/third_party/tgc/tests/data/example_cloud_run_service_iam_policy.tf
index 0e64eeb0f485..230b23b95b7d 100644
--- a/mmv1/third_party/tgc/tests/data/example_cloud_run_service_iam_policy.tf
+++ b/mmv1/third_party/tgc/tests/data/example_cloud_run_service_iam_policy.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_cloud_run_service_iam_policy.tfplan.json b/mmv1/third_party/tgc/tests/data/example_cloud_run_service_iam_policy.tfplan.json
index 5d8ba47a9267..223a86bb1be2 100644
--- a/mmv1/third_party/tgc/tests/data/example_cloud_run_service_iam_policy.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_cloud_run_service_iam_policy.tfplan.json
@@ -133,12 +133,12 @@
               "percent": 100,
               "revision_name": null
             }
-          ]
+          ],
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "id": true,
           "metadata": true,
-          "project": true,
           "status": true,
           "template": [
             {
@@ -209,12 +209,12 @@
         "after": {
           "location": "us-central1",
           "policy_data": "{\"bindings\":[{\"members\":[\"user:jane@example.com\"],\"role\":\"roles/editor\"}]}",
-          "service": "cloudrun-srv"
+          "service": "cloudrun-srv",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "etag": true,
-          "id": true,
-          "project": true
+          "id": true
         },
         "before_sensitive": false,
         "after_sensitive": {}
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_address.json b/mmv1/third_party/tgc/tests/data/example_compute_address.json
index c3cda8696550..3c9364e3a80f 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_address.json
+++ b/mmv1/third_party/tgc/tests/data/example_compute_address.json
@@ -10,7 +10,8 @@
       "parent": "//cloudresourcemanager.googleapis.com/projects/{{.Provider.project}}",
       "data": {
         "autoCreateSubnetworks": true,
-        "name": "my-network"
+        "name": "my-network",
+        "networkFirewallPolicyEnforcementOrder": "AFTER_CLASSIC_FIREWALL"
       }
     }
   },
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_address.tf b/mmv1/third_party/tgc/tests/data/example_compute_address.tf
index 0755c67f7670..5346ea03353f 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_address.tf
+++ b/mmv1/third_party/tgc/tests/data/example_compute_address.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_address.tfplan.json b/mmv1/third_party/tgc/tests/data/example_compute_address.tfplan.json
index d5d68aa663bf..419c358f9b4a 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_address.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_compute_address.tfplan.json
@@ -87,13 +87,13 @@
           "network": null,
           "prefix_length": null,
           "region": "us-central1",
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "creation_timestamp": true,
           "id": true,
           "network_tier": true,
-          "project": true,
           "purpose": true,
           "self_link": true,
           "subnetwork": true,
@@ -121,13 +121,14 @@
           "delete_default_routes_on_create": false,
           "description": null,
           "name": "my-network",
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}",
+          "network_firewall_policy_enforcement_order": "AFTER_CLASSIC_FIREWALL"
         },
         "after_unknown": {
           "gateway_ipv4": true,
           "id": true,
           "mtu": true,
-          "project": true,
           "routing_mode": true,
           "self_link": true
         },
@@ -155,7 +156,8 @@
           "private_ip_google_access": null,
           "region": "us-central1",
           "role": null,
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "creation_timestamp": true,
@@ -167,7 +169,6 @@
           "log_config": [],
           "network": true,
           "private_ipv6_google_access": true,
-          "project": true,
           "purpose": true,
           "secondary_ip_range": true,
           "self_link": true,
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_disk.tf b/mmv1/third_party/tgc/tests/data/example_compute_disk.tf
index bd54910d4162..4e59100a052e 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_disk.tf
+++ b/mmv1/third_party/tgc/tests/data/example_compute_disk.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_disk.tfplan.json b/mmv1/third_party/tgc/tests/data/example_compute_disk.tfplan.json
index ebc95b4dca87..e1a8091c0b06 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_disk.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_compute_disk.tfplan.json
@@ -15,6 +15,9 @@
             "description": null,
             "disk_encryption_key": [],
             "disk_encryption_key_raw": null,
+            "effective_labels": {
+              "environment": "dev"
+            },
             "image": "projects/debian-cloud/global/images/debian-8-jessie-v20170523",
             "labels": {
               "environment": "dev"
@@ -24,6 +27,9 @@
             "snapshot": null,
             "source_image_encryption_key": [],
             "source_snapshot_encryption_key": [],
+            "terraform_labels": {
+              "environment": "dev"
+            },
             "timeouts": null,
             "type": "pd-ssd",
             "zone": "us-central1-a"
@@ -48,6 +54,9 @@
           "description": null,
           "disk_encryption_key": [],
           "disk_encryption_key_raw": null,
+          "effective_labels": {
+            "environment": "dev"
+          },
           "image": "projects/debian-cloud/global/images/debian-8-jessie-v20170523",
           "labels": {
             "environment": "dev"
@@ -57,26 +66,31 @@
           "snapshot": null,
           "source_image_encryption_key": [],
           "source_snapshot_encryption_key": [],
+          "terraform_labels": {
+            "environment": "dev"
+          },
           "timeouts": null,
           "type": "pd-ssd",
-          "zone": "us-central1-a"
+          "zone": "us-central1-a",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "creation_timestamp": true,
           "disk_encryption_key": [],
           "disk_encryption_key_sha256": true,
+          "effective_labels": {},
           "id": true,
           "label_fingerprint": true,
           "labels": {},
           "last_attach_timestamp": true,
           "last_detach_timestamp": true,
-          "project": true,
           "self_link": true,
           "size": true,
           "source_image_encryption_key": [],
           "source_image_id": true,
           "source_snapshot_encryption_key": [],
           "source_snapshot_id": true,
+          "terraform_labels": {},
           "users": true
         }
       }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_disk_empty_image.tf b/mmv1/third_party/tgc/tests/data/example_compute_disk_empty_image.tf
index 3168f98ade02..2daffd659355 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_disk_empty_image.tf
+++ b/mmv1/third_party/tgc/tests/data/example_compute_disk_empty_image.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_disk_empty_image.tfplan.json b/mmv1/third_party/tgc/tests/data/example_compute_disk_empty_image.tfplan.json
index e44bdfa8c85c..fbeab06d9542 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_disk_empty_image.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_compute_disk_empty_image.tfplan.json
@@ -15,6 +15,9 @@
             "description": null,
             "disk_encryption_key": [],
             "disk_encryption_key_raw": null,
+            "effective_labels": {
+              "environment": "dev"
+            },
             "image": "",
             "labels": {
               "environment": "dev"
@@ -24,6 +27,9 @@
             "snapshot": null,
             "source_image_encryption_key": [],
             "source_snapshot_encryption_key": [],
+            "terraform_labels": {
+              "environment": "dev"
+            },
             "timeouts": null,
             "type": "pd-ssd",
             "zone": "us-central1-a"
@@ -48,6 +54,9 @@
           "description": null,
           "disk_encryption_key": [],
           "disk_encryption_key_raw": null,
+          "effective_labels": {
+            "environment": "dev"
+          },
           "image": "",
           "labels": {
             "environment": "dev"
@@ -57,26 +66,31 @@
           "snapshot": null,
           "source_image_encryption_key": [],
           "source_snapshot_encryption_key": [],
+          "terraform_labels": {
+            "environment": "dev"
+          },
           "timeouts": null,
           "type": "pd-ssd",
-          "zone": "us-central1-a"
+          "zone": "us-central1-a",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "creation_timestamp": true,
           "disk_encryption_key": [],
           "disk_encryption_key_sha256": true,
+          "effective_labels": {},
           "id": true,
           "label_fingerprint": true,
           "labels": {},
           "last_attach_timestamp": true,
           "last_detach_timestamp": true,
-          "project": true,
           "self_link": true,
           "size": true,
           "source_image_encryption_key": [],
           "source_image_id": true,
           "source_snapshot_encryption_key": [],
           "source_snapshot_id": true,
+          "terraform_labels": {},
           "users": true
         }
       }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_firewall.json b/mmv1/third_party/tgc/tests/data/example_compute_firewall.json
index cde6175f707a..f50ef6504683 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_firewall.json
+++ b/mmv1/third_party/tgc/tests/data/example_compute_firewall.json
@@ -46,7 +46,8 @@
       "parent": "//cloudresourcemanager.googleapis.com/projects/{{.Provider.project}}",
       "data": {
         "autoCreateSubnetworks": true,
-        "name": "test-network"
+        "name": "test-network",
+        "networkFirewallPolicyEnforcementOrder": "AFTER_CLASSIC_FIREWALL"
       }
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_firewall.tf b/mmv1/third_party/tgc/tests/data/example_compute_firewall.tf
index c90636ff0c0e..5a825069606e 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_firewall.tf
+++ b/mmv1/third_party/tgc/tests/data/example_compute_firewall.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_firewall.tfplan.json b/mmv1/third_party/tgc/tests/data/example_compute_firewall.tfplan.json
index e38dce0e7fc7..285cdf8bcc8a 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_firewall.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_compute_firewall.tfplan.json
@@ -99,7 +99,8 @@
           ],
           "target_service_accounts": null,
           "target_tags": null,
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "allow": [
@@ -119,7 +120,6 @@
           "destination_ranges": true,
           "direction": true,
           "id": true,
-          "project": true,
           "self_link": true,
           "source_ranges": true,
           "source_tags": [
@@ -145,12 +145,13 @@
           "description": null,
           "ipv4_range": null,
           "name": "test-network",
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}",
+          "network_firewall_policy_enforcement_order": "AFTER_CLASSIC_FIREWALL"
         },
         "after_unknown": {
           "gateway_ipv4": true,
           "id": true,
-          "project": true,
           "routing_mode": true,
           "self_link": true
         }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_forwarding_rule.json b/mmv1/third_party/tgc/tests/data/example_compute_forwarding_rule.json
index 23408b550815..5faf853ed4cc 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_forwarding_rule.json
+++ b/mmv1/third_party/tgc/tests/data/example_compute_forwarding_rule.json
@@ -15,7 +15,9 @@
         "loadBalancingScheme": "INTERNAL_MANAGED",
         "name": "test-forwarding-rule",
         "portRange": "80",
-        "region": "projects/{{.Provider.project}}/global/regions/australia-southeast1"
+        "region": "projects/{{.Provider.project}}/global/regions/australia-southeast1",
+        "allowPscGlobalAccess": false,
+        "noAutomateDnsZone":    false
       }
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_forwarding_rule.tf b/mmv1/third_party/tgc/tests/data/example_compute_forwarding_rule.tf
index 5701f5d148c3..e471b909d740 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_forwarding_rule.tf
+++ b/mmv1/third_party/tgc/tests/data/example_compute_forwarding_rule.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
@@ -28,11 +28,11 @@ provider "google" {
 }
 
 resource "google_compute_forwarding_rule" "default" {
-  
+
   name                  = "test-forwarding-rule"
   load_balancing_scheme = "INTERNAL_MANAGED"
   ip_protocol           = "TCP"
   region                = "australia-southeast1"
   port_range            = 80
   backend_service       = "test-backend-service-id"
-}
\ No newline at end of file
+}
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_forwarding_rule.tfplan.json b/mmv1/third_party/tgc/tests/data/example_compute_forwarding_rule.tfplan.json
new file mode 100644
index 000000000000..e07ad1fcd1f6
--- /dev/null
+++ b/mmv1/third_party/tgc/tests/data/example_compute_forwarding_rule.tfplan.json
@@ -0,0 +1,148 @@
+{
+  "format_version": "1.1",
+  "terraform_version": "1.3.2",
+  "planned_values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_compute_forwarding_rule.default",
+          "mode": "managed",
+          "type": "google_compute_forwarding_rule",
+          "name": "default",
+          "provider_name": "registry.terraform.io/hashicorp/google",
+          "schema_version": 0,
+          "values": {
+            "all_ports": null,
+            "allow_global_access": null,
+            "allow_psc_global_access": null,
+            "backend_service": "test-backend-service-id",
+            "description": null,
+            "ip_protocol": "TCP",
+            "is_mirroring_collector": null,
+            "labels": null,
+            "load_balancing_scheme": "INTERNAL_MANAGED",
+            "name": "test-forwarding-rule",
+            "no_automate_dns_zone": null,
+            "port_range": "80",
+            "ports": null,
+            "project": "{{.Provider.project}}",
+            "region": "australia-southeast1",
+            "service_label": null,
+            "source_ip_ranges": null,
+            "target": null,
+            "timeouts": null
+          },
+          "sensitive_values": {
+            "effective_labels": {},
+            "service_directory_registrations": [],
+            "terraform_labels": {}
+          }
+        }
+      ]
+    }
+  },
+  "resource_changes": [
+    {
+      "address": "google_compute_forwarding_rule.default",
+      "mode": "managed",
+      "type": "google_compute_forwarding_rule",
+      "name": "default",
+      "provider_name": "registry.terraform.io/hashicorp/google",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "all_ports": null,
+          "allow_global_access": null,
+          "allow_psc_global_access": null,
+          "backend_service": "test-backend-service-id",
+          "description": null,
+          "ip_protocol": "TCP",
+          "is_mirroring_collector": null,
+          "labels": null,
+          "load_balancing_scheme": "INTERNAL_MANAGED",
+          "name": "test-forwarding-rule",
+          "no_automate_dns_zone": null,
+          "port_range": "80",
+          "ports": null,
+          "project": "{{.Provider.project}}",
+          "region": "australia-southeast1",
+          "service_label": null,
+          "source_ip_ranges": null,
+          "target": null,
+          "timeouts": null
+        },
+        "after_unknown": {
+          "base_forwarding_rule": true,
+          "creation_timestamp": true,
+          "effective_labels": true,
+          "id": true,
+          "ip_address": true,
+          "ip_version": true,
+          "label_fingerprint": true,
+          "network": true,
+          "network_tier": true,
+          "psc_connection_id": true,
+          "psc_connection_status": true,
+          "self_link": true,
+          "service_directory_registrations": true,
+          "service_name": true,
+          "subnetwork": true,
+          "terraform_labels": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "effective_labels": {},
+          "service_directory_registrations": [],
+          "terraform_labels": {}
+        }
+      }
+    }
+  ],
+  "configuration": {
+    "provider_config": {
+      "google": {
+        "name": "google",
+        "expressions": {
+          "project": {
+            "constant_value": "{{.Provider.project}}"
+          }
+        }
+      }
+    },
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_compute_forwarding_rule.default",
+          "mode": "managed",
+          "type": "google_compute_forwarding_rule",
+          "name": "default",
+          "provider_config_key": "google",
+          "expressions": {
+            "backend_service": {
+              "constant_value": "test-backend-service-id"
+            },
+            "ip_protocol": {
+              "constant_value": "TCP"
+            },
+            "load_balancing_scheme": {
+              "constant_value": "INTERNAL_MANAGED"
+            },
+            "name": {
+              "constant_value": "test-forwarding-rule"
+            },
+            "port_range": {
+              "constant_value": 80
+            },
+            "region": {
+              "constant_value": "australia-southeast1"
+            }
+          },
+          "schema_version": 0
+        }
+      ]
+    }
+  }
+}
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_global_address.tf b/mmv1/third_party/tgc/tests/data/example_compute_global_address.tf
index e3ea697b0f87..f4cf9d8b8010 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_global_address.tf
+++ b/mmv1/third_party/tgc/tests/data/example_compute_global_address.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_global_address.tfplan.json b/mmv1/third_party/tgc/tests/data/example_compute_global_address.tfplan.json
index d81a2a43d895..06585f3fb5b9 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_global_address.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_compute_global_address.tfplan.json
@@ -46,13 +46,13 @@
           "network": null,
           "prefix_length": null,
           "purpose": null,
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "address": true,
           "creation_timestamp": true,
           "id": true,
-          "project": true,
           "self_link": true
         },
         "before_sensitive": false,
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_global_forwarding_rule.json b/mmv1/third_party/tgc/tests/data/example_compute_global_forwarding_rule.json
index 124f10dca449..41e98b823564 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_global_forwarding_rule.json
+++ b/mmv1/third_party/tgc/tests/data/example_compute_global_forwarding_rule.json
@@ -14,7 +14,8 @@
         "loadBalancingScheme": "INTERNAL_SELF_MANAGED",
         "name": "test-global-rule",
         "portRange": "80",
-        "target": "target-id"
+        "target": "target-id",
+        "noAutomateDnsZone": false
       }
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_global_forwarding_rule.tf b/mmv1/third_party/tgc/tests/data/example_compute_global_forwarding_rule.tf
index 3080a0fb3c1b..f55432a449fc 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_global_forwarding_rule.tf
+++ b/mmv1/third_party/tgc/tests/data/example_compute_global_forwarding_rule.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_global_forwarding_rule.tfplan.json b/mmv1/third_party/tgc/tests/data/example_compute_global_forwarding_rule.tfplan.json
index 3a847f14f067..59baeb14767f 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_global_forwarding_rule.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_compute_global_forwarding_rule.tfplan.json
@@ -47,13 +47,14 @@
           "name": "test-global-rule",
           "port_range": "80",
           "target": "target-id",
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}",
+          "no_automate_dns_zone": false
         },
         "after_unknown": {
           "id": true,
           "ip_address": true,
           "metadata_filters": [],
-          "project": true,
           "self_link": true
         }
       }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_instance.json b/mmv1/third_party/tgc/tests/data/example_compute_instance.json
deleted file mode 100644
index 14faf1ac93bb..000000000000
--- a/mmv1/third_party/tgc/tests/data/example_compute_instance.json
+++ /dev/null
@@ -1,88 +0,0 @@
-[
-  {
-    "name": "//compute.googleapis.com/projects/{{.Provider.project}}/zones/us-central1-a/instances/test",
-    "asset_type": "compute.googleapis.com/Instance",
-    "ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
-    "resource": {
-      "version": "v1",
-      "discovery_document_uri": "https://www.googleapis.com/discovery/v1/apis/compute/v1/rest",
-      "discovery_name": "Instance",
-      "parent": "//cloudresourcemanager.googleapis.com/projects/{{.Provider.project}}",
-      "data": {
-        "canIpForward": false,
-        "deletionProtection": false,
-        "disks": [
-          {
-            "autoDelete": true,
-            "boot": true,
-            "initializeParams": {
-              "sourceImage": "projects/debian-cloud/global/images/family/debian-11"
-            },
-            "mode": "READ_WRITE"
-          },
-          {
-            "autoDelete": true,
-            "initializeParams": {
-              "diskType": "projects/{{.Provider.project}}/zones/us-central1-a/diskTypes/local-ssd"
-            },
-            "interface": "SCSI",
-            "type": "SCRATCH"
-          }
-        ],
-        "machineType": "projects/{{.Provider.project}}/zones/us-central1-a/machineTypes/n1-standard-1",
-        "metadata": {
-          "items": [
-            {
-              "key": "foo",
-              "value": "bar"
-            }
-          ]
-        },
-        "name": "test",
-        "networkInterfaces": [
-          {
-            "accessConfigs": [
-              {
-                "type": "ONE_TO_ONE_NAT"
-              }
-            ],
-            "network": "projects/{{.Provider.project}}/global/networks/default"
-          }
-        ],
-        "scheduling": {
-          "automaticRestart": true
-        },
-        "serviceAccounts": [
-          {
-            "email": "default",
-            "scopes": [
-              "https://www.googleapis.com/auth/cloud-platform"
-            ]
-          }
-        ],
-        "tags": {
-          "items": [
-            "bar",
-            "foo"
-          ]
-        },
-        "zone": "us-central1-a"
-      }
-    }
-  },
-  {
-    "name": "//iam.googleapis.com/projects/{{.Provider.project}}/serviceAccounts/placeholder-unique-id",
-    "asset_type": "iam.googleapis.com/ServiceAccount",
-    "ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
-    "resource": {
-      "version": "v1",
-      "discovery_document_uri": "https://iam.googleapis.com/$discovery/rest",
-      "discovery_name": "ServiceAccount",
-      "parent": "//cloudresourcemanager.googleapis.com/projects/{{.Provider.project}}",
-      "data": {
-        "displayName": "Service Account",
-        "email": "service-account-id@{{.Provider.project}}.iam.gserviceaccount.com"
-      }
-    }
-  }
-]
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_instance.tf b/mmv1/third_party/tgc/tests/data/example_compute_instance.tf
deleted file mode 100644
index 809052cd8927..000000000000
--- a/mmv1/third_party/tgc/tests/data/example_compute_instance.tf
+++ /dev/null
@@ -1,75 +0,0 @@
-/**
- * Copyright 2019 Google LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-terraform {
-  required_providers {
-    google = {
-      source = "hashicorp/google"
-      version = "~> {{.Provider.version}}"
-    }
-  }
-}
-
-provider "google" {
-  {{if .Provider.credentials }}credentials = "{{.Provider.credentials}}"{{end}}
-}
-
-resource "google_service_account" "default" {
-  account_id   = "service-account-id"
-  display_name = "Service Account"
-}
-
-resource "google_compute_instance" "default" {
-  name         = "test"
-  machine_type = "n1-standard-1"
-  zone         = "us-central1-a"
-
-  tags = ["foo", "bar"]
-
-  boot_disk {
-    initialize_params {
-      image = "debian-cloud/debian-11"
-    }
-  }
-
-  // Local SSD disk
-  scratch_disk {
-    interface = "SCSI"
-  }
-
-  network_interface {
-    network = "default"
-
-    access_config {
-      // Ephemeral IP
-    }
-  }
-
-  metadata = {
-    foo = "bar"
-  }
-
-  # metadata_startup_script is equivalent to metadata{ startup-script } and
-  # the result is not deterministic as there will be two metadata block inserted
-  # at different time. Thus commenting out.
-  #
-  # metadata_startup_script = "echo hi > /test.txt"
-
-  service_account {
-    email  = google_service_account.default.email
-    scopes = ["cloud-platform"]
-  }
-}
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_instance_iam_binding.tf b/mmv1/third_party/tgc/tests/data/example_compute_instance_iam_binding.tf
index 7fb6248d6497..757a466d649b 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_instance_iam_binding.tf
+++ b/mmv1/third_party/tgc/tests/data/example_compute_instance_iam_binding.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_instance_iam_binding.tfplan.json b/mmv1/third_party/tgc/tests/data/example_compute_instance_iam_binding.tfplan.json
index ceaf763bcfa2..14ef5551b440 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_instance_iam_binding.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_compute_instance_iam_binding.tfplan.json
@@ -202,7 +202,8 @@
             "foo"
           ],
           "timeouts": null,
-          "zone": "us-central1-a"
+          "zone": "us-central1-a",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "advanced_machine_features": [],
@@ -250,7 +251,6 @@
               "subnetwork_project": true
             }
           ],
-          "project": true,
           "reservation_affinity": true,
           "scheduling": true,
           "scratch_disk": [
@@ -324,7 +324,8 @@
             "user:example-b@google.com"
           ],
           "role": "roles/compute.osLogin",
-          "zone": "us-central1-a"
+          "zone": "us-central1-a",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "condition": [],
@@ -333,8 +334,7 @@
           "members": [
             false,
             false
-          ],
-          "project": true
+          ]
         },
         "before_sensitive": false,
         "after_sensitive": {
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_instance_iam_member.tf b/mmv1/third_party/tgc/tests/data/example_compute_instance_iam_member.tf
index 0da674beab2a..685cae7453aa 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_instance_iam_member.tf
+++ b/mmv1/third_party/tgc/tests/data/example_compute_instance_iam_member.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_instance_iam_member.tfplan.json b/mmv1/third_party/tgc/tests/data/example_compute_instance_iam_member.tfplan.json
index a49081af30d3..1583b7ae2932 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_instance_iam_member.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_compute_instance_iam_member.tfplan.json
@@ -195,7 +195,8 @@
             "foo"
           ],
           "timeouts": null,
-          "zone": "us-central1-a"
+          "zone": "us-central1-a",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "advanced_machine_features": [],
@@ -243,7 +244,6 @@
               "subnetwork_project": true
             }
           ],
-          "project": true,
           "reservation_affinity": true,
           "scheduling": true,
           "scratch_disk": [
@@ -314,13 +314,13 @@
           "instance_name": "test",
           "member": "user:example-a@google.com",
           "role": "roles/compute.osLogin",
-          "zone": "us-central1-a"
+          "zone": "us-central1-a",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "condition": [],
           "etag": true,
-          "id": true,
-          "project": true
+          "id": true
         },
         "before_sensitive": false,
         "after_sensitive": {
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_instance_iam_policy.tf b/mmv1/third_party/tgc/tests/data/example_compute_instance_iam_policy.tf
index c6db287ac4eb..f5ee91051fe6 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_instance_iam_policy.tf
+++ b/mmv1/third_party/tgc/tests/data/example_compute_instance_iam_policy.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_instance_iam_policy.tfplan.json b/mmv1/third_party/tgc/tests/data/example_compute_instance_iam_policy.tfplan.json
index e729046ee478..4ea9b00094c0 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_instance_iam_policy.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_compute_instance_iam_policy.tfplan.json
@@ -191,7 +191,8 @@
             "foo"
           ],
           "timeouts": null,
-          "zone": "us-central1-a"
+          "zone": "us-central1-a",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "advanced_machine_features": [],
@@ -239,7 +240,6 @@
               "subnetwork_project": true
             }
           ],
-          "project": true,
           "reservation_affinity": true,
           "scheduling": true,
           "scratch_disk": [
@@ -308,12 +308,12 @@
         "after": {
           "instance_name": "test",
           "policy_data": "{\"bindings\":[{\"members\":[\"user:jane@example.com\"],\"role\":\"roles/compute.osLogin\"}]}",
-          "zone": "us-central1-a"
+          "zone": "us-central1-a",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "etag": true,
-          "id": true,
-          "project": true
+          "id": true
         },
         "before_sensitive": false,
         "after_sensitive": {}
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_network.json b/mmv1/third_party/tgc/tests/data/example_compute_network.json
index ab54220d1c63..193c7de3f6e7 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_network.json
+++ b/mmv1/third_party/tgc/tests/data/example_compute_network.json
@@ -10,7 +10,8 @@
       "parent": "//cloudresourcemanager.googleapis.com/projects/{{.Provider.project}}",
       "data": {
         "autoCreateSubnetworks": false,
-        "name": "test-network"
+        "name": "test-network",
+        "networkFirewallPolicyEnforcementOrder": "AFTER_CLASSIC_FIREWALL"
       }
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_network.tf b/mmv1/third_party/tgc/tests/data/example_compute_network.tf
index 0c5df3bddbd4..c3d4a0953076 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_network.tf
+++ b/mmv1/third_party/tgc/tests/data/example_compute_network.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_network.tfplan.json b/mmv1/third_party/tgc/tests/data/example_compute_network.tfplan.json
index 5b8b48e34382..2574d77fec20 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_network.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_compute_network.tfplan.json
@@ -39,13 +39,14 @@
           "delete_default_routes_on_create": false,
           "description": null,
           "name": "test-network",
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}",
+          "network_firewall_policy_enforcement_order": "AFTER_CLASSIC_FIREWALL"
         },
         "after_unknown": {
           "gateway_ipv4": true,
           "id": true,
           "mtu": true,
-          "project": true,
           "routing_mode": true,
           "self_link": true
         }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_snapshot.tf b/mmv1/third_party/tgc/tests/data/example_compute_snapshot.tf
index c74a457f9747..fe3121424d73 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_snapshot.tf
+++ b/mmv1/third_party/tgc/tests/data/example_compute_snapshot.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_snapshot.tfplan.json b/mmv1/third_party/tgc/tests/data/example_compute_snapshot.tfplan.json
index 18c079b12317..7d536e0f43b6 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_snapshot.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_compute_snapshot.tfplan.json
@@ -14,6 +14,7 @@
           "values": {
             "description": null,
             "disk_encryption_key": [],
+            "effective_labels": null,
             "image": "projects/debian-cloud/global/images/debian-8-jessie-v20170523",
             "labels": null,
             "name": "debian-disk",
@@ -22,6 +23,7 @@
             "snapshot": null,
             "source_image_encryption_key": [],
             "source_snapshot_encryption_key": [],
+            "terraform_labels": null,
             "timeouts": null,
             "type": "pd-ssd",
             "zone": "us-central1-a"
@@ -42,6 +44,9 @@
           "schema_version": 0,
           "values": {
             "description": null,
+            "effective_labels": {
+              "test-name": "test-value"
+            },
             "labels": {
               "test-name": "test-value"
             },
@@ -52,17 +57,22 @@
             "storage_locations": [
               "us-central1"
             ],
+            "terraform_labels": {
+              "test-name": "test-value"
+            },
             "timeouts": null,
             "zone": "us-central1-a"
           },
           "sensitive_values": {
+            "effective_labels": {},
             "labels": {},
             "licenses": [],
             "snapshot_encryption_key": [],
             "source_disk_encryption_key": [],
             "storage_locations": [
               false
-            ]
+            ],
+            "terraform_labels": {}
           }
         }
       ]
@@ -83,6 +93,7 @@
         "after": {
           "description": null,
           "disk_encryption_key": [],
+          "effective_labels": null,
           "image": "projects/debian-cloud/global/images/debian-8-jessie-v20170523",
           "labels": null,
           "name": "debian-disk",
@@ -91,9 +102,11 @@
           "snapshot": null,
           "source_image_encryption_key": [],
           "source_snapshot_encryption_key": [],
+          "terraform_labels": null,
           "timeouts": null,
           "type": "pd-ssd",
-          "zone": "us-central1-a"
+          "zone": "us-central1-a",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "creation_timestamp": true,
@@ -103,7 +116,6 @@
           "last_attach_timestamp": true,
           "last_detach_timestamp": true,
           "physical_block_size_bytes": true,
-          "project": true,
           "self_link": true,
           "source_image_encryption_key": [],
           "source_image_id": true,
@@ -133,6 +145,9 @@
         "before": null,
         "after": {
           "description": null,
+          "effective_labels": {
+            "test-name": "test-value"
+          },
           "labels": {
             "test-name": "test-value"
           },
@@ -143,17 +158,21 @@
           "storage_locations": [
             "us-central1"
           ],
+          "terraform_labels": {
+            "test-name": "test-value"
+          },
           "timeouts": null,
-          "zone": "us-central1-a"
+          "zone": "us-central1-a",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "creation_timestamp": true,
           "disk_size_gb": true,
+          "effective_labels": {},
           "id": true,
           "label_fingerprint": true,
           "labels": {},
           "licenses": true,
-          "project": true,
           "self_link": true,
           "snapshot_encryption_key": [],
           "snapshot_id": true,
@@ -161,17 +180,20 @@
           "storage_bytes": true,
           "storage_locations": [
             false
-          ]
+          ],
+          "terraform_labels": {}
         },
         "before_sensitive": false,
         "after_sensitive": {
+          "effective_labels": {},
           "labels": {},
           "licenses": [],
           "snapshot_encryption_key": [],
           "source_disk_encryption_key": [],
           "storage_locations": [
             false
-          ]
+          ],
+          "terraform_labels": {}
         }
       }
     }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_ssl_policy.tf b/mmv1/third_party/tgc/tests/data/example_compute_ssl_policy.tf
index 6c8081a03351..bede9caf36e0 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_ssl_policy.tf
+++ b/mmv1/third_party/tgc/tests/data/example_compute_ssl_policy.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_ssl_policy.tfplan.json b/mmv1/third_party/tgc/tests/data/example_compute_ssl_policy.tfplan.json
index 9e660d3773cc..a166634c0628 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_ssl_policy.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_compute_ssl_policy.tfplan.json
@@ -54,7 +54,8 @@
           "min_tls_version": "TLS_1_2",
           "name": "custom-ssl-policy",
           "profile": "CUSTOM",
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "creation_timestamp": true,
@@ -65,7 +66,6 @@
           "enabled_features": true,
           "fingerprint": true,
           "id": true,
-          "project": true,
           "self_link": true
         },
         "before_sensitive": false,
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_subnetwork.json b/mmv1/third_party/tgc/tests/data/example_compute_subnetwork.json
index bc15cb704552..4cfed781810d 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_subnetwork.json
+++ b/mmv1/third_party/tgc/tests/data/example_compute_subnetwork.json
@@ -10,7 +10,8 @@
       "parent": "//cloudresourcemanager.googleapis.com/projects/{{.Provider.project}}",
       "data": {
         "autoCreateSubnetworks": false,
-        "name": "test-network"
+        "name": "test-network",
+        "networkFirewallPolicyEnforcementOrder": "AFTER_CLASSIC_FIREWALL"
       }
     }
   },
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_subnetwork.tf b/mmv1/third_party/tgc/tests/data/example_compute_subnetwork.tf
index be935f1bf10f..6da798863af9 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_subnetwork.tf
+++ b/mmv1/third_party/tgc/tests/data/example_compute_subnetwork.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_subnetwork.tfplan.json b/mmv1/third_party/tgc/tests/data/example_compute_subnetwork.tfplan.json
index 9b141dfec950..2bd053cd9982 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_subnetwork.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_compute_subnetwork.tfplan.json
@@ -64,13 +64,14 @@
           "delete_default_routes_on_create": false,
           "description": null,
           "name": "test-network",
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}",
+          "network_firewall_policy_enforcement_order": "AFTER_CLASSIC_FIREWALL"
         },
         "after_unknown": {
           "gateway_ipv4": true,
           "id": true,
           "mtu": true,
-          "project": true,
           "routing_mode": true,
           "self_link": true
         }
@@ -102,7 +103,8 @@
           "name": "my-test-subnetwork",
           "private_ip_google_access": null,
           "region": "us-central1",
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "creation_timestamp": true,
@@ -114,7 +116,6 @@
           ],
           "network": true,
           "private_ipv6_google_access": true,
-          "project": true,
           "secondary_ip_range": true,
           "self_link": true
         }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_target_https_proxy.tf b/mmv1/third_party/tgc/tests/data/example_compute_target_https_proxy.tf
index 9692aec3673c..ecba87e2073a 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_target_https_proxy.tf
+++ b/mmv1/third_party/tgc/tests/data/example_compute_target_https_proxy.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_target_https_proxy.tfplan.json b/mmv1/third_party/tgc/tests/data/example_compute_target_https_proxy.tfplan.json
index 475d050cece0..2504bbdd4e85 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_target_https_proxy.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_compute_target_https_proxy.tfplan.json
@@ -54,12 +54,12 @@
           ],
           "ssl_policy": "ssl-policy-id",
           "timeouts": null,
-          "url_map": "url-map-id"
+          "url_map": "url-map-id",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "creation_timestamp": true,
           "id": true,
-          "project": true,
           "proxy_bind": true,
           "proxy_id": true,
           "self_link": true,
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_target_ssl_proxy.tf b/mmv1/third_party/tgc/tests/data/example_compute_target_ssl_proxy.tf
index 42284afdfa66..7f257d5de9a5 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_target_ssl_proxy.tf
+++ b/mmv1/third_party/tgc/tests/data/example_compute_target_ssl_proxy.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_compute_target_ssl_proxy.tfplan.json b/mmv1/third_party/tgc/tests/data/example_compute_target_ssl_proxy.tfplan.json
index 858ad184a88b..01f442afc7e0 100644
--- a/mmv1/third_party/tgc/tests/data/example_compute_target_ssl_proxy.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_compute_target_ssl_proxy.tfplan.json
@@ -54,12 +54,12 @@
                       "ssl_certificate_id"
                   ],
                   "ssl_policy": "ssl-policy-id",
-                  "timeouts": null
+                  "timeouts": null,
+                  "project": "{{.Provider.project}}"
               },
               "after_unknown": {
                   "creation_timestamp": true,
                   "id": true,
-                  "project": true,
                   "proxy_id": true,
                   "self_link": true,
                   "ssl_certificates": [
diff --git a/mmv1/third_party/tgc/tests/data/example_container_cluster.json b/mmv1/third_party/tgc/tests/data/example_container_cluster.json
index 68b75fd4f1b0..e863d272877f 100644
--- a/mmv1/third_party/tgc/tests/data/example_container_cluster.json
+++ b/mmv1/third_party/tgc/tests/data/example_container_cluster.json
@@ -53,7 +53,8 @@
       "parent": "//cloudresourcemanager.googleapis.com/projects/{{.Provider.project}}",
       "data": {
         "displayName": "Service Account",
-        "email": "service-account-id@{{.Provider.project}}.iam.gserviceaccount.com"
+        "email": "service-account-id@{{.Provider.project}}.iam.gserviceaccount.com",
+        "projectId": "{{.Provider.project}}"
       }
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_container_cluster.tf b/mmv1/third_party/tgc/tests/data/example_container_cluster.tf
index 71d98cf90684..d0c4ee600403 100644
--- a/mmv1/third_party/tgc/tests/data/example_container_cluster.tf
+++ b/mmv1/third_party/tgc/tests/data/example_container_cluster.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_container_cluster.tfplan.json b/mmv1/third_party/tgc/tests/data/example_container_cluster.tfplan.json
index 998e197fae0d..52d9c3c849e6 100644
--- a/mmv1/third_party/tgc/tests/data/example_container_cluster.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_container_cluster.tfplan.json
@@ -13,7 +13,6 @@
           "schema_version": 1,
           "values": {
             "description": null,
-            "enable_binary_authorization": false,
             "enable_intranode_visibility": null,
             "enable_kubernetes_alpha": false,
             "enable_legacy_abac": false,
@@ -98,7 +97,6 @@
         "before": null,
         "after": {
           "description": null,
-          "enable_binary_authorization": false,
           "enable_intranode_visibility": null,
           "enable_kubernetes_alpha": false,
           "enable_legacy_abac": false,
@@ -119,7 +117,8 @@
           "resource_usage_export_config": [],
           "timeouts": null,
           "vertical_pod_autoscaling": [],
-          "workload_identity_config": []
+          "workload_identity_config": [],
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "addons_config": true,
@@ -147,7 +146,6 @@
           "operation": true,
           "pod_security_policy_config": [],
           "private_cluster_config": [],
-          "project": true,
           "release_channel": true,
           "resource_usage_export_config": [],
           "self_link": true,
@@ -189,7 +187,8 @@
             }
           ],
           "node_count": 1,
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "autoscaling": [],
@@ -218,7 +217,6 @@
             }
           ],
           "node_locations": true,
-          "project": true,
           "upgrade_settings": true,
           "version": true
         }
@@ -239,13 +237,13 @@
           "account_id": "service-account-id",
           "description": null,
           "display_name": "Service Account",
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "email": true,
           "id": true,
           "name": true,
-          "project": true,
           "unique_id": true
         }
       }
@@ -344,4 +342,4 @@
       ]
     }
   }
-}
+}
\ No newline at end of file
diff --git a/mmv1/third_party/tgc/tests/data/example_dns_managed_zone.tf b/mmv1/third_party/tgc/tests/data/example_dns_managed_zone.tf
index 137a34a8744c..d4c99fe55fd4 100644
--- a/mmv1/third_party/tgc/tests/data/example_dns_managed_zone.tf
+++ b/mmv1/third_party/tgc/tests/data/example_dns_managed_zone.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
@@ -30,7 +30,7 @@ provider "google" {
 resource "google_dns_managed_zone" "zone1" {
   name        = "publiczone"
   dns_name    = "publiczone.gsecurity.net."
-  
+
   force_destroy = true
   visibility = "public"
 
diff --git a/mmv1/third_party/tgc/tests/data/example_dns_managed_zone.tfplan.json b/mmv1/third_party/tgc/tests/data/example_dns_managed_zone.tfplan.json
index 27447a4e22cd..8629cd871123 100644
--- a/mmv1/third_party/tgc/tests/data/example_dns_managed_zone.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_dns_managed_zone.tfplan.json
@@ -66,7 +66,8 @@
 				"peering_config": [],
 				"private_visibility_config": [],
 				"timeouts": null,
-				"visibility": "public"
+				"visibility": "public",
+				"project": "{{.Provider.project}}"
 			},
 			"after_unknown": {
 				"dnssec_config": [{
@@ -76,8 +77,7 @@
 				"id": true,
 				"name_servers": true,
 				"peering_config": [],
-				"private_visibility_config": [],
-				"project": true
+				"private_visibility_config": []
 			},
 			"before_sensitive": false,
 			"after_sensitive": {
diff --git a/mmv1/third_party/tgc/tests/data/example_dns_policy.json b/mmv1/third_party/tgc/tests/data/example_dns_policy.json
index b6760dc7831f..ba2989db6fa7 100644
--- a/mmv1/third_party/tgc/tests/data/example_dns_policy.json
+++ b/mmv1/third_party/tgc/tests/data/example_dns_policy.json
@@ -10,7 +10,8 @@
       "parent": "//cloudresourcemanager.googleapis.com/projects/{{.Provider.project}}",
       "data": {
         "autoCreateSubnetworks": false,
-        "name": "network-1"
+        "name": "network-1",
+        "networkFirewallPolicyEnforcementOrder": "AFTER_CLASSIC_FIREWALL"
       }
     }
   },
@@ -25,7 +26,8 @@
       "parent": "//cloudresourcemanager.googleapis.com/projects/{{.Provider.project}}",
       "data": {
         "autoCreateSubnetworks": false,
-        "name": "network-2"
+        "name": "network-2",
+        "networkFirewallPolicyEnforcementOrder": "AFTER_CLASSIC_FIREWALL"
       }
     }
   },
diff --git a/mmv1/third_party/tgc/tests/data/example_dns_policy.tf b/mmv1/third_party/tgc/tests/data/example_dns_policy.tf
index 35eec992f08a..10719252344a 100644
--- a/mmv1/third_party/tgc/tests/data/example_dns_policy.tf
+++ b/mmv1/third_party/tgc/tests/data/example_dns_policy.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_dns_policy.tfplan.json b/mmv1/third_party/tgc/tests/data/example_dns_policy.tfplan.json
index 3afed08c592e..e267eedfedf2 100644
--- a/mmv1/third_party/tgc/tests/data/example_dns_policy.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_dns_policy.tfplan.json
@@ -103,13 +103,14 @@
           "delete_default_routes_on_create": false,
           "description": null,
           "name": "network-1",
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}",
+          "network_firewall_policy_enforcement_order": "AFTER_CLASSIC_FIREWALL"
         },
         "after_unknown": {
           "gateway_ipv4": true,
           "id": true,
           "mtu": true,
-          "project": true,
           "routing_mode": true,
           "self_link": true
         },
@@ -133,13 +134,14 @@
           "delete_default_routes_on_create": false,
           "description": null,
           "name": "network-2",
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}",
+          "network_firewall_policy_enforcement_order": "AFTER_CLASSIC_FIREWALL"
         },
         "after_unknown": {
           "gateway_ipv4": true,
           "id": true,
           "mtu": true,
-          "project": true,
           "routing_mode": true,
           "self_link": true
         },
@@ -181,7 +183,8 @@
             {},
             {}
           ],
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "alternative_name_server_config": [
@@ -200,8 +203,7 @@
             {
               "network_url": true
             }
-          ],
-          "project": true
+          ]
         },
         "before_sensitive": false,
         "after_sensitive": {
diff --git a/mmv1/third_party/tgc/tests/data/example_filestore_instance.tf b/mmv1/third_party/tgc/tests/data/example_filestore_instance.tf
index fc8545ba95cd..3c03efd96a40 100644
--- a/mmv1/third_party/tgc/tests/data/example_filestore_instance.tf
+++ b/mmv1/third_party/tgc/tests/data/example_filestore_instance.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
@@ -41,4 +41,4 @@ resource "google_filestore_instance" "test" {
     network = "default"
     modes   = ["MODE_IPV4"]
   }
-}
\ No newline at end of file
+}
diff --git a/mmv1/third_party/tgc/tests/data/example_filestore_instance.tfplan.json b/mmv1/third_party/tgc/tests/data/example_filestore_instance.tfplan.json
index e1ab289484e9..48370701d61a 100644
--- a/mmv1/third_party/tgc/tests/data/example_filestore_instance.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_filestore_instance.tfplan.json
@@ -75,7 +75,8 @@
             }
           ],
           "tier": "BASIC_SSD",
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "create_time": true,
@@ -95,7 +96,6 @@
               "reserved_ip_range": true
             }
           ],
-          "project": true,
           "zone": true
         }
       }
diff --git a/mmv1/third_party/tgc/tests/data/example_folder_iam_member.tf b/mmv1/third_party/tgc/tests/data/example_folder_iam_member.tf
index 62713639fa5f..176cab612c35 100644
--- a/mmv1/third_party/tgc/tests/data/example_folder_iam_member.tf
+++ b/mmv1/third_party/tgc/tests/data/example_folder_iam_member.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_folder_iam_member_empty_folder.tf b/mmv1/third_party/tgc/tests/data/example_folder_iam_member_empty_folder.tf
index 22ad94217e7c..a38125b0aa5f 100644
--- a/mmv1/third_party/tgc/tests/data/example_folder_iam_member_empty_folder.tf
+++ b/mmv1/third_party/tgc/tests/data/example_folder_iam_member_empty_folder.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_folder_organization_policy.tf b/mmv1/third_party/tgc/tests/data/example_folder_organization_policy.tf
index 27a86e7ec3b2..d1bfd34f0d3f 100644
--- a/mmv1/third_party/tgc/tests/data/example_folder_organization_policy.tf
+++ b/mmv1/third_party/tgc/tests/data/example_folder_organization_policy.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_google_cloudfunctions_function.tf b/mmv1/third_party/tgc/tests/data/example_google_cloudfunctions_function.tf
index b0ebfacd94bb..4b544666cdab 100644
--- a/mmv1/third_party/tgc/tests/data/example_google_cloudfunctions_function.tf
+++ b/mmv1/third_party/tgc/tests/data/example_google_cloudfunctions_function.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_google_cloudfunctions_function.tfplan.json b/mmv1/third_party/tgc/tests/data/example_google_cloudfunctions_function.tfplan.json
index 5b726ccb041e..8ac5653f93f6 100644
--- a/mmv1/third_party/tgc/tests/data/example_google_cloudfunctions_function.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_google_cloudfunctions_function.tfplan.json
@@ -81,7 +81,8 @@
           "timeout": 60,
           "timeouts": null,
           "trigger_http": true,
-          "vpc_connector": null
+          "vpc_connector": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "environment_variables": {},
@@ -89,7 +90,6 @@
           "https_trigger_url": true,
           "id": true,
           "labels": {},
-          "project": true,
           "service_account_email": true,
           "source_repository": [],
           "vpc_connector_egress_settings": true
diff --git a/mmv1/third_party/tgc/tests/data/example_google_sql_database.tf b/mmv1/third_party/tgc/tests/data/example_google_sql_database.tf
index 35c1574c3ae5..db01f5da7e91 100644
--- a/mmv1/third_party/tgc/tests/data/example_google_sql_database.tf
+++ b/mmv1/third_party/tgc/tests/data/example_google_sql_database.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_google_sql_database.tfplan.json b/mmv1/third_party/tgc/tests/data/example_google_sql_database.tfplan.json
index 3d2c3a1757c7..5d4acb6afddb 100644
--- a/mmv1/third_party/tgc/tests/data/example_google_sql_database.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_google_sql_database.tfplan.json
@@ -36,13 +36,13 @@
         "after": {
           "instance": "my-database-instance",
           "name": "my-database",
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "charset": true,
           "collation": true,
           "id": true,
-          "project": true,
           "self_link": true
         },
         "before_sensitive": false,
diff --git a/mmv1/third_party/tgc/tests/data/example_kms_crypto_key.tf b/mmv1/third_party/tgc/tests/data/example_kms_crypto_key.tf
index 497821518c92..3839fe370c65 100644
--- a/mmv1/third_party/tgc/tests/data/example_kms_crypto_key.tf
+++ b/mmv1/third_party/tgc/tests/data/example_kms_crypto_key.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
@@ -35,4 +35,4 @@ resource "google_kms_crypto_key" "test" {
   lifecycle {
     prevent_destroy = true
   }
-}
\ No newline at end of file
+}
diff --git a/mmv1/third_party/tgc/tests/data/example_kms_crypto_key_iam_binding.tf b/mmv1/third_party/tgc/tests/data/example_kms_crypto_key_iam_binding.tf
index 56ce6fc1f95a..ffb75d1d93b8 100644
--- a/mmv1/third_party/tgc/tests/data/example_kms_crypto_key_iam_binding.tf
+++ b/mmv1/third_party/tgc/tests/data/example_kms_crypto_key_iam_binding.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_kms_crypto_key_iam_member.tf b/mmv1/third_party/tgc/tests/data/example_kms_crypto_key_iam_member.tf
index 011241ad25a8..a043b96d0d50 100644
--- a/mmv1/third_party/tgc/tests/data/example_kms_crypto_key_iam_member.tf
+++ b/mmv1/third_party/tgc/tests/data/example_kms_crypto_key_iam_member.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_kms_crypto_key_iam_policy.tf b/mmv1/third_party/tgc/tests/data/example_kms_crypto_key_iam_policy.tf
index b10e12f3064a..545f55608228 100644
--- a/mmv1/third_party/tgc/tests/data/example_kms_crypto_key_iam_policy.tf
+++ b/mmv1/third_party/tgc/tests/data/example_kms_crypto_key_iam_policy.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_kms_key_ring.tf b/mmv1/third_party/tgc/tests/data/example_kms_key_ring.tf
index 2b191f80374b..f4aa5a21aa8f 100644
--- a/mmv1/third_party/tgc/tests/data/example_kms_key_ring.tf
+++ b/mmv1/third_party/tgc/tests/data/example_kms_key_ring.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
@@ -30,4 +30,4 @@ provider "google" {
 resource "google_kms_key_ring" "test" {
   name     = "keyring-example"
   location = "global"
-}
\ No newline at end of file
+}
diff --git a/mmv1/third_party/tgc/tests/data/example_kms_key_ring.tfplan.json b/mmv1/third_party/tgc/tests/data/example_kms_key_ring.tfplan.json
index 8a4c4e08e53c..ac08f87e8249 100644
--- a/mmv1/third_party/tgc/tests/data/example_kms_key_ring.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_kms_key_ring.tfplan.json
@@ -35,11 +35,11 @@
         "after": {
           "location": "global",
           "name": "keyring-example",
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "id": true,
-          "project": true,
           "self_link": true
         }
       }
diff --git a/mmv1/third_party/tgc/tests/data/example_kms_key_ring_iam_binding.tf b/mmv1/third_party/tgc/tests/data/example_kms_key_ring_iam_binding.tf
index ae6cec4e8bc9..ff974a5595d1 100644
--- a/mmv1/third_party/tgc/tests/data/example_kms_key_ring_iam_binding.tf
+++ b/mmv1/third_party/tgc/tests/data/example_kms_key_ring_iam_binding.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_kms_key_ring_iam_member.tf b/mmv1/third_party/tgc/tests/data/example_kms_key_ring_iam_member.tf
index 8b665bb141de..c7ec70ae5d48 100644
--- a/mmv1/third_party/tgc/tests/data/example_kms_key_ring_iam_member.tf
+++ b/mmv1/third_party/tgc/tests/data/example_kms_key_ring_iam_member.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_kms_key_ring_iam_policy.tf b/mmv1/third_party/tgc/tests/data/example_kms_key_ring_iam_policy.tf
index bfb5a83969e6..15d6884b0bcf 100644
--- a/mmv1/third_party/tgc/tests/data/example_kms_key_ring_iam_policy.tf
+++ b/mmv1/third_party/tgc/tests/data/example_kms_key_ring_iam_policy.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_logging_metric.tf b/mmv1/third_party/tgc/tests/data/example_logging_metric.tf
index cd72faeabcb1..9d47f670e72a 100644
--- a/mmv1/third_party/tgc/tests/data/example_logging_metric.tf
+++ b/mmv1/third_party/tgc/tests/data/example_logging_metric.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_org_policy_policy.tf b/mmv1/third_party/tgc/tests/data/example_org_policy_policy.tf
index 312f3d74053c..bedb1a1629f6 100644
--- a/mmv1/third_party/tgc/tests/data/example_org_policy_policy.tf
+++ b/mmv1/third_party/tgc/tests/data/example_org_policy_policy.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
@@ -41,8 +41,8 @@ resource "google_org_policy_policy" "project_policy" {
         location    = "sample-location.log"
         title       = "sample-condition"
       }
-      
-    
+
+
       values {
         allowed_values = ["projects/allowed-project1", "projects/allowed-project2"]
         denied_values  = ["projects/denied-project"]
diff --git a/mmv1/third_party/tgc/tests/data/example_organization_iam_binding.tf b/mmv1/third_party/tgc/tests/data/example_organization_iam_binding.tf
index 5f16a130bfe4..c3dfc42fe8ce 100644
--- a/mmv1/third_party/tgc/tests/data/example_organization_iam_binding.tf
+++ b/mmv1/third_party/tgc/tests/data/example_organization_iam_binding.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_organization_iam_member.tf b/mmv1/third_party/tgc/tests/data/example_organization_iam_member.tf
index f66bdfd93ec9..633997ff9958 100644
--- a/mmv1/third_party/tgc/tests/data/example_organization_iam_member.tf
+++ b/mmv1/third_party/tgc/tests/data/example_organization_iam_member.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_organization_iam_policy.tf b/mmv1/third_party/tgc/tests/data/example_organization_iam_policy.tf
index 57d4e7940060..78575a8b49a2 100644
--- a/mmv1/third_party/tgc/tests/data/example_organization_iam_policy.tf
+++ b/mmv1/third_party/tgc/tests/data/example_organization_iam_policy.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_organization_policy.tf b/mmv1/third_party/tgc/tests/data/example_organization_policy.tf
index 49d6862bbfa6..81f3be2fef24 100644
--- a/mmv1/third_party/tgc/tests/data/example_organization_policy.tf
+++ b/mmv1/third_party/tgc/tests/data/example_organization_policy.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_project_create.tf b/mmv1/third_party/tgc/tests/data/example_project_create.tf
index 695ba0e29c04..2043396c2ad6 100644
--- a/mmv1/third_party/tgc/tests/data/example_project_create.tf
+++ b/mmv1/third_party/tgc/tests/data/example_project_create.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_project_create_empty_project_id.tf b/mmv1/third_party/tgc/tests/data/example_project_create_empty_project_id.tf
index 35b369035827..374df42c4fea 100644
--- a/mmv1/third_party/tgc/tests/data/example_project_create_empty_project_id.tf
+++ b/mmv1/third_party/tgc/tests/data/example_project_create_empty_project_id.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_project_iam.tf b/mmv1/third_party/tgc/tests/data/example_project_iam.tf
index f6732d51b196..3afaba26bbc9 100644
--- a/mmv1/third_party/tgc/tests/data/example_project_iam.tf
+++ b/mmv1/third_party/tgc/tests/data/example_project_iam.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_project_iam_binding.tf b/mmv1/third_party/tgc/tests/data/example_project_iam_binding.tf
index 7693d7f495cd..aa2db794dd42 100644
--- a/mmv1/third_party/tgc/tests/data/example_project_iam_binding.tf
+++ b/mmv1/third_party/tgc/tests/data/example_project_iam_binding.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_project_iam_member.tf b/mmv1/third_party/tgc/tests/data/example_project_iam_member.tf
index 87170fff0749..780a0038d368 100644
--- a/mmv1/third_party/tgc/tests/data/example_project_iam_member.tf
+++ b/mmv1/third_party/tgc/tests/data/example_project_iam_member.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_project_iam_member_empty_project.tf b/mmv1/third_party/tgc/tests/data/example_project_iam_member_empty_project.tf
index 50f5089e26ce..be1709cc2c3e 100644
--- a/mmv1/third_party/tgc/tests/data/example_project_iam_member_empty_project.tf
+++ b/mmv1/third_party/tgc/tests/data/example_project_iam_member_empty_project.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_project_iam_policy.tf b/mmv1/third_party/tgc/tests/data/example_project_iam_policy.tf
index 5be740863e91..86347e630d1c 100644
--- a/mmv1/third_party/tgc/tests/data/example_project_iam_policy.tf
+++ b/mmv1/third_party/tgc/tests/data/example_project_iam_policy.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_project_in_folder.tf b/mmv1/third_party/tgc/tests/data/example_project_in_folder.tf
index 137d2788817b..b75f74a3316f 100644
--- a/mmv1/third_party/tgc/tests/data/example_project_in_folder.tf
+++ b/mmv1/third_party/tgc/tests/data/example_project_in_folder.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_project_in_org.tf b/mmv1/third_party/tgc/tests/data/example_project_in_org.tf
index 7ab3395b2f1e..615ca8de7a45 100644
--- a/mmv1/third_party/tgc/tests/data/example_project_in_org.tf
+++ b/mmv1/third_party/tgc/tests/data/example_project_in_org.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_project_organization_policy.tf b/mmv1/third_party/tgc/tests/data/example_project_organization_policy.tf
index a3ffea1faf0d..12b261d25e01 100644
--- a/mmv1/third_party/tgc/tests/data/example_project_organization_policy.tf
+++ b/mmv1/third_party/tgc/tests/data/example_project_organization_policy.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_project_service.tf b/mmv1/third_party/tgc/tests/data/example_project_service.tf
index 087c8f935092..6dc44b9b7f4d 100644
--- a/mmv1/third_party/tgc/tests/data/example_project_service.tf
+++ b/mmv1/third_party/tgc/tests/data/example_project_service.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_project_update.tf b/mmv1/third_party/tgc/tests/data/example_project_update.tf
index 497c48e6c1fe..65d9f6fc2f3b 100644
--- a/mmv1/third_party/tgc/tests/data/example_project_update.tf
+++ b/mmv1/third_party/tgc/tests/data/example_project_update.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_pubsub_lite_reservation.tf b/mmv1/third_party/tgc/tests/data/example_pubsub_lite_reservation.tf
index e8dc3b3890e1..cb7eaded3b78 100644
--- a/mmv1/third_party/tgc/tests/data/example_pubsub_lite_reservation.tf
+++ b/mmv1/third_party/tgc/tests/data/example_pubsub_lite_reservation.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_pubsub_lite_reservation.tfplan.json b/mmv1/third_party/tgc/tests/data/example_pubsub_lite_reservation.tfplan.json
index b23c990fa370..7785f1549900 100644
--- a/mmv1/third_party/tgc/tests/data/example_pubsub_lite_reservation.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_pubsub_lite_reservation.tfplan.json
@@ -38,11 +38,11 @@
           "name": "example-reservation",
           "region": "us-central1",
           "throughput_capacity": 2,
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
-          "id": true,
-          "project": true
+          "id": true
         },
         "before_sensitive": false,
         "after_sensitive": {}
diff --git a/mmv1/third_party/tgc/tests/data/example_pubsub_lite_subscription.tf b/mmv1/third_party/tgc/tests/data/example_pubsub_lite_subscription.tf
index 509df281d98f..8a99f4e498be 100644
--- a/mmv1/third_party/tgc/tests/data/example_pubsub_lite_subscription.tf
+++ b/mmv1/third_party/tgc/tests/data/example_pubsub_lite_subscription.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_pubsub_lite_subscription.tfplan.json b/mmv1/third_party/tgc/tests/data/example_pubsub_lite_subscription.tfplan.json
index e4c7c5d99caf..97971bb3041c 100644
--- a/mmv1/third_party/tgc/tests/data/example_pubsub_lite_subscription.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_pubsub_lite_subscription.tfplan.json
@@ -54,14 +54,14 @@
           "region": null,
           "timeouts": null,
           "topic": "my-topic",
-          "zone": "us-central1a"
+          "zone": "us-central1a",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "delivery_config": [
             {}
           ],
-          "id": true,
-          "project": true
+          "id": true
         },
         "before_sensitive": false,
         "after_sensitive": {
diff --git a/mmv1/third_party/tgc/tests/data/example_pubsub_lite_topic.tf b/mmv1/third_party/tgc/tests/data/example_pubsub_lite_topic.tf
index 0d7a7fa06b24..6697b15713e8 100644
--- a/mmv1/third_party/tgc/tests/data/example_pubsub_lite_topic.tf
+++ b/mmv1/third_party/tgc/tests/data/example_pubsub_lite_topic.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_pubsub_lite_topic.tfplan.json b/mmv1/third_party/tgc/tests/data/example_pubsub_lite_topic.tfplan.json
index 7cbed88739ad..7fce720dd508 100644
--- a/mmv1/third_party/tgc/tests/data/example_pubsub_lite_topic.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_pubsub_lite_topic.tfplan.json
@@ -96,7 +96,8 @@
             }
           ],
           "timeouts": null,
-          "zone": "us-central1a"
+          "zone": "us-central1a",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "id": true,
@@ -107,7 +108,6 @@
               ]
             }
           ],
-          "project": true,
           "reservation_config": [
             {}
           ],
diff --git a/mmv1/third_party/tgc/tests/data/example_pubsub_schema.tf b/mmv1/third_party/tgc/tests/data/example_pubsub_schema.tf
index 197309f7c26d..b8e76f2e8880 100644
--- a/mmv1/third_party/tgc/tests/data/example_pubsub_schema.tf
+++ b/mmv1/third_party/tgc/tests/data/example_pubsub_schema.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_pubsub_schema.tfplan.json b/mmv1/third_party/tgc/tests/data/example_pubsub_schema.tfplan.json
index 6def3f0d4099..cb1b4fc05ed7 100644
--- a/mmv1/third_party/tgc/tests/data/example_pubsub_schema.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_pubsub_schema.tfplan.json
@@ -38,11 +38,11 @@
           "definition": "{\n  \"type\" : \"record\",\n  \"name\" : \"Avro\",\n  \"fields\" : [\n    {\n      \"name\" : \"StringField\",\n      \"type\" : \"string\"\n    },\n    {\n      \"name\" : \"IntField\",\n      \"type\" : \"int\"\n    }\n  ]\n}\n",
           "name": "example",
           "timeouts": null,
-          "type": "AVRO"
+          "type": "AVRO",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
-          "id": true,
-          "project": true
+          "id": true
         },
         "before_sensitive": false,
         "after_sensitive": {}
diff --git a/mmv1/third_party/tgc/tests/data/example_pubsub_subscription.tf b/mmv1/third_party/tgc/tests/data/example_pubsub_subscription.tf
index 83ad5804e25e..0fb601e7d16e 100644
--- a/mmv1/third_party/tgc/tests/data/example_pubsub_subscription.tf
+++ b/mmv1/third_party/tgc/tests/data/example_pubsub_subscription.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
@@ -68,4 +68,4 @@ resource "google_pubsub_subscription" "test-pull" {
   }
 
   enable_message_ordering    = false
-}
\ No newline at end of file
+}
diff --git a/mmv1/third_party/tgc/tests/data/example_pubsub_subscription.tfplan.json b/mmv1/third_party/tgc/tests/data/example_pubsub_subscription.tfplan.json
index 28b2fa772da3..1db2e0e3ab10 100644
--- a/mmv1/third_party/tgc/tests/data/example_pubsub_subscription.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_pubsub_subscription.tfplan.json
@@ -14,6 +14,9 @@
           "values": {
             "ack_deadline_seconds": 20,
             "dead_letter_policy": [],
+            "effective_labels": {
+              "test-label2": "test-value2"
+            },
             "enable_message_ordering": false,
             "expiration_policy": [
               {
@@ -33,6 +36,9 @@
                 "minimum_backoff": "10s"
               }
             ],
+            "terraform_labels": {
+              "test-label2": "test-value2"
+            },
             "timeouts": null,
             "topic": "example-pubsub-topic"
           }
@@ -47,6 +53,9 @@
           "values": {
             "ack_deadline_seconds": 20,
             "dead_letter_policy": [],
+            "effective_labels": {
+              "test-label1": "test-value1"
+            },
             "enable_message_ordering": null,
             "filter": null,
             "labels": {
@@ -63,6 +72,9 @@
             ],
             "retain_acked_messages": null,
             "retry_policy": [],
+            "terraform_labels": {
+              "test-label1": "test-value1"
+            },
             "timeouts": null,
             "topic": "example-pubsub-topic"
           }
@@ -85,6 +97,9 @@
         "after": {
           "ack_deadline_seconds": 20,
           "dead_letter_policy": [],
+          "effective_labels": {
+            "test-label2": "test-value2"
+          },
           "enable_message_ordering": false,
           "expiration_policy": [
             {
@@ -104,24 +119,29 @@
               "minimum_backoff": "10s"
             }
           ],
+          "terraform_labels": {
+            "test-label2": "test-value2"
+          },
           "timeouts": null,
-          "topic": "example-pubsub-topic"
+          "topic": "example-pubsub-topic",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "dead_letter_policy": [],
+          "effective_labels": {},
           "expiration_policy": [
             {}
           ],
           "id": true,
           "labels": {},
           "path": true,
-          "project": true,
           "push_config": [],
           "retry_policy": [
             {
               "maximum_backoff": true
             }
-          ]
+          ],
+          "terraform_labels": {}
         }
       }
     },
@@ -139,6 +159,9 @@
         "after": {
           "ack_deadline_seconds": 20,
           "dead_letter_policy": [],
+          "effective_labels": {
+            "test-label1": "test-value1"
+          },
           "enable_message_ordering": null,
           "filter": null,
           "labels": {
@@ -155,22 +178,27 @@
           ],
           "retain_acked_messages": null,
           "retry_policy": [],
+          "terraform_labels": {
+            "test-label2": "test-value2"
+          },
           "timeouts": null,
-          "topic": "example-pubsub-topic"
+          "topic": "example-pubsub-topic",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "dead_letter_policy": [],
+          "effective_labels": {},
           "expiration_policy": true,
           "id": true,
           "labels": {},
           "path": true,
-          "project": true,
           "push_config": [
             {
               "oidc_token": []
             }
           ],
-          "retry_policy": []
+          "retry_policy": [],
+          "terraform_labels": {}
         }
       }
     }
diff --git a/mmv1/third_party/tgc/tests/data/example_pubsub_subscription_iam_binding.tf b/mmv1/third_party/tgc/tests/data/example_pubsub_subscription_iam_binding.tf
index 8cd718023c0c..ed2651d8042f 100644
--- a/mmv1/third_party/tgc/tests/data/example_pubsub_subscription_iam_binding.tf
+++ b/mmv1/third_party/tgc/tests/data/example_pubsub_subscription_iam_binding.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_pubsub_subscription_iam_binding.tfplan.json b/mmv1/third_party/tgc/tests/data/example_pubsub_subscription_iam_binding.tfplan.json
index 0a730e6b809e..ea9d407c4be5 100644
--- a/mmv1/third_party/tgc/tests/data/example_pubsub_subscription_iam_binding.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_pubsub_subscription_iam_binding.tfplan.json
@@ -14,6 +14,9 @@
           "values": {
             "ack_deadline_seconds": 20,
             "dead_letter_policy": [],
+            "effective_labels": {
+              "test-label1": "test-value1"
+            },
             "enable_message_ordering": null,
             "filter": null,
             "labels": {
@@ -30,6 +33,9 @@
             ],
             "retain_acked_messages": null,
             "retry_policy": [],
+            "terraform_labels": {
+              "test-label1": "test-value1"
+            },
             "timeouts": null,
             "topic": "example-pubsub-topic"
           },
@@ -85,6 +91,9 @@
         "after": {
           "ack_deadline_seconds": 20,
           "dead_letter_policy": [],
+          "effective_labels": {
+            "test-label1": "test-value1"
+          },
           "enable_message_ordering": null,
           "filter": null,
           "labels": {
@@ -101,25 +110,31 @@
           ],
           "retain_acked_messages": null,
           "retry_policy": [],
+          "terraform_labels": {
+            "test-label1": "test-value1"
+          },
           "timeouts": null,
-          "topic": "example-pubsub-topic"
+          "topic": "example-pubsub-topic",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "dead_letter_policy": [],
+          "effective_labels": {},
           "expiration_policy": true,
           "id": true,
           "labels": {},
-          "project": true,
           "push_config": [
             {
               "oidc_token": []
             }
           ],
-          "retry_policy": []
+          "retry_policy": [],
+          "terraform_labels": {}
         },
         "before_sensitive": false,
         "after_sensitive": {
           "dead_letter_policy": [],
+          "effective_labels": {},
           "expiration_policy": [],
           "labels": {},
           "push_config": [
@@ -127,7 +142,8 @@
               "oidc_token": []
             }
           ],
-          "retry_policy": []
+          "retry_policy": [],
+          "terraform_labels": {}
         }
       }
     },
@@ -148,7 +164,8 @@
             "user:jane@example.com"
           ],
           "role": "roles/editor",
-          "subscription": "example-subscription"
+          "subscription": "example-subscription",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "condition": [],
@@ -156,8 +173,7 @@
           "id": true,
           "members": [
             false
-          ],
-          "project": true
+          ]
         },
         "before_sensitive": false,
         "after_sensitive": {
diff --git a/mmv1/third_party/tgc/tests/data/example_pubsub_subscription_iam_member.tf b/mmv1/third_party/tgc/tests/data/example_pubsub_subscription_iam_member.tf
index 51e9e7d64359..42706ed47662 100644
--- a/mmv1/third_party/tgc/tests/data/example_pubsub_subscription_iam_member.tf
+++ b/mmv1/third_party/tgc/tests/data/example_pubsub_subscription_iam_member.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_pubsub_subscription_iam_member.tfplan.json b/mmv1/third_party/tgc/tests/data/example_pubsub_subscription_iam_member.tfplan.json
index 691e23ba6c4c..4c18456a7719 100644
--- a/mmv1/third_party/tgc/tests/data/example_pubsub_subscription_iam_member.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_pubsub_subscription_iam_member.tfplan.json
@@ -14,6 +14,9 @@
           "values": {
             "ack_deadline_seconds": 20,
             "dead_letter_policy": [],
+            "effective_labels": {
+              "test-label1": "test-value1"
+            },
             "enable_message_ordering": null,
             "filter": null,
             "labels": {
@@ -30,6 +33,9 @@
             ],
             "retain_acked_messages": null,
             "retry_policy": [],
+            "terraform_labels": {
+              "test-label1": "test-value1"
+            },
             "timeouts": null,
             "topic": "example-pubsub-topic"
           },
@@ -80,6 +86,9 @@
         "after": {
           "ack_deadline_seconds": 20,
           "dead_letter_policy": [],
+          "effective_labels": {
+            "test-label1": "test-value1"
+          },
           "enable_message_ordering": null,
           "filter": null,
           "labels": {
@@ -96,25 +105,31 @@
           ],
           "retain_acked_messages": null,
           "retry_policy": [],
+          "terraform_labels": {
+            "test-label1": "test-value1"
+          },
           "timeouts": null,
-          "topic": "example-pubsub-topic"
+          "topic": "example-pubsub-topic",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "dead_letter_policy": [],
+          "effective_labels": {},
           "expiration_policy": true,
           "id": true,
           "labels": {},
-          "project": true,
           "push_config": [
             {
               "oidc_token": []
             }
           ],
-          "retry_policy": []
+          "retry_policy": [],
+          "terraform_labels": {}
         },
         "before_sensitive": false,
         "after_sensitive": {
           "dead_letter_policy": [],
+          "effective_labels": {},
           "expiration_policy": [],
           "labels": {},
           "push_config": [
@@ -122,7 +137,8 @@
               "oidc_token": []
             }
           ],
-          "retry_policy": []
+          "retry_policy": [],
+          "terraform_labels": {}
         }
       }
     },
@@ -141,13 +157,13 @@
           "condition": [],
           "member": "user:jane@example.com",
           "role": "roles/editor",
-          "subscription": "example-subscription"
+          "subscription": "example-subscription",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "condition": [],
           "etag": true,
-          "id": true,
-          "project": true
+          "id": true
         },
         "before_sensitive": false,
         "after_sensitive": {
diff --git a/mmv1/third_party/tgc/tests/data/example_pubsub_subscription_iam_policy.tf b/mmv1/third_party/tgc/tests/data/example_pubsub_subscription_iam_policy.tf
index 1d50f5564f31..fc62e53af943 100644
--- a/mmv1/third_party/tgc/tests/data/example_pubsub_subscription_iam_policy.tf
+++ b/mmv1/third_party/tgc/tests/data/example_pubsub_subscription_iam_policy.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_pubsub_subscription_iam_policy.tfplan.json b/mmv1/third_party/tgc/tests/data/example_pubsub_subscription_iam_policy.tfplan.json
index 281258b9501e..dd9b929d8d3d 100644
--- a/mmv1/third_party/tgc/tests/data/example_pubsub_subscription_iam_policy.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_pubsub_subscription_iam_policy.tfplan.json
@@ -14,6 +14,9 @@
           "values": {
             "ack_deadline_seconds": 20,
             "dead_letter_policy": [],
+            "effective_labels": {
+              "test-label1": "test-value1"
+            },
             "enable_message_ordering": null,
             "filter": null,
             "labels": {
@@ -30,6 +33,9 @@
             ],
             "retain_acked_messages": null,
             "retry_policy": [],
+            "terraform_labels": {
+              "test-label1": "test-value1"
+            },
             "timeouts": null,
             "topic": "example-pubsub-topic"
           },
@@ -76,6 +82,9 @@
         "after": {
           "ack_deadline_seconds": 20,
           "dead_letter_policy": [],
+          "effective_labels": {
+            "test-label1": "test-value1"
+          },
           "enable_message_ordering": null,
           "filter": null,
           "labels": {
@@ -92,25 +101,31 @@
           ],
           "retain_acked_messages": null,
           "retry_policy": [],
+          "terraform_labels": {
+            "test-label1": "test-value1"
+          },
           "timeouts": null,
-          "topic": "example-pubsub-topic"
+          "topic": "example-pubsub-topic",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "dead_letter_policy": [],
+          "effective_labels": {},
           "expiration_policy": true,
           "id": true,
           "labels": {},
-          "project": true,
           "push_config": [
             {
               "oidc_token": []
             }
           ],
-          "retry_policy": []
+          "retry_policy": [],
+          "terraform_labels": {}
         },
         "before_sensitive": false,
         "after_sensitive": {
           "dead_letter_policy": [],
+          "effective_labels": {},
           "expiration_policy": [],
           "labels": {},
           "push_config": [
@@ -118,7 +133,8 @@
               "oidc_token": []
             }
           ],
-          "retry_policy": []
+          "retry_policy": [],
+          "terraform_labels": {}
         }
       }
     },
@@ -135,12 +151,12 @@
         "before": null,
         "after": {
           "policy_data": "{\"bindings\":[{\"members\":[\"user:jane@example.com\"],\"role\":\"roles/editor\"}]}",
-          "subscription": "example-subscription"
+          "subscription": "example-subscription",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "etag": true,
-          "id": true,
-          "project": true
+          "id": true
         },
         "before_sensitive": false,
         "after_sensitive": {}
diff --git a/mmv1/third_party/tgc/tests/data/example_pubsub_topic.tf b/mmv1/third_party/tgc/tests/data/example_pubsub_topic.tf
index 76422a68ad5e..c4b05306d7f5 100644
--- a/mmv1/third_party/tgc/tests/data/example_pubsub_topic.tf
+++ b/mmv1/third_party/tgc/tests/data/example_pubsub_topic.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
@@ -39,4 +39,4 @@ resource "google_pubsub_topic" "topic" {
   message_storage_policy {
     allowed_persistence_regions = ["australia-southeast1"]
   }
-}
\ No newline at end of file
+}
diff --git a/mmv1/third_party/tgc/tests/data/example_pubsub_topic.tfplan.json b/mmv1/third_party/tgc/tests/data/example_pubsub_topic.tfplan.json
index ec75e9e92203..740f394fc1b9 100644
--- a/mmv1/third_party/tgc/tests/data/example_pubsub_topic.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_pubsub_topic.tfplan.json
@@ -12,6 +12,9 @@
           "provider_name": "registry.terraform.io/hashicorp/google",
           "schema_version": 0,
           "values": {
+            "effective_labels": {
+              "test-key": "test-value"
+            },
             "kms_key_name": "projects/{{.Provider.project}}/locations/australia-southeast1/keyRings/default_kms_keyring_name/cryptoKeys/default_kms_key_name",
             "labels": {
               "test-key": "test-value"
@@ -25,6 +28,9 @@
             ],
             "name": "test",
             "project": "{{.Provider.project}}",
+            "terraform_labels": {
+              "test-key": "test-value"
+            },
             "timeouts": null
           }
         }
@@ -44,6 +50,9 @@
         ],
         "before": null,
         "after": {
+          "effective_labels": {
+            "test-key": "test-value"
+          },
           "kms_key_name": "projects/{{.Provider.project}}/locations/australia-southeast1/keyRings/default_kms_keyring_name/cryptoKeys/default_kms_key_name",
           "labels": {
             "test-key": "test-value"
@@ -57,9 +66,13 @@
           ],
           "name": "test",
           "project": "{{.Provider.project}}",
+          "terraform_labels": {
+            "test-key": "test-value"
+          },
           "timeouts": null
         },
         "after_unknown": {
+          "effective_labels": {},
           "id": true,
           "labels": {},
           "message_storage_policy": [
@@ -68,7 +81,8 @@
                 false
               ]
             }
-          ]
+          ],
+          "terraform_labels": {}
         }
       }
     }
diff --git a/mmv1/third_party/tgc/tests/data/example_secret_manager_secret_iam_binding.tfplan.json b/mmv1/third_party/tgc/tests/data/example_secret_manager_secret_iam_binding.tfplan.json
index b262950cabcb..30f142ea14fa 100644
--- a/mmv1/third_party/tgc/tests/data/example_secret_manager_secret_iam_binding.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_secret_manager_secret_iam_binding.tfplan.json
@@ -126,7 +126,8 @@
           "secret_id": "secret",
           "timeouts": null,
           "topics": [],
-          "ttl": null
+          "ttl": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "create_time": true,
@@ -134,7 +135,6 @@
           "id": true,
           "labels": {},
           "name": true,
-          "project": true,
           "replication": [
             {
               "user_managed": [
@@ -195,7 +195,8 @@
             "user:jane@example.com"
           ],
           "role": "roles/secretmanager.secretAccessor",
-          "secret_id": "secret"
+          "secret_id": "secret",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "condition": [],
@@ -203,8 +204,7 @@
           "id": true,
           "members": [
             false
-          ],
-          "project": true
+          ]
         },
         "before_sensitive": false,
         "after_sensitive": {
diff --git a/mmv1/third_party/tgc/tests/data/example_secret_manager_secret_iam_member.tfplan.json b/mmv1/third_party/tgc/tests/data/example_secret_manager_secret_iam_member.tfplan.json
index cdc97f038d22..f998a2287bef 100644
--- a/mmv1/third_party/tgc/tests/data/example_secret_manager_secret_iam_member.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_secret_manager_secret_iam_member.tfplan.json
@@ -121,7 +121,8 @@
           "secret_id": "secret",
           "timeouts": null,
           "topics": [],
-          "ttl": null
+          "ttl": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "create_time": true,
@@ -129,7 +130,6 @@
           "id": true,
           "labels": {},
           "name": true,
-          "project": true,
           "replication": [
             {
               "user_managed": [
@@ -188,13 +188,13 @@
           "condition": [],
           "member": "user:jane@example.com",
           "role": "roles/secretmanager.secretAccessor",
-          "secret_id": "secret"
+          "secret_id": "secret",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "condition": [],
           "etag": true,
-          "id": true,
-          "project": true
+          "id": true
         },
         "before_sensitive": false,
         "after_sensitive": {
diff --git a/mmv1/third_party/tgc/tests/data/example_secret_manager_secret_iam_policy.tfplan.json b/mmv1/third_party/tgc/tests/data/example_secret_manager_secret_iam_policy.tfplan.json
index d05eb75610f8..f25ae1e7ea02 100644
--- a/mmv1/third_party/tgc/tests/data/example_secret_manager_secret_iam_policy.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_secret_manager_secret_iam_policy.tfplan.json
@@ -117,7 +117,8 @@
           "secret_id": "secret",
           "timeouts": null,
           "topics": [],
-          "ttl": null
+          "ttl": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "create_time": true,
@@ -125,7 +126,6 @@
           "id": true,
           "labels": {},
           "name": true,
-          "project": true,
           "replication": [
             {
               "user_managed": [
@@ -182,12 +182,12 @@
         "before": null,
         "after": {
           "policy_data": "{\"bindings\":[{\"members\":[\"user:jane@example.com\"],\"role\":\"roles/secretmanager.secretAccessor\"}]}",
-          "secret_id": "secret"
+          "secret_id": "secret",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "etag": true,
-          "id": true,
-          "project": true
+          "id": true
         },
         "before_sensitive": false,
         "after_sensitive": {}
diff --git a/mmv1/third_party/tgc/tests/data/example_service_account.json b/mmv1/third_party/tgc/tests/data/example_service_account.json
index 91d56691a629..33b0eae6a510 100644
--- a/mmv1/third_party/tgc/tests/data/example_service_account.json
+++ b/mmv1/third_party/tgc/tests/data/example_service_account.json
@@ -11,7 +11,8 @@
       "data": {
         "displayName": "Service Account",
         "email": "service-account-id@{{.Provider.project}}.iam.gserviceaccount.com",
-        "description": "Service Account Description"
+        "description": "Service Account Description",
+        "projectId": "{{.Provider.project}}"
       }
     }
   }  
diff --git a/mmv1/third_party/tgc/tests/data/example_service_account.tf b/mmv1/third_party/tgc/tests/data/example_service_account.tf
index e8009b7c91b0..6e0dbe8c9ed3 100644
--- a/mmv1/third_party/tgc/tests/data/example_service_account.tf
+++ b/mmv1/third_party/tgc/tests/data/example_service_account.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
@@ -32,4 +32,4 @@ resource "google_service_account" "service_account" {
   display_name = "Service Account"
   description  = "Service Account Description"
   disabled     = false
-}
\ No newline at end of file
+}
diff --git a/mmv1/third_party/tgc/tests/data/example_service_account.tfplan.json b/mmv1/third_party/tgc/tests/data/example_service_account.tfplan.json
index 943ab61985ef..f51cee06c721 100644
--- a/mmv1/third_party/tgc/tests/data/example_service_account.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_service_account.tfplan.json
@@ -40,14 +40,14 @@
           "description": "Service Account Description",
           "disabled": false,
           "display_name": "Service Account",
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "email": true,
           "id": true,
           "member": true,
           "name": true,
-          "project": true,
           "unique_id": true
         },
         "before_sensitive": false,
diff --git a/mmv1/third_party/tgc/tests/data/example_service_account_update.tf b/mmv1/third_party/tgc/tests/data/example_service_account_update.tf
index f2bcec25b88c..6e0dbe8c9ed3 100644
--- a/mmv1/third_party/tgc/tests/data/example_service_account_update.tf
+++ b/mmv1/third_party/tgc/tests/data/example_service_account_update.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_spanner_database.tf b/mmv1/third_party/tgc/tests/data/example_spanner_database.tf
index 0b203f2b2970..998f6b163970 100644
--- a/mmv1/third_party/tgc/tests/data/example_spanner_database.tf
+++ b/mmv1/third_party/tgc/tests/data/example_spanner_database.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_spanner_database.tfplan.json b/mmv1/third_party/tgc/tests/data/example_spanner_database.tfplan.json
index d4145ab8e7ca..9ab0e37a7c63 100644
--- a/mmv1/third_party/tgc/tests/data/example_spanner_database.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_spanner_database.tfplan.json
@@ -69,7 +69,8 @@
           "deletion_protection": false,
           "encryption_config": [],
           "name": "my-database",
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "ddl": [
@@ -79,7 +80,6 @@
           "encryption_config": [],
           "id": true,
           "instance": true,
-          "project": true,
           "state": true
         },
         "before_sensitive": false,
@@ -109,13 +109,13 @@
           "force_destroy": false,
           "labels": null,
           "num_nodes": 1,
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "id": true,
           "name": true,
           "processing_units": true,
-          "project": true,
           "state": true
         },
         "before_sensitive": false,
diff --git a/mmv1/third_party/tgc/tests/data/example_spanner_database_iam_binding.tf b/mmv1/third_party/tgc/tests/data/example_spanner_database_iam_binding.tf
index 7fcc4725f92a..7a2233385166 100644
--- a/mmv1/third_party/tgc/tests/data/example_spanner_database_iam_binding.tf
+++ b/mmv1/third_party/tgc/tests/data/example_spanner_database_iam_binding.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_spanner_database_iam_binding.tfplan.json b/mmv1/third_party/tgc/tests/data/example_spanner_database_iam_binding.tfplan.json
index 1341f100556c..6e9f84e49c7d 100644
--- a/mmv1/third_party/tgc/tests/data/example_spanner_database_iam_binding.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_spanner_database_iam_binding.tfplan.json
@@ -95,7 +95,8 @@
           "encryption_config": [],
           "instance": "my-instance",
           "name": "my-database",
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "ddl": [
@@ -104,7 +105,6 @@
           ],
           "encryption_config": [],
           "id": true,
-          "project": true,
           "state": true
         },
         "before_sensitive": false,
@@ -135,7 +135,8 @@
           "members": [
             "user:jane@example.com"
           ],
-          "role": "roles/compute.networkUser"
+          "role": "roles/compute.networkUser",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "condition": [],
@@ -143,8 +144,7 @@
           "id": true,
           "members": [
             false
-          ],
-          "project": true
+          ]
         },
         "before_sensitive": false,
         "after_sensitive": {
@@ -173,12 +173,12 @@
           "labels": null,
           "name": "my-instance",
           "num_nodes": 1,
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "id": true,
           "processing_units": true,
-          "project": true,
           "state": true
         },
         "before_sensitive": false,
diff --git a/mmv1/third_party/tgc/tests/data/example_spanner_database_iam_member.tf b/mmv1/third_party/tgc/tests/data/example_spanner_database_iam_member.tf
index 109c4db46ee6..554490c08f38 100644
--- a/mmv1/third_party/tgc/tests/data/example_spanner_database_iam_member.tf
+++ b/mmv1/third_party/tgc/tests/data/example_spanner_database_iam_member.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_spanner_database_iam_member.tfplan.json b/mmv1/third_party/tgc/tests/data/example_spanner_database_iam_member.tfplan.json
index e37e6158e8c7..60d0b83e89d2 100644
--- a/mmv1/third_party/tgc/tests/data/example_spanner_database_iam_member.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_spanner_database_iam_member.tfplan.json
@@ -90,7 +90,8 @@
           "encryption_config": [],
           "instance": "my-instance",
           "name": "my-database",
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "ddl": [
@@ -99,7 +100,6 @@
           ],
           "encryption_config": [],
           "id": true,
-          "project": true,
           "state": true
         },
         "before_sensitive": false,
@@ -128,13 +128,13 @@
           "database": "my-database",
           "instance": "my-instance",
           "member": "user:jane@example.com",
-          "role": "roles/compute.networkUser"
+          "role": "roles/compute.networkUser",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "condition": [],
           "etag": true,
-          "id": true,
-          "project": true
+          "id": true
         },
         "before_sensitive": false,
         "after_sensitive": {
@@ -160,12 +160,12 @@
           "labels": null,
           "name": "my-instance",
           "num_nodes": 1,
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "id": true,
           "processing_units": true,
-          "project": true,
           "state": true
         },
         "before_sensitive": false,
diff --git a/mmv1/third_party/tgc/tests/data/example_spanner_database_iam_policy.tf b/mmv1/third_party/tgc/tests/data/example_spanner_database_iam_policy.tf
index 4bb2d25a6ebe..4598b8f21449 100644
--- a/mmv1/third_party/tgc/tests/data/example_spanner_database_iam_policy.tf
+++ b/mmv1/third_party/tgc/tests/data/example_spanner_database_iam_policy.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_spanner_database_iam_policy.tfplan.json b/mmv1/third_party/tgc/tests/data/example_spanner_database_iam_policy.tfplan.json
index dc3e6de96ddf..9f47ee692a57 100644
--- a/mmv1/third_party/tgc/tests/data/example_spanner_database_iam_policy.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_spanner_database_iam_policy.tfplan.json
@@ -86,7 +86,8 @@
           "encryption_config": [],
           "instance": "my-instance",
           "name": "my-database",
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "ddl": [
@@ -95,7 +96,6 @@
           ],
           "encryption_config": [],
           "id": true,
-          "project": true,
           "state": true
         },
         "before_sensitive": false,
@@ -122,12 +122,12 @@
         "after": {
           "database": "my-database",
           "instance": "my-instance",
-          "policy_data": "{\"bindings\":[{\"members\":[\"user:jane@example.com\"],\"role\":\"roles/editor\"}]}"
+          "policy_data": "{\"bindings\":[{\"members\":[\"user:jane@example.com\"],\"role\":\"roles/editor\"}]}",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "etag": true,
-          "id": true,
-          "project": true
+          "id": true
         },
         "before_sensitive": false,
         "after_sensitive": {}
@@ -151,12 +151,12 @@
           "labels": null,
           "name": "my-instance",
           "num_nodes": 1,
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "id": true,
           "processing_units": true,
-          "project": true,
           "state": true
         },
         "before_sensitive": false,
diff --git a/mmv1/third_party/tgc/tests/data/example_spanner_instance_iam_binding.tf b/mmv1/third_party/tgc/tests/data/example_spanner_instance_iam_binding.tf
index f2e46c693b2d..345e342f5314 100644
--- a/mmv1/third_party/tgc/tests/data/example_spanner_instance_iam_binding.tf
+++ b/mmv1/third_party/tgc/tests/data/example_spanner_instance_iam_binding.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_spanner_instance_iam_binding.tfplan.json b/mmv1/third_party/tgc/tests/data/example_spanner_instance_iam_binding.tfplan.json
index 0eea832230a1..3e530acff0a4 100644
--- a/mmv1/third_party/tgc/tests/data/example_spanner_instance_iam_binding.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_spanner_instance_iam_binding.tfplan.json
@@ -66,12 +66,12 @@
           "labels": null,
           "name": "spanner-instance",
           "num_nodes": 1,
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "id": true,
           "processing_units": true,
-          "project": true,
           "state": true
         },
         "before_sensitive": false,
@@ -95,7 +95,8 @@
           "members": [
             "user:jane@example.com"
           ],
-          "role": "roles/compute.networkUser"
+          "role": "roles/compute.networkUser",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "condition": [],
@@ -103,8 +104,7 @@
           "id": true,
           "members": [
             false
-          ],
-          "project": true
+          ]
         },
         "before_sensitive": false,
         "after_sensitive": {
diff --git a/mmv1/third_party/tgc/tests/data/example_spanner_instance_iam_member.tf b/mmv1/third_party/tgc/tests/data/example_spanner_instance_iam_member.tf
index 1f4171842c71..7dbd24fdf9a3 100644
--- a/mmv1/third_party/tgc/tests/data/example_spanner_instance_iam_member.tf
+++ b/mmv1/third_party/tgc/tests/data/example_spanner_instance_iam_member.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_spanner_instance_iam_member.tfplan.json b/mmv1/third_party/tgc/tests/data/example_spanner_instance_iam_member.tfplan.json
index 371286e9eac8..9d17f4eff5b5 100644
--- a/mmv1/third_party/tgc/tests/data/example_spanner_instance_iam_member.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_spanner_instance_iam_member.tfplan.json
@@ -61,12 +61,12 @@
           "labels": null,
           "name": "spanner-instance",
           "num_nodes": 1,
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "id": true,
           "processing_units": true,
-          "project": true,
           "state": true
         },
         "before_sensitive": false,
@@ -88,13 +88,13 @@
           "condition": [],
           "instance": "spanner-instance",
           "member": "user:jane@example.com",
-          "role": "roles/compute.networkUser"
+          "role": "roles/compute.networkUser",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "condition": [],
           "etag": true,
-          "id": true,
-          "project": true
+          "id": true
         },
         "before_sensitive": false,
         "after_sensitive": {
diff --git a/mmv1/third_party/tgc/tests/data/example_spanner_instance_iam_policy.tf b/mmv1/third_party/tgc/tests/data/example_spanner_instance_iam_policy.tf
index e62efc7493cd..2f48b5669f76 100644
--- a/mmv1/third_party/tgc/tests/data/example_spanner_instance_iam_policy.tf
+++ b/mmv1/third_party/tgc/tests/data/example_spanner_instance_iam_policy.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_spanner_instance_iam_policy.tfplan.json b/mmv1/third_party/tgc/tests/data/example_spanner_instance_iam_policy.tfplan.json
index 61d97ab04c59..474ae044a7e9 100644
--- a/mmv1/third_party/tgc/tests/data/example_spanner_instance_iam_policy.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_spanner_instance_iam_policy.tfplan.json
@@ -57,12 +57,12 @@
           "labels": null,
           "name": "spanner-instance",
           "num_nodes": 1,
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "id": true,
           "processing_units": true,
-          "project": true,
           "state": true
         },
         "before_sensitive": false,
@@ -82,12 +82,12 @@
         "before": null,
         "after": {
           "instance": "spanner-instance",
-          "policy_data": "{\"bindings\":[{\"members\":[\"user:jane@example.com\"],\"role\":\"roles/editor\"}]}"
+          "policy_data": "{\"bindings\":[{\"members\":[\"user:jane@example.com\"],\"role\":\"roles/editor\"}]}",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "etag": true,
-          "id": true,
-          "project": true
+          "id": true
         },
         "before_sensitive": false,
         "after_sensitive": {}
diff --git a/mmv1/third_party/tgc/tests/data/example_sql_database_instance.tf b/mmv1/third_party/tgc/tests/data/example_sql_database_instance.tf
index 2a419d82228d..ee13d0e3e090 100644
--- a/mmv1/third_party/tgc/tests/data/example_sql_database_instance.tf
+++ b/mmv1/third_party/tgc/tests/data/example_sql_database_instance.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_sql_database_instance.tfplan.json b/mmv1/third_party/tgc/tests/data/example_sql_database_instance.tfplan.json
index 75504cfe7417..1e93ac4fd098 100644
--- a/mmv1/third_party/tgc/tests/data/example_sql_database_instance.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_sql_database_instance.tfplan.json
@@ -93,7 +93,8 @@
               "tier": "db-f1-micro"
             }
           ],
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "clone": [],
@@ -103,7 +104,6 @@
           "ip_address": true,
           "master_instance_name": true,
           "private_ip_address": true,
-          "project": true,
           "public_ip_address": true,
           "replica_configuration": true,
           "restore_backup_context": [],
diff --git a/mmv1/third_party/tgc/tests/data/example_storage_bucket.tf b/mmv1/third_party/tgc/tests/data/example_storage_bucket.tf
index caab5ebb9948..7c256bdb3128 100644
--- a/mmv1/third_party/tgc/tests/data/example_storage_bucket.tf
+++ b/mmv1/third_party/tgc/tests/data/example_storage_bucket.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_storage_bucket.tfplan.json b/mmv1/third_party/tgc/tests/data/example_storage_bucket.tfplan.json
index 9a26e370b01f..34973ceec914 100644
--- a/mmv1/third_party/tgc/tests/data/example_storage_bucket.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_storage_bucket.tfplan.json
@@ -67,7 +67,8 @@
               "main_page_suffix": "index.html",
               "not_found_page": "404.html"
             }
-          ]
+          ],
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "uniform_bucket_level_access": true,
@@ -76,7 +77,6 @@
           "id": true,
           "lifecycle_rule": [],
           "logging": [],
-          "project": true,
           "retention_policy": [],
           "self_link": true,
           "url": true,
diff --git a/mmv1/third_party/tgc/tests/data/example_storage_bucket_empty_project_id.json b/mmv1/third_party/tgc/tests/data/example_storage_bucket_empty_project_id.json
new file mode 100644
index 000000000000..6086117f63a3
--- /dev/null
+++ b/mmv1/third_party/tgc/tests/data/example_storage_bucket_empty_project_id.json
@@ -0,0 +1,31 @@
+[
+  {
+    "name": "//storage.googleapis.com/image-store-bucket",
+    "asset_type": "storage.googleapis.com/Bucket",
+    "ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
+    "resource": {
+      "version": "v1",
+      "discovery_document_uri": "https://www.googleapis.com/discovery/v1/apis/storage/v1/rest",
+      "discovery_name": "Bucket",
+      "parent": "//cloudresourcemanager.googleapis.com/projects/{{.Provider.project}}",
+      "data": {
+        "iamConfiguration": {
+          "uniformBucketLevelAccess": {
+            "enabled": false
+          }
+        },
+        "lifecycle": {
+          "rule": []
+        },
+        "location": "EU",
+        "name": "image-store-bucket",
+        "project": "{{.Provider.project}}",
+        "storageClass": "STANDARD",
+        "website": {
+          "mainPageSuffix": "index.html",
+          "notFoundPage": "404.html"
+        }
+      }
+    }
+  }
+]
diff --git a/mmv1/third_party/tgc/tests/data/example_storage_bucket_empty_project_id.tf b/mmv1/third_party/tgc/tests/data/example_storage_bucket_empty_project_id.tf
new file mode 100644
index 000000000000..9ca5eed2311c
--- /dev/null
+++ b/mmv1/third_party/tgc/tests/data/example_storage_bucket_empty_project_id.tf
@@ -0,0 +1,46 @@
+/**
+ * Copyright 2019 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+terraform {
+  required_providers {
+    google = {
+      source = "hashicorp/google-beta"
+      version = "~> {{.Provider.version}}"
+    }
+  }
+}
+
+provider "google" {
+  {{if .Provider.credentials }}credentials = "{{.Provider.credentials}}"{{end}}
+}
+
+resource "random_string" "suffix" {
+  length  = 4
+  upper   = false
+  special = false
+}
+
+
+resource "google_storage_bucket" "image-store" {
+  project = "${random_string.suffix.result}"
+  name     = "image-store-bucket"
+  location = "EU"
+
+  website {
+    main_page_suffix = "index.html"
+    not_found_page   = "404.html"
+  }
+}
diff --git a/mmv1/third_party/tgc/tests/data/example_storage_bucket_empty_project_id.tfplan.json b/mmv1/third_party/tgc/tests/data/example_storage_bucket_empty_project_id.tfplan.json
new file mode 100644
index 000000000000..c48467d6bc41
--- /dev/null
+++ b/mmv1/third_party/tgc/tests/data/example_storage_bucket_empty_project_id.tfplan.json
@@ -0,0 +1,264 @@
+{
+  "format_version": "1.2",
+  "terraform_version": "1.5.6",
+  "planned_values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_storage_bucket.image-store",
+          "mode": "managed",
+          "type": "google_storage_bucket",
+          "name": "image-store",
+          "provider_name": "registry.terraform.io/hashicorp/google",
+          "schema_version": 1,
+          "values": {
+            "autoclass": [],
+            "cors": [],
+            "custom_placement_config": [],
+            "default_event_based_hold": null,
+            "encryption": [],
+            "force_destroy": false,
+            "labels": null,
+            "lifecycle_rule": [],
+            "location": "EU",
+            "logging": [],
+            "name": "image-store-bucket",
+            "requester_pays": null,
+            "retention_policy": [],
+            "storage_class": "STANDARD",
+            "timeouts": null,
+            "website": [
+              {
+                "main_page_suffix": "index.html",
+                "not_found_page": "404.html"
+              }
+            ]
+          },
+          "sensitive_values": {
+            "autoclass": [],
+            "cors": [],
+            "custom_placement_config": [],
+            "effective_labels": {},
+            "encryption": [],
+            "lifecycle_rule": [],
+            "logging": [],
+            "retention_policy": [],
+            "terraform_labels": {},
+            "versioning": [],
+            "website": [
+              {}
+            ]
+          }
+        },
+        {
+          "address": "random_string.suffix",
+          "mode": "managed",
+          "type": "random_string",
+          "name": "suffix",
+          "provider_name": "registry.terraform.io/hashicorp/random",
+          "schema_version": 2,
+          "values": {
+            "keepers": null,
+            "length": 4,
+            "lower": true,
+            "min_lower": 0,
+            "min_numeric": 0,
+            "min_special": 0,
+            "min_upper": 0,
+            "number": true,
+            "numeric": true,
+            "override_special": null,
+            "special": false,
+            "upper": false
+          },
+          "sensitive_values": {}
+        }
+      ]
+    }
+  },
+  "resource_changes": [
+    {
+      "address": "google_storage_bucket.image-store",
+      "mode": "managed",
+      "type": "google_storage_bucket",
+      "name": "image-store",
+      "provider_name": "registry.terraform.io/hashicorp/google",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "autoclass": [],
+          "cors": [],
+          "custom_placement_config": [],
+          "default_event_based_hold": null,
+          "encryption": [],
+          "force_destroy": false,
+          "labels": null,
+          "lifecycle_rule": [],
+          "location": "EU",
+          "logging": [],
+          "name": "image-store-bucket",
+          "requester_pays": null,
+          "retention_policy": [],
+          "storage_class": "STANDARD",
+          "timeouts": null,
+          "website": [
+            {
+              "main_page_suffix": "index.html",
+              "not_found_page": "404.html"
+            }
+          ]
+        },
+        "after_unknown": {
+          "autoclass": [],
+          "cors": [],
+          "custom_placement_config": [],
+          "effective_labels": true,
+          "encryption": [],
+          "id": true,
+          "lifecycle_rule": [],
+          "logging": [],
+          "project": true,
+          "public_access_prevention": true,
+          "retention_policy": [],
+          "self_link": true,
+          "terraform_labels": true,
+          "uniform_bucket_level_access": true,
+          "url": true,
+          "versioning": true,
+          "website": [
+            {}
+          ]
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "autoclass": [],
+          "cors": [],
+          "custom_placement_config": [],
+          "effective_labels": {},
+          "encryption": [],
+          "lifecycle_rule": [],
+          "logging": [],
+          "retention_policy": [],
+          "terraform_labels": {},
+          "versioning": [],
+          "website": [
+            {}
+          ]
+        }
+      }
+    },
+    {
+      "address": "random_string.suffix",
+      "mode": "managed",
+      "type": "random_string",
+      "name": "suffix",
+      "provider_name": "registry.terraform.io/hashicorp/random",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "keepers": null,
+          "length": 4,
+          "lower": true,
+          "min_lower": 0,
+          "min_numeric": 0,
+          "min_special": 0,
+          "min_upper": 0,
+          "number": true,
+          "numeric": true,
+          "override_special": null,
+          "special": false,
+          "upper": false
+        },
+        "after_unknown": {
+          "id": true,
+          "result": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {}
+      }
+    }
+  ],
+  "configuration": {
+    "provider_config": {
+      "google": {
+        "name": "google",
+        "full_name": "registry.terraform.io/hashicorp/google",
+        "version_constraint": "5.0.0"
+      },
+      "random": {
+        "name": "random",
+        "full_name": "registry.terraform.io/hashicorp/random"
+      }
+    },
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_storage_bucket.image-store",
+          "mode": "managed",
+          "type": "google_storage_bucket",
+          "name": "image-store",
+          "provider_config_key": "google",
+          "expressions": {
+            "location": {
+              "constant_value": "EU"
+            },
+            "name": {
+              "constant_value": "image-store-bucket"
+            },
+            "project": {
+              "references": [
+                "random_string.suffix.result",
+                "random_string.suffix"
+              ]
+            },
+            "website": [
+              {
+                "main_page_suffix": {
+                  "constant_value": "index.html"
+                },
+                "not_found_page": {
+                  "constant_value": "404.html"
+                }
+              }
+            ]
+          },
+          "schema_version": 1
+        },
+        {
+          "address": "random_string.suffix",
+          "mode": "managed",
+          "type": "random_string",
+          "name": "suffix",
+          "provider_config_key": "random",
+          "expressions": {
+            "length": {
+              "constant_value": 4
+            },
+            "special": {
+              "constant_value": false
+            },
+            "upper": {
+              "constant_value": false
+            }
+          },
+          "schema_version": 2
+        }
+      ]
+    }
+  },
+  "relevant_attributes": [
+    {
+      "resource": "random_string.suffix",
+      "attribute": [
+        "result"
+      ]
+    }
+  ],
+  "timestamp": "2023-10-11T17:45:17Z"
+}
diff --git a/mmv1/third_party/tgc/tests/data/example_storage_bucket_without_default_project.json b/mmv1/third_party/tgc/tests/data/example_storage_bucket_empty_project_id_without_default_project.json
similarity index 94%
rename from mmv1/third_party/tgc/tests/data/example_storage_bucket_without_default_project.json
rename to mmv1/third_party/tgc/tests/data/example_storage_bucket_empty_project_id_without_default_project.json
index b14474275229..d2e76ac7bee3 100644
--- a/mmv1/third_party/tgc/tests/data/example_storage_bucket_without_default_project.json
+++ b/mmv1/third_party/tgc/tests/data/example_storage_bucket_empty_project_id_without_default_project.json
@@ -2,7 +2,7 @@
   {
     "name": "//storage.googleapis.com/image-store-bucket",
     "asset_type": "storage.googleapis.com/Bucket",
-    "ancestry_path": "organization/unknown",
+    "ancestry_path": "organizations/unknown",
     "resource": {
       "version": "v1",
       "discovery_document_uri": "https://www.googleapis.com/discovery/v1/apis/storage/v1/rest",
diff --git a/mmv1/third_party/tgc/tests/data/example_storage_bucket_iam_binding.tf b/mmv1/third_party/tgc/tests/data/example_storage_bucket_iam_binding.tf
index 7c4db5d0f8d4..75526739e521 100644
--- a/mmv1/third_party/tgc/tests/data/example_storage_bucket_iam_binding.tf
+++ b/mmv1/third_party/tgc/tests/data/example_storage_bucket_iam_binding.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_storage_bucket_iam_member.tf b/mmv1/third_party/tgc/tests/data/example_storage_bucket_iam_member.tf
index c160c913f95e..d42a835b83c7 100644
--- a/mmv1/third_party/tgc/tests/data/example_storage_bucket_iam_member.tf
+++ b/mmv1/third_party/tgc/tests/data/example_storage_bucket_iam_member.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_storage_bucket_iam_member_random_suffix.tf b/mmv1/third_party/tgc/tests/data/example_storage_bucket_iam_member_random_suffix.tf
index 0afae182da89..ceae06cf91bb 100644
--- a/mmv1/third_party/tgc/tests/data/example_storage_bucket_iam_member_random_suffix.tf
+++ b/mmv1/third_party/tgc/tests/data/example_storage_bucket_iam_member_random_suffix.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_storage_bucket_iam_policy.tf b/mmv1/third_party/tgc/tests/data/example_storage_bucket_iam_policy.tf
index b1a997315688..46e7f2af68b4 100644
--- a/mmv1/third_party/tgc/tests/data/example_storage_bucket_iam_policy.tf
+++ b/mmv1/third_party/tgc/tests/data/example_storage_bucket_iam_policy.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_vpc_access_connector.json b/mmv1/third_party/tgc/tests/data/example_vpc_access_connector.json
index 1552e7b58f73..febb8f3bc824 100644
--- a/mmv1/third_party/tgc/tests/data/example_vpc_access_connector.json
+++ b/mmv1/third_party/tgc/tests/data/example_vpc_access_connector.json
@@ -12,7 +12,8 @@
         "ipCidrRange": "10.8.0.0/28",
         "maxThroughput": 300,
         "minThroughput": 200,
-        "network": "default"
+        "network": "default",
+        "machineType": "e2-micro"
       }
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_vpc_access_connector.tf b/mmv1/third_party/tgc/tests/data/example_vpc_access_connector.tf
index 8e2e45ec0193..9281200db1f0 100644
--- a/mmv1/third_party/tgc/tests/data/example_vpc_access_connector.tf
+++ b/mmv1/third_party/tgc/tests/data/example_vpc_access_connector.tf
@@ -16,7 +16,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/example_vpc_access_connector.tfplan.json b/mmv1/third_party/tgc/tests/data/example_vpc_access_connector.tfplan.json
index 24fdb4c5ebc1..1098a173595e 100644
--- a/mmv1/third_party/tgc/tests/data/example_vpc_access_connector.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/example_vpc_access_connector.tfplan.json
@@ -43,11 +43,12 @@
                     "name": "vpc-con",
                     "network": "default",
                     "region": "us-central1",
-                    "timeouts": null
+                    "timeouts": null,
+                    "project": "{{.Provider.project}}",
+                    "machine_type": "e2-micro"
                 },
                 "after_unknown": {
                     "id": true,
-                    "project": true,
                     "self_link": true,
                     "state": true,
                     "connected_projects": true
diff --git a/mmv1/third_party/tgc/tests/data/firewall.tf b/mmv1/third_party/tgc/tests/data/firewall.tf
index 12b3e7ce2ef1..f86d4229214a 100644
--- a/mmv1/third_party/tgc/tests/data/firewall.tf
+++ b/mmv1/third_party/tgc/tests/data/firewall.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/firewall.tfplan.json b/mmv1/third_party/tgc/tests/data/firewall.tfplan.json
new file mode 100644
index 000000000000..3e6764b1388c
--- /dev/null
+++ b/mmv1/third_party/tgc/tests/data/firewall.tfplan.json
@@ -0,0 +1,219 @@
+{
+  "format_version": "1.1",
+  "terraform_version": "1.3.2",
+  "planned_values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_compute_firewall.my-test-firewall",
+          "mode": "managed",
+          "type": "google_compute_firewall",
+          "name": "my-test-firewall",
+          "provider_name": "registry.terraform.io/hashicorp/google",
+          "schema_version": 1,
+          "values": {
+            "allow": [
+              {
+                "ports": [
+                  "80",
+                  "8080",
+                  "1000-2000"
+                ],
+                "protocol": "tcp"
+              },
+              {
+                "ports": [],
+                "protocol": "icmp"
+              }
+            ],
+            "deny": [],
+            "description": null,
+            "disabled": null,
+            "log_config": [],
+            "name": "my-test-firewall",
+            "network": "default",
+            "priority": 1000,
+            "project": "{{.Provider.project}}",
+            "source_ranges": null,
+            "source_service_accounts": null,
+            "source_tags": [
+              "web"
+            ],
+            "target_service_accounts": null,
+            "target_tags": null,
+            "timeouts": null
+          },
+          "sensitive_values": {
+            "allow": [
+              {
+                "ports": [
+                  false,
+                  false,
+                  false
+                ]
+              },
+              {
+                "ports": []
+              }
+            ],
+            "deny": [],
+            "destination_ranges": [],
+            "log_config": [],
+            "source_tags": [
+              false
+            ]
+          }
+        }
+      ]
+    }
+  },
+  "resource_changes": [
+    {
+      "address": "google_compute_firewall.my-test-firewall",
+      "mode": "managed",
+      "type": "google_compute_firewall",
+      "name": "my-test-firewall",
+      "provider_name": "registry.terraform.io/hashicorp/google",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "allow": [
+            {
+              "ports": [
+                "80",
+                "8080",
+                "1000-2000"
+              ],
+              "protocol": "tcp"
+            },
+            {
+              "ports": [],
+              "protocol": "icmp"
+            }
+          ],
+          "deny": [],
+          "description": null,
+          "disabled": null,
+          "log_config": [],
+          "name": "my-test-firewall",
+          "network": "default",
+          "priority": 1000,
+          "project": "{{.Provider.project}}",
+          "source_ranges": null,
+          "source_service_accounts": null,
+          "source_tags": [
+            "web"
+          ],
+          "target_service_accounts": null,
+          "target_tags": null,
+          "timeouts": null
+        },
+        "after_unknown": {
+          "allow": [
+            {
+              "ports": [
+                false,
+                false,
+                false
+              ]
+            },
+            {
+              "ports": []
+            }
+          ],
+          "creation_timestamp": true,
+          "deny": [],
+          "destination_ranges": true,
+          "direction": true,
+          "enable_logging": true,
+          "id": true,
+          "log_config": [],
+          "self_link": true,
+          "source_tags": [
+            false
+          ]
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "allow": [
+            {
+              "ports": [
+                false,
+                false,
+                false
+              ]
+            },
+            {
+              "ports": []
+            }
+          ],
+          "deny": [],
+          "destination_ranges": [],
+          "log_config": [],
+          "source_tags": [
+            false
+          ]
+        }
+      }
+    }
+  ],
+  "configuration": {
+    "provider_config": {
+      "google": {
+        "name": "google",
+        "expressions": {
+          "project": {
+            "constant_value": "{{.Provider.project}}"
+          }
+        }
+      }
+    },
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_compute_firewall.my-test-firewall",
+          "mode": "managed",
+          "type": "google_compute_firewall",
+          "name": "my-test-firewall",
+          "provider_config_key": "google",
+          "expressions": {
+            "allow": [
+              {
+                "protocol": {
+                  "constant_value": "icmp"
+                }
+              },
+              {
+                "ports": {
+                  "constant_value": [
+                    "80",
+                    "8080",
+                    "1000-2000"
+                  ]
+                },
+                "protocol": {
+                  "constant_value": "tcp"
+                }
+              }
+            ],
+            "name": {
+              "constant_value": "my-test-firewall"
+            },
+            "network": {
+              "constant_value": "default"
+            },
+            "source_tags": {
+              "constant_value": [
+                "web"
+              ]
+            }
+          },
+          "schema_version": 1
+        }
+      ]
+    }
+  }
+}
diff --git a/mmv1/third_party/tgc/tests/data/full_compute_firewall.json b/mmv1/third_party/tgc/tests/data/full_compute_firewall.json
index 9c9aa21cea72..188a33b22275 100644
--- a/mmv1/third_party/tgc/tests/data/full_compute_firewall.json
+++ b/mmv1/third_party/tgc/tests/data/full_compute_firewall.json
@@ -130,7 +130,8 @@
       "parent": "//cloudresourcemanager.googleapis.com/projects/{{.Provider.project}}",
       "data": {
         "autoCreateSubnetworks": true,
-        "name": "test-network"
+        "name": "test-network",
+        "networkFirewallPolicyEnforcementOrder": "AFTER_CLASSIC_FIREWALL"
       }
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/full_compute_firewall.tf b/mmv1/third_party/tgc/tests/data/full_compute_firewall.tf
index fc9a46299d7b..587f915e3042 100644
--- a/mmv1/third_party/tgc/tests/data/full_compute_firewall.tf
+++ b/mmv1/third_party/tgc/tests/data/full_compute_firewall.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/full_compute_firewall.tfplan.json b/mmv1/third_party/tgc/tests/data/full_compute_firewall.tfplan.json
index 4c79ee95c49c..4d464a6748d6 100644
--- a/mmv1/third_party/tgc/tests/data/full_compute_firewall.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/full_compute_firewall.tfplan.json
@@ -265,7 +265,8 @@
           "source_tags": null,
           "target_service_accounts": null,
           "target_tags": null,
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "allow": [
@@ -289,7 +290,6 @@
           "enable_logging": true,
           "id": true,
           "log_config": [],
-          "project": true,
           "self_link": true,
           "source_service_accounts": [
             false,
@@ -370,7 +370,8 @@
             "test-target_service_account2"
           ],
           "target_tags": null,
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "allow": [],
@@ -392,7 +393,6 @@
           "enable_logging": true,
           "id": true,
           "log_config": [],
-          "project": true,
           "self_link": true,
           "source_ranges": [
             false,
@@ -474,7 +474,8 @@
             "test-target_tag1",
             "test-target_tag2"
           ],
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "allow": [],
@@ -489,7 +490,6 @@
           "enable_logging": true,
           "id": true,
           "log_config": [],
-          "project": true,
           "self_link": true,
           "source_tags": [
             false
@@ -535,13 +535,14 @@
           "delete_default_routes_on_create": false,
           "description": null,
           "name": "test-network",
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}",
+          "network_firewall_policy_enforcement_order": "AFTER_CLASSIC_FIREWALL"
         },
         "after_unknown": {
           "gateway_ipv4": true,
           "id": true,
           "mtu": true,
-          "project": true,
           "routing_mode": true,
           "self_link": true
         },
diff --git a/mmv1/third_party/tgc/tests/data/full_compute_instance.tf b/mmv1/third_party/tgc/tests/data/full_compute_instance.tf
index e081503a369a..ebdc80fdbce6 100644
--- a/mmv1/third_party/tgc/tests/data/full_compute_instance.tf
+++ b/mmv1/third_party/tgc/tests/data/full_compute_instance.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/full_compute_instance.tfplan.json b/mmv1/third_party/tgc/tests/data/full_compute_instance.tfplan.json
index 56ab5ff21223..cac36f3c02aa 100644
--- a/mmv1/third_party/tgc/tests/data/full_compute_instance.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/full_compute_instance.tfplan.json
@@ -354,7 +354,8 @@
             "foo"
           ],
           "timeouts": null,
-          "zone": "us-central1-a"
+          "zone": "us-central1-a",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "advanced_machine_features": [],
@@ -421,7 +422,6 @@
               "network_ip": true
             }
           ],
-          "project": true,
           "reservation_affinity": true,
           "scheduling": [
             {
@@ -506,7 +506,8 @@
           "shielded_instance_config": [],
           "tags": null,
           "timeouts": null,
-          "zone": "us-central1-a"
+          "zone": "us-central1-a",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "advanced_machine_features": [],
@@ -538,7 +539,6 @@
               "subnetwork_project": true
             }
           ],
-          "project": true,
           "reservation_affinity": true,
           "scheduling": true,
           "scratch_disk": [],
diff --git a/mmv1/third_party/tgc/tests/data/full_container_cluster.tf b/mmv1/third_party/tgc/tests/data/full_container_cluster.tf
index fe7966114c5e..90fdb32f5971 100644
--- a/mmv1/third_party/tgc/tests/data/full_container_cluster.tf
+++ b/mmv1/third_party/tgc/tests/data/full_container_cluster.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
@@ -36,7 +36,6 @@ resource "google_container_cluster" "full_list_default_1" {
   # authenticator_groups_config
   # cluster_autoscaling
   # database_encryption
-  # enable_binary_authorization
   # enable_intranode_visibility
   # enable_shielded_nodes
   # enable_tpu
diff --git a/mmv1/third_party/tgc/tests/data/full_container_cluster.tfplan.json b/mmv1/third_party/tgc/tests/data/full_container_cluster.tfplan.json
index a9370d3d5cc1..7b9147d03feb 100644
--- a/mmv1/third_party/tgc/tests/data/full_container_cluster.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/full_container_cluster.tfplan.json
@@ -34,7 +34,6 @@
             "default_max_pods_per_node": 42,
             "description": "test-description",
             "enable_autopilot": null,
-            "enable_binary_authorization": false,
             "enable_kubernetes_alpha": true,
             "enable_legacy_abac": true,
             "enable_shielded_nodes": true,
@@ -277,7 +276,6 @@
           "default_max_pods_per_node": 42,
           "description": "test-description",
           "enable_autopilot": null,
-          "enable_binary_authorization": false,
           "enable_kubernetes_alpha": true,
           "enable_legacy_abac": true,
           "enable_shielded_nodes": true,
@@ -391,7 +389,8 @@
           "resource_usage_export_config": [],
           "subnetwork": "test-subnetwork",
           "timeouts": null,
-          "vertical_pod_autoscaling": []
+          "vertical_pod_autoscaling": [],
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "addons_config": [
@@ -496,7 +495,6 @@
             }
           ],
           "private_ipv6_google_access": true,
-          "project": true,
           "release_channel": true,
           "resource_labels": {},
           "resource_usage_export_config": [],
@@ -815,4 +813,4 @@
       ]
     }
   }
-}
+}
\ No newline at end of file
diff --git a/mmv1/third_party/tgc/tests/data/full_container_node_pool.tf b/mmv1/third_party/tgc/tests/data/full_container_node_pool.tf
index 1ebcaf4e082f..4cdb03d53adb 100644
--- a/mmv1/third_party/tgc/tests/data/full_container_node_pool.tf
+++ b/mmv1/third_party/tgc/tests/data/full_container_node_pool.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/full_container_node_pool.tfplan.json b/mmv1/third_party/tgc/tests/data/full_container_node_pool.tfplan.json
index 2d6be4038d3d..6a1dc713660a 100644
--- a/mmv1/third_party/tgc/tests/data/full_container_node_pool.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/full_container_node_pool.tfplan.json
@@ -147,7 +147,8 @@
           "region": "us-central1",
           "timeouts": null,
           "version": "test-version",
-          "zone": "us-central1-a"
+          "zone": "us-central1-a",
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "autoscaling": [
@@ -178,8 +179,7 @@
               ],
               "workload_metadata_config": []
             }
-          ],
-          "project": true
+          ]
         }
       }
     }
diff --git a/mmv1/third_party/tgc/tests/data/full_spanner_instance.tf b/mmv1/third_party/tgc/tests/data/full_spanner_instance.tf
index f42fd6c9e874..147f1ad2bfb7 100644
--- a/mmv1/third_party/tgc/tests/data/full_spanner_instance.tf
+++ b/mmv1/third_party/tgc/tests/data/full_spanner_instance.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/full_spanner_instance.tfplan.json b/mmv1/third_party/tgc/tests/data/full_spanner_instance.tfplan.json
index ead499d7a4eb..b282fc2efdaf 100644
--- a/mmv1/third_party/tgc/tests/data/full_spanner_instance.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/full_spanner_instance.tfplan.json
@@ -14,6 +14,11 @@
           "values": {
             "config": "regional-us-central1",
             "display_name": "spanner-instance",
+            "effective_labels": {
+              "label1": "value1",
+              "label2": "value2",
+              "label3": "value3"
+            },
             "force_destroy": false,
             "labels": {
               "label1": "value1",
@@ -22,6 +27,11 @@
             },
             "name": "spanner-instance",
             "num_nodes": 1,
+            "terraform_labels": {
+              "label1": "value1",
+              "label2": "value2",
+              "label3": "value3"
+            },
             "timeouts": null
           }
         }
@@ -43,6 +53,11 @@
         "after": {
           "config": "regional-us-central1",
           "display_name": "spanner-instance",
+          "effective_labels": {
+            "label1": "value1",
+            "label2": "value2",
+            "label3": "value3"
+          },
           "force_destroy": false,
           "labels": {
             "label1": "value1",
@@ -51,13 +66,20 @@
           },
           "name": "spanner-instance",
           "num_nodes": 1,
-          "timeouts": null
+          "terraform_labels": {
+            "label1": "value1",
+            "label2": "value2",
+            "label3": "value3"
+          },
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
+          "effective_labels": {},
           "id": true,
           "labels": {},
-          "project": true,
-          "state": true
+          "state": true,
+          "terraform_labels": {}
         }
       }
     }
diff --git a/mmv1/third_party/tgc/tests/data/full_sql_database_instance.json b/mmv1/third_party/tgc/tests/data/full_sql_database_instance.json
index f1c60d2cff4d..e9bec3fd717f 100644
--- a/mmv1/third_party/tgc/tests/data/full_sql_database_instance.json
+++ b/mmv1/third_party/tgc/tests/data/full_sql_database_instance.json
@@ -114,7 +114,8 @@
       "parent": "//cloudresourcemanager.googleapis.com/projects/{{.Provider.project}}",
       "data": {
         "autoCreateSubnetworks": true,
-        "name": "private-network"
+        "name": "private-network",
+        "networkFirewallPolicyEnforcementOrder": "AFTER_CLASSIC_FIREWALL"
       }
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/full_sql_database_instance.tf b/mmv1/third_party/tgc/tests/data/full_sql_database_instance.tf
index 825120ba1a41..9cd7249ee21e 100644
--- a/mmv1/third_party/tgc/tests/data/full_sql_database_instance.tf
+++ b/mmv1/third_party/tgc/tests/data/full_sql_database_instance.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/full_sql_database_instance.tfplan.json b/mmv1/third_party/tgc/tests/data/full_sql_database_instance.tfplan.json
index 3e5af2e0fa2a..ae55f1df2b49 100644
--- a/mmv1/third_party/tgc/tests/data/full_sql_database_instance.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/full_sql_database_instance.tfplan.json
@@ -166,14 +166,14 @@
           "name": "private-ip-address",
           "prefix_length": 16,
           "purpose": "VPC_PEERING",
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "address": true,
           "creation_timestamp": true,
           "id": true,
           "network": true,
-          "project": true,
           "self_link": true
         }
       }
@@ -194,13 +194,14 @@
           "delete_default_routes_on_create": false,
           "description": null,
           "name": "private-network",
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}",
+          "network_firewall_policy_enforcement_order": "AFTER_CLASSIC_FIREWALL"
         },
         "after_unknown": {
           "gateway_ipv4": true,
           "id": true,
           "ipv4_range": true,
-          "project": true,
           "routing_mode": true,
           "self_link": true
         }
@@ -328,7 +329,8 @@
               }
             }
           ],
-          "timeouts": null
+          "timeouts": null,
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "connection_name": true,
@@ -336,7 +338,6 @@
           "id": true,
           "ip_address": true,
           "private_ip_address": true,
-          "project": true,
           "public_ip_address": true,
           "replica_configuration": [
             {}
diff --git a/mmv1/third_party/tgc/tests/data/full_storage_bucket.tf b/mmv1/third_party/tgc/tests/data/full_storage_bucket.tf
index 7300ce817942..99c2ed742ac8 100644
--- a/mmv1/third_party/tgc/tests/data/full_storage_bucket.tf
+++ b/mmv1/third_party/tgc/tests/data/full_storage_bucket.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/full_storage_bucket.tfplan.json b/mmv1/third_party/tgc/tests/data/full_storage_bucket.tfplan.json
index c7c25528048a..c994947de73d 100644
--- a/mmv1/third_party/tgc/tests/data/full_storage_bucket.tfplan.json
+++ b/mmv1/third_party/tgc/tests/data/full_storage_bucket.tfplan.json
@@ -257,7 +257,8 @@
               "main_page_suffix": "index.html",
               "not_found_page": "404.html"
             }
-          ]
+          ],
+          "project": "{{.Provider.project}}"
         },
         "after_unknown": {
           "cors": [
@@ -326,7 +327,6 @@
           "logging": [
             {}
           ],
-          "project": true,
           "retention_policy": [
             {}
           ],
diff --git a/mmv1/third_party/tgc/tests/data/instance.tf b/mmv1/third_party/tgc/tests/data/instance.tf
index a677a5dcc584..924c97c1af71 100644
--- a/mmv1/third_party/tgc/tests/data/instance.tf
+++ b/mmv1/third_party/tgc/tests/data/instance.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/instance.tfplan.json b/mmv1/third_party/tgc/tests/data/instance.tfplan.json
new file mode 100644
index 000000000000..6d954bca050b
--- /dev/null
+++ b/mmv1/third_party/tgc/tests/data/instance.tfplan.json
@@ -0,0 +1,415 @@
+{
+  "format_version": "1.1",
+  "terraform_version": "1.3.2",
+  "planned_values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_compute_instance.my-test-instance",
+          "mode": "managed",
+          "type": "google_compute_instance",
+          "name": "my-test-instance",
+          "provider_name": "registry.terraform.io/hashicorp/google",
+          "schema_version": 6,
+          "values": {
+            "advanced_machine_features": [],
+            "allow_stopping_for_update": null,
+            "attached_disk": [],
+            "boot_disk": [
+              {
+                "auto_delete": true,
+                "disk_encryption_key_raw": null,
+                "initialize_params": [
+                  {
+                    "image": "projects/debian-cloud/global/images/debian-8-jessie-v20170523",
+                    "resource_manager_tags": null
+                  }
+                ],
+                "mode": "READ_WRITE"
+              }
+            ],
+            "can_ip_forward": false,
+            "deletion_protection": false,
+            "description": null,
+            "desired_status": null,
+            "enable_display": null,
+            "hostname": null,
+            "labels": null,
+            "machine_type": "n1-standard-1",
+            "metadata": null,
+            "metadata_startup_script": "echo hi \u003e /test.txt",
+            "name": "my-instance",
+            "network_interface": [
+              {
+                "access_config": [
+                  {
+                    "public_ptr_domain_name": null
+                  }
+                ],
+                "alias_ip_range": [],
+                "ipv6_access_config": [],
+                "network": "default",
+                "nic_type": null,
+                "queue_count": null
+              }
+            ],
+            "network_performance_config": [],
+            "params": [],
+            "project": "{{.Provider.project}}",
+            "resource_policies": null,
+            "scratch_disk": [
+              {
+                "interface": "SCSI",
+                "size": 375
+              }
+            ],
+            "service_account": [
+              {
+                "scopes": [
+                  "https://www.googleapis.com/auth/cloud-platform"
+                ]
+              }
+            ],
+            "shielded_instance_config": [],
+            "tags": [
+              "bar",
+              "foo"
+            ],
+            "timeouts": null,
+            "zone": "us-central1-a"
+          },
+          "sensitive_values": {
+            "advanced_machine_features": [],
+            "attached_disk": [],
+            "boot_disk": [
+              {
+                "initialize_params": [
+                  {
+                    "labels": {}
+                  }
+                ]
+              }
+            ],
+            "confidential_instance_config": [],
+            "effective_labels": {},
+            "guest_accelerator": [],
+            "network_interface": [
+              {
+                "access_config": [
+                  {}
+                ],
+                "alias_ip_range": [],
+                "ipv6_access_config": []
+              }
+            ],
+            "network_performance_config": [],
+            "params": [],
+            "reservation_affinity": [],
+            "scheduling": [],
+            "scratch_disk": [
+              {}
+            ],
+            "service_account": [
+              {
+                "scopes": [
+                  false
+                ]
+              }
+            ],
+            "shielded_instance_config": [],
+            "tags": [
+              false,
+              false
+            ],
+            "terraform_labels": {}
+          }
+        }
+      ]
+    }
+  },
+  "resource_changes": [
+    {
+      "address": "google_compute_instance.my-test-instance",
+      "mode": "managed",
+      "type": "google_compute_instance",
+      "name": "my-test-instance",
+      "provider_name": "registry.terraform.io/hashicorp/google",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "advanced_machine_features": [],
+          "allow_stopping_for_update": null,
+          "attached_disk": [],
+          "boot_disk": [
+            {
+              "auto_delete": true,
+              "disk_encryption_key_raw": null,
+              "initialize_params": [
+                {
+                  "image": "projects/debian-cloud/global/images/debian-8-jessie-v20170523",
+                  "resource_manager_tags": null
+                }
+              ],
+              "mode": "READ_WRITE"
+            }
+          ],
+          "can_ip_forward": false,
+          "deletion_protection": false,
+          "description": null,
+          "desired_status": null,
+          "enable_display": null,
+          "hostname": null,
+          "labels": null,
+          "machine_type": "n1-standard-1",
+          "metadata": null,
+          "metadata_startup_script": "echo hi \u003e /test.txt",
+          "name": "my-instance",
+          "network_interface": [
+            {
+              "access_config": [
+                {
+                  "public_ptr_domain_name": null
+                }
+              ],
+              "alias_ip_range": [],
+              "ipv6_access_config": [],
+              "network": "default",
+              "nic_type": null,
+              "queue_count": null
+            }
+          ],
+          "network_performance_config": [],
+          "params": [],
+          "project": "{{.Provider.project}}",
+          "resource_policies": null,
+          "scratch_disk": [
+            {
+              "interface": "SCSI",
+              "size": 375
+            }
+          ],
+          "service_account": [
+            {
+              "scopes": [
+                "https://www.googleapis.com/auth/cloud-platform"
+              ]
+            }
+          ],
+          "shielded_instance_config": [],
+          "tags": [
+            "bar",
+            "foo"
+          ],
+          "timeouts": null,
+          "zone": "us-central1-a"
+        },
+        "after_unknown": {
+          "advanced_machine_features": [],
+          "attached_disk": [],
+          "boot_disk": [
+            {
+              "device_name": true,
+              "disk_encryption_key_sha256": true,
+              "initialize_params": [
+                {
+                  "labels": true,
+                  "size": true,
+                  "type": true
+                }
+              ],
+              "kms_key_self_link": true,
+              "source": true
+            }
+          ],
+          "confidential_instance_config": true,
+          "cpu_platform": true,
+          "current_status": true,
+          "effective_labels": true,
+          "guest_accelerator": true,
+          "id": true,
+          "instance_id": true,
+          "label_fingerprint": true,
+          "metadata_fingerprint": true,
+          "min_cpu_platform": true,
+          "network_interface": [
+            {
+              "access_config": [
+                {
+                  "nat_ip": true,
+                  "network_tier": true
+                }
+              ],
+              "alias_ip_range": [],
+              "internal_ipv6_prefix_length": true,
+              "ipv6_access_config": [],
+              "ipv6_access_type": true,
+              "ipv6_address": true,
+              "name": true,
+              "network_ip": true,
+              "stack_type": true,
+              "subnetwork": true,
+              "subnetwork_project": true
+            }
+          ],
+          "network_performance_config": [],
+          "params": [],
+          "reservation_affinity": true,
+          "scheduling": true,
+          "scratch_disk": [
+            {}
+          ],
+          "self_link": true,
+          "service_account": [
+            {
+              "email": true,
+              "scopes": [
+                false
+              ]
+            }
+          ],
+          "shielded_instance_config": [],
+          "tags": [
+            false,
+            false
+          ],
+          "tags_fingerprint": true,
+          "terraform_labels": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "advanced_machine_features": [],
+          "attached_disk": [],
+          "boot_disk": [
+            {
+              "disk_encryption_key_raw": true,
+              "initialize_params": [
+                {
+                  "labels": {}
+                }
+              ]
+            }
+          ],
+          "confidential_instance_config": [],
+          "effective_labels": {},
+          "guest_accelerator": [],
+          "network_interface": [
+            {
+              "access_config": [
+                {}
+              ],
+              "alias_ip_range": [],
+              "ipv6_access_config": []
+            }
+          ],
+          "network_performance_config": [],
+          "params": [],
+          "reservation_affinity": [],
+          "scheduling": [],
+          "scratch_disk": [
+            {}
+          ],
+          "service_account": [
+            {
+              "scopes": [
+                false
+              ]
+            }
+          ],
+          "shielded_instance_config": [],
+          "tags": [
+            false,
+            false
+          ],
+          "terraform_labels": {}
+        }
+      }
+    }
+  ],
+  "configuration": {
+    "provider_config": {
+      "google": {
+        "name": "google",
+        "expressions": {
+          "project": {
+            "constant_value": "{{.Provider.project}}"
+          }
+        }
+      }
+    },
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_compute_instance.my-test-instance",
+          "mode": "managed",
+          "type": "google_compute_instance",
+          "name": "my-test-instance",
+          "provider_config_key": "google",
+          "expressions": {
+            "boot_disk": [
+              {
+                "initialize_params": [
+                  {
+                    "image": {
+                      "constant_value": "projects/debian-cloud/global/images/debian-8-jessie-v20170523"
+                    }
+                  }
+                ]
+              }
+            ],
+            "machine_type": {
+              "constant_value": "n1-standard-1"
+            },
+            "metadata_startup_script": {
+              "constant_value": "echo hi \u003e /test.txt"
+            },
+            "name": {
+              "constant_value": "my-instance"
+            },
+            "network_interface": [
+              {
+                "access_config": [
+                  {}
+                ],
+                "network": {
+                  "constant_value": "default"
+                }
+              }
+            ],
+            "project": {
+              "constant_value": "{{.Provider.project}}"
+            },
+            "scratch_disk": [
+              {
+                "interface": {
+                  "constant_value": "SCSI"
+                }
+              }
+            ],
+            "service_account": [
+              {
+                "scopes": {
+                  "constant_value": [
+                    "cloud-platform"
+                  ]
+                }
+              }
+            ],
+            "tags": {
+              "constant_value": [
+                "foo",
+                "bar"
+              ]
+            },
+            "zone": {
+              "constant_value": "us-central1-a"
+            }
+          },
+          "schema_version": 6
+        }
+      ]
+    }
+  }
+}
diff --git a/mmv1/third_party/tgc/tests/data/sql.tf b/mmv1/third_party/tgc/tests/data/sql.tf
index 0a7208b67f1f..e861a60e94a3 100644
--- a/mmv1/third_party/tgc/tests/data/sql.tf
+++ b/mmv1/third_party/tgc/tests/data/sql.tf
@@ -17,7 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source = "hashicorp/google"
+      source = "hashicorp/google-beta"
       version = "~> {{.Provider.version}}"
     }
   }
diff --git a/mmv1/third_party/tgc/tests/data/sql.tfplan.json b/mmv1/third_party/tgc/tests/data/sql.tfplan.json
new file mode 100644
index 000000000000..116c0194f21d
--- /dev/null
+++ b/mmv1/third_party/tgc/tests/data/sql.tfplan.json
@@ -0,0 +1,238 @@
+{
+  "format_version": "1.1",
+  "terraform_version": "1.3.2",
+  "planned_values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_sql_database_instance.my-test-sql",
+          "mode": "managed",
+          "type": "google_sql_database_instance",
+          "name": "my-test-sql",
+          "provider_name": "registry.terraform.io/hashicorp/google",
+          "schema_version": 0,
+          "values": {
+            "clone": [],
+            "database_version": "POSTGRES_9_6",
+            "deletion_protection": true,
+            "name": "main-instance",
+            "project": "{{.Provider.project}}",
+            "region": "us-central1",
+            "restore_backup_context": [],
+            "root_password": null,
+            "settings": [
+              {
+                "activation_policy": "ALWAYS",
+                "active_directory_config": [],
+                "advanced_machine_features": [],
+                "availability_type": "ZONAL",
+                "collation": null,
+                "data_cache_config": [],
+                "database_flags": [],
+                "deletion_protection_enabled": null,
+                "deny_maintenance_period": [],
+                "disk_autoresize": true,
+                "disk_autoresize_limit": 0,
+                "disk_type": "PD_SSD",
+                "edition": null,
+                "insights_config": [],
+                "maintenance_window": [],
+                "password_validation_policy": [],
+                "pricing_plan": "PER_USE",
+                "sql_server_audit_config": [],
+                "tier": "db-f1-micro",
+                "time_zone": null
+              }
+            ],
+            "timeouts": null
+          },
+          "sensitive_values": {
+            "available_maintenance_versions": [],
+            "clone": [],
+            "ip_address": [],
+            "replica_configuration": [],
+            "restore_backup_context": [],
+            "server_ca_cert": [],
+            "settings": [
+              {
+                "active_directory_config": [],
+                "advanced_machine_features": [],
+                "backup_configuration": [],
+                "data_cache_config": [],
+                "database_flags": [],
+                "deny_maintenance_period": [],
+                "insights_config": [],
+                "ip_configuration": [],
+                "location_preference": [],
+                "maintenance_window": [],
+                "password_validation_policy": [],
+                "sql_server_audit_config": [],
+                "user_labels": {}
+              }
+            ]
+          }
+        }
+      ]
+    }
+  },
+  "resource_changes": [
+    {
+      "address": "google_sql_database_instance.my-test-sql",
+      "mode": "managed",
+      "type": "google_sql_database_instance",
+      "name": "my-test-sql",
+      "provider_name": "registry.terraform.io/hashicorp/google",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "clone": [],
+          "database_version": "POSTGRES_9_6",
+          "deletion_protection": true,
+          "name": "main-instance",
+          "project": "{{.Provider.project}}",
+          "region": "us-central1",
+          "restore_backup_context": [],
+          "root_password": null,
+          "settings": [
+            {
+              "activation_policy": "ALWAYS",
+              "active_directory_config": [],
+              "advanced_machine_features": [],
+              "availability_type": "ZONAL",
+              "collation": null,
+              "data_cache_config": [],
+              "database_flags": [],
+              "deletion_protection_enabled": null,
+              "deny_maintenance_period": [],
+              "disk_autoresize": true,
+              "disk_autoresize_limit": 0,
+              "disk_type": "PD_SSD",
+              "edition": null,
+              "insights_config": [],
+              "maintenance_window": [],
+              "password_validation_policy": [],
+              "pricing_plan": "PER_USE",
+              "sql_server_audit_config": [],
+              "tier": "db-f1-micro",
+              "time_zone": null
+            }
+          ],
+          "timeouts": null
+        },
+        "after_unknown": {
+          "available_maintenance_versions": true,
+          "clone": [],
+          "connection_name": true,
+          "dns_name": true,
+          "encryption_key_name": true,
+          "first_ip_address": true,
+          "id": true,
+          "instance_type": true,
+          "ip_address": true,
+          "maintenance_version": true,
+          "master_instance_name": true,
+          "private_ip_address": true,
+          "psc_service_attachment_link": true,
+          "public_ip_address": true,
+          "replica_configuration": true,
+          "restore_backup_context": [],
+          "self_link": true,
+          "server_ca_cert": true,
+          "service_account_email_address": true,
+          "settings": [
+            {
+              "active_directory_config": [],
+              "advanced_machine_features": [],
+              "backup_configuration": true,
+              "connector_enforcement": true,
+              "data_cache_config": [],
+              "database_flags": [],
+              "deny_maintenance_period": [],
+              "disk_size": true,
+              "insights_config": [],
+              "ip_configuration": true,
+              "location_preference": true,
+              "maintenance_window": [],
+              "password_validation_policy": [],
+              "sql_server_audit_config": [],
+              "user_labels": true,
+              "version": true
+            }
+          ]
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "available_maintenance_versions": [],
+          "clone": [],
+          "ip_address": [],
+          "replica_configuration": [],
+          "restore_backup_context": [],
+          "root_password": true,
+          "server_ca_cert": [],
+          "settings": [
+            {
+              "active_directory_config": [],
+              "advanced_machine_features": [],
+              "backup_configuration": [],
+              "data_cache_config": [],
+              "database_flags": [],
+              "deny_maintenance_period": [],
+              "insights_config": [],
+              "ip_configuration": [],
+              "location_preference": [],
+              "maintenance_window": [],
+              "password_validation_policy": [],
+              "sql_server_audit_config": [],
+              "user_labels": {}
+            }
+          ]
+        }
+      }
+    }
+  ],
+  "configuration": {
+    "provider_config": {
+      "google": {
+        "name": "google",
+        "expressions": {
+          "project": {
+            "constant_value": "{{.Provider.project}}"
+          }
+        }
+      }
+    },
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_sql_database_instance.my-test-sql",
+          "mode": "managed",
+          "type": "google_sql_database_instance",
+          "name": "my-test-sql",
+          "provider_config_key": "google",
+          "expressions": {
+            "database_version": {
+              "constant_value": "POSTGRES_9_6"
+            },
+            "name": {
+              "constant_value": "main-instance"
+            },
+            "region": {
+              "constant_value": "us-central1"
+            },
+            "settings": [
+              {
+                "tier": {
+                  "constant_value": "db-f1-micro"
+                }
+              }
+            ]
+          },
+          "schema_version": 0
+        }
+      ]
+    }
+  }
+}
diff --git a/mmv1/third_party/tgc/tests/source/cli_test.go.erb b/mmv1/third_party/tgc/tests/source/cli_test.go.erb
index 915e6a68ef8c..93102524c98a 100644
--- a/mmv1/third_party/tgc/tests/source/cli_test.go.erb
+++ b/mmv1/third_party/tgc/tests/source/cli_test.go.erb
@@ -43,46 +43,10 @@ func TestCLI(t *testing.T) {
 		name                 string
 		compareConvertOutput compareConvertOutputFunc
 	}{
-		// cli-only, the following tests are not in read_test or
-		// have unique parameters that separate them
-		{name: "bucket"},
-		{name: "disk"},
-		{name: "firewall"},
-		{name: "instance"},
-		{name: "sql"},
-		{name: "example_compute_forwarding_rule"},
-		{name: "example_compute_instance"},
-		{name: "example_project_create_empty_project_id"},
-		{name: "example_project_iam_member_empty_project"},
-		{name: "example_storage_bucket"},
-		{name: "example_folder_iam_binding", compareConvertOutput: compareMergedIamBindingOutput},
-		{name: "example_folder_iam_member", compareConvertOutput: compareMergedIamMemberOutput},
-		{name: "example_project_create"},
-		{name: "example_project_update"},
 		{name: "example_project_iam_binding", compareConvertOutput: compareMergedIamBindingOutput},
 		{name: "example_project_iam_member", compareConvertOutput: compareMergedIamMemberOutput},
-		{name: "example_storage_bucket_iam_binding", compareConvertOutput: compareMergedIamBindingOutput},
-		{name: "example_storage_bucket_iam_member", compareConvertOutput: compareMergedIamMemberOutput},
-		// auto inserted tests that are not in list above or manually inserted in read_test.go
-	<% @non_defined_tests.each do |test| -%>
-		{name: "<%= test -%>"},
-	<% end -%>
 	}
 
-	// Map of cases to skip to reasons for the skip
-	skipCases := map[string]string{
-		"TestCLI/v=0.12/tf=example_compute_forwarding_rule/offline=true/cmd=convert":                              "temporarily skip because of the predictable drift in offline mode",
-		"TestCLI/v=0.12/tf=example_compute_forwarding_rule/offline=true/cmd=validate/constraint=always_violate":   "temporarily skip because of the predictable drift in offline mode",
-		"TestCLI/v=0.12/tf=example_compute_instance/offline=true/cmd=convert":                                     "compute_instance doesn't work in offline mode - github.com/hashicorp/terraform-provider-google/issues/8489",
-		"TestCLI/v=0.12/tf=example_compute_instance/offline=true/cmd=validate/constraint=always_violate":          "compute_instance doesn't work in offline mode - github.com/hashicorp/terraform-provider-google/issues/8489",
-		"TestCLI/v=0.12/tf=example_organization_iam_binding/offline=false/cmd=convert":                            "skip because test runner doesn't have org permissions",
-		"TestCLI/v=0.12/tf=example_organization_iam_binding/offline=false/cmd=validate/constraint=always_violate": "skip because test runner doesn't have org permissions",
-		"TestCLI/v=0.12/tf=example_organization_iam_member/offline=false/cmd=convert":                             "skip because test runner doesn't have org permissions",
-		"TestCLI/v=0.12/tf=example_organization_iam_member/offline=false/cmd=validate/constraint=always_violate":  "skip because test runner doesn't have org permissions",
-		"TestCLI/v=0.12/tf=example_project_iam/offline=false/cmd=convert":                                         "example_project_iam is too complex to untangle merges with online data generically",
-		"TestCLI/v=0.12/tf=example_storage_bucket_iam_member_random_suffix/offline=false":                         "test produces inconsistent results based on randomized names - github.com/GoogleCloudPlatform/terraform-validator/issues/259",
-		"TestCLI/v=0.12/tf=example_storage_bucket_iam_member_random_suffix/offline=false/cmd=convert":             "test produces inconsistent results based on randomized names - github.com/GoogleCloudPlatform/terraform-validator/issues/259",
-	}
 	for i := range cases {
 		// Allocate a variable to make sure test can run in parallel.
 		c := cases[i]
@@ -127,9 +91,6 @@ func TestCLI(t *testing.T) {
 				terraformWorkflow(t, dir, c.name)
 
 				t.Run("cmd=convert", func(t *testing.T) {
-					if reason, exists := skipCases[t.Name()]; exists {
-						t.Skip(reason)
-					}
 					testConvertCommand(t, dir, c.name, c.name, offline, true, c.compareConvertOutput)
 				})
 			})
@@ -137,78 +98,6 @@ func TestCLI(t *testing.T) {
 	}
 }
 
-
-// TestCLIWithoutProject tests the "convert" and "validate" subcommand
-// against a generated .tfplan file, and it does not have --project option.
-func TestCLIWithoutProject(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping integration test in short mode.")
-		return
-	}
-
-	// Test cases for each type of resource is defined here.
-	cases := []struct {
-		name                 string
-		compareConvertOutput compareConvertOutputFunc
-	}{
-		{name: "example_project_create_empty_project_id"},
-		{name: "example_storage_bucket"},
-		{name: "example_project_iam_member_empty_project"},
-	}
-
-	for i := range cases {
-		// Allocate a variable to make sure test can run in parallel.
-		c := cases[i]
-
-		// Add default convert comparison func if not set
-		if c.compareConvertOutput == nil {
-			c.compareConvertOutput = compareUnmergedConvertOutput
-		}
-
-		// Test both offline and online mode.
-		for _, offline := range []bool{true, false} {
-			offline := offline
-			t.Run(fmt.Sprintf("v=0.12/tf=%s/offline=%t", c.name, offline), func(t *testing.T) {
-				t.Parallel()
-				// Create a temporary directory for running terraform.
-				dir, err := os.MkdirTemp(tmpDir, "terraform")
-				if err != nil {
-					log.Fatal(err)
-				}
-				defer os.RemoveAll(dir)
-
-				// Generate the <name>.tf and <name>_assets.json files into the temporary directory.
-				generateTestFiles(t, "../testdata/templates", dir, c.name+".tf")
-				generateTestFiles(t, "../testdata/templates", dir, c.name+"_without_default_project.json")
-
-				// Uses glob matching to match generateTestFiles internals.
-				tfstateMatches, err := filepath.Glob(filepath.Join("../testdata/templates", c.name+".tfstate"))
-				if err != nil {
-					t.Fatalf("malformed glob: %v", err)
-				}
-				if tfstateMatches != nil {
-					generateTestFiles(t, "../testdata/templates", dir, c.name+".tfstate")
-					err = os.Rename(
-						filepath.Join(dir, c.name+".tfstate"),
-						filepath.Join(dir, "terraform.tfstate"),
-					)
-					if err != nil {
-						t.Fatalf("renaming tfstate: %v", err)
-					}
-				}
-
-				terraformWorkflow(t, dir, c.name)
-
-				t.Run("cmd=convert", func(t *testing.T) {
-					testConvertCommand(t, dir, c.name, c.name+"_without_default_project", offline, false, c.compareConvertOutput)
-				})
-
-			})
-		}
-	}
-}
-
-
 type compareConvertOutputFunc func(t *testing.T, expected []caiasset.Asset, actual []caiasset.Asset, offline bool)
 
 func compareUnmergedConvertOutput(t *testing.T, expected []caiasset.Asset, actual []caiasset.Asset, offline bool) {
diff --git a/mmv1/third_party/tgc/tests/source/environment_test.go b/mmv1/third_party/tgc/tests/source/environment_test.go
index 20e46817c327..4df056f0c5d0 100644
--- a/mmv1/third_party/tgc/tests/source/environment_test.go
+++ b/mmv1/third_party/tgc/tests/source/environment_test.go
@@ -19,7 +19,7 @@ const (
 	defaultOrganizationDomain = "meep.test.com"
 	defaultOrganizationTarget = "13579"
 	defaultProject            = "foobar"
-	defaultProviderVersion    = "4.28.0"
+	defaultProviderVersion    = "5.0.0"
 	defaultRegion             = "us-central1"
 	defaultServiceAccount     = "meep@foobar.iam.gserviceaccount.com"
 )
diff --git a/mmv1/third_party/tgc/tests/source/read_test.go.erb b/mmv1/third_party/tgc/tests/source/read_test.go.erb
index b8e028af7a0f..ce71979c6099 100644
--- a/mmv1/third_party/tgc/tests/source/read_test.go.erb
+++ b/mmv1/third_party/tgc/tests/source/read_test.go.erb
@@ -27,6 +27,7 @@ func TestReadPlannedAssetsCoverage(t *testing.T) {
 		{name: "example_project_iam_binding"},
 		{name: "example_project_iam_member"},
 		{name: "example_storage_bucket"},
+		{name: "example_storage_bucket_empty_project_id"},
 		{name: "example_storage_bucket_iam_binding"},
 		{name: "example_storage_bucket_iam_member"},
 		{name: "example_project_create_empty_project_id"},
@@ -97,7 +98,7 @@ func TestReadPlannedAssetsCoverage_WithoutDefaultProject(t *testing.T) {
 		name string
 	}{
 		{name: "example_project_create_empty_project_id"},
-		{name: "example_storage_bucket"},
+		{name: "example_storage_bucket_empty_project_id"},
 		{name: "example_project_iam_member_empty_project"},
 	}
 	for i := range cases {
diff --git a/mmv1/third_party/tgc/tests/source/utils_test.go b/mmv1/third_party/tgc/tests/source/utils_test.go
index ffb6904cec37..f73af88bb4e0 100644
--- a/mmv1/third_party/tgc/tests/source/utils_test.go
+++ b/mmv1/third_party/tgc/tests/source/utils_test.go
@@ -69,7 +69,15 @@ func terraformShow(t *testing.T, executable, dir, tfplan string) []byte {
 
 func terraformExec(t *testing.T, executable, dir string, args ...string) []byte {
 	cmd := exec.Command(executable, args...)
-	cmd.Env = []string{"HOME=" + filepath.Join(dir, "fakehome")}
+	cmd.Env = []string{
+		"HOME=" + filepath.Join(dir, "fakehome"),
+		"GOOGLE_PROJECT=" + data.Provider["project"],
+		"GOOGLE_FOLDER=" + data.FolderID,
+		"GOOGLE_ORG=" + data.OrgID,
+	}
+	if os.Getenv("TF_CLI_CONFIG_FILE") != "" {
+		cmd.Env = append(cmd.Env, "TF_CLI_CONFIG_FILE="+os.Getenv("TF_CLI_CONFIG_FILE"))
+	}
 	cmd.Dir = dir
 	wantError := false
 	payload, _ := run(t, cmd, wantError)
@@ -179,28 +187,6 @@ func generateTFVconvertedAsset(t *testing.T, testDir, testSlug string) {
 	fmt.Println("created file : " + dstFile)
 }
 
-func getTestPrefix() string {
-	credentials, ok := data.Provider["credentials"]
-	if ok {
-		credentials = "credentials = \"" + credentials + "\""
-	}
-
-	return fmt.Sprintf(`terraform {
-		required_providers {
-			google = {
-				source  = "hashicorp/google"
-				version = "~> %s"
-			}
-		}
-	}
-
-	provider "google" {
-		%s
-	}
-
-`, data.Provider["version"], credentials)
-}
-
 // newTestConfig create a config using the http test server.
 func newTestConfig(server *httptest.Server) *transport_tpg.Config {
 	cfg := &transport_tpg.Config{}
diff --git a/tools/diff-processor/README.md b/tools/diff-processor/README.md
index 09f7676be083..7cd410dd854a 100644
--- a/tools/diff-processor/README.md
+++ b/tools/diff-processor/README.md
@@ -11,8 +11,12 @@ make clone OWNER_REPO=modular-magician/terraform-provider-google
 # build based on old / new dirs
 make build OLD_REF=branch_or_commit NEW_REF=branch_or_commit
 
-# Run the binary
-bin/diff-processor
+# Run breaking change detection on the difference between OLD_REF and NEW_REF
+bin/diff-processor breaking-changes
+
+# Add labels to a PR based on the resources changed between OLD_REF and NEW_REF
+# The token used must have write access to issues
+GITHUB_TOKEN=github_token bin/diff-processor add-labels PR_ID [--dry-run]
 ```
 
 ## Test
diff --git a/tools/diff-processor/cmd/add_labels.go b/tools/diff-processor/cmd/add_labels.go
new file mode 100644
index 000000000000..9fa068a29594
--- /dev/null
+++ b/tools/diff-processor/cmd/add_labels.go
@@ -0,0 +1,103 @@
+package cmd
+
+import (
+	newProvider "google/provider/new/google/provider"
+	oldProvider "google/provider/old/google/provider"
+
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/GoogleCloudPlatform/magic-modules/tools/diff-processor/diff"
+	"github.com/GoogleCloudPlatform/magic-modules/tools/diff-processor/labels"
+	"github.com/GoogleCloudPlatform/magic-modules/tools/issue-labeler/labeler"
+	"github.com/spf13/cobra"
+	"golang.org/x/exp/maps"
+)
+
+const addLabelsDesc = `Add labels to a PR based on changed resources.`
+
+type addLabelsOptions struct {
+	rootOptions       *rootOptions
+	computeSchemaDiff func() diff.SchemaDiff
+	enrolledTeamsYaml []byte
+	getIssue          func(repository string, id uint64) (labeler.Issue, error)
+	updateIssues      func(repository string, issueUpdates []labeler.IssueUpdate, dryRun bool)
+	dryRun            bool
+}
+
+func newAddLabelsCmd(rootOptions *rootOptions) *cobra.Command {
+	o := &addLabelsOptions{
+		rootOptions: rootOptions,
+		computeSchemaDiff: func() diff.SchemaDiff {
+			return diff.ComputeSchemaDiff(oldProvider.ResourceMap(), newProvider.ResourceMap())
+		},
+		enrolledTeamsYaml: labeler.EnrolledTeamsYaml,
+		getIssue:          labels.GetIssue,
+		updateIssues:      labeler.UpdateIssues,
+	}
+	cmd := &cobra.Command{
+		Use:   "add-labels PR_ID [--dry-run]",
+		Short: addLabelsDesc,
+		Long:  addLabelsDesc,
+		Args: cobra.ExactArgs(1),
+		RunE: func(c *cobra.Command, args []string) error {
+			return o.run(args)
+		},
+	}
+	cmd.Flags().BoolVar(&o.dryRun, "dry-run", false, "Do a dry run without updating labels")
+	return cmd
+}
+func (o *addLabelsOptions) run(args []string) error {
+	prId, err := strconv.ParseUint(args[0], 10, 0)
+	if err != nil {
+		return fmt.Errorf("PR_ID must be an unsigned integer: %w", err)
+	}
+
+	repository := "GoogleCloudPlatform/magic-modules"
+	issue, err := o.getIssue(repository, prId)
+
+	if err != nil {
+		return fmt.Errorf("Error retrieving PR data: %w", err)
+	}
+
+	hasServiceLabels := false
+	oldLabels := make(map[string]struct{}, len(issue.Labels))
+	for _, label := range issue.Labels {
+		oldLabels[label.Name] = struct{}{}
+		if strings.HasPrefix(label.Name, "services/") {
+			hasServiceLabels = true
+		}
+	}
+	if hasServiceLabels {
+		return nil
+	}
+
+	schemaDiff := o.computeSchemaDiff()
+	affectedResources := maps.Keys(schemaDiff)
+	regexpLabels, err := labeler.BuildRegexLabels(o.enrolledTeamsYaml)
+	if err != nil {
+		return fmt.Errorf("Error building regex labels: %w", err)
+	}
+
+	newLabels := make(map[string]struct{}, len(oldLabels))
+	for label, _ := range oldLabels {
+		newLabels[label] = struct{}{}
+	}
+	for _, label := range labeler.ComputeLabels(affectedResources, regexpLabels) {
+		newLabels[label] = struct{}{}
+	}
+
+	// Only update the issue if new labels should be added
+	if len(newLabels) != len(oldLabels) {
+		issueUpdate := labeler.IssueUpdate{
+			Number:    prId,
+			Labels:    maps.Keys(newLabels),
+			OldLabels: maps.Keys(oldLabels),
+		}
+
+		o.updateIssues(repository, []labeler.IssueUpdate{issueUpdate}, o.dryRun)
+	}
+
+	return nil
+}
diff --git a/tools/diff-processor/cmd/add_labels_test.go b/tools/diff-processor/cmd/add_labels_test.go
new file mode 100644
index 000000000000..62906187dd27
--- /dev/null
+++ b/tools/diff-processor/cmd/add_labels_test.go
@@ -0,0 +1,294 @@
+package cmd
+
+import (
+	_ "embed"
+	"errors"
+	"github.com/GoogleCloudPlatform/magic-modules/tools/diff-processor/diff"
+	"github.com/GoogleCloudPlatform/magic-modules/tools/issue-labeler/labeler"
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"testing"
+)
+
+var enrolledTeamsYaml = []byte(`
+services/google-x:
+  resources:
+  - google_x_resource`)
+
+func TestAddLabelsCmdRun(t *testing.T) {
+	cases := map[string]struct {
+		args           []string
+		oldResourceMap map[string]*schema.Resource
+		newResourceMap map[string]*schema.Resource
+		githubIssue    *labeler.Issue
+		updateErrors   bool
+		expectedLabels []string
+		expectError    bool
+	}{
+		"empty resource map": {
+			args: []string{"12345"},
+			oldResourceMap: map[string]*schema.Resource{},
+			newResourceMap: map[string]*schema.Resource{},
+			githubIssue: &labeler.Issue{
+				Number:      12345,
+				Body:        "Unused",
+				Labels:      []labeler.Label{},
+				PullRequest: map[string]any{},
+			},
+			expectedLabels: nil,
+		},
+		"resource changed that doesn't match mapping": {
+			args: []string{"12345"},
+			oldResourceMap: map[string]*schema.Resource{
+				"google_y_resource": {
+					Schema: map[string]*schema.Schema{
+						"field_a": {Description: "beep", Optional: true},
+						"field_b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google_y_resource": {
+					Schema: map[string]*schema.Schema{
+						"field_a": {Description: "beep", Required: true},
+					},
+				},
+			},
+			githubIssue: &labeler.Issue{
+				Number:      12345,
+				Body:        "Unused",
+				Labels:      []labeler.Label{},
+				PullRequest: map[string]any{},
+			},
+			expectedLabels: nil,
+		},
+		"resource matches mapping but isn't changed": {
+			args: []string{"12345"},
+			oldResourceMap: map[string]*schema.Resource{
+				"google_x_resource": {
+					Schema: map[string]*schema.Schema{
+						"field_a": {Description: "beep", Optional: true},
+						"field_b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google_x_resource": {
+					Schema: map[string]*schema.Schema{
+						"field_a": {Description: "beep", Optional: true},
+						"field_b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			githubIssue: &labeler.Issue{
+				Number:      12345,
+				Body:        "Unused",
+				Labels:      []labeler.Label{},
+				PullRequest: map[string]any{},
+			},
+			expectedLabels: nil,
+		},
+		"resource changed that matches mapping": {
+			args: []string{"12345"},
+			oldResourceMap: map[string]*schema.Resource{
+				"google_x_resource": {
+					Schema: map[string]*schema.Schema{
+						"field_a": {Description: "beep", Optional: true},
+						"field_b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google_x_resource": {
+					Schema: map[string]*schema.Schema{
+						"field_a": {Description: "beep", Required: true},
+					},
+				},
+			},
+			githubIssue: &labeler.Issue{
+				Number:      12345,
+				Body:        "Unused",
+				Labels:      []labeler.Label{},
+				PullRequest: map[string]any{},
+			},
+			expectedLabels: []string{"services/google-x"},
+		},
+		"service labels are deduped": {
+			args: []string{"12345"},
+			oldResourceMap: map[string]*schema.Resource{
+				"google_x_resource": {
+					Schema: map[string]*schema.Schema{
+						"field_a": {Description: "beep", Optional: true},
+						"field_b": {Description: "beep", Optional: true},
+					},
+				},
+				"google_x_resource2": {
+					Schema: map[string]*schema.Schema{
+						"field_a": {Description: "beep", Optional: true},
+						"field_b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google_x_resource": {
+					Schema: map[string]*schema.Schema{
+						"field_a": {Description: "beep", Required: true},
+					},
+				},
+				"google_x_resource2": {
+					Schema: map[string]*schema.Schema{
+						"field_a": {Description: "beep", Required: true},
+					},
+				},
+			},
+			githubIssue: &labeler.Issue{
+				Number:      12345,
+				Body:        "Unused",
+				Labels:      []labeler.Label{},
+				PullRequest: map[string]any{},
+			},
+			expectedLabels: []string{"services/google-x"},
+		},
+		"existing labels are preserved": {
+			args: []string{"12345"},
+			oldResourceMap: map[string]*schema.Resource{
+				"google_x_resource": {
+					Schema: map[string]*schema.Schema{
+						"field_a": {Description: "beep", Optional: true},
+						"field_b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google_x_resource": {
+					Schema: map[string]*schema.Schema{
+						"field_a": {Description: "beep", Required: true},
+					},
+				},
+			},
+			githubIssue: &labeler.Issue{
+				Number:      12345,
+				Body:        "Unused",
+				Labels:      []labeler.Label{{Name: "override-breaking-change"}},
+				PullRequest: map[string]any{},
+			},
+			expectedLabels: []string{"override-breaking-change", "services/google-x"},
+		},
+		"existing service label prevents new service labels": {
+			args: []string{"12345"},
+			oldResourceMap: map[string]*schema.Resource{
+				"google_x_resource": {
+					Schema: map[string]*schema.Schema{
+						"field_a": {Description: "beep", Optional: true},
+						"field_b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google_x_resource": {
+					Schema: map[string]*schema.Schema{
+						"field_a": {Description: "beep", Required: true},
+					},
+				},
+			},
+			githubIssue: &labeler.Issue{
+				Number:      12345,
+				Body:        "Unused",
+				Labels:      []labeler.Label{{Name: "services/google-z"}},
+				PullRequest: map[string]any{},
+			},
+			// nil indicates that the issue won't be updated at all (preserving existing labels)
+			expectedLabels: nil,
+		},
+		"error fetching issue": {
+			args: []string{"12345"},
+			oldResourceMap: map[string]*schema.Resource{
+				"google_x_resource": {
+					Schema: map[string]*schema.Schema{
+						"field_a": {Description: "beep", Optional: true},
+						"field_b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google_x_resource": {
+					Schema: map[string]*schema.Schema{
+						"field_a": {Description: "beep", Required: true},
+					},
+				},
+			},
+			githubIssue: nil,
+			expectError: true,
+		},
+		"error parsing PR id": {
+			args: []string{"foobar"},
+			oldResourceMap: map[string]*schema.Resource{
+				"google_x_resource": {
+					Schema: map[string]*schema.Schema{
+						"field_a": {Description: "beep", Optional: true},
+						"field_b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google_x_resource": {
+					Schema: map[string]*schema.Schema{
+						"field_a": {Description: "beep", Required: true},
+					},
+				},
+			},
+			githubIssue: &labeler.Issue{
+				Number:      12345,
+				Body:        "Unused",
+				Labels:      []labeler.Label{{Name: "services/google-z"}},
+				PullRequest: map[string]any{},
+			},
+			expectError: true,
+		},
+	}
+
+	for tn, tc := range cases {
+		tc := tc
+		t.Run(tn, func(t *testing.T) {
+			t.Parallel()
+
+			var gotLabels []string
+			o := addLabelsOptions{
+				computeSchemaDiff: func() diff.SchemaDiff {
+					return diff.ComputeSchemaDiff(tc.oldResourceMap, tc.newResourceMap)
+				},
+				enrolledTeamsYaml: enrolledTeamsYaml,
+				getIssue: func(repository string, id uint64) (labeler.Issue, error) {
+					if tc.githubIssue != nil {
+						return *tc.githubIssue, nil
+					}
+					var issue labeler.Issue
+					return issue, errors.New("Error getting issue")
+				},
+				updateIssues: func(repository string, issueUpdates []labeler.IssueUpdate, dryRun bool) {
+					gotLabels = issueUpdates[0].Labels
+				},
+			}
+
+			err := o.run([]string{"1"})
+			if err != nil {
+				if tc.expectError {
+					return
+				}
+				t.Errorf("Error running command: %s", err)
+			}
+
+			if tc.expectedLabels == nil {
+				if gotLabels != nil {
+					t.Errorf("Expected updateIssues to not run. Got %v as new labels", gotLabels)
+				}
+			}
+
+			less := func(a, b string) bool { return a < b }
+			if (len(tc.expectedLabels) > 0 || len(gotLabels) > 0) && !cmp.Equal(tc.expectedLabels, gotLabels, cmpopts.SortSlices(less)) {
+				t.Errorf("Unexpected final labels. Want %v, got %v", tc.expectedLabels, gotLabels)
+			}
+		})
+	}
+}
diff --git a/tools/diff-processor/cmd/breaking_changes.go b/tools/diff-processor/cmd/breaking_changes.go
index 7d9957234449..9ac78af0c94c 100644
--- a/tools/diff-processor/cmd/breaking_changes.go
+++ b/tools/diff-processor/cmd/breaking_changes.go
@@ -1,18 +1,33 @@
 package cmd
+
 import (
-	"fmt"
+	newProvider "google/provider/new/google/provider"
+	oldProvider "google/provider/old/google/provider"
+
+	"io"
+	"os"
 	"sort"
 
+	"github.com/GoogleCloudPlatform/magic-modules/tools/diff-processor/diff"
+	"github.com/GoogleCloudPlatform/magic-modules/tools/diff-processor/rules"
 	"github.com/spf13/cobra"
-	"github.com/GoogleCloudPlatform/magic-modules/.ci/diff-processor/diff"
 )
+
 const breakingChangesDesc = `Check for breaking changes between the new / old Terraform provider versions.`
+
 type breakingChangesOptions struct {
-	rootOptions           *rootOptions
+	rootOptions       *rootOptions
+	computeSchemaDiff func() diff.SchemaDiff
+	stdout            io.Writer
 }
+
 func newBreakingChangesCmd(rootOptions *rootOptions) *cobra.Command {
 	o := &breakingChangesOptions{
-		rootOptions:           rootOptions,
+		rootOptions: rootOptions,
+		computeSchemaDiff: func() diff.SchemaDiff {
+			return diff.ComputeSchemaDiff(oldProvider.ResourceMap(), newProvider.ResourceMap())
+		},
+		stdout: os.Stdout,
 	}
 	cmd := &cobra.Command{
 		Use:   "breaking-changes",
@@ -25,10 +40,14 @@ func newBreakingChangesCmd(rootOptions *rootOptions) *cobra.Command {
 	return cmd
 }
 func (o *breakingChangesOptions) run() error {
-	breakages := diff.Compare()
-	sort.Strings(breakages)
-	for _, breakage := range breakages {
-		fmt.Println(breakage)
+	schemaDiff := o.computeSchemaDiff()
+	breakingChanges := rules.ComputeBreakingChanges(schemaDiff)
+	sort.Strings(breakingChanges)
+	for _, breakingChange := range breakingChanges {
+		_, err := o.stdout.Write([]byte(breakingChange + "\n"))
+		if err != nil {
+			return err
+		}
 	}
 	return nil
-}
\ No newline at end of file
+}
diff --git a/tools/diff-processor/cmd/breaking_changes_test.go b/tools/diff-processor/cmd/breaking_changes_test.go
new file mode 100644
index 000000000000..735dc593c623
--- /dev/null
+++ b/tools/diff-processor/cmd/breaking_changes_test.go
@@ -0,0 +1,106 @@
+package cmd
+
+import (
+	"bytes"
+	"github.com/GoogleCloudPlatform/magic-modules/tools/diff-processor/diff"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"strings"
+	"testing"
+)
+
+func TestBreakingChangesCmd(t *testing.T) {
+	cases := map[string]struct {
+		oldResourceMap     map[string]*schema.Resource
+		newResourceMap     map[string]*schema.Resource
+		expectedViolations int
+	}{
+		"no breaking changes": {
+			oldResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {Description: "beep", Optional: true},
+						"field-b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {Description: "beep", Optional: true},
+						"field-b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			expectedViolations: 0,
+		},
+		"resource missing": {
+			oldResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {Description: "beep"},
+						"field-b": {Description: "beep"},
+					},
+				},
+			},
+			newResourceMap:     map[string]*schema.Resource{},
+			expectedViolations: 1,
+		},
+		"field missing, resource missing, and optional to required": {
+			oldResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {Description: "beep", Optional: true},
+						"field-b": {Description: "beep", Optional: true},
+					},
+				},
+				"google-y": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {Description: "beep", Required: true},
+					},
+				},
+			},
+			expectedViolations: 3,
+		},
+	}
+
+	for tn, tc := range cases {
+		tc := tc
+		t.Run(tn, func(t *testing.T) {
+			t.Parallel()
+
+			var buf bytes.Buffer
+			o := breakingChangesOptions{
+				computeSchemaDiff: func() diff.SchemaDiff {
+					return diff.ComputeSchemaDiff(tc.oldResourceMap, tc.newResourceMap)
+				},
+				stdout: &buf,
+			}
+
+			err := o.run()
+			if err != nil {
+				t.Errorf("Error running command: %s", err)
+			}
+
+			out := make([]byte, buf.Len())
+			buf.Read(out)
+
+			lines := strings.Split(string(out), "\n")
+			nonemptyLines := []string{}
+			for _, line := range lines {
+				if line != "" {
+					nonemptyLines = append(nonemptyLines, line)
+				}
+			}
+			if len(nonemptyLines) != tc.expectedViolations {
+				t.Errorf("Unexpected number of violations. Want %d, got %d. Output: %s", tc.expectedViolations, len(nonemptyLines), out)
+			}
+		})
+	}
+}
diff --git a/tools/diff-processor/cmd/root.go b/tools/diff-processor/cmd/root.go
index c749e0e31b52..1a3674921745 100644
--- a/tools/diff-processor/cmd/root.go
+++ b/tools/diff-processor/cmd/root.go
@@ -1,10 +1,13 @@
 package cmd
+
 import (
 	"fmt"
-	"os"
 	"github.com/spf13/cobra"
+	"os"
 )
+
 const rootCmdDesc = "Utilities for interacting with diffs between Terraform schema versions."
+
 type rootOptions struct {
 }
 
@@ -18,8 +21,10 @@ func newRootCmd() (*cobra.Command, *rootOptions, error) {
 		SilenceErrors: true,
 	}
 	cmd.AddCommand(newBreakingChangesCmd(o))
+	cmd.AddCommand(newAddLabelsCmd(o))
 	return cmd, o, nil
 }
+
 // Execute is the entry-point for all commands.
 // This lets us keep all new command functions private.
 func Execute() {
@@ -35,4 +40,4 @@ func Execute() {
 		fmt.Println(err.Error())
 		os.Exit(1)
 	}
-}
\ No newline at end of file
+}
diff --git a/tools/diff-processor/diff/comparison.go b/tools/diff-processor/diff/comparison.go
deleted file mode 100644
index 26ad10122f38..000000000000
--- a/tools/diff-processor/diff/comparison.go
+++ /dev/null
@@ -1,134 +0,0 @@
-package diff
-
-import (
-	newProvider "google/provider/new/google/provider"
-	oldProvider "google/provider/old/google/provider"
-	"strings"
-
-	"github.com/GoogleCloudPlatform/magic-modules/.ci/diff-processor/rules"
-	"github.com/golang/glog"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-)
-
-func Compare() []string {
-	resourceMapOld := oldProvider.ResourceMap()
-	resourceMapNew := newProvider.ResourceMap()
-
-	return compareResourceMaps(resourceMapOld, resourceMapNew)
-}
-
-func compareResourceMaps(old, new map[string]*schema.Resource) []string {
-	messages := []string{}
-
-	for _, rule := range rules.ResourceInventoryRules {
-		violatingResources := rule.IsRuleBreak(old, new)
-		if len(violatingResources) > 0 {
-			for _, resourceName := range violatingResources {
-				newMessage := rule.Message(resourceName)
-				messages = append(messages, newMessage)
-			}
-		}
-
-	}
-
-	for resourceName, resource := range new {
-		oldResource, ok := old[resourceName]
-		if ok {
-			newMessages := compareResourceSchema(resourceName, oldResource.Schema, resource.Schema)
-			messages = append(messages, newMessages...)
-		}
-	}
-
-	return messages
-}
-
-func compareResourceSchema(resourceName string, old, new map[string]*schema.Schema) []string {
-	messages := []string{}
-	oldCompressed := flattenSchema(old)
-	newCompressed := flattenSchema(new)
-
-	for _, rule := range rules.ResourceSchemaRules {
-		violatingFields := rule.IsRuleBreak(oldCompressed, newCompressed)
-		if len(violatingFields) > 0 {
-			for _, fieldName := range violatingFields {
-				newMessage := rule.Message(resourceName, fieldName)
-				messages = append(messages, newMessage)
-			}
-		}
-	}
-
-	for fieldName, field := range newCompressed {
-		oldField, ok := oldCompressed[fieldName]
-		if ok {
-			newMessages := compareField(resourceName, fieldName, oldField, field)
-			messages = append(messages, newMessages...)
-		}
-	}
-
-	return messages
-}
-
-func compareField(resourceName, fieldName string, old, new *schema.Schema) []string {
-	messages := []string{}
-	fieldRules := rules.FieldRules
-
-	for _, rule := range fieldRules {
-		breakageMessage := rule.IsRuleBreak(
-			old,
-			new,
-			rules.MessageContext{
-				Resource: resourceName,
-				Field:    fieldName,
-			},
-		)
-		if breakageMessage != "" {
-			messages = append(messages, breakageMessage)
-		}
-	}
-	return messages
-}
-
-func flattenSchema(schemaObj map[string]*schema.Schema) map[string]*schema.Schema {
-	return flattenSchemaRecursive(nil, schemaObj)
-}
-
-func flattenSchemaRecursive(parentLineage []string, schemaObj map[string]*schema.Schema) map[string]*schema.Schema {
-	compressed := make(map[string]*schema.Schema)
-
-	// prepare prefix to bring nested entries up
-	parentPrefix := strings.Join(parentLineage, ".")
-	if len(parentPrefix) > 0 {
-		parentPrefix += "."
-	}
-
-	// add entry to output and call
-	// flattenSchemaRecursive for any children
-	for fieldName, field := range schemaObj {
-		compressed[parentPrefix+fieldName] = field
-		casted, typeConverted := field.Elem.(*schema.Resource)
-		if field.Elem != nil && typeConverted {
-			newLineage := append([]string{}, parentLineage...)
-			newLineage = append(newLineage, fieldName)
-			compressedChild := flattenSchemaRecursive(newLineage, casted.Schema)
-			compressed = mergeSchemaMaps(compressed, compressedChild)
-		}
-	}
-
-	return compressed
-}
-
-func mergeSchemaMaps(map1, map2 map[string]*schema.Schema) map[string]*schema.Schema {
-	merged := make(map[string]*schema.Schema)
-	for key, value := range map1 {
-		merged[key] = value
-	}
-
-	for key, value := range map2 {
-		if _, alreadyExists := merged[key]; alreadyExists {
-			glog.Errorf("error when trying to merge maps key " + key + " was found in both maps.. please ensure the children you are merging up have the prefix on the key names.")
-		}
-		merged[key] = value
-	}
-
-	return merged
-}
diff --git a/tools/diff-processor/diff/comparison_test.go b/tools/diff-processor/diff/comparison_test.go
deleted file mode 100644
index 5554148b07ed..000000000000
--- a/tools/diff-processor/diff/comparison_test.go
+++ /dev/null
@@ -1,344 +0,0 @@
-package diff
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-)
-
-func TestComparisonEngine(t *testing.T) {
-	for _, tc := range comparisonEngineTestCases {
-		tc.check(t)
-	}
-}
-
-type comparisonEngineTestCase struct {
-	name               string
-	oldResourceMap     map[string]*schema.Resource
-	newResourceMap     map[string]*schema.Resource
-	expectedViolations int
-}
-
-var comparisonEngineTestCases = []comparisonEngineTestCase{
-	{
-		name: "control",
-		oldResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Optional: true},
-					"field-b": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		newResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Optional: true},
-					"field-b": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		expectedViolations: 0,
-	},
-	{
-		name: "adding resources",
-		oldResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Optional: true},
-					"field-b": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		newResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Optional: true},
-					"field-b": {Description: "beep", Optional: true},
-				},
-			},
-			"google-y": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		expectedViolations: 0,
-	},
-	{
-		name: "adding fields",
-		oldResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Optional: true},
-					"field-b": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		newResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Optional: true},
-					"field-b": {Description: "beep", Optional: true},
-					"field-c": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		expectedViolations: 0,
-	},
-	{
-		name: "resource missing",
-		oldResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep"},
-					"field-b": {Description: "beep"},
-				},
-			},
-		},
-		newResourceMap:     map[string]*schema.Resource{},
-		expectedViolations: 1,
-	},
-	{
-		name: "field missing",
-		oldResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Optional: true},
-					"field-b": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		newResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		expectedViolations: 1,
-	},
-	{
-		name: "optional field to required",
-		oldResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Optional: true},
-					"field-b": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		newResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Required: true},
-					"field-b": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		expectedViolations: 1,
-	},
-	{
-		name: "field missing and optional to required",
-		oldResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Optional: true},
-					"field-b": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		newResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Required: true},
-				},
-			},
-		},
-		expectedViolations: 2,
-	},
-	{
-		name: "field missing, resource missing, and optional to required",
-		oldResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Optional: true},
-					"field-b": {Description: "beep", Optional: true},
-				},
-			},
-			"google-y": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		newResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Required: true},
-				},
-			},
-		},
-		expectedViolations: 3,
-	},
-	{
-		name: "removing a subfield",
-		oldResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {
-						Description: "beep",
-						Optional:    true,
-						Type:        schema.TypeList,
-						MaxItems:    1,
-						Elem: &schema.Resource{
-							Schema: map[string]*schema.Schema{
-								"sub-field-1": {Description: "beep", Optional: true},
-								"sub-field-2": {Description: "beep", Optional: true},
-							},
-						},
-					},
-					"field-b": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		newResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {
-						Description: "beep",
-						Optional:    true,
-						Type:        schema.TypeList,
-						MaxItems:    1,
-						Elem: &schema.Resource{
-							Schema: map[string]*schema.Schema{
-								"sub-field-1": {Description: "beep", Optional: true},
-							},
-						},
-					},
-					"field-b": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		expectedViolations: 1,
-	},
-	{
-		name: "subfield max shrinking",
-		oldResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {
-						Description: "beep",
-						Optional:    true,
-						Type:        schema.TypeList,
-						MaxItems:    1,
-						Elem: &schema.Resource{
-							Schema: map[string]*schema.Schema{
-								"sub-field-1": {Description: "beep", Optional: true, MaxItems: 100},
-							},
-						},
-					},
-					"field-b": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		newResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {
-						Description: "beep",
-						Optional:    true,
-						Type:        schema.TypeList,
-						MaxItems:    1,
-						Elem: &schema.Resource{
-							Schema: map[string]*schema.Schema{
-								"sub-field-1": {Description: "beep", Optional: true, MaxItems: 25},
-							},
-						},
-					},
-					"field-b": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		expectedViolations: 1,
-	},
-	{
-		name: "subfield max shrinking",
-		oldResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {
-						Description: "beep",
-						Optional:    true,
-						Type:        schema.TypeList,
-						MaxItems:    1,
-						Elem: &schema.Resource{
-							Schema: map[string]*schema.Schema{
-								"sub-field-1": {Description: "beep", Optional: true, MaxItems: 100},
-							},
-						},
-					},
-					"field-b": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		newResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {
-						Description: "beep",
-						Optional:    true,
-						Type:        schema.TypeList,
-						MaxItems:    1,
-						Elem: &schema.Resource{
-							Schema: map[string]*schema.Schema{
-								"sub-field-1": {Description: "beep", Optional: true, MaxItems: 25},
-							},
-						},
-					},
-					"field-b": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		expectedViolations: 1,
-	},
-	{
-		name: "min growing",
-		oldResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {
-						Description: "beep",
-						Optional:    true,
-						MinItems:    1,
-					},
-				},
-			},
-		},
-		newResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {
-						Description: "beep",
-						Optional:    true,
-						MinItems:    4,
-					},
-				},
-			},
-		},
-		expectedViolations: 1,
-	},
-}
-
-func (tc *comparisonEngineTestCase) check(t *testing.T) {
-	violations := compareResourceMaps(tc.oldResourceMap, tc.newResourceMap)
-	for _, v := range violations {
-		if strings.Contains(v, "{{") || strings.Contains(v, "}}") {
-			t.Errorf("Test `%s` failed: found unreplaced characters in string - %s", tc.name, v)
-		}
-	}
-	if tc.expectedViolations != len(violations) {
-		t.Errorf("Test `%s` failed: expected %d violations, got %d", tc.name, tc.expectedViolations, len(violations))
-	}
-}
diff --git a/tools/diff-processor/diff/diff.go b/tools/diff-processor/diff/diff.go
new file mode 100644
index 000000000000..486ac6de88a8
--- /dev/null
+++ b/tools/diff-processor/diff/diff.go
@@ -0,0 +1,229 @@
+package diff
+
+import (
+	"reflect"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"golang.org/x/exp/maps"
+)
+
+// SchemaDiff is a nested map with field names as keys and Field objects
+// as bottom-level values.
+// Fields are assumed not to be covered until detected in a test.
+type SchemaDiff map[string]ResourceDiff
+
+type ResourceDiff struct {
+	ResourceConfig ResourceConfigDiff
+	Fields         map[string]FieldDiff
+}
+
+type ResourceConfigDiff struct {
+	Old *schema.Resource
+	New *schema.Resource
+}
+
+type FieldDiff struct {
+	Old *schema.Schema
+	New *schema.Schema
+}
+
+func ComputeSchemaDiff(oldResourceMap, newResourceMap map[string]*schema.Resource) SchemaDiff {
+	schemaDiff := make(SchemaDiff)
+	for resource, _ := range union(maps.Keys(oldResourceMap), maps.Keys(newResourceMap)) {
+		// Compute diff between old and new resources and fields.
+		// TODO: add support for computing diff between resource configs, not just whether the
+		// resource was added/removed. b/300114839
+		resourceDiff := ResourceDiff{}
+		var flattenedOldSchema map[string]*schema.Schema
+		if oldResource, ok := oldResourceMap[resource]; ok {
+			flattenedOldSchema = flattenSchema("", oldResource.Schema)
+			resourceDiff.ResourceConfig.Old = &schema.Resource{}
+		}
+
+		var flattenedNewSchema map[string]*schema.Schema
+		if newResource, ok := newResourceMap[resource]; ok {
+			flattenedNewSchema = flattenSchema("", newResource.Schema)
+			resourceDiff.ResourceConfig.New = &schema.Resource{}
+		}
+
+		resourceDiff.Fields = make(map[string]FieldDiff)
+		for key, _ := range union(maps.Keys(flattenedOldSchema), maps.Keys(flattenedNewSchema)) {
+			oldField := flattenedOldSchema[key]
+			newField := flattenedNewSchema[key]
+			if fieldChanged(oldField, newField) {
+				resourceDiff.Fields[key] = FieldDiff{
+					Old: oldField,
+					New: newField,
+				}
+			}
+		}
+		if len(resourceDiff.Fields) > 0 || !cmp.Equal(resourceDiff.ResourceConfig.Old, resourceDiff.ResourceConfig.New) {
+			schemaDiff[resource] = resourceDiff
+		}
+	}
+	return schemaDiff
+}
+
+func union(keys1, keys2 []string) map[string]struct{} {
+	allKeys := make(map[string]struct{})
+	for _, key := range keys1 {
+		allKeys[key] = struct{}{}
+	}
+	for _, key := range keys2 {
+		allKeys[key] = struct{}{}
+	}
+	return allKeys
+}
+
+func flattenSchema(parentKey string, schemaObj map[string]*schema.Schema) map[string]*schema.Schema {
+	flattened := make(map[string]*schema.Schema)
+
+	if parentKey != "" {
+		parentKey += "."
+	}
+
+	for fieldName, field := range schemaObj {
+		key := parentKey + fieldName
+		flattened[key] = field
+		childResource, hasNestedFields := field.Elem.(*schema.Resource)
+		if field.Elem != nil && hasNestedFields {
+			for childKey, childField := range flattenSchema(key, childResource.Schema) {
+				flattened[childKey] = childField
+			}
+		}
+	}
+
+	return flattened
+}
+
+func fieldChanged(oldField, newField *schema.Schema) bool {
+	// If either field is nil, it is changed; if both are nil (which should never happen) it's not
+	if oldField == nil && newField == nil {
+		return false
+	}
+	if oldField == nil || newField == nil {
+		return true
+	}
+	// Check if any basic Schema struct fields have changed.
+	// https://github.com/hashicorp/terraform-plugin-sdk/blob/v2.24.0/helper/schema/schema.go#L44
+	if oldField.Type != newField.Type {
+		return true
+	}
+	if oldField.ConfigMode != newField.ConfigMode {
+		return true
+	}
+	if oldField.Required != newField.Required {
+		return true
+	}
+	if oldField.Optional != newField.Optional {
+		return true
+	}
+	if oldField.Computed != newField.Computed {
+		return true
+	}
+	if oldField.ForceNew != newField.ForceNew {
+		return true
+	}
+	if oldField.DiffSuppressOnRefresh != newField.DiffSuppressOnRefresh {
+		return true
+	}
+	if oldField.Default != newField.Default {
+		return true
+	}
+	if oldField.Description != newField.Description {
+		return true
+	}
+	if oldField.InputDefault != newField.InputDefault {
+		return true
+	}
+	if oldField.MaxItems != newField.MaxItems {
+		return true
+	}
+	if oldField.MinItems != newField.MinItems {
+		return true
+	}
+	if oldField.Deprecated != newField.Deprecated {
+		return true
+	}
+	if oldField.Sensitive != newField.Sensitive {
+		return true
+	}
+
+	// Compare slices
+	less := func(a, b string) bool { return a < b }
+
+	if (len(oldField.ConflictsWith) > 0 || len(newField.ConflictsWith) > 0) && !cmp.Equal(oldField.ConflictsWith, newField.ConflictsWith, cmpopts.SortSlices(less)) {
+		return true
+	}
+
+	if (len(oldField.ExactlyOneOf) > 0 || len(newField.ExactlyOneOf) > 0) && !cmp.Equal(oldField.ExactlyOneOf, newField.ExactlyOneOf, cmpopts.SortSlices(less)) {
+		return true
+	}
+
+	if (len(oldField.AtLeastOneOf) > 0 || len(newField.AtLeastOneOf) > 0) && !cmp.Equal(oldField.AtLeastOneOf, newField.AtLeastOneOf, cmpopts.SortSlices(less)) {
+		return true
+	}
+
+	if (len(oldField.RequiredWith) > 0 || len(newField.RequiredWith) > 0) && !cmp.Equal(oldField.RequiredWith, newField.RequiredWith, cmpopts.SortSlices(less)) {
+		return true
+	}
+
+	// Check if Elem changed (unless old and new both represent nested fields)
+	if (oldField.Elem == nil && newField.Elem != nil) || (oldField.Elem != nil && newField.Elem == nil) {
+		return true
+	}
+	if oldField.Elem != nil && newField.Elem != nil {
+		// At this point new/old Elems are either schema.Schema or schema.Resource.
+		// If both are schema.Resource we don't need to do anything. Diffs on subfields
+		// are handled separately.
+		_, oldIsResource := oldField.Elem.(*schema.Resource)
+		_, newIsResource := newField.Elem.(*schema.Resource)
+
+		if (oldIsResource && !newIsResource) || (!oldIsResource && newIsResource) {
+			return true
+		}
+		if !oldIsResource && !newIsResource {
+			if fieldChanged(oldField.Elem.(*schema.Schema), newField.Elem.(*schema.Schema)) {
+				return true
+			}
+		}
+	}
+
+	// Check if any Schema struct fields that are functions have changed
+	if funcChanged(oldField.DiffSuppressFunc, newField.DiffSuppressFunc) {
+		return true
+	}
+	if funcChanged(oldField.DefaultFunc, newField.DefaultFunc) {
+		return true
+	}
+	if funcChanged(oldField.StateFunc, newField.StateFunc) {
+		return true
+	}
+	if funcChanged(oldField.Set, newField.Set) {
+		return true
+	}
+	if funcChanged(oldField.ValidateFunc, newField.ValidateFunc) {
+		return true
+	}
+	if funcChanged(oldField.ValidateDiagFunc, newField.ValidateDiagFunc) {
+		return true
+	}
+
+	return false
+}
+
+func funcChanged(oldFunc, newFunc interface{}) bool {
+	// If it changed to/from nil, it changed
+	oldFuncIsNil := reflect.ValueOf(oldFunc).IsNil()
+	newFuncIsNil := reflect.ValueOf(newFunc).IsNil()
+	if (oldFuncIsNil && !newFuncIsNil) || (!oldFuncIsNil && newFuncIsNil) {
+		return true
+	}
+
+	// If a func is set before and after we don't currently have a way to reliably
+	// determine whether the function changed, so we assume that it has not changed.
+	// b/300157205
+	return false
+}
diff --git a/tools/diff-processor/diff/diff_test.go b/tools/diff-processor/diff/diff_test.go
new file mode 100644
index 000000000000..5fb6057abd5c
--- /dev/null
+++ b/tools/diff-processor/diff/diff_test.go
@@ -0,0 +1,1361 @@
+package diff
+
+import (
+	"testing"
+
+	newProvider "google/provider/new/google/provider"
+	newTpgresource "google/provider/new/google/tpgresource"
+	oldTpgresource "google/provider/new/google/tpgresource"
+	newVerify "google/provider/new/google/verify"
+	oldProvider "google/provider/old/google/provider"
+	oldVerify "google/provider/old/google/verify"
+
+	"github.com/davecgh/go-spew/spew"
+	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/go-cty/cty"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestNewProviderOldProviderChanges(t *testing.T) {
+	changes := ComputeSchemaDiff(oldProvider.ResourceMap(), newProvider.ResourceMap())
+
+	for resource, resourceDiff := range changes {
+		if resourceDiff.ResourceConfig.Old == nil {
+			t.Logf("%s is added", resource)
+			continue
+		}
+		if resourceDiff.ResourceConfig.New == nil {
+			t.Logf("%s is removed", resource)
+			continue
+		}
+		t.Logf("%s is modified", resource)
+		if diff := cmp.Diff(resourceDiff.ResourceConfig.Old, resourceDiff.ResourceConfig.New); diff != "" {
+			t.Logf("%s config changes (-old, +new):\n%s", resource, diff)
+		}
+		for field, fieldDiff := range resourceDiff.Fields {
+			if fieldDiff.Old == nil {
+				t.Logf("%s.%s is added", resource, field)
+				continue
+			}
+			if fieldDiff.New == nil {
+				t.Logf("%s.%s is removed", resource, field)
+				continue
+			}
+			t.Logf("%s.%s is modified", resource, field)
+			if diff := cmp.Diff(fieldDiff.Old, fieldDiff.New); diff != "" {
+				t.Logf("%s.%s changes (-old, +new):\n%s", resource, field, diff)
+			}
+		}
+
+	}
+}
+
+func TestFlattenSchema(t *testing.T) {
+	cases := map[string]struct {
+		resourceSchema  map[string]*schema.Schema
+		expectFlattened map[string]*schema.Schema
+	}{
+		"primitive fields": {
+			resourceSchema: map[string]*schema.Schema{
+				"bool": {
+					Type: schema.TypeBool,
+				},
+				"int": {
+					Type: schema.TypeInt,
+				},
+				"float": {
+					Type: schema.TypeFloat,
+				},
+				"string": {
+					Type: schema.TypeString,
+				},
+			},
+			expectFlattened: map[string]*schema.Schema{
+				"bool": {
+					Type: schema.TypeBool,
+				},
+				"int": {
+					Type: schema.TypeInt,
+				},
+				"float": {
+					Type: schema.TypeFloat,
+				},
+				"string": {
+					Type: schema.TypeString,
+				},
+			},
+		},
+		"map field": {
+			resourceSchema: map[string]*schema.Schema{
+				"map": {
+					Type: schema.TypeMap,
+					Elem: &schema.Schema{Type: schema.TypeString},
+				},
+			},
+			expectFlattened: map[string]*schema.Schema{
+				"map": {
+					Type: schema.TypeMap,
+					Elem: &schema.Schema{Type: schema.TypeString},
+				},
+			},
+		},
+		"simple list field": {
+			resourceSchema: map[string]*schema.Schema{
+				"list": {
+					Type: schema.TypeList,
+					Elem: &schema.Schema{Type: schema.TypeString},
+				},
+			},
+			expectFlattened: map[string]*schema.Schema{
+				"list": {
+					Type: schema.TypeList,
+					Elem: &schema.Schema{Type: schema.TypeString},
+				},
+			},
+		},
+		"simple set field": {
+			resourceSchema: map[string]*schema.Schema{
+				"set": {
+					Type: schema.TypeSet,
+					Elem: &schema.Schema{Type: schema.TypeString},
+				},
+			},
+			expectFlattened: map[string]*schema.Schema{
+				"set": {
+					Type: schema.TypeSet,
+					Elem: &schema.Schema{Type: schema.TypeString},
+				},
+			},
+		},
+		"nested list field": {
+			resourceSchema: map[string]*schema.Schema{
+				"list": {
+					Type: schema.TypeList,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"nested_string": {
+								Type: schema.TypeString,
+							},
+						},
+					},
+				},
+			},
+			expectFlattened: map[string]*schema.Schema{
+				"list": {
+					Type: schema.TypeList,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"nested_string": {
+								Type: schema.TypeString,
+							},
+						},
+					},
+				},
+				"list.nested_string": {
+					Type: schema.TypeString,
+				},
+			},
+		},
+		"nested set field": {
+			resourceSchema: map[string]*schema.Schema{
+				"set": {
+					Type: schema.TypeSet,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"nested_string": {
+								Type: schema.TypeString,
+							},
+						},
+					},
+				},
+			},
+			expectFlattened: map[string]*schema.Schema{
+				"set": {
+					Type: schema.TypeSet,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"nested_string": {
+								Type: schema.TypeString,
+							},
+						},
+					},
+				},
+				"set.nested_string": {
+					Type: schema.TypeString,
+				},
+			},
+		},
+	}
+
+	for tn, tc := range cases {
+		tc := tc
+		t.Run(tn, func(t *testing.T) {
+			t.Parallel()
+			flattened := flattenSchema("", tc.resourceSchema)
+			assert.Equal(t, tc.expectFlattened, flattened)
+		})
+	}
+}
+
+func testDefaultFunc1() (interface{}, error) {
+	return "default1", nil
+}
+func testDefaultFunc2() (interface{}, error) {
+	return "default2", nil
+}
+func testStateFunc1(interface{}) string {
+	return "state1"
+}
+func testStateFunc2(interface{}) string {
+	return "state2"
+}
+func testValidateDiagFunc1(v interface{}, p cty.Path) diag.Diagnostics {
+	return diag.Diagnostics{}
+}
+func testValidateDiagFunc2(v interface{}, p cty.Path) diag.Diagnostics {
+	return diag.Diagnostics{}
+}
+
+func TestFieldChanged(t *testing.T) {
+	cases := map[string]struct {
+		oldField      *schema.Schema
+		newField      *schema.Schema
+		expectChanged bool
+	}{
+		"both nil": {
+			oldField:      nil,
+			newField:      nil,
+			expectChanged: false,
+		},
+		"old nil": {
+			oldField: nil,
+			newField: &schema.Schema{
+				Type: schema.TypeString,
+			},
+			expectChanged: true,
+		},
+		"new nil": {
+			oldField: &schema.Schema{
+				Type: schema.TypeString,
+			},
+			newField:      nil,
+			expectChanged: true,
+		},
+		"not changed": {
+			oldField:      &schema.Schema{},
+			newField:      &schema.Schema{},
+			expectChanged: false,
+		},
+		"Type changed": {
+			oldField: &schema.Schema{
+				Type: schema.TypeString,
+			},
+			newField: &schema.Schema{
+				Type: schema.TypeInt,
+			},
+			expectChanged: true,
+		},
+		"ConfigMode changed": {
+			oldField: &schema.Schema{
+				ConfigMode: schema.SchemaConfigModeAttr,
+			},
+			newField: &schema.Schema{
+				ConfigMode: schema.SchemaConfigModeBlock,
+			},
+			expectChanged: true,
+		},
+		"Required changed": {
+			oldField: &schema.Schema{
+				Required: false,
+			},
+			newField: &schema.Schema{
+				Required: true,
+			},
+			expectChanged: true,
+		},
+		"Optional changed": {
+			oldField: &schema.Schema{
+				Optional: false,
+			},
+			newField: &schema.Schema{
+				Optional: true,
+			},
+			expectChanged: true,
+		},
+		"Computed changed": {
+			oldField: &schema.Schema{
+				Computed: false,
+			},
+			newField: &schema.Schema{
+				Computed: true,
+			},
+			expectChanged: true,
+		},
+		"ForceNew changed": {
+			oldField: &schema.Schema{
+				ForceNew: false,
+			},
+			newField: &schema.Schema{
+				ForceNew: true,
+			},
+			expectChanged: true,
+		},
+		"DiffSuppressOnRefresh changed": {
+			oldField: &schema.Schema{
+				DiffSuppressOnRefresh: false,
+			},
+			newField: &schema.Schema{
+				DiffSuppressOnRefresh: true,
+			},
+			expectChanged: true,
+		},
+		"Default changed": {
+			oldField: &schema.Schema{
+				Default: 10,
+			},
+			newField: &schema.Schema{
+				Default: 20,
+			},
+			expectChanged: true,
+		},
+		"Description changed": {
+			oldField: &schema.Schema{
+				Description: "Hello",
+			},
+			newField: &schema.Schema{
+				Description: "Goodbye",
+			},
+			expectChanged: true,
+		},
+		"InputDefault changed": {
+			oldField: &schema.Schema{
+				InputDefault: "Hello",
+			},
+			newField: &schema.Schema{
+				InputDefault: "Goodbye",
+			},
+			expectChanged: true,
+		},
+		"MaxItems changed": {
+			oldField: &schema.Schema{
+				MaxItems: 10,
+			},
+			newField: &schema.Schema{
+				MaxItems: 20,
+			},
+			expectChanged: true,
+		},
+		"MinItems changed": {
+			oldField: &schema.Schema{
+				MinItems: 10,
+			},
+			newField: &schema.Schema{
+				MinItems: 20,
+			},
+			expectChanged: true,
+		},
+		"Deprecated changed": {
+			oldField: &schema.Schema{
+				Deprecated: "Hello",
+			},
+			newField: &schema.Schema{
+				Deprecated: "Goodbye",
+			},
+			expectChanged: true,
+		},
+		"Sensitive changed": {
+			oldField: &schema.Schema{
+				Sensitive: false,
+			},
+			newField: &schema.Schema{
+				Sensitive: true,
+			},
+			expectChanged: true,
+		},
+		"ConflictsWith reordered": {
+			oldField: &schema.Schema{
+				ConflictsWith: []string{"field_one", "field_two"},
+			},
+			newField: &schema.Schema{
+				ConflictsWith: []string{"field_two", "field_one"},
+			},
+			expectChanged: false,
+		},
+		"ConflictsWith changed": {
+			oldField: &schema.Schema{
+				ConflictsWith: []string{"field_one", "field_two"},
+			},
+			newField: &schema.Schema{
+				ConflictsWith: []string{"field_two", "field_three"},
+			},
+			expectChanged: true,
+		},
+		"ExactlyOneOf reordered": {
+			oldField: &schema.Schema{
+				ExactlyOneOf: []string{"field_one", "field_two"},
+			},
+			newField: &schema.Schema{
+				ExactlyOneOf: []string{"field_two", "field_one"},
+			},
+			expectChanged: false,
+		},
+		"ExactlyOneOf changed": {
+			oldField: &schema.Schema{
+				ExactlyOneOf: []string{"field_one", "field_two"},
+			},
+			newField: &schema.Schema{
+				ExactlyOneOf: []string{"field_two", "field_three"},
+			},
+			expectChanged: true,
+		},
+		"AtLeastOneOf reordered": {
+			oldField: &schema.Schema{
+				AtLeastOneOf: []string{"field_one", "field_two"},
+			},
+			newField: &schema.Schema{
+				AtLeastOneOf: []string{"field_two", "field_one"},
+			},
+			expectChanged: false,
+		},
+		"AtLeastOneOf changed": {
+			oldField: &schema.Schema{
+				AtLeastOneOf: []string{"field_one", "field_two"},
+			},
+			newField: &schema.Schema{
+				AtLeastOneOf: []string{"field_two", "field_three"},
+			},
+			expectChanged: true,
+		},
+		"RequiredWith reordered": {
+			oldField: &schema.Schema{
+				RequiredWith: []string{"field_one", "field_two"},
+			},
+			newField: &schema.Schema{
+				RequiredWith: []string{"field_two", "field_one"},
+			},
+			expectChanged: false,
+		},
+		"RequiredWith changed": {
+			oldField: &schema.Schema{
+				RequiredWith: []string{"field_one", "field_two"},
+			},
+			newField: &schema.Schema{
+				RequiredWith: []string{"field_two", "field_three"},
+			},
+			expectChanged: true,
+		},
+		"simple Elem unset -> set": {
+			oldField: &schema.Schema{},
+			newField: &schema.Schema{
+				Elem: &schema.Schema{Type: schema.TypeInt},
+			},
+			expectChanged: true,
+		},
+		"simple Elem set -> unset": {
+			oldField: &schema.Schema{
+				Elem: &schema.Schema{Type: schema.TypeInt},
+			},
+			newField:      &schema.Schema{},
+			expectChanged: true,
+		},
+		"simple Elem unchanged": {
+			oldField: &schema.Schema{
+				Elem: &schema.Schema{Type: schema.TypeString},
+			},
+			newField: &schema.Schema{
+				Elem: &schema.Schema{Type: schema.TypeString},
+			},
+			expectChanged: false,
+		},
+		"simple Elem changed": {
+			oldField: &schema.Schema{
+				Elem: &schema.Schema{Type: schema.TypeString},
+			},
+			newField: &schema.Schema{
+				Elem: &schema.Schema{Type: schema.TypeInt},
+			},
+			expectChanged: true,
+		},
+		"nested Elem unset -> set": {
+			oldField: &schema.Schema{},
+			newField: &schema.Schema{
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"foobar": {
+							Type: schema.TypeInt,
+						},
+					},
+				},
+			},
+			expectChanged: true,
+		},
+		"nested Elem set -> unset": {
+			oldField: &schema.Schema{
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"foobar": {
+							Type: schema.TypeInt,
+						},
+					},
+				},
+			},
+			newField:      &schema.Schema{},
+			expectChanged: true,
+		},
+		"nested Elem unchanged": {
+			oldField: &schema.Schema{
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"foobar": {
+							Type: schema.TypeInt,
+						},
+					},
+				},
+			},
+			newField: &schema.Schema{
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"foobar": {
+							Type: schema.TypeInt,
+						},
+					},
+				},
+			},
+			expectChanged: false,
+		},
+		"nested Elem changing is ignored": {
+			oldField: &schema.Schema{
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"foobar": {
+							Type: schema.TypeInt,
+						},
+					},
+				},
+			},
+			newField: &schema.Schema{
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"barbaz": {
+							Type: schema.TypeString,
+						},
+					},
+				},
+			},
+			expectChanged: false,
+		},
+		"Elem simple -> nested": {
+			oldField: &schema.Schema{
+				Elem: &schema.Schema{Type: schema.TypeString},
+			},
+			newField: &schema.Schema{
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"foobar": {
+							Type: schema.TypeInt,
+						},
+					},
+				},
+			},
+			expectChanged: true,
+		},
+		"Elem nested -> simple": {
+			oldField: &schema.Schema{
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"foobar": {
+							Type: schema.TypeInt,
+						},
+					},
+				},
+			},
+			newField: &schema.Schema{
+				Elem: &schema.Schema{Type: schema.TypeString},
+			},
+			expectChanged: true,
+		},
+
+		"DiffSuppressFunc added": {
+			oldField: &schema.Schema{},
+			newField: &schema.Schema{
+				DiffSuppressFunc: newTpgresource.CaseDiffSuppress,
+			},
+			expectChanged: true,
+		},
+		"DiffSuppressFunc removed": {
+			oldField: &schema.Schema{
+				DiffSuppressFunc: oldTpgresource.CaseDiffSuppress,
+			},
+			newField:      &schema.Schema{},
+			expectChanged: true,
+		},
+		"DiffSuppressFunc remains set": {
+			oldField: &schema.Schema{
+				DiffSuppressFunc: oldTpgresource.CaseDiffSuppress,
+			},
+			newField: &schema.Schema{
+				DiffSuppressFunc: newTpgresource.CaseDiffSuppress,
+			},
+			expectChanged: false,
+		},
+		"Elem DiffSuppressFunc added": {
+			oldField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+			newField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type:             schema.TypeString,
+					DiffSuppressFunc: oldTpgresource.CaseDiffSuppress,
+				},
+			},
+			expectChanged: true,
+		},
+		"Elem DiffSuppressFunc removed": {
+			oldField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type:             schema.TypeString,
+					DiffSuppressFunc: newTpgresource.CaseDiffSuppress,
+				},
+			},
+			newField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+			expectChanged: true,
+		},
+		"Elem DiffSuppressFunc remains set": {
+			oldField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type:             schema.TypeString,
+					DiffSuppressFunc: newTpgresource.CaseDiffSuppress,
+				},
+			},
+			newField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type:             schema.TypeString,
+					DiffSuppressFunc: oldTpgresource.CaseDiffSuppress,
+				},
+			},
+			expectChanged: false,
+		},
+
+		"DefaultFunc added": {
+			oldField: &schema.Schema{},
+			newField: &schema.Schema{
+				DefaultFunc: testDefaultFunc1,
+			},
+			expectChanged: true,
+		},
+		"DefaultFunc removed": {
+			oldField: &schema.Schema{
+				DefaultFunc: testDefaultFunc1,
+			},
+			newField:      &schema.Schema{},
+			expectChanged: true,
+		},
+		"DefaultFunc remains set": {
+			oldField: &schema.Schema{
+				DefaultFunc: testDefaultFunc1,
+			},
+			newField: &schema.Schema{
+				DefaultFunc: testDefaultFunc2,
+			},
+			expectChanged: false,
+		},
+		"Elem DefaultFunc added": {
+			oldField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+			newField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type:        schema.TypeString,
+					DefaultFunc: testDefaultFunc2,
+				},
+			},
+			expectChanged: true,
+		},
+		"Elem DefaultFunc removed": {
+			oldField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type:        schema.TypeString,
+					DefaultFunc: testDefaultFunc1,
+				},
+			},
+			newField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+			expectChanged: true,
+		},
+		"Elem DefaultFunc remains set": {
+			oldField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type:        schema.TypeString,
+					DefaultFunc: testDefaultFunc1,
+				},
+			},
+			newField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type:        schema.TypeString,
+					DefaultFunc: testDefaultFunc2,
+				},
+			},
+			expectChanged: false,
+		},
+
+		"StateFunc added": {
+			oldField: &schema.Schema{},
+			newField: &schema.Schema{
+				StateFunc: testStateFunc1,
+			},
+			expectChanged: true,
+		},
+		"StateFunc removed": {
+			oldField: &schema.Schema{
+				StateFunc: testStateFunc1,
+			},
+			newField:      &schema.Schema{},
+			expectChanged: true,
+		},
+		"StateFunc remains set": {
+			oldField: &schema.Schema{
+				StateFunc: testStateFunc1,
+			},
+			newField: &schema.Schema{
+				StateFunc: testStateFunc2,
+			},
+			expectChanged: false,
+		},
+		"Elem StateFunc added": {
+			oldField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+			newField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type:      schema.TypeString,
+					StateFunc: testStateFunc2,
+				},
+			},
+			expectChanged: true,
+		},
+		"Elem StateFunc removed": {
+			oldField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type:      schema.TypeString,
+					StateFunc: testStateFunc1,
+				},
+			},
+			newField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+			expectChanged: true,
+		},
+		"Elem StateFunc remains set": {
+			oldField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type:      schema.TypeString,
+					StateFunc: testStateFunc1,
+				},
+			},
+			newField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type:      schema.TypeString,
+					StateFunc: testStateFunc2,
+				},
+			},
+			expectChanged: false,
+		},
+
+		"Set added": {
+			oldField: &schema.Schema{},
+			newField: &schema.Schema{
+				Set: newTpgresource.SelfLinkRelativePathHash,
+			},
+			expectChanged: true,
+		},
+		"Set removed": {
+			oldField: &schema.Schema{
+				Set: oldTpgresource.SelfLinkRelativePathHash,
+			},
+			newField:      &schema.Schema{},
+			expectChanged: true,
+		},
+		"Set remains set": {
+			oldField: &schema.Schema{
+				Set: oldTpgresource.SelfLinkRelativePathHash,
+			},
+			newField: &schema.Schema{
+				Set: newTpgresource.SelfLinkRelativePathHash,
+			},
+			expectChanged: false,
+		},
+		"Elem Set added": {
+			oldField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+			newField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+					Set:  newTpgresource.SelfLinkRelativePathHash,
+				},
+			},
+			expectChanged: true,
+		},
+		"Elem Set removed": {
+			oldField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+					Set:  oldTpgresource.SelfLinkRelativePathHash,
+				},
+			},
+			newField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+			expectChanged: true,
+		},
+		"Elem Set remains set": {
+			oldField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+					Set:  oldTpgresource.SelfLinkRelativePathHash,
+				},
+			},
+			newField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+					Set:  newTpgresource.SelfLinkRelativePathHash,
+				},
+			},
+			expectChanged: false,
+		},
+
+		"ValidateFunc added": {
+			oldField: &schema.Schema{},
+			newField: &schema.Schema{
+				ValidateFunc: newVerify.ValidateBase64String,
+			},
+			expectChanged: true,
+		},
+		"ValidateFunc removed": {
+			oldField: &schema.Schema{
+				ValidateFunc: oldVerify.ValidateBase64String,
+			},
+			newField:      &schema.Schema{},
+			expectChanged: true,
+		},
+		"ValidateFunc remains set": {
+			oldField: &schema.Schema{
+				ValidateFunc: oldVerify.ValidateBase64String,
+			},
+			newField: &schema.Schema{
+				ValidateFunc: newVerify.ValidateBase64String,
+			},
+			expectChanged: false,
+		},
+		"Elem ValidateFunc added": {
+			oldField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+			newField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type:         schema.TypeString,
+					ValidateFunc: newVerify.ValidateBase64String,
+				},
+			},
+			expectChanged: true,
+		},
+		"Elem ValidateFunc removed": {
+			oldField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type:         schema.TypeString,
+					ValidateFunc: oldVerify.ValidateBase64String,
+				},
+			},
+			newField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+			expectChanged: true,
+		},
+		"Elem ValidateFunc remains set": {
+			oldField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type:         schema.TypeString,
+					ValidateFunc: oldVerify.ValidateBase64String,
+				},
+			},
+			newField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type:         schema.TypeString,
+					ValidateFunc: newVerify.ValidateBase64String,
+				},
+			},
+			expectChanged: false,
+		},
+
+		"ValidateDiagFunc added": {
+			oldField: &schema.Schema{},
+			newField: &schema.Schema{
+				ValidateDiagFunc: testValidateDiagFunc1,
+			},
+			expectChanged: true,
+		},
+		"ValidateDiagFunc removed": {
+			oldField: &schema.Schema{
+				ValidateDiagFunc: testValidateDiagFunc1,
+			},
+			newField:      &schema.Schema{},
+			expectChanged: true,
+		},
+		"ValidateDiagFunc remains set": {
+			oldField: &schema.Schema{
+				ValidateDiagFunc: testValidateDiagFunc1,
+			},
+			newField: &schema.Schema{
+				ValidateDiagFunc: testValidateDiagFunc2,
+			},
+			expectChanged: false,
+		},
+		"Elem ValidateDiagFunc added": {
+			oldField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+			newField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type:             schema.TypeString,
+					ValidateDiagFunc: testValidateDiagFunc2,
+				},
+			},
+			expectChanged: true,
+		},
+		"Elem ValidateDiagFunc removed": {
+			oldField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type:             schema.TypeString,
+					ValidateDiagFunc: testValidateDiagFunc1,
+				},
+			},
+			newField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+			expectChanged: true,
+		},
+		"Elem ValidateDiagFunc remains set": {
+			oldField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type:             schema.TypeString,
+					ValidateDiagFunc: testValidateDiagFunc1,
+				},
+			},
+			newField: &schema.Schema{
+				Elem: &schema.Schema{
+					Type:             schema.TypeString,
+					ValidateDiagFunc: testValidateDiagFunc2,
+				},
+			},
+			expectChanged: false,
+		},
+	}
+
+	for tn, tc := range cases {
+		tc := tc
+		t.Run(tn, func(t *testing.T) {
+			t.Parallel()
+			changed := fieldChanged(tc.oldField, tc.newField)
+			if changed != tc.expectChanged {
+				if diff := cmp.Diff(tc.oldField, tc.newField); diff != "" {
+					t.Errorf("want %t; got %t.\nField diff (-old, +new):\n%s",
+						tc.expectChanged,
+						changed,
+						diff,
+					)
+				} else {
+					t.Errorf("want %t; got %t. No field diff.\nOld field: %s\nNew field: %s\n",
+						tc.expectChanged,
+						changed,
+						spew.Sdump(tc.oldField),
+						spew.Sdump(tc.newField),
+					)
+				}
+			}
+		})
+	}
+}
+
+func TestComputeSchemaDiff(t *testing.T) {
+	cases := map[string]struct {
+		oldResourceMap     map[string]*schema.Resource
+		newResourceMap     map[string]*schema.Resource
+		expectedSchemaDiff SchemaDiff
+	}{
+		"empty-maps": {
+			oldResourceMap:     map[string]*schema.Resource{},
+			newResourceMap:     map[string]*schema.Resource{},
+			expectedSchemaDiff: SchemaDiff{},
+		},
+		"empty-resources": {
+			oldResourceMap: map[string]*schema.Resource{
+				"google_service_one_resource_one": {},
+				"google_service_one_resource_two": {},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google_service_one_resource_one": {},
+				"google_service_one_resource_two": {},
+			},
+			expectedSchemaDiff: SchemaDiff{},
+		},
+		"unchanged-nested-field": {
+			oldResourceMap: map[string]*schema.Resource{
+				"google_service_one_resource_one": {
+					Schema: map[string]*schema.Schema{
+						"field_one": {
+							Type: schema.TypeString,
+						},
+						"field_two": {
+							Type: schema.TypeList,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"field_three": {
+										Type: schema.TypeString,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google_service_one_resource_one": {
+					Schema: map[string]*schema.Schema{
+						"field_one": {
+							Type: schema.TypeString,
+						},
+						"field_two": {
+							Type: schema.TypeList,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"field_three": {
+										Type: schema.TypeString,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			expectedSchemaDiff: SchemaDiff{},
+		},
+		"new-nested-field": {
+			oldResourceMap: map[string]*schema.Resource{
+				"google_service_one_resource_one": {
+					Schema: map[string]*schema.Schema{
+						"field_one": {
+							Type: schema.TypeString,
+						},
+						"field_two": {
+							Type: schema.TypeList,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"field_three": {
+										Type: schema.TypeString,
+									},
+								},
+							},
+						},
+					},
+				},
+				"google_service_one_resource_two": {
+					Schema: map[string]*schema.Schema{
+						"field_one": {
+							Type: schema.TypeString,
+						},
+						"field_two": {
+							Type: schema.TypeList,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"field_three": {
+										Type: schema.TypeString,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google_service_one_resource_one": {
+					Schema: map[string]*schema.Schema{
+						"field_one": {
+							Type: schema.TypeString,
+						},
+						"field_two": {
+							Type: schema.TypeList,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"field_three": {
+										Type: schema.TypeString,
+									},
+								},
+							},
+						},
+					},
+				},
+				"google_service_one_resource_two": {
+					Schema: map[string]*schema.Schema{
+						"field_one": {
+							Type: schema.TypeString,
+						},
+						"field_two": {
+							Type: schema.TypeList,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"field_three": {
+										Type: schema.TypeString,
+									},
+									"field_four": {
+										Type: schema.TypeInt,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			expectedSchemaDiff: SchemaDiff{
+				"google_service_one_resource_two": ResourceDiff{
+					ResourceConfig: ResourceConfigDiff{
+						Old: &schema.Resource{},
+						New: &schema.Resource{},
+					},
+					Fields: map[string]FieldDiff{
+						"field_two.field_four": FieldDiff{
+							Old: nil,
+							New: &schema.Schema{
+								Type: schema.TypeInt,
+							},
+						},
+					},
+				},
+			},
+		},
+		"new-field-in-two-resources": {
+			oldResourceMap: map[string]*schema.Resource{
+				"google_service_one_resource_one": {
+					Schema: map[string]*schema.Schema{
+						"field_one": {
+							Type: schema.TypeString,
+						},
+						"field_two": {
+							Type: schema.TypeList,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"field_three": {
+										Type: schema.TypeString,
+									},
+								},
+							},
+						},
+					},
+				},
+				"google_service_one_resource_two": {
+					Schema: map[string]*schema.Schema{
+						"field_one": {
+							Type: schema.TypeString,
+						},
+						"field_two": {
+							Type: schema.TypeList,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"field_three": {
+										Type: schema.TypeString,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google_service_one_resource_one": {
+					Schema: map[string]*schema.Schema{
+						"field_one": {
+							Type: schema.TypeString,
+						},
+						"field_two": {
+							Type: schema.TypeList,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"field_three": {
+										Type: schema.TypeString,
+									},
+									"field_four": {
+										Type: schema.TypeInt,
+									},
+								},
+							},
+						},
+					},
+				},
+				"google_service_one_resource_two": {
+					Schema: map[string]*schema.Schema{
+						"field_one": {
+							Type: schema.TypeString,
+						},
+						"field_two": {
+							Type: schema.TypeList,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"field_three": {
+										Type: schema.TypeString,
+									},
+									"field_four": {
+										Type: schema.TypeInt,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			expectedSchemaDiff: SchemaDiff{
+				"google_service_one_resource_one": ResourceDiff{
+					ResourceConfig: ResourceConfigDiff{
+						Old: &schema.Resource{},
+						New: &schema.Resource{},
+					},
+					Fields: map[string]FieldDiff{
+						"field_two.field_four": FieldDiff{
+							Old: nil,
+							New: &schema.Schema{Type: schema.TypeInt},
+						},
+					},
+				},
+				"google_service_one_resource_two": ResourceDiff{
+					ResourceConfig: ResourceConfigDiff{
+						Old: &schema.Resource{},
+						New: &schema.Resource{},
+					},
+					Fields: map[string]FieldDiff{
+						"field_two.field_four": FieldDiff{
+							Old: nil,
+							New: &schema.Schema{Type: schema.TypeInt},
+						},
+					},
+				},
+			},
+		},
+		"deleted-field": {
+			oldResourceMap: map[string]*schema.Resource{
+				"google_service_one_resource_one": {
+					Schema: map[string]*schema.Schema{
+						"field_one": {
+							Type: schema.TypeString,
+						},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google_service_one_resource_one": {
+					Schema: map[string]*schema.Schema{},
+				},
+			},
+			expectedSchemaDiff: SchemaDiff{
+				"google_service_one_resource_one": ResourceDiff{
+					ResourceConfig: ResourceConfigDiff{
+						Old: &schema.Resource{},
+						New: &schema.Resource{},
+					},
+					Fields: map[string]FieldDiff{
+						"field_one": FieldDiff{
+							Old: &schema.Schema{Type: schema.TypeString},
+							New: nil,
+						},
+					},
+				},
+			},
+		},
+		"deleted-resource": {
+			oldResourceMap: map[string]*schema.Resource{
+				"google_service_one_resource_one": {
+					Schema: map[string]*schema.Schema{
+						"field_one": {
+							Type: schema.TypeString,
+						},
+					},
+				},
+			},
+			expectedSchemaDiff: SchemaDiff{
+				"google_service_one_resource_one": ResourceDiff{
+					ResourceConfig: ResourceConfigDiff{
+						Old: &schema.Resource{},
+						New: nil,
+					},
+					Fields: map[string]FieldDiff{
+						"field_one": FieldDiff{
+							Old: &schema.Schema{Type: schema.TypeString},
+							New: nil,
+						},
+					},
+				},
+			},
+		},
+		"new-resource": {
+			newResourceMap: map[string]*schema.Resource{
+				"google_service_one_resource_one": {
+					Schema: map[string]*schema.Schema{
+						"field_one": {
+							Type: schema.TypeString,
+						},
+					},
+				},
+			},
+			expectedSchemaDiff: SchemaDiff{
+				"google_service_one_resource_one": ResourceDiff{
+					ResourceConfig: ResourceConfigDiff{
+						Old: nil,
+						New: &schema.Resource{},
+					},
+					Fields: map[string]FieldDiff{
+						"field_one": FieldDiff{
+							Old: nil,
+							New: &schema.Schema{Type: schema.TypeString},
+						},
+					},
+				},
+			},
+		},
+	}
+	for tn, tc := range cases {
+		tc := tc
+		t.Run(tn, func(t *testing.T) {
+			t.Parallel()
+			schemaDiff := ComputeSchemaDiff(tc.oldResourceMap, tc.newResourceMap)
+			if diff := cmp.Diff(tc.expectedSchemaDiff, schemaDiff); diff != "" {
+				t.Errorf("schema diff not equal (-want, +got):\n%s", diff)
+			}
+		})
+	}
+}
diff --git a/tools/diff-processor/go.mod b/tools/diff-processor/go.mod
index 37ae5ef32752..880f54da41c9 100644
--- a/tools/diff-processor/go.mod
+++ b/tools/diff-processor/go.mod
@@ -1,4 +1,4 @@
-module github.com/GoogleCloudPlatform/magic-modules/.ci/diff-processor
+module github.com/GoogleCloudPlatform/magic-modules/tools/diff-processor
 
 go 1.19
 
@@ -6,12 +6,19 @@ replace google/provider/old => ./old
 
 replace google/provider/new => ./new
 
-replace github.com/GoogleCloudPlatform/magic-modules/.ci/diff-processor => ./
+replace github.com/GoogleCloudPlatform/magic-modules/tools/diff-processor => ./
+
+replace github.com/GoogleCloudPlatform/magic-modules/tools/issue-labeler => ../issue-labeler
 
 require (
-	github.com/golang/glog v1.1.0
+	github.com/GoogleCloudPlatform/magic-modules/tools/issue-labeler v0.0.0-00010101000000-000000000000
+	github.com/davecgh/go-spew v1.1.1
+	github.com/google/go-cmp v0.5.9
+	github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320
 	github.com/hashicorp/terraform-plugin-sdk/v2 v2.24.0
 	github.com/spf13/cobra v1.7.0
+	github.com/stretchr/testify v1.8.3
+	golang.org/x/exp v0.0.0-20230905200255-921286631fa9
 	google/provider/new v0.0.0-00010101000000-000000000000
 	google/provider/old v0.0.0-00010101000000-000000000000
 )
@@ -24,7 +31,7 @@ require (
 	cloud.google.com/go/compute/metadata v0.2.3 // indirect
 	cloud.google.com/go/iam v1.1.0 // indirect
 	cloud.google.com/go/longrunning v0.5.1 // indirect
-	github.com/GoogleCloudPlatform/declarative-resource-client-library v1.50.0 // indirect
+	github.com/GoogleCloudPlatform/declarative-resource-client-library v1.51.0 // indirect
 	github.com/agext/levenshtein v1.2.2 // indirect
 	github.com/apparentlymart/go-cidr v1.1.0 // indirect
 	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
@@ -33,15 +40,14 @@ require (
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/cncf/udpa/go v0.0.0-20220112060539-c52dc94e7fbe // indirect
 	github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/envoyproxy/go-control-plane v0.11.1-0.20230524094728-9239064ad72f // indirect
 	github.com/envoyproxy/protoc-gen-validate v0.10.1 // indirect
 	github.com/fatih/color v1.13.0 // indirect
 	github.com/gammazero/deque v0.0.0-20180920172122-f6adf94963e4 // indirect
 	github.com/gammazero/workerpool v0.0.0-20181230203049-86a96b5d5d92 // indirect
+	github.com/golang/glog v1.1.1 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/go-cmp v0.5.9 // indirect
 	github.com/google/go-cpy v0.0.0-20211218193943-a9c933c06932 // indirect
 	github.com/google/s2a-go v0.1.4 // indirect
 	github.com/google/uuid v1.3.0 // indirect
@@ -51,7 +57,6 @@ require (
 	github.com/hashicorp/errwrap v1.0.0 // indirect
 	github.com/hashicorp/go-checkpoint v0.5.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320 // indirect
 	github.com/hashicorp/go-hclog v1.2.1 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-plugin v1.4.8 // indirect
@@ -82,6 +87,7 @@ require (
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/oklog/run v1.0.0 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/sirupsen/logrus v1.8.1 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
@@ -93,7 +99,7 @@ require (
 	golang.org/x/net v0.12.0 // indirect
 	golang.org/x/oauth2 v0.10.0 // indirect
 	golang.org/x/sync v0.3.0 // indirect
-	golang.org/x/sys v0.10.0 // indirect
+	golang.org/x/sys v0.12.0 // indirect
 	golang.org/x/text v0.11.0 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
 	google.golang.org/api v0.135.0 // indirect
@@ -103,4 +109,6 @@ require (
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20230726155614-23370e0ffb3e // indirect
 	google.golang.org/grpc v1.57.0 // indirect
 	google.golang.org/protobuf v1.31.0 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/tools/diff-processor/go.sum b/tools/diff-processor/go.sum
index d7166b77e319..8aea913951ea 100644
--- a/tools/diff-processor/go.sum
+++ b/tools/diff-processor/go.sum
@@ -15,8 +15,8 @@ cloud.google.com/go/iam v1.1.0/go.mod h1:nxdHjaKfCr7fNYx/HJMM8LgiMugmveWlkatear5
 cloud.google.com/go/longrunning v0.5.1 h1:Fr7TXftcqTudoyRJa113hyaqlGdiBQkp0Gq7tErFDWI=
 cloud.google.com/go/longrunning v0.5.1/go.mod h1:spvimkwdz6SPWKEt/XBij79E9fiTkHSQl/fRUUQJYJc=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/GoogleCloudPlatform/declarative-resource-client-library v1.50.0 h1:tsuB2FrGmDXIPUdhRD6YdUuvIzAly6+RYpyRkKWwk9E=
-github.com/GoogleCloudPlatform/declarative-resource-client-library v1.50.0/go.mod h1:pL2Qt5HT+x6xrTd806oMiM3awW6kNIXB/iiuClz6m6k=
+github.com/GoogleCloudPlatform/declarative-resource-client-library v1.51.0 h1:YhWTPhOf6gVpA9mSfnLOuL8Y6j8W5pzmHE7flXjTke4=
+github.com/GoogleCloudPlatform/declarative-resource-client-library v1.51.0/go.mod h1:pL2Qt5HT+x6xrTd806oMiM3awW6kNIXB/iiuClz6m6k=
 github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
 github.com/Microsoft/go-winio v0.4.16 h1:FtSW/jqD+l4ba5iPBj9CODVtgfYAD8w2wS923g/cFDk=
 github.com/Microsoft/go-winio v0.4.16/go.mod h1:XB6nPKklQyQ7GC9LdcBEcBl8PF76WugXOPRXwdLnMv0=
@@ -98,8 +98,8 @@ github.com/go-test/deep v1.0.3 h1:ZrJSEWsXzPOxaZnFteGEfooLba+ju3FYIbOrS+rQd68=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/glog v1.1.0 h1:/d3pCKDPWNnvIWe0vVUpNP32qc8U3PDVxySP/y360qE=
-github.com/golang/glog v1.1.0/go.mod h1:pfYeQZ3JWZoXTV5sFc986z3HTpwQs9At6P4ImfuP3NQ=
+github.com/golang/glog v1.1.1 h1:jxpi2eWoU84wbX9iIEyAeeoac3FLuifZpY9tcNUD9kw=
+github.com/golang/glog v1.1.1/go.mod h1:zR+okUeTbrL6EL3xHUDxZuEtGv04p5shwip1+mL/rLQ=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -280,6 +280,7 @@ github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1F
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.3 h1:RP3t2pwF7cMEbC1dqtB6poj3niw/9gnV4Cjg5oW5gtY=
+github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/vmihailenco/msgpack v3.3.3+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
 github.com/vmihailenco/msgpack v4.0.4+incompatible h1:dSLoQfGFAo3F6OoNhwUmLwVgaUXK79GlxNBwueZn0xI=
 github.com/vmihailenco/msgpack v4.0.4+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
@@ -317,6 +318,8 @@ golang.org/x/crypto v0.0.0-20220314234659-1baeb1ce4c0b/go.mod h1:IxCIyHEi3zRg3s0
 golang.org/x/crypto v0.11.0 h1:6Ewdq3tDic1mg5xRO4milcWCfMVQhI4NkqWWvqejpuA=
 golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/exp v0.0.0-20230905200255-921286631fa9 h1:GoHiUyI/Tp2nVkLI2mCxVkOjsbSXD66ic0XW0js0R9g=
+golang.org/x/exp v0.0.0-20230905200255-921286631fa9/go.mod h1:S2oDrQGGwySpoQPVqRShND87VCbxmc6bL1Yd2oYrm6k=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
@@ -383,8 +386,8 @@ golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.10.0 h1:SqMFp9UcQJZa+pmYuAKjd9xq1f0j5rLcDIk0mj4qAsA=
-golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -466,6 +469,7 @@ gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/tools/diff-processor/labels/get_issue.go b/tools/diff-processor/labels/get_issue.go
new file mode 100644
index 000000000000..fe9b5a235d8a
--- /dev/null
+++ b/tools/diff-processor/labels/get_issue.go
@@ -0,0 +1,46 @@
+package labels
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+
+	labeler "github.com/GoogleCloudPlatform/magic-modules/tools/issue-labeler/labeler"
+)
+
+func GetIssue(repository string, id uint64) (labeler.Issue, error) {
+	var issue labeler.Issue
+	client := &http.Client{}
+	url := fmt.Sprintf("https://api.github.com/repos/%s/issues/%d", repository, id)
+
+	req, err := http.NewRequest("GET", url, nil)
+	if err != nil {
+		return issue, fmt.Errorf("Error creating request: %w", err)
+	}
+	req.Header.Add("Accept", "application/vnd.github+json")
+	req.Header.Add("Authorization", "Bearer "+os.Getenv("GITHUB_TOKEN"))
+	req.Header.Add("X-GitHub-Api-Version", "2022-11-28")
+	resp, err := client.Do(req)
+	if err != nil {
+		return issue, fmt.Errorf("Error getting issue: %w", err)
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return issue, fmt.Errorf("Error reading response body: %w", err)
+	}
+
+	err = json.Unmarshal(body, &issue)
+	if err != nil {
+		var errorResponse labeler.ErrorResponse
+		err = json.Unmarshal(body, &errorResponse)
+		if err != nil {
+			return issue, fmt.Errorf("Error unmarshalling response body: %w", err)
+		}
+		return issue, fmt.Errorf("Error from API: %s", errorResponse.Message)
+	}
+
+	return issue, nil
+}
diff --git a/tools/diff-processor/main.go b/tools/diff-processor/main.go
index 2795fad34354..f7693547c404 100644
--- a/tools/diff-processor/main.go
+++ b/tools/diff-processor/main.go
@@ -1,8 +1,9 @@
-
 package main
+
 import (
-	"github.com/GoogleCloudPlatform/magic-modules/.ci/diff-processor/cmd"
+	"github.com/GoogleCloudPlatform/magic-modules/tools/diff-processor/cmd"
 )
+
 func main() {
 	cmd.Execute()
-}
\ No newline at end of file
+}
diff --git a/tools/diff-processor/rules/breaking_changes.go b/tools/diff-processor/rules/breaking_changes.go
new file mode 100644
index 000000000000..4a3b27b365da
--- /dev/null
+++ b/tools/diff-processor/rules/breaking_changes.go
@@ -0,0 +1,52 @@
+package rules
+
+import (
+	"github.com/GoogleCloudPlatform/magic-modules/tools/diff-processor/diff"
+)
+
+func ComputeBreakingChanges(schemaDiff diff.SchemaDiff) []string {
+	messages := []string{}
+	for resource, resourceDiff := range schemaDiff {
+		for _, rule := range ResourceInventoryRules {
+			if rule.isRuleBreak(resourceDiff.ResourceConfig.Old, resourceDiff.ResourceConfig.New) {
+				messages = append(messages, rule.Message(resource))
+			}
+		}
+
+		// If the resource was added or removed, don't check field schema diffs.
+		if resourceDiff.ResourceConfig.Old == nil || resourceDiff.ResourceConfig.New == nil {
+			continue
+		}
+
+		// TODO: Move field removal to field_rules and merge resource schema / resource inventory rules
+		// b/300124253
+		for _, rule := range ResourceSchemaRules {
+			violatingFields := rule.IsRuleBreak(resourceDiff)
+			if len(violatingFields) > 0 {
+				for _, field := range violatingFields {
+					newMessage := rule.Message(resource, field)
+					messages = append(messages, newMessage)
+				}
+			}
+		}
+
+		for field, fieldDiff := range resourceDiff.Fields {
+			for _, rule := range FieldRules {
+				// TODO: refactor rules to use interface-based implementation that separates checking whether
+				// a rule broke from composing a message for a rule break.
+				breakageMessage := rule.IsRuleBreak(
+					fieldDiff.Old,
+					fieldDiff.New,
+					MessageContext{
+						Resource: resource,
+						Field:    field,
+					},
+				)
+				if breakageMessage != "" {
+					messages = append(messages, breakageMessage)
+				}
+			}
+		}
+	}
+	return messages
+}
diff --git a/tools/diff-processor/rules/breaking_changes_test.go b/tools/diff-processor/rules/breaking_changes_test.go
new file mode 100644
index 000000000000..9c63981c3391
--- /dev/null
+++ b/tools/diff-processor/rules/breaking_changes_test.go
@@ -0,0 +1,344 @@
+package rules
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/GoogleCloudPlatform/magic-modules/tools/diff-processor/diff"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+func TestComputeBreakingChanges(t *testing.T) {
+	cases := []struct {
+		name               string
+		oldResourceMap     map[string]*schema.Resource
+		newResourceMap     map[string]*schema.Resource
+		expectedViolations int
+	}{
+		{
+			name: "control",
+			oldResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {Description: "beep", Optional: true},
+						"field-b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {Description: "beep", Optional: true},
+						"field-b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			expectedViolations: 0,
+		},
+		{
+			name: "adding resources",
+			oldResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {Description: "beep", Optional: true},
+						"field-b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {Description: "beep", Optional: true},
+						"field-b": {Description: "beep", Optional: true},
+					},
+				},
+				"google-y": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			expectedViolations: 0,
+		},
+		{
+			name: "adding fields",
+			oldResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {Description: "beep", Optional: true},
+						"field-b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {Description: "beep", Optional: true},
+						"field-b": {Description: "beep", Optional: true},
+						"field-c": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			expectedViolations: 0,
+		},
+		{
+			name: "resource missing",
+			oldResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {Description: "beep"},
+						"field-b": {Description: "beep"},
+					},
+				},
+			},
+			newResourceMap:     map[string]*schema.Resource{},
+			expectedViolations: 1,
+		},
+		{
+			name: "field missing",
+			oldResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {Description: "beep", Optional: true},
+						"field-b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			expectedViolations: 1,
+		},
+		{
+			name: "optional field to required",
+			oldResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {Description: "beep", Optional: true},
+						"field-b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {Description: "beep", Required: true},
+						"field-b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			expectedViolations: 1,
+		},
+		{
+			name: "field missing and optional to required",
+			oldResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {Description: "beep", Optional: true},
+						"field-b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {Description: "beep", Required: true},
+					},
+				},
+			},
+			expectedViolations: 2,
+		},
+		{
+			name: "field missing, resource missing, and optional to required",
+			oldResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {Description: "beep", Optional: true},
+						"field-b": {Description: "beep", Optional: true},
+					},
+				},
+				"google-y": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {Description: "beep", Required: true},
+					},
+				},
+			},
+			expectedViolations: 3,
+		},
+		{
+			name: "removing a subfield",
+			oldResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {
+							Description: "beep",
+							Optional:    true,
+							Type:        schema.TypeList,
+							MaxItems:    1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"sub-field-1": {Description: "beep", Optional: true},
+									"sub-field-2": {Description: "beep", Optional: true},
+								},
+							},
+						},
+						"field-b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {
+							Description: "beep",
+							Optional:    true,
+							Type:        schema.TypeList,
+							MaxItems:    1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"sub-field-1": {Description: "beep", Optional: true},
+								},
+							},
+						},
+						"field-b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			expectedViolations: 1,
+		},
+		{
+			name: "subfield max shrinking",
+			oldResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {
+							Description: "beep",
+							Optional:    true,
+							Type:        schema.TypeList,
+							MaxItems:    1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"sub-field-1": {Description: "beep", Optional: true, MaxItems: 100},
+								},
+							},
+						},
+						"field-b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {
+							Description: "beep",
+							Optional:    true,
+							Type:        schema.TypeList,
+							MaxItems:    1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"sub-field-1": {Description: "beep", Optional: true, MaxItems: 25},
+								},
+							},
+						},
+						"field-b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			expectedViolations: 1,
+		},
+		{
+			name: "subfield max shrinking",
+			oldResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {
+							Description: "beep",
+							Optional:    true,
+							Type:        schema.TypeList,
+							MaxItems:    1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"sub-field-1": {Description: "beep", Optional: true, MaxItems: 100},
+								},
+							},
+						},
+						"field-b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {
+							Description: "beep",
+							Optional:    true,
+							Type:        schema.TypeList,
+							MaxItems:    1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"sub-field-1": {Description: "beep", Optional: true, MaxItems: 25},
+								},
+							},
+						},
+						"field-b": {Description: "beep", Optional: true},
+					},
+				},
+			},
+			expectedViolations: 1,
+		},
+		{
+			name: "min growing",
+			oldResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {
+							Description: "beep",
+							Optional:    true,
+							MinItems:    1,
+						},
+					},
+				},
+			},
+			newResourceMap: map[string]*schema.Resource{
+				"google-x": {
+					Schema: map[string]*schema.Schema{
+						"field-a": {
+							Description: "beep",
+							Optional:    true,
+							MinItems:    4,
+						},
+					},
+				},
+			},
+			expectedViolations: 1,
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			schemaDiff := diff.ComputeSchemaDiff(tc.oldResourceMap, tc.newResourceMap)
+			violations := ComputeBreakingChanges(schemaDiff)
+			for _, v := range violations {
+				if strings.Contains(v, "{{") || strings.Contains(v, "}}") {
+					t.Errorf("Test `%s` failed: found unreplaced characters in string - %s", tc.name, v)
+				}
+			}
+			if tc.expectedViolations != len(violations) {
+				t.Errorf("Test `%s` failed: expected %d violations, got %d", tc.name, tc.expectedViolations, len(violations))
+			}
+		})
+	}
+}
diff --git a/tools/diff-processor/rules/rules_field.go b/tools/diff-processor/rules/rules_field.go
index be79462b10e4..1b5645571731 100644
--- a/tools/diff-processor/rules/rules_field.go
+++ b/tools/diff-processor/rules/rules_field.go
@@ -45,6 +45,10 @@ var fieldRule_ChangingType = FieldRule{
 }
 
 func fieldRule_ChangingType_func(old, new *schema.Schema, mc MessageContext) string {
+	// Type change doesn't matter for added / removed fields
+	if old == nil || new == nil {
+		return ""
+	}
 	message := mc.message
 	if old.Type != new.Type {
 		oldType := getValueType(old.Type)
@@ -76,6 +80,10 @@ var fieldRule_BecomingRequired = FieldRule{
 }
 
 func fieldRule_BecomingRequired_func(old, new *schema.Schema, mc MessageContext) string {
+	// Ignore for added / removed fields
+	if old == nil || new == nil {
+		return ""
+	}
 	message := mc.message
 	if !old.Required && new.Required {
 		return populateMessageContext(message, mc)
@@ -93,6 +101,10 @@ var fieldRule_BecomingComputedOnly = FieldRule{
 }
 
 func fieldRule_BecomingComputedOnly_func(old, new *schema.Schema, mc MessageContext) string {
+	// ignore for added / removed fields
+	if old == nil || new == nil {
+		return ""
+	}
 	message := mc.message
 	// if the field is computed only already
 	// this rule doesn't apply
@@ -115,6 +127,10 @@ var fieldRule_OptionalComputedToOptional = FieldRule{
 }
 
 func fieldRule_OptionalComputedToOptional_func(old, new *schema.Schema, mc MessageContext) string {
+	// ignore for added / removed fields
+	if old == nil || new == nil {
+		return ""
+	}
 	message := mc.message
 	if (old.Computed && old.Optional) && (new.Optional && !new.Computed) {
 		return populateMessageContext(message, mc)
@@ -131,6 +147,10 @@ var fieldRule_DefaultModification = FieldRule{
 }
 
 func fieldRule_DefaultModification_func(old, new *schema.Schema, mc MessageContext) string {
+	// ignore for added / removed fields
+	if old == nil || new == nil {
+		return ""
+	}
 	message := mc.message
 	if old.Default != new.Default {
 		oldDefault := fmt.Sprintf("%v", old.Default)
@@ -152,6 +172,10 @@ var fieldRule_GrowingMin = FieldRule{
 }
 
 func fieldRule_GrowingMin_func(old, new *schema.Schema, mc MessageContext) string {
+	// ignore for added / removed fields
+	if old == nil || new == nil {
+		return ""
+	}
 	message := mc.message
 	if old.MinItems < new.MinItems {
 		oldMin := fmt.Sprint(old.MinItems)
@@ -172,6 +196,10 @@ var fieldRule_ShrinkingMax = FieldRule{
 }
 
 func fieldRule_ShrinkingMax_func(old, new *schema.Schema, mc MessageContext) string {
+	// ignore for added / removed fields
+	if old == nil || new == nil {
+		return ""
+	}
 	message := mc.message
 	if old.MaxItems > new.MaxItems {
 		oldMax := fmt.Sprint(old.MinItems)
diff --git a/tools/diff-processor/rules/rules_field_test.go b/tools/diff-processor/rules/rules_field_test.go
index 1b485d62c195..e19fd13cbc4f 100644
--- a/tools/diff-processor/rules/rules_field_test.go
+++ b/tools/diff-processor/rules/rules_field_test.go
@@ -71,6 +71,25 @@ var fieldRule_BecomingRequiredTestCases = []fieldTestCase{
 		},
 		expectedViolation: true,
 	},
+	{
+		// TODO: detect this as violation b/300515447
+		name:     "field added as required",
+		oldField: nil,
+		newField: &schema.Schema{
+			Description: "beep",
+			Required:    true,
+		},
+		expectedViolation: false,
+	},
+	{
+		name: "field removed",
+		oldField: &schema.Schema{
+			Description: "beep",
+			Optional:    true,
+		},
+		newField:          nil,
+		expectedViolation: false,
+	},
 }
 
 // !! min max ?
@@ -93,6 +112,22 @@ var fieldRule_ChangingTypeTestCases = []fieldTestCase{
 		},
 		expectedViolation: false,
 	},
+	{
+		name:     "field added",
+		oldField: nil,
+		newField: &schema.Schema{
+			Type: schema.TypeBool,
+		},
+		expectedViolation: false,
+	},
+	{
+		name: "field removed",
+		oldField: &schema.Schema{
+			Type: schema.TypeBool,
+		},
+		newField:          nil,
+		expectedViolation: false,
+	},
 	{
 		name: "field sub-element type control",
 		oldField: &schema.Schema{
@@ -222,6 +257,22 @@ var fieldRule_DefaultModificationTestCases = []fieldTestCase{
 		},
 		expectedViolation: true,
 	},
+	{
+		name:     "field added",
+		oldField: nil,
+		newField: &schema.Schema{
+			Default: "same",
+		},
+		expectedViolation: false,
+	},
+	{
+		name: "field removed",
+		oldField: &schema.Schema{
+			Default: "same",
+		},
+		newField:          nil,
+		expectedViolation: false,
+	},
 }
 
 func TestFieldRule_BecomingComputedOnly(t *testing.T) {
@@ -294,6 +345,22 @@ var fieldRule_BecomingComputedOnlyTestCases = []fieldTestCase{
 		},
 		expectedViolation: true,
 	},
+	{
+		name:     "added computed field",
+		oldField: nil,
+		newField: &schema.Schema{
+			Computed: true,
+		},
+		expectedViolation: false,
+	},
+	{
+		name: "removed computed field",
+		oldField: &schema.Schema{
+			Computed: true,
+		},
+		newField:          nil,
+		expectedViolation: false,
+	},
 }
 
 func TestFieldRule_OptionalComputedToOptional(t *testing.T) {
@@ -336,6 +403,23 @@ var fieldRule_OptionalComputedToOptionalTestCases = []fieldTestCase{
 		},
 		expectedViolation: true,
 	},
+	{
+		name:     "field added",
+		oldField: nil,
+		newField: &schema.Schema{
+			Optional: true,
+		},
+		expectedViolation: false,
+	},
+	{
+		name: "field removed",
+		oldField: &schema.Schema{
+			Optional: true,
+			Computed: true,
+		},
+		newField:          nil,
+		expectedViolation: false,
+	},
 }
 
 func TestFieldRule_GrowingMin(t *testing.T) {
@@ -381,6 +465,22 @@ var fieldRule_GrowingMinTestCases = []fieldTestCase{
 		},
 		expectedViolation: true,
 	},
+	{
+		name:     "field added",
+		oldField: nil,
+		newField: &schema.Schema{
+			MaxItems: 1,
+		},
+		expectedViolation: false,
+	},
+	{
+		name: "field removed",
+		oldField: &schema.Schema{
+			MinItems: 1,
+		},
+		newField:          nil,
+		expectedViolation: false,
+	},
 }
 
 func TestFieldRule_ShrinkingMax(t *testing.T) {
@@ -426,6 +526,22 @@ var fieldRule_ShrinkingMaxTestCases = []fieldTestCase{
 		},
 		expectedViolation: true,
 	},
+	{
+		name:     "field added",
+		oldField: nil,
+		newField: &schema.Schema{
+			MaxItems: 2,
+		},
+		expectedViolation: false,
+	},
+	{
+		name: "field removed",
+		oldField: &schema.Schema{
+			MinItems: 2,
+		},
+		newField:          nil,
+		expectedViolation: false,
+	},
 }
 
 func (tc *fieldTestCase) check(rule FieldRule, t *testing.T) {
diff --git a/tools/diff-processor/rules/rules_resource_inventory.go b/tools/diff-processor/rules/rules_resource_inventory.go
index 8e1d6083f50c..f3664625725e 100644
--- a/tools/diff-processor/rules/rules_resource_inventory.go
+++ b/tools/diff-processor/rules/rules_resource_inventory.go
@@ -15,7 +15,7 @@ type ResourceInventoryRule struct {
 	definition  string
 	message     string
 	identifier  string
-	isRuleBreak func(old, new map[string]*schema.Resource) []string
+	isRuleBreak func(old, new *schema.Resource) bool
 }
 
 // ResourceInventoryRules is a list of ResourceInventoryRule
@@ -27,18 +27,11 @@ var resourceInventoryRule_RemovingAResource = ResourceInventoryRule{
 	definition:  "In terraform resources should be retained whenever possible. A removable of an resource will result in a configuration breakage wherever a dependency on that resource exists. Renaming or Removing a resources are functionally equivalent in terms of configuration breakages.",
 	message:     "Resource {{resource}} was either removed or renamed",
 	identifier:  "resource-map-resource-removal-or-rename",
-	isRuleBreak: resourceInventoryRule_RemovingAField_func,
+	isRuleBreak: resourceInventoryRule_RemovingAResource_func,
 }
 
-func resourceInventoryRule_RemovingAField_func(old, new map[string]*schema.Resource) []string {
-	keysNotPresent := []string{}
-	for key := range old {
-		_, exists := new[key]
-		if !exists {
-			keysNotPresent = append(keysNotPresent, key)
-		}
-	}
-	return keysNotPresent
+func resourceInventoryRule_RemovingAResource_func(old, new *schema.Resource) bool {
+	return new == nil && old != nil
 }
 
 func resourceInventoryRulesToRuleArray(rms []ResourceInventoryRule) []Rule {
@@ -73,15 +66,6 @@ func (rm ResourceInventoryRule) Message(resource string) string {
 	return msg + documentationReference(rm.identifier)
 }
 
-// IsRuleBreak - compares resource entries and returns
-// a list of resources violating the rule
-func (rm ResourceInventoryRule) IsRuleBreak(old, new map[string]*schema.Resource) []string {
-	if rm.isRuleBreak == nil {
-		return []string{}
-	}
-	return rm.isRuleBreak(old, new)
-}
-
 // Undetectable - informs if there are functions in place
 // to detect this rule.
 func (rm ResourceInventoryRule) Undetectable() bool {
diff --git a/tools/diff-processor/rules/rules_resource_inventory_test.go b/tools/diff-processor/rules/rules_resource_inventory_test.go
index d8a33167f552..2bc309bfdda4 100644
--- a/tools/diff-processor/rules/rules_resource_inventory_test.go
+++ b/tools/diff-processor/rules/rules_resource_inventory_test.go
@@ -7,10 +7,10 @@ import (
 )
 
 type resourceInventoryTestCase struct {
-	name               string
-	oldResourceMap     map[string]*schema.Resource
-	newResourceMap     map[string]*schema.Resource
-	expectedViolations int
+	name     string
+	old      *schema.Resource
+	new      *schema.Resource
+	expected bool
 }
 
 func TestResourceInventoryRule_RemovingAResource(t *testing.T) {
@@ -21,113 +21,28 @@ func TestResourceInventoryRule_RemovingAResource(t *testing.T) {
 
 var resourceInventoryRule_RemovingAResourceTestCases = []resourceInventoryTestCase{
 	{
-		name: "control",
-		oldResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Optional: true},
-					"field-b": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		newResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Optional: true},
-					"field-b": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		expectedViolations: 0,
+		name:     "control",
+		old:      &schema.Resource{},
+		new:      &schema.Resource{},
+		expected: false,
 	},
 	{
-		name: "adding a resource",
-		oldResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Optional: true},
-					"field-b": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		newResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Optional: true},
-					"field-b": {Description: "beep", Optional: true},
-				},
-			},
-			"google-y": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		expectedViolations: 0,
+		name:     "resource added",
+		old:      nil,
+		new:      &schema.Resource{},
+		expected: false,
 	},
 	{
-		name: "resource missing",
-		oldResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep"},
-					"field-b": {Description: "beep"},
-				},
-			},
-		},
-		newResourceMap:     map[string]*schema.Resource{},
-		expectedViolations: 1,
-	},
-	{
-		name: "resource renamed",
-		oldResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Optional: true},
-					"field-b": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		newResourceMap: map[string]*schema.Resource{
-			"google-y": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Optional: true},
-					"field-b": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		expectedViolations: 1,
-	},
-	{
-		name: "resource renamed and another removed",
-		oldResourceMap: map[string]*schema.Resource{
-			"google-x": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Optional: true},
-					"field-b": {Description: "beep", Optional: true},
-				},
-			},
-			"google-z": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		newResourceMap: map[string]*schema.Resource{
-			"google-y": {
-				Schema: map[string]*schema.Schema{
-					"field-a": {Description: "beep", Optional: true},
-					"field-b": {Description: "beep", Optional: true},
-				},
-			},
-		},
-		expectedViolations: 2,
+		name:     "resource removed",
+		old:      &schema.Resource{},
+		new:      nil,
+		expected: true,
 	},
 }
 
 func (tc *resourceInventoryTestCase) check(rule ResourceInventoryRule, t *testing.T) {
-	violations := rule.isRuleBreak(tc.oldResourceMap, tc.newResourceMap)
-	if tc.expectedViolations != len(violations) {
-		t.Errorf("Test `%s` failed: expected %d violations, got %d", tc.name, tc.expectedViolations, len(violations))
+	got := rule.isRuleBreak(tc.old, tc.new)
+	if tc.expected != got {
+		t.Errorf("Test `%s` failed: want %t, got %t", tc.name, tc.expected, got)
 	}
 }
diff --git a/tools/diff-processor/rules/rules_resource_schema.go b/tools/diff-processor/rules/rules_resource_schema.go
index 3929238afc94..68ce9ea43650 100644
--- a/tools/diff-processor/rules/rules_resource_schema.go
+++ b/tools/diff-processor/rules/rules_resource_schema.go
@@ -4,7 +4,7 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/GoogleCloudPlatform/magic-modules/tools/diff-processor/diff"
 )
 
 // ResourceSchemaRule provides structure for
@@ -14,7 +14,7 @@ type ResourceSchemaRule struct {
 	definition  string
 	message     string
 	identifier  string
-	isRuleBreak func(old, new map[string]*schema.Schema) []string
+	isRuleBreak func(resourceDiff diff.ResourceDiff) []string
 }
 
 // ResourceSchemaRules is a list of ResourceInventoryRule
@@ -41,15 +41,14 @@ var resourceSchemaRule_RemovingAField = ResourceSchemaRule{
 	isRuleBreak: resourceSchemaRule_RemovingAField_func,
 }
 
-func resourceSchemaRule_RemovingAField_func(old, new map[string]*schema.Schema) []string {
-	keysNotPresent := []string{}
-	for key := range old {
-		_, exists := new[key]
-		if !exists {
-			keysNotPresent = append(keysNotPresent, key)
+func resourceSchemaRule_RemovingAField_func(resourceDiff diff.ResourceDiff) []string {
+	fieldsRemoved := []string{}
+	for field, fieldDiff := range resourceDiff.Fields {
+		if fieldDiff.Old != nil && fieldDiff.New == nil {
+			fieldsRemoved = append(fieldsRemoved, field)
 		}
 	}
-	return keysNotPresent
+	return fieldsRemoved
 }
 
 func resourceSchemaRulesToRuleArray(rss []ResourceSchemaRule) []Rule {
@@ -88,11 +87,11 @@ func (rs ResourceSchemaRule) Message(resource, field string) string {
 
 // IsRuleBreak - compares the field entries and returns
 // a list of fields violating the rule
-func (rs ResourceSchemaRule) IsRuleBreak(old, new map[string]*schema.Schema) []string {
+func (rs ResourceSchemaRule) IsRuleBreak(resourceDiff diff.ResourceDiff) []string {
 	if rs.isRuleBreak == nil {
 		return []string{}
 	}
-	return rs.isRuleBreak(old, new)
+	return rs.isRuleBreak(resourceDiff)
 }
 
 // Undetectable - informs if there are functions in place
diff --git a/tools/diff-processor/rules/rules_resource_schema_test.go b/tools/diff-processor/rules/rules_resource_schema_test.go
index 01d40676649d..da8b488bf69e 100644
--- a/tools/diff-processor/rules/rules_resource_schema_test.go
+++ b/tools/diff-processor/rules/rules_resource_schema_test.go
@@ -3,6 +3,9 @@ package rules
 import (
 	"testing"
 
+	"github.com/GoogleCloudPlatform/magic-modules/tools/diff-processor/diff"
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 )
 
@@ -13,77 +16,70 @@ func TestResourceSchemaRule_RemovingAField(t *testing.T) {
 }
 
 type resourceSchemaTestCase struct {
-	name               string
-	oldResourceSchema  map[string]*schema.Schema
-	newResourceSchema  map[string]*schema.Schema
-	expectedViolations int
+	name           string
+	resourceDiff   diff.ResourceDiff
+	expectedFields []string
 }
 
 var resourceSchemaRule_RemovingAField_TestCases = []resourceSchemaTestCase{
 	{
 		name: "control",
-		oldResourceSchema: map[string]*schema.Schema{
-			"field-a": {Description: "beep", Optional: true},
-			"field-b": {Description: "beep", Optional: true},
+		resourceDiff: diff.ResourceDiff{
+			Fields: map[string]diff.FieldDiff{
+				"field-a": diff.FieldDiff{
+					Old: &schema.Schema{Description: "beep", Optional: true},
+					New: &schema.Schema{Description: "beep", Optional: true},
+				},
+			},
 		},
-		newResourceSchema: map[string]*schema.Schema{
-			"field-a": {Description: "beep", Optional: true},
-			"field-b": {Description: "beep", Optional: true},
-		},
-		expectedViolations: 0,
+		expectedFields: []string{},
 	},
 	{
 		name: "adding a field",
-		oldResourceSchema: map[string]*schema.Schema{
-			"field-a": {Description: "beep", Optional: true},
-			"field-b": {Description: "beep", Optional: true},
-		},
-		newResourceSchema: map[string]*schema.Schema{
-			"field-a": {Description: "beep", Optional: true},
-			"field-b": {Description: "beep", Optional: true},
-			"field-c": {Description: "beep", Optional: true},
-		},
-		expectedViolations: 0,
-	},
-	{
-		name: "renaming a field",
-		oldResourceSchema: map[string]*schema.Schema{
-			"field-a": {Description: "beep", Optional: true},
-			"field-b": {Description: "beep", Optional: true},
-		},
-		newResourceSchema: map[string]*schema.Schema{
-			"field-a": {Description: "beep", Optional: true},
-			"field-d": {Description: "beep", Optional: true},
+		resourceDiff: diff.ResourceDiff{
+			Fields: map[string]diff.FieldDiff{
+				"field-a": diff.FieldDiff{
+					Old: nil,
+					New: &schema.Schema{Description: "beep", Optional: true},
+				},
+			},
 		},
-		expectedViolations: 1,
+		expectedFields: []string{},
 	},
 	{
 		name: "removing a field",
-		oldResourceSchema: map[string]*schema.Schema{
-			"field-a": {Description: "beep", Optional: true},
-			"field-b": {Description: "beep", Optional: true},
+		resourceDiff: diff.ResourceDiff{
+			Fields: map[string]diff.FieldDiff{
+				"field-a": diff.FieldDiff{
+					Old: &schema.Schema{Description: "beep", Optional: true},
+					New: nil,
+				},
+			},
 		},
-		newResourceSchema: map[string]*schema.Schema{
-			"field-a": {Description: "beep", Optional: true},
-		},
-		expectedViolations: 1,
+		expectedFields: []string{"field-a"},
 	},
 	{
-		name: "renaming a field and removing a field",
-		oldResourceSchema: map[string]*schema.Schema{
-			"field-a": {Description: "beep", Optional: true},
-			"field-b": {Description: "beep", Optional: true},
-		},
-		newResourceSchema: map[string]*schema.Schema{
-			"field-z": {Description: "beep", Optional: true},
+		name: "removing multiple fields",
+		resourceDiff: diff.ResourceDiff{
+			Fields: map[string]diff.FieldDiff{
+				"field-a": diff.FieldDiff{
+					Old: &schema.Schema{Description: "beep", Optional: true},
+					New: nil,
+				},
+				"field-b": diff.FieldDiff{
+					Old: &schema.Schema{Description: "beep", Optional: true},
+					New: nil,
+				},
+			},
 		},
-		expectedViolations: 2,
+		expectedFields: []string{"field-a", "field-b"},
 	},
 }
 
 func (tc *resourceSchemaTestCase) check(rule ResourceSchemaRule, t *testing.T) {
-	violations := rule.isRuleBreak(tc.oldResourceSchema, tc.newResourceSchema)
-	if tc.expectedViolations != len(violations) {
-		t.Errorf("Test `%s` failed: expected %d violations, got %d", tc.name, tc.expectedViolations, len(violations))
+	fields := rule.IsRuleBreak(tc.resourceDiff)
+	less := func(a, b string) bool { return a < b }
+	if !cmp.Equal(fields, tc.expectedFields, cmpopts.SortSlices(less)) {
+		t.Errorf("Test `%s` failed: wanted %v , got %v", tc.name, tc.expectedFields, fields)
 	}
 }
diff --git a/tools/diff-processor/rules/utility.go b/tools/diff-processor/rules/utility.go
index 43437a6e579c..78e82b63fcb8 100644
--- a/tools/diff-processor/rules/utility.go
+++ b/tools/diff-processor/rules/utility.go
@@ -3,7 +3,7 @@ package rules
 import (
 	"fmt"
 
-	"github.com/GoogleCloudPlatform/magic-modules/.ci/diff-processor/constants"
+	"github.com/GoogleCloudPlatform/magic-modules/tools/diff-processor/constants"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 )
 
diff --git a/tools/go-changelog/cmd/changelog-pr-body-check/main.go b/tools/go-changelog/cmd/changelog-pr-body-check/main.go
index 5fdaa3304796..af317b1ed838 100644
--- a/tools/go-changelog/cmd/changelog-pr-body-check/main.go
+++ b/tools/go-changelog/cmd/changelog-pr-body-check/main.go
@@ -63,7 +63,7 @@ func main() {
 		case changelog.EntryErrorNotFound:
 			body := "Oops! It looks like no changelog entry is attached to" +
 				" this PR. Please include a release note block" +
-				" in the PR body, as described in https://github.com/GoogleCloudPlatform/magic-modules/blob/master/.ci/RELEASE_NOTES_GUIDE.md:" +
+				" in the PR body, as described in https://googlecloudplatform.github.io/magic-modules/contribute/release-notes/:" +
 				"\n\n~~~\n```release-note:TYPE\nRelease note" +
 				"\n```\n~~~"
 			log.Fatal(body)
@@ -82,7 +82,7 @@ func main() {
 			for _, t := range unknownTypes {
 				body += "\n* " + t
 			}
-			body += "\n\nPlease only use the types listed in https://github.com/GoogleCloudPlatform/magic-modules/blob/master/.ci/RELEASE_NOTES_GUIDE.md."
+			body += "\n\nPlease only use the types listed in https://googlecloudplatform.github.io/magic-modules/contribute/release-notes/."
 			log.Fatal(body)
 		}
 	}
diff --git a/tools/issue-labeler/enrolled_teams.yml b/tools/issue-labeler/enrolled_teams.yml
deleted file mode 100755
index df594171ce30..000000000000
--- a/tools/issue-labeler/enrolled_teams.yml
+++ /dev/null
@@ -1,313 +0,0 @@
-service/accesscontextmanager:
-  resources:
-  - google_access_context_manager_.*
-service/aiplatform-metadata:
-  resources:
-  - google_vertex_ai_metadata_store
-service/alloydb:
-  resources:
-  - google_alloydb_.*
-service/apigateway:
-  resources:
-  - google_api_gateway_.*
-service/apigee:
-  resources:
-  - google_apigee_.*
-service/artifactregistry:
-  resources:
-  - google_artifact_registry_.*
-service/assuredworkloads:
-  resources:
-  - google_assured_workloads_workload
-service/beyondcorp:
-  resources:
-  - google_beyondcorp_.*
-service/bigquery:
-  team: bq-terraform-eng
-  resources:
-  - google_bigquery_.*
-service/bigtableadmin:
-  resources:
-  - google_bigtable_.*
-service/billingbudgets:
-  resources:
-  - google_billing_budget
-service/binaryauthorization:
-  resources:
-  - google_binary_authorization_.*
-service/certificatemanager:
-  resources:
-  - google_certificate_manager_.*
-service/cloudasset:
-  resources:
-  - google_cloud_asset_.*
-service/cloudbilling:
-  resources:
-  - google_billing_account.*
-  - google_billing_project_info
-  - google_billing_subaccount
-service/cloudbuild:
-  resources:
-  - google_cloudbuild_.*
-  - google_cloudbuildv2_.*
-service/clouddeploy:
-  resources:
-  - google_clouddeploy_.*
-service/cloudfunctions:
-  resources:
-  - google_cloudfunctions_.*
-  - google_cloudfunctions2_.*
-service/cloudkms:
-  resources:
-  - google_kms_.*
-service/cloudscheduler:
-  resources:
-  - google_cloud_scheduler_.*
-service/cloudtasks:
-  resources:
-  - google_cloud_tasks_.*
-service/composer:
-  resources:
-  - google_composer_.*
-service/compute-interconnect:
-  resources:
-  - google_compute_interconnect_.*
-service/compute-nat:
-  resources:
-  - google_compute_router_nat
-service/compute-regional-l7-load-balancer:
-  resources:
-  - google_compute_region_target_http_proxy
-  - google_compute_region_target_https_proxy
-service/compute-router:
-  resources:
-  - google_compute_router
-  - google_compute_router_interface
-  - google_compute_router_peer
-  - google_compute_router_status
-service/compute-security-policy:
-  resources:
-  - google_compute_security_policy
-service/container:
-  resources:
-  - google_container_cluster
-  - google_container_engine_versions
-  - google_container_node_pool
-service/containeranalysis:
-  resources:
-  - google_container_analysis_.*
-service/datacatalog:
-  resources:
-  - google_data_catalog_.*
-service/dataform:
-  resources:
-  - google_dataform_.*
-service/dataproc:
-  resources:
-  - google_dataproc_cluster
-  - google_dataproc_autoscaling_policy
-  - google_dataproc_job
-  - google_dataproc_workflow_template
-  - google_dataproc_batch
-service/datastream:
-  resources:
-  - google_datastream_.*
-service/deploymentmanager:
-  resources:
-  - google_deployment_manager_.*
-  - google_runtimeconfig_.*
-service/dialogflow:
-  resources:
-  - google_dialogflow_.*
-service/dlp:
-  resources:
-  - google_data_loss_prevention_.*
-service/documentai:
-  resources:
-  - google_document_ai_processor.*
-service/documentaiwarehouse:
-  resources:
-  - google_document_ai_warehouse_.*
-service/edgenetwork:
-  resources:
-  - google_edgenetwork_.*
-service/endpoints:
-  resources:
-  - google_endpoints_.*
-service/essentialcontacts:
-  resources:
-  - google_essential_contacts_.*
-service/eventarc:
-  resources:
-  - google_eventarc_.*
-service/filestore:
-  resources:
-  - google_filestore_.*
-service/firebase:
-  resources:
-  - google_firebase_.*
-  - google_firebaserules_.*
-service/firestore-controlplane:
-  resources:
-  - google_firestore_database
-service/firestore-dataplane:
-  resources:
-  - google_datastore_index
-  - google_firestore_document
-  - google_firestore_field
-  - google_firestore_index
-  - google_firestore_ttl
-service/gkebackup:
-  resources:
-  - google_gke_backup_.*
-service/gkehub:
-  resources:
-  - google_gke_hub_.*
-service/gkemulticloud:
-  resources:
-  - google_container_aws_.*
-  - google_container_azure_.*
-  - google_container_attached_.*
-service/gkeonprem:
-  resources:
-  - google_gkeonprem_.*
-service/healthcare:
-  resources:
-  - google_healthcare_.*
-service/iam-core:
-  resources:
-  - google_organization_iam_custom_role
-  - google_project_iam_custom_role
-  - google_iam_deny_policy
-  - google_iam_policy
-  - google_iam_role
-  - google_iam_testable_permissions
-service/iam-serviceaccount:
-  resources:
-  - google_project_default_service_accounts
-  - google_project_service_identity
-  - google_service_account.*
-service/iam-wlid:
-  resources:
-  - google_iam_access_boundary_policy
-  - google_iam_workload_identity_pool
-  - google_iam_workload_identity_pool_provider
-service/iam-workforce:
-  resources:
-  - google_iam_workforce_pool.*
-service/iap:
-  resources:
-  - google_iap_.*
-service/identitytoolkit:
-  resources:
-  - google_identity_platform_.*
-service/ids:
-  resources:
-  - google_cloud_ids_.*
-service/logging:
-  resources:
-  - google_logging_.*
-service/looker-core:
-  resources:
-  - google_looker_instance
-service/managedidentities:
-  resources:
-  - google_active_directory_.*
-service/memcache:
-  resources:
-  - google_memcache_instance
-service/metastore:
-  resources:
-  - google_dataproc_metastore_.*
-service/monitoring-alerting:
-  resources:
-  - google_monitoring_notification_channel
-  - google_monitoring_alert_policy
-service/monitoring-metrics:
-  resources:
-  - google_monitoring_metric_descriptor
-  - google_monitoring_group
-service/monitoring-services:
-  resources:
-  - google_monitoring_custom_service
-  - google_monitoring_dashboard
-  - google_monitoring_monitored_project
-  - google_monitoring_slo
-  - google_monitoring_service
-  - google_monitoring_app_engine_service
-  - google_monitoring_cluster_istio_service
-  - google_monitoring_istio_canonical_service
-  - google_monitoring_mesh_istio_service
-  - google_monitoring_istio_canonical_service
-service/monitoring-uptime:
-  resources:
-  - google_monitoring_uptime_.*
-service/notebooks:
-  resources:
-  - google_notebooks_.*
-service/orgpolicy:
-  resources:
-  - google_org_policy_.*
-service/osconfig:
-  resources:
-  - google_os_config_.*
-service/privateca:
-  resources:
-  - google_privateca_.*
-service/publicca:
-  resources:
-  - google_public_ca_external_account_key
-service/pubsub:
-  resources:
-  - google_pubsub_schema
-  - google_pubsub_subscription.*
-  - google_pubsub_topic.*
-service/pubsublite:
-  resources:
-  - google_pubsub_lite_.*
-service/redis-cluster:
-  resources:
-  - google_redis_cluster
-service/redis-instance:
-  resources:
-  - google_redis_instance
-service/run:
-  resources:
-  - google_cloud_run_.*
-  - google_cloud_run_v2_.*
-service/secretmanager:
-  resources:
-  - google_secret_manager_.*
-service/sourcerepo:
-  resources:
-  - google_sourcerepo_.*
-service/spanner:
-  resources:
-  - google_spanner_.*
-service/sqladmin:
-  resources:
-  - google_sql_.*
-service/storage:
-  resources:
-  - google_storage_bucket.*
-  - google_storage_default_object_.*
-  - google_storage_hmac_key
-  - google_storage_notification
-  - google_storage_object_.*
-  - google_storage_project_service_account
-  - google_storage_transfer_agent_pool
-  - google_storage_transfer_job
-service/vmwareengine:
-  resources:
-  - google_vmwareengine_network
-  - google_vmwareengine_private_cloud
-  - google_vmwareengine_cluster
-service/websecurityscanner:
-  resources:
-  - google_security_scanner_.*
-service/workflows:
-  resources:
-  - google_workflows.*
-service/workstations:
-  resources:
-  - google_workstations_.*
\ No newline at end of file
diff --git a/tools/issue-labeler/go.mod b/tools/issue-labeler/go.mod
index 4a4ba3345cd4..d0e17c929f42 100644
--- a/tools/issue-labeler/go.mod
+++ b/tools/issue-labeler/go.mod
@@ -1,4 +1,4 @@
-module github.com/GoogleCloudPlatform/magic-modules/issue-labeler/tools/issue-labeler
+module github.com/GoogleCloudPlatform/magic-modules/tools/issue-labeler
 
 go 1.19
 
diff --git a/tools/issue-labeler/backfill.go b/tools/issue-labeler/labeler/backfill.go
similarity index 81%
rename from tools/issue-labeler/backfill.go
rename to tools/issue-labeler/labeler/backfill.go
index e5cb8f4b728a..12db0cc04238 100644
--- a/tools/issue-labeler/backfill.go
+++ b/tools/issue-labeler/labeler/backfill.go
@@ -1,4 +1,4 @@
-package main
+package labeler
 
 import (
 	"bytes"
@@ -17,7 +17,7 @@ type ErrorResponse struct {
 }
 
 type Issue struct {
-	Number      int
+	Number      uint64
 	Body        string
 	Labels      []Label
 	PullRequest map[string]any `json:"pull_request"`
@@ -28,7 +28,7 @@ type Label struct {
 }
 
 type IssueUpdate struct {
-	Number    int
+	Number    uint64
 	Labels    []string
 	OldLabels []string
 }
@@ -37,13 +37,13 @@ type IssueUpdateBody struct {
 	Labels []string `json:"labels"`
 }
 
-func getIssues(since string) []Issue {
+func GetIssues(repository, since string) []Issue {
 	client := &http.Client{}
 	done := false
 	page := 1
 	var issues []Issue
 	for !done {
-		url := fmt.Sprintf("https://api.github.com/repos/hashicorp/terraform-provider-google/issues?since=%s&per_page=100&page=%d", since, page)
+		url := fmt.Sprintf("https://api.github.com/repos/%s/issues?since=%s&per_page=100&page=%d", repository, since, page)
 		req, err := http.NewRequest("GET", url, nil)
 		if err != nil {
 			glog.Exitf("Error creating request: %v", err)
@@ -78,7 +78,7 @@ func getIssues(since string) []Issue {
 	return issues
 }
 
-func computeIssueUpdates(issues []Issue, regexpLabels []regexpLabel) []IssueUpdate {
+func ComputeIssueUpdates(issues []Issue, regexpLabels []RegexpLabel) []IssueUpdate {
 	var issueUpdates []IssueUpdate
 
 	for _, issue := range issues {
@@ -103,8 +103,8 @@ func computeIssueUpdates(issues []Issue, regexpLabels []regexpLabel) []IssueUpda
 			issueUpdate.OldLabels = append(issueUpdate.OldLabels, label)
 		}
 
-		affectedResources := extractAffectedResources(issue.Body)
-		for _, needed := range computeLabels(affectedResources, regexpLabels) {
+		affectedResources := ExtractAffectedResources(issue.Body)
+		for _, needed := range ComputeLabels(affectedResources, regexpLabels) {
 			desired[needed] = struct{}{}
 		}
 
@@ -126,10 +126,10 @@ func computeIssueUpdates(issues []Issue, regexpLabels []regexpLabel) []IssueUpda
 	return issueUpdates
 }
 
-func updateIssues(issueUpdates []IssueUpdate, dryRun bool) {
+func UpdateIssues(repository string, issueUpdates []IssueUpdate, dryRun bool) {
 	client := &http.Client{}
 	for _, issueUpdate := range issueUpdates {
-		url := fmt.Sprintf("https://api.github.com/repos/hashicorp/terraform-provider-google/issues/%d", issueUpdate.Number)
+		url := fmt.Sprintf("https://api.github.com/repos/%s/issues/%d", repository, issueUpdate.Number)
 		updateBody := IssueUpdateBody{Labels: issueUpdate.Labels}
 		body, err := json.Marshal(updateBody)
 		if err != nil {
@@ -146,7 +146,7 @@ func updateIssues(issueUpdates []IssueUpdate, dryRun bool) {
 		}
 		fmt.Printf("Existing labels: %v\n", issueUpdate.OldLabels)
 		fmt.Printf("New labels: %v\n", issueUpdate.Labels)
-		fmt.Printf("%s %s (https://github.com/hashicorp/terraform-provider-google/issues/%d)\n", req.Method, req.URL, issueUpdate.Number)
+		fmt.Printf("%s %s (https://github.com/%s/issues/%d)\n", req.Method, req.URL, repository, issueUpdate.Number)
 		b, err := json.MarshalIndent(updateBody, "", "  ")
 		if err != nil {
 			glog.Errorf("Error marshalling json: %v", err)
@@ -167,8 +167,11 @@ func updateIssues(issueUpdates []IssueUpdate, dryRun bool) {
 			var errResp ErrorResponse
 			json.Unmarshal(body, &errResp)
 			if errResp.Message != "" {
-				glog.Infof("API error: %s", errResp.Message)
+				fmt.Printf("API error: %s", errResp.Message)
+				continue
 			}
+
 		}
+		fmt.Printf("GitHub Issue %s %d updated successfully", repository, issueUpdate.Number)
 	}
 }
diff --git a/tools/issue-labeler/backfill_test.go b/tools/issue-labeler/labeler/backfill_test.go
similarity index 96%
rename from tools/issue-labeler/backfill_test.go
rename to tools/issue-labeler/labeler/backfill_test.go
index 41c00f2304cf..c58e7f14b8e6 100644
--- a/tools/issue-labeler/backfill_test.go
+++ b/tools/issue-labeler/labeler/backfill_test.go
@@ -1,4 +1,4 @@
-package main
+package labeler
 
 import (
 	"fmt"
@@ -20,7 +20,7 @@ func testIssueBodyWithResources(resources []string) string {
 }
 
 func TestComputeIssueUpdates(t *testing.T) {
-	defaultRegexpLabels := []regexpLabel{
+	defaultRegexpLabels := []RegexpLabel{
 		{
 			Regexp: regexp.MustCompile("google_service1_.*"),
 			Label:  "service/service1",
@@ -36,7 +36,7 @@ func TestComputeIssueUpdates(t *testing.T) {
 	}
 	cases := map[string]struct {
 		issues               []Issue
-		regexpLabels         []regexpLabel
+		regexpLabels         []RegexpLabel
 		expectedIssueUpdates []IssueUpdate
 	}{
 		"no issues -> no updates": {
@@ -160,7 +160,7 @@ func TestComputeIssueUpdates(t *testing.T) {
 		tc := tc
 		t.Run(tn, func(t *testing.T) {
 			t.Parallel()
-			issueUpdates := computeIssueUpdates(tc.issues, tc.regexpLabels)
+			issueUpdates := ComputeIssueUpdates(tc.issues, tc.regexpLabels)
 			// reflect.DeepEqual treats nil & empty slices as not equal so ignore diffs if both slices are empty.
 			if (len(issueUpdates) > 0 || len(tc.expectedIssueUpdates) > 0) && !reflect.DeepEqual(issueUpdates, tc.expectedIssueUpdates) {
 				t.Errorf("Expected %v, got %v", tc.expectedIssueUpdates, issueUpdates)
diff --git a/tools/issue-labeler/labeler/enrolled_teams.yml b/tools/issue-labeler/labeler/enrolled_teams.yml
new file mode 100755
index 000000000000..2000516b8810
--- /dev/null
+++ b/tools/issue-labeler/labeler/enrolled_teams.yml
@@ -0,0 +1,542 @@
+service/accessapproval:
+  resources:
+  - google_organization_access_approval_settings
+  - google_folder_access_approval_settings
+  - google_project_access_approval_settings
+  - google_access_approval_.*
+service/accesscontextmanager:
+  resources:
+  - google_access_context_manager_.*
+service/aiplatform-dataset:
+  resources:
+  - google_vertex_ai_dataset
+service/aiplatform-featurestore:
+  resources:
+  - google_vertex_ai_featurestore.*
+service/aiplatform-matching-engine:
+  resources:
+  - google_vertex_ai_index.*
+service/aiplatform-metadata:
+  resources:
+  - google_vertex_ai_metadata_store
+service/aiplatform-prediction:
+  resources:
+  - google_vertex_ai_endpoint
+  - google_ml_engine_model
+service/aiplatform-tensorboard:
+  resources:
+  - google_vertex_ai_tensorboard
+service/alloydb:
+  resources:
+  - google_alloydb_.*
+service/apigateway:
+  resources:
+  - google_api_gateway_.*
+service/apigee:
+  resources:
+  - google_apigee_.*
+service/artifactregistry:
+  resources:
+  - google_artifact_registry_.*
+service/assuredworkloads:
+  resources:
+  - google_assured_workloads_workload
+service/backupdr:
+  resources:
+  - google_backup_dr_.*
+service/beyondcorp:
+  resources:
+  - google_beyondcorp_.*
+service/bigquery:
+  team: bq-terraform-eng
+  resources:
+  - google_biglake_.*
+  - google_bigquery_.*
+service/bigtableadmin:
+  resources:
+  - google_bigtable_.*
+service/billingbudgets:
+  resources:
+  - google_billing_budget
+service/binaryauthorization:
+  resources:
+  - google_binary_authorization_.*
+service/certificatemanager:
+  resources:
+  - google_certificate_manager_.*
+  - google_compute_managed_ssl_certificate
+  - google_compute_region_ssl_certificate
+  - google_compute_ssl_certificate
+service/cloudasset:
+  resources:
+  - google_cloud_asset_.*
+service/cloudbilling:
+  resources:
+  - google_billing_account.*
+  - google_billing_project_info
+  - google_billing_subaccount
+service/cloudbuild:
+  resources:
+  - google_cloudbuild_.*
+  - google_cloudbuildv2_.*
+service/clouddeploy:
+  resources:
+  - google_clouddeploy_.*
+service/cloudfunctions:
+  resources:
+  - google_cloudfunctions_.*
+  - google_cloudfunctions2_.*
+service/cloudidentity-groups:
+  resources:
+  - google_cloud_identity_group.*
+service/cloudkms:
+  resources:
+  - google_kms_.*
+service/cloudresourcemanager-crm:
+  resources:
+  - google_folder
+  - google_folder_iam_.*
+  - google_folders
+  - google_project
+  - google_project_iam_.*
+  - google_projects
+  - google_organization
+  - google_organization_iam_.*
+  - google_resource_manager_lien
+service/cloudresourcemanager-tags:
+  resources:
+  - google_tags_.*
+service/cloudscheduler:
+  resources:
+  - google_cloud_scheduler_.*
+service/cloudtasks:
+  resources:
+  - google_cloud_tasks_.*
+service/composer:
+  resources:
+  - google_composer_.*
+service/compute-autoscaler:
+  resources:
+  - google_compute_autoscaler
+  - google_compute_region_autoscaler
+service/compute-commitment:
+  resources:
+  - google_compute_region_commitment.*
+service/compute-health:
+  resources:
+  - google_compute_health_check
+  - google_compute_http_health_check
+  - google_compute_https_health_check
+  - google_compute_region_health_check
+service/compute-instances:
+  resources:
+  - google_compute_instance
+  - google_compute_instance_from_.*
+  - google_compute_instance_iam.*
+  - google_compute_instance_template
+  - google_compute_region_instance_template
+  - google_compute_project_metadata.*
+  - google_compute_resource_policy
+service/compute-interconnect:
+  resources:
+  - google_compute_interconnect_.*
+service/compute-ipam:
+  resources:
+  - google_compute_address
+  - google_compute_global_address
+  - google_compute_public_advertised_prefix
+  - google_compute_public_delegated_prefix
+service/compute-l7-load-balancer:
+  resources:
+  - google_compute_backend_bucket
+  - google_compute_backend_bucket_signed_url_key
+  - google_compute_backend_service
+  - google_compute_backend_service_signed_url_key
+  - google_compute_region_backend_service
+  - google_compute_global_forwarding_rule
+  - google_compute_forwarding_rule
+  - google_compute_url_map
+  - google_compute_region_url_map
+  - google_compute_ssl_policy
+  - google_compute_region_ssl_policy
+  - google_compute_target_tcp_proxy
+  - google_compute_region_target_tcp_proxy
+  - google_compute_target_ssl_proxy
+  - google_compute_target_grpc_proxy
+  - google_compute_target_http_proxy
+  - google_compute_region_target_http_proxy
+  - google_compute_target_https_proxy
+  - google_compute_region_target_https_proxy
+service/compute-nat:
+  resources:
+  - google_compute_router_nat
+service/compute-network-peering:
+  resources:
+  - google_compute_network_peering.*
+service/compute-networking-ig:
+  resources:
+  - google_compute_instance_group
+  - google_compute_instance_group_named_port
+  - google_compute_region_instance_group
+service/compute-networking-neg:
+  resources:
+  - google_compute_global_network_endpoint.*
+  - google_compute_network_endpoint.*
+  - google_compute_region_network_endpoint.*
+service/compute-pd:
+  resources:
+  - google_compute_attached_disk.*
+  - google_compute_disk.*
+  - google_compute_region_disk.*
+  - google_compute_image.*
+  - google_compute_snapshot.*
+  - google_compute_machine_image.*
+service/compute-private-service-connect-published-service:
+  resources:
+  - google_compute_service_attachment
+service/compute-projects:
+  resources:
+  - google_project_usage_export_bucket
+service/compute-regional-pass-through-load-balancer:
+  resources:
+  - google_compute_target_instance
+  - google_compute_target_pool
+service/compute-reservation:
+  resources:
+  - google_compute_reservation.*
+service/compute-router:
+  resources:
+  - google_compute_router
+  - google_compute_router_interface
+  - google_compute_router_peer
+  - google_compute_router_status
+service/compute-security-policy:
+  resources:
+  - google_compute_network_edge_security_service
+  - google_compute_region_security_policy.*
+  - google_compute_security_policy
+service/compute-sole-tenancy:
+  resources:
+  - google_compute_node_group
+  - google_compute_node_template
+service/compute-vpc:
+  resources:
+  - google_compute_network
+  - google_compute_route
+  - google_compute_subnetwork
+  - google_compute_shared_vpc_host_project
+  - google_compute_shared_vpc_service_project
+  - google_compute_project_default_network_tier
+service/compute-vpn:
+  resources:
+  - google_compute_ha_vpn_gateway
+  - google_compute_external_vpn_gateway
+  - google_compute_vpn_.*
+service/container:
+  resources:
+  - google_container_cluster
+  - google_container_engine_versions
+  - google_container_node_pool
+service/containeranalysis:
+  resources:
+  - google_container_analysis_.*
+service/datacatalog:
+  resources:
+  - google_data_catalog_.*
+service/dataflow:
+  resources:
+  - google_dataflow_.*
+  - google_data_pipeline_pipeline
+service/dataform:
+  resources:
+  - google_dataform_.*
+service/datafusion:
+  resources:
+  - google_data_fusion_.*
+service/datamigration:
+  resources:
+  - google_database_migration_service_.*
+service/dataplex:
+  resources:
+  - google_dataplex_.*
+service/dataproc:
+  resources:
+  - google_dataproc_cluster
+  - google_dataproc_autoscaling_policy
+  - google_dataproc_job
+  - google_dataproc_workflow_template
+  - google_dataproc_batch
+service/datastream:
+  resources:
+  - google_datastream_.*
+service/deploymentmanager:
+  resources:
+  - google_deployment_manager_.*
+  - google_runtimeconfig_.*
+service/dialogflow:
+  resources:
+  - google_dialogflow_.*
+service/dlp:
+  resources:
+  - google_data_loss_prevention_.*
+service/documentai:
+  resources:
+  - google_document_ai_processor.*
+service/documentaiwarehouse:
+  resources:
+  - google_document_ai_warehouse_.*
+service/edgecontainer:
+  resources:
+  - google_edgecontainer_.*
+service/edgenetwork:
+  resources:
+  - google_edgenetwork_.*
+service/endpoints:
+  resources:
+  - google_endpoints_.*
+service/essentialcontacts:
+  resources:
+  - google_essential_contacts_.*
+service/eventarc:
+  resources:
+  - google_eventarc_.*
+service/filestore:
+  resources:
+  - google_filestore_.*
+service/firebase:
+  resources:
+  - google_firebase_.*
+  - google_firebaserules_.*
+service/firestore-controlplane:
+  resources:
+  - google_firestore_backup_schedule
+  - google_firestore_database
+service/firestore-dataplane:
+  resources:
+  - google_datastore_index
+  - google_firestore_document
+  - google_firestore_field
+  - google_firestore_index
+  - google_firestore_ttl
+service/gkebackup:
+  resources:
+  - google_gke_backup_.*
+service/gkehub:
+  resources:
+  - google_gke_hub_.*
+service/gkemulticloud:
+  resources:
+  - google_container_aws_.*
+  - google_container_azure_.*
+  - google_container_attached_.*
+service/gkeonprem:
+  resources:
+  - google_gkeonprem_.*
+service/healthcare:
+  resources:
+  - google_healthcare_.*
+service/iam-core:
+  resources:
+  - google_organization_iam_custom_role
+  - google_project_iam_custom_role
+  - google_iam_deny_policy
+  - google_iam_policy
+  - google_iam_role
+  - google_iam_testable_permissions
+service/iam-serviceaccount:
+  resources:
+  - google_project_default_service_accounts
+  - google_project_service_identity
+  - google_service_account.*
+service/iam-wlid:
+  resources:
+  - google_iam_access_boundary_policy
+  - google_iam_workload_identity_pool
+  - google_iam_workload_identity_pool_provider
+service/iam-workforce:
+  resources:
+  - google_iam_workforce_pool.*
+service/iap:
+  resources:
+  - google_iap_.*
+service/identitytoolkit:
+  resources:
+  - google_identity_platform_.*
+service/ids:
+  resources:
+  - google_cloud_ids_.*
+service/integrationconnectors:
+  resources:
+  - google_integration_connectors_.*
+service/logging:
+  resources:
+  - google_logging_.*
+service/looker-core:
+  resources:
+  - google_looker_instance
+service/managedidentities:
+  resources:
+  - google_active_directory_.*
+service/memcache:
+  resources:
+  - google_memcache_instance
+service/metastore:
+  resources:
+  - google_dataproc_metastore_.*
+service/monitoring-alerting:
+  resources:
+  - google_monitoring_notification_channel
+  - google_monitoring_alert_policy
+service/monitoring-metrics:
+  resources:
+  - google_monitoring_metric_descriptor
+  - google_monitoring_group
+service/monitoring-services:
+  resources:
+  - google_monitoring_custom_service
+  - google_monitoring_dashboard
+  - google_monitoring_monitored_project
+  - google_monitoring_slo
+  - google_monitoring_service
+  - google_monitoring_app_engine_service
+  - google_monitoring_cluster_istio_service
+  - google_monitoring_istio_canonical_service
+  - google_monitoring_mesh_istio_service
+  - google_monitoring_istio_canonical_service
+service/monitoring-uptime:
+  resources:
+  - google_monitoring_uptime_.*
+service/network-security:
+  resources:
+  - google_network_security_authorization_policy
+  - google_network_security_client_tls_policy
+  - google_network_security_gateway_security_policy
+  - google_network_security_gateway_security_policy_rule
+  - google_network_security_server_tls_policy
+  - google_network_security_tls_inspection_policy
+  - google_network_security_url_lists
+service/network-security-distributed-firewall:
+  resources:
+  - google_network_security_address_group
+  - google_compute_firewall.*
+  - google_compute_network_firewall_policy.*
+  - google_compute_organization_security_policy.*
+  - google_compute_region_network_firewall_policy.*
+service/networkconnectivity-serviceautomation:
+  resources:
+  - google_network_connectivity_service_.*
+service/networkmanagement-connectivity-test:
+  resources:
+  - google_network_management_connectivity_test
+service/networkservices-media-cdn:
+  resources:
+  - google_network_services_edge_cache_.*
+service/networkservices-traffic-director:
+  resources:
+  - google_network_services_endpoint_policy
+  - google_network_services_gateway
+  - google_network_services_grpc_route
+  - google_network_services_http_route
+  - google_network_services_mesh
+  - google_network_services_service_binding
+  - google_network_services_tcp_route
+  - google_network_services_tls_route
+  - google_network_security_authorization_policy
+  - google_network_security_client_tls_policy
+  - google_network_security_server_tls_policy
+service/notebooks:
+  resources:
+  - google_notebooks_.*
+service/orgpolicy:
+  resources:
+  - google_folder_organization_policy
+  - google_org_policy_.*
+  - google_organization_policy
+  - google_project_organization_policy
+service/osconfig:
+  resources:
+  - google_os_config_.*
+service/oslogin:
+  resources:
+  - google_os_login_.*
+service/policy-based-routing:
+  resources:
+  - google_network_connectivity_policy_based_route
+service/private-service-connect-interfaces:
+  resources:
+  - google_compute_network_attachment
+service/privateca:
+  resources:
+  - google_privateca_.*
+service/publicca:
+  resources:
+  - google_public_ca_external_account_key
+service/pubsub:
+  resources:
+  - google_pubsub_schema
+  - google_pubsub_subscription.*
+  - google_pubsub_topic.*
+service/pubsublite:
+  resources:
+  - google_pubsub_lite_.*
+service/recaptchaenterprise:
+  resources:
+  - google_recaptcha_enterprise_key
+service/redis-cluster:
+  resources:
+  - google_redis_cluster
+service/redis-instance:
+  resources:
+  - google_redis_instance
+service/run:
+  resources:
+  - google_cloud_run_.*
+  - google_cloud_run_v2_.*
+service/secretmanager:
+  resources:
+  - google_secret_manager_.*
+service/securitycenter:
+  resources:
+  - google_scc_.*
+service/service-networking:
+  resources:
+  - google_service_networking_connection
+  - google_service_networking_peered_dns_domain
+service/servicedirectory:
+  resources:
+  - google_service_directory_.*
+service/serviceusage-quota:
+  resources:
+  - google_service_usage_consumer_quota_override
+service/sourcerepo:
+  resources:
+  - google_sourcerepo_.*
+service/spanner:
+  resources:
+  - google_spanner_.*
+service/sqladmin:
+  resources:
+  - google_sql_.*
+service/storage:
+  resources:
+  - google_storage_.*
+service/tpu:
+  resources:
+  - google_tpu_.*
+service/vmwareengine:
+  resources:
+  - google_vmwareengine_network
+  - google_vmwareengine_private_cloud
+  - google_vmwareengine_cluster
+service/vpcaccess:
+  resources:
+  - google_vpc_access_connector
+service/websecurityscanner:
+  resources:
+  - google_security_scanner_.*
+service/workflows:
+  resources:
+  - google_workflows.*
+service/workstations:
+  resources:
+  - google_workstations_.*
diff --git a/tools/issue-labeler/labels.go b/tools/issue-labeler/labeler/labels.go
similarity index 75%
rename from tools/issue-labeler/labels.go
rename to tools/issue-labeler/labeler/labels.go
index b4fd8f233104..697bdb6f132f 100644
--- a/tools/issue-labeler/labels.go
+++ b/tools/issue-labeler/labeler/labels.go
@@ -1,4 +1,4 @@
-package main
+package labeler
 
 import (
 	"fmt"
@@ -6,6 +6,7 @@ import (
 	"sort"
 
 	_ "embed"
+
 	"github.com/golang/glog"
 	"gopkg.in/yaml.v2"
 )
@@ -16,7 +17,7 @@ var resourceRegexp = regexp.MustCompile(`google_[\w*.]+`)
 
 var (
 	//go:embed enrolled_teams.yml
-	enrolledTeamsYaml []byte
+	EnrolledTeamsYaml []byte
 )
 
 type labelData struct {
@@ -24,22 +25,23 @@ type labelData struct {
 	Resources []string `yaml:"resources"`
 }
 
-type regexpLabel struct {
+type RegexpLabel struct {
 	Regexp *regexp.Regexp
 	Label  string
 }
 
-func buildRegexLabels(teamsYaml []byte) ([]regexpLabel, error) {
+func BuildRegexLabels(teamsYaml []byte) ([]RegexpLabel, error) {
 	enrolledTeams := make(map[string]labelData)
-	regexpLabels := []regexpLabel{}
+	regexpLabels := []RegexpLabel{}
 	if err := yaml.Unmarshal(teamsYaml, &enrolledTeams); err != nil {
 		return regexpLabels, fmt.Errorf("Error unmarshalling enrolled teams yaml: %w", err)
 	}
 
 	for label, data := range enrolledTeams {
 		for _, resource := range data.Resources {
-			regexpLabels = append(regexpLabels, regexpLabel{
-				Regexp: regexp.MustCompile(resource),
+			exactResource := fmt.Sprintf("^%s$", resource)
+			regexpLabels = append(regexpLabels, RegexpLabel{
+				Regexp: regexp.MustCompile(exactResource),
 				Label:  label,
 			})
 		}
@@ -52,7 +54,7 @@ func buildRegexLabels(teamsYaml []byte) ([]regexpLabel, error) {
 	return regexpLabels, nil
 }
 
-func extractAffectedResources(body string) []string {
+func ExtractAffectedResources(body string) []string {
 	section := sectionRegexp.FindString(body)
 	section = commentRegexp.ReplaceAllString(section, "")
 	if section != "" {
@@ -62,7 +64,7 @@ func extractAffectedResources(body string) []string {
 	return []string{}
 }
 
-func computeLabels(resources []string, regexpLabels []regexpLabel) []string {
+func ComputeLabels(resources []string, regexpLabels []RegexpLabel) []string {
 	labelSet := make(map[string]struct{})
 	for _, resource := range resources {
 		for _, rl := range regexpLabels {
@@ -76,8 +78,8 @@ func computeLabels(resources []string, regexpLabels []regexpLabel) []string {
 
 	var labels []string
 
-	for l, _ := range labelSet {
-		labels = append(labels, l)
+	for label := range labelSet {
+		labels = append(labels, label)
 	}
 	sort.Strings(labels)
 
diff --git a/tools/issue-labeler/labels_test.go b/tools/issue-labeler/labeler/labels_test.go
similarity index 89%
rename from tools/issue-labeler/labels_test.go
rename to tools/issue-labeler/labeler/labels_test.go
index be1813938bc4..7161969dd8e9 100644
--- a/tools/issue-labeler/labels_test.go
+++ b/tools/issue-labeler/labeler/labels_test.go
@@ -1,4 +1,4 @@
-package main
+package labeler
 
 import (
 	"reflect"
@@ -35,7 +35,7 @@ func TestExtractAffectedResources(t *testing.T) {
 		tc := tc
 		t.Run(tn, func(t *testing.T) {
 			t.Parallel()
-			resources := extractAffectedResources(tc.body)
+			resources := ExtractAffectedResources(tc.body)
 			if !slices.Equal(resources, tc.expectedResources) {
 				t.Errorf("Expected %v, got %v", tc.expectedResources, resources)
 			}
@@ -45,7 +45,7 @@ func TestExtractAffectedResources(t *testing.T) {
 
 func TestEnrolledTeamsData(t *testing.T) {
 	// Smoke test to make sure enrolled teams data can be converted to a regex -> label map
-	_, err := buildRegexLabels(enrolledTeamsYaml)
+	_, err := BuildRegexLabels(EnrolledTeamsYaml)
 	if err != nil {
 		t.Logf("Error converting enrolled_teams.yml to regexpLabels: %s", err)
 		t.FailNow()
@@ -55,11 +55,11 @@ func TestEnrolledTeamsData(t *testing.T) {
 func TestBuildRegexLabels(t *testing.T) {
 	cases := map[string]struct {
 		yaml                 []byte
-		expectedRegexpLabels []regexpLabel
+		expectedRegexpLabels []RegexpLabel
 	}{
 		"empty yaml": {
 			yaml:                 []byte{},
-			expectedRegexpLabels: []regexpLabel{},
+			expectedRegexpLabels: []RegexpLabel{},
 		},
 		"labels with resources": {
 			yaml: []byte(`
@@ -70,17 +70,17 @@ service/service2:
   resources:
   - google_service2_resource1
   - google_service2_resource2`),
-			expectedRegexpLabels: []regexpLabel{
+			expectedRegexpLabels: []RegexpLabel{
 				{
-					Regexp: regexp.MustCompile("google_service1_.*"),
+					Regexp: regexp.MustCompile("^google_service1_.*$"),
 					Label:  "service/service1",
 				},
 				{
-					Regexp: regexp.MustCompile("google_service2_resource1"),
+					Regexp: regexp.MustCompile("^google_service2_resource1$"),
 					Label:  "service/service2",
 				},
 				{
-					Regexp: regexp.MustCompile("google_service2_resource2"),
+					Regexp: regexp.MustCompile("^google_service2_resource2$"),
 					Label:  "service/service2",
 				},
 			},
@@ -91,9 +91,9 @@ service/service1:
   team: service1-team
   resources:
     - google_service1_resource1`),
-			expectedRegexpLabels: []regexpLabel{
+			expectedRegexpLabels: []RegexpLabel{
 				{
-					Regexp: regexp.MustCompile("google_service1_resource1"),
+					Regexp: regexp.MustCompile("^google_service1_resource1$"),
 					Label:  "service/service1",
 				},
 			},
@@ -104,7 +104,7 @@ service/service1:
 		tc := tc
 		t.Run(tn, func(t *testing.T) {
 			t.Parallel()
-			regexpLabels, err := buildRegexLabels(tc.yaml)
+			regexpLabels, err := BuildRegexLabels(tc.yaml)
 			if err != nil {
 				t.Logf("Unable to read enrolled teams: %s", err)
 				t.FailNow()
@@ -117,27 +117,31 @@ service/service1:
 }
 
 func TestComputeLabels(t *testing.T) {
-	defaultRegexpLabels := []regexpLabel{
+	defaultRegexpLabels := []RegexpLabel{
 		{
-			Regexp: regexp.MustCompile("google_service1_.*"),
+			Regexp: regexp.MustCompile("^google_service1_.*$"),
 			Label:  "service/service1",
 		},
 		{
-			Regexp: regexp.MustCompile("google_service2_resource1"),
+			Regexp: regexp.MustCompile("^google_service2_resource1$"),
 			Label:  "service/service2-subteam1",
 		},
 		{
-			Regexp: regexp.MustCompile("google_service2_resource2"),
+			Regexp: regexp.MustCompile("^google_service2_resource2$"),
 			Label:  "service/service2-subteam2",
 		},
 		{
-			Regexp: regexp.MustCompile("google_service1_resource5"),
+			Regexp: regexp.MustCompile("^google_service1_resource5$"),
 			Label:  "service/service1-subteam1",
 		},
+		{
+			Regexp: regexp.MustCompile("^google_resource6$"),
+			Label:  "service/service3",
+		},
 	}
 	cases := map[string]struct {
 		resources      []string
-		regexpLabels   []regexpLabel
+		regexpLabels   []RegexpLabel
 		expectedLabels []string
 	}{
 		"empty resources -> empty labels": {
@@ -152,7 +156,7 @@ func TestComputeLabels(t *testing.T) {
 		},
 		"empty regexpLabels -> empty labels": {
 			resources:      []string{"google_service1_resource1"},
-			regexpLabels:   []regexpLabel{},
+			regexpLabels:   []RegexpLabel{},
 			expectedLabels: []string{},
 		},
 		"single matched resource": {
@@ -160,6 +164,16 @@ func TestComputeLabels(t *testing.T) {
 			regexpLabels:   defaultRegexpLabels,
 			expectedLabels: []string{"service/service1"},
 		},
+		"exact resource match": {
+			resources:      []string{"google_resource6"},
+			regexpLabels:   defaultRegexpLabels,
+			expectedLabels: []string{"service/service3"},
+		},
+		"no partial match allowed": {
+			resources:      []string{"google_resource6_foo"},
+			regexpLabels:   defaultRegexpLabels,
+			expectedLabels: []string{},
+		},
 		"only return first label matching a resource": {
 			resources:      []string{"google_service1_resource5"},
 			regexpLabels:   defaultRegexpLabels,
@@ -181,7 +195,7 @@ func TestComputeLabels(t *testing.T) {
 		tc := tc
 		t.Run(tn, func(t *testing.T) {
 			t.Parallel()
-			labels := computeLabels(tc.resources, tc.regexpLabels)
+			labels := ComputeLabels(tc.resources, tc.regexpLabels)
 			if !slices.Equal(labels, tc.expectedLabels) {
 				t.Errorf("want %v; got %v", tc.expectedLabels, labels)
 			}
diff --git a/tools/issue-labeler/main.go b/tools/issue-labeler/main.go
index 1239337f5a5e..d83ff58b8250 100644
--- a/tools/issue-labeler/main.go
+++ b/tools/issue-labeler/main.go
@@ -7,6 +7,7 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/GoogleCloudPlatform/magic-modules/tools/issue-labeler/labeler"
 	"github.com/golang/glog"
 )
 
@@ -16,15 +17,15 @@ var flagDryRun = flag.Bool("backfill-dry-run", false, "when combined with backfi
 func main() {
 	flag.Parse()
 
-	regexpLabels, err := buildRegexLabels(enrolledTeamsYaml)
+	regexpLabels, err := labeler.BuildRegexLabels(labeler.EnrolledTeamsYaml)
 	if err != nil {
 		glog.Exitf("Error building regex labels: %v", err)
 	}
 
 	if *flagBackfillDate == "" {
 		issueBody := os.Getenv("ISSUE_BODY")
-		affectedResources := extractAffectedResources(issueBody)
-		labels := computeLabels(affectedResources, regexpLabels)
+		affectedResources := labeler.ExtractAffectedResources(issueBody)
+		labels := labeler.ComputeLabels(affectedResources, regexpLabels)
 
 		if len(labels) > 0 {
 			labels = append(labels, "forward/review")
@@ -32,8 +33,9 @@ func main() {
 			fmt.Println(`["` + strings.Join(labels, `", "`) + `"]`)
 		}
 	} else {
-		issues := getIssues(*flagBackfillDate)
-		issueUpdates := computeIssueUpdates(issues, regexpLabels)
-		updateIssues(issueUpdates, *flagDryRun)
+		repository := "hashicorp/terraform-provider-google"
+		issues := labeler.GetIssues(repository, *flagBackfillDate)
+		issueUpdates := labeler.ComputeIssueUpdates(issues, regexpLabels)
+		labeler.UpdateIssues(repository, issueUpdates, *flagDryRun)
 	}
 }
diff --git a/tools/missing-test-detector/go.mod b/tools/missing-test-detector/go.mod
index 5572d08961d0..291b412ade2c 100644
--- a/tools/missing-test-detector/go.mod
+++ b/tools/missing-test-detector/go.mod
@@ -23,7 +23,7 @@ require (
 	cloud.google.com/go/compute/metadata v0.2.2 // indirect
 	cloud.google.com/go/iam v0.8.0 // indirect
 	cloud.google.com/go/longrunning v0.3.0 // indirect
-	github.com/GoogleCloudPlatform/declarative-resource-client-library v1.34.0 // indirect
+	github.com/GoogleCloudPlatform/declarative-resource-client-library v1.51.0 // indirect
 	github.com/agext/levenshtein v1.2.2 // indirect
 	github.com/apparentlymart/go-cidr v1.1.0 // indirect
 	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
diff --git a/tools/missing-test-detector/go.sum b/tools/missing-test-detector/go.sum
index 3a78829e6b16..9200a80bcd61 100644
--- a/tools/missing-test-detector/go.sum
+++ b/tools/missing-test-detector/go.sum
@@ -15,8 +15,8 @@ cloud.google.com/go/iam v0.8.0/go.mod h1:lga0/y3iH6CX7sYqypWJ33hf7kkfXJag67naqGE
 cloud.google.com/go/longrunning v0.3.0 h1:NjljC+FYPV3uh5/OwWT6pVU+doBqMg2x/rZlE+CamDs=
 cloud.google.com/go/longrunning v0.3.0/go.mod h1:qth9Y41RRSUE69rDcOn6DdK3HfQfsUI0YSmW3iIlLJc=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/GoogleCloudPlatform/declarative-resource-client-library v1.34.0 h1:o7t+hPFv+Ax5O2vxzIH7dEtvlWA7JJOlOd7mWFvMa6s=
-github.com/GoogleCloudPlatform/declarative-resource-client-library v1.34.0/go.mod h1:pL2Qt5HT+x6xrTd806oMiM3awW6kNIXB/iiuClz6m6k=
+github.com/GoogleCloudPlatform/declarative-resource-client-library v1.51.0 h1:YhWTPhOf6gVpA9mSfnLOuL8Y6j8W5pzmHE7flXjTke4=
+github.com/GoogleCloudPlatform/declarative-resource-client-library v1.51.0/go.mod h1:pL2Qt5HT+x6xrTd806oMiM3awW6kNIXB/iiuClz6m6k=
 github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
 github.com/Microsoft/go-winio v0.4.16 h1:FtSW/jqD+l4ba5iPBj9CODVtgfYAD8w2wS923g/cFDk=
 github.com/Microsoft/go-winio v0.4.16/go.mod h1:XB6nPKklQyQ7GC9LdcBEcBl8PF76WugXOPRXwdLnMv0=
diff --git a/tools/missing-test-detector/reader.go b/tools/missing-test-detector/reader.go
index f3c9b0468694..3ac95d54092d 100644
--- a/tools/missing-test-detector/reader.go
+++ b/tools/missing-test-detector/reader.go
@@ -28,56 +28,66 @@ type Test struct {
 	Steps []Step
 }
 
-// Return a slice of tests as well as a map of file names to errors encountered.
+func (t *Test) String() string {
+	return fmt.Sprintf("%s: %#v", t.Name, t.Steps)
+}
+
+// Return a slice of tests as well as a map of file or test names to errors encountered.
 func readAllTests(servicesDir string) ([]*Test, map[string]error) {
 	dirs, err := os.ReadDir(servicesDir)
 	if err != nil {
 		return nil, map[string]error{servicesDir: err}
 	}
 	allTests := make([]*Test, 0)
-	errs := make(map[string]error, 0)
+	allErrs := make(map[string]error)
 	for _, dir := range dirs {
 		servicePath := filepath.Join(servicesDir, dir.Name())
 		files, err := os.ReadDir(servicePath)
 		if err != nil {
 			return nil, map[string]error{servicePath: err}
 		}
+		var testFileNames []string
 		for _, file := range files {
 			if strings.HasSuffix(file.Name(), "_test.go") {
-				filePath := filepath.Join(servicePath, file.Name())
-				tests, err := readTestFile(filePath)
-				if err != nil {
-					errs[filePath] = err
-				}
-				allTests = append(allTests, tests...)
+				testFileNames = append(testFileNames, filepath.Join(servicePath, file.Name()))
 			}
 		}
+		serviceTests, serviceErrs := readTestFiles(testFileNames)
+		for fileName, err := range serviceErrs {
+			allErrs[fileName] = err
+		}
+		allTests = append(allTests, serviceTests...)
 	}
-	if len(errs) > 0 {
-		return allTests, errs
+	if len(allErrs) > 0 {
+		return allTests, allErrs
 	}
 	return allTests, nil
 }
 
-func readTestFile(filename string) ([]*Test, error) {
-	fset := token.NewFileSet()
-	f, err := parser.ParseFile(fset, filename, nil, 0)
-	if err != nil {
-		return nil, err
-	}
+// Read all the test files in a service directory together to capture cross-file function usage.
+func readTestFiles(filenames []string) ([]*Test, map[string]error) {
 	funcDecls := make(map[string]*ast.FuncDecl) // map of function names to function declarations
 	varDecls := make(map[string]*ast.BasicLit)  // map of variable names to value expressions
-	for _, decl := range f.Decls {
-		if funcDecl, ok := decl.(*ast.FuncDecl); ok {
-			// This is a function declaration.
-			funcDecls[funcDecl.Name.Name] = funcDecl
-		} else if genDecl, ok := decl.(*ast.GenDecl); ok {
-			// This is an import, constant, type, or variable declaration
-			for _, spec := range genDecl.Specs {
-				if valueSpec, ok := spec.(*ast.ValueSpec); ok {
-					if len(valueSpec.Values) > 0 {
-						if basicLit, ok := valueSpec.Values[0].(*ast.BasicLit); ok {
-							varDecls[valueSpec.Names[0].Name] = basicLit
+	errs := make(map[string]error)              // map of file or test names to errors encountered parsing
+	fset := token.NewFileSet()
+	for _, filename := range filenames {
+		f, err := parser.ParseFile(fset, filename, nil, 0)
+		if err != nil {
+			errs[filename] = err
+			continue
+		}
+		for _, decl := range f.Decls {
+			if funcDecl, ok := decl.(*ast.FuncDecl); ok {
+				// This is a function declaration.
+				funcDecls[funcDecl.Name.Name] = funcDecl
+			} else if genDecl, ok := decl.(*ast.GenDecl); ok {
+				// This is an import, constant, type, or variable declaration
+				for _, spec := range genDecl.Specs {
+					if valueSpec, ok := spec.(*ast.ValueSpec); ok {
+						if len(valueSpec.Values) > 0 {
+							if basicLit, ok := valueSpec.Values[0].(*ast.BasicLit); ok {
+								varDecls[valueSpec.Names[0].Name] = basicLit
+							}
 						}
 					}
 				}
@@ -85,27 +95,26 @@ func readTestFile(filename string) ([]*Test, error) {
 		}
 	}
 	tests := make([]*Test, 0)
-	errs := make([]error, 0)
 	for name, funcDecl := range funcDecls {
 		if strings.HasPrefix(name, "TestAcc") {
-			test, err := readTestFunc(funcDecl, funcDecls, varDecls)
+			funcTests, err := readTestFunc(funcDecl, funcDecls, varDecls)
 			if err != nil {
-				errs = append(errs, err)
-			}
-			if test != nil {
-				test.Name = name
-				tests = append(tests, test)
+				errs[name] = err
 			}
+			tests = append(tests, funcTests...)
 		}
 	}
 	if len(errs) > 0 {
-		return tests, fmt.Errorf("errors encountered parsing test file: %v", errs)
+		return tests, errs
 	}
 	return tests, nil
 }
 
-func readTestFunc(testFunc *ast.FuncDecl, funcDecls map[string]*ast.FuncDecl, varDecls map[string]*ast.BasicLit) (*Test, error) {
+func readTestFunc(testFunc *ast.FuncDecl, funcDecls map[string]*ast.FuncDecl, varDecls map[string]*ast.BasicLit) ([]*Test, error) {
 	// This is an exported test function.
+	var tests []*Test
+	var errs []error
+	vars := make(map[string]*ast.CompositeLit, len(testFunc.Body.List)) // map of variable names to composite literal values in function body
 	for _, stmt := range testFunc.Body.List {
 		if exprStmt, ok := stmt.(*ast.ExprStmt); ok {
 			if callExpr, ok := exprStmt.X.(*ast.CallExpr); ok {
@@ -113,12 +122,64 @@ func readTestFunc(testFunc *ast.FuncDecl, funcDecls map[string]*ast.FuncDecl, va
 				ident, isIdent := callExpr.Fun.(*ast.Ident)
 				selExpr, isSelExpr := callExpr.Fun.(*ast.SelectorExpr)
 				if isIdent && ident.Name == "VcrTest" || isSelExpr && selExpr.Sel.Name == "VcrTest" {
-					return readVcrTestCall(callExpr, funcDecls, varDecls)
+					test, err := readVcrTestCall(callExpr, funcDecls, varDecls)
+					if err != nil {
+						errs = append(errs, err)
+					}
+					test.Name = testFunc.Name.Name
+					tests = append(tests, test)
 				}
 			}
+		} else if assignStmt, ok := stmt.(*ast.AssignStmt); ok {
+			if len(assignStmt.Lhs) == 1 && len(assignStmt.Rhs) == 1 {
+				// For now, only allow single assignment variables for serial test maps.
+				// e.g. testCases := map[string]func(t *testing.T) {...
+				if ident, ok := assignStmt.Lhs[0].(*ast.Ident); ok {
+					if rhsCompLit, ok := assignStmt.Rhs[0].(*ast.CompositeLit); ok {
+						vars[ident.Name] = rhsCompLit
+					}
+				}
+			}
+		} else if rangeStmt, ok := stmt.(*ast.RangeStmt); ok {
+			if ident, ok := rangeStmt.X.(*ast.Ident); ok {
+				if varCompLit, ok := vars[ident.Name]; ok {
+					serialTests, serialErrs := readSerialTestCompLit(varCompLit, funcDecls, varDecls)
+					errs = append(errs, serialErrs...)
+					tests = append(tests, serialTests...)
+				}
+			}
+		}
+	}
+	if len(errs) > 0 {
+		return tests, fmt.Errorf("errors reading test func %s: %v", testFunc.Name.Name, errs)
+	}
+	return tests, nil
+}
+
+// Reads a composite literal which is either a slice or a map of serialized test functions.
+func readSerialTestCompLit(varCompLit *ast.CompositeLit, funcDecls map[string]*ast.FuncDecl, varDecls map[string]*ast.BasicLit) ([]*Test, []error) {
+	var tests []*Test
+	var errs []error
+	for _, elt := range varCompLit.Elts {
+		if eltKeyValueExpr, ok := elt.(*ast.KeyValueExpr); ok {
+			eltTests, err := readSerialTestEltKeyValueExpr(eltKeyValueExpr, funcDecls, varDecls)
+			if err != nil {
+				errs = append(errs, err)
+			}
+			tests = append(tests, eltTests...)
 		}
 	}
-	return nil, nil
+	return tests, errs
+}
+
+func readSerialTestEltKeyValueExpr(eltKeyValueExpr *ast.KeyValueExpr, funcDecls map[string]*ast.FuncDecl, varDecls map[string]*ast.BasicLit) ([]*Test, error) {
+	if ident, ok := eltKeyValueExpr.Value.(*ast.Ident); ok {
+		if testFunc, ok := funcDecls[ident.Name]; ok {
+			return readTestFunc(testFunc, funcDecls, varDecls)
+		}
+		return nil, fmt.Errorf("failed to find function with name %s", ident.Name)
+	}
+	return nil, fmt.Errorf("element key value expression with key %+v had non-ident value %+v", eltKeyValueExpr.Key, eltKeyValueExpr.Value)
 }
 
 func readVcrTestCall(vcrTestCall *ast.CallExpr, funcDecls map[string]*ast.FuncDecl, varDecls map[string]*ast.BasicLit) (*Test, error) {
@@ -163,7 +224,11 @@ func readStepsCompLit(stepsCompLit *ast.CompositeLit, funcDecls map[string]*ast.
 							test.Steps = append(test.Steps, step)
 						} else if ident, ok := keyValueExpr.Value.(*ast.Ident); ok {
 							if configVar, ok := varDecls[ident.Name]; ok {
-								step, err := readConfigBasicLit(configVar)
+								configStr, err := strconv.Unquote(configVar.Value)
+								if err != nil {
+									errs = append(errs, err)
+								}
+								step, err := readConfigStr(configStr)
 								if err != nil {
 									errs = append(errs, err)
 								}
@@ -196,90 +261,109 @@ func readConfigFunc(configFunc *ast.FuncDecl) (Step, error) {
 	for _, stmt := range configFunc.Body.List {
 		if returnStmt, ok := stmt.(*ast.ReturnStmt); ok {
 			for _, result := range returnStmt.Results {
-				if basicLit, ok := result.(*ast.BasicLit); ok && basicLit.Kind == token.STRING {
-					return readConfigBasicLit(basicLit)
+				configStr, err := readConfigFuncResult(result)
+				if err != nil {
+					return nil, err
 				}
-				if callExpr, ok := result.(*ast.CallExpr); ok {
-					return readConfigFuncCallExpr(callExpr)
+				if configStr != "" {
+					return readConfigStr(configStr)
 				}
 			}
-			return nil, fmt.Errorf("failed to find a call expression in results %v", returnStmt.Results)
+			return nil, fmt.Errorf("failed to find a config string in results %v", returnStmt.Results)
 		}
 	}
 	return nil, fmt.Errorf("failed to find a return statement in %v", configFunc.Body.List)
 }
 
+// Read the return result of a config func and return the config string.
+func readConfigFuncResult(result ast.Expr) (string, error) {
+	if basicLit, ok := result.(*ast.BasicLit); ok && basicLit.Kind == token.STRING {
+		return strconv.Unquote(basicLit.Value)
+	} else if callExpr, ok := result.(*ast.CallExpr); ok {
+		return readConfigFuncCallExpr(callExpr)
+	} else if binaryExpr, ok := result.(*ast.BinaryExpr); ok {
+		xConfigStr, err := readConfigFuncResult(binaryExpr.X)
+		if err != nil {
+			return "", err
+		}
+		yConfigStr, err := readConfigFuncResult(binaryExpr.Y)
+		if err != nil {
+			return "", err
+		}
+		return xConfigStr + yConfigStr, nil
+	}
+	return "", fmt.Errorf("unknown config func result %v (%T)", result, result)
+}
+
 // Read the call expression in the config function that returns the config string.
 // The call expression can contain a nested call expression.
-func readConfigFuncCallExpr(configFuncCallExpr *ast.CallExpr) (Step, error) {
+// Return the config string.
+func readConfigFuncCallExpr(configFuncCallExpr *ast.CallExpr) (string, error) {
 	if len(configFuncCallExpr.Args) == 0 {
-		return nil, fmt.Errorf("no arguments found for call expression %v", configFuncCallExpr)
+		return "", fmt.Errorf("no arguments found for call expression %v", configFuncCallExpr)
 	}
 	if basicLit, ok := configFuncCallExpr.Args[0].(*ast.BasicLit); ok && basicLit.Kind == token.STRING {
-		return readConfigBasicLit(basicLit)
+		return strconv.Unquote(basicLit.Value)
 	} else if nestedCallExpr, ok := configFuncCallExpr.Args[0].(*ast.CallExpr); ok {
 		return readConfigFuncCallExpr(nestedCallExpr)
 	}
-	return nil, fmt.Errorf("no string literal found in arguments to call expression %v", configFuncCallExpr)
+	return "", fmt.Errorf("no string literal found in arguments to call expression %v", configFuncCallExpr)
 }
 
-func readConfigBasicLit(configBasicLit *ast.BasicLit) (Step, error) {
-	if configStr, err := strconv.Unquote(configBasicLit.Value); err != nil {
-		return nil, err
-	} else {
-		// Remove template variables because they interfere with hcl parsing.
-		pattern := regexp.MustCompile("%{[^{}]*}")
-		// Replace with a value that can be parsed outside quotation marks.
-		configStr = pattern.ReplaceAllString(configStr, "true")
-		parser := hclparse.NewParser()
-		file, diagnostics := parser.ParseHCL([]byte(configStr), "config.hcl")
-		if diagnostics.HasErrors() {
-			return nil, fmt.Errorf("errors parsing hcl: %v", diagnostics.Errs())
-		}
-		content, diagnostics := file.Body.Content(&hcl.BodySchema{
-			Blocks: []hcl.BlockHeaderSchema{
-				{
-					Type:       "resource",
-					LabelNames: []string{"type", "name"},
-				},
-				{
-					Type:       "data",
-					LabelNames: []string{"type", "name"},
-				},
-				{
-					Type:       "output",
-					LabelNames: []string{"name"},
-				},
-				{
-					Type: "locals",
-				},
+// Read the config string and return a test step.
+func readConfigStr(configStr string) (Step, error) {
+	// Remove template variables because they interfere with hcl parsing.
+	pattern := regexp.MustCompile("%{[^{}]*}")
+	// Replace with a value that can be parsed outside quotation marks.
+	configStr = pattern.ReplaceAllString(configStr, "true")
+	parser := hclparse.NewParser()
+	file, diagnostics := parser.ParseHCL([]byte(configStr), "config.hcl")
+	if diagnostics.HasErrors() {
+		return nil, fmt.Errorf("errors parsing hcl: %v", diagnostics.Errs())
+	}
+	content, diagnostics := file.Body.Content(&hcl.BodySchema{
+		Blocks: []hcl.BlockHeaderSchema{
+			{
+				Type:       "resource",
+				LabelNames: []string{"type", "name"},
 			},
-		})
-		if diagnostics.HasErrors() {
-			return nil, fmt.Errorf("errors getting hcl body content: %v", diagnostics.Errs())
+			{
+				Type:       "data",
+				LabelNames: []string{"type", "name"},
+			},
+			{
+				Type:       "output",
+				LabelNames: []string{"name"},
+			},
+			{
+				Type: "locals",
+			},
+		},
+	})
+	if diagnostics.HasErrors() {
+		return nil, fmt.Errorf("errors getting hcl body content: %v", diagnostics.Errs())
+	}
+	m := make(map[string]Resources)
+	errs := make([]error, 0)
+	for _, block := range content.Blocks {
+		if len(block.Labels) != 2 {
+			continue
 		}
-		m := make(map[string]Resources)
-		errs := make([]error, 0)
-		for _, block := range content.Blocks {
-			if len(block.Labels) != 2 {
-				continue
-			}
-			if _, ok := m[block.Labels[0]]; !ok {
-				// Create an empty map for this resource type.
-				m[block.Labels[0]] = make(Resources)
-			}
-			// Use the resource name as a key.
-			resourceConfig, err := readHCLBlockBody(block.Body, file.Bytes)
-			if err != nil {
-				errs = append(errs, err)
-			}
-			m[block.Labels[0]][block.Labels[1]] = resourceConfig
+		if _, ok := m[block.Labels[0]]; !ok {
+			// Create an empty map for this resource type.
+			m[block.Labels[0]] = make(Resources)
 		}
-		if len(errs) > 0 {
-			return m, fmt.Errorf("errors reading hcl blocks: %v", errs)
+		// Use the resource name as a key.
+		resourceConfig, err := readHCLBlockBody(block.Body, file.Bytes)
+		if err != nil {
+			errs = append(errs, err)
 		}
-		return m, nil
+		m[block.Labels[0]][block.Labels[1]] = resourceConfig
 	}
+	if len(errs) > 0 {
+		return m, fmt.Errorf("errors reading hcl blocks: %v", errs)
+	}
+	return m, nil
 }
 
 func readHCLBlockBody(body hcl.Body, fileBytes []byte) (Resource, error) {
diff --git a/tools/missing-test-detector/reader_test.go b/tools/missing-test-detector/reader_test.go
index 57bb5cceee3b..e42d3eff4137 100644
--- a/tools/missing-test-detector/reader_test.go
+++ b/tools/missing-test-detector/reader_test.go
@@ -13,11 +13,13 @@ func TestReadAllTests(t *testing.T) {
 		for path, err := range errs {
 			t.Logf("path: %s, err: %v", path, err)
 		}
+	} else {
+		t.Log("no services directory provided, skipping TestReadAllTests")
 	}
 }
 
 func TestReadCoveredResourceTestFile(t *testing.T) {
-	tests, err := readTestFile("testdata/service/covered_resource_test.go")
+	tests, err := readTestFiles([]string{"testdata/service/covered_resource_test.go"})
 	if err != nil {
 		t.Fatalf("error reading covered resource test file: %v", err)
 	}
@@ -45,7 +47,7 @@ func TestReadCoveredResourceTestFile(t *testing.T) {
 }
 
 func TestReadConfigVariableTestFile(t *testing.T) {
-	tests, err := readTestFile("testdata/service/config_variable_test.go")
+	tests, err := readTestFiles([]string{"testdata/service/config_variable_test.go"})
 	if err != nil {
 		t.Fatalf("error reading config variable test file: %v", err)
 	}
@@ -65,7 +67,7 @@ func TestReadConfigVariableTestFile(t *testing.T) {
 }
 
 func TestReadMultipleResourcesTestFile(t *testing.T) {
-	tests, err := readTestFile("testdata/service/multiple_resource_test.go")
+	tests, err := readTestFiles([]string{"testdata/service/multiple_resource_test.go"})
 	if err != nil {
 		t.Fatalf("error reading multiple resources test file: %v", err)
 	}
@@ -97,3 +99,81 @@ func TestReadMultipleResourcesTestFile(t *testing.T) {
 		t.Errorf("found unexpected test steps for multiple resources: %#v, expected %#v", tests[0].Steps, expectedSteps)
 	}
 }
+
+func TestReadSerialResourceTestFile(t *testing.T) {
+	tests, err := readTestFiles([]string{"testdata/service/serial_resource_test.go"})
+	if err != nil {
+		t.Fatalf("error reading serial resource test file: %v", err)
+	}
+	if len(tests) != 2 {
+		t.Fatalf("unexpected number of tests: %d, expected 2", len(tests))
+	}
+	if expectedTests := []*Test{
+		{
+			Name: "testAccSerialResource1",
+			Steps: []Step{
+				{
+					"serial_resource": {
+						"resource": {"field_one": "\"value-one\""},
+					},
+				},
+			},
+		},
+		{
+			Name: "testAccSerialResource2",
+			Steps: []Step{
+				{
+					"serial_resource": {
+						"resource": {
+							"field_two": Resource{
+								"field_three": "\"value-two\"",
+							},
+						},
+					},
+				},
+			},
+		},
+	}; !reflect.DeepEqual(tests, expectedTests) {
+		t.Errorf("found unexpected serialized tests: %v, expected %v", tests, expectedTests)
+	}
+
+}
+
+func TestReadCrossFileTests(t *testing.T) {
+	tests, err := readTestFiles([]string{"testdata/service/cross_file_1_test.go", "testdata/service/cross_file_2_test.go"})
+	if err != nil {
+		t.Fatalf("error reading cross file tests: %v", err)
+	}
+	if len(tests) != 2 {
+		t.Fatalf("unexpected number of tests: %d, expected 2", len(tests))
+	}
+	if expectedTests := []*Test{
+		{
+			Name: "testAccCrossFile1",
+			Steps: []Step{
+				{
+					"serial_resource": {
+						"resource": {"field_one": "\"value-one\""},
+					},
+				},
+			},
+		},
+		{
+			Name: "testAccCrossFile2",
+			Steps: []Step{
+				{
+					"serial_resource": {
+						"resource": {
+							"field_two": Resource{
+								"field_three": "\"value-two\"",
+							},
+						},
+					},
+				},
+			},
+		},
+	}; !reflect.DeepEqual(tests, expectedTests) {
+		t.Errorf("found unexpected cross file tests: %v, expected %v", tests, expectedTests)
+	}
+
+}
diff --git a/tools/missing-test-detector/testdata/service/covered_resource_test.go b/tools/missing-test-detector/testdata/service/covered_resource_test.go
index 115a05c96ff4..0cd9ad44c442 100644
--- a/tools/missing-test-detector/testdata/service/covered_resource_test.go
+++ b/tools/missing-test-detector/testdata/service/covered_resource_test.go
@@ -29,10 +29,10 @@ resource "covered_resource" "resource" {
     field_five {
       field_six = "value-three"
     }
-  }
+  }`)) + acctest.Nprintf(`
   field_seven = %{bool}
 }
-`, context))
+`, context)
 }
 
 func testAccCoveredResource_update() string {
diff --git a/tools/missing-test-detector/testdata/service/cross_file_1_test.go b/tools/missing-test-detector/testdata/service/cross_file_1_test.go
new file mode 100644
index 000000000000..b2844846f0e2
--- /dev/null
+++ b/tools/missing-test-detector/testdata/service/cross_file_1_test.go
@@ -0,0 +1,35 @@
+package service_test
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+)
+
+func TestAccCrossFile(t *testing.T) {
+	testCases := map[string]func(t *testing.T){
+		"test1": testAccCrossFile1,
+		"test2": testAccCrossFile2,
+	}
+
+	for name, tc := range testCases {
+		// shadow the tc variable into scope so that when
+		// the loop continues, if t.Run hasn't executed tc(t)
+		// yet, we don't have a race condition
+		// see https://github.com/golang/go/wiki/CommonMistakes#using-goroutines-on-loop-iterator-variables
+		tc := tc
+		t.Run(name, func(t *testing.T) {
+			tc(t)
+		})
+	}
+}
+
+func testAccCrossFile1(t *testing.T) {
+	VcrTest(t, resource.TestCase{
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCrossFileConfig1(),
+			},
+		},
+	})
+}
diff --git a/tools/missing-test-detector/testdata/service/cross_file_2_test.go b/tools/missing-test-detector/testdata/service/cross_file_2_test.go
new file mode 100644
index 000000000000..06b8bea8793c
--- /dev/null
+++ b/tools/missing-test-detector/testdata/service/cross_file_2_test.go
@@ -0,0 +1,36 @@
+package service_test
+
+import (
+	"google/provider/new/google-beta/acctest"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+)
+
+func testAccCrossFile2(t *testing.T) {
+	VcrTest(t, resource.TestCase{
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCrossFileConfig2(),
+			},
+		},
+	})
+}
+
+func testAccCrossFileConfig1() string {
+	return acctest.Nprintf(`
+resource "serial_resource" "resource" {
+  field_one = "value-one"
+}
+`, context)
+}
+
+func testAccCrossFileConfig2() string {
+	return acctest.Nprintf(`
+resource "serial_resource" "resource" {
+  field_two {
+    field_three = "value-two"
+  }
+}
+`, context)
+}
diff --git a/tools/missing-test-detector/testdata/service/serial_resource_test.go b/tools/missing-test-detector/testdata/service/serial_resource_test.go
new file mode 100644
index 000000000000..6704384e895a
--- /dev/null
+++ b/tools/missing-test-detector/testdata/service/serial_resource_test.go
@@ -0,0 +1,64 @@
+package service_test
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-provider-google-beta/google-beta/acctest"
+)
+
+func TestAccSerialResource(t *testing.T) {
+	testCases := map[string]func(t *testing.T){
+		"test1": testAccSerialResource1,
+		"test2": testAccSerialResource2,
+	}
+
+	for name, tc := range testCases {
+		// shadow the tc variable into scope so that when
+		// the loop continues, if t.Run hasn't executed tc(t)
+		// yet, we don't have a race condition
+		// see https://github.com/golang/go/wiki/CommonMistakes#using-goroutines-on-loop-iterator-variables
+		tc := tc
+		t.Run(name, func(t *testing.T) {
+			tc(t)
+		})
+	}
+}
+
+func testAccSerialResource1(t *testing.T) {
+	VcrTest(t, resource.TestCase{
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSerialResourceConfig1(),
+			},
+		},
+	})
+}
+
+func testAccSerialResource2(t *testing.T) {
+	VcrTest(t, resource.TestCase{
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSerialResourceConfig2(),
+			},
+		},
+	})
+}
+
+func testAccSerialResourceConfig1() string {
+	return acctest.Nprintf(`
+resource "serial_resource" "resource" {
+  field_one = "value-one"
+}
+`, context)
+}
+
+func testAccSerialResourceConfig2() string {
+	return acctest.Nprintf(`
+resource "serial_resource" "resource" {
+  field_two {
+    field_three = "value-two"
+  }
+}
+`, context)
+}
diff --git a/tools/teamcity-generator/main.go b/tools/teamcity-generator/main.go
index 0b376b370a2d..e64741be7da0 100644
--- a/tools/teamcity-generator/main.go
+++ b/tools/teamcity-generator/main.go
@@ -88,7 +88,9 @@ func readAllServicePackages(providerDir string) ([]string, error) {
 	var services = make([]string, 0)
 
 	for _, p := range packages {
-		services = append(services, p.Name())
+		if p.IsDir() {
+			services = append(services, p.Name())
+		}
 	}
 	if len(services) == 0 {
 		return nil, fmt.Errorf("found 0 service packages in %s", providerDir)
diff --git a/tpgtools/api/assuredworkloads/samples/basic.workload.json b/tpgtools/api/assuredworkloads/samples/basic.workload.json
index 331cfbf585b9..5b280bd44047 100755
--- a/tpgtools/api/assuredworkloads/samples/basic.workload.json
+++ b/tpgtools/api/assuredworkloads/samples/basic.workload.json
@@ -1,20 +1,22 @@
 {
   "organization": "{{org_id}}",
   "location": "{{region}}",
-  "displayName": "Workload Example",
+  "displayName": "{{display}}",
   "complianceRegime": "FEDRAMP_MODERATE",
   "billingAccount": "billingAccounts/{{billing_account}}",
   "labels": {
     "label-one": "value-one"
   },
   "provisionedResourcesParent": "folders/519620126891",
+  "violationNotificationsEnabled": true,
   "kmsSettings": {
     "nextRotationTime": "9999-10-02T15:01:23Z",
     "rotationPeriod": "10368000s"
   },
   "resourceSettings": [
     {
-      "resourceType": "CONSUMER_PROJECT"
+      "resourceType": "CONSUMER_FOLDER",
+      "displayName": "folder-display-name"
     },
     {
       "resourceType": "ENCRYPTION_KEYS_PROJECT"
@@ -24,4 +26,4 @@
       "resourceType": "KEYRING"
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/tpgtools/api/assuredworkloads/samples/sovereign_controls.workload.json b/tpgtools/api/assuredworkloads/samples/sovereign_controls.workload.json
new file mode 100644
index 000000000000..f75313bc7777
--- /dev/null
+++ b/tpgtools/api/assuredworkloads/samples/sovereign_controls.workload.json
@@ -0,0 +1,27 @@
+{
+    "organization": "{{org_id}}",
+    "location": "europe-west9",
+    "displayName": "{{display}}",
+    "complianceRegime": "EU_REGIONS_AND_SUPPORT",
+    "billingAccount": "billingAccounts/{{billing_account}}",
+    "labels": {
+        "label-one": "value-one"
+    },
+    "enableSovereignControls": true,
+    "kmsSettings": {
+        "nextRotationTime": "9999-10-02T15:01:23Z",
+        "rotationPeriod": "10368000s"
+    },
+    "resourceSettings": [
+        {
+            "resourceType": "CONSUMER_FOLDER"
+        },
+        {
+            "resourceType": "ENCRYPTION_KEYS_PROJECT"
+        },
+        {
+            "resourceId": "{{ring}}",
+            "resourceType": "KEYRING"
+        }
+    ]
+}
\ No newline at end of file
diff --git a/tpgtools/api/assuredworkloads/samples/sovereign_controls_workload.yaml b/tpgtools/api/assuredworkloads/samples/sovereign_controls_workload.yaml
new file mode 100644
index 000000000000..bcb6e5fbd7ea
--- /dev/null
+++ b/tpgtools/api/assuredworkloads/samples/sovereign_controls_workload.yaml
@@ -0,0 +1,31 @@
+# Copyright 2023 Google LLC. All Rights Reserved.
+# 
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+# 
+#     http://www.apache.org/licenses/LICENSE-2.0
+# 
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+name: sovereign_controls_workload
+description: A Sovereign Controls test of the assuredworkloads api
+type: workload
+versions:
+- beta
+resource: samples/sovereign_controls.workload.json
+updates:
+- resource: samples/update_sovereign_controls.workload.json
+  dependencies: []
+variables:
+- name: billing_account
+  type: billing_account
+- name: display
+  type: resource_name
+- name: org_id
+  type: org_id
+- name: ring
+  type: resource_name
\ No newline at end of file
diff --git a/tpgtools/api/assuredworkloads/samples/update_sovereign_controls.workload.json b/tpgtools/api/assuredworkloads/samples/update_sovereign_controls.workload.json
new file mode 100644
index 000000000000..99fa43989bb9
--- /dev/null
+++ b/tpgtools/api/assuredworkloads/samples/update_sovereign_controls.workload.json
@@ -0,0 +1,11 @@
+{
+    "name": "{{ref:__state__:name}}",
+    "organization": "{{org_id}}",
+    "location": "europe-west9",
+    "displayName": "updated-example",
+    "billingAccount": "billingAccounts/{{billing_account}}",
+    "complianceRegime": "EU_REGIONS_AND_SUPPORT",
+    "labels": {
+        "label-two": "value-two-eu-regions-and-support"
+    }
+}
\ No newline at end of file
diff --git a/tpgtools/api/orgpolicy/samples/organization_dry_run.policy.json b/tpgtools/api/orgpolicy/samples/organization_dry_run.policy.json
new file mode 100644
index 000000000000..ef93418792e8
--- /dev/null
+++ b/tpgtools/api/orgpolicy/samples/organization_dry_run.policy.json
@@ -0,0 +1,13 @@
+{
+    "name": "organizations/{{org_id}}/policies/gcp.resourceLocations",
+    "parent": "organizations/{{org_id}}",
+    "dryRunSpec": {
+        "rules": [
+            {
+                "denyAll": true
+            }
+        ],
+        "reset": true,
+        "inheritFromParent": false
+    }
+}
\ No newline at end of file
diff --git a/tpgtools/api/orgpolicy/samples/organization_dry_run_policy.yaml b/tpgtools/api/orgpolicy/samples/organization_dry_run_policy.yaml
new file mode 100644
index 000000000000..809c10dde32e
--- /dev/null
+++ b/tpgtools/api/orgpolicy/samples/organization_dry_run_policy.yaml
@@ -0,0 +1,26 @@
+# Copyright 2023 Google LLC. All Rights Reserved.
+# 
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+# 
+#     http://www.apache.org/licenses/LICENSE-2.0
+# 
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+name: organization_dry_run_policy
+description: A test of an dry run policy for an organization
+type: policy
+versions:
+- ga
+- beta
+resource: samples/organization_dry_run.policy.json
+updates:
+- resource: samples/update_organization_dry_run.policy.json
+  dependencies: []
+variables:
+- name: org_id
+  type: org_id
\ No newline at end of file
diff --git a/tpgtools/api/orgpolicy/samples/update_organization_dry_run.policy.json b/tpgtools/api/orgpolicy/samples/update_organization_dry_run.policy.json
new file mode 100644
index 000000000000..fa4c032116be
--- /dev/null
+++ b/tpgtools/api/orgpolicy/samples/update_organization_dry_run.policy.json
@@ -0,0 +1,14 @@
+{
+    "name": "organizations/{{org_id}}/policies/gcp.resourceLocations",
+    "parent": "organizations/{{org_id}}",
+    "dryRunSpec": {
+        "rules": [
+            {
+                "allowAll": true,
+                "enforce": true
+            }
+        ],
+        "reset": false,
+        "inheritFromParent": true
+    }
+}
\ No newline at end of file
diff --git a/tpgtools/go.mod b/tpgtools/go.mod
index 01564e2fc660..5eb502e7c7b6 100644
--- a/tpgtools/go.mod
+++ b/tpgtools/go.mod
@@ -3,26 +3,30 @@ module github.com/GoogleCloudPlatform/magic-modules/tpgtools
 go 1.19
 
 require (
-	bitbucket.org/creachadair/stringset v0.0.9
-	github.com/GoogleCloudPlatform/declarative-resource-client-library v1.50.0
-	github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b
+	bitbucket.org/creachadair/stringset v0.0.11
+	github.com/GoogleCloudPlatform/declarative-resource-client-library v1.56.0
+	github.com/golang/glog v1.1.2
 	github.com/hashicorp/errwrap v1.0.0
 	github.com/hashicorp/hcl v1.0.0
 	github.com/hashicorp/terraform-plugin-sdk/v2 v2.4.0
 	github.com/kylelemons/godebug v1.1.0
-	github.com/nasa9084/go-openapi v0.0.0-20200604141640-2875b7376353
+	github.com/nasa9084/go-openapi v0.0.0-20210722142352-4a81d737faf6
 	gopkg.in/yaml.v2 v2.4.0
 )
 
 require (
-	cloud.google.com/go v0.61.0 // indirect
+	cloud.google.com/go v0.110.6 // indirect
+	cloud.google.com/go/compute v1.23.0 // indirect
+	cloud.google.com/go/compute/metadata v0.2.3 // indirect
 	github.com/agext/levenshtein v1.2.2 // indirect
 	github.com/apparentlymart/go-textseg v1.0.0 // indirect
 	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
-	github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e // indirect
-	github.com/golang/protobuf v1.4.2 // indirect
-	github.com/google/go-cmp v0.5.8 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/google/go-cmp v0.5.9 // indirect
 	github.com/google/go-cpy v0.0.0-20211218193943-a9c933c06932 // indirect
+	github.com/google/s2a-go v0.1.7 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.2.5 // indirect
 	github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320 // indirect
 	github.com/hashicorp/go-multierror v1.0.0 // indirect
 	github.com/hashicorp/go-uuid v1.0.1 // indirect
@@ -36,14 +40,16 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.1 // indirect
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
 	github.com/zclconf/go-cty v1.2.1 // indirect
-	go.opencensus.io v0.22.4 // indirect
-	golang.org/x/net v0.0.0-20200707034311-ab3426394381 // indirect
-	golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d // indirect
-	golang.org/x/sys v0.0.0-20200523222454-059865788121 // indirect
-	golang.org/x/text v0.3.3 // indirect
-	google.golang.org/api v0.29.0 // indirect
-	google.golang.org/appengine v1.6.6 // indirect
-	google.golang.org/genproto v0.0.0-20200711021454-869866162049 // indirect
-	google.golang.org/grpc v1.32.0 // indirect
-	google.golang.org/protobuf v1.25.0 // indirect
+	go.opencensus.io v0.24.0 // indirect
+	golang.org/x/crypto v0.13.0 // indirect
+	golang.org/x/net v0.15.0 // indirect
+	golang.org/x/oauth2 v0.12.0 // indirect
+	golang.org/x/sys v0.12.0 // indirect
+	golang.org/x/text v0.13.0 // indirect
+	google.golang.org/api v0.138.0 // indirect
+	google.golang.org/appengine v1.6.8 // indirect
+	google.golang.org/genproto v0.0.0-20230803162519-f966b187b2e5 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d // indirect
+	google.golang.org/grpc v1.57.0 // indirect
+	google.golang.org/protobuf v1.31.0 // indirect
 )
diff --git a/tpgtools/go.sum b/tpgtools/go.sum
index 7018bea809e0..4e6bda17fc4a 100644
--- a/tpgtools/go.sum
+++ b/tpgtools/go.sum
@@ -1,5 +1,7 @@
 bitbucket.org/creachadair/stringset v0.0.9 h1:L4vld9nzPt90UZNrXjNelTshD74ps4P5NGs3Iq6yN3o=
 bitbucket.org/creachadair/stringset v0.0.9/go.mod h1:t+4WcQ4+PXTa8aQdNKe40ZP6iwesoMFWAxPGd3UGjyY=
+bitbucket.org/creachadair/stringset v0.0.11 h1:6Sv4CCv14Wm+OipW4f3tWOb0SQVpBDLW0knnJqUnmZ8=
+bitbucket.org/creachadair/stringset v0.0.11/go.mod h1:wh0BHewFe+j0HrzWz7KcGbSNpFzWwnpmgPRlB57U5jU=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
@@ -15,12 +17,18 @@ cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKV
 cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
 cloud.google.com/go v0.61.0 h1:NLQf5e1OMspfNT1RAHOB3ublr1TW3YTXO8OiWwVjK2U=
 cloud.google.com/go v0.61.0/go.mod h1:XukKJg4Y7QsUu0Hxg3qQKUWR4VuWivmyMK2+rUyxAqw=
+cloud.google.com/go v0.110.6 h1:8uYAkj3YHTP/1iwReuHPxLSbdcyc+dSBbzFMrVwDR6Q=
+cloud.google.com/go v0.110.6/go.mod h1:+EYjdK8e5RME/VY/qLCAtuyALQ9q67dvuum8i+H5xsI=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
 cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
 cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
 cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
 cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
 cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
+cloud.google.com/go/compute v1.23.0 h1:tP41Zoavr8ptEqaW6j+LQOnyBBhO7OkOMAGrgLopTwY=
+cloud.google.com/go/compute v1.23.0/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM=
+cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
+cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
@@ -35,8 +43,8 @@ cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/GoogleCloudPlatform/declarative-resource-client-library v1.50.0 h1:tsuB2FrGmDXIPUdhRD6YdUuvIzAly6+RYpyRkKWwk9E=
-github.com/GoogleCloudPlatform/declarative-resource-client-library v1.50.0/go.mod h1:pL2Qt5HT+x6xrTd806oMiM3awW6kNIXB/iiuClz6m6k=
+github.com/GoogleCloudPlatform/declarative-resource-client-library v1.56.0 h1:R8zbp/2oVfPbMF1u6RTkf5s+J4hA6sWAEo8E7xsrbpY=
+github.com/GoogleCloudPlatform/declarative-resource-client-library v1.56.0/go.mod h1:pL2Qt5HT+x6xrTd806oMiM3awW6kNIXB/iiuClz6m6k=
 github.com/agext/levenshtein v1.2.1/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
 github.com/agext/levenshtein v1.2.2 h1:0S/Yg6LYmFJ5stwQeRp6EeOcCbj7xiqQSdNelsXvaqE=
 github.com/agext/levenshtein v1.2.2/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
@@ -90,10 +98,14 @@ github.com/go-test/deep v1.0.3 h1:ZrJSEWsXzPOxaZnFteGEfooLba+ju3FYIbOrS+rQd68=
 github.com/go-test/deep v1.0.3/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/glog v1.1.2 h1:DVjP2PbBOzHyzA+dn3WhHIq4NdVu3Q+pvivFICf/7fo=
+github.com/golang/glog v1.1.2/go.mod h1:zR+okUeTbrL6EL3xHUDxZuEtGv04p5shwip1+mL/rLQ=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e h1:1r7pUrabqp18hOBcwBwiTsbnFeTZHV9eER/QT5JVZxY=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
@@ -115,6 +127,11 @@ github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvq
 github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
 github.com/golang/protobuf v1.4.2 h1:+Z5KGCizgyZCbGh1KZqA0fcLLkwbsjIzS4aV2v7wJX0=
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
@@ -125,8 +142,12 @@ github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cpy v0.0.0-20211218193943-a9c933c06932 h1:5/4TSDzpDnHQ8rKEEQBjRlYx77mHOvXu08oGchxej7o=
 github.com/google/go-cpy v0.0.0-20211218193943-a9c933c06932/go.mod h1:cC6EdPbj/17GFCPDK39NRarlMI+kt+O60S12cNB5J9Y=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
@@ -139,6 +160,12 @@ github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hf
 github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
+github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
+github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
+github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/enterprise-certificate-proxy v0.2.5 h1:UR4rDjcgpgEnqpIEvkiqTYKBCKLNmlge2eVjoZfySzM=
+github.com/googleapis/enterprise-certificate-proxy v0.2.5/go.mod h1:RxW0N9901Cko1VOCW3SXCpWP+mlIEkk2tP7jnHy9a3w=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
 github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
@@ -226,6 +253,8 @@ github.com/mitchellh/reflectwalk v1.0.1 h1:FVzMWA5RllMAKIdUSC8mdWo3XtwoecrH79BY7
 github.com/mitchellh/reflectwalk v1.0.1/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/nasa9084/go-openapi v0.0.0-20200604141640-2875b7376353 h1:B12KiVODig0ltyL7AOeO68ZKLrIWAus/SdlWvO7KcfA=
 github.com/nasa9084/go-openapi v0.0.0-20200604141640-2875b7376353/go.mod h1:Y+QYE2No9P7gTzq/clACcx4vZ34gemXUmfspIcRD6LY=
+github.com/nasa9084/go-openapi v0.0.0-20210722142352-4a81d737faf6 h1:EgeFHuf1nYbw8nN/04bzCHjUL+ZGOMi+b5DXH+TVNJE=
+github.com/nasa9084/go-openapi v0.0.0-20210722142352-4a81d737faf6/go.mod h1:oY7A58oP7/O7+8Ob5s6uGrdVlLQj/BGgUUIsj6IMrQw=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/nsf/jsondiff v0.0.0-20200515183724-f29ed568f4ce h1:RPclfga2SEJmgMmz2k+Mg7cowZ8yv4Trqw9UsJby758=
@@ -241,10 +270,15 @@ github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAm
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/spf13/pflag v1.0.2/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/ulikunitz/xz v0.5.5/go.mod h1:2bypXElzHzzJZwzH67Y6wb67pO62Rzfn7BSiF4ABRW8=
 github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/vmihailenco/msgpack v3.3.3+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
@@ -254,6 +288,7 @@ github.com/xanzy/ssh-agent v0.2.1/go.mod h1:mLlQY/MoOhWBj+gOGMQkOeiEvkx+8pJSI+0B
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/zclconf/go-cty v1.2.0/go.mod h1:hOPWgoHbaTUnI5k4D2ld+GRpFJSCe6bCM7m1q/N4PQ8=
 github.com/zclconf/go-cty v1.2.1 h1:vGMsygfmeCl4Xb6OA5U5XVAaQZ69FvoG7X2jUtQujb8=
 github.com/zclconf/go-cty v1.2.1/go.mod h1:hOPWgoHbaTUnI5k4D2ld+GRpFJSCe6bCM7m1q/N4PQ8=
@@ -264,6 +299,8 @@ go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.4 h1:LYy1Hy3MJdrCdMwwzxA/dRok4ejH+RwNGbuoD9fCjto=
 go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
+go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
+go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 golang.org/x/crypto v0.0.0-20190219172222-a4c6cb3142f2/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190426145343-a29dc8fdc734/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
@@ -272,6 +309,9 @@ golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.13.0 h1:mvySKfSWJ+UKUii46M40LOvyWfN0s2U+46/jDd0e6Ck=
+golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -302,6 +342,7 @@ golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzB
 golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/net v0.0.0-20180530234432-1e491301e022/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180811021610-c39426892332/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -330,12 +371,19 @@ golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/
 golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200707034311-ab3426394381 h1:VXak5I6aEWmAXeQjA+QSZzlgNrpq9mjcfDemuexIKsU=
 golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.15.0 h1:ugBLEUaxABaB5AJqW9enI0ACdci2RUd4eP51NTBvuJ8=
+golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d h1:TzXSXBo42m9gQenoE3b9BGiEpg5IG2JkU5FkPIawgtw=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.12.0 h1:smVPGxink+n1ZI5pkQa8y6fZT0RW0MgCO5bFpepy4B4=
+golang.org/x/oauth2 v0.12.0/go.mod h1:A74bZ3aGXgCY0qaIC9Ahg6Lglin4AMAco8cIv9baba4=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -344,6 +392,7 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -374,12 +423,25 @@ golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200523222454-059865788121 h1:rITEj+UZHYC927n8GT97eC3zrpzXdb/voyeOuVKS46o=
 golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3 h1:cokOdA+Jmi5PJGXLlLllQSgYigAEfHXJAERHVMaCc2k=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
+golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -421,6 +483,7 @@ golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roY
 golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200713011307-fd294ab11aed/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -440,6 +503,8 @@ google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0M
 google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
 google.golang.org/api v0.29.0 h1:BaiDisFir8O4IJxvAabCGGkQ6yCJegNQqSVoYUNAnbk=
 google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
+google.golang.org/api v0.138.0 h1:K/tVp05MxNVbHShRw9m7e9VJGdagNeTdMzqPH7AUqr0=
+google.golang.org/api v0.138.0/go.mod h1:4xyob8CxC+0GChNBvEUAk8VBKNvYOTWM9T3v3UfRxuY=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -447,6 +512,8 @@ google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/appengine v1.6.6 h1:lMO5rYAqUxkmaj76jAkRUvt5JZgFymx/+Q5Mzfivuhc=
 google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
+google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
 google.golang.org/genproto v0.0.0-20170818010345-ee236bd376b0/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
@@ -476,6 +543,10 @@ google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEY
 google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
 google.golang.org/genproto v0.0.0-20200711021454-869866162049 h1:YFTFpQhgvrLrmxtiIncJxFXeCyq84ixuKWVCaCAi9Oc=
 google.golang.org/genproto v0.0.0-20200711021454-869866162049/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20230803162519-f966b187b2e5 h1:L6iMMGrtzgHsWofoFcihmDEMYeDR9KN/ThbPWGrh++g=
+google.golang.org/genproto v0.0.0-20230803162519-f966b187b2e5/go.mod h1:oH/ZOT02u4kWEp7oYBGYFFkCdKS/uYR9Z7+0/xuuFp8=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d h1:uvYuEyMHKNt+lT4K3bN6fGswmK8qSvcreM3BwjDh+y4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d/go.mod h1:+Bk1OCOj40wS2hwAMA+aCW9ypzm63QTBBHp6lQ3p+9M=
 google.golang.org/grpc v1.8.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
@@ -490,6 +561,9 @@ google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3Iji
 google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.32.0 h1:zWTV+LMdc3kaiJMSTOFz2UgSBgx8RNQoTGiZu3fR9S0=
 google.golang.org/grpc v1.32.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
+google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
+google.golang.org/grpc v1.57.0 h1:kfzNeI/klCGD2YPMUlaGNT3pxvYfga7smW3Vth8Zsiw=
+google.golang.org/grpc v1.57.0/go.mod h1:Sd+9RMTACXwmub0zcNY2c4arhtrbBYD1AUHI/dt16Mo=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -501,6 +575,10 @@ google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpAD
 google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
 google.golang.org/protobuf v1.25.0 h1:Ejskq+SyPohKW+1uil0JJMtmHCgJPJ/qWTxr8qp+R4c=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
+google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -515,6 +593,7 @@ gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
diff --git a/tpgtools/handwritten/tpgtools_utils.go b/tpgtools/handwritten/tpgtools_utils.go
index 68fa33e1d0e7..2e60238e3daa 100644
--- a/tpgtools/handwritten/tpgtools_utils.go
+++ b/tpgtools/handwritten/tpgtools_utils.go
@@ -1,6 +1,7 @@
 package tpgdclresource
 
 import (
+	"context"
 	"fmt"
 	"log"
 
@@ -24,3 +25,24 @@ func HandleNotFoundDCLError(err error, d *schema.ResourceData, resourceName stri
 	return errwrap.Wrapf(
 		fmt.Sprintf("Error when reading or editing %s: {{err}}", resourceName), err)
 }
+
+func ResourceContainerAwsNodePoolCustomizeDiffFunc(_ context.Context, diff *schema.ResourceDiff, meta interface{}) error {
+	count := diff.Get("update_settings.#").(int)
+	if count < 1 {
+		return nil
+	}
+
+	oMaxSurge, nMaxSurge := diff.GetChange("update_settings.0.surge_settings.0.max_surge")
+	oMaxUnavailable, nMaxUnavailable := diff.GetChange("update_settings.0.surge_settings.0.max_unavailable")
+
+	// Server default of maxSurge = 1 and maxUnavailable = 0 is not returned
+	// Clear the diff if trying to resolve these specific values
+	if oMaxSurge == 0 && nMaxSurge == 1 && oMaxUnavailable == 0 && nMaxUnavailable == 0 {
+		err := diff.Clear("update_settings")
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/tpgtools/overrides/apikeys/beta/key.yaml b/tpgtools/overrides/apikeys/beta/key.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/apikeys/beta/key.yaml
+++ b/tpgtools/overrides/apikeys/beta/key.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/apikeys/key.yaml b/tpgtools/overrides/apikeys/key.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/apikeys/key.yaml
+++ b/tpgtools/overrides/apikeys/key.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/assuredworkloads/beta/workload.yaml b/tpgtools/overrides/assuredworkloads/beta/workload.yaml
index e69de29bb2d1..b75a7c4a3f6b 100644
--- a/tpgtools/overrides/assuredworkloads/beta/workload.yaml
+++ b/tpgtools/overrides/assuredworkloads/beta/workload.yaml
@@ -0,0 +1,12 @@
+- type: CUSTOM_SCHEMA_VALUES
+  field: enable_sovereign_controls
+  details:
+    required: false
+    optional: true
+    computed: true
+- type: CUSTOM_SCHEMA_VALUES
+  field: violation_notifications_enabled
+  details:
+    required: false
+    optional: true
+    computed: true
\ No newline at end of file
diff --git a/tpgtools/overrides/assuredworkloads/samples/workload/basic.tf.tmpl b/tpgtools/overrides/assuredworkloads/samples/workload/basic.tf.tmpl
index fd154c19057f..8d303ef61437 100644
--- a/tpgtools/overrides/assuredworkloads/samples/workload/basic.tf.tmpl
+++ b/tpgtools/overrides/assuredworkloads/samples/workload/basic.tf.tmpl
@@ -8,6 +8,11 @@ resource "google_assured_workloads_workload" "primary" {
   provisioned_resources_parent = google_folder.folder1.name
   organization = "{{org_id}}"
   location = "us-central1"
+  resource_settings {
+    resource_type = "CONSUMER_FOLDER"
+    display_name = "folder-display-name"
+  }
+  violation_notifications_enabled = true
 }
 
 resource "google_folder" "folder1" {
diff --git a/tpgtools/overrides/assuredworkloads/samples/workload/basic_update.tf.tmpl b/tpgtools/overrides/assuredworkloads/samples/workload/basic_update.tf.tmpl
index 9da19474c62f..4d5fb120eb93 100644
--- a/tpgtools/overrides/assuredworkloads/samples/workload/basic_update.tf.tmpl
+++ b/tpgtools/overrides/assuredworkloads/samples/workload/basic_update.tf.tmpl
@@ -8,6 +8,11 @@ resource "google_assured_workloads_workload" "primary" {
   provisioned_resources_parent = google_folder.folder1.name
   organization = "{{org_id}}"
   location = "us-central1"
+  resource_settings {
+    resource_type = "CONSUMER_FOLDER"
+    display_name = "folder-display-name"
+  }
+  violation_notifications_enabled = true
 }
 
 resource "google_folder" "folder1" {
diff --git a/tpgtools/overrides/assuredworkloads/workload.yaml b/tpgtools/overrides/assuredworkloads/workload.yaml
index e69de29bb2d1..617746f0f6a6 100644
--- a/tpgtools/overrides/assuredworkloads/workload.yaml
+++ b/tpgtools/overrides/assuredworkloads/workload.yaml
@@ -0,0 +1,6 @@
+- type: CUSTOM_SCHEMA_VALUES
+  field: violation_notifications_enabled
+  details:
+    required: false
+    optional: true
+    computed: true
\ No newline at end of file
diff --git a/tpgtools/overrides/bigqueryreservation/assignment.yaml b/tpgtools/overrides/bigqueryreservation/assignment.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/bigqueryreservation/assignment.yaml
+++ b/tpgtools/overrides/bigqueryreservation/assignment.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/bigqueryreservation/beta/assignment.yaml b/tpgtools/overrides/bigqueryreservation/beta/assignment.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/bigqueryreservation/beta/assignment.yaml
+++ b/tpgtools/overrides/bigqueryreservation/beta/assignment.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/cloudbuild/beta/worker_pool.yaml b/tpgtools/overrides/cloudbuild/beta/worker_pool.yaml
index 4deb00daaee1..8c8073b08ca5 100644
--- a/tpgtools/overrides/cloudbuild/beta/worker_pool.yaml
+++ b/tpgtools/overrides/cloudbuild/beta/worker_pool.yaml
@@ -4,3 +4,7 @@
     diffsuppressfunc: tpgresource.CompareResourceNames
 - type: EXCLUDE
   field: etag
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/cloudbuild/worker_pool.yaml b/tpgtools/overrides/cloudbuild/worker_pool.yaml
index 4deb00daaee1..8c8073b08ca5 100644
--- a/tpgtools/overrides/cloudbuild/worker_pool.yaml
+++ b/tpgtools/overrides/cloudbuild/worker_pool.yaml
@@ -4,3 +4,7 @@
     diffsuppressfunc: tpgresource.CompareResourceNames
 - type: EXCLUDE
   field: etag
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/cloudbuildv2/beta/connection.yaml b/tpgtools/overrides/cloudbuildv2/beta/connection.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/cloudbuildv2/beta/connection.yaml
+++ b/tpgtools/overrides/cloudbuildv2/beta/connection.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/cloudbuildv2/beta/repository.yaml b/tpgtools/overrides/cloudbuildv2/beta/repository.yaml
index 01ea7c579c97..8de5a79b7fc7 100644
--- a/tpgtools/overrides/cloudbuildv2/beta/repository.yaml
+++ b/tpgtools/overrides/cloudbuildv2/beta/repository.yaml
@@ -16,3 +16,7 @@
     required: false
     optional: true
     computed: true
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/cloudbuildv2/connection.yaml b/tpgtools/overrides/cloudbuildv2/connection.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/cloudbuildv2/connection.yaml
+++ b/tpgtools/overrides/cloudbuildv2/connection.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/cloudbuildv2/repository.yaml b/tpgtools/overrides/cloudbuildv2/repository.yaml
index 01ea7c579c97..8de5a79b7fc7 100644
--- a/tpgtools/overrides/cloudbuildv2/repository.yaml
+++ b/tpgtools/overrides/cloudbuildv2/repository.yaml
@@ -16,3 +16,7 @@
     required: false
     optional: true
     computed: true
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/cloudbuildv2/samples/connection/ghe.tf.tmpl b/tpgtools/overrides/cloudbuildv2/samples/connection/ghe.tf.tmpl
index 2aece6005734..6841ab373a64 100644
--- a/tpgtools/overrides/cloudbuildv2/samples/connection/ghe.tf.tmpl
+++ b/tpgtools/overrides/cloudbuildv2/samples/connection/ghe.tf.tmpl
@@ -2,7 +2,7 @@ resource "google_secret_manager_secret" "private-key-secret" {
   secret_id = "ghe-pk-secret"
 
   replication {
-    automatic = true
+    auto {}
   }
 }
 
@@ -15,7 +15,7 @@ resource "google_secret_manager_secret" "webhook-secret-secret" {
   secret_id = "github-token-secret"
 
   replication {
-    automatic = true
+    auto {}
   }
 }
 
diff --git a/tpgtools/overrides/cloudbuildv2/samples/connection/github.tf.tmpl b/tpgtools/overrides/cloudbuildv2/samples/connection/github.tf.tmpl
index f25048ef1443..05bd5d6b81dc 100644
--- a/tpgtools/overrides/cloudbuildv2/samples/connection/github.tf.tmpl
+++ b/tpgtools/overrides/cloudbuildv2/samples/connection/github.tf.tmpl
@@ -2,7 +2,7 @@ resource "google_secret_manager_secret" "github-token-secret" {
   secret_id = "github-token-secret"
 
   replication {
-    automatic = true
+    auto {}
   }
 }
 
diff --git a/tpgtools/overrides/cloudbuildv2/samples/repository/ghe.tf.tmpl b/tpgtools/overrides/cloudbuildv2/samples/repository/ghe.tf.tmpl
index 3f6ec4778b26..bf307ddefa98 100644
--- a/tpgtools/overrides/cloudbuildv2/samples/repository/ghe.tf.tmpl
+++ b/tpgtools/overrides/cloudbuildv2/samples/repository/ghe.tf.tmpl
@@ -2,7 +2,7 @@ resource "google_secret_manager_secret" "private-key-secret" {
   secret_id = "ghe-pk-secret"
 
   replication {
-    automatic = true
+    auto {}
   }
 }
 
@@ -15,7 +15,7 @@ resource "google_secret_manager_secret" "webhook-secret-secret" {
   secret_id = "github-token-secret"
 
   replication {
-    automatic = true
+    auto {}
   }
 }
 
diff --git a/tpgtools/overrides/cloudbuildv2/samples/repository/github.tf.tmpl b/tpgtools/overrides/cloudbuildv2/samples/repository/github.tf.tmpl
index 3058a12649d1..1f9f311c850c 100644
--- a/tpgtools/overrides/cloudbuildv2/samples/repository/github.tf.tmpl
+++ b/tpgtools/overrides/cloudbuildv2/samples/repository/github.tf.tmpl
@@ -2,7 +2,7 @@ resource "google_secret_manager_secret" "github-token-secret" {
   secret_id = "github-token-secret"
 
   replication {
-    automatic = true
+    auto {}
   }
 }
 
diff --git a/tpgtools/overrides/clouddeploy/beta/delivery_pipeline.yaml b/tpgtools/overrides/clouddeploy/beta/delivery_pipeline.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/clouddeploy/beta/delivery_pipeline.yaml
+++ b/tpgtools/overrides/clouddeploy/beta/delivery_pipeline.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/clouddeploy/beta/target.yaml b/tpgtools/overrides/clouddeploy/beta/target.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/clouddeploy/beta/target.yaml
+++ b/tpgtools/overrides/clouddeploy/beta/target.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/clouddeploy/delivery_pipeline.yaml b/tpgtools/overrides/clouddeploy/delivery_pipeline.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/clouddeploy/delivery_pipeline.yaml
+++ b/tpgtools/overrides/clouddeploy/delivery_pipeline.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/clouddeploy/target.yaml b/tpgtools/overrides/clouddeploy/target.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/clouddeploy/target.yaml
+++ b/tpgtools/overrides/clouddeploy/target.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/compute/beta/firewall_policy.yaml b/tpgtools/overrides/compute/beta/firewall_policy.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/compute/beta/firewall_policy.yaml
+++ b/tpgtools/overrides/compute/beta/firewall_policy.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/compute/beta/firewall_policy_association.yaml b/tpgtools/overrides/compute/beta/firewall_policy_association.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/compute/beta/firewall_policy_association.yaml
+++ b/tpgtools/overrides/compute/beta/firewall_policy_association.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/compute/beta/firewall_policy_rule.yaml b/tpgtools/overrides/compute/beta/firewall_policy_rule.yaml
index e743d253be12..dc91e4f5a9d5 100644
--- a/tpgtools/overrides/compute/beta/firewall_policy_rule.yaml
+++ b/tpgtools/overrides/compute/beta/firewall_policy_rule.yaml
@@ -2,3 +2,7 @@
   field: target_resources
   details:
     diffsuppressfunc: tpgresource.CompareSelfLinkOrResourceName
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/compute/beta/network_firewall_policy.yaml b/tpgtools/overrides/compute/beta/network_firewall_policy.yaml
index ac4ed8505f0c..ea763ef1b90d 100644
--- a/tpgtools/overrides/compute/beta/network_firewall_policy.yaml
+++ b/tpgtools/overrides/compute/beta/network_firewall_policy.yaml
@@ -15,3 +15,8 @@
   details:
     id: projects/{{project}}/regions/{{region}}/firewallPolicies/{{name}}
   location: region
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
+    - tpgresource.DefaultProviderRegion
diff --git a/tpgtools/overrides/compute/beta/network_firewall_policy_association.yaml b/tpgtools/overrides/compute/beta/network_firewall_policy_association.yaml
index 8919dd2c7cf8..3260bc51a574 100644
--- a/tpgtools/overrides/compute/beta/network_firewall_policy_association.yaml
+++ b/tpgtools/overrides/compute/beta/network_firewall_policy_association.yaml
@@ -31,3 +31,8 @@
     - "projects/{{project}}/global/firewallPolicies/{{firewall_policy}}/associations/{{name}}"
     - "{{project}}/{{firewall_policy}}/{{name}}"
   location: global 
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
+    - tpgresource.DefaultProviderRegion
diff --git a/tpgtools/overrides/compute/beta/network_firewall_policy_rule.yaml b/tpgtools/overrides/compute/beta/network_firewall_policy_rule.yaml
index 6c0153011095..4ad5ccbeee34 100644
--- a/tpgtools/overrides/compute/beta/network_firewall_policy_rule.yaml
+++ b/tpgtools/overrides/compute/beta/network_firewall_policy_rule.yaml
@@ -17,3 +17,8 @@
   details:
     id: projects/{{project}}/regions/{{region}}/firewallPolicies/{{firewall_policy}}/{{priority}}
   location: region
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
+    - tpgresource.DefaultProviderRegion
diff --git a/tpgtools/overrides/compute/firewall_policy.yaml b/tpgtools/overrides/compute/firewall_policy.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/compute/firewall_policy.yaml
+++ b/tpgtools/overrides/compute/firewall_policy.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/compute/firewall_policy_association.yaml b/tpgtools/overrides/compute/firewall_policy_association.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/compute/firewall_policy_association.yaml
+++ b/tpgtools/overrides/compute/firewall_policy_association.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/compute/firewall_policy_rule.yaml b/tpgtools/overrides/compute/firewall_policy_rule.yaml
index e743d253be12..dc91e4f5a9d5 100644
--- a/tpgtools/overrides/compute/firewall_policy_rule.yaml
+++ b/tpgtools/overrides/compute/firewall_policy_rule.yaml
@@ -2,3 +2,7 @@
   field: target_resources
   details:
     diffsuppressfunc: tpgresource.CompareSelfLinkOrResourceName
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/compute/network_firewall_policy.yaml b/tpgtools/overrides/compute/network_firewall_policy.yaml
index ac4ed8505f0c..ea763ef1b90d 100644
--- a/tpgtools/overrides/compute/network_firewall_policy.yaml
+++ b/tpgtools/overrides/compute/network_firewall_policy.yaml
@@ -15,3 +15,8 @@
   details:
     id: projects/{{project}}/regions/{{region}}/firewallPolicies/{{name}}
   location: region
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
+    - tpgresource.DefaultProviderRegion
diff --git a/tpgtools/overrides/compute/network_firewall_policy_association.yaml b/tpgtools/overrides/compute/network_firewall_policy_association.yaml
index 8919dd2c7cf8..3260bc51a574 100644
--- a/tpgtools/overrides/compute/network_firewall_policy_association.yaml
+++ b/tpgtools/overrides/compute/network_firewall_policy_association.yaml
@@ -31,3 +31,8 @@
     - "projects/{{project}}/global/firewallPolicies/{{firewall_policy}}/associations/{{name}}"
     - "{{project}}/{{firewall_policy}}/{{name}}"
   location: global 
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
+    - tpgresource.DefaultProviderRegion
diff --git a/tpgtools/overrides/compute/network_firewall_policy_rule.yaml b/tpgtools/overrides/compute/network_firewall_policy_rule.yaml
index 6c0153011095..4ad5ccbeee34 100644
--- a/tpgtools/overrides/compute/network_firewall_policy_rule.yaml
+++ b/tpgtools/overrides/compute/network_firewall_policy_rule.yaml
@@ -17,3 +17,8 @@
   details:
     id: projects/{{project}}/regions/{{region}}/firewallPolicies/{{firewall_policy}}/{{priority}}
   location: region
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
+    - tpgresource.DefaultProviderRegion
diff --git a/tpgtools/overrides/containeraws/beta/cluster.yaml b/tpgtools/overrides/containeraws/beta/cluster.yaml
index 94133162675a..534584d856d3 100644
--- a/tpgtools/overrides/containeraws/beta/cluster.yaml
+++ b/tpgtools/overrides/containeraws/beta/cluster.yaml
@@ -3,6 +3,10 @@
 - type: NO_SWEEPER
 - type: EXCLUDE
   field: monitoring_config
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
 - type: DIFF_SUPPRESS_FUNC
   field: control_plane.root_volume.volume_type
   details:
diff --git a/tpgtools/overrides/containeraws/beta/node_pool.yaml b/tpgtools/overrides/containeraws/beta/node_pool.yaml
index e16b502f32ef..9a25ea0089a2 100644
--- a/tpgtools/overrides/containeraws/beta/node_pool.yaml
+++ b/tpgtools/overrides/containeraws/beta/node_pool.yaml
@@ -1,3 +1,8 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
+    - tpgdclresource.ResourceContainerAwsNodePoolCustomizeDiffFunc
 - type: DIFF_SUPPRESS_FUNC
   field: config.root_volume.volume_type
   details:
@@ -10,3 +15,17 @@
   field: config.instance_placement.tenancy
   details:
     diffsuppressfunc: tpgresource.CompareCaseInsensitive
+- type: CUSTOM_STATE_SETTER
+  field: management
+  details:
+    function: d.Set("management", tpgresource.FlattenContainerAwsNodePoolManagement(res.Management, d, config))
+- type: CUSTOM_SCHEMA_VALUES
+  field: management
+  details:
+    optional: true
+    computed: true
+- type: CUSTOM_SCHEMA_VALUES
+  field: management.auto_repair
+  details:
+    optional: true
+    computed: true
diff --git a/tpgtools/overrides/containeraws/cluster.yaml b/tpgtools/overrides/containeraws/cluster.yaml
index 5a8e72bbad15..5db8bc4d3ede 100644
--- a/tpgtools/overrides/containeraws/cluster.yaml
+++ b/tpgtools/overrides/containeraws/cluster.yaml
@@ -1,6 +1,10 @@
 # GKE MultiCloud uses a different set of locations than GCE, and our default
 # sweeper logic assumes that resources are in us-central1.
 - type: NO_SWEEPER
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
 - type: DIFF_SUPPRESS_FUNC
   field: control_plane.root_volume.volume_type
   details:
diff --git a/tpgtools/overrides/containeraws/node_pool.yaml b/tpgtools/overrides/containeraws/node_pool.yaml
index 4f76c9df9c1e..f94cbca06d97 100644
--- a/tpgtools/overrides/containeraws/node_pool.yaml
+++ b/tpgtools/overrides/containeraws/node_pool.yaml
@@ -1,3 +1,7 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
 - type: DIFF_SUPPRESS_FUNC
   field: config.root_volume.volume_type
   details:
@@ -6,3 +10,17 @@
   field: config.taints.effect
   details:
     diffsuppressfunc: tpgresource.CompareCaseInsensitive
+- type: CUSTOM_STATE_SETTER
+  field: management
+  details:
+    function: d.Set("management", tpgresource.FlattenContainerAwsNodePoolManagement(res.Management, d, config))
+- type: CUSTOM_SCHEMA_VALUES
+  field: management
+  details:
+    optional: true
+    computed: true
+- type: CUSTOM_SCHEMA_VALUES
+  field: management.auto_repair
+  details:
+    optional: true
+    computed: true
diff --git a/tpgtools/overrides/containeraws/samples/cluster/basic.tf.tmpl b/tpgtools/overrides/containeraws/samples/cluster/basic.tf.tmpl
index ffa75537965e..cba4d5fefbb9 100644
--- a/tpgtools/overrides/containeraws/samples/cluster/basic.tf.tmpl
+++ b/tpgtools/overrides/containeraws/samples/cluster/basic.tf.tmpl
@@ -8,6 +8,9 @@ resource "google_container_aws_cluster" "primary" {
     admin_users {
       username = "{{test_service_account}}"
     }
+    admin_groups {
+      group = "group@domain.com"
+    }
   }
 
   aws_region = "{{aws_region}}"
diff --git a/tpgtools/overrides/containeraws/samples/cluster/basic_update.tf.tmpl b/tpgtools/overrides/containeraws/samples/cluster/basic_update.tf.tmpl
index c20cc9b2345d..5273978a0121 100644
--- a/tpgtools/overrides/containeraws/samples/cluster/basic_update.tf.tmpl
+++ b/tpgtools/overrides/containeraws/samples/cluster/basic_update.tf.tmpl
@@ -8,6 +8,9 @@ resource "google_container_aws_cluster" "primary" {
     admin_users {
       username = "{{test_service_account}}"
     }
+    admin_groups {
+      group = "group@domain.com"
+    }
   }
 
   aws_region = "{{aws_region}}"
diff --git a/tpgtools/overrides/containeraws/samples/cluster/beta_basic_enum_update.tf.tmpl b/tpgtools/overrides/containeraws/samples/cluster/beta_basic_enum_update.tf.tmpl
index e77928ece260..73b33d002742 100644
--- a/tpgtools/overrides/containeraws/samples/cluster/beta_basic_enum_update.tf.tmpl
+++ b/tpgtools/overrides/containeraws/samples/cluster/beta_basic_enum_update.tf.tmpl
@@ -14,6 +14,10 @@ resource "google_container_aws_cluster" "primary" {
 
   aws_region = "{{aws_region}}"
 
+  binary_authorization {
+    evaluation_mode = "PROJECT_SINGLETON_POLICY_ENFORCE"
+  }
+
   control_plane {
     aws_services_authentication {
       role_arn          = "arn:aws:iam::{{aws_account_id}}:role/{{byo_multicloud_prefix}}-1p-dev-oneplatform"
diff --git a/tpgtools/overrides/containeraws/samples/nodepool/basic.tf.tmpl b/tpgtools/overrides/containeraws/samples/nodepool/basic.tf.tmpl
index abb995117a02..fd11ead5739d 100644
--- a/tpgtools/overrides/containeraws/samples/nodepool/basic.tf.tmpl
+++ b/tpgtools/overrides/containeraws/samples/nodepool/basic.tf.tmpl
@@ -146,6 +146,10 @@ resource "google_container_aws_node_pool" "primary" {
     label-one = "value-one"
   }
 
+  management {
+    auto_repair = true
+  }
+
   project = "{{project}}"
 }
 
diff --git a/tpgtools/overrides/containeraws/samples/nodepool/basic_update.tf.tmpl b/tpgtools/overrides/containeraws/samples/nodepool/basic_update.tf.tmpl
index 85c7870fbf1c..d7a2cb9aab28 100644
--- a/tpgtools/overrides/containeraws/samples/nodepool/basic_update.tf.tmpl
+++ b/tpgtools/overrides/containeraws/samples/nodepool/basic_update.tf.tmpl
@@ -145,6 +145,10 @@ resource "google_container_aws_node_pool" "primary" {
     label-two = "value-two"
   }
 
+  management {
+    auto_repair = false
+  }
+
   project = "{{project}}"
 }
 
diff --git a/tpgtools/overrides/containeraws/samples/nodepool/beta_basic.tf.tmpl b/tpgtools/overrides/containeraws/samples/nodepool/beta_basic.tf.tmpl
index 58252330d551..48e57734a938 100644
--- a/tpgtools/overrides/containeraws/samples/nodepool/beta_basic.tf.tmpl
+++ b/tpgtools/overrides/containeraws/samples/nodepool/beta_basic.tf.tmpl
@@ -150,11 +150,22 @@ resource "google_container_aws_node_pool" "primary" {
   name      = "{{node-pool-name}}"
   subnet_id = "{{aws_subnet}}"
   version   = "${data.google_container_aws_versions.versions.valid_versions[0]}"
+  
+  management {
+    auto_repair = true
+  }
 
   annotations = {
     label-one = "value-one"
   }
 
+  update_settings {
+    surge_settings {
+      max_surge = 1
+      max_unavailable = 0
+    }
+  }
+
   project = "{{project}}"
 }
 
diff --git a/tpgtools/overrides/containeraws/samples/nodepool/beta_basic_update.tf.tmpl b/tpgtools/overrides/containeraws/samples/nodepool/beta_basic_update.tf.tmpl
index 13037629cb09..1afdb2e909b1 100644
--- a/tpgtools/overrides/containeraws/samples/nodepool/beta_basic_update.tf.tmpl
+++ b/tpgtools/overrides/containeraws/samples/nodepool/beta_basic_update.tf.tmpl
@@ -150,10 +150,21 @@ resource "google_container_aws_node_pool" "primary" {
   subnet_id = "{{aws_subnet}}"
   version   = "${data.google_container_aws_versions.versions.valid_versions[0]}"
 
+  management {
+    auto_repair = false
+  }
+
   annotations = {
     label-two = "value-two"
   }
 
+  update_settings {
+    surge_settings {
+      max_surge = 1
+      max_unavailable = 0
+    }
+  }
+
   project = "{{project}}"
 }
 
diff --git a/tpgtools/overrides/containeraws/samples/nodepool/meta.yaml b/tpgtools/overrides/containeraws/samples/nodepool/meta.yaml
index 1f3464c256a4..b14ec31e9af2 100644
--- a/tpgtools/overrides/containeraws/samples/nodepool/meta.yaml
+++ b/tpgtools/overrides/containeraws/samples/nodepool/meta.yaml
@@ -1,4 +1,7 @@
 ignore_read:
   - fleet.0.project
+  - management.#
+  - management.0.%
+  - management.0.auto_repair
 doc_hide:
   - beta_basic.tf.tmpl
diff --git a/tpgtools/overrides/containerazure/azure_client.yaml b/tpgtools/overrides/containerazure/azure_client.yaml
index 6c130fe26fab..a3c82651a742 100644
--- a/tpgtools/overrides/containerazure/azure_client.yaml
+++ b/tpgtools/overrides/containerazure/azure_client.yaml
@@ -1,3 +1,7 @@
 # GKE MultiCloud uses a different set of locations than GCE, and our default
 # sweeper logic assumes that resources are in us-central1.
 - type: NO_SWEEPER
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/containerazure/beta/azure_client.yaml b/tpgtools/overrides/containerazure/beta/azure_client.yaml
index 6c130fe26fab..a3c82651a742 100644
--- a/tpgtools/overrides/containerazure/beta/azure_client.yaml
+++ b/tpgtools/overrides/containerazure/beta/azure_client.yaml
@@ -1,3 +1,7 @@
 # GKE MultiCloud uses a different set of locations than GCE, and our default
 # sweeper logic assumes that resources are in us-central1.
 - type: NO_SWEEPER
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/containerazure/beta/cluster.yaml b/tpgtools/overrides/containerazure/beta/cluster.yaml
index f4e3a091bafc..c3ce9bb16b32 100644
--- a/tpgtools/overrides/containerazure/beta/cluster.yaml
+++ b/tpgtools/overrides/containerazure/beta/cluster.yaml
@@ -3,6 +3,10 @@
 - type: NO_SWEEPER
 - type: EXCLUDE
   field: monitoring_config
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
 - type: DIFF_SUPPRESS_FUNC
   field: logging_config.component_config.enable_components
   details:
diff --git a/tpgtools/overrides/containerazure/beta/node_pool.yaml b/tpgtools/overrides/containerazure/beta/node_pool.yaml
index e69de29bb2d1..7455aaf975dc 100644
--- a/tpgtools/overrides/containerazure/beta/node_pool.yaml
+++ b/tpgtools/overrides/containerazure/beta/node_pool.yaml
@@ -0,0 +1,18 @@
+- type: CUSTOM_STATE_SETTER
+  field: management
+  details:
+    function: d.Set("management", tpgresource.FlattenContainerAzureNodePoolManagement(res.Management, d, config))
+- type: CUSTOM_SCHEMA_VALUES
+  field: management
+  details:
+    optional: true
+    computed: true
+- type: CUSTOM_SCHEMA_VALUES
+  field: management.auto_repair
+  details:
+    optional: true
+    computed: true
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/containerazure/cluster.yaml b/tpgtools/overrides/containerazure/cluster.yaml
index 6c130fe26fab..a3c82651a742 100644
--- a/tpgtools/overrides/containerazure/cluster.yaml
+++ b/tpgtools/overrides/containerazure/cluster.yaml
@@ -1,3 +1,7 @@
 # GKE MultiCloud uses a different set of locations than GCE, and our default
 # sweeper logic assumes that resources are in us-central1.
 - type: NO_SWEEPER
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/containerazure/node_pool.yaml b/tpgtools/overrides/containerazure/node_pool.yaml
index e69de29bb2d1..7455aaf975dc 100644
--- a/tpgtools/overrides/containerazure/node_pool.yaml
+++ b/tpgtools/overrides/containerazure/node_pool.yaml
@@ -0,0 +1,18 @@
+- type: CUSTOM_STATE_SETTER
+  field: management
+  details:
+    function: d.Set("management", tpgresource.FlattenContainerAzureNodePoolManagement(res.Management, d, config))
+- type: CUSTOM_SCHEMA_VALUES
+  field: management
+  details:
+    optional: true
+    computed: true
+- type: CUSTOM_SCHEMA_VALUES
+  field: management.auto_repair
+  details:
+    optional: true
+    computed: true
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/containerazure/samples/cluster/basic.tf.tmpl b/tpgtools/overrides/containerazure/samples/cluster/basic.tf.tmpl
index dd043e5fe5ce..712364a3b4b1 100644
--- a/tpgtools/overrides/containerazure/samples/cluster/basic.tf.tmpl
+++ b/tpgtools/overrides/containerazure/samples/cluster/basic.tf.tmpl
@@ -8,6 +8,9 @@ resource "google_container_azure_cluster" "primary" {
     admin_users {
       username = "mmv2@google.com"
     }
+    admin_groups {
+      group = "group@domain.com"
+    }
   }
 
   azure_region = "westus2"
diff --git a/tpgtools/overrides/containerazure/samples/cluster/basic_update.tf.tmpl b/tpgtools/overrides/containerazure/samples/cluster/basic_update.tf.tmpl
index 0c2632431f82..a010a7fa4126 100644
--- a/tpgtools/overrides/containerazure/samples/cluster/basic_update.tf.tmpl
+++ b/tpgtools/overrides/containerazure/samples/cluster/basic_update.tf.tmpl
@@ -8,6 +8,9 @@ resource "google_container_azure_cluster" "primary" {
     admin_users {
       username = "mmv2@google.com"
     }
+    admin_groups {
+      group = "group@domain.com"
+    }
   }
 
   azure_region = "westus2"
diff --git a/tpgtools/overrides/containerazure/samples/nodepool/basic.tf.tmpl b/tpgtools/overrides/containerazure/samples/nodepool/basic.tf.tmpl
index 9130e0b68e42..8ea45ee3f996 100644
--- a/tpgtools/overrides/containerazure/samples/nodepool/basic.tf.tmpl
+++ b/tpgtools/overrides/containerazure/samples/nodepool/basic.tf.tmpl
@@ -90,6 +90,10 @@ resource "google_container_azure_node_pool" "primary" {
     annotation-one = "value-one"
   }
 
+  management {
+    auto_repair = true
+  }
+
   project = "{{project}}"
 }
 
diff --git a/tpgtools/overrides/containerazure/samples/nodepool/basic_update.tf.tmpl b/tpgtools/overrides/containerazure/samples/nodepool/basic_update.tf.tmpl
index 31b230b5c09f..2786c74963b7 100644
--- a/tpgtools/overrides/containerazure/samples/nodepool/basic_update.tf.tmpl
+++ b/tpgtools/overrides/containerazure/samples/nodepool/basic_update.tf.tmpl
@@ -91,6 +91,10 @@ resource "google_container_azure_node_pool" "primary" {
     annotation-two = "value-two"
   }
 
+  management {
+    auto_repair = false
+  }
+
   project = "{{project}}"
 }
 
diff --git a/tpgtools/overrides/containerazure/samples/nodepool/beta_basic.tf.tmpl b/tpgtools/overrides/containerazure/samples/nodepool/beta_basic.tf.tmpl
index ff9cb4c233db..4967311d5107 100644
--- a/tpgtools/overrides/containerazure/samples/nodepool/beta_basic.tf.tmpl
+++ b/tpgtools/overrides/containerazure/samples/nodepool/beta_basic.tf.tmpl
@@ -92,6 +92,10 @@ resource "google_container_azure_node_pool" "primary" {
   subnet_id = "/subscriptions/{{azure_subscription}}/resourceGroups/{{byo_multicloud_prefix}}-dev-byo/providers/Microsoft.Network/virtualNetworks/{{byo_multicloud_prefix}}-dev-vnet/subnets/default"
   version   = "${data.google_container_azure_versions.versions.valid_versions[0]}"
 
+  management {
+    auto_repair = true
+  }
+
   annotations = {
     annotation-one = "value-one"
   }
diff --git a/tpgtools/overrides/containerazure/samples/nodepool/beta_basic_update.tf.tmpl b/tpgtools/overrides/containerazure/samples/nodepool/beta_basic_update.tf.tmpl
index 2aef4c024ba4..2156af0dc662 100644
--- a/tpgtools/overrides/containerazure/samples/nodepool/beta_basic_update.tf.tmpl
+++ b/tpgtools/overrides/containerazure/samples/nodepool/beta_basic_update.tf.tmpl
@@ -93,6 +93,10 @@ resource "google_container_azure_node_pool" "primary" {
   subnet_id = "/subscriptions/{{azure_subscription}}/resourceGroups/{{byo_multicloud_prefix}}-dev-byo/providers/Microsoft.Network/virtualNetworks/{{byo_multicloud_prefix}}-dev-vnet/subnets/default"
   version   = "${data.google_container_azure_versions.versions.valid_versions[0]}"
 
+  management {
+    auto_repair = false
+  }
+
   annotations = {
     annotation-two = "value-two"
   }
diff --git a/tpgtools/overrides/containerazure/samples/nodepool/meta.yaml b/tpgtools/overrides/containerazure/samples/nodepool/meta.yaml
index 0e7b5556a993..09bdf3c9ce82 100644
--- a/tpgtools/overrides/containerazure/samples/nodepool/meta.yaml
+++ b/tpgtools/overrides/containerazure/samples/nodepool/meta.yaml
@@ -1,2 +1,6 @@
+ignore_read:
+  - management.#
+  - management.0.%
+  - management.0.auto_repair
 doc_hide:
   - beta_basic.tf.tmpl
\ No newline at end of file
diff --git a/tpgtools/overrides/dataplex/asset.yaml b/tpgtools/overrides/dataplex/asset.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/dataplex/asset.yaml
+++ b/tpgtools/overrides/dataplex/asset.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/dataplex/beta/asset.yaml b/tpgtools/overrides/dataplex/beta/asset.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/dataplex/beta/asset.yaml
+++ b/tpgtools/overrides/dataplex/beta/asset.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/dataplex/beta/lake.yaml b/tpgtools/overrides/dataplex/beta/lake.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/dataplex/beta/lake.yaml
+++ b/tpgtools/overrides/dataplex/beta/lake.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/dataplex/beta/zone.yaml b/tpgtools/overrides/dataplex/beta/zone.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/dataplex/beta/zone.yaml
+++ b/tpgtools/overrides/dataplex/beta/zone.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/dataplex/lake.yaml b/tpgtools/overrides/dataplex/lake.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/dataplex/lake.yaml
+++ b/tpgtools/overrides/dataplex/lake.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/dataplex/samples/asset/basic_asset.tf.tmpl b/tpgtools/overrides/dataplex/samples/asset/basic_asset.tf.tmpl
index 07c9141bb937..d3f18d1990dd 100644
--- a/tpgtools/overrides/dataplex/samples/asset/basic_asset.tf.tmpl
+++ b/tpgtools/overrides/dataplex/samples/asset/basic_asset.tf.tmpl
@@ -52,6 +52,12 @@ resource "google_dataplex_asset" "primary" {
     name = "projects/{{project}}/buckets/{{bucket}}"
     type = "STORAGE_BUCKET"
   }
+
+  labels = {
+    env     = "foo"
+    my-asset = "exists"
+  }
+
  
   project = "{{project}}"
   depends_on = [
diff --git a/tpgtools/overrides/dataplex/zone.yaml b/tpgtools/overrides/dataplex/zone.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/dataplex/zone.yaml
+++ b/tpgtools/overrides/dataplex/zone.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/dataproc/beta/workflow_template.yaml b/tpgtools/overrides/dataproc/beta/workflow_template.yaml
index a0cea3403c87..da6b1fa0e6ad 100644
--- a/tpgtools/overrides/dataproc/beta/workflow_template.yaml
+++ b/tpgtools/overrides/dataproc/beta/workflow_template.yaml
@@ -9,3 +9,7 @@
   details:
     message: >-
       version is not useful as a configurable field, and will be removed in the future.
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/dataproc/workflow_template.yaml b/tpgtools/overrides/dataproc/workflow_template.yaml
index a0cea3403c87..da6b1fa0e6ad 100644
--- a/tpgtools/overrides/dataproc/workflow_template.yaml
+++ b/tpgtools/overrides/dataproc/workflow_template.yaml
@@ -9,3 +9,7 @@
   details:
     message: >-
       version is not useful as a configurable field, and will be removed in the future.
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/eventarc/beta/channel.yaml b/tpgtools/overrides/eventarc/beta/channel.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/eventarc/beta/channel.yaml
+++ b/tpgtools/overrides/eventarc/beta/channel.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/eventarc/beta/google_channel_config.yaml b/tpgtools/overrides/eventarc/beta/google_channel_config.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/eventarc/beta/google_channel_config.yaml
+++ b/tpgtools/overrides/eventarc/beta/google_channel_config.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/eventarc/beta/trigger.yaml b/tpgtools/overrides/eventarc/beta/trigger.yaml
index 2b02fd09b9ce..9014b1241575 100644
--- a/tpgtools/overrides/eventarc/beta/trigger.yaml
+++ b/tpgtools/overrides/eventarc/beta/trigger.yaml
@@ -11,4 +11,7 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/eventarc/channel.yaml b/tpgtools/overrides/eventarc/channel.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/eventarc/channel.yaml
+++ b/tpgtools/overrides/eventarc/channel.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/eventarc/google_channel_config.yaml b/tpgtools/overrides/eventarc/google_channel_config.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/eventarc/google_channel_config.yaml
+++ b/tpgtools/overrides/eventarc/google_channel_config.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/eventarc/samples/trigger/basic_update_json.tf.tmpl b/tpgtools/overrides/eventarc/samples/trigger/basic_update_json.tf.tmpl
deleted file mode 100644
index de6ee2b9ae15..000000000000
--- a/tpgtools/overrides/eventarc/samples/trigger/basic_update_json.tf.tmpl
+++ /dev/null
@@ -1,46 +0,0 @@
-resource "google_eventarc_trigger" "primary" {
-	name = "{{name}}"
-	location = "europe-west1"
-	matching_criteria {
-		attribute = "type"
-		value = "google.cloud.pubsub.topic.v1.messagePublished"
-	}
-	destination {
-		cloud_run_service {
-			service = google_cloud_run_service.default.name
-			region = "europe-west1"
-		}
-	}
-    event_data_content_type = "application/json"
-}
-
-resource "google_pubsub_topic" "foo" {
-	name = "{{topic}}"
-}
-
-resource "google_cloud_run_service" "default" {
-	name     = "{{eventarc-service}}"
-	location = "europe-west1"
-
-	metadata {
-		namespace = "{{project}}"
-	}
-
-	template {
-		spec {
-			containers {
-				image = "gcr.io/cloudrun/hello"
-				ports {
-					container_port = 8080
-				}
-			}
-			container_concurrency = 50
-			timeout_seconds = 100
-		}
-	}
-
-	traffic {
-		percent         = 100
-		latest_revision = true
-	}
-}
diff --git a/tpgtools/overrides/eventarc/samples/trigger/basic_update_proto.tf.tmpl b/tpgtools/overrides/eventarc/samples/trigger/basic_update_proto.tf.tmpl
deleted file mode 100644
index a8594608cd29..000000000000
--- a/tpgtools/overrides/eventarc/samples/trigger/basic_update_proto.tf.tmpl
+++ /dev/null
@@ -1,46 +0,0 @@
-resource "google_eventarc_trigger" "primary" {
-	name = "{{name}}"
-	location = "europe-west1"
-	matching_criteria {
-		attribute = "type"
-		value = "google.cloud.pubsub.topic.v1.messagePublished"
-	}
-	destination {
-		cloud_run_service {
-			service = google_cloud_run_service.default.name
-			region = "europe-west1"
-		}
-	}
-    event_data_content_type = "application/proto"
-}
-
-resource "google_pubsub_topic" "foo" {
-	name = "{{topic}}"
-}
-
-resource "google_cloud_run_service" "default" {
-	name     = "{{eventarc-service}}"
-	location = "europe-west1"
-
-	metadata {
-		namespace = "{{project}}"
-	}
-
-	template {
-		spec {
-			containers {
-				image = "gcr.io/cloudrun/hello"
-				ports {
-					container_port = 8080
-				}
-			}
-			container_concurrency = 50
-			timeout_seconds = 100
-		}
-	}
-
-	traffic {
-		percent         = 100
-		latest_revision = true
-	}
-}
diff --git a/tpgtools/overrides/eventarc/trigger.yaml b/tpgtools/overrides/eventarc/trigger.yaml
index 13ed711e62fe..9014b1241575 100644
--- a/tpgtools/overrides/eventarc/trigger.yaml
+++ b/tpgtools/overrides/eventarc/trigger.yaml
@@ -11,3 +11,7 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/firebaserules/beta/release.yaml b/tpgtools/overrides/firebaserules/beta/release.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/firebaserules/beta/release.yaml
+++ b/tpgtools/overrides/firebaserules/beta/release.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/firebaserules/beta/ruleset.yaml b/tpgtools/overrides/firebaserules/beta/ruleset.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/firebaserules/beta/ruleset.yaml
+++ b/tpgtools/overrides/firebaserules/beta/ruleset.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/firebaserules/release.yaml b/tpgtools/overrides/firebaserules/release.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/firebaserules/release.yaml
+++ b/tpgtools/overrides/firebaserules/release.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/firebaserules/ruleset.yaml b/tpgtools/overrides/firebaserules/ruleset.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/firebaserules/ruleset.yaml
+++ b/tpgtools/overrides/firebaserules/ruleset.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/firebaserules/samples/release/firestore_release.yaml b/tpgtools/overrides/firebaserules/samples/release/firestore_release.yaml
index 4ae842c1d411..814b4c37d22a 100644
--- a/tpgtools/overrides/firebaserules/samples/release/firestore_release.yaml
+++ b/tpgtools/overrides/firebaserules/samples/release/firestore_release.yaml
@@ -18,8 +18,6 @@ versions:
 - ga
 - beta
 resource: ./firestore_release.tf.tmpl
-updates:
-- resource: ./firestore_release_update.tf.tmpl
 variables:
 - name: project
   type: project
\ No newline at end of file
diff --git a/tpgtools/overrides/firebaserules/samples/release/firestore_release_update.tf.tmpl b/tpgtools/overrides/firebaserules/samples/release/firestore_release_update.tf.tmpl
deleted file mode 100644
index d279c25e2a58..000000000000
--- a/tpgtools/overrides/firebaserules/samples/release/firestore_release_update.tf.tmpl
+++ /dev/null
@@ -1,22 +0,0 @@
-resource "google_firebaserules_release" "primary" {
-  name         = "cloud.firestore"
-  ruleset_name = "projects/{{project}}/rulesets/${google_firebaserules_ruleset.firestore.name}"
-  project      = "{{project}}"
-
-  lifecycle {
-    replace_triggered_by = [
-      google_firebaserules_ruleset.firestore
-    ]
-  }
-}
-
-resource "google_firebaserules_ruleset" "firestore" {
-  source {
-    files {
-      content = "service cloud.firestore {match /databases/{database}/documents { match /{document=**} { allow read, write: if request.auth != null; } } }"
-      name    = "firestore.rules"
-    }
-  }
-
-  project = "{{project}}"
-}
diff --git a/tpgtools/overrides/gkehub/beta/feature_membership.yaml b/tpgtools/overrides/gkehub/beta/feature_membership.yaml
index 2e8b8f32503c..3eac7364e119 100644
--- a/tpgtools/overrides/gkehub/beta/feature_membership.yaml
+++ b/tpgtools/overrides/gkehub/beta/feature_membership.yaml
@@ -24,4 +24,8 @@
   field: mesh.control_plane
   details:
     message: >-
-      Deprecated in favor of the `management` field
\ No newline at end of file
+      Deprecated in favor of the `management` field
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/networkconnectivity/beta/hub.yaml b/tpgtools/overrides/networkconnectivity/beta/hub.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/networkconnectivity/beta/hub.yaml
+++ b/tpgtools/overrides/networkconnectivity/beta/hub.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/networkconnectivity/beta/spoke.yaml b/tpgtools/overrides/networkconnectivity/beta/spoke.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/networkconnectivity/beta/spoke.yaml
+++ b/tpgtools/overrides/networkconnectivity/beta/spoke.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/networkconnectivity/hub.yaml b/tpgtools/overrides/networkconnectivity/hub.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/networkconnectivity/hub.yaml
+++ b/tpgtools/overrides/networkconnectivity/hub.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/networkconnectivity/samples/spoke/linked_vpc_network.tf.tmpl b/tpgtools/overrides/networkconnectivity/samples/spoke/linked_vpc_network.tf.tmpl
new file mode 100644
index 000000000000..8a1bd423b3bb
--- /dev/null
+++ b/tpgtools/overrides/networkconnectivity/samples/spoke/linked_vpc_network.tf.tmpl
@@ -0,0 +1,30 @@
+
+resource "google_compute_network" "network" {
+  name                    = "{{network}}"
+  auto_create_subnetworks = false
+}
+
+resource "google_network_connectivity_hub" "basic_hub" {
+  name        = "{{hub}}"
+  description = "A sample hub"
+  labels = {
+    label-two = "value-one"
+  }
+}
+
+resource "google_network_connectivity_spoke" "primary" {
+  name = "{{name}}"
+  location = "global"
+  description = "A sample spoke with a linked routher appliance instance"
+  labels = {
+    label-one = "value-one"
+  }
+  hub = google_network_connectivity_hub.basic_hub.id
+  linked_vpc_network {
+    exclude_export_ranges = [
+      "198.51.100.0/24",
+      "10.10.0.0/16"
+    ]
+    uri = google_compute_network.network.self_link
+  }
+}
\ No newline at end of file
diff --git a/tpgtools/overrides/networkconnectivity/samples/spoke/linked_vpc_network.yaml b/tpgtools/overrides/networkconnectivity/samples/spoke/linked_vpc_network.yaml
new file mode 100644
index 000000000000..ec8fa78bb2fd
--- /dev/null
+++ b/tpgtools/overrides/networkconnectivity/samples/spoke/linked_vpc_network.yaml
@@ -0,0 +1,13 @@
+updates:
+  - resource: linked_vpc_network.tf.tmpl
+variables:
+  - name: "project"
+    type: "project"
+  - name: "region"
+    type: "region"
+  - name: "name"
+    type: "resource_name"
+  - name: "hub"
+    type: "resource_name"
+  - name: "network"
+    type: "resource_name"
diff --git a/tpgtools/overrides/networkconnectivity/spoke.yaml b/tpgtools/overrides/networkconnectivity/spoke.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/networkconnectivity/spoke.yaml
+++ b/tpgtools/overrides/networkconnectivity/spoke.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/orgpolicy/beta/policy.yaml b/tpgtools/overrides/orgpolicy/beta/policy.yaml
index c27653ff9807..e31fa2fc2c0a 100644
--- a/tpgtools/overrides/orgpolicy/beta/policy.yaml
+++ b/tpgtools/overrides/orgpolicy/beta/policy.yaml
@@ -7,3 +7,5 @@
   field: spec.rules.deny_all
 - type: ENUM_BOOL
   field: spec.rules.enforce
+- type: EXCLUDE
+  field: dry_run_spec
diff --git a/tpgtools/overrides/orgpolicy/policy.yaml b/tpgtools/overrides/orgpolicy/policy.yaml
index c27653ff9807..08ff9e6b371f 100644
--- a/tpgtools/overrides/orgpolicy/policy.yaml
+++ b/tpgtools/overrides/orgpolicy/policy.yaml
@@ -7,3 +7,9 @@
   field: spec.rules.deny_all
 - type: ENUM_BOOL
   field: spec.rules.enforce
+- type: ENUM_BOOL
+  field: dry_run_spec.rules.allow_all
+- type: ENUM_BOOL
+  field: dry_run_spec.rules.deny_all
+- type: ENUM_BOOL
+  field: dry_run_spec.rules.enforce
\ No newline at end of file
diff --git a/tpgtools/overrides/orgpolicy/samples/policy/meta.yaml b/tpgtools/overrides/orgpolicy/samples/policy/meta.yaml
index aecd139b9102..fe632768fe17 100644
--- a/tpgtools/overrides/orgpolicy/samples/policy/meta.yaml
+++ b/tpgtools/overrides/orgpolicy/samples/policy/meta.yaml
@@ -1,3 +1,8 @@
 ignore_read:
   - name
   - "spec.0.rules.0.condition.0.expression"
+# The feature for this sample is not ready
+test_hide:
+- organization_dry_run_policy.yaml
+doc_hide:
+- organization_dry_run_policy.yaml
diff --git a/tpgtools/overrides/privateca/beta/certificate_template.yaml b/tpgtools/overrides/privateca/beta/certificate_template.yaml
index 13ed711e62fe..9014b1241575 100644
--- a/tpgtools/overrides/privateca/beta/certificate_template.yaml
+++ b/tpgtools/overrides/privateca/beta/certificate_template.yaml
@@ -11,3 +11,7 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/privateca/certificate_template.yaml b/tpgtools/overrides/privateca/certificate_template.yaml
index 13ed711e62fe..9014b1241575 100644
--- a/tpgtools/overrides/privateca/certificate_template.yaml
+++ b/tpgtools/overrides/privateca/certificate_template.yaml
@@ -11,3 +11,7 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/recaptchaenterprise/beta/key.yaml b/tpgtools/overrides/recaptchaenterprise/beta/key.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/recaptchaenterprise/beta/key.yaml
+++ b/tpgtools/overrides/recaptchaenterprise/beta/key.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/overrides/recaptchaenterprise/key.yaml b/tpgtools/overrides/recaptchaenterprise/key.yaml
index e69de29bb2d1..af851d79a0c9 100644
--- a/tpgtools/overrides/recaptchaenterprise/key.yaml
+++ b/tpgtools/overrides/recaptchaenterprise/key.yaml
@@ -0,0 +1,4 @@
+- type: CUSTOMIZE_DIFF
+  details:
+    functions: 
+    - tpgresource.DefaultProviderProject
diff --git a/tpgtools/property.go b/tpgtools/property.go
index 0ee26f2af299..23a4ff896fd9 100644
--- a/tpgtools/property.go
+++ b/tpgtools/property.go
@@ -311,6 +311,10 @@ func (p Property) DefaultStateSetter() string {
 	case SchemaTypeFloat:
 		fallthrough
 	case SchemaTypeMap:
+		if p.IsResourceLabels() || p.IsResourceAnnotations() {
+			return fmt.Sprintf("d.Set(%q, flatten%s%s(res.%s, d))", p.Name(), p.resource.PathType(), p.PackagePath(), p.PackageName)
+		}
+
 		return fmt.Sprintf("d.Set(%q, res.%s)", p.Name(), p.PackageName)
 	case SchemaTypeList, SchemaTypeSet:
 		if p.typ.Items != nil && ((p.typ.Items.Type == "string" && len(p.typ.Items.Enum) == 0) || p.typ.Items.Type == "integer") {
@@ -440,6 +444,18 @@ func (p Property) Objects() (props []Property) {
 	return props
 }
 
+func (p Property) IsResourceLabels() bool {
+	return p.Name() == "labels" && p.parent == nil
+}
+
+func (p Property) IsResourceAnnotations() bool {
+	return p.Name() == "annotations" && p.parent == nil
+}
+
+func (p Property) ShouldShowUpInSamples() bool {
+	return (p.Settable && p.Name() != "effective_labels" && p.Name() != "effective_annotations") || p.IsResourceLabels() || p.IsResourceAnnotations()
+}
+
 // collapsedProperties returns the input list of properties with nested objects collapsed if needed.
 func collapsedProperties(props []Property) (collapsed []Property) {
 	for _, v := range props {
@@ -878,6 +894,21 @@ func createPropertiesFromSchema(schema *openapi.Schema, typeFetcher *TypeFetcher
 			resource.ReusedTypes = resource.RegisterReusedType(p)
 		}
 
+		// Add the "effective_labels" property when the current property is top level "labels" or
+		// add the "effective_annotations" property when the current property is top level "annotations"
+
+		if p.IsResourceLabels() || p.IsResourceAnnotations() {
+			p.Description = fmt.Sprintf("%s\n\n%s", p.Description, get_labels_field_note(p.title))
+			p.Settable = false
+			p.StateGetter = nil
+
+			props = append(props, build_effective_labels_field(p, resource, parent))
+
+			if p.IsResourceLabels() {
+				props = append(props, build_terraform_labels_field(p, resource, parent))
+			}
+		}
+
 		props = append(props, p)
 	}
 
@@ -901,3 +932,49 @@ func createPropertiesFromSchema(schema *openapi.Schema, typeFetcher *TypeFetcher
 
 	return props, nil
 }
+
+func build_effective_labels_field(p Property, resource *Resource, parent *Property) Property {
+	title := fmt.Sprintf("effective_%s", p.title)
+	description := fmt.Sprintf("All of %s (key/value pairs) present on the resource in GCP, including the %s configured through Terraform, other clients and services.", p.title, p.title)
+	stateSetter := fmt.Sprintf("d.Set(%q, res.%s)", title, p.PackageName)
+
+	effectiveLabels := Property{
+		title:       title,
+		Type:        p.Type,
+		Description: description,
+		resource:    resource,
+		parent:      parent,
+		Optional:    false,
+		Computed:    true,
+		ForceNew:    p.ForceNew, // Add ForceNew property if labels field has it
+		PackageName: p.PackageName,
+		Settable:    true,
+		StateSetter: &stateSetter,
+	}
+
+	stateGetter := effectiveLabels.DefaultStateGetter()
+	effectiveLabels.StateGetter = &stateGetter
+	return effectiveLabels
+}
+
+func build_terraform_labels_field(p Property, resource *Resource, parent *Property) Property {
+	title := fmt.Sprintf("terraform_%s", p.title)
+	description := fmt.Sprintf("The combination of %s configured directly on the resource and default %s configured on the provider.", p.title, p.title)
+	stateSetter := fmt.Sprintf("d.Set(%q, flatten%sTerraform%s(res.%s, d))", title, p.resource.PathType(), p.PackagePath(), p.PackageName)
+
+	return Property{
+		title:       title,
+		Type:        p.Type,
+		Description: description,
+		resource:    resource,
+		parent:      parent,
+		Computed:    true,
+		ForceNew:    p.ForceNew, // Add ForceNew property if labels field has it
+		PackageName: p.PackageName,
+		StateSetter: &stateSetter,
+	}
+}
+
+func get_labels_field_note(title string) string {
+	return fmt.Sprintf("**Note**: This field is non-authoritative, and will only manage the %s present in your configuration.\nPlease refer to the field `effective_%s` for all of the %s present on the resource.", title, title, title)
+}
diff --git a/tpgtools/resource.go b/tpgtools/resource.go
index b65c2061f9f9..26c94420ef45 100644
--- a/tpgtools/resource.go
+++ b/tpgtools/resource.go
@@ -381,6 +381,26 @@ func (r Resource) IDFunction() string {
 	return "tpgresource.ReplaceVarsForId"
 }
 
+// Check if the resource has the lables field for the resource
+func (r Resource) HasLabels() bool {
+	for _, p := range r.Properties {
+		if p.IsResourceLabels() {
+			return true
+		}
+	}
+	return false
+}
+
+// Check if the resource has the annotations field for the resource
+func (r Resource) HasAnnotations() bool {
+	for _, p := range r.Properties {
+		if p.IsResourceAnnotations() {
+			return true
+		}
+	}
+	return false
+}
+
 // ResourceInput is a Resource along with additional generation metadata.
 type ResourceInput struct {
 	Resource
@@ -566,6 +586,14 @@ func createResource(schema *openapi.Schema, info *openapi.Info, typeFetcher *Typ
 		res.CustomizeDiff = cdiff.Functions
 	}
 
+	if res.HasLabels() {
+		res.CustomizeDiff = append(res.CustomizeDiff, "tpgresource.SetLabelsDiff")
+	}
+
+	if res.HasAnnotations() {
+		res.CustomizeDiff = append(res.CustomizeDiff, "tpgresource.SetAnnotationsDiff")
+	}
+
 	// ListFields
 	if parameters, ok := typeFetcher.doc.Paths["list"]; ok {
 		for _, param := range parameters.Parameters {
@@ -810,6 +838,18 @@ func (r *Resource) loadHandWrittenSamples() []Sample {
 			sample.Name = &sampleName
 		}
 		sample.TestSlug = RenderedString(snakeToTitleCase(miscellaneousNameSnakeCase(sampleName)).titlecase() + "HandWritten")
+
+		// The "labels" and "annotations" fields in the state are decided by the configuration.
+		// During importing, as the configuration is unavailableafter, the "labels" and "annotations" fields in the state will be empty.
+		// So add the "labels" and the "annotations" fields to the ImportStateVerifyIgnore list.
+		if r.HasLabels() {
+			sample.IgnoreRead = append(sample.IgnoreRead, "labels", "terraform_labels")
+		}
+
+		if r.HasAnnotations() {
+			sample.IgnoreRead = append(sample.IgnoreRead, "annotations")
+		}
+
 		samples = append(samples, sample)
 	}
 
@@ -896,6 +936,18 @@ func (r *Resource) loadDCLSamples() []Sample {
 		}
 		sample.DependencyList = dependencies
 		sample.TestSlug = RenderedString(sampleNameToTitleCase(*sample.Name).titlecase())
+
+		// The "labels" and "annotations" fields in the state are decided by the configuration.
+		// During importing, as the configuration is unavailable, the "labels" and "annotations" fields in the state will be empty.
+		// So add the "labels" and the "annotations" fields to the ImportStateVerifyIgnore list.
+		if r.HasLabels() {
+			sample.IgnoreRead = append(sample.IgnoreRead, "labels", "terraform_labels")
+		}
+
+		if r.HasAnnotations() {
+			sample.IgnoreRead = append(sample.IgnoreRead, "annotations")
+		}
+
 		samples = append(samples, sample)
 	}
 
diff --git a/tpgtools/templates/resource.go.tmpl b/tpgtools/templates/resource.go.tmpl
index 532dd4c4c75b..db1eeb4d6aea 100644
--- a/tpgtools/templates/resource.go.tmpl
+++ b/tpgtools/templates/resource.go.tmpl
@@ -714,6 +714,55 @@ func flatten{{$.PathType}}{{$v.PackagePath}}(obj *{{$.Package}}.{{$v.ObjectType}
 }
 {{ end -}}
 
+{{ if $.HasLabels }}
+func flatten{{$.PathType}}Labels(v map[string]string, d *schema.ResourceData) interface{} {
+	if v == nil {
+		return nil
+	}
+
+	transformed := make(map[string]interface{})
+	if l, ok := d.Get("labels").(map[string]interface{}); ok {
+		for k, _ := range l {
+			transformed[k] = v[k]
+		}
+	}
+
+	return transformed
+}
+
+func flatten{{$.PathType}}TerraformLabels(v map[string]string, d *schema.ResourceData) interface{} {
+	if v == nil {
+		return nil
+	}
+
+	transformed := make(map[string]interface{})
+	if l, ok := d.Get("terraform_labels").(map[string]interface{}); ok {
+		for k, _ := range l {
+			transformed[k] = v[k]
+		}
+	}
+
+	return transformed
+}
+{{ end }}
+
+{{ if $.HasAnnotations }}
+func flatten{{$.PathType}}Annotations(v map[string]string, d *schema.ResourceData) interface{} {
+	if v == nil {
+		return nil
+	}
+
+	transformed := make(map[string]interface{})
+	if l, ok := d.Get("annotations").(map[string]interface{}); ok {
+		for k, _ := range l {
+			transformed[k] = v[k]
+		}
+	}
+
+	return transformed
+}
+{{ end }}
+
 {{ range $v := .EnumArrays -}}
 func flatten{{$.PathType}}{{$v.PackagePath}}Array(obj []{{$.Package}}.{{$v.ObjectType}}Enum) interface{} {
 	if obj == nil {
diff --git a/tpgtools/templates/resource.html.markdown.tmpl b/tpgtools/templates/resource.html.markdown.tmpl
index dec30b769688..07fd4244c6e5 100644
--- a/tpgtools/templates/resource.html.markdown.tmpl
+++ b/tpgtools/templates/resource.html.markdown.tmpl
@@ -143,6 +143,29 @@ This resource provides the following
 {{/* TODO excluded imports */}}
 {{$.DCLTitle}} can be imported using any of these accepted formats:
 
+{{- $id := "" }}
+{{- range $format := $.ImportFormats }}
+{{- $id = $format }}
+* `{{$format}}`
+{{- end }}
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import {{$.DCLTitle}} using one of the formats above. For example:
+
+{{- range $format := $.ImportFormats }}
+{{/* Get the first import format for templating */}}
+{{- $id = $format }}
+{{- break }}
+{{- end }}
+
+```tf
+import {
+  id = "{{$id}}"
+  to = {{$.TerraformName}}.default
+}
+```
+
+When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), {{$.DCLTitle}} can be imported using one of the formats above. For example:
+
 ```
 {{- range $format := $.ImportFormats }}
 $ terraform import {{$.TerraformName}}.default {{$format}}
diff --git a/tpgtools/templates/serialization.go.tmpl b/tpgtools/templates/serialization.go.tmpl
index 7936e1a0119c..faba0a38cdfc 100644
--- a/tpgtools/templates/serialization.go.tmpl
+++ b/tpgtools/templates/serialization.go.tmpl
@@ -126,7 +126,7 @@ func ConvertSampleJSONToHCL(product DCLPackageName, resource miscellaneousNameSn
 func {{ $res.TitleCaseFullName }}{{$version.SerializationSuffix}}AsHCL(r {{$res.Package}}{{$version.SerializationSuffix}}.{{$res.DCLStructName}}, hasGAEquivalent bool) (string, error) {
 	outputConfig := "resource \"{{$res.TerraformName}}\" \"output\" {\n"
 		{{- range $field := $res.Properties}}
-			{{- if $field.Settable }}
+			{{- if $field.ShouldShowUpInSamples }}
 				{{- if eq $field.Type.String "TypeString" "TypeInt" "TypeBool" "TypeFloat" }}
 					{{- if $field.Type.IsDateTime }}
 	if !r.{{$field.PackageName}}.IsZero() {