Terraform Google Provider v7.40.0: New Data Sources and Resources
This release of the Terraform Google Provider introduces several new data sources and resources, enhancing infrastructure management capabilities for Google Cloud services. Notably, it adds new integrations for Data Catalog, Oracle Database Exascale, and Chronicle, alongside improvements to existing Compute Engine and Container resources. These updates benefit engineers and architects managing GCP infrastructure via Terraform, with many new resources becoming generally available.
- →New Data Source: google_data_catalog_taxonomy
- →New Data Source: google_oracle_database_exascale_db_storage_vault
- →New List Resource: 'google_project'
- →New List Resource: google_compute_instant_snapshot
- →New List Resource: google_compute_region_instant_snapshot
Deprecations (3) ›
- cloudrunv2
deprecated http_get.http_headers.port field in container startup probe and liveness probe in google_cloud_run_v2_worker_pool resource because it is not supported in Cloud Run API. This field will be removed in a future major release
- cloudsecuritycompliance
deprecated the organization field on google_cloud_security_compliance_cloud_control, google_cloud_security_compliance_framework, and google_cloud_security_compliance_framework_deployment. Use parent instead
- networkservices deprecated protocols on google_network_services_agent_gateway
Features (77) ›
- google_data_catalog_taxonomy New Data Source: google_data_catalog_taxonomy
- google_oracle_database_exascale_db_storage_vault New Data Source: google_oracle_database_exascale_db_storage_vault
- New List Resource: 'google_project'
- google_compute_instant_snapshot New List Resource: google_compute_instant_snapshot
- google_compute_region_instant_snapshot New List Resource: google_compute_region_instant_snapshot
- google_compute_region_target_http_proxy New List Resource: google_compute_region_target_http_proxy
- google_compute_region_target_tcp_proxy New List Resource: google_compute_region_target_tcp_proxy
- google_compute_region_url_map New List Resource: google_compute_region_url_map
- google_compute_rollout_plan New List Resource: google_compute_rollout_plan
- google_compute_target_grpc_proxy New List Resource: google_compute_target_grpc_proxy
- google_compute_target_http_proxy New List Resource: google_compute_target_http_proxy
- google_compute_target_ssl_proxy New List Resource: google_compute_target_ssl_proxy
- google_compute_target_tcp_proxy New List Resource: google_compute_target_tcp_proxy
- google_dns_managed_zone New List Resource: google_dns_managed_zone
- google_oracle_database_exascale_db_storage_vaults New List Resource: google_oracle_database_exascale_db_storage_vaults
- google_chronicle_findings_refinement_deployment New Resource: google_chronicle_findings_refinement_deployment
- google_chronicle_soar_domain New Resource: google_chronicle_soar_domain
- google_container_recurring_maintenance_window New Resource: google_container_recurring_maintenance_window
- google_iap_agent_registry_agent_iam_binding New Resource: google_iap_agent_registry_agent_iam_binding
- google_iap_agent_registry_agent_iam_member New Resource: google_iap_agent_registry_agent_iam_member
- google_iap_agent_registry_agent_iam_policy New Resource: google_iap_agent_registry_agent_iam_policy
- google_iap_agent_registry_endpoint_iam_binding New Resource: google_iap_agent_registry_endpoint_iam_binding
- google_iap_agent_registry_endpoint_iam_binding New Resource: google_iap_agent_registry_endpoint_iam_binding
- google_iap_agent_registry_endpoint_iam_member New Resource: google_iap_agent_registry_endpoint_iam_member
- google_iap_agent_registry_endpoint_iam_member New Resource: google_iap_agent_registry_endpoint_iam_member
- google_iap_agent_registry_endpoint_iam_policy New Resource: google_iap_agent_registry_endpoint_iam_policy
- google_iap_agent_registry_endpoint_iam_policy New Resource: google_iap_agent_registry_endpoint_iam_policy
- google_iap_agent_registry_mcp_server_iam_binding New Resource: google_iap_agent_registry_mcp_server_iam_binding
- google_iap_agent_registry_mcp_server_iam_member New Resource: google_iap_agent_registry_mcp_server_iam_member
- google_iap_agent_registry_mcp_server_iam_policy New Resource: google_iap_agent_registry_mcp_server_iam_policy
- google_tags_tag_binding_collection New Resource: google_tags_tag_binding_collection
- google_vector_search_index New Resource: google_vector_search_index
- google_chronicle_environment New Resource: google_chronicle_environment
- google_chronicle_data_export New Resource: google_chronicle_data_export
- google_oracle_database_goldengate_deployment_versions New Data Source: google_oracle_database_goldengate_deployment_versions
- google_storage_control_project_intelligence_finding New Data Source: google_storage_control_project_intelligence_finding
- google_storage_control_project_intelligence_findings New Data Source: google_storage_control_project_intelligence_findings
- google_chronicle_parser New Resource: google_chronicle_parser
- google_migration_center_import_data_file New Resource: google_migration_center_import_data_file
- google_network_services_agent_gateway New Resource: google_network_services_agent_gateway
- google_vertex_ai_tensorboard_experiment New Resource: google_vertex_ai_tensorboard_experiment
- google_bigquery_dataset_access New List Resource: google_bigquery_dataset_access
- google_cloud_scheduler_job New List Resource: google_cloud_scheduler_job
- google_dns_record_set New List Resource: google_dns_record_set
- google_monitoring_alert_policy New List Resource: google_monitoring_alert_policy
- google_pubsub_subscription New List Resource: google_pubsub_subscription
- google_apigee_instance New Data Source: google_apigee_instance
- google_oracle_database_goldengate_deployment_types New Data Source: google_oracle_database_goldengate_deployment_types
- google_apigee_datastore New Resource: google_apigee_datastore
- google_discovery_engine_search_engine_iam_binding New Resource: google_discovery_engine_search_engine_iam_binding
- google_license_manager_configuration New Resource: google_license_manager_configuration
- google_migration_center_import_job New Resource: google_migration_center_import_job
- google_compute_disk New List Resource: google_compute_disk
- google_compute_image New List Resource: google_compute_image
- google_compute_snapshot New List Resource: google_compute_snapshot
- google_storage_hmac_key New List Resource: google_storage_hmac_key
- google_oracle_database_goldengate_connection_types New Data Source: google_oracle_database_goldengate_connection_types
- google_chronicle_findings_refinement New Resource: google_chronicle_findings_refinement
- google_dataplex_data_product New Resource: google_dataplex_data_product
- google_dataplex_data_product_data_asset New Resource: google_dataplex_data_product_data_asset
- google_migration_center_discovery_client New Resource: google_migration_center_discovery_client
- google_migration_center_report New Resource: google_migration_center_report
- google_oracle_database_goldengate_connection_assignment New Resource: google_oracle_database_goldengate_connection_assignment
- google_oracle_database_goldengate_connection New Resource: google_oracle_database_goldengate_connection
- google_oracle_database_goldengate_deployment New Resource: google_oracle_database_goldengate_deployment
- google_compute_firewall New List Resource: google_compute_firewall
- google_compute_global_address New List Resource: google_compute_global_address
- google_compute_subnetwork New List Resource: google_compute_subnetwork
- google_sql_database New List Resource: google_sql_database
- google_compute_service_attachment New Data Source: google_compute_service_attachment
- google_oracle_database_goldengate_deployment_environments New Data Source: google_oracle_database_goldengate_deployment_environments
- google_config_deployment New Resource: google_config_deployment
- google_dialogflow_sip_trunk New Resource: google_dialogflow_sip_trunk
- google_migration_center_assets_export_job New Resource: google_migration_center_assets_export_job
- google_migration_center_report_config New Resource: google_migration_center_report_config
- google_migration_center_settings New Resource: google_migration_center_settings
- google_migration_center_source New Resource: google_migration_center_source
Enhancements (72) ›
- agentregistry added name field to google_agent_registry_binding resource
- agentregistry added name field to google_agent_registry_service resource
- appengine added app_engine_bundled_services field to google_app_engine_standard_app_version resource
- biglakeiceberg add support for CATALOG_TYPE_FEDERATED with federated_catalog_options to google_biglake_iceberg_catalog
- compute added target_type and target_forwarding_rules to google_compute_region_network_firewall_policy_with_rules resource
- compute added workload_identity_config fields to google_compute_instance and google_compute_instance_template resources
- compute
added instance_lifecycle_policy.on_repair.allow_changing_zone field to google_compute_instance_group_manager and google_compute_instance_region_group_manager
- container
added ANY_RESERVATION_THEN_FAIL option to consume_reservation_type field in google_container_cluster and google_container_node_pool resources
- container
added custom_node_init configuration block to node_config (supporting Cloud Storage and Secret Manager) for both google_container_cluster and google_container_node_pool resources
- container added maintenance_policy field to google_container_node_pool resource
- dataplex added catalog_publishing_enabled field to google_dataplex_datascan resource
- dlp added inspect_config.min_likelihood_per_info_type to google_data_loss_prevention_inspect_template
- firestore added skip_wait field to google_firestore_field resource, skipping the wait for index creation
- oracledatabase
added support for configuring Exascale-based VM clusters on top of dedicated storage vaults via the exascale_db_storage_vault parameter and storage_management_type to determine if VM Cluster is ASM or EXASCALE in google_oracle_database_cloud_vm_cluster
- oracledatabase added exadata_infrastructure field to google_oracle_database_exascale_db_storage_vault resource
- oracledatabase added exascale_db_storage_vault and storage_management_type fields to google_oracle_database_cloud_vm_clusters data source
- sql added enforce_new_sql_network_architecture field to google_sql_database_instance resource
- sql
added psc_auto_connection_policy_enabled field and output-only service_connection_policy and service_connection_policy_creation_result fields to google_sql_database_instance resource
- storagetransfer added private_network_service to resource google_storage_transfer_job
- apigee added new resource google_apigee_environment_debugmask for managing Apigee environment debug masks
- backupdr added support for use_project_service_account flag in google_backup_dr_restore_workload disk and compute restores
- cloudrunv2 added http_get.http_headers.name field to container startup probe and liveness probe in google_cloud_run_v2_worker_pool resource
- cloudrunv2 added template.client and template.client_version fields to google_cloud_run_v2_worker_pool resource
- cloudsecuritycompliance
added support for project parent to google_cloud_security_compliance_cloud_control, google_cloud_security_compliance_framework, and google_cloud_security_compliance_framework_deployment via the new parent field. The organization field has been deprecated
- compute added params.resource_manager_tags field to google_compute_reservation resource
- compute
added data sources for google_compute_target_http_proxy, google_compute_target_https_proxy, google_compute_region_target_http_proxy, and google_compute_region_target_https_proxy
- container added addons_config.slurm_operator_config field to google_container_cluster resource
- container added node_image_config field to google_container_node_pool and google_container_cluster resources
- databasemigrationservice added state and stop_on_warnings fields to google_database_migration_service_migration_job resource
- dns added resource identity support for google_dns_record_set resource
- networksecurity added network_rules field on google_network_security_authz_policy resource
- pubsub added first_revision_id and last_revision_id fields to google_pubsub_topic resource
- sql
added settings.ip_configuration.psc_config.psc_auto_dns_enabled and settings.ip_configuration.psc_config.psc_write_endpoint_dns_enabled fields to google_sql_database_instance resource
- accesscontextmanager added in-place update for egress_from and egress_to fields in google_access_context_manager_service_perimeter_egress_policy resource
- accesscontextmanager added in-place update for egress_from and egress_to fields in google_access_context_manager_service_perimeter_ingress_policy resource
- bigquery
added IAM support (google_bigquery_routine_iam_policy, google_bigquery_routine_iam_binding, google_bigquery_routine_iam_member) for google_bigquery_routine resource
- bigtable added automated_backup_policy.locations field in google_bigtable_table resource
- ces added agent_tool, file_search_tool, and widget_tool fields to the google_ces_tool resource
- ces added google_search_tool.prompt_config and data_store_tool.data_store_source fields to the google_ces_tool resource
- ces exposed remote_agent_tool, connector_tool, and mcp_tool as read-only (output-only) attributes in google_ces_tool
- container added node_creation_config field to google_container_cluster resource
- container
added node_drain_config.pdb_timeout_duration and node_drain_config.grace_termination_duration fields to google_container_node_pool and google_container_cluster resources
- data_catalog added RICHTEXT to allowed values of primitive_type on google_data_catalog_tag_template fields
- dataplex added IAM support for google_dataplex_data_product resource (iam_policy, iam_binding, iam_member)
- dataplex added access_approval_config field to google_dataplex_data_product resource
- hypercomputecluster marked network_resources field as required in google_hypercomputecluster_cluster resource to align with API validation
- networksecurity
google_network_security_ull_mirroring_engine, google_network_security_ull_mirroring_collector, and google_network_security_ull_mirroring_collector_rule resources promoted to GA
- securesourcemanager added psc_allowed_projects field to google_secure_source_manager_instance resource
- workbench added NVIDIA_RTX6000 to the supported gce_setup.accelerator_configs.type values on google_workbench_instance resource
- compute added target_type and target_forwarding_rules fields to google_compute_network_firewall_policy_rule resource
- container added crash_loop_back_off.max_container_restart_period field to google_container_node_pool and google_container_cluster resources
- container added additional value KCP_VPA for logging_config.enable_components field to google_container_cluster resource
- dataplex added service_account support to google_dataplex_data_product access group principals
- firestore added ttl_config.expiration_offset field to google_firestore_field resource
- netapp added ontap_source field to google_netapp_backup resource
- networkmanagement added gke_pod and network_type fields to google_network_management_connectivity_test resource
- bigtable added edition field to google_bigtable_instance resource
- ces added fail_open field to llm_prompt_security block in google_ces_guardrail resource
- ces added read-only fail_open field to llm_prompt_security block in google_ces_app_version resource
- compute added ip_version and ip_collection fields to secondary_ip_range field in google_compute_subnetwork resource
- compute added post_quantum_key_exchange field to google_compute_ssl_policy and google_compute_region_ssl_policy resources
- compute added support in the google_compute_network datasource for looking up a network by self_link in addition to name
- container added agent_sandbox_config field to google_container_cluster resource
- container
added node_config.gpudirect_strategy and node_pool.node_config.gpudirect_strategy to cluster resource, added node_config.gpudirect_strategy to node_pool resource
- dataflow Added create_ignore_already_exists field to google_dataflow_flex_template_job resource to handle 409 conflicts
- datafusion added maintenance_policy field to google_data_fusion_instance resource
- iam add resource identity support for iam_member resources
- networkconnectivity google_network_connectivity_transport resource promoted to GA
- oracledatabase added identity_connector to google_oracle_database_cloud_vm_cluster for CMEK support
- project added Resource Identity support to google_project_iam_binding
- project added Resource Identity support to google_project_iam_policy
- sql promoted Hyperdisk fields, data_disk_provisioned_iops and data_disk_provisioned_throughput to GA
Fixes (41) ›
- bigtable fixed a bug where row_affinity updates did not persist on google_bigtable_app_profile
- bug fixed labels diff in google_project
- chronicle suppressed a permadiff on google_chronicle_rule.text caused by the Chronicle API appending a trailing newline to every stored rule body
- cloudscheudler added retries for "409: sync mutate calls cannot be queued" error for google_cloud_scheduler_job
- compute fixed an issue where preview = false updates for google_compute_organization_security_policy_rule were omitted from API requests
- compute fixed bug where it wasn't possible to disable enable_proxy_protocol on google_compute_service_attachment resource
- datastream fixed a bug in update functionality in google_datastream_connection_profile mongodb_profile.additional_options
- eventarc fixed a type mismatch when an google_eventarc_trigger resource returns non-empty conditions
- filestore aligned google_filestore_instance resource timeouts with the Filestore service instance operations TTLs
- gemini
fixed truncated timeouts in google_gemini_code_tools_setting, google_gemini_data_sharing_with_google_setting_binding, google_gemini_gemini_gcp_enablement_setting_binding, and google_gemini_release_channel_setting_binding
- hypercomputecluster fixed 20-minute timeout limit during google_hypercomputecluster_cluster resource creation
- logging fixed an issue where errors on update would not be propagated in google_logging_project_bucket_config
- observability
fixed unintentionally long timeouts in google_observability_folder_settings, google_observability_organization_settings, and google_observability_project_settings
- oracledatabase
fixed early client-side timeouts and aligned default schema timeouts with backend async polling limits on google_oracle_database_exadb_vm_cluster, google_oracle_database_odb_network, google_oracle_database_odb_subnet, google_oracle_database_goldengate_connection, google_oracle_database_goldengate_deployment, and google_oracle_database_goldengate_connection_assignment
- oracledatabase
fixed truncated timeouts in google_oracle_database_exadb_vm_cluster, google_oracle_database_goldengate_connection, and google_oracle_database_odb_subnet
- privilegedaccessmanager fixed a permadiff on google_privileged_access_manager_entitlement for entitlements created without an approval workflow
- provider fixed validation of external_credentials.identity_token to reject malformed JWTs containing empty segments
- apigee fixed google_apigee_api not detecting local bundle changes due to a missing default on detect_md5hash, and fixed the test sweeper's list URL
- apigee
fixed google_apigee_security_action update failure by enabling PATCH-based updates now that the Apigee Security Actions API supports mutations
- apigee fixed a perma-diff for api_products and scopes fields in google_apigee_developer_app resource when updating them with multiple items
- apigee fixed an issue where the resource would attempt recreation if the key_expires_in field was set in google_apigee_developer_app resource
- ces fixed persistent diff in google_ces_guardrail when llm_prompt_security is configured with default_settings
- cloudrun fixed a permadiff for the run.googleapis.com/gpu-zonal-redundancy-disabled annotation in google_cloud_run_service
- cloudrunv2
fixed bug where only one http_get.http_headers block could be specified in container startup probe and liveness probe in google_cloud_run_v2_worker_pool resource
- compute
fixed an issue in google_compute_subnetwork where secondary_ip_range entries linked to an internal_range could not be removed and adding new ranges would sometimes fail due to positional shifts
- compute fixed diff when using existing_reservations field in google_region_commitment
- compute fixed rules in google_compute_security_policy being unnecessarily recreated due to TypeSet hash instability
- sql fixed inconsistent result after apply error when adding users of type CLOUD_IAM_GROUP with capitalized domain names for MySQL
- storage fixed OOM issue for google_storage_bucket force_destroy by limiting the number of outstanding tasks to 2000
- apigee send zero values for ip_header_index in google_apigee_environment resource
- backupdr fixed an issue where google_backup_dr_restore_workload did not use the correct API JSON names for networking/reservation fields
- compute
fixed an issue where updating connection_limit in the consumer_accept_lists block of google_compute_service_attachment would not trigger a resource update
- compute fixed regional backend reference in google_compute_regional_url_map resource
- dlp fixed error when reading google_data_loss_prevention_discovery_config caused by nested error details
- sql fixed permadiff on connection_pool_config when connection_pooling_enabled is set to false
- tags fixed google_tags_location_tag_binding failing with Operation location does not match service location 'global' during creation
- vertexai
fixed terraform import of google_vertex_ai_index_endpoint_deployed_index failing with "Cannot determine region" when provider-level region/zone is unset
- resourcemanager fixed a bug where ephemeral google_service_account_key failed on deletion if the parent service account had already been deleted
- storage fixed missing identity error when updating values in google_storage_bucket
- bigtable fixed an issue where bigtable_custom_endpoint and universe_domain were ignored when creating Bigtable resources
- compute
fixed an issue in google_compute_subnetwork where secondary_ip_range entries linked to an internal_range could not be removed and adding new ranges would sometimes fail due to positional shifts
Notes (7) ›
- compute migrated google_compute_instance code related to advanced machine features to use direct HTTP rather than a client library
- compute migrated EnableDisplay fields in google_compute_instance resources to use direct HTTP rather than a client library
- compute
migrated desired_status block and startInstanceOperation in resource_compute_instance.go.tmpl to use direct HTTP rather than a client library
- compute
migrated getInstance, getDisk, Delete and the setMetadata update block in resource_compute_instance.go.tmpl to use direct HTTP rather than a client library
- compute migrated part of google_compute_instance to use direct HTTP rather than a client library
- compute migrated google_compute_region_instance_template to use direct HTTP rather than a client library
- compute migrated google_compute_instance_group_manager resource to use direct HTTP rather than a client library
https://github.com/hashicorp/terraform-provider-google/releases/tag/v7.40.0
Related releases
- Google Cloud Accelerate AI with Cloud Run Roadshow 2026 Google Cloud Blog ·
- Gemini Enterprise for Education Recognized by Tambellini Group Google Cloud Blog ·
- Google Cloud: New AI, Serverless, and Infrastructure Updates Google Cloud Blog ·
- Google Cloud enables AI-defined vehicles with Android and Bigtable Google Cloud Blog ·
- BigQuery Security Advisory and New Features Announced Google Cloud release notes ·
- Colab Enterprise Security Vulnerability in BigQuery, Dataform Google Cloud release notes ·