NOTES:

• provider: List resources are now supported in both google and google-beta providers with the introduction of google_service_account list resource - more info can be found here (#26938)

FEATURES:

• New Data Source: google_firebase_admin_sdk_config (#26901)
• New Resource: google_chronicle_datatable_row (#26960)
• New Resource: google_chronicle_datatable (#26895)
• New Resource: google_dataform_folder (#26881)
• New Resource: google_dataform_team_folder (#26881)
• New Resource: google_firebase_storage_default_bucket (#26965)

IMPROVEMENTS:

• alloydb: added track_client_address field to google_alloydb_instance resource (#26964)
• clouddeploy: added tasks field to google_clouddeploy_custom_target_type resource (#26941)
• compute: added header_action and redirect_options fields to google_compute_organization_security_policy_rule resource (#26942)
• dataplex: added execution_identity field to google_dataplex_datascan resource (#26924)
• dataproc: added cluster_config.engine field to google_dataproc_cluster resource (#26962)
• iambeta: added trust_default_shared_ca field to google_iam_workload_identity_pool resource (#26974)
• netapp: added large_capacity_config field to google_netapp_volume resource(#26927)
• netapp: added kms_config, encryption_state and backups_crypto_key_version fields to google_netapp_backup_vault resource (#26939)
• resourcemanager: add resource-identity support to google_service_account resource (#26938)
• sql: added entraid_config field to google_sql_database_instance resource (#26921)
• vectorsearch: added encryption_spec field to google_vector_search_collection resource (#26972)

BUG FIXES:

• apigee: fixed ignoring is_enabled = false on create and update in google_apigee_target_server resource (#26878)
• bigquery: fixed inability to set default_collation to empty string in google_bigquery_dataset (#26925)
• ces: fixed a diff on logging_settings when unspecified in google_ces_app. Removing the value from config will now preserve the existing settings instead of removing them. (#26899)
• compute: fixed a permadiff on iap.oauth2_client_id in google_compute_backend_service and google_compute_region_backend_service when the API returns a single space (#26975)
• container: fixed a bug in google_container_cluster where setting multiple fields in dns_endpoint_config failed to apply all changes (#26968)
• workstations: fixed a permadiff on persistent_directories.gce_pd.reclaim_policy in google_workstations_workstation_config resource (#26971)

NOTES:

• compute: migrated data_source_google_compute_instance_template datasource to use direct HTTP rather then a client library (#26831)
• compute: migrated google_compute_instance_guest_attributes datasource to use direct HTTP rather then a client library (#26826)
• provider: added provider-wide Identity() schema support, allowing imports with MMv1 resources to occur using the identity block instead of id field (#26783)

FEATURES:

• New Data Source: google_vertex_ai_reasoning_engine_query (#26787)
• New Resource: google_apigee_space (#26857)
• New Resource: google_chronicle_feed (#26742)
• New Resource: google_vertex_ai_reasoning_engine_iam_binding (#26785)
• New Resource: google_vertex_ai_reasoning_engine_iam_member (#26785)
• New Resource: google_vertex_ai_reasoning_engine_iam_policy (#26785)
• New Resource: google_workload_identity_service_agent (#26780)

IMPROVEMENTS:

• bigqueryanalyticshub: added replica_locations and effective_replicas fields to google_bigquery_analytics_hub_listing resource (#26843)
• bigqueryanalyticshub: added replica_locations field to google_bigquery_analytics_hub_listing_subscription resource (#26843)
• composer: increased google_composer_environment default delete timeout to 120m from 30m (#26851)
• compute: added target_size_policy field to google_compute_instance_group_manager and google_compute_region_instance_group_manager resources (#26849)
• compute: increased google_compute_security_policy default timeout to 60m from 30m (#26850)
• compute: supported simultaneous updates for Hyperdisk IOPS and throughput in google_compute_disk and google_compute_region_disk resources (#26815)
• container: added autopilot_cluster_policy_config field to google_container_cluster resource (#26822)
• container: added disable_multi_nic field to lustre_csi_driver_config in google_container_cluster resource (#26759)
• developerconnect: added custom_oauth_config, etag, and proxy_config fields to google_developer_connect_account_connector resource (#26751)
• netapp: added scale_type field to google_netapp_storage_pool resource (#26821)
• netapp: added mode field to google_netapp_storage_pool resource (#26778)
• networkservices: added all_ports field to google_network_services_gateway resource (#26808)
• sql: added SQLSERVER_2025 value to database_version field in database_instance resource (#26845)
• vertexai: add labels field to google_vertex_ai_reasoning_engine resource (#26825)
• vertexai: added spec.source_code_spec.image_spec field to google_vertex_ai_reasoning_engine resource (#26790)
• vertexai: added container_spec field to google_vertex_ai_reasoning_engine resource (#26813)
• vertexai: added spec.identity_type and spec.effective_identity fields to google_vertex_ai_reasoning_engine resource (#26788)

BUG FIXES:

• apigee: fixed a crash in google_apigee_environment_addons_config resource when analytics are not configured (#26810)
• apigee: fixed overly restrictive validation of name field in google_apigee_api_product that rejected uppercase letters, aligning provider behavior with the Apigee API (#26756)
• bigquery: fixed crash when hive_partitioning_options is defined with all null values in google_bigquery_table resource (#26846)
• firebaseailogic: fixed permadiff on traffic_filter field in google_firebase_ai_logic_config resource (#26749)
• networksecurity: fixed permadiff on policy_profile field in google_network_security_authz_policy resource (#26865)
• vertexai: added 10-second wait before reading the updated resource in google_vertex_ai_reasoning_engine, preventing stale values getting written to state (#26852)

BREAKING CHANGES:

• lustre: marked maintenance_policy.weekly_maintenance_windows field required in google_lustre_instance resource. Configuring maintenance_policy without weekly_maintenance_windows will cause an API error. (#26741)

FEATURES:

• New Data Source: google_discovery_engine_data_store (#26651)
• New Data Source: google_discovery_engine_data_stores (#26651)
• New Data Source: google_dns_record_sets (#26736)
• New Resource: google_chronicle_dashboard_chart (#26707)
• New Resource: google_chronicle_feed (#26742)
• New Resource: google_network_connectivity_transport (#26626)
• New Resource: google_iam_workload_identity_pool_managed_identity (#26732)
• New Resource: google_iam_workload_identity_pool_namespace (#26647)

IMPROVEMENTS:

• compute: added SEV_LIVE_MIGRATABLE_V2 to guest_os_features enum for google_compute_region_disk resource (#26735)
• compute: added SNP_SVSM_CAPABLE to guest_os_features enum for google_compute_image and google_compute_region_disk resources (#26735)
• compute: added excluded_folders and excluded_projects fields to google_compute_organization_security_policy_association resource (#26694)
• compute: supported in-place update for secondary_ip_range field in google_compute_subnetwork resource (#26689)
• container: added autopilot_privileged_admission field to google_container_cluster resource for Customer-Driven Allowlisting (#26668)
• dataplex: added aspects field to google_dataplex_entry_link resource (#26664)
• dataplex: supported in-place update for aspects field in google_dataplex_entry_link resource (#26702)
• dataproc: added boot_disk_provisioned_iops and boot_disk_provisioned_throughput fields to cluster_config.worker_config.disk_config in google_dataproc_cluster resource (#26691)
• dataproc: added value AUTO to runtime_config.autotuning_config.scenarios field in google_dataproc_batch resource (#26646)
• iambeta: added attestation_rules field to google_iam_workload_identity_pool resource (#26706)
• lustre: added dynamic_tier_options field to google_lustre_instance resource (#26741)
• migrationcenter: added virtual_machine_preferences.compute_engine_preferences.persistent_disk_type field to google_migration_center_preference_set resource (#26693)
• networkconnectivity: added exclude_import_ranges, include_export_ranges, exclude_export_ranges fields to google_network_connectivity_spoke resource (#26730)
• pubsub: added ai_inference field to google_pubsub_topic and google_pubsub_subscription resources (#26738)
• sql: added clone_context.source_project field to google_sql_database_instance resource to support cross project clone (#26652)

BUG FIXES:

• compute: fixed a permadiff on the adaptive_protection_config field in google_compute_security_policy resource (#26692)
• compute: fixed panic when setting google_compute_project_metadata on a project with no existing metadata (#26630)
• biglakeiceberg: changed the primary-location parameter to primary_location in the create URL of google_biglake_iceberg_catalog resource (#26695)
• securityposture: always sent value of enforce in policies.constraint.org_policy_constraint.policy_rules to the api in google_securityposture_posture resource (#26645)
• vertexai: fixed missing Private Service Connect service attachment for service_attachment field in google_vertex_ai_endpoint_with_model_garden_deployment resource (#26690)
• workstations: fixed update of private_cluster_config.allowed_projects in google_workstations_workstation_cluster resource (#26705)

BREAKING CHANGES:

• compute: Removed google_compute_region_backend_bucket from the google (GA) provider. It is currently beta-only, and calls to the nonexistent GA API always returned a 404. Until released in google, use google-beta instead. (#26597)

FEATURES:

• New Data Source: google_network_security_address_groups (#26562)
• New Data Source: google_iam_workload_identity_pool_iam_policy (#26598)
• New Resource: google_bigqueryreservation_reservation_group (#26560)
• New Resource: google_compute_region_composite_health_check (#26591)
• New Resource: google_compute_region_health_aggregation_policy (#26591)
• New Resource: google_compute_region_health_source (#26591)
• New Resource: google_contact_center_insights_assessment_rule (#26530)
• New Resource: google_iam_workload_identity_pool_iam_* (#26598)
• New Resource: google_workstations_workstation (#26561)
• New Resource: google_workstations_workstation_iam_* (#26561)
• New Resource: google_workstations_workstation_cluster (#26561)
• New Resource: google_workstations_workstation_config (#26561)
• New Resource: google_workstations_workstation_config_iam_* (#26561)

IMPROVEMENTS:

• bigqueryreservation: added reservation_group field to google_bigquery_reservation resource (#26560)
• ces: added remote_dialogflow_agent.respect_response_interruption_settings field to google_ces_agent resource (#26578)
• clusterdirector: made boot_disk.size_gb and boot_disk.type editable within nodesets and login nodes in google_hypercomputecluster_cluster (#26615)
• colab: added colab_image field to google_colab_runtime_template resource (#26582)
• colab: made google_colab_runtime_template resource updatable (#26582)
• compute: added hyperdisk-balanced as an option for disk_type field in google_container_cluster resource (#26581)
• compute: made backend_service field optional for google_compute_target_tcp_proxy resource (#26519)
• compute: promoted resolve_subnet_field field in google_compute_subnetwork resource to GA (#26570)
• iambeta: promoted mode, inline_certificate_issuance_config, and inline_trust_config fields in google_iam_workload_identity_pool resource to GA (#26598)
• spanner: added autoscaling config for instance partition and missing asymmetric autoscaling override fields to google_spanner_instance resource (#26577)
• sql: added server_certificate_rotation_mode field to google_sql_database_instance resource (#26572)
• storage: added google_managed_encryption_enforcement_config, customer_managed_encryption_enforcement_config and customer_supplied_encryption_enforcement_config to google_storage_bucket resource (#26529)

BUG FIXES:

• alloydb: fixed an issue where password_wo and password_wo_version fields were not functioning properly during update requests in google_alloydb_user resource (#26571)
• biglake: fixed erroneous diff for the properties field in the google_biglake_iceberg_table and google_biglake_iceberg_namespace resources (#26595)
• cloudfunctionsv2: fixed validation to only allow one of direct_vpc_network_interface or vpc_connector on google_cloudfunctions2_function resource (#26567)
• cloudrunv2: fixed validation to only allow one of network_interfaces or connector on google_cloud_run_v2_service and google_cloud_run_v2_job resources (#26567)
• compute: fixed google_compute_region_backend_bucket being present in the google (GA) provider. It is currently beta-only, and calls to the nonexistent GA API always returned a 404. (#26597)
• compute: fixed invalid update mask used for rate_limit_options field in google_compute_region_security_policy_rule resource (#26527)
• compute: fixed invalid update mask used for rate_limit_options field in google_compute_security_policy and google_compute_security_policy_rule resources (#26526)
• iambeta: fixed a perma-diff on mode field for google_iam_workload_identity_pool resource (#26601)
• provider: fixed an issue when custom endpoints use http:// (#26600)
• vertexai: fixed operation calls in google_vertex_ai_ resources not respecting universe_domain and vertex_custom_endpoint (#26556)

FEATURES:

• New Data Source: google_compute_network_endpoint_groups (#26515)
• New Resource: google_dialogflow_environment (#26489)
• New Resource: google_kms_project_autokey_config (#26501)

IMPROVEMENTS:

• backupdr: added disk_backup_plan_properties field to google_backup_dr_backup_plan resource (#26497)
• backupdr: made backup_rules optional in google_backup_dr_backup_plan resource (#26494)
• blockchainnodeengine: added ethereum_details.validator_config.beacon_fee_recipient field to google_blockchain_node_engine_blockchain_nodes resource (#26499)
• ces: added custom_headers field to MCP toolset in CES google_ces_toolset resource (#26473)
• compute: added expr field to google_compute_organization_security_policy_rule resource (#26506)
• compute: added location field to google_network_services_tls_route resource (#26514)
• compute: added target_proxies field to google_network_services_tls_route resource (#26516)
• compute: made backend_service field optional for resource google_compute_target_tcp_proxy (#26519)
• compute: made backend_service field optional for resource google_compute_region_target_tcp_proxy (#26493)
• iamworkforcepool: added detailed_audit_logging field to google_iam_workforce_pool_provider resource (#26500)
• kms: added key_project_resolution_mode field to google_kms_autokey_config resource (#26501)
• lustre: added maintenance_policy field to google_lustre_instance resource (#26512)
• sql: added point_in_time_restore_context.region field to google_sql_database_instance resource (#26510)
• vertexai: added deletion_policy field to resource_vertex_ai_reasoning_engine resource (#26518)

BUG FIXES:

• vertexai: fixed permadiff on spec field in google_vertex_ai_reasoning_engine resource (#26470)

DEPRECATIONS:

• iamworkforcepool: deprecated extended_attributes_oauth2_client on google_iam_workforce_pool_provider. Use scim_usage instead. (#26388)

FEATURES:

• New Resource: google_biglake_iceberg_table (#26394)
• New Resource: google_contact_center_insights_auto_labeling_rule (#26426)
• New Resource: google_observability_trace_scope (#26428)
• New Resource: google_sql_provision_script (#26432)

IMPROVEMENTS:

• ces: added Service Account OAuth scopes fields to google_ces_toolset resource (#26368)
• cloudrunv2: added DISK fields to google_cloud_run_v2_service resource (#26418)
• cloudsql: added max_custom_on_demand_retention_days field to sqladmin resource (#26407)
• compute: added ForwardProxy field in google_compute_region_backend_service resource (#26449)
• compute: added accelerator_topology_mode field to google_compute_resource_policy resource (#26383)
• compute: added target_type and target_forwarding_rules on google_compute_region_network_firewall_policy_rule resource (#26369)
• compute: promoted the endpoint_url field in google_compute_service_attachment to GA (#26434)
• container: marked subnetwork as settable in google_container_node_pool (#26416)
• container: added disruption_budget field to google_container_cluster resource (#26425)
• discoveryengine: added search_engine_config.required_subscription_tier field to google_discovery_engine_search_engine resource (#26398)
• discoveryengine: marked content_config as optional field in google_discovery_engine_data_store (#26398)
• memorystore: added server_ca_mode and server_ca_pool fields to google_memorystore_instance resource (#26437)
• networkservices: relaxed authority validation in google_network_services_authz_extension for different target types (#26386)
• redis: added server_ca_mode and server_ca_pool fields to google_redis_cluster resource (#26437)
• sql: added clone_context.source_project field to google_sql_database_instance resource to support cross project clone (beta) (#26384)
• transport: added automatic retry for GCE 403 errors with reason CONCURRENT_OPERATIONS_QUOTA_EXCEEDED (#26417)

BUG FIXES:

• compute: fixed perpetual diff for oauth2_client_id in iap block of google_compute_backend_service and google_compute_region_backend_service when disabling IAP (#26385)
• datastream: fixed an issue in google_datastream_stream where source_config.mysql_source_config.binary_log_position would show a diff when unset (#26435)
• workbench: marked install-nvidia-driver metadata key as settable for google_workbench_instance (#26402)

DEPRECATIONS:

• notebooks: google_notebooks_environment is deprecated and will be removed in a future major release. Use google_workbench_instance instead (#26288)
• provider: google_*_iam_* resources and datasources will now show deprecation messages when their parent resource has been deprecated (#26288)

FEATURES:

• New Data Source: google_oracle_database_odb_network (#26290)
• New Data Source: google_oracle_database_odb_subnet (#26290)
• New Resource: google_vector_search_collection (ga) (#26353)

IMPROVEMENTS:

• alloydb: added dataplex_config field to google_alloydb_cluster resource (#26304)
• biglake: added primary_location to google_biglake_iceberg_catalog resource (#26307)
• compute: added params field to google_compute_external_vpn_gateway resource (ga) (#26348)
• compute: added params field to google_compute_ha_vpn_gateway resource (ga) (#26348)
• compute: added params field to google_compute_vpn_gateway resource (ga) (#26348)
• compute: added params field to google_compute_vpn_tunnel resource (ga) (#26348)
• compute: added storage_pool support to google_compute_instance_template and google_compute_region_instance_template disks (#26347)
• container: added control_plane_disk_encryption_key_versions field to user_managed_keys_config in google_container_cluster resource (#26289)
• dataproc: added cluster_type to google_dataproc_cluster resource (#26350)
• dlp: added actions.publish_to_scc, actions.publish_to_chronicle, actions.export_data.sample_findings_table and targets.big_query_target.filter.table_reference.project_id fields to google_data_loss_prevention_discovery_config resource (#26281)
• gkebackup: added protected_namespace_count field to google_gke_backup_backup_plan resource (#26283)
• netapp: added mode field to google_netapp_storage_pool resource (#26319)
• osconfig: added patch_config.skip_unpatchable_vms field to google_os_config_patch_deployment resource (#26282)
• pubsub: added text_config field to google_pubsub_subscription resource (#26329)

BUG FIXES:

• tags: fixed iam read-after-write consistency issue with conditions in google_tags_tag_key_iam_member resource (#26330)

DEPRECATIONS:

• dataplex: deprecated google_dataplex_data_asset. Use google_dataplex_data_product_data_asset instead. (#26256)

FEATURES:

• New Resource: google_compute_organization_security_policy_rule (#26202)

IMPROVEMENTS:

• compute: initialize_params.size is now updatable in-place in the google_compute_instance resource (#26195)
• compute: added dest_network_context, src_network_context and src_networks fields to google_compute_firewall_policy_rule resource (#26227)
• compute: added dest_network_context, src_network_context and src_networks fields to google_compute_network_firewall_policy_rule resource (#26227)
• compute: added dest_network_context, src_network_context and src_networks fields to google_compute_region_network_firewall_policy_rule resource (#26227)
• container: promoted sandbox_config field in google_container_cluster and google_container_node_pool resources to GA (#26247)
• developerconnect: added http_config field to google_developer_connect_connection resource (#26232)
• filestore: added source_backupdr_backup field to google_filestore_instance resource (#26238)
• gkehub2: added field spec.workloadidentity to resource google_gke_hub_feature (#26259)
• iam: added AZURE_AD_GROUPS_DISPLAY_NAME enum value to extra_attributes_oauth2_client.attribute-type field in google_iam_workforce_pool_provider resource (#26226)
• kms: added a KMS AutokeyConfig-specific 10s post-create/post-update (#26236)
• networksecurity: added url_filtering_profile field to google_network_security_security_profile_group resource (#26266)
• networksecurity: added url_filtering_profile field to google_network_security_security_profile resource (#26266)
• networkservices: added support for use of multiple ports for google_network_services_gateway resources of type SECURE_WEB_GATEWAY (#26265)
• sql: added auto_upgrade_enabled field to google_sql_database_instance resource. (#26205)
• sql: added data_api_access field to google_sql_database_instance resource (#26217)
• sql: added enhanced_query_insights_enabled field to google_sql_database_instance resource (#26244)

BUG FIXES:

• datastream: fixed permadiff where google_datastream_connection_profile.salesforce_profile.oauth2_client_credentials.client_id is not read properly from the API (#26201)
• servicenetworking: added retry when creating google_service_networking_connection if it looks like the service account permissions haven't yet propagated (#26220)

FEATURES:

• New Data Source: google_vmwareengine_announcements (#26145)
• New Data Source: google_vmwareengine_upgrades (#26174)
• New Resource: google_compute_region_backend_bucket (#26144)
• New Resource: google_hypercomputecluster_cluster (#26180)
• New Resource: google_network_services_agent_gateway (beta) (#26140)

IMPROVEMENTS:

• beyondcorp: added logging field to google_beyondcorp_security_gateway resource (#26159)
• cloudfunctions2: added direct_vpc_network_interface and direct_vpc_egress fields to google_cloudfunctions2_function resource. Users who directly enabled DirectVPC on the underlying Cloud Run service will see a diff as a result of this update. (#26142)
• cloudrunv2: added the iap_enabled field to google_cloud_run_v2_service resource (#26161)
• dataproc: added wait_for_completion to google_dataproc_job resource (#26177)
• discoveryengine: added disable_analytics field to google_discovery_engine_search_engine resource (#26171)
• dlp: added targets.cloud_storage_target.filter.collection.include_tags block to google_data_loss_prevention_discovery_config resource (#26178)
• iap: added client_id, client_secret, and client_secret_sha256 fields to google_iap_settings resource (#26170)
• networksecurity: added mirroring_deployment_groups and mirroring_endpoint_group_type fields to google_network_security_security_profile resource (#26137)

BUG FIXES:

• cloudrun: fixed perma-diff on http_target.uri_override.query_override in google_cloud_tasks_queue (#26172)
• storage: fixed a bug in google_storage_bucket where force_destroy = true would fail to delete buckets with large number of objects due to missing pagination (#26164)

FEATURES:

• New Data Source: google_access_context_manager_supported_service (#26092)
• New Data Source: google_access_context_manager_supported_services (#26092)
• New Data Source: google_backup_dr_data_sources (#26080)
• New Data Source: google_kms_secret_asymmetric (#26096)
• New Data Source: google_storage_bucket_object_contents (#26054)
• New Resource: google_biglake_iceberg_namespace (#26076)
• New Resource: google_compute_rollout_plan (#26093)
• New Resource: google_oracle_database_exadb_vm_cluster (#26021)
• New Resource: google_vector_search_collection (#26098)

IMPROVEMENTS:

• alloydb: added write-only support for initial_user.password_wo to google_alloydb_cluster (#26074)
• ces: added mcp_toolset field to google_ces_toolset resource (#26025)
• compute: added allow_subnet_cidr_routes_overlap field to google_compute_subnetwork resource (#26019)
• compute: added write-only support for private_key to google_compute_region_ssl_certificate resource (#26072)
• compute: added write-only support for private_key to google_compute_ssl_certificate resource (#26072)
• compute: added enable field to google_compute_packet_mirroring resource (#26064)
• compute: added params field to google_compute_external_vpn_gateway resource (#26089)
• compute: added params field to google_compute_ha_vpn_gateway resource (#26089)
• compute: added params field to google_compute_interconnect_attachment resource (#26042)
• compute: added params field to google_compute_vpn_gateway resource (#26089)
• compute: added params field to google_compute_vpn_tunnel resource (#26089)
• compute: added slice_controller_config field to google_container_cluster resource (#26023)
• container: added additional_ip_ranges_config.status to google_container_cluster resource (#26061)
• dataproc: added instance_flexibility_policy to master_config and worker_config in google_dataproc_cluster resource (#26058)
• developerconnect: added target_projects field to google_developer_connect_insights_config resource (#26073)
• filestore: added replica_action to google_filestore_instance resource (#26082)
• networksecurity: added policy_profile, http_rules.0.to.0.operations.0.mcp to google_network_security_authz_policy resource (#26090)
• networkservices: added ull_multicast_domain field to google_network_services_multicast_domain resource (#26071)
• networkservices: relaxed load_balancing_scheme validation to support non-Backend Service targets in google_network_services_authz_extension (#26090)
• spanner: added support for user_project_override in google_spanner_database_iam and google_spanner_instance_iam resources (#26052)
• vmwareengine: added datastore_mount_config field to google_vmwareengine_cluster resource (#26083)

BUG FIXES:

• bigquery: fixed permadiff with the collation field in google_bigquery_table.schema when it inherits the value from google_bigquery_dataset.default_collation (#26065)
• bigqueryanalyticshub: fixed update failure for replica_locations in google_bigquery_analytics_hub_listing (#26046)
• iam: fixed an issue where iam resources not retry on error 409 concurrent policy changes (#26095)
• publicca: fixed mac_key fields not being properly set in google_public_ca_external_account_key (#26099)