chore(deps): update terraform google to ~> 7.12.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
google (source)	required_provider	minor	~> 7.4.0 -> ~> 7.12.0

---

Release Notes

hashicorp/terraform-provider-google (google)

v7.12.0

Compare Source

v7.11.0

Compare Source

DEPRECATIONS:

• pubsublite: google_pubsub_lite_reservation will be turned down effective March 18, 2026. Use google_pubsub_reservation instead. (#​25058)
• pubsublite: google_pubsub_lite_subscription will be turned down effective March 18, 2026. Use google_pubsub_subscription instead. (#​25058)
• pubsublite: google_pubsub_lite_topic will be turned down effective March 18, 2026. Use google_pubsub_topic instead. (#​25058)

BREAKING CHANGES:

• netapp: made google_netapp_volume.export_policy.rules.squash_mode not preserve values returned by the API. Without this change, unsetting squash_mode in the provider can cause an API error. (#​25059)

FEATURES:

• New Data Source: google_artifact_registry_python_packages (#​25053)
• New Data Source: google_cloud_identity_policy (#​24946)
• New Data Source: google_compute_reservation_block (#​25034)
• New Data Source: google_compute_reservation_sub_block (#​25034)
• New Resource: google_ces_deployment (#​24945)
• New Resource: google_ces_example (#​25056)
• New Resource: google_discovery_engine_user_store (#​25054)

IMPROVEMENTS:

• bigquery: added external_data_configuration.decimal_target_types to google_bigquery_table (#​24936)
• compute: added internal_ipv6_prefix field to the google_compute_subnetwork resource (#​25037)
• compute: added ipv6_access_type field and INTERNAL_IPV6_SUBNETWORK_CREATION as a supported value for the mode field in google_compute_public_delegated_prefix resource (#​24940)
• compute: added ipv6_access_type field to google_compute_public_advertised_prefix resource (#​24911)
• dataplex: added data_documentation_spec field to google_dataplex_datascan resource to support the DATA_DOCUMENTATION scan type (#​25044)
• dataproc: added resource_manager_tags to google_dataproc_cluster resource (#​25057)
• lustre: added placement_policy field to google_lustre_instance resource (#​25042)
• netapp: added cache_parameters field to google_netapp_volume resource (#​24909)
• secretmanager: added project and short name support for secret on google_secret_manager_secret_version (#​25045)
• secretmanager: added project and short name support for secret on ephemeral google_secret_manager_secret_version (#​25045)

BUG FIXES:

• alloydb: fixed issue with creation when initial_user.password was set to a computed value in google_alloydb_cluster (#​25036)
• bigquery: fixed extraneous diffs in google_bigquery_table.external_data_configuration.schema (#​24936)
• compute: fixed a breaking change in google_compute_instance introduced in 7.9.0 where a destroy-diff is prompted for instances with preset GPUs (#​25021)
• container: added KUBE_DNS as an accepted value for cluster_dns field on google_container_cluster (#​24953)
• netapp: fixed bug where unsetting export_policy.rules.squash_mode on google_netapp_volume can cause an API error (#​25059)
• pubsub: fixed bug where google_pubsub_subscription could only be updated if bigquery_config was modified (#​24952)
• sql: fixed bug where final_backup_description in google_sql_database_instance resource wasn't set on the final backup on delete (#​25055)
• storage: fixed bug where certain changes to google_storage_bucket_acl.role_entity were ignored (#​24949)
• workstations: fixed bug in google_workstations_workstation where setting source_workstation caused a permadiff that forced recreation (#​24941)
• vmwareengine: made deletion of google_vmwareengine_private_cloud wait until the deletion completes (#​25040)

v7.10.0

Compare Source

BREAKING CHANGES:

• alloydb: marked initial_user.password as required on create of new google_alloydb_cluster resources. This change aligns the provider with existing API constraints to surface errors earlier. (#​25022)

FEATURES:

• New Resource: google_ces_app (#​24861)
• New Resource: google_ces_toolset (#​24885)
• New Resource: google_discovery_engine_control (#​24883)
• New Resource: google_netapp_host_group (#​24876)
• New Resource: google_network_management_organization_vpc_flow_logs_config (#​24896)
• New Resource: google_network_services_multicast_domain (#​24864)
• New Resource: google_privileged_access_manager_settings (#​24878)
• New Ephemeral Resource: google_client_config (#​24900)

IMPROVEMENTS:

• cloudfunctions2: added direct_vpc_network_interface and direct_vpc_egress field to google_cloudfunctions2_function resource (#​24895)
• cloudrunv2: added template.container.depends_on field to google_cloud_run_v2_worker_pool resource (#​24893)
• compute: added grpc_tls_health_check field to google_compute_healthcheck resource (#​24872)
• container: added network_tier_config to google_container_cluster resource. (#​24877)
• eventarc: added labels field to google_eventarc_channel resource (#​24854)
• netapp: added block_devices field and ISCSI protocol support to goolge_netapp_volume resource, and increased timeouts on its operations (#​24898)
• netapp: added type field to google_netapp_storage_pool resource (#​24867)
• vertexai: added psc_automation_configs field to google_vertex_ai_endpoint resource (#​24870)
• vertexai: added sync_config.continuous field to google_vertex_ai_feature_online_store_featureview (#​24881)

BUG FIXES:

• accesscontextmanager: fixed issue where google_access_context_manager_service_perimeter_[dry_run_][egress|ingress]_policy caused the provider to crash when a provided identity casing was invalid. (#​24886)
• apigee: fixed issue where credentials block was not populated in the Terraform state in google_apigee_developer_app resource (#​24880)
• compute: fixed google_compute_network_firewall_policy_rule staying disabled after apply with disabled = false (#​24879)
• compute: fixed a breaking change in google_compute_instance introduced in 7.9.0 where a destroy-diff is prompted for instances with preset GPUs (#​25020
• compute: resolve permadiff for display_name in new deployments of google_compute_organization_security_policy (#​24882)
• storage: fixed a conversion error in google_storage_bucket state migration. This bug impacted Pulumi users. (#​24853)

v7.9.0

Compare Source

BREAKING CHANGES:

• beyondcorp: made the ports field in endpoint_matchers required in response to a change in the API surface. (#​24770)

FEATURES:

• New Resource: google_firestore_user_creds (#​24794)
• New Resource: google_network_security_dns_threat_detector (#​24744)

IMPROVEMENTS:

• appengine: added ssl_policy to application on google_app_engine_application resource (#​24786)
• bigquery: added support for IAM conditions in google_bigquery_dataset_iam_* (#​24778)
• compute: promoted policy_type to GA in google_compute_network_firewall_policy, google_compute_network_firewall_policy_with_rules, google_compute_region_network_firewall_policy, google_compute_region_network_firewall_policy_with_rules. (#​24769)
• container: added dns_endpoint_confg.enable_k8s_tokens_via_dns and dns_endpoint_config.enable_k8s_certs_via_dns fields to google_container_cluster resource (#​24774)
• container: added fleet.membership_type field to google_container_cluster resource (#​24759)
• dataplex: added data_classification field to google_dataplex_aspect_type resource (#​24807)
• iamworkforcepool: added scim_usage field to workforce_pool_provider resource (#​24787)
• memorystore: added available_maintenance_versions field to google_memorystore_instance resource (#​24745)
• memorystore: added maintenance_version field to google_memorystore_instance resource (#​24740)
• redis: added available_maintenance_versions field to google_redis_cluster resource (#​24745)
• redis: added maintenance_version field to google_redis_cluster resource (#​24740)
• storagetransfer: added transfer_manifest field to google_storage_transfer_job resource (#​24768)

BUG FIXES:

• bigquery: added validation for target_types in google_bigquery_dataset_access (#​24810)
• cloudquotas: resolved permadiff for preferred_value in google_cloud_quotas_quota_preference (#​24776)
• compute: fixed scenario where google_compute_instance would not be staged for recreation if guest_accelerator.count was updated to 0 from non-zero value (#​24762)
• sql: fixed an issue where dataDiskSize was unintentionally null instead of set to the current value in API requests, triggering unrelated errors (#​24790)

v7.8.0

Compare Source

FEATURES:

• New Data Source: google_artifact_registry_packages (#​24696)
• New Data Source: google_network_management_connectivity_tests (#​24635)
• New Resource: google_apigee_environment_api_revision_deployment (#​24657)
• New Resource: google_dataplex_entry_link (#​24737)
• New Resource: google_discovery_engine_assistant (#​24724)
• New Resource: google_oracle_database_db_system (#​24733)
• New Resource: google_saas_runtime_unit (#​24692)

IMPROVEMENTS:

• compute: added IN_FLIGHT to balancing_mode on google_compute_backend_service resource (#​24710)
• compute: added new field instance_lifecycle_policy.on_repair.allow_changing_zone to google_compute_region_instance_group_manager & google_compute_instance_group_manager (#​24706)
• compute: promoted security_policy in compute_region_backend_service resource to GA (#​24693)
• compute: promoted the google_compute_preview_feature resource to GA. (#​24725)
• compute: the activation_status attribute within the google_compute_preview_feature resource now uses the ACTIVATION_STATE_UNSPECIFIED value instead of DISABLED. Support for DISABLED will be added in a future release. (#​24725)
• datastream: added backfill_all.mongodb_excluded_objects and source_config.mongodb_source_config fields to google_datastream_stream (#​24727)
• datastream: added mongodb_profile field to google_datastream_connection_profile (#​24727)
• discoveryengine: added connector_modes, sync_mode, incremental_refresh_interval, auto_run_disabled, and incremental_sync_disabled fields to google_discovery_engine_data_connector resource (#​24658)
• discoveryengine: added kms_key_name field to google_discovery_engine_search_engine resource (#​24658)
• discoveryengine: added in-place update support for entities.params and entities.key_property_mappings in google_discovery_engine_data_connector (#​24739)
• dlp: added publish_findings_to_dataplex_catalog field to google_data_loss_prevention_job_trigger (#​24722)
• iambeta: allowed GKE workload identity pool pattern in workload_identity_pool_id field of google_iam_workload_identity_pool resource. (#​24656)
• memorystore: added maintenance_version field to google_memorystore_instance resource (#​24740)
• memorystore: added available_maintenance_versions field to google_memorystore_instance resource (#​24745)
• networkconnectivity: added HYBRID_INSPECTION enum value to preset_topology field in google_network_connectivity_hub resource (#​24738)
• networkservices: added isolationConfig on google_network_services_service_lb_policies resource (#​24652)
• redis: added deletion_protection field to redis_instance to make deleting them require an explicit intent. redis_instance resources now cannot be destroyed unless deletion_protection = false is set for the resource. (#​24654)
• redis: added maintenance_version field to google_redis_cluster resource (#​24740)
• redis: added available_maintenance_versions field to google_redis_cluster resource (#​24745)
• saas_runtime: added default_release field to google_saas_runtime_unit_kind resource (#​24726)
• sql: added read_pool_auto_scale_config support to sql_database_instance resource (#​24723)

BUG FIXES:

• bigquery: fixed the issue where google_bigquery_table detected an incorrect schema diff on tables with row access policies when the schema was unchanged. (#​24711)
• compute: allow requested_link_count to be updated in-place in google_compute_interconnect resource (#​24705)

v7.7.0

Compare Source

BREAKING CHANGES:

• discoveryengine: changed type of google_discovery_engine_data_connector.entities.params. Previously, it was a map of string keys to string values; now, it must be a JSON-encoded string containing an object. This change is being made in a minor release because the field wasn't usable as intended – specifically, all current valid uses require mapping strings to lists of strings. (#​24658)

FEATURES:

• New Data Source: google_network_management_connectivity_tests (#​24635)
• New Resource: google_apigee_developer_app (#​24625)
• New Resource: google_discovery_engine_license_config (#​24619)
• New Resource: google_iam_workforce_pool_provider_scim_tenant (#​24587)
• New Resource: google_kms_project_kaj_policy_config (#​24622)
• New Resource: google_saas_runtime_tenant (#​24608)

IMPROVEMENTS:

• apigee: updated the scopes argument in google_apigee_api_product resource to be order-insensitive. (#​24625)
• beyondcorp: added proxy_protocol_config and service_discovery fields to google_beyondcorp_security_gateway resource (#​24609)
• cloudrunv2: added default_uri_disabled field to google_cloud_run_v2_service resource. (GA promotion) (#​24602)
• cloudrunv2: added health_check_disabled field to google_cloud_run_v2_service resource. (#​24602)
• compute: added params field to google_compute_router resource (GA) (#​24611)
• discoveryengine: added connector_modes, sync_mode, incremental_refresh_interval, auto_run_disabled, and incremental_sync_disabled fields to google_discovery_engine_data_connector resource (#​24658)
• discoveryengine: added kms_key_name field to google_discovery_engine_search_engine resource (#​24658)
• dlp: added publish_to_dataplex_catalog field to discovery_config resource (#​24621)
• gkeonprem: made it possible to set the on_prem_version field on google_gkeonprem_vmware_node_pool (previously output-only) (#​24614)
• memcache: added deletion_protection field to memcache_instance to make deleting them require an explicit intent. memcache_instance resources now cannot be destroyed unless deletion_protection = false is set for the resource. (#​24613)
• metastore: added tags field to google_dataproc_metastore_service and 'google_dataproc_metastore_federation' resources to allow setting tags for services and federation at creation time (#​24633)
• networksecurity: added URL_FILTERING option to enum field type for google_network_security_security_profile resource (#​24583)
• networksecurity: added url_filtering_profile field to google_network_security_security_profile_group resource (beta) (#​24583)
• networksecurity: added url_filtering_profile field to google_network_security_security_profile resource (beta) (#​24583)
• sql: added source_instance_deletion_time field to google_sql_database_instance_latest_recovery_time data source (#​24576)
• sql: added source_instance_deletion_time field to google_sql_database_instance resource (#​24576)

BUG FIXES:

• bigqueryanalyticshub: fixed google_bigquery_analytics_hub_listing_subscription import (#​24634)
• discoveryengine: fixed bug where it wasn't possible to specify values for knowledgeBaseSysId or catalogSysId in google_discovery_engine_data_connector.entities.params. (#​24658)

v7.6.0

Compare Source

DEPRECATIONS:

• networksecurity: deprecated ignore_case, exact, prefix, suffix and contains fields in http_rules.from.not_sources.principals and http_rules.from.sources.principals blocks in google_network_security_authz_policy resource. Use the equivalent fields in http_rules.from.not_sources.principals.principal or http_rules.from.sources.principals.principal instead. (#​24543)

BREAKING CHANGES:

• container: node_config blocks that had set kubelet_config without explicitly setting cpu_cfs_quota implicitly set cfu_cfs_quota to false when unset. From this version onwards, an unset cpu_cfs_quota will instead match the API default of true true. Resources that are recreated will receive the new value; old resources are unaffected, and may change values by explicitly setting the intended one. (#​24569)
• storageinsights: removed activity_data_retention_period_days field from google_storage_insights_dataset_config resource due to a delayed launch. It will be readded when the feature launches. (#​24570)

FEATURES:

• New Resource: google_kms_folder_kaj_policy_config (#​24513)
• New Resource: google_vertex_ai_cache_config (#​24541)
• New Resource: google_vertex_ai_reasoning_engine (#​24512)

IMPROVEMENTS:

• backupdr: added data_source and rules_config_info fields to google_backup_dr_backup_plan_associations datasource (#​24517)
• beyondcorp: added external, proxy_protocol, and schema fields to google_beyondcorp_security_gateway_application resource (#​24542)
• beyondcorp: changed endpoint_matchers field to not be required anymore in the google_beyondcorp_security_gateway_application resource (#​24542)
• cloudrunv2: added default_uri_disabled field to google_cloud_run_v2_service resource (#​24556)
• compute: added shared_secret_wo and shared_secret_wo_version fields to google_compute_vpn_tunnel resource, enabling write-only management of the shared secret. (#​24491)
• dlp: added SENSITIVITY_UNKNOWN as possible enum value for actions.tag_resources.tag_conditions.sensitivity_score.score in google_data_loss_prevention_discovery_config resource (#​24564)
• dlp: added actions.save_findings.output_config.storage_path field to google_data_loss_prevention_job_trigger resource (#​24558)
• filestore: added file_shares.nfs_export_options.network and networks.psc_config.endpoint_project fields to google_filestore_instance resource (#​24567)
• lustre: increased creation timeout from 20min to 40min for google_lustre_instance resource (#​24559)
• netapp: added hybrid_replication_user_commands field with subfield commands to google_netapp_volume_replication resource (#​24554)
• netapp: added replication_schedule, hybrid_replication_type, large_volume_constituent_count fields to hybrid_replication_parameters field in google_netapp_volume resource (#​24554)
• networksecurity: added ip_blocks field to google_network_security_authz_policy resource (#​24543)
• secretmanager: added ephemeral support for google_secret_manager_secret_version resource (#​24566)
• sql: added source_instance_deletion_time field to google_sql_database_instance_latest_recovery_time data source (#​24576)
• sql: added source_instance_deletion_time field to google_sql_database_instance resource (#​24576)
• storagetransfer: added user_project_override and billing_project fields to google_storage_transfer_job resource (#​24504)

BUG FIXES:

• container: fixed the default for node_config.kubelet_config.cpu_cfs_quota on google_container_cluster, google_container_node_pool, google_container_cluster.node_pool to align with the API. Terraform will now send a true value when the field is unset on creation, and preserve any previously set value when unset. Explicitly set values will work as defined in configuration. (#​24569)

v7.5.0

Compare Source

BREAKING CHANGES:

• netapp: changed peer_ip_addresses field type from String to Array in google_netapp_volume resource, as it was unusable otherwise (#​24428)

FEATURES:

• New Data Source: google_artifact_registry_maven_artifacts (#​24487)
• New Data Source: google_artifact_registry_npm_packages (#​24486)
• New Resource: google_apigee_api_deployment (#​24469)
• New Resource: google_discovery_engine_data_connector (#​24472)
• New Resource: google_managed_kafka_connect_cluster (#​24443)
• New Resource: google_managed_kafka_connector (#​24443)
• New Resource: google_kms_organization_kaj_policy_config (#​24471)
• New Resource: google_saas_runtime_rollout_kind (#​24447)

IMPROVEMENTS:

• cloudrunv2: added mount_options in gcsfuse volumes for google_cloud_run_v2_service, google_cloud_run_v2_job, and google_cloud_run_v2_workerpool resources. (#​24413)
• cloudrunv2: added startup_probe and liveness_probe to google_cloud_run_v2_worker_pool resource (#​24418)
• compute: added bandwidth_allocation field to google_compute_wire_group resource (#​24460)
• compute: added shared_secret_wo and shared_secret_wo_version fields for google_compute_vpn_tunnel resource, enabling write-only management of the shared secret. (#​24491)
• dialogflow: added new_recognition_result_notification_config field to google_dialogflow_conversation_profile resource (#​24468)
• discoveryengine: added features field to google_discovery_engine_search_engine resource (#​24445)
• dlp: added other_cloud_target and other_cloud_starting_location to google_data_loss_prevention_discovery_config (#​24463)
• gkebackup: added backup_config.selected_namespace_labels field to google_gke_backup_backup_plan resource (#​24427)
• looker: added gemini_enabled field to google_looker_instance resource (#​24461)
• netapp: added hot_tier_bypass_mode_enabled and hot_tier_size_used_gib fields to google_netapp_volume (#​24454)
• netapp: added hot_tier_size_gib, enable_hot_tier_auto_resize, cold_tier_size_used_gib and hot_tier_size_used_gib fields to google_netapp_storage_pool (#​24454)
• oracledatabase: added gcp_oracle_zone field to google_oracle_database_odb_network resource (#​24456)
• privilegedaccessmanager: added approval_workflow.steps.id field to google_privileged_access_manager_entitlement resource (#​24419)
• pubsub: added support for tags field to google_pubsub_topic and google_pubsub_subscription resources (#​24442)
• sql: added point_in_time_restore_context field to google_sql_database_instance (#​24489)
• storage: added force_destroy field to google_storage_insights_report_config resource (#​24462)
• storageinsights: added activity_data_retention_period_days field to google_storage_insights_dataset_config resource (#​24459)
• vertexai: added endpoint_config.private_service_connect_config block to google_vertex_ai_endpoint_with_model_garden_deployment resource (#​24425)
• vertexai: added encryption_spec.kms_key_name field to google_vertex_ai_index_endpoint resource (#​24490)
• vertexai: added encryption_spec.kms_key_name field to google_vertex_ai_index resource (#​24441)

BUG FIXES:

• apihub: fixed a permadiff on config_template in google_apihub_plugin resource (#​24429)
• storage: fixed a panic caused by empty cors blocks google_storage_bucket resource (#​24476)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.