FEATURES:

• New Data Source: google_compute_network_attachment (#23570)
• New Data Source: google_firestore_document (#23553)
• New Resource: google_backup_dr_service_config (#23552)
• New Resource: google_bigquery_analytics_hub_data_exchange_subscription (#23560)
• New Resource: google_gkeonprem_vmware_admin_cluster (#23554)
• New Resource: google_network_security_backend_authentication_config (#23555)

IMPROVEMENTS:

• alloydb: added machine_config.machine_type field to google_alloydb_instance resource (#23562)
• apigee: added access_logging_config field to google_apigee_instance resource (#23522)
• apigee: marked access_logging_config field immutable in google_apigee_instance resource (#23571)
• backupdr: added in-place update support for google_backup_dr_backup_plan resource (#23537)
• compute: added params.resource_manager_tags field to google_compute_firewall resource (#23524)
• compute: added application_aware_interconnect and aai_enabled fields to google_compute_interconnect resource (#23567)
• compute: added load_balancing_scheme field to google_compute_backend_bucket resource (#23499)
• compute: added provisioned_iops and provisioned_throughput fields to google_compute_region_disk resource (#23551)
• compute: added specific_reservation.source_instance_template, delete_at_time, delete_after_duration.seconds, delete_after_duration.nanos and reservation_sharing_policy.service_share_type fields to google_compute_reservation resource (#23561)
• firestore: added tags field to google_firestore_database resource (#23569)
• securesourcemanager: added in-place update support for description field in google_secure_source_manager_repository resource (#23557)
• storage: added force_empty_content_type field to google_storage_bucket_object resource (#23568)

BUG FIXES:

• artifactregistry: fixed an issue where changes to cleanup_policies were not being applied correctly in google_artifact_registry_repository resource (#23556)
• iambeta: fixed perma-diff for jwks_json field when GCP normalizes JSON formatting in google_iam_workload_identity_pool_provider resource (#23526)

DEPRECATIONS:

• iap: deprecated google_iap_client and google_iap_brand (#23431)

FEATURES:

• New Data Source: google_kms_autokey_config (#23490)
• New Data Source: google_kms_key_handle (#23490)
• New Data Source: google_kms_key_handles (#23490)
• New Data Source: google_network_management_connectivity_test_run (#23497)
• New Data Source: google_redis_cluster (#23436)
• New Resource: google_contact_center_insights_analysis_rule (#23435)
• New Resource: google_kms_autokey_config (#23490)
• New Resource: google_kms_key_handle (#23490)
• New Resource: google_model_armor_template (#23432)

IMPROVEMENTS:

• bigquery: added ignore_schema_changes virtual field to google_bigquery_table resource. Only dataPolicies field is supported in ignore_schema_changes for now. (#23495)
• billing: added currency_code to google_billing_account data source (#23474)
• compute: added params.resource_manager_tags field to google_compute_network resource (#23421)
• compute: added load_balancing_scheme field to google_compute_backend_bucket resource (#23499)
• compute: added params.resource_manager_tags field to google_compute_route resource (#23489)
• container: added anonymous_authentication_config field to google_container_cluster resource (#23491)
• dataplex: added suspended field to google_dataplex_datascan resource (#23456)
• discoveryengine: added enable_table_annotation, enable_image_annotation, structured_content_types, exclude_html_elements, exclude_html_classes and exclude_html_ids fields to layout_parsing_config of google_discovery_engine_data_store resource (#23478)
• discoveryengine: added kms_key_name field to google_discovery_engine_data_store resource (#23469)
• memorystore: added managed_server_ca field to google_memorystore_instance resource (#23430)
• secretmanager: added deletion_protection field to google_secret_manager_secret resource to optionally make deleting them require an explicit intent (#23480)
• secretmanager: added fetch_secret_data field to google_secret_manager_secret_version to optionally skip fetching the secret data (#23471)

BUG FIXES:

• compute: fixed match field in google_compute_router_route_policy resource to be marked as required (#23494)
• compute: fixed an issue with bgp_always_compare_med in google_compute_network where it was unable to be set from true to false (#23477)
• compute: made no replication status in google_compute_disk_async_replication a retryable error (#23492)
• gkeonprem: fixed type of load_balancer.0.bgp_lb_config.0.address_pools.0.manual_assign in google_gkeonprem_bare_metal_cluster, making it a boolean instead of a string (#23472)
• integrationconnectors: removed validation from auth configs in google_integration_connectors_connection resource (#23429)

6.42.0 (July 1, 2025)

FEATURES:

• New Resource: google_apihub_plugin_instance (#23346)
• New Resource: google_apihub_plugin (#23407)
• New Resource: google_dialogflow_cx_generative_settings (#23394)

IMPROVEMENTS:

• cloudidentity: added create_ignore_already_exists field to google_cloud_identity_group_membership resource (#23376)
• compute: added access_mode field to google_compute_region_disk resource (#23409)
• compute: added match.src_secure_tags and target_secure_tags fields to google_compute_firewall_policy_rule resource (#23414)
• compute: added params.resource_manager_tags field to google_compute_network resource (#23421)
• compute: added resource_policies.workload_policy field to google_compute_instance_group_manager resource (#23420)
• container: added confidential_nodes.confidential_instance_type field to google_container_cluster resource (#23410)
• container: added gke_auto_upgrade_config field to google_container_cluster resource (#23411)
• container: added node_config.confidential_nodes.confidential_instance_type field to google_container_node_pool resource (#23410)
• firestore: revoked deprecation of deletion_policy field in google_firestore_database resource (#23403)
• memorystore: added kms_key field to google_memorystore_instance resource (#23396)
• redis: added effective_reserved_ip_range field to google_redis_instance resource (#23384)
• secretmanager: added deletion_protection field to google_secret_manager_regional_secret resource (#23398)
• spanner: added encryption_config.kms_key_name field to google_spanner_backup_schedule resource (#23378)
• storage: added allow_cross_org_vpcs and allow_all_service_agent_access fields to google_storage_bucket resource (#23405)

BUG FIXES:

• alloydb: removed machine_config.machine_type field from google_alloydb_instance resource because it is not yet supported in GA (#23415)
• bigqueryanalyticshub: supported in-place update for log_linked_dataset_query_user_email in google_bigquery_analytics_hub_listing and google_bigquery_analytics_hub_data_exchange resources. Once enabled, this feature cannot be disabled. (#23391)
• bigquerydatatransfer: stopped surfacing persistent warnings recommending write-only field when using secret_access_key on google_bigquery_data_transfer_config (#23417)
• memorystore: added the ability to set the replica_count field in google_memorystore_instance resource to 0 (#23412)
• monitoring: made description and displayName optional and mutable in google_monitoring_metric_descriptor resource (#23381)
• redis: fixed reserved_ip_range field not being populated for google_redis_instance data source (#23384)
• secretmanager: stopped surfacing persistent warnings recommending write-only field when using secret_data on google_secret_manager_secret_version (#23417)
• sql: stopped surfacing persistent warnings recommending write-only field when using password on google_sql_user (#23417)
• workbench: added support for setting serial-port-logging-enable key in metadata field in google_workbench_instance resource (#23406)

BREAKING CHANGES:

• lustre: added per_unit_storage_throughput as a required field to google_lustre_instance resource in response to a change in the API surface (#23319)

FEATURES:

• New Data Source: google_dataplex_data_quality_rules (#23255)
• New Resource: google_apihub_plugin_instance (#23346)
• New Resource: google_contact_center_insights_view (#23263)
• New Resource: google_dataproc_session_template (#23288)
• New Resource: google_dialogflow_encryption_spec (#23335)

IMPROVEMENTS:

• alloydb: added network_config.allocated_ip_range_override field to google_alloydb_instance resource (#23330)
• bigqueryanalyticshub: added log_linked_dataset_query_user_email field to google_bigquery_analytics_hub_data_exchange resource (#23271)
• bigqueryanalyticshub: added log_linked_dataset_query_user_email field to google_bigquery_analytics_hub_listing_subscription resource (#23286)
• bigqueryanalyticshub: added pubsub_topic field to google_bigquery_analytics_hub_listing resource (#23334)
• bigtable: added row_key_schema to google_bigtable_table resource (#23337)
• cloudasset: added support for universe domain handling for google_cloud_asset_resources_search_all datasource (#23318)
• cloudquotas: added inherited and inherited_from fields to google_cloud_quotas_quota_adjuster_settings resource (#23339)
• compute: added CROSS_SITE_NETWORK enum option to requested_features field in google_compute_interconnect resource (#23316)
• compute: added TLS_JA4_FINGERPRINT option to enforce_on_key field in google_compute_region_security_policy, google_compute_security_policy, and google_compute_security_policy_rule resources (#23270)
• compute: added send_propagated_connection_limit_if_zero to google_compute_service_attachment to resolve an issue where propagated_connection_limit were not working for 0 value previously. Now setting send_propagated_connection_limit_if_zero = true will send propagated_connection_limit = 0 when it's unset or set to 0. (#23325)
• compute: promoted default_custom_error_response_policy to GA in google_compute_url_map (#23268)
• container: added performance_monitoring_unit in node_config/advanced_machine_features to 'google_container_cluster' resource (#23260)
• container: added release_channel_upgrade_target_version to google_container_engine_versions data source (#23336)
• dataplex: added support for discovery scan in google_dataplex_datascan resource (#23291)
• dns: added target_name_servers.domain_name field to google_dns_managed_zone resource (#23265)
• provider: added support for adc impersonation in different universes (#23320)
• storage: added source_md5hash field in google_storage_bucket_object (#23267)

BUG FIXES:

• compute: fixed google_compute_firewall_policy_rule staying disabled after apply with disabled = false (#23329)
• compute: marked name in google_compute_node_group, google_compute_node_template as required as it was impossible to create successfully without a value (#23345)
• sql: fixed an error in updating connection_pool_config in google_sql_database_instance (#23332)
• tags: fixed perma-diff for parent field in google_tags_location_tag_binding resource (#23331)

DEPRECATIONS:

• notebook: google_notebook_runtime is deprecated and will be removed in a future major release. Use google_workbench_instance instead. (#23251)

FEATURES:

• New Data Source: google_dataplex_data_quality_rules (#23255)
• New Resource: google_dialogflow_cx_tool (#23192)

IMPROVEMENTS:

• backupdr: added support for updating in-place to the google_backup_dr_backup_plan_association resource (#23237)
• bigqueryanalyticshub: added log_linked_dataset_query_user_email field to google_bigquery_analytics_hub_listing resource (#23238)
• compute: added cipher_suite block with phase1 and phase2 encryption configurations to google_compute_vpn_tunnel resource. (#23253)
• compute: added fingerprint field in google_compute_target_http_proxy and google_compute_target_https_proxy resources. (#23231)
• compute: added headers, expected_output_url, and expected_redirect_response_code fields to test in google_compute_url_map resource and made service field optional (#23199)
• compute: added path_matcher.default_route_action fields to google_compute_region_url_map resource (#23226)
• compute: added workload_policy and group_placement_policy.gpu_topology fields to google_compute_resource_policy resource (ga) (#23229)
• gkehub: added custom_role field to google_gke_hub_scope_rbac_role_binding resource (#23183)
• integrationconnectors: added support for log_config.level for google_integration_connectors_connection (#23224)
• networkconnectivity: added psc_config.producer_instance_location and psc_config.allowed_google_producers_resource_hierarchy_level fields to google_network_connectivity_service_connection_policy (#23240)
• redis: added managed_server_ca to google_redis_cluster resource (#23223)
• resourcemanager: allowed dataproc-control.googleapis.com and stackdriverprovisioning.googleapis.com services in google_project_service resource (#23230)
• storage: removed the hardcoded 80m timeout used during google_storage_bucket deletion when removing an anywhere cache, polling instead. This should speed up deletion in these cases. (#23198)
• vertexai: added region in google_vertex_ai_index_endpoint_deployed_index (#23247)

BUG FIXES:

• beyondcorp: fixed the issue where hubs.internet_gateway.assigned_ips was not populated correctly in the google_beyondcorp_security_gateway resource (#23244)
• compute: fixed google_compute_router_nat where changes to auto_network_tier are always shown after initial apply (#23190)
• compute: fixed validation for target_service field in google_compute_service_attachment resource causing issues when targeting a google_network_services_gateway resource (#23239)
• dataflow: fields network, subnetwork, num_workers, max_num_workers and machine_type will no longer cause permadiff on dataflow_flex_template_job (#23222)
• dataproc: fixed a permadiff with "prodcurrent" and "prodprevious" within image subminor version for google_dataproc_cluster (#23207)
• networksecurity: marked google_network_security_address_group capacity as immutable because it can't be updated in place. (#23209)

FEATURES:

• New Resource: google_apihub_curation (#23144)
• New Resource: google_compute_interconnect_attachment_group (#23159)
• New Resource: google_compute_interconnect_group (#23159)
• New Resource: google_compute_snapshot_settings (#23151)

IMPROVEMENTS:

• apigee: added client_ip_resolution_config field to google_apigee_environment resource (#23172)
• beyondcorp: added delegating_service_account field to google_beyondcorp_security_gateway resource (#23094)
• bigquery: added data_source_id to update requests through google_bigquery_data_transfer_config (#23134)
• cloudrunv2: added google_cloud_run_v2_job support for depends_on and startup_probe properties (#23179)
• container: added network_performance_config field to google_container_cluster resource (#23098)
• container: promoted flex_start in google_container_cluster to GA (#23093)
• dataplex: added catalog_publishing_enabled field to google_dataplex_datascan resource (#23165)
• datastream: added network_attachment support via psc_interface_config attribute in google_datastream_private_connection (#23091)
• eventarc: made network_attachment field optional in google_eventarc_pipeline (#23133)
• gemini: added disable_web_grounding field to google_gemini_gemini_gcp_enablement_setting resource (#23096)
• gemini: added enable_data_sharing field to google_gemini_data_sharing_with_google_setting resource (#23173)
• gkehub2: added spec.rbacrolebindingactuation field to resource google_gke_hub_feature (#23102)
• gkehub: added custom_role field to google_gke_hub_scope_rbac_role_binding resource (#23183)
• iambeta: enforced workload_identity_pool_managed_identity_id field validation per the documented specifications (#23149)
• pubsub: added message_transform field to google_pubsub_topic resource (#23161)
• pubsub: added message_transforms field to google_pubsub_subscription resource (#23162)

BUG FIXES:

• bigquery: modified google_bigquery_dataset_iam_member to no longer remove authorized views and routines (#23177)
• colab: fixed perma-diff in google_colab_runtime_template caused by the API returning a non-null default value. (#23137)
• colab: fixed perma-diff in google_colab_runtime_template caused by empty blocks. (#23163)
• compute: fixed a permadiff in network_profile field of google_compute_network related to specifying partial self-links (#23164)
• compute: fixed an issue where google_compute_firewall_policy_with_rules.target_resources could see a diff between the beta and v1 API in the resource's self-link (#23170)
• container: fixed nodepool secondary range validation to allow the use of netmasks. (#23142)
• gemini: removed overly restrictive product validation on google_gemini_gemini_gcp_enablement_setting_binding, google_gemini_data_sharing_with_google_setting_binding. New values like GOOGLE_CLOUD_ASSIST will now be accepted. (#23178)

DEPRECATIONS:

• colab: deprecated post_startup_script_config field in google_colab_runtime_template resource (#23075)

FEATURES:

• New Data Source: google_bigquery_datasets (#23059)
• New Resource: google_dataplex_entry (#23000)

IMPROVEMENTS:

• compute: added numeric_id field to google_compute_region_instance_template resource (#23065)
• compute: added source_subnetwork_ip_ranges_to_nat64 and nat64_subnetwork fields to google_compute_router_nat resource (#23078)
• container: promoted pod_autoscaling field in google_container_cluster resource to GA (#23002)
• datastream: added psc_interface_config field in google_datastream_private_connection resource (#23091)
• dns: added dns64_config field to google_dns_policy resource (#23078)
• filestore: added effective_replication.role and effective_replication.replicas.peer_instance fields to google_filestore_instance resource (#23001)
• netapp: added backup_retention_policy.backup_minimum_enforced_retention_days, backup_retention_policy.daily_backup_immutable, backup_retention_policy.weekly_backup_immutable, backup_retention_policy.monthly_backup_immutable, and backup_retention_policy.manual_backup_immutable fields to google_netapp_backup_vault (#23087)
• networkconnectivity: added IPV6 enum to protocolVersion field in PolicyBasedRoute resource (#23069)
• privateca: added support for setting default values for basic constraints for google_privateca_certificate_template via the null_ca and zero_max_issuer_path_length fields (#22981)
• privateca: added name_constraints field for google_privateca_certificate_template resource (#22981)
• provider: supported service account impersonation in different universes through credential file (#23063)

BUG FIXES:

• colab: fixed perma-diff in google_colab_runtime_template caused by the API returning a non-null default value (#23137)
• compute: fixed an issue where rules ordering in google_compute_region_security_policy caused a diff after apply (#23076)
• filestore: fixed bug where google_filestore_instance.initial_replication field could not be set (#23001)

FEATURES:

• New Data Source: google_bigquery_table (#22973)
• New Data Source: google_gke_hub_membership (#22972)
• New Resource: google_apigee_security_monitoring_condition (#22953)
• New Resource: google_beyondcorp_security_gateway_application (#22938)
• New Resource: google_cloud_run_v2_worker_pool (#22933)
• New Resource: google_compute_future_reservation (#22860)
• New Resource: google_dataplex_glossary_category (#22835)
• New Resource: google_dataplex_glossary_term (#22835)
• New Resource: google_iam_workforce_pool_provider_key (#22960)
• New Resource: google_managed_kafka_acl (#22957)

IMPROVEMENTS:

• alloydb: added activation_policy field to google_alloydb_instance resource (#22818)
• compute: added in-place update support for mtu field in google_compute_network (#22956)
• compute: promoted google_compute_region_network_firewall_policy_with_rules, google_compute_network_firewall_policy_with_rules, and compute_firewall_policy_with_rules resources to GA (#22958)
• container: added in-place update support for ip_allocation_policy.stack_type field in google_container_cluster resource (#22915)
• container: added in-place update support for enable_multi_networking in google_container_cluster resource (#22924)
• databasemigrationservice: added create_without_validation field to google_database_migration_service_private_connection resource (#22925)
• dataflow: added additional_pipeline_options field to google_dataflow_flex_template_job resource (#22919)
• memorystore: added field desired_auto_created_endpoints for google_memorystore_instance resource (#22871)
• netapp: added hybrid_peering_details and hybrid_replication_type fields to google_netapp_volume_replication resource (#22975)
• netapp: added hybrid_replication_parameters fields to google_netapp_volume resource (#22975)
• netblock: added restricted-googleapis-with-directconnectivity and private-googleapis-with-directconnectivity range_types to google_netblock_ip_ranges data source (#22930)
• netblock: added ipv6 ranges for restricted-googleapis and private-googleapis range_types to google_netblock_ip_ranges data source (#22930)
• privateca: added name_constraints field for google_privateca_certificate_template resource (#22981)
• spanner: added field instance_type to the google_spanner_instance resource (#22916)
• storage: added ip_filter to google_storage_bucket resource. (#22976)

BUG FIXES:

• compute: fixed forced instance recreation when adding a attached_disk with force_attach being false to google_compute_instance (#22954)
• gemini: fixed permadiff on product field in google_gemini_logging_setting_binding resource (#22819)
• gemini: fixed permadiff on product field in google_gemini_release_channel_setting_binding resource (#22929)
• networkservices: fixed validation error when modifying the cache_mode field in edge_cache_service (#22932)
• privateca: fixed issue preventing setting 0 and null values for basic constraints in the google_privateca_certificate_template resource via the addition of null_ca and zero_max_issuer_path_length fields (#22981)
• vpcaccess: fixed an issue where Terraform config validation conditions could have erroneously invalidated existing google_vpc_access_connector resources (#22837)

BUG FIXES:

• compute: fixed forced instance recreation when adding a attached_disk with unset force_attach to google_compute_instance (#22954)

DEPRECATIONS:

• beyondcorp: deprecated google_beyondcorp_application (#22754)
• firestore: deprecated deletion_policy field of google_firestore_database resource (#22764)

FEATURES:

• New Data Source: google_beyondcorp_security_gateway (#22793)
• New Data Source: google_lustre_instance (#22766)
• New Resource: google_bigquery_row_access_policy (#22806)
• New Resource: google_dataplex_glossary (#22794)
• New Resource: google_firebase_app_hosting_default_domain (#22748)
• New Resource: google_firebase_app_hosting_domain (#22748)
• New Resource: google_firebase_app_hosting_traffic (#22748)
• New Resource: google_network_security_intercept_deployment (#22790)
• New Resource: google_network_security_intercept_deployment_group (#22790)
• New Resource: google_network_security_intercept_endpoint_group (#22790)
• New Resource: google_network_security_intercept_endpoint_group_association (#22790)

IMPROVEMENTS:

• beyondcorp: increased default timeouts on google_beyondcorp_app_gateway operations from 20m to 40m (#22805)
• bigtable: added deletion_protection field to google_bigtable_logical_view resource (#22755)
• compute: added 'H2C' as a supported value for protocol in google_compute_backend_service and google_compute_region_backend_service (#22791)
• compute: added external_managed_backend_bucket_migration_state and external_managed_backend_bucket_migration_testing_percentage to google_compute_global_forwarding_rule resource. (#22781)
• compute: added external_managed_migration_state and external_managed_migration_testing_percentage to google_compute_backend_service resource. (#22781)
• compute: added force_attach field to boot_disk and attached_disk of google_compute_instance resource (#22801)
• compute: added numeric_id to google_compute_instance_template resource (#22763)
• compute: added the numeric id as generated_id attribute to the google_compute_network_endpoint_group (#22780)
• compute: added update support for load_balancing_scheme in google_compute_backend_service and google_compute_global_forwarding_rule resources to allow migrating between classic and global external ALB (#22781)
• container: added in_transit_encryption_config field in google_container_cluster resource (#22758)
• container: allowed in-place update node_config.windows_node_config field in google_container_cluster and google_container_node_pool resource (#22782)
• container: allowed in-place update for node_config.storage_pools field in google_container_cluster and google_container_node_pool resource (#22753)
• dialogflowcx: added event_handlers.trigger_fulfillment.enable_generative_fallback field to google_dialogflow_cx_flow resource (#22671)
• dialogflowcx: added gen_app_builder_settings field to google_dialogflow_cx_agent resource (#22757)
• netapp: added custom_performance_enabled, total_throughput_mibps, and total_iops fields to google_netapp_storage_pool resource (#22778)
• vmwareengine: increased google_cloud_vmwareengine_private_cloud timeout to 6 hours. (#22762)

BUG FIXES:

• compute: added global retry for "resourceNotReady for Networks" 400 errors (#22756)
• dialogflowcx: fixed an issue where dialogflow_cx_custom_endpoint is not correctedly handled (#22792)
• iamoauthclient: marked google_iam_oauth_client_credential.client_secret as sensitive (#22789)
• resourcemanager: fixed an issue in google_projects data source where the provider universe_domain did not overwrite the list URL (#22747)