diff --git a/3.x/_gen/data/automation_variables.libsonnet b/3.x/_gen/data/automation_variables.libsonnet
new file mode 100644
index 00000000..a829a516
--- /dev/null
+++ b/3.x/_gen/data/automation_variables.libsonnet
@@ -0,0 +1,63 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='automation_variables', url='', help='`automation_variables` represents the `azurerm_automation_variables` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`azurerm.data.automation_variables.new` injects a new `data_azurerm_automation_variables` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    azurerm.data.automation_variables.new('some_id')\n\nYou can get the reference to the `id` field of the created `azurerm.data.automation_variables` using the reference:\n\n    $._ref.data_azurerm_automation_variables.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_azurerm_automation_variables.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `automation_account_id` (`string`): Set the `automation_account_id` field on the resulting data source block.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting data source block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.data.automation_variables.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    automation_account_id,
+    timeouts=null,
+    _meta={}
+  ):: tf.withData(
+    type='azurerm_automation_variables',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(automation_account_id=automation_account_id, timeouts=timeouts),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`azurerm.data.automation_variables.newAttrs` constructs a new object with attributes and blocks configured for the `automation_variables`\nTerraform data source.\n\nUnlike [azurerm.data.automation_variables.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `automation_account_id` (`string`): Set the `automation_account_id` field on the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.data.automation_variables.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `automation_variables` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    automation_account_id,
+    timeouts=null
+  ):: std.prune(a={
+    automation_account_id: automation_account_id,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`azurerm.automation_variables.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `read` (`string`): Set the `read` field on the resulting object. When `null`, the `read` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      read=null
+    ):: std.prune(a={
+      read: read,
+    }),
+  },
+  '#withAutomationAccountId':: d.fn(help='`azurerm.string.withAutomationAccountId` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the automation_account_id field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `automation_account_id` field.\n', args=[]),
+  withAutomationAccountId(dataSrcLabel, value): {
+    data+: {
+      azurerm_automation_variables+: {
+        [dataSrcLabel]+: {
+          automation_account_id: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`azurerm.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform data source block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [azurerm.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(dataSrcLabel, value): {
+    data+: {
+      azurerm_automation_variables+: {
+        [dataSrcLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`azurerm.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform data source block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [azurerm.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(dataSrcLabel, value): {
+    data+: {
+      azurerm_automation_variables+: {
+        [dataSrcLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/3.x/_gen/data/main.libsonnet b/3.x/_gen/data/main.libsonnet
index 50ba38c6..877583a7 100644
--- a/3.x/_gen/data/main.libsonnet
+++ b/3.x/_gen/data/main.libsonnet
@@ -31,6 +31,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   automation_variable_datetime: (import 'automation_variable_datetime.libsonnet'),
   automation_variable_int: (import 'automation_variable_int.libsonnet'),
   automation_variable_string: (import 'automation_variable_string.libsonnet'),
+  automation_variables: (import 'automation_variables.libsonnet'),
   availability_set: (import 'availability_set.libsonnet'),
   backup_policy_file_share: (import 'backup_policy_file_share.libsonnet'),
   backup_policy_vm: (import 'backup_policy_vm.libsonnet'),
diff --git a/3.x/_gen/main.libsonnet b/3.x/_gen/main.libsonnet
index 32a11ca6..06796e9f 100644
--- a/3.x/_gen/main.libsonnet
+++ b/3.x/_gen/main.libsonnet
@@ -92,6 +92,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   arc_kubernetes_cluster_extension: (import 'resources/arc_kubernetes_cluster_extension.libsonnet'),
   arc_kubernetes_flux_configuration: (import 'resources/arc_kubernetes_flux_configuration.libsonnet'),
   arc_machine_extension: (import 'resources/arc_machine_extension.libsonnet'),
+  arc_private_link_scope: (import 'resources/arc_private_link_scope.libsonnet'),
   attestation_provider: (import 'resources/attestation_provider.libsonnet'),
   automanage_configuration: (import 'resources/automanage_configuration.libsonnet'),
   automation_account: (import 'resources/automation_account.libsonnet'),
@@ -434,6 +435,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   kusto_cluster_customer_managed_key: (import 'resources/kusto_cluster_customer_managed_key.libsonnet'),
   kusto_cluster_managed_private_endpoint: (import 'resources/kusto_cluster_managed_private_endpoint.libsonnet'),
   kusto_cluster_principal_assignment: (import 'resources/kusto_cluster_principal_assignment.libsonnet'),
+  kusto_cosmosdb_data_connection: (import 'resources/kusto_cosmosdb_data_connection.libsonnet'),
   kusto_database: (import 'resources/kusto_database.libsonnet'),
   kusto_database_principal_assignment: (import 'resources/kusto_database_principal_assignment.libsonnet'),
   kusto_eventgrid_data_connection: (import 'resources/kusto_eventgrid_data_connection.libsonnet'),
@@ -651,6 +653,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   orbital_contact_profile: (import 'resources/orbital_contact_profile.libsonnet'),
   orbital_spacecraft: (import 'resources/orbital_spacecraft.libsonnet'),
   orchestrated_virtual_machine_scale_set: (import 'resources/orchestrated_virtual_machine_scale_set.libsonnet'),
+  pim_active_role_assignment: (import 'resources/pim_active_role_assignment.libsonnet'),
+  pim_eligible_role_assignment: (import 'resources/pim_eligible_role_assignment.libsonnet'),
   point_to_site_vpn_gateway: (import 'resources/point_to_site_vpn_gateway.libsonnet'),
   policy_definition: (import 'resources/policy_definition.libsonnet'),
   policy_set_definition: (import 'resources/policy_set_definition.libsonnet'),
diff --git a/3.x/_gen/resources/arc_private_link_scope.libsonnet b/3.x/_gen/resources/arc_private_link_scope.libsonnet
new file mode 100644
index 00000000..4120ac9d
--- /dev/null
+++ b/3.x/_gen/resources/arc_private_link_scope.libsonnet
@@ -0,0 +1,128 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='arc_private_link_scope', url='', help='`arc_private_link_scope` represents the `azurerm_arc_private_link_scope` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`azurerm.arc_private_link_scope.new` injects a new `azurerm_arc_private_link_scope` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    azurerm.arc_private_link_scope.new('some_id')\n\nYou can get the reference to the `id` field of the created `azurerm.arc_private_link_scope` using the reference:\n\n    $._ref.azurerm_arc_private_link_scope.some_id.get('id')\n\nThis is the same as directly entering `\"${ azurerm_arc_private_link_scope.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `location` (`string`): Set the `location` field on the resulting resource block.\n  - `name` (`string`): Set the `name` field on the resulting resource block.\n  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting resource block. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.\n  - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting resource block.\n  - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.arc_private_link_scope.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    location,
+    name,
+    resource_group_name,
+    public_network_access_enabled=null,
+    tags=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='azurerm_arc_private_link_scope',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      location=location,
+      name=name,
+      public_network_access_enabled=public_network_access_enabled,
+      resource_group_name=resource_group_name,
+      tags=tags,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`azurerm.arc_private_link_scope.newAttrs` constructs a new object with attributes and blocks configured for the `arc_private_link_scope`\nTerraform resource.\n\nUnlike [azurerm.arc_private_link_scope.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): Set the `location` field on the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting object. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.\n  - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.arc_private_link_scope.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `arc_private_link_scope` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    location,
+    name,
+    resource_group_name,
+    public_network_access_enabled=null,
+    tags=null,
+    timeouts=null
+  ):: std.prune(a={
+    location: location,
+    name: name,
+    public_network_access_enabled: public_network_access_enabled,
+    resource_group_name: resource_group_name,
+    tags: tags,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`azurerm.arc_private_link_scope.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `read` (`string`): Set the `read` field on the resulting object. When `null`, the `read` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      read=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      read: read,
+      update: update,
+    }),
+  },
+  '#withLocation':: d.fn(help='`azurerm.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      azurerm_arc_private_link_scope+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`azurerm.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      azurerm_arc_private_link_scope+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withPublicNetworkAccessEnabled':: d.fn(help='`azurerm.bool.withPublicNetworkAccessEnabled` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the public_network_access_enabled field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `public_network_access_enabled` field.\n', args=[]),
+  withPublicNetworkAccessEnabled(resourceLabel, value): {
+    resource+: {
+      azurerm_arc_private_link_scope+: {
+        [resourceLabel]+: {
+          public_network_access_enabled: value,
+        },
+      },
+    },
+  },
+  '#withResourceGroupName':: d.fn(help='`azurerm.string.withResourceGroupName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the resource_group_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `resource_group_name` field.\n', args=[]),
+  withResourceGroupName(resourceLabel, value): {
+    resource+: {
+      azurerm_arc_private_link_scope+: {
+        [resourceLabel]+: {
+          resource_group_name: value,
+        },
+      },
+    },
+  },
+  '#withTags':: d.fn(help='`azurerm.obj.withTags` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the tags field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `tags` field.\n', args=[]),
+  withTags(resourceLabel, value): {
+    resource+: {
+      azurerm_arc_private_link_scope+: {
+        [resourceLabel]+: {
+          tags: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`azurerm.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [azurerm.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      azurerm_arc_private_link_scope+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`azurerm.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [azurerm.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      azurerm_arc_private_link_scope+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/3.x/_gen/resources/attestation_provider.libsonnet b/3.x/_gen/resources/attestation_provider.libsonnet
index 091d8de5..a642f838 100644
--- a/3.x/_gen/resources/attestation_provider.libsonnet
+++ b/3.x/_gen/resources/attestation_provider.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='attestation_provider', url='', help='`attestation_provider` represents the `azurerm_attestation_provider` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`azurerm.attestation_provider.new` injects a new `azurerm_attestation_provider` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    azurerm.attestation_provider.new('some_id')\n\nYou can get the reference to the `id` field of the created `azurerm.attestation_provider` using the reference:\n\n    $._ref.azurerm_attestation_provider.some_id.get('id')\n\nThis is the same as directly entering `\"${ azurerm_attestation_provider.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `location` (`string`): Set the `location` field on the resulting resource block.\n  - `name` (`string`): Set the `name` field on the resulting resource block.\n  - `open_enclave_policy_base64` (`string`): Set the `open_enclave_policy_base64` field on the resulting resource block. When `null`, the `open_enclave_policy_base64` field will be omitted from the resulting object.\n  - `policy_signing_certificate_data` (`string`): Set the `policy_signing_certificate_data` field on the resulting resource block. When `null`, the `policy_signing_certificate_data` field will be omitted from the resulting object.\n  - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting resource block.\n  - `sgx_enclave_policy_base64` (`string`): Set the `sgx_enclave_policy_base64` field on the resulting resource block. When `null`, the `sgx_enclave_policy_base64` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.\n  - `tpm_policy_base64` (`string`): Set the `tpm_policy_base64` field on the resulting resource block. When `null`, the `tpm_policy_base64` field will be omitted from the resulting object.\n  - `policy` (`list[obj]`): Set the `policy` field on the resulting resource block. When `null`, the `policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.attestation_provider.policy.new](#fn-policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.attestation_provider.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`azurerm.attestation_provider.new` injects a new `azurerm_attestation_provider` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    azurerm.attestation_provider.new('some_id')\n\nYou can get the reference to the `id` field of the created `azurerm.attestation_provider` using the reference:\n\n    $._ref.azurerm_attestation_provider.some_id.get('id')\n\nThis is the same as directly entering `\"${ azurerm_attestation_provider.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `location` (`string`): Set the `location` field on the resulting resource block.\n  - `name` (`string`): Set the `name` field on the resulting resource block.\n  - `open_enclave_policy_base64` (`string`): Set the `open_enclave_policy_base64` field on the resulting resource block. When `null`, the `open_enclave_policy_base64` field will be omitted from the resulting object.\n  - `policy_signing_certificate_data` (`string`): Set the `policy_signing_certificate_data` field on the resulting resource block. When `null`, the `policy_signing_certificate_data` field will be omitted from the resulting object.\n  - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting resource block.\n  - `sev_snp_policy_base64` (`string`): Set the `sev_snp_policy_base64` field on the resulting resource block. When `null`, the `sev_snp_policy_base64` field will be omitted from the resulting object.\n  - `sgx_enclave_policy_base64` (`string`): Set the `sgx_enclave_policy_base64` field on the resulting resource block. When `null`, the `sgx_enclave_policy_base64` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.\n  - `tpm_policy_base64` (`string`): Set the `tpm_policy_base64` field on the resulting resource block. When `null`, the `tpm_policy_base64` field will be omitted from the resulting object.\n  - `policy` (`list[obj]`): Set the `policy` field on the resulting resource block. When `null`, the `policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.attestation_provider.policy.new](#fn-policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.attestation_provider.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -11,6 +11,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     open_enclave_policy_base64=null,
     policy=null,
     policy_signing_certificate_data=null,
+    sev_snp_policy_base64=null,
     sgx_enclave_policy_base64=null,
     tags=null,
     timeouts=null,
@@ -26,6 +27,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       policy=policy,
       policy_signing_certificate_data=policy_signing_certificate_data,
       resource_group_name=resource_group_name,
+      sev_snp_policy_base64=sev_snp_policy_base64,
       sgx_enclave_policy_base64=sgx_enclave_policy_base64,
       tags=tags,
       timeouts=timeouts,
@@ -33,7 +35,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`azurerm.attestation_provider.newAttrs` constructs a new object with attributes and blocks configured for the `attestation_provider`\nTerraform resource.\n\nUnlike [azurerm.attestation_provider.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): Set the `location` field on the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `open_enclave_policy_base64` (`string`): Set the `open_enclave_policy_base64` field on the resulting object. When `null`, the `open_enclave_policy_base64` field will be omitted from the resulting object.\n  - `policy_signing_certificate_data` (`string`): Set the `policy_signing_certificate_data` field on the resulting object. When `null`, the `policy_signing_certificate_data` field will be omitted from the resulting object.\n  - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting object.\n  - `sgx_enclave_policy_base64` (`string`): Set the `sgx_enclave_policy_base64` field on the resulting object. When `null`, the `sgx_enclave_policy_base64` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.\n  - `tpm_policy_base64` (`string`): Set the `tpm_policy_base64` field on the resulting object. When `null`, the `tpm_policy_base64` field will be omitted from the resulting object.\n  - `policy` (`list[obj]`): Set the `policy` field on the resulting object. When `null`, the `policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.attestation_provider.policy.new](#fn-policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.attestation_provider.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `attestation_provider` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`azurerm.attestation_provider.newAttrs` constructs a new object with attributes and blocks configured for the `attestation_provider`\nTerraform resource.\n\nUnlike [azurerm.attestation_provider.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): Set the `location` field on the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `open_enclave_policy_base64` (`string`): Set the `open_enclave_policy_base64` field on the resulting object. When `null`, the `open_enclave_policy_base64` field will be omitted from the resulting object.\n  - `policy_signing_certificate_data` (`string`): Set the `policy_signing_certificate_data` field on the resulting object. When `null`, the `policy_signing_certificate_data` field will be omitted from the resulting object.\n  - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting object.\n  - `sev_snp_policy_base64` (`string`): Set the `sev_snp_policy_base64` field on the resulting object. When `null`, the `sev_snp_policy_base64` field will be omitted from the resulting object.\n  - `sgx_enclave_policy_base64` (`string`): Set the `sgx_enclave_policy_base64` field on the resulting object. When `null`, the `sgx_enclave_policy_base64` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.\n  - `tpm_policy_base64` (`string`): Set the `tpm_policy_base64` field on the resulting object. When `null`, the `tpm_policy_base64` field will be omitted from the resulting object.\n  - `policy` (`list[obj]`): Set the `policy` field on the resulting object. When `null`, the `policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.attestation_provider.policy.new](#fn-policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.attestation_provider.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `attestation_provider` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
@@ -41,6 +43,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     open_enclave_policy_base64=null,
     policy=null,
     policy_signing_certificate_data=null,
+    sev_snp_policy_base64=null,
     sgx_enclave_policy_base64=null,
     tags=null,
     timeouts=null,
@@ -52,6 +55,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     policy: policy,
     policy_signing_certificate_data: policy_signing_certificate_data,
     resource_group_name: resource_group_name,
+    sev_snp_policy_base64: sev_snp_policy_base64,
     sgx_enclave_policy_base64: sgx_enclave_policy_base64,
     tags: tags,
     timeouts: timeouts,
@@ -151,6 +155,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withSevSnpPolicyBase64':: d.fn(help='`azurerm.string.withSevSnpPolicyBase64` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the sev_snp_policy_base64 field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `sev_snp_policy_base64` field.\n', args=[]),
+  withSevSnpPolicyBase64(resourceLabel, value): {
+    resource+: {
+      azurerm_attestation_provider+: {
+        [resourceLabel]+: {
+          sev_snp_policy_base64: value,
+        },
+      },
+    },
+  },
   '#withSgxEnclavePolicyBase64':: d.fn(help='`azurerm.string.withSgxEnclavePolicyBase64` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the sgx_enclave_policy_base64 field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `sgx_enclave_policy_base64` field.\n', args=[]),
   withSgxEnclavePolicyBase64(resourceLabel, value): {
     resource+: {
diff --git a/3.x/_gen/resources/cognitive_deployment.libsonnet b/3.x/_gen/resources/cognitive_deployment.libsonnet
index a0288ef6..4dec7990 100644
--- a/3.x/_gen/resources/cognitive_deployment.libsonnet
+++ b/3.x/_gen/resources/cognitive_deployment.libsonnet
@@ -54,10 +54,18 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     timeouts: timeouts,
   }),
   scale:: {
-    '#new':: d.fn(help='\n`azurerm.cognitive_deployment.scale.new` constructs a new object with attributes and blocks configured for the `scale`\nTerraform sub block.\n\n\n\n**Args**:\n  - `type` (`string`): Set the `type` field on the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `scale` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`azurerm.cognitive_deployment.scale.new` constructs a new object with attributes and blocks configured for the `scale`\nTerraform sub block.\n\n\n\n**Args**:\n  - `capacity` (`number`): Set the `capacity` field on the resulting object. When `null`, the `capacity` field will be omitted from the resulting object.\n  - `family` (`string`): Set the `family` field on the resulting object. When `null`, the `family` field will be omitted from the resulting object.\n  - `size` (`string`): Set the `size` field on the resulting object. When `null`, the `size` field will be omitted from the resulting object.\n  - `tier` (`string`): Set the `tier` field on the resulting object. When `null`, the `tier` field will be omitted from the resulting object.\n  - `type` (`string`): Set the `type` field on the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `scale` sub block.\n', args=[]),
     new(
-      type
+      type,
+      capacity=null,
+      family=null,
+      size=null,
+      tier=null
     ):: std.prune(a={
+      capacity: capacity,
+      family: family,
+      size: size,
+      tier: tier,
       type: type,
     }),
   },
diff --git a/3.x/_gen/resources/kusto_cosmosdb_data_connection.libsonnet b/3.x/_gen/resources/kusto_cosmosdb_data_connection.libsonnet
new file mode 100644
index 00000000..f9fe585c
--- /dev/null
+++ b/3.x/_gen/resources/kusto_cosmosdb_data_connection.libsonnet
@@ -0,0 +1,168 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='kusto_cosmosdb_data_connection', url='', help='`kusto_cosmosdb_data_connection` represents the `azurerm_kusto_cosmosdb_data_connection` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`azurerm.kusto_cosmosdb_data_connection.new` injects a new `azurerm_kusto_cosmosdb_data_connection` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    azurerm.kusto_cosmosdb_data_connection.new('some_id')\n\nYou can get the reference to the `id` field of the created `azurerm.kusto_cosmosdb_data_connection` using the reference:\n\n    $._ref.azurerm_kusto_cosmosdb_data_connection.some_id.get('id')\n\nThis is the same as directly entering `\"${ azurerm_kusto_cosmosdb_data_connection.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `cosmosdb_container_id` (`string`): Set the `cosmosdb_container_id` field on the resulting resource block.\n  - `kusto_database_id` (`string`): Set the `kusto_database_id` field on the resulting resource block.\n  - `location` (`string`): Set the `location` field on the resulting resource block.\n  - `managed_identity_id` (`string`): Set the `managed_identity_id` field on the resulting resource block.\n  - `mapping_rule_name` (`string`): Set the `mapping_rule_name` field on the resulting resource block. When `null`, the `mapping_rule_name` field will be omitted from the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting resource block.\n  - `retrieval_start_date` (`string`): Set the `retrieval_start_date` field on the resulting resource block. When `null`, the `retrieval_start_date` field will be omitted from the resulting object.\n  - `table_name` (`string`): Set the `table_name` field on the resulting resource block.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.kusto_cosmosdb_data_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    cosmosdb_container_id,
+    kusto_database_id,
+    location,
+    managed_identity_id,
+    name,
+    table_name,
+    mapping_rule_name=null,
+    retrieval_start_date=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='azurerm_kusto_cosmosdb_data_connection',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      cosmosdb_container_id=cosmosdb_container_id,
+      kusto_database_id=kusto_database_id,
+      location=location,
+      managed_identity_id=managed_identity_id,
+      mapping_rule_name=mapping_rule_name,
+      name=name,
+      retrieval_start_date=retrieval_start_date,
+      table_name=table_name,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`azurerm.kusto_cosmosdb_data_connection.newAttrs` constructs a new object with attributes and blocks configured for the `kusto_cosmosdb_data_connection`\nTerraform resource.\n\nUnlike [azurerm.kusto_cosmosdb_data_connection.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `cosmosdb_container_id` (`string`): Set the `cosmosdb_container_id` field on the resulting object.\n  - `kusto_database_id` (`string`): Set the `kusto_database_id` field on the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting object.\n  - `managed_identity_id` (`string`): Set the `managed_identity_id` field on the resulting object.\n  - `mapping_rule_name` (`string`): Set the `mapping_rule_name` field on the resulting object. When `null`, the `mapping_rule_name` field will be omitted from the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `retrieval_start_date` (`string`): Set the `retrieval_start_date` field on the resulting object. When `null`, the `retrieval_start_date` field will be omitted from the resulting object.\n  - `table_name` (`string`): Set the `table_name` field on the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.kusto_cosmosdb_data_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `kusto_cosmosdb_data_connection` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    cosmosdb_container_id,
+    kusto_database_id,
+    location,
+    managed_identity_id,
+    name,
+    table_name,
+    mapping_rule_name=null,
+    retrieval_start_date=null,
+    timeouts=null
+  ):: std.prune(a={
+    cosmosdb_container_id: cosmosdb_container_id,
+    kusto_database_id: kusto_database_id,
+    location: location,
+    managed_identity_id: managed_identity_id,
+    mapping_rule_name: mapping_rule_name,
+    name: name,
+    retrieval_start_date: retrieval_start_date,
+    table_name: table_name,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`azurerm.kusto_cosmosdb_data_connection.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `read` (`string`): Set the `read` field on the resulting object. When `null`, the `read` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      read=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      read: read,
+    }),
+  },
+  '#withCosmosdbContainerId':: d.fn(help='`azurerm.string.withCosmosdbContainerId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the cosmosdb_container_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `cosmosdb_container_id` field.\n', args=[]),
+  withCosmosdbContainerId(resourceLabel, value): {
+    resource+: {
+      azurerm_kusto_cosmosdb_data_connection+: {
+        [resourceLabel]+: {
+          cosmosdb_container_id: value,
+        },
+      },
+    },
+  },
+  '#withKustoDatabaseId':: d.fn(help='`azurerm.string.withKustoDatabaseId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the kusto_database_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `kusto_database_id` field.\n', args=[]),
+  withKustoDatabaseId(resourceLabel, value): {
+    resource+: {
+      azurerm_kusto_cosmosdb_data_connection+: {
+        [resourceLabel]+: {
+          kusto_database_id: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`azurerm.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      azurerm_kusto_cosmosdb_data_connection+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withManagedIdentityId':: d.fn(help='`azurerm.string.withManagedIdentityId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the managed_identity_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `managed_identity_id` field.\n', args=[]),
+  withManagedIdentityId(resourceLabel, value): {
+    resource+: {
+      azurerm_kusto_cosmosdb_data_connection+: {
+        [resourceLabel]+: {
+          managed_identity_id: value,
+        },
+      },
+    },
+  },
+  '#withMappingRuleName':: d.fn(help='`azurerm.string.withMappingRuleName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the mapping_rule_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `mapping_rule_name` field.\n', args=[]),
+  withMappingRuleName(resourceLabel, value): {
+    resource+: {
+      azurerm_kusto_cosmosdb_data_connection+: {
+        [resourceLabel]+: {
+          mapping_rule_name: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`azurerm.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      azurerm_kusto_cosmosdb_data_connection+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withRetrievalStartDate':: d.fn(help='`azurerm.string.withRetrievalStartDate` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the retrieval_start_date field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `retrieval_start_date` field.\n', args=[]),
+  withRetrievalStartDate(resourceLabel, value): {
+    resource+: {
+      azurerm_kusto_cosmosdb_data_connection+: {
+        [resourceLabel]+: {
+          retrieval_start_date: value,
+        },
+      },
+    },
+  },
+  '#withTableName':: d.fn(help='`azurerm.string.withTableName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the table_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `table_name` field.\n', args=[]),
+  withTableName(resourceLabel, value): {
+    resource+: {
+      azurerm_kusto_cosmosdb_data_connection+: {
+        [resourceLabel]+: {
+          table_name: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`azurerm.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [azurerm.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      azurerm_kusto_cosmosdb_data_connection+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`azurerm.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [azurerm.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      azurerm_kusto_cosmosdb_data_connection+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/3.x/_gen/resources/linux_function_app.libsonnet b/3.x/_gen/resources/linux_function_app.libsonnet
index 2b95141a..cbcb1a97 100644
--- a/3.x/_gen/resources/linux_function_app.libsonnet
+++ b/3.x/_gen/resources/linux_function_app.libsonnet
@@ -378,7 +378,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       type: type,
     }),
   },
-  '#new':: d.fn(help="\n`azurerm.linux_function_app.new` injects a new `azurerm_linux_function_app` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    azurerm.linux_function_app.new('some_id')\n\nYou can get the reference to the `id` field of the created `azurerm.linux_function_app` using the reference:\n\n    $._ref.azurerm_linux_function_app.some_id.get('id')\n\nThis is the same as directly entering `\"${ azurerm_linux_function_app.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `app_settings` (`obj`): A map of key-value pairs for [App Settings](https://docs.microsoft.com/en-us/azure/azure-functions/functions-app-settings) and custom values. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `builtin_logging_enabled` (`bool`): Should built in logging be enabled. Configures `AzureWebJobsDashboard` app setting based on the configured storage setting When `null`, the `builtin_logging_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Should the function app use Client Certificates When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): The mode of the Function App\u0026#39;s client certificates requirement for incoming requests. Possible values are `Required`, `Optional`, and `OptionalInteractiveUser`  When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `content_share_force_disabled` (`bool`): Force disable the content share settings. When `null`, the `content_share_force_disabled` field will be omitted from the resulting object.\n  - `daily_memory_time_quota` (`number`): The amount of memory in gigabyte-seconds that your application is allowed to consume per day. Setting this value only affects function apps in Consumption Plans. When `null`, the `daily_memory_time_quota` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Is the Linux Function App enabled. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `functions_extension_version` (`string`): The runtime version associated with the Function App. When `null`, the `functions_extension_version` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Can the Function App only be accessed via HTTPS? When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): The User Assigned Identity to use for Key Vault access. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting resource block.\n  - `name` (`string`): Specifies the name of the Function App.\n  - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting resource block.\n  - `service_plan_id` (`string`): The ID of the App Service Plan within which to create this Function App\n  - `storage_account_access_key` (`string`): The access key which will be used to access the storage account for the Function App. When `null`, the `storage_account_access_key` field will be omitted from the resulting object.\n  - `storage_account_name` (`string`): The backend storage account name which will be used by this Function App. When `null`, the `storage_account_name` field will be omitted from the resulting object.\n  - `storage_key_vault_secret_id` (`string`): The Key Vault Secret ID, including version, that contains the Connection String to connect to the storage account for this Function App. When `null`, the `storage_key_vault_secret_id` field will be omitted from the resulting object.\n  - `storage_uses_managed_identity` (`bool`): Should the Function App use its Managed Identity to access storage? When `null`, the `storage_uses_managed_identity` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting resource block. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `zip_deploy_file` (`string`): The local path and filename of the Zip packaged application to deploy to this Linux Function App. **Note:** Using this value requires either `WEBSITE_RUN_FROM_PACKAGE=1` or `SCM_DO_BUILD_DURING_DEPLOYMENT=true` to be set on the App in `app_settings`. When `null`, the `zip_deploy_file` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting resource block. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting resource block. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting resource block. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting resource block. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting resource block. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.identity.new](#fn-identitynew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting resource block. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.site_config.new](#fn-site_confignew) constructor.\n  - `sticky_settings` (`list[obj]`): Set the `sticky_settings` field on the resulting resource block. When `null`, the `sticky_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.sticky_settings.new](#fn-sticky_settingsnew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting resource block. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`azurerm.linux_function_app.new` injects a new `azurerm_linux_function_app` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    azurerm.linux_function_app.new('some_id')\n\nYou can get the reference to the `id` field of the created `azurerm.linux_function_app` using the reference:\n\n    $._ref.azurerm_linux_function_app.some_id.get('id')\n\nThis is the same as directly entering `\"${ azurerm_linux_function_app.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `app_settings` (`obj`): A map of key-value pairs for [App Settings](https://docs.microsoft.com/en-us/azure/azure-functions/functions-app-settings) and custom values. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `builtin_logging_enabled` (`bool`): Should built in logging be enabled. Configures `AzureWebJobsDashboard` app setting based on the configured storage setting When `null`, the `builtin_logging_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Should the function app use Client Certificates When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): The mode of the Function App\u0026#39;s client certificates requirement for incoming requests. Possible values are `Required`, `Optional`, and `OptionalInteractiveUser`  When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `content_share_force_disabled` (`bool`): Force disable the content share settings. When `null`, the `content_share_force_disabled` field will be omitted from the resulting object.\n  - `daily_memory_time_quota` (`number`): The amount of memory in gigabyte-seconds that your application is allowed to consume per day. Setting this value only affects function apps in Consumption Plans. When `null`, the `daily_memory_time_quota` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Is the Linux Function App enabled. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `functions_extension_version` (`string`): The runtime version associated with the Function App. When `null`, the `functions_extension_version` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Can the Function App only be accessed via HTTPS? When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): The User Assigned Identity to use for Key Vault access. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting resource block.\n  - `name` (`string`): Specifies the name of the Function App.\n  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting resource block. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.\n  - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting resource block.\n  - `service_plan_id` (`string`): The ID of the App Service Plan within which to create this Function App\n  - `storage_account_access_key` (`string`): The access key which will be used to access the storage account for the Function App. When `null`, the `storage_account_access_key` field will be omitted from the resulting object.\n  - `storage_account_name` (`string`): The backend storage account name which will be used by this Function App. When `null`, the `storage_account_name` field will be omitted from the resulting object.\n  - `storage_key_vault_secret_id` (`string`): The Key Vault Secret ID, including version, that contains the Connection String to connect to the storage account for this Function App. When `null`, the `storage_key_vault_secret_id` field will be omitted from the resulting object.\n  - `storage_uses_managed_identity` (`bool`): Should the Function App use its Managed Identity to access storage? When `null`, the `storage_uses_managed_identity` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting resource block. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `zip_deploy_file` (`string`): The local path and filename of the Zip packaged application to deploy to this Linux Function App. **Note:** Using this value requires either `WEBSITE_RUN_FROM_PACKAGE=1` or `SCM_DO_BUILD_DURING_DEPLOYMENT=true` to be set on the App in `app_settings`. When `null`, the `zip_deploy_file` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting resource block. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting resource block. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting resource block. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting resource block. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting resource block. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.identity.new](#fn-identitynew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting resource block. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.site_config.new](#fn-site_confignew) constructor.\n  - `sticky_settings` (`list[obj]`): Set the `sticky_settings` field on the resulting resource block. When `null`, the `sticky_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.sticky_settings.new](#fn-sticky_settingsnew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting resource block. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -401,6 +401,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     https_only=null,
     identity=null,
     key_vault_reference_identity_id=null,
+    public_network_access_enabled=null,
     site_config=null,
     sticky_settings=null,
     storage_account=null,
@@ -435,6 +436,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       key_vault_reference_identity_id=key_vault_reference_identity_id,
       location=location,
       name=name,
+      public_network_access_enabled=public_network_access_enabled,
       resource_group_name=resource_group_name,
       service_plan_id=service_plan_id,
       site_config=site_config,
@@ -451,7 +453,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`azurerm.linux_function_app.newAttrs` constructs a new object with attributes and blocks configured for the `linux_function_app`\nTerraform resource.\n\nUnlike [azurerm.linux_function_app.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `app_settings` (`obj`): A map of key-value pairs for [App Settings](https://docs.microsoft.com/en-us/azure/azure-functions/functions-app-settings) and custom values. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `builtin_logging_enabled` (`bool`): Should built in logging be enabled. Configures `AzureWebJobsDashboard` app setting based on the configured storage setting When `null`, the `builtin_logging_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Should the function app use Client Certificates When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): The mode of the Function App's client certificates requirement for incoming requests. Possible values are `Required`, `Optional`, and `OptionalInteractiveUser`  When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `content_share_force_disabled` (`bool`): Force disable the content share settings. When `null`, the `content_share_force_disabled` field will be omitted from the resulting object.\n  - `daily_memory_time_quota` (`number`): The amount of memory in gigabyte-seconds that your application is allowed to consume per day. Setting this value only affects function apps in Consumption Plans. When `null`, the `daily_memory_time_quota` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Is the Linux Function App enabled. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `functions_extension_version` (`string`): The runtime version associated with the Function App. When `null`, the `functions_extension_version` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Can the Function App only be accessed via HTTPS? When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): The User Assigned Identity to use for Key Vault access. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting object.\n  - `name` (`string`): Specifies the name of the Function App.\n  - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting object.\n  - `service_plan_id` (`string`): The ID of the App Service Plan within which to create this Function App\n  - `storage_account_access_key` (`string`): The access key which will be used to access the storage account for the Function App. When `null`, the `storage_account_access_key` field will be omitted from the resulting object.\n  - `storage_account_name` (`string`): The backend storage account name which will be used by this Function App. When `null`, the `storage_account_name` field will be omitted from the resulting object.\n  - `storage_key_vault_secret_id` (`string`): The Key Vault Secret ID, including version, that contains the Connection String to connect to the storage account for this Function App. When `null`, the `storage_key_vault_secret_id` field will be omitted from the resulting object.\n  - `storage_uses_managed_identity` (`bool`): Should the Function App use its Managed Identity to access storage? When `null`, the `storage_uses_managed_identity` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting object. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `zip_deploy_file` (`string`): The local path and filename of the Zip packaged application to deploy to this Linux Function App. **Note:** Using this value requires either `WEBSITE_RUN_FROM_PACKAGE=1` or `SCM_DO_BUILD_DURING_DEPLOYMENT=true` to be set on the App in `app_settings`. When `null`, the `zip_deploy_file` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting object. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting object. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting object. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting object. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting object. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.identity.new](#fn-identitynew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting object. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.site_config.new](#fn-site_confignew) constructor.\n  - `sticky_settings` (`list[obj]`): Set the `sticky_settings` field on the resulting object. When `null`, the `sticky_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.sticky_settings.new](#fn-sticky_settingsnew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting object. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `linux_function_app` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`azurerm.linux_function_app.newAttrs` constructs a new object with attributes and blocks configured for the `linux_function_app`\nTerraform resource.\n\nUnlike [azurerm.linux_function_app.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `app_settings` (`obj`): A map of key-value pairs for [App Settings](https://docs.microsoft.com/en-us/azure/azure-functions/functions-app-settings) and custom values. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `builtin_logging_enabled` (`bool`): Should built in logging be enabled. Configures `AzureWebJobsDashboard` app setting based on the configured storage setting When `null`, the `builtin_logging_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Should the function app use Client Certificates When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): The mode of the Function App's client certificates requirement for incoming requests. Possible values are `Required`, `Optional`, and `OptionalInteractiveUser`  When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `content_share_force_disabled` (`bool`): Force disable the content share settings. When `null`, the `content_share_force_disabled` field will be omitted from the resulting object.\n  - `daily_memory_time_quota` (`number`): The amount of memory in gigabyte-seconds that your application is allowed to consume per day. Setting this value only affects function apps in Consumption Plans. When `null`, the `daily_memory_time_quota` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Is the Linux Function App enabled. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `functions_extension_version` (`string`): The runtime version associated with the Function App. When `null`, the `functions_extension_version` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Can the Function App only be accessed via HTTPS? When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): The User Assigned Identity to use for Key Vault access. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting object.\n  - `name` (`string`): Specifies the name of the Function App.\n  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting object. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.\n  - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting object.\n  - `service_plan_id` (`string`): The ID of the App Service Plan within which to create this Function App\n  - `storage_account_access_key` (`string`): The access key which will be used to access the storage account for the Function App. When `null`, the `storage_account_access_key` field will be omitted from the resulting object.\n  - `storage_account_name` (`string`): The backend storage account name which will be used by this Function App. When `null`, the `storage_account_name` field will be omitted from the resulting object.\n  - `storage_key_vault_secret_id` (`string`): The Key Vault Secret ID, including version, that contains the Connection String to connect to the storage account for this Function App. When `null`, the `storage_key_vault_secret_id` field will be omitted from the resulting object.\n  - `storage_uses_managed_identity` (`bool`): Should the Function App use its Managed Identity to access storage? When `null`, the `storage_uses_managed_identity` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting object. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `zip_deploy_file` (`string`): The local path and filename of the Zip packaged application to deploy to this Linux Function App. **Note:** Using this value requires either `WEBSITE_RUN_FROM_PACKAGE=1` or `SCM_DO_BUILD_DURING_DEPLOYMENT=true` to be set on the App in `app_settings`. When `null`, the `zip_deploy_file` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting object. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting object. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting object. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting object. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting object. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.identity.new](#fn-identitynew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting object. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.site_config.new](#fn-site_confignew) constructor.\n  - `sticky_settings` (`list[obj]`): Set the `sticky_settings` field on the resulting object. When `null`, the `sticky_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.sticky_settings.new](#fn-sticky_settingsnew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting object. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `linux_function_app` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
@@ -473,6 +475,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     https_only=null,
     identity=null,
     key_vault_reference_identity_id=null,
+    public_network_access_enabled=null,
     site_config=null,
     sticky_settings=null,
     storage_account=null,
@@ -503,6 +506,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     key_vault_reference_identity_id: key_vault_reference_identity_id,
     location: location,
     name: name,
+    public_network_access_enabled: public_network_access_enabled,
     resource_group_name: resource_group_name,
     service_plan_id: service_plan_id,
     site_config: site_config,
@@ -959,6 +963,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withPublicNetworkAccessEnabled':: d.fn(help='`azurerm.bool.withPublicNetworkAccessEnabled` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the public_network_access_enabled field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `public_network_access_enabled` field.\n', args=[]),
+  withPublicNetworkAccessEnabled(resourceLabel, value): {
+    resource+: {
+      azurerm_linux_function_app+: {
+        [resourceLabel]+: {
+          public_network_access_enabled: value,
+        },
+      },
+    },
+  },
   '#withResourceGroupName':: d.fn(help='`azurerm.string.withResourceGroupName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the resource_group_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `resource_group_name` field.\n', args=[]),
   withResourceGroupName(resourceLabel, value): {
     resource+: {
diff --git a/3.x/_gen/resources/linux_function_app_slot.libsonnet b/3.x/_gen/resources/linux_function_app_slot.libsonnet
index 0eff8580..5baed239 100644
--- a/3.x/_gen/resources/linux_function_app_slot.libsonnet
+++ b/3.x/_gen/resources/linux_function_app_slot.libsonnet
@@ -378,7 +378,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       type: type,
     }),
   },
-  '#new':: d.fn(help="\n`azurerm.linux_function_app_slot.new` injects a new `azurerm_linux_function_app_slot` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    azurerm.linux_function_app_slot.new('some_id')\n\nYou can get the reference to the `id` field of the created `azurerm.linux_function_app_slot` using the reference:\n\n    $._ref.azurerm_linux_function_app_slot.some_id.get('id')\n\nThis is the same as directly entering `\"${ azurerm_linux_function_app_slot.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `app_settings` (`obj`): A map of key-value pairs for [App Settings](https://docs.microsoft.com/en-us/azure/azure-functions/functions-app-settings) and custom values. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `builtin_logging_enabled` (`bool`): Should built in logging be enabled. Configures `AzureWebJobsDashboard` app setting based on the configured storage setting. When `null`, the `builtin_logging_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Should the Function App Slot use Client Certificates. When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): The mode of the Function App Slot\u0026#39;s client certificates requirement for incoming requests. Possible values are `Required`, `Optional`, and `OptionalInteractiveUser`. When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `content_share_force_disabled` (`bool`): Force disable the content share settings. When `null`, the `content_share_force_disabled` field will be omitted from the resulting object.\n  - `daily_memory_time_quota` (`number`): The amount of memory in gigabyte-seconds that your application is allowed to consume per day. Setting this value only affects function apps in Consumption Plans. When `null`, the `daily_memory_time_quota` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Is the Linux Function App Slot enabled. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `function_app_id` (`string`): The ID of the Linux Function App this Slot is a member of.\n  - `functions_extension_version` (`string`): The runtime version associated with the Function App Slot. When `null`, the `functions_extension_version` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Can the Function App Slot only be accessed via HTTPS? When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): The User Assigned Identity to use for Key Vault access. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `name` (`string`): Specifies the name of the Function App Slot.\n  - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting resource block. When `null`, the `service_plan_id` field will be omitted from the resulting object.\n  - `storage_account_access_key` (`string`): The access key which will be used to access the storage account for the Function App Slot. When `null`, the `storage_account_access_key` field will be omitted from the resulting object.\n  - `storage_account_name` (`string`): The backend storage account name which will be used by this Function App Slot. When `null`, the `storage_account_name` field will be omitted from the resulting object.\n  - `storage_key_vault_secret_id` (`string`): The Key Vault Secret ID, including version, that contains the Connection String to connect to the storage account for this Function App. When `null`, the `storage_key_vault_secret_id` field will be omitted from the resulting object.\n  - `storage_uses_managed_identity` (`bool`): Should the Function App Slot use its Managed Identity to access storage? When `null`, the `storage_uses_managed_identity` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting resource block. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting resource block. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting resource block. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting resource block. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting resource block. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting resource block. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.identity.new](#fn-identitynew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting resource block. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.site_config.new](#fn-site_confignew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting resource block. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`azurerm.linux_function_app_slot.new` injects a new `azurerm_linux_function_app_slot` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    azurerm.linux_function_app_slot.new('some_id')\n\nYou can get the reference to the `id` field of the created `azurerm.linux_function_app_slot` using the reference:\n\n    $._ref.azurerm_linux_function_app_slot.some_id.get('id')\n\nThis is the same as directly entering `\"${ azurerm_linux_function_app_slot.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `app_settings` (`obj`): A map of key-value pairs for [App Settings](https://docs.microsoft.com/en-us/azure/azure-functions/functions-app-settings) and custom values. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `builtin_logging_enabled` (`bool`): Should built in logging be enabled. Configures `AzureWebJobsDashboard` app setting based on the configured storage setting. When `null`, the `builtin_logging_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Should the Function App Slot use Client Certificates. When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): The mode of the Function App Slot\u0026#39;s client certificates requirement for incoming requests. Possible values are `Required`, `Optional`, and `OptionalInteractiveUser`. When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `content_share_force_disabled` (`bool`): Force disable the content share settings. When `null`, the `content_share_force_disabled` field will be omitted from the resulting object.\n  - `daily_memory_time_quota` (`number`): The amount of memory in gigabyte-seconds that your application is allowed to consume per day. Setting this value only affects function apps in Consumption Plans. When `null`, the `daily_memory_time_quota` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Is the Linux Function App Slot enabled. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `function_app_id` (`string`): The ID of the Linux Function App this Slot is a member of.\n  - `functions_extension_version` (`string`): The runtime version associated with the Function App Slot. When `null`, the `functions_extension_version` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Can the Function App Slot only be accessed via HTTPS? When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): The User Assigned Identity to use for Key Vault access. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `name` (`string`): Specifies the name of the Function App Slot.\n  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting resource block. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.\n  - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting resource block. When `null`, the `service_plan_id` field will be omitted from the resulting object.\n  - `storage_account_access_key` (`string`): The access key which will be used to access the storage account for the Function App Slot. When `null`, the `storage_account_access_key` field will be omitted from the resulting object.\n  - `storage_account_name` (`string`): The backend storage account name which will be used by this Function App Slot. When `null`, the `storage_account_name` field will be omitted from the resulting object.\n  - `storage_key_vault_secret_id` (`string`): The Key Vault Secret ID, including version, that contains the Connection String to connect to the storage account for this Function App. When `null`, the `storage_key_vault_secret_id` field will be omitted from the resulting object.\n  - `storage_uses_managed_identity` (`bool`): Should the Function App Slot use its Managed Identity to access storage? When `null`, the `storage_uses_managed_identity` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting resource block. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting resource block. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting resource block. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting resource block. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting resource block. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting resource block. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.identity.new](#fn-identitynew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting resource block. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.site_config.new](#fn-site_confignew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting resource block. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     function_app_id,
@@ -399,6 +399,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     https_only=null,
     identity=null,
     key_vault_reference_identity_id=null,
+    public_network_access_enabled=null,
     service_plan_id=null,
     site_config=null,
     storage_account=null,
@@ -432,6 +433,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       identity=identity,
       key_vault_reference_identity_id=key_vault_reference_identity_id,
       name=name,
+      public_network_access_enabled=public_network_access_enabled,
       service_plan_id=service_plan_id,
       site_config=site_config,
       storage_account=storage_account,
@@ -445,7 +447,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`azurerm.linux_function_app_slot.newAttrs` constructs a new object with attributes and blocks configured for the `linux_function_app_slot`\nTerraform resource.\n\nUnlike [azurerm.linux_function_app_slot.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `app_settings` (`obj`): A map of key-value pairs for [App Settings](https://docs.microsoft.com/en-us/azure/azure-functions/functions-app-settings) and custom values. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `builtin_logging_enabled` (`bool`): Should built in logging be enabled. Configures `AzureWebJobsDashboard` app setting based on the configured storage setting. When `null`, the `builtin_logging_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Should the Function App Slot use Client Certificates. When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): The mode of the Function App Slot's client certificates requirement for incoming requests. Possible values are `Required`, `Optional`, and `OptionalInteractiveUser`. When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `content_share_force_disabled` (`bool`): Force disable the content share settings. When `null`, the `content_share_force_disabled` field will be omitted from the resulting object.\n  - `daily_memory_time_quota` (`number`): The amount of memory in gigabyte-seconds that your application is allowed to consume per day. Setting this value only affects function apps in Consumption Plans. When `null`, the `daily_memory_time_quota` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Is the Linux Function App Slot enabled. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `function_app_id` (`string`): The ID of the Linux Function App this Slot is a member of.\n  - `functions_extension_version` (`string`): The runtime version associated with the Function App Slot. When `null`, the `functions_extension_version` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Can the Function App Slot only be accessed via HTTPS? When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): The User Assigned Identity to use for Key Vault access. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `name` (`string`): Specifies the name of the Function App Slot.\n  - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting object. When `null`, the `service_plan_id` field will be omitted from the resulting object.\n  - `storage_account_access_key` (`string`): The access key which will be used to access the storage account for the Function App Slot. When `null`, the `storage_account_access_key` field will be omitted from the resulting object.\n  - `storage_account_name` (`string`): The backend storage account name which will be used by this Function App Slot. When `null`, the `storage_account_name` field will be omitted from the resulting object.\n  - `storage_key_vault_secret_id` (`string`): The Key Vault Secret ID, including version, that contains the Connection String to connect to the storage account for this Function App. When `null`, the `storage_key_vault_secret_id` field will be omitted from the resulting object.\n  - `storage_uses_managed_identity` (`bool`): Should the Function App Slot use its Managed Identity to access storage? When `null`, the `storage_uses_managed_identity` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting object. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting object. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting object. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting object. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting object. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting object. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.identity.new](#fn-identitynew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting object. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.site_config.new](#fn-site_confignew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting object. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `linux_function_app_slot` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`azurerm.linux_function_app_slot.newAttrs` constructs a new object with attributes and blocks configured for the `linux_function_app_slot`\nTerraform resource.\n\nUnlike [azurerm.linux_function_app_slot.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `app_settings` (`obj`): A map of key-value pairs for [App Settings](https://docs.microsoft.com/en-us/azure/azure-functions/functions-app-settings) and custom values. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `builtin_logging_enabled` (`bool`): Should built in logging be enabled. Configures `AzureWebJobsDashboard` app setting based on the configured storage setting. When `null`, the `builtin_logging_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Should the Function App Slot use Client Certificates. When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): The mode of the Function App Slot's client certificates requirement for incoming requests. Possible values are `Required`, `Optional`, and `OptionalInteractiveUser`. When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `content_share_force_disabled` (`bool`): Force disable the content share settings. When `null`, the `content_share_force_disabled` field will be omitted from the resulting object.\n  - `daily_memory_time_quota` (`number`): The amount of memory in gigabyte-seconds that your application is allowed to consume per day. Setting this value only affects function apps in Consumption Plans. When `null`, the `daily_memory_time_quota` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Is the Linux Function App Slot enabled. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `function_app_id` (`string`): The ID of the Linux Function App this Slot is a member of.\n  - `functions_extension_version` (`string`): The runtime version associated with the Function App Slot. When `null`, the `functions_extension_version` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Can the Function App Slot only be accessed via HTTPS? When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): The User Assigned Identity to use for Key Vault access. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `name` (`string`): Specifies the name of the Function App Slot.\n  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting object. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.\n  - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting object. When `null`, the `service_plan_id` field will be omitted from the resulting object.\n  - `storage_account_access_key` (`string`): The access key which will be used to access the storage account for the Function App Slot. When `null`, the `storage_account_access_key` field will be omitted from the resulting object.\n  - `storage_account_name` (`string`): The backend storage account name which will be used by this Function App Slot. When `null`, the `storage_account_name` field will be omitted from the resulting object.\n  - `storage_key_vault_secret_id` (`string`): The Key Vault Secret ID, including version, that contains the Connection String to connect to the storage account for this Function App. When `null`, the `storage_key_vault_secret_id` field will be omitted from the resulting object.\n  - `storage_uses_managed_identity` (`bool`): Should the Function App Slot use its Managed Identity to access storage? When `null`, the `storage_uses_managed_identity` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting object. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting object. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting object. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting object. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting object. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting object. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.identity.new](#fn-identitynew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting object. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.site_config.new](#fn-site_confignew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting object. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_function_app_slot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `linux_function_app_slot` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     function_app_id,
     name,
@@ -465,6 +467,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     https_only=null,
     identity=null,
     key_vault_reference_identity_id=null,
+    public_network_access_enabled=null,
     service_plan_id=null,
     site_config=null,
     storage_account=null,
@@ -494,6 +497,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     identity: identity,
     key_vault_reference_identity_id: key_vault_reference_identity_id,
     name: name,
+    public_network_access_enabled: public_network_access_enabled,
     service_plan_id: service_plan_id,
     site_config: site_config,
     storage_account: storage_account,
@@ -939,6 +943,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withPublicNetworkAccessEnabled':: d.fn(help='`azurerm.bool.withPublicNetworkAccessEnabled` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the public_network_access_enabled field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `public_network_access_enabled` field.\n', args=[]),
+  withPublicNetworkAccessEnabled(resourceLabel, value): {
+    resource+: {
+      azurerm_linux_function_app_slot+: {
+        [resourceLabel]+: {
+          public_network_access_enabled: value,
+        },
+      },
+    },
+  },
   '#withServicePlanId':: d.fn(help='`azurerm.string.withServicePlanId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the service_plan_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `service_plan_id` field.\n', args=[]),
   withServicePlanId(resourceLabel, value): {
     resource+: {
diff --git a/3.x/_gen/resources/linux_web_app.libsonnet b/3.x/_gen/resources/linux_web_app.libsonnet
index 936b2646..532be2f3 100644
--- a/3.x/_gen/resources/linux_web_app.libsonnet
+++ b/3.x/_gen/resources/linux_web_app.libsonnet
@@ -444,7 +444,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       http_logs: http_logs,
     }),
   },
-  '#new':: d.fn(help="\n`azurerm.linux_web_app.new` injects a new `azurerm_linux_web_app` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    azurerm.linux_web_app.new('some_id')\n\nYou can get the reference to the `id` field of the created `azurerm.linux_web_app` using the reference:\n\n    $._ref.azurerm_linux_web_app.some_id.get('id')\n\nThis is the same as directly entering `\"${ azurerm_linux_web_app.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `app_settings` (`obj`): Set the `app_settings` field on the resulting resource block. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `client_affinity_enabled` (`bool`): Set the `client_affinity_enabled` field on the resulting resource block. When `null`, the `client_affinity_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Set the `client_certificate_enabled` field on the resulting resource block. When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): Set the `client_certificate_mode` field on the resulting resource block. When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Set the `enabled` field on the resulting resource block. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Set the `https_only` field on the resulting resource block. When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): Set the `key_vault_reference_identity_id` field on the resulting resource block. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting resource block.\n  - `name` (`string`): Set the `name` field on the resulting resource block.\n  - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting resource block.\n  - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting resource block.\n  - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting resource block. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `zip_deploy_file` (`string`): The local path and filename of the Zip packaged application to deploy to this Linux Web App. **Note:** Using this value requires either `WEBSITE_RUN_FROM_PACKAGE=1` or `SCM_DO_BUILD_DURING_DEPLOYMENT=true` to be set on the App in `app_settings`. When `null`, the `zip_deploy_file` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting resource block. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting resource block. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting resource block. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting resource block. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting resource block. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.identity.new](#fn-identitynew) constructor.\n  - `logs` (`list[obj]`): Set the `logs` field on the resulting resource block. When `null`, the `logs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.logs.new](#fn-logsnew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting resource block. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.site_config.new](#fn-site_confignew) constructor.\n  - `sticky_settings` (`list[obj]`): Set the `sticky_settings` field on the resulting resource block. When `null`, the `sticky_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.sticky_settings.new](#fn-sticky_settingsnew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting resource block. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`azurerm.linux_web_app.new` injects a new `azurerm_linux_web_app` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    azurerm.linux_web_app.new('some_id')\n\nYou can get the reference to the `id` field of the created `azurerm.linux_web_app` using the reference:\n\n    $._ref.azurerm_linux_web_app.some_id.get('id')\n\nThis is the same as directly entering `\"${ azurerm_linux_web_app.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `app_settings` (`obj`): Set the `app_settings` field on the resulting resource block. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `client_affinity_enabled` (`bool`): Set the `client_affinity_enabled` field on the resulting resource block. When `null`, the `client_affinity_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Set the `client_certificate_enabled` field on the resulting resource block. When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): Set the `client_certificate_mode` field on the resulting resource block. When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Set the `enabled` field on the resulting resource block. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Set the `https_only` field on the resulting resource block. When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): Set the `key_vault_reference_identity_id` field on the resulting resource block. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting resource block.\n  - `name` (`string`): Set the `name` field on the resulting resource block.\n  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting resource block. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.\n  - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting resource block.\n  - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting resource block.\n  - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting resource block. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `zip_deploy_file` (`string`): The local path and filename of the Zip packaged application to deploy to this Linux Web App. **Note:** Using this value requires either `WEBSITE_RUN_FROM_PACKAGE=1` or `SCM_DO_BUILD_DURING_DEPLOYMENT=true` to be set on the App in `app_settings`. When `null`, the `zip_deploy_file` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting resource block. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting resource block. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting resource block. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting resource block. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting resource block. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.identity.new](#fn-identitynew) constructor.\n  - `logs` (`list[obj]`): Set the `logs` field on the resulting resource block. When `null`, the `logs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.logs.new](#fn-logsnew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting resource block. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.site_config.new](#fn-site_confignew) constructor.\n  - `sticky_settings` (`list[obj]`): Set the `sticky_settings` field on the resulting resource block. When `null`, the `sticky_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.sticky_settings.new](#fn-sticky_settingsnew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting resource block. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -465,6 +465,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     identity=null,
     key_vault_reference_identity_id=null,
     logs=null,
+    public_network_access_enabled=null,
     site_config=null,
     sticky_settings=null,
     storage_account=null,
@@ -493,6 +494,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       location=location,
       logs=logs,
       name=name,
+      public_network_access_enabled=public_network_access_enabled,
       resource_group_name=resource_group_name,
       service_plan_id=service_plan_id,
       site_config=site_config,
@@ -505,7 +507,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`azurerm.linux_web_app.newAttrs` constructs a new object with attributes and blocks configured for the `linux_web_app`\nTerraform resource.\n\nUnlike [azurerm.linux_web_app.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `app_settings` (`obj`): Set the `app_settings` field on the resulting object. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `client_affinity_enabled` (`bool`): Set the `client_affinity_enabled` field on the resulting object. When `null`, the `client_affinity_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Set the `client_certificate_enabled` field on the resulting object. When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): Set the `client_certificate_mode` field on the resulting object. When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Set the `enabled` field on the resulting object. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Set the `https_only` field on the resulting object. When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): Set the `key_vault_reference_identity_id` field on the resulting object. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting object.\n  - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting object. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `zip_deploy_file` (`string`): The local path and filename of the Zip packaged application to deploy to this Linux Web App. **Note:** Using this value requires either `WEBSITE_RUN_FROM_PACKAGE=1` or `SCM_DO_BUILD_DURING_DEPLOYMENT=true` to be set on the App in `app_settings`. When `null`, the `zip_deploy_file` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting object. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting object. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting object. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting object. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting object. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.identity.new](#fn-identitynew) constructor.\n  - `logs` (`list[obj]`): Set the `logs` field on the resulting object. When `null`, the `logs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.logs.new](#fn-logsnew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting object. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.site_config.new](#fn-site_confignew) constructor.\n  - `sticky_settings` (`list[obj]`): Set the `sticky_settings` field on the resulting object. When `null`, the `sticky_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.sticky_settings.new](#fn-sticky_settingsnew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting object. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `linux_web_app` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`azurerm.linux_web_app.newAttrs` constructs a new object with attributes and blocks configured for the `linux_web_app`\nTerraform resource.\n\nUnlike [azurerm.linux_web_app.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `app_settings` (`obj`): Set the `app_settings` field on the resulting object. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `client_affinity_enabled` (`bool`): Set the `client_affinity_enabled` field on the resulting object. When `null`, the `client_affinity_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Set the `client_certificate_enabled` field on the resulting object. When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): Set the `client_certificate_mode` field on the resulting object. When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Set the `enabled` field on the resulting object. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Set the `https_only` field on the resulting object. When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): Set the `key_vault_reference_identity_id` field on the resulting object. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting object. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.\n  - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting object.\n  - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting object. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `zip_deploy_file` (`string`): The local path and filename of the Zip packaged application to deploy to this Linux Web App. **Note:** Using this value requires either `WEBSITE_RUN_FROM_PACKAGE=1` or `SCM_DO_BUILD_DURING_DEPLOYMENT=true` to be set on the App in `app_settings`. When `null`, the `zip_deploy_file` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting object. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting object. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting object. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting object. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting object. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.identity.new](#fn-identitynew) constructor.\n  - `logs` (`list[obj]`): Set the `logs` field on the resulting object. When `null`, the `logs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.logs.new](#fn-logsnew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting object. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.site_config.new](#fn-site_confignew) constructor.\n  - `sticky_settings` (`list[obj]`): Set the `sticky_settings` field on the resulting object. When `null`, the `sticky_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.sticky_settings.new](#fn-sticky_settingsnew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting object. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `linux_web_app` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
@@ -525,6 +527,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     identity=null,
     key_vault_reference_identity_id=null,
     logs=null,
+    public_network_access_enabled=null,
     site_config=null,
     sticky_settings=null,
     storage_account=null,
@@ -549,6 +552,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     location: location,
     logs: logs,
     name: name,
+    public_network_access_enabled: public_network_access_enabled,
     resource_group_name: resource_group_name,
     service_plan_id: service_plan_id,
     site_config: site_config,
@@ -1045,6 +1049,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withPublicNetworkAccessEnabled':: d.fn(help='`azurerm.bool.withPublicNetworkAccessEnabled` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the public_network_access_enabled field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `public_network_access_enabled` field.\n', args=[]),
+  withPublicNetworkAccessEnabled(resourceLabel, value): {
+    resource+: {
+      azurerm_linux_web_app+: {
+        [resourceLabel]+: {
+          public_network_access_enabled: value,
+        },
+      },
+    },
+  },
   '#withResourceGroupName':: d.fn(help='`azurerm.string.withResourceGroupName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the resource_group_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `resource_group_name` field.\n', args=[]),
   withResourceGroupName(resourceLabel, value): {
     resource+: {
diff --git a/3.x/_gen/resources/linux_web_app_slot.libsonnet b/3.x/_gen/resources/linux_web_app_slot.libsonnet
index 1f058975..9c359554 100644
--- a/3.x/_gen/resources/linux_web_app_slot.libsonnet
+++ b/3.x/_gen/resources/linux_web_app_slot.libsonnet
@@ -444,7 +444,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       http_logs: http_logs,
     }),
   },
-  '#new':: d.fn(help="\n`azurerm.linux_web_app_slot.new` injects a new `azurerm_linux_web_app_slot` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    azurerm.linux_web_app_slot.new('some_id')\n\nYou can get the reference to the `id` field of the created `azurerm.linux_web_app_slot` using the reference:\n\n    $._ref.azurerm_linux_web_app_slot.some_id.get('id')\n\nThis is the same as directly entering `\"${ azurerm_linux_web_app_slot.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `app_service_id` (`string`): Set the `app_service_id` field on the resulting resource block.\n  - `app_settings` (`obj`): Set the `app_settings` field on the resulting resource block. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `client_affinity_enabled` (`bool`): Set the `client_affinity_enabled` field on the resulting resource block. When `null`, the `client_affinity_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Set the `client_certificate_enabled` field on the resulting resource block. When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): Set the `client_certificate_mode` field on the resulting resource block. When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Set the `enabled` field on the resulting resource block. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Set the `https_only` field on the resulting resource block. When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): Set the `key_vault_reference_identity_id` field on the resulting resource block. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting resource block.\n  - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting resource block. When `null`, the `service_plan_id` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting resource block. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `zip_deploy_file` (`string`): The local path and filename of the Zip packaged application to deploy to this Windows Web App. **Note:** Using this value requires `WEBSITE_RUN_FROM_PACKAGE=1` on the App in `app_settings`. When `null`, the `zip_deploy_file` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting resource block. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting resource block. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting resource block. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting resource block. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting resource block. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.identity.new](#fn-identitynew) constructor.\n  - `logs` (`list[obj]`): Set the `logs` field on the resulting resource block. When `null`, the `logs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.logs.new](#fn-logsnew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting resource block. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.site_config.new](#fn-site_confignew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting resource block. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`azurerm.linux_web_app_slot.new` injects a new `azurerm_linux_web_app_slot` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    azurerm.linux_web_app_slot.new('some_id')\n\nYou can get the reference to the `id` field of the created `azurerm.linux_web_app_slot` using the reference:\n\n    $._ref.azurerm_linux_web_app_slot.some_id.get('id')\n\nThis is the same as directly entering `\"${ azurerm_linux_web_app_slot.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `app_service_id` (`string`): Set the `app_service_id` field on the resulting resource block.\n  - `app_settings` (`obj`): Set the `app_settings` field on the resulting resource block. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `client_affinity_enabled` (`bool`): Set the `client_affinity_enabled` field on the resulting resource block. When `null`, the `client_affinity_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Set the `client_certificate_enabled` field on the resulting resource block. When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): Set the `client_certificate_mode` field on the resulting resource block. When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Set the `enabled` field on the resulting resource block. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Set the `https_only` field on the resulting resource block. When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): Set the `key_vault_reference_identity_id` field on the resulting resource block. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting resource block.\n  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting resource block. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.\n  - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting resource block. When `null`, the `service_plan_id` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting resource block. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `zip_deploy_file` (`string`): The local path and filename of the Zip packaged application to deploy to this Windows Web App. **Note:** Using this value requires `WEBSITE_RUN_FROM_PACKAGE=1` on the App in `app_settings`. When `null`, the `zip_deploy_file` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting resource block. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting resource block. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting resource block. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting resource block. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting resource block. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.identity.new](#fn-identitynew) constructor.\n  - `logs` (`list[obj]`): Set the `logs` field on the resulting resource block. When `null`, the `logs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.logs.new](#fn-logsnew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting resource block. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.site_config.new](#fn-site_confignew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting resource block. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     app_service_id,
@@ -463,6 +463,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     identity=null,
     key_vault_reference_identity_id=null,
     logs=null,
+    public_network_access_enabled=null,
     service_plan_id=null,
     site_config=null,
     storage_account=null,
@@ -491,6 +492,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       key_vault_reference_identity_id=key_vault_reference_identity_id,
       logs=logs,
       name=name,
+      public_network_access_enabled=public_network_access_enabled,
       service_plan_id=service_plan_id,
       site_config=site_config,
       storage_account=storage_account,
@@ -501,7 +503,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`azurerm.linux_web_app_slot.newAttrs` constructs a new object with attributes and blocks configured for the `linux_web_app_slot`\nTerraform resource.\n\nUnlike [azurerm.linux_web_app_slot.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `app_service_id` (`string`): Set the `app_service_id` field on the resulting object.\n  - `app_settings` (`obj`): Set the `app_settings` field on the resulting object. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `client_affinity_enabled` (`bool`): Set the `client_affinity_enabled` field on the resulting object. When `null`, the `client_affinity_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Set the `client_certificate_enabled` field on the resulting object. When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): Set the `client_certificate_mode` field on the resulting object. When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Set the `enabled` field on the resulting object. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Set the `https_only` field on the resulting object. When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): Set the `key_vault_reference_identity_id` field on the resulting object. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting object. When `null`, the `service_plan_id` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting object. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `zip_deploy_file` (`string`): The local path and filename of the Zip packaged application to deploy to this Windows Web App. **Note:** Using this value requires `WEBSITE_RUN_FROM_PACKAGE=1` on the App in `app_settings`. When `null`, the `zip_deploy_file` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting object. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting object. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting object. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting object. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting object. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.identity.new](#fn-identitynew) constructor.\n  - `logs` (`list[obj]`): Set the `logs` field on the resulting object. When `null`, the `logs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.logs.new](#fn-logsnew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting object. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.site_config.new](#fn-site_confignew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting object. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `linux_web_app_slot` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`azurerm.linux_web_app_slot.newAttrs` constructs a new object with attributes and blocks configured for the `linux_web_app_slot`\nTerraform resource.\n\nUnlike [azurerm.linux_web_app_slot.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `app_service_id` (`string`): Set the `app_service_id` field on the resulting object.\n  - `app_settings` (`obj`): Set the `app_settings` field on the resulting object. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `client_affinity_enabled` (`bool`): Set the `client_affinity_enabled` field on the resulting object. When `null`, the `client_affinity_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Set the `client_certificate_enabled` field on the resulting object. When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): Set the `client_certificate_mode` field on the resulting object. When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Set the `enabled` field on the resulting object. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Set the `https_only` field on the resulting object. When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): Set the `key_vault_reference_identity_id` field on the resulting object. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting object. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.\n  - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting object. When `null`, the `service_plan_id` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting object. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `zip_deploy_file` (`string`): The local path and filename of the Zip packaged application to deploy to this Windows Web App. **Note:** Using this value requires `WEBSITE_RUN_FROM_PACKAGE=1` on the App in `app_settings`. When `null`, the `zip_deploy_file` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting object. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting object. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting object. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting object. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting object. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.identity.new](#fn-identitynew) constructor.\n  - `logs` (`list[obj]`): Set the `logs` field on the resulting object. When `null`, the `logs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.logs.new](#fn-logsnew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting object. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.site_config.new](#fn-site_confignew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting object. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.linux_web_app_slot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `linux_web_app_slot` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     app_service_id,
     name,
@@ -519,6 +521,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     identity=null,
     key_vault_reference_identity_id=null,
     logs=null,
+    public_network_access_enabled=null,
     service_plan_id=null,
     site_config=null,
     storage_account=null,
@@ -543,6 +546,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     key_vault_reference_identity_id: key_vault_reference_identity_id,
     logs: logs,
     name: name,
+    public_network_access_enabled: public_network_access_enabled,
     service_plan_id: service_plan_id,
     site_config: site_config,
     storage_account: storage_account,
@@ -1029,6 +1033,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withPublicNetworkAccessEnabled':: d.fn(help='`azurerm.bool.withPublicNetworkAccessEnabled` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the public_network_access_enabled field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `public_network_access_enabled` field.\n', args=[]),
+  withPublicNetworkAccessEnabled(resourceLabel, value): {
+    resource+: {
+      azurerm_linux_web_app_slot+: {
+        [resourceLabel]+: {
+          public_network_access_enabled: value,
+        },
+      },
+    },
+  },
   '#withServicePlanId':: d.fn(help='`azurerm.string.withServicePlanId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the service_plan_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `service_plan_id` field.\n', args=[]),
   withServicePlanId(resourceLabel, value): {
     resource+: {
diff --git a/3.x/_gen/resources/pim_active_role_assignment.libsonnet b/3.x/_gen/resources/pim_active_role_assignment.libsonnet
new file mode 100644
index 00000000..7baa353b
--- /dev/null
+++ b/3.x/_gen/resources/pim_active_role_assignment.libsonnet
@@ -0,0 +1,192 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='pim_active_role_assignment', url='', help='`pim_active_role_assignment` represents the `azurerm_pim_active_role_assignment` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`azurerm.pim_active_role_assignment.new` injects a new `azurerm_pim_active_role_assignment` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    azurerm.pim_active_role_assignment.new('some_id')\n\nYou can get the reference to the `id` field of the created `azurerm.pim_active_role_assignment` using the reference:\n\n    $._ref.azurerm_pim_active_role_assignment.some_id.get('id')\n\nThis is the same as directly entering `\"${ azurerm_pim_active_role_assignment.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `justification` (`string`): The justification of the role assignment. When `null`, the `justification` field will be omitted from the resulting object.\n  - `principal_id` (`string`): The principal id.\n  - `role_definition_id` (`string`): The role definition id.\n  - `scope` (`string`): The scope.\n  - `schedule` (`list[obj]`): The schedule details of this role assignment. When `null`, the `schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_active_role_assignment.schedule.new](#fn-schedulenew) constructor.\n  - `ticket` (`list[obj]`): The ticket details. When `null`, the `ticket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_active_role_assignment.ticket.new](#fn-ticketnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_active_role_assignment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    principal_id,
+    role_definition_id,
+    scope,
+    justification=null,
+    schedule=null,
+    ticket=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='azurerm_pim_active_role_assignment',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      justification=justification,
+      principal_id=principal_id,
+      role_definition_id=role_definition_id,
+      schedule=schedule,
+      scope=scope,
+      ticket=ticket,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`azurerm.pim_active_role_assignment.newAttrs` constructs a new object with attributes and blocks configured for the `pim_active_role_assignment`\nTerraform resource.\n\nUnlike [azurerm.pim_active_role_assignment.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `justification` (`string`): The justification of the role assignment. When `null`, the `justification` field will be omitted from the resulting object.\n  - `principal_id` (`string`): The principal id.\n  - `role_definition_id` (`string`): The role definition id.\n  - `scope` (`string`): The scope.\n  - `schedule` (`list[obj]`): The schedule details of this role assignment. When `null`, the `schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_active_role_assignment.schedule.new](#fn-schedulenew) constructor.\n  - `ticket` (`list[obj]`): The ticket details. When `null`, the `ticket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_active_role_assignment.ticket.new](#fn-ticketnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_active_role_assignment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pim_active_role_assignment` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    principal_id,
+    role_definition_id,
+    scope,
+    justification=null,
+    schedule=null,
+    ticket=null,
+    timeouts=null
+  ):: std.prune(a={
+    justification: justification,
+    principal_id: principal_id,
+    role_definition_id: role_definition_id,
+    schedule: schedule,
+    scope: scope,
+    ticket: ticket,
+    timeouts: timeouts,
+  }),
+  schedule:: {
+    expiration:: {
+      '#new':: d.fn(help='\n`azurerm.pim_active_role_assignment.schedule.expiration.new` constructs a new object with attributes and blocks configured for the `expiration`\nTerraform sub block.\n\n\n\n**Args**:\n  - `duration_days` (`number`): The duration of the assignment in days. When `null`, the `duration_days` field will be omitted from the resulting object.\n  - `duration_hours` (`number`): The duration of the assignment in hours. When `null`, the `duration_hours` field will be omitted from the resulting object.\n  - `end_date_time` (`string`): The end date time of the assignment. When `null`, the `end_date_time` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `expiration` sub block.\n', args=[]),
+      new(
+        duration_days=null,
+        duration_hours=null,
+        end_date_time=null
+      ):: std.prune(a={
+        duration_days: duration_days,
+        duration_hours: duration_hours,
+        end_date_time: end_date_time,
+      }),
+    },
+    '#new':: d.fn(help='\n`azurerm.pim_active_role_assignment.schedule.new` constructs a new object with attributes and blocks configured for the `schedule`\nTerraform sub block.\n\n\n\n**Args**:\n  - `start_date_time` (`string`): The start date time. When `null`, the `start_date_time` field will be omitted from the resulting object.\n  - `expiration` (`list[obj]`): Set the `expiration` field on the resulting object. When `null`, the `expiration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_active_role_assignment.schedule.expiration.new](#fn-scheduleexpirationnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `schedule` sub block.\n', args=[]),
+    new(
+      expiration=null,
+      start_date_time=null
+    ):: std.prune(a={
+      expiration: expiration,
+      start_date_time: start_date_time,
+    }),
+  },
+  ticket:: {
+    '#new':: d.fn(help='\n`azurerm.pim_active_role_assignment.ticket.new` constructs a new object with attributes and blocks configured for the `ticket`\nTerraform sub block.\n\n\n\n**Args**:\n  - `number` (`string`): The ticket number. When `null`, the `number` field will be omitted from the resulting object.\n  - `system` (`string`): The ticket system. When `null`, the `system` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `ticket` sub block.\n', args=[]),
+    new(
+      number=null,
+      system=null
+    ):: std.prune(a={
+      number: number,
+      system: system,
+    }),
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`azurerm.pim_active_role_assignment.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `read` (`string`): Set the `read` field on the resulting object. When `null`, the `read` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      read=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      read: read,
+    }),
+  },
+  '#withJustification':: d.fn(help='`azurerm.string.withJustification` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the justification field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `justification` field.\n', args=[]),
+  withJustification(resourceLabel, value): {
+    resource+: {
+      azurerm_pim_active_role_assignment+: {
+        [resourceLabel]+: {
+          justification: value,
+        },
+      },
+    },
+  },
+  '#withPrincipalId':: d.fn(help='`azurerm.string.withPrincipalId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the principal_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `principal_id` field.\n', args=[]),
+  withPrincipalId(resourceLabel, value): {
+    resource+: {
+      azurerm_pim_active_role_assignment+: {
+        [resourceLabel]+: {
+          principal_id: value,
+        },
+      },
+    },
+  },
+  '#withRoleDefinitionId':: d.fn(help='`azurerm.string.withRoleDefinitionId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the role_definition_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `role_definition_id` field.\n', args=[]),
+  withRoleDefinitionId(resourceLabel, value): {
+    resource+: {
+      azurerm_pim_active_role_assignment+: {
+        [resourceLabel]+: {
+          role_definition_id: value,
+        },
+      },
+    },
+  },
+  '#withSchedule':: d.fn(help='`azurerm.list[obj].withSchedule` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the schedule field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [azurerm.list[obj].withScheduleMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `schedule` field.\n', args=[]),
+  withSchedule(resourceLabel, value): {
+    resource+: {
+      azurerm_pim_active_role_assignment+: {
+        [resourceLabel]+: {
+          schedule: value,
+        },
+      },
+    },
+  },
+  '#withScheduleMixin':: d.fn(help='`azurerm.list[obj].withScheduleMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the schedule field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [azurerm.list[obj].withSchedule](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `schedule` field.\n', args=[]),
+  withScheduleMixin(resourceLabel, value): {
+    resource+: {
+      azurerm_pim_active_role_assignment+: {
+        [resourceLabel]+: {
+          schedule+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withScope':: d.fn(help='`azurerm.string.withScope` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the scope field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `scope` field.\n', args=[]),
+  withScope(resourceLabel, value): {
+    resource+: {
+      azurerm_pim_active_role_assignment+: {
+        [resourceLabel]+: {
+          scope: value,
+        },
+      },
+    },
+  },
+  '#withTicket':: d.fn(help='`azurerm.list[obj].withTicket` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the ticket field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [azurerm.list[obj].withTicketMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `ticket` field.\n', args=[]),
+  withTicket(resourceLabel, value): {
+    resource+: {
+      azurerm_pim_active_role_assignment+: {
+        [resourceLabel]+: {
+          ticket: value,
+        },
+      },
+    },
+  },
+  '#withTicketMixin':: d.fn(help='`azurerm.list[obj].withTicketMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the ticket field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [azurerm.list[obj].withTicket](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `ticket` field.\n', args=[]),
+  withTicketMixin(resourceLabel, value): {
+    resource+: {
+      azurerm_pim_active_role_assignment+: {
+        [resourceLabel]+: {
+          ticket+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`azurerm.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [azurerm.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      azurerm_pim_active_role_assignment+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`azurerm.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [azurerm.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      azurerm_pim_active_role_assignment+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/3.x/_gen/resources/pim_eligible_role_assignment.libsonnet b/3.x/_gen/resources/pim_eligible_role_assignment.libsonnet
new file mode 100644
index 00000000..38ce674b
--- /dev/null
+++ b/3.x/_gen/resources/pim_eligible_role_assignment.libsonnet
@@ -0,0 +1,192 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='pim_eligible_role_assignment', url='', help='`pim_eligible_role_assignment` represents the `azurerm_pim_eligible_role_assignment` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`azurerm.pim_eligible_role_assignment.new` injects a new `azurerm_pim_eligible_role_assignment` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    azurerm.pim_eligible_role_assignment.new('some_id')\n\nYou can get the reference to the `id` field of the created `azurerm.pim_eligible_role_assignment` using the reference:\n\n    $._ref.azurerm_pim_eligible_role_assignment.some_id.get('id')\n\nThis is the same as directly entering `\"${ azurerm_pim_eligible_role_assignment.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `justification` (`string`): The justification of the eligible role assignment. When `null`, the `justification` field will be omitted from the resulting object.\n  - `principal_id` (`string`): The principal id.\n  - `role_definition_id` (`string`): The role definition id.\n  - `scope` (`string`): The scope.\n  - `schedule` (`list[obj]`): The schedule details of this eligible role assignment. When `null`, the `schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_eligible_role_assignment.schedule.new](#fn-schedulenew) constructor.\n  - `ticket` (`list[obj]`): Ticket details relating to the assignment. When `null`, the `ticket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_eligible_role_assignment.ticket.new](#fn-ticketnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_eligible_role_assignment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    principal_id,
+    role_definition_id,
+    scope,
+    justification=null,
+    schedule=null,
+    ticket=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='azurerm_pim_eligible_role_assignment',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      justification=justification,
+      principal_id=principal_id,
+      role_definition_id=role_definition_id,
+      schedule=schedule,
+      scope=scope,
+      ticket=ticket,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`azurerm.pim_eligible_role_assignment.newAttrs` constructs a new object with attributes and blocks configured for the `pim_eligible_role_assignment`\nTerraform resource.\n\nUnlike [azurerm.pim_eligible_role_assignment.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `justification` (`string`): The justification of the eligible role assignment. When `null`, the `justification` field will be omitted from the resulting object.\n  - `principal_id` (`string`): The principal id.\n  - `role_definition_id` (`string`): The role definition id.\n  - `scope` (`string`): The scope.\n  - `schedule` (`list[obj]`): The schedule details of this eligible role assignment. When `null`, the `schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_eligible_role_assignment.schedule.new](#fn-schedulenew) constructor.\n  - `ticket` (`list[obj]`): Ticket details relating to the assignment. When `null`, the `ticket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_eligible_role_assignment.ticket.new](#fn-ticketnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_eligible_role_assignment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pim_eligible_role_assignment` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    principal_id,
+    role_definition_id,
+    scope,
+    justification=null,
+    schedule=null,
+    ticket=null,
+    timeouts=null
+  ):: std.prune(a={
+    justification: justification,
+    principal_id: principal_id,
+    role_definition_id: role_definition_id,
+    schedule: schedule,
+    scope: scope,
+    ticket: ticket,
+    timeouts: timeouts,
+  }),
+  schedule:: {
+    expiration:: {
+      '#new':: d.fn(help='\n`azurerm.pim_eligible_role_assignment.schedule.expiration.new` constructs a new object with attributes and blocks configured for the `expiration`\nTerraform sub block.\n\n\n\n**Args**:\n  - `duration_days` (`number`): The duration of the assignment in days. When `null`, the `duration_days` field will be omitted from the resulting object.\n  - `duration_hours` (`number`): The duration of the assignment in hours. When `null`, the `duration_hours` field will be omitted from the resulting object.\n  - `end_date_time` (`string`): The end date time of the assignment. When `null`, the `end_date_time` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `expiration` sub block.\n', args=[]),
+      new(
+        duration_days=null,
+        duration_hours=null,
+        end_date_time=null
+      ):: std.prune(a={
+        duration_days: duration_days,
+        duration_hours: duration_hours,
+        end_date_time: end_date_time,
+      }),
+    },
+    '#new':: d.fn(help='\n`azurerm.pim_eligible_role_assignment.schedule.new` constructs a new object with attributes and blocks configured for the `schedule`\nTerraform sub block.\n\n\n\n**Args**:\n  - `start_date_time` (`string`): The start date time. When `null`, the `start_date_time` field will be omitted from the resulting object.\n  - `expiration` (`list[obj]`): Set the `expiration` field on the resulting object. When `null`, the `expiration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_eligible_role_assignment.schedule.expiration.new](#fn-scheduleexpirationnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `schedule` sub block.\n', args=[]),
+    new(
+      expiration=null,
+      start_date_time=null
+    ):: std.prune(a={
+      expiration: expiration,
+      start_date_time: start_date_time,
+    }),
+  },
+  ticket:: {
+    '#new':: d.fn(help='\n`azurerm.pim_eligible_role_assignment.ticket.new` constructs a new object with attributes and blocks configured for the `ticket`\nTerraform sub block.\n\n\n\n**Args**:\n  - `number` (`string`): The ticket number. When `null`, the `number` field will be omitted from the resulting object.\n  - `system` (`string`): The ticket system. When `null`, the `system` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `ticket` sub block.\n', args=[]),
+    new(
+      number=null,
+      system=null
+    ):: std.prune(a={
+      number: number,
+      system: system,
+    }),
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`azurerm.pim_eligible_role_assignment.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `read` (`string`): Set the `read` field on the resulting object. When `null`, the `read` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      read=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      read: read,
+    }),
+  },
+  '#withJustification':: d.fn(help='`azurerm.string.withJustification` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the justification field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `justification` field.\n', args=[]),
+  withJustification(resourceLabel, value): {
+    resource+: {
+      azurerm_pim_eligible_role_assignment+: {
+        [resourceLabel]+: {
+          justification: value,
+        },
+      },
+    },
+  },
+  '#withPrincipalId':: d.fn(help='`azurerm.string.withPrincipalId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the principal_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `principal_id` field.\n', args=[]),
+  withPrincipalId(resourceLabel, value): {
+    resource+: {
+      azurerm_pim_eligible_role_assignment+: {
+        [resourceLabel]+: {
+          principal_id: value,
+        },
+      },
+    },
+  },
+  '#withRoleDefinitionId':: d.fn(help='`azurerm.string.withRoleDefinitionId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the role_definition_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `role_definition_id` field.\n', args=[]),
+  withRoleDefinitionId(resourceLabel, value): {
+    resource+: {
+      azurerm_pim_eligible_role_assignment+: {
+        [resourceLabel]+: {
+          role_definition_id: value,
+        },
+      },
+    },
+  },
+  '#withSchedule':: d.fn(help='`azurerm.list[obj].withSchedule` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the schedule field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [azurerm.list[obj].withScheduleMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `schedule` field.\n', args=[]),
+  withSchedule(resourceLabel, value): {
+    resource+: {
+      azurerm_pim_eligible_role_assignment+: {
+        [resourceLabel]+: {
+          schedule: value,
+        },
+      },
+    },
+  },
+  '#withScheduleMixin':: d.fn(help='`azurerm.list[obj].withScheduleMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the schedule field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [azurerm.list[obj].withSchedule](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `schedule` field.\n', args=[]),
+  withScheduleMixin(resourceLabel, value): {
+    resource+: {
+      azurerm_pim_eligible_role_assignment+: {
+        [resourceLabel]+: {
+          schedule+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withScope':: d.fn(help='`azurerm.string.withScope` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the scope field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `scope` field.\n', args=[]),
+  withScope(resourceLabel, value): {
+    resource+: {
+      azurerm_pim_eligible_role_assignment+: {
+        [resourceLabel]+: {
+          scope: value,
+        },
+      },
+    },
+  },
+  '#withTicket':: d.fn(help='`azurerm.list[obj].withTicket` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the ticket field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [azurerm.list[obj].withTicketMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `ticket` field.\n', args=[]),
+  withTicket(resourceLabel, value): {
+    resource+: {
+      azurerm_pim_eligible_role_assignment+: {
+        [resourceLabel]+: {
+          ticket: value,
+        },
+      },
+    },
+  },
+  '#withTicketMixin':: d.fn(help='`azurerm.list[obj].withTicketMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the ticket field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [azurerm.list[obj].withTicket](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `ticket` field.\n', args=[]),
+  withTicketMixin(resourceLabel, value): {
+    resource+: {
+      azurerm_pim_eligible_role_assignment+: {
+        [resourceLabel]+: {
+          ticket+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`azurerm.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [azurerm.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      azurerm_pim_eligible_role_assignment+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`azurerm.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [azurerm.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      azurerm_pim_eligible_role_assignment+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/3.x/_gen/resources/spring_cloud_gateway.libsonnet b/3.x/_gen/resources/spring_cloud_gateway.libsonnet
index db15ce09..fa6d2710 100644
--- a/3.x/_gen/resources/spring_cloud_gateway.libsonnet
+++ b/3.x/_gen/resources/spring_cloud_gateway.libsonnet
@@ -29,10 +29,11 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     }),
   },
   cors:: {
-    '#new':: d.fn(help='\n`azurerm.spring_cloud_gateway.cors.new` constructs a new object with attributes and blocks configured for the `cors`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allowed_headers` (`list`): Set the `allowed_headers` field on the resulting object. When `null`, the `allowed_headers` field will be omitted from the resulting object.\n  - `allowed_methods` (`list`): Set the `allowed_methods` field on the resulting object. When `null`, the `allowed_methods` field will be omitted from the resulting object.\n  - `allowed_origins` (`list`): Set the `allowed_origins` field on the resulting object. When `null`, the `allowed_origins` field will be omitted from the resulting object.\n  - `credentials_allowed` (`bool`): Set the `credentials_allowed` field on the resulting object. When `null`, the `credentials_allowed` field will be omitted from the resulting object.\n  - `exposed_headers` (`list`): Set the `exposed_headers` field on the resulting object. When `null`, the `exposed_headers` field will be omitted from the resulting object.\n  - `max_age_seconds` (`number`): Set the `max_age_seconds` field on the resulting object. When `null`, the `max_age_seconds` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `cors` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`azurerm.spring_cloud_gateway.cors.new` constructs a new object with attributes and blocks configured for the `cors`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allowed_headers` (`list`): Set the `allowed_headers` field on the resulting object. When `null`, the `allowed_headers` field will be omitted from the resulting object.\n  - `allowed_methods` (`list`): Set the `allowed_methods` field on the resulting object. When `null`, the `allowed_methods` field will be omitted from the resulting object.\n  - `allowed_origin_patterns` (`list`): Set the `allowed_origin_patterns` field on the resulting object. When `null`, the `allowed_origin_patterns` field will be omitted from the resulting object.\n  - `allowed_origins` (`list`): Set the `allowed_origins` field on the resulting object. When `null`, the `allowed_origins` field will be omitted from the resulting object.\n  - `credentials_allowed` (`bool`): Set the `credentials_allowed` field on the resulting object. When `null`, the `credentials_allowed` field will be omitted from the resulting object.\n  - `exposed_headers` (`list`): Set the `exposed_headers` field on the resulting object. When `null`, the `exposed_headers` field will be omitted from the resulting object.\n  - `max_age_seconds` (`number`): Set the `max_age_seconds` field on the resulting object. When `null`, the `max_age_seconds` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `cors` sub block.\n', args=[]),
     new(
       allowed_headers=null,
       allowed_methods=null,
+      allowed_origin_patterns=null,
       allowed_origins=null,
       credentials_allowed=null,
       exposed_headers=null,
@@ -40,6 +41,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ):: std.prune(a={
       allowed_headers: allowed_headers,
       allowed_methods: allowed_methods,
+      allowed_origin_patterns: allowed_origin_patterns,
       allowed_origins: allowed_origins,
       credentials_allowed: credentials_allowed,
       exposed_headers: exposed_headers,
diff --git a/3.x/_gen/resources/windows_function_app.libsonnet b/3.x/_gen/resources/windows_function_app.libsonnet
index 7d592c41..585e683e 100644
--- a/3.x/_gen/resources/windows_function_app.libsonnet
+++ b/3.x/_gen/resources/windows_function_app.libsonnet
@@ -378,7 +378,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       type: type,
     }),
   },
-  '#new':: d.fn(help="\n`azurerm.windows_function_app.new` injects a new `azurerm_windows_function_app` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    azurerm.windows_function_app.new('some_id')\n\nYou can get the reference to the `id` field of the created `azurerm.windows_function_app` using the reference:\n\n    $._ref.azurerm_windows_function_app.some_id.get('id')\n\nThis is the same as directly entering `\"${ azurerm_windows_function_app.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `app_settings` (`obj`): A map of key-value pairs for [App Settings](https://docs.microsoft.com/en-us/azure/azure-functions/functions-app-settings) and custom values. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `builtin_logging_enabled` (`bool`): Should built in logging be enabled. Configures `AzureWebJobsDashboard` app setting based on the configured storage setting When `null`, the `builtin_logging_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Should the function app use Client Certificates When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): The mode of the Function App\u0026#39;s client certificates requirement for incoming requests. Possible values are `Required`, `Optional`, and `OptionalInteractiveUser`  When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `content_share_force_disabled` (`bool`): Force disable the content share settings. When `null`, the `content_share_force_disabled` field will be omitted from the resulting object.\n  - `daily_memory_time_quota` (`number`): The amount of memory in gigabyte-seconds that your application is allowed to consume per day. Setting this value only affects function apps in Consumption Plans. When `null`, the `daily_memory_time_quota` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Is the Windows Function App enabled. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `functions_extension_version` (`string`): The runtime version associated with the Function App. When `null`, the `functions_extension_version` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Can the Function App only be accessed via HTTPS? When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): The User Assigned Identity to use for Key Vault access. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting resource block.\n  - `name` (`string`): Specifies the name of the Function App.\n  - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting resource block.\n  - `service_plan_id` (`string`): The ID of the App Service Plan within which to create this Function App\n  - `storage_account_access_key` (`string`): The access key which will be used to access the storage account for the Function App. When `null`, the `storage_account_access_key` field will be omitted from the resulting object.\n  - `storage_account_name` (`string`): The backend storage account name which will be used by this Function App. When `null`, the `storage_account_name` field will be omitted from the resulting object.\n  - `storage_key_vault_secret_id` (`string`): The Key Vault Secret ID, including version, that contains the Connection String to connect to the storage account for this Function App. When `null`, the `storage_key_vault_secret_id` field will be omitted from the resulting object.\n  - `storage_uses_managed_identity` (`bool`): Should the Function App use its Managed Identity to access storage? When `null`, the `storage_uses_managed_identity` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting resource block. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `zip_deploy_file` (`string`): The local path and filename of the Zip packaged application to deploy to this Windows Function App. **Note:** Using this value requires `WEBSITE_RUN_FROM_PACKAGE=1` to be set on the App in `app_settings`. When `null`, the `zip_deploy_file` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting resource block. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting resource block. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting resource block. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting resource block. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting resource block. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.identity.new](#fn-identitynew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting resource block. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.site_config.new](#fn-site_confignew) constructor.\n  - `sticky_settings` (`list[obj]`): Set the `sticky_settings` field on the resulting resource block. When `null`, the `sticky_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.sticky_settings.new](#fn-sticky_settingsnew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting resource block. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`azurerm.windows_function_app.new` injects a new `azurerm_windows_function_app` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    azurerm.windows_function_app.new('some_id')\n\nYou can get the reference to the `id` field of the created `azurerm.windows_function_app` using the reference:\n\n    $._ref.azurerm_windows_function_app.some_id.get('id')\n\nThis is the same as directly entering `\"${ azurerm_windows_function_app.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `app_settings` (`obj`): A map of key-value pairs for [App Settings](https://docs.microsoft.com/en-us/azure/azure-functions/functions-app-settings) and custom values. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `builtin_logging_enabled` (`bool`): Should built in logging be enabled. Configures `AzureWebJobsDashboard` app setting based on the configured storage setting When `null`, the `builtin_logging_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Should the function app use Client Certificates When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): The mode of the Function App\u0026#39;s client certificates requirement for incoming requests. Possible values are `Required`, `Optional`, and `OptionalInteractiveUser`  When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `content_share_force_disabled` (`bool`): Force disable the content share settings. When `null`, the `content_share_force_disabled` field will be omitted from the resulting object.\n  - `daily_memory_time_quota` (`number`): The amount of memory in gigabyte-seconds that your application is allowed to consume per day. Setting this value only affects function apps in Consumption Plans. When `null`, the `daily_memory_time_quota` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Is the Windows Function App enabled. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `functions_extension_version` (`string`): The runtime version associated with the Function App. When `null`, the `functions_extension_version` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Can the Function App only be accessed via HTTPS? When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): The User Assigned Identity to use for Key Vault access. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting resource block.\n  - `name` (`string`): Specifies the name of the Function App.\n  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting resource block. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.\n  - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting resource block.\n  - `service_plan_id` (`string`): The ID of the App Service Plan within which to create this Function App\n  - `storage_account_access_key` (`string`): The access key which will be used to access the storage account for the Function App. When `null`, the `storage_account_access_key` field will be omitted from the resulting object.\n  - `storage_account_name` (`string`): The backend storage account name which will be used by this Function App. When `null`, the `storage_account_name` field will be omitted from the resulting object.\n  - `storage_key_vault_secret_id` (`string`): The Key Vault Secret ID, including version, that contains the Connection String to connect to the storage account for this Function App. When `null`, the `storage_key_vault_secret_id` field will be omitted from the resulting object.\n  - `storage_uses_managed_identity` (`bool`): Should the Function App use its Managed Identity to access storage? When `null`, the `storage_uses_managed_identity` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting resource block. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `zip_deploy_file` (`string`): The local path and filename of the Zip packaged application to deploy to this Windows Function App. **Note:** Using this value requires `WEBSITE_RUN_FROM_PACKAGE=1` to be set on the App in `app_settings`. When `null`, the `zip_deploy_file` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting resource block. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting resource block. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting resource block. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting resource block. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting resource block. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.identity.new](#fn-identitynew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting resource block. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.site_config.new](#fn-site_confignew) constructor.\n  - `sticky_settings` (`list[obj]`): Set the `sticky_settings` field on the resulting resource block. When `null`, the `sticky_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.sticky_settings.new](#fn-sticky_settingsnew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting resource block. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -401,6 +401,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     https_only=null,
     identity=null,
     key_vault_reference_identity_id=null,
+    public_network_access_enabled=null,
     site_config=null,
     sticky_settings=null,
     storage_account=null,
@@ -435,6 +436,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       key_vault_reference_identity_id=key_vault_reference_identity_id,
       location=location,
       name=name,
+      public_network_access_enabled=public_network_access_enabled,
       resource_group_name=resource_group_name,
       service_plan_id=service_plan_id,
       site_config=site_config,
@@ -451,7 +453,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`azurerm.windows_function_app.newAttrs` constructs a new object with attributes and blocks configured for the `windows_function_app`\nTerraform resource.\n\nUnlike [azurerm.windows_function_app.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `app_settings` (`obj`): A map of key-value pairs for [App Settings](https://docs.microsoft.com/en-us/azure/azure-functions/functions-app-settings) and custom values. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `builtin_logging_enabled` (`bool`): Should built in logging be enabled. Configures `AzureWebJobsDashboard` app setting based on the configured storage setting When `null`, the `builtin_logging_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Should the function app use Client Certificates When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): The mode of the Function App's client certificates requirement for incoming requests. Possible values are `Required`, `Optional`, and `OptionalInteractiveUser`  When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `content_share_force_disabled` (`bool`): Force disable the content share settings. When `null`, the `content_share_force_disabled` field will be omitted from the resulting object.\n  - `daily_memory_time_quota` (`number`): The amount of memory in gigabyte-seconds that your application is allowed to consume per day. Setting this value only affects function apps in Consumption Plans. When `null`, the `daily_memory_time_quota` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Is the Windows Function App enabled. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `functions_extension_version` (`string`): The runtime version associated with the Function App. When `null`, the `functions_extension_version` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Can the Function App only be accessed via HTTPS? When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): The User Assigned Identity to use for Key Vault access. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting object.\n  - `name` (`string`): Specifies the name of the Function App.\n  - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting object.\n  - `service_plan_id` (`string`): The ID of the App Service Plan within which to create this Function App\n  - `storage_account_access_key` (`string`): The access key which will be used to access the storage account for the Function App. When `null`, the `storage_account_access_key` field will be omitted from the resulting object.\n  - `storage_account_name` (`string`): The backend storage account name which will be used by this Function App. When `null`, the `storage_account_name` field will be omitted from the resulting object.\n  - `storage_key_vault_secret_id` (`string`): The Key Vault Secret ID, including version, that contains the Connection String to connect to the storage account for this Function App. When `null`, the `storage_key_vault_secret_id` field will be omitted from the resulting object.\n  - `storage_uses_managed_identity` (`bool`): Should the Function App use its Managed Identity to access storage? When `null`, the `storage_uses_managed_identity` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting object. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `zip_deploy_file` (`string`): The local path and filename of the Zip packaged application to deploy to this Windows Function App. **Note:** Using this value requires `WEBSITE_RUN_FROM_PACKAGE=1` to be set on the App in `app_settings`. When `null`, the `zip_deploy_file` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting object. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting object. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting object. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting object. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting object. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.identity.new](#fn-identitynew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting object. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.site_config.new](#fn-site_confignew) constructor.\n  - `sticky_settings` (`list[obj]`): Set the `sticky_settings` field on the resulting object. When `null`, the `sticky_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.sticky_settings.new](#fn-sticky_settingsnew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting object. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `windows_function_app` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`azurerm.windows_function_app.newAttrs` constructs a new object with attributes and blocks configured for the `windows_function_app`\nTerraform resource.\n\nUnlike [azurerm.windows_function_app.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `app_settings` (`obj`): A map of key-value pairs for [App Settings](https://docs.microsoft.com/en-us/azure/azure-functions/functions-app-settings) and custom values. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `builtin_logging_enabled` (`bool`): Should built in logging be enabled. Configures `AzureWebJobsDashboard` app setting based on the configured storage setting When `null`, the `builtin_logging_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Should the function app use Client Certificates When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): The mode of the Function App's client certificates requirement for incoming requests. Possible values are `Required`, `Optional`, and `OptionalInteractiveUser`  When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `content_share_force_disabled` (`bool`): Force disable the content share settings. When `null`, the `content_share_force_disabled` field will be omitted from the resulting object.\n  - `daily_memory_time_quota` (`number`): The amount of memory in gigabyte-seconds that your application is allowed to consume per day. Setting this value only affects function apps in Consumption Plans. When `null`, the `daily_memory_time_quota` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Is the Windows Function App enabled. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `functions_extension_version` (`string`): The runtime version associated with the Function App. When `null`, the `functions_extension_version` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Can the Function App only be accessed via HTTPS? When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): The User Assigned Identity to use for Key Vault access. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting object.\n  - `name` (`string`): Specifies the name of the Function App.\n  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting object. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.\n  - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting object.\n  - `service_plan_id` (`string`): The ID of the App Service Plan within which to create this Function App\n  - `storage_account_access_key` (`string`): The access key which will be used to access the storage account for the Function App. When `null`, the `storage_account_access_key` field will be omitted from the resulting object.\n  - `storage_account_name` (`string`): The backend storage account name which will be used by this Function App. When `null`, the `storage_account_name` field will be omitted from the resulting object.\n  - `storage_key_vault_secret_id` (`string`): The Key Vault Secret ID, including version, that contains the Connection String to connect to the storage account for this Function App. When `null`, the `storage_key_vault_secret_id` field will be omitted from the resulting object.\n  - `storage_uses_managed_identity` (`bool`): Should the Function App use its Managed Identity to access storage? When `null`, the `storage_uses_managed_identity` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting object. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `zip_deploy_file` (`string`): The local path and filename of the Zip packaged application to deploy to this Windows Function App. **Note:** Using this value requires `WEBSITE_RUN_FROM_PACKAGE=1` to be set on the App in `app_settings`. When `null`, the `zip_deploy_file` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting object. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting object. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting object. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting object. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting object. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.identity.new](#fn-identitynew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting object. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.site_config.new](#fn-site_confignew) constructor.\n  - `sticky_settings` (`list[obj]`): Set the `sticky_settings` field on the resulting object. When `null`, the `sticky_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.sticky_settings.new](#fn-sticky_settingsnew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting object. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `windows_function_app` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
@@ -473,6 +475,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     https_only=null,
     identity=null,
     key_vault_reference_identity_id=null,
+    public_network_access_enabled=null,
     site_config=null,
     sticky_settings=null,
     storage_account=null,
@@ -503,6 +506,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     key_vault_reference_identity_id: key_vault_reference_identity_id,
     location: location,
     name: name,
+    public_network_access_enabled: public_network_access_enabled,
     resource_group_name: resource_group_name,
     service_plan_id: service_plan_id,
     site_config: site_config,
@@ -935,6 +939,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withPublicNetworkAccessEnabled':: d.fn(help='`azurerm.bool.withPublicNetworkAccessEnabled` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the public_network_access_enabled field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `public_network_access_enabled` field.\n', args=[]),
+  withPublicNetworkAccessEnabled(resourceLabel, value): {
+    resource+: {
+      azurerm_windows_function_app+: {
+        [resourceLabel]+: {
+          public_network_access_enabled: value,
+        },
+      },
+    },
+  },
   '#withResourceGroupName':: d.fn(help='`azurerm.string.withResourceGroupName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the resource_group_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `resource_group_name` field.\n', args=[]),
   withResourceGroupName(resourceLabel, value): {
     resource+: {
diff --git a/3.x/_gen/resources/windows_function_app_slot.libsonnet b/3.x/_gen/resources/windows_function_app_slot.libsonnet
index 29131af0..d04d1230 100644
--- a/3.x/_gen/resources/windows_function_app_slot.libsonnet
+++ b/3.x/_gen/resources/windows_function_app_slot.libsonnet
@@ -378,7 +378,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       type: type,
     }),
   },
-  '#new':: d.fn(help="\n`azurerm.windows_function_app_slot.new` injects a new `azurerm_windows_function_app_slot` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    azurerm.windows_function_app_slot.new('some_id')\n\nYou can get the reference to the `id` field of the created `azurerm.windows_function_app_slot` using the reference:\n\n    $._ref.azurerm_windows_function_app_slot.some_id.get('id')\n\nThis is the same as directly entering `\"${ azurerm_windows_function_app_slot.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `app_settings` (`obj`): A map of key-value pairs for [App Settings](https://docs.microsoft.com/en-us/azure/azure-functions/functions-app-settings) and custom values. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `builtin_logging_enabled` (`bool`): Should built in logging be enabled. Configures `AzureWebJobsDashboard` app setting based on the configured storage setting. When `null`, the `builtin_logging_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Should the Function App Slot use Client Certificates. When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): The mode of the Function App Slot\u0026#39;s client certificates requirement for incoming requests. Possible values are `Required`, `Optional`, and `OptionalInteractiveUser`. When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `content_share_force_disabled` (`bool`): Force disable the content share settings. When `null`, the `content_share_force_disabled` field will be omitted from the resulting object.\n  - `daily_memory_time_quota` (`number`): The amount of memory in gigabyte-seconds that your application is allowed to consume per day. Setting this value only affects function apps in Consumption Plans. When `null`, the `daily_memory_time_quota` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Is the Windows Function App Slot enabled. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `function_app_id` (`string`): The ID of the Windows Function App this Slot is a member of.\n  - `functions_extension_version` (`string`): The runtime version associated with the Function App Slot. When `null`, the `functions_extension_version` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Can the Function App Slot only be accessed via HTTPS? When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): The User Assigned Identity to use for Key Vault access. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `name` (`string`): Specifies the name of the Windows Function App Slot.\n  - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting resource block. When `null`, the `service_plan_id` field will be omitted from the resulting object.\n  - `storage_account_access_key` (`string`): The access key which will be used to access the storage account for the Function App Slot. When `null`, the `storage_account_access_key` field will be omitted from the resulting object.\n  - `storage_account_name` (`string`): The backend storage account name which will be used by this Function App Slot. When `null`, the `storage_account_name` field will be omitted from the resulting object.\n  - `storage_key_vault_secret_id` (`string`): The Key Vault Secret ID, including version, that contains the Connection String to connect to the storage account for this Function App. When `null`, the `storage_key_vault_secret_id` field will be omitted from the resulting object.\n  - `storage_uses_managed_identity` (`bool`): Should the Function App Slot use its Managed Identity to access storage? When `null`, the `storage_uses_managed_identity` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting resource block. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting resource block. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting resource block. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting resource block. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting resource block. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting resource block. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.identity.new](#fn-identitynew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting resource block. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.site_config.new](#fn-site_confignew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting resource block. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`azurerm.windows_function_app_slot.new` injects a new `azurerm_windows_function_app_slot` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    azurerm.windows_function_app_slot.new('some_id')\n\nYou can get the reference to the `id` field of the created `azurerm.windows_function_app_slot` using the reference:\n\n    $._ref.azurerm_windows_function_app_slot.some_id.get('id')\n\nThis is the same as directly entering `\"${ azurerm_windows_function_app_slot.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `app_settings` (`obj`): A map of key-value pairs for [App Settings](https://docs.microsoft.com/en-us/azure/azure-functions/functions-app-settings) and custom values. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `builtin_logging_enabled` (`bool`): Should built in logging be enabled. Configures `AzureWebJobsDashboard` app setting based on the configured storage setting. When `null`, the `builtin_logging_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Should the Function App Slot use Client Certificates. When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): The mode of the Function App Slot\u0026#39;s client certificates requirement for incoming requests. Possible values are `Required`, `Optional`, and `OptionalInteractiveUser`. When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `content_share_force_disabled` (`bool`): Force disable the content share settings. When `null`, the `content_share_force_disabled` field will be omitted from the resulting object.\n  - `daily_memory_time_quota` (`number`): The amount of memory in gigabyte-seconds that your application is allowed to consume per day. Setting this value only affects function apps in Consumption Plans. When `null`, the `daily_memory_time_quota` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Is the Windows Function App Slot enabled. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `function_app_id` (`string`): The ID of the Windows Function App this Slot is a member of.\n  - `functions_extension_version` (`string`): The runtime version associated with the Function App Slot. When `null`, the `functions_extension_version` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Can the Function App Slot only be accessed via HTTPS? When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): The User Assigned Identity to use for Key Vault access. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `name` (`string`): Specifies the name of the Windows Function App Slot.\n  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting resource block. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.\n  - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting resource block. When `null`, the `service_plan_id` field will be omitted from the resulting object.\n  - `storage_account_access_key` (`string`): The access key which will be used to access the storage account for the Function App Slot. When `null`, the `storage_account_access_key` field will be omitted from the resulting object.\n  - `storage_account_name` (`string`): The backend storage account name which will be used by this Function App Slot. When `null`, the `storage_account_name` field will be omitted from the resulting object.\n  - `storage_key_vault_secret_id` (`string`): The Key Vault Secret ID, including version, that contains the Connection String to connect to the storage account for this Function App. When `null`, the `storage_key_vault_secret_id` field will be omitted from the resulting object.\n  - `storage_uses_managed_identity` (`bool`): Should the Function App Slot use its Managed Identity to access storage? When `null`, the `storage_uses_managed_identity` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting resource block. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting resource block. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting resource block. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting resource block. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting resource block. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting resource block. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.identity.new](#fn-identitynew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting resource block. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.site_config.new](#fn-site_confignew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting resource block. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     function_app_id,
@@ -399,6 +399,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     https_only=null,
     identity=null,
     key_vault_reference_identity_id=null,
+    public_network_access_enabled=null,
     service_plan_id=null,
     site_config=null,
     storage_account=null,
@@ -432,6 +433,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       identity=identity,
       key_vault_reference_identity_id=key_vault_reference_identity_id,
       name=name,
+      public_network_access_enabled=public_network_access_enabled,
       service_plan_id=service_plan_id,
       site_config=site_config,
       storage_account=storage_account,
@@ -445,7 +447,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`azurerm.windows_function_app_slot.newAttrs` constructs a new object with attributes and blocks configured for the `windows_function_app_slot`\nTerraform resource.\n\nUnlike [azurerm.windows_function_app_slot.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `app_settings` (`obj`): A map of key-value pairs for [App Settings](https://docs.microsoft.com/en-us/azure/azure-functions/functions-app-settings) and custom values. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `builtin_logging_enabled` (`bool`): Should built in logging be enabled. Configures `AzureWebJobsDashboard` app setting based on the configured storage setting. When `null`, the `builtin_logging_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Should the Function App Slot use Client Certificates. When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): The mode of the Function App Slot's client certificates requirement for incoming requests. Possible values are `Required`, `Optional`, and `OptionalInteractiveUser`. When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `content_share_force_disabled` (`bool`): Force disable the content share settings. When `null`, the `content_share_force_disabled` field will be omitted from the resulting object.\n  - `daily_memory_time_quota` (`number`): The amount of memory in gigabyte-seconds that your application is allowed to consume per day. Setting this value only affects function apps in Consumption Plans. When `null`, the `daily_memory_time_quota` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Is the Windows Function App Slot enabled. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `function_app_id` (`string`): The ID of the Windows Function App this Slot is a member of.\n  - `functions_extension_version` (`string`): The runtime version associated with the Function App Slot. When `null`, the `functions_extension_version` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Can the Function App Slot only be accessed via HTTPS? When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): The User Assigned Identity to use for Key Vault access. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `name` (`string`): Specifies the name of the Windows Function App Slot.\n  - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting object. When `null`, the `service_plan_id` field will be omitted from the resulting object.\n  - `storage_account_access_key` (`string`): The access key which will be used to access the storage account for the Function App Slot. When `null`, the `storage_account_access_key` field will be omitted from the resulting object.\n  - `storage_account_name` (`string`): The backend storage account name which will be used by this Function App Slot. When `null`, the `storage_account_name` field will be omitted from the resulting object.\n  - `storage_key_vault_secret_id` (`string`): The Key Vault Secret ID, including version, that contains the Connection String to connect to the storage account for this Function App. When `null`, the `storage_key_vault_secret_id` field will be omitted from the resulting object.\n  - `storage_uses_managed_identity` (`bool`): Should the Function App Slot use its Managed Identity to access storage? When `null`, the `storage_uses_managed_identity` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting object. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting object. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting object. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting object. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting object. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting object. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.identity.new](#fn-identitynew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting object. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.site_config.new](#fn-site_confignew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting object. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `windows_function_app_slot` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`azurerm.windows_function_app_slot.newAttrs` constructs a new object with attributes and blocks configured for the `windows_function_app_slot`\nTerraform resource.\n\nUnlike [azurerm.windows_function_app_slot.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `app_settings` (`obj`): A map of key-value pairs for [App Settings](https://docs.microsoft.com/en-us/azure/azure-functions/functions-app-settings) and custom values. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `builtin_logging_enabled` (`bool`): Should built in logging be enabled. Configures `AzureWebJobsDashboard` app setting based on the configured storage setting. When `null`, the `builtin_logging_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Should the Function App Slot use Client Certificates. When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): The mode of the Function App Slot's client certificates requirement for incoming requests. Possible values are `Required`, `Optional`, and `OptionalInteractiveUser`. When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `content_share_force_disabled` (`bool`): Force disable the content share settings. When `null`, the `content_share_force_disabled` field will be omitted from the resulting object.\n  - `daily_memory_time_quota` (`number`): The amount of memory in gigabyte-seconds that your application is allowed to consume per day. Setting this value only affects function apps in Consumption Plans. When `null`, the `daily_memory_time_quota` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Is the Windows Function App Slot enabled. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `function_app_id` (`string`): The ID of the Windows Function App this Slot is a member of.\n  - `functions_extension_version` (`string`): The runtime version associated with the Function App Slot. When `null`, the `functions_extension_version` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Can the Function App Slot only be accessed via HTTPS? When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): The User Assigned Identity to use for Key Vault access. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `name` (`string`): Specifies the name of the Windows Function App Slot.\n  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting object. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.\n  - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting object. When `null`, the `service_plan_id` field will be omitted from the resulting object.\n  - `storage_account_access_key` (`string`): The access key which will be used to access the storage account for the Function App Slot. When `null`, the `storage_account_access_key` field will be omitted from the resulting object.\n  - `storage_account_name` (`string`): The backend storage account name which will be used by this Function App Slot. When `null`, the `storage_account_name` field will be omitted from the resulting object.\n  - `storage_key_vault_secret_id` (`string`): The Key Vault Secret ID, including version, that contains the Connection String to connect to the storage account for this Function App. When `null`, the `storage_key_vault_secret_id` field will be omitted from the resulting object.\n  - `storage_uses_managed_identity` (`bool`): Should the Function App Slot use its Managed Identity to access storage? When `null`, the `storage_uses_managed_identity` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting object. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting object. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting object. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting object. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting object. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting object. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.identity.new](#fn-identitynew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting object. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.site_config.new](#fn-site_confignew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting object. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_function_app_slot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `windows_function_app_slot` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     function_app_id,
     name,
@@ -465,6 +467,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     https_only=null,
     identity=null,
     key_vault_reference_identity_id=null,
+    public_network_access_enabled=null,
     service_plan_id=null,
     site_config=null,
     storage_account=null,
@@ -494,6 +497,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     identity: identity,
     key_vault_reference_identity_id: key_vault_reference_identity_id,
     name: name,
+    public_network_access_enabled: public_network_access_enabled,
     service_plan_id: service_plan_id,
     site_config: site_config,
     storage_account: storage_account,
@@ -915,6 +919,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withPublicNetworkAccessEnabled':: d.fn(help='`azurerm.bool.withPublicNetworkAccessEnabled` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the public_network_access_enabled field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `public_network_access_enabled` field.\n', args=[]),
+  withPublicNetworkAccessEnabled(resourceLabel, value): {
+    resource+: {
+      azurerm_windows_function_app_slot+: {
+        [resourceLabel]+: {
+          public_network_access_enabled: value,
+        },
+      },
+    },
+  },
   '#withServicePlanId':: d.fn(help='`azurerm.string.withServicePlanId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the service_plan_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `service_plan_id` field.\n', args=[]),
   withServicePlanId(resourceLabel, value): {
     resource+: {
diff --git a/3.x/_gen/resources/windows_web_app.libsonnet b/3.x/_gen/resources/windows_web_app.libsonnet
index c900d480..ca6ade4a 100644
--- a/3.x/_gen/resources/windows_web_app.libsonnet
+++ b/3.x/_gen/resources/windows_web_app.libsonnet
@@ -444,7 +444,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       http_logs: http_logs,
     }),
   },
-  '#new':: d.fn(help="\n`azurerm.windows_web_app.new` injects a new `azurerm_windows_web_app` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    azurerm.windows_web_app.new('some_id')\n\nYou can get the reference to the `id` field of the created `azurerm.windows_web_app` using the reference:\n\n    $._ref.azurerm_windows_web_app.some_id.get('id')\n\nThis is the same as directly entering `\"${ azurerm_windows_web_app.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `app_settings` (`obj`): Set the `app_settings` field on the resulting resource block. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `client_affinity_enabled` (`bool`): Set the `client_affinity_enabled` field on the resulting resource block. When `null`, the `client_affinity_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Set the `client_certificate_enabled` field on the resulting resource block. When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): Set the `client_certificate_mode` field on the resulting resource block. When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Set the `enabled` field on the resulting resource block. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Set the `https_only` field on the resulting resource block. When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): Set the `key_vault_reference_identity_id` field on the resulting resource block. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting resource block.\n  - `name` (`string`): Set the `name` field on the resulting resource block.\n  - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting resource block.\n  - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting resource block.\n  - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting resource block. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `zip_deploy_file` (`string`): The local path and filename of the Zip packaged application to deploy to this Windows Web App. **Note:** Using this value requires either `WEBSITE_RUN_FROM_PACKAGE=1` or `SCM_DO_BUILD_DURING_DEPLOYMENT=true` to be set on the App in `app_settings`. When `null`, the `zip_deploy_file` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting resource block. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting resource block. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting resource block. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting resource block. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting resource block. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.identity.new](#fn-identitynew) constructor.\n  - `logs` (`list[obj]`): Set the `logs` field on the resulting resource block. When `null`, the `logs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.logs.new](#fn-logsnew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting resource block. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.site_config.new](#fn-site_confignew) constructor.\n  - `sticky_settings` (`list[obj]`): Set the `sticky_settings` field on the resulting resource block. When `null`, the `sticky_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.sticky_settings.new](#fn-sticky_settingsnew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting resource block. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`azurerm.windows_web_app.new` injects a new `azurerm_windows_web_app` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    azurerm.windows_web_app.new('some_id')\n\nYou can get the reference to the `id` field of the created `azurerm.windows_web_app` using the reference:\n\n    $._ref.azurerm_windows_web_app.some_id.get('id')\n\nThis is the same as directly entering `\"${ azurerm_windows_web_app.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `app_settings` (`obj`): Set the `app_settings` field on the resulting resource block. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `client_affinity_enabled` (`bool`): Set the `client_affinity_enabled` field on the resulting resource block. When `null`, the `client_affinity_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Set the `client_certificate_enabled` field on the resulting resource block. When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): Set the `client_certificate_mode` field on the resulting resource block. When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Set the `enabled` field on the resulting resource block. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Set the `https_only` field on the resulting resource block. When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): Set the `key_vault_reference_identity_id` field on the resulting resource block. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting resource block.\n  - `name` (`string`): Set the `name` field on the resulting resource block.\n  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting resource block. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.\n  - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting resource block.\n  - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting resource block.\n  - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting resource block. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `zip_deploy_file` (`string`): The local path and filename of the Zip packaged application to deploy to this Windows Web App. **Note:** Using this value requires either `WEBSITE_RUN_FROM_PACKAGE=1` or `SCM_DO_BUILD_DURING_DEPLOYMENT=true` to be set on the App in `app_settings`. When `null`, the `zip_deploy_file` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting resource block. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting resource block. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting resource block. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting resource block. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting resource block. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.identity.new](#fn-identitynew) constructor.\n  - `logs` (`list[obj]`): Set the `logs` field on the resulting resource block. When `null`, the `logs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.logs.new](#fn-logsnew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting resource block. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.site_config.new](#fn-site_confignew) constructor.\n  - `sticky_settings` (`list[obj]`): Set the `sticky_settings` field on the resulting resource block. When `null`, the `sticky_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.sticky_settings.new](#fn-sticky_settingsnew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting resource block. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -465,6 +465,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     identity=null,
     key_vault_reference_identity_id=null,
     logs=null,
+    public_network_access_enabled=null,
     site_config=null,
     sticky_settings=null,
     storage_account=null,
@@ -493,6 +494,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       location=location,
       logs=logs,
       name=name,
+      public_network_access_enabled=public_network_access_enabled,
       resource_group_name=resource_group_name,
       service_plan_id=service_plan_id,
       site_config=site_config,
@@ -505,7 +507,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`azurerm.windows_web_app.newAttrs` constructs a new object with attributes and blocks configured for the `windows_web_app`\nTerraform resource.\n\nUnlike [azurerm.windows_web_app.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `app_settings` (`obj`): Set the `app_settings` field on the resulting object. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `client_affinity_enabled` (`bool`): Set the `client_affinity_enabled` field on the resulting object. When `null`, the `client_affinity_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Set the `client_certificate_enabled` field on the resulting object. When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): Set the `client_certificate_mode` field on the resulting object. When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Set the `enabled` field on the resulting object. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Set the `https_only` field on the resulting object. When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): Set the `key_vault_reference_identity_id` field on the resulting object. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting object.\n  - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting object. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `zip_deploy_file` (`string`): The local path and filename of the Zip packaged application to deploy to this Windows Web App. **Note:** Using this value requires either `WEBSITE_RUN_FROM_PACKAGE=1` or `SCM_DO_BUILD_DURING_DEPLOYMENT=true` to be set on the App in `app_settings`. When `null`, the `zip_deploy_file` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting object. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting object. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting object. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting object. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting object. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.identity.new](#fn-identitynew) constructor.\n  - `logs` (`list[obj]`): Set the `logs` field on the resulting object. When `null`, the `logs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.logs.new](#fn-logsnew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting object. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.site_config.new](#fn-site_confignew) constructor.\n  - `sticky_settings` (`list[obj]`): Set the `sticky_settings` field on the resulting object. When `null`, the `sticky_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.sticky_settings.new](#fn-sticky_settingsnew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting object. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `windows_web_app` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`azurerm.windows_web_app.newAttrs` constructs a new object with attributes and blocks configured for the `windows_web_app`\nTerraform resource.\n\nUnlike [azurerm.windows_web_app.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `app_settings` (`obj`): Set the `app_settings` field on the resulting object. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `client_affinity_enabled` (`bool`): Set the `client_affinity_enabled` field on the resulting object. When `null`, the `client_affinity_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Set the `client_certificate_enabled` field on the resulting object. When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): Set the `client_certificate_mode` field on the resulting object. When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Set the `enabled` field on the resulting object. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Set the `https_only` field on the resulting object. When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): Set the `key_vault_reference_identity_id` field on the resulting object. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting object. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.\n  - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting object.\n  - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting object. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `zip_deploy_file` (`string`): The local path and filename of the Zip packaged application to deploy to this Windows Web App. **Note:** Using this value requires either `WEBSITE_RUN_FROM_PACKAGE=1` or `SCM_DO_BUILD_DURING_DEPLOYMENT=true` to be set on the App in `app_settings`. When `null`, the `zip_deploy_file` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting object. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting object. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting object. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting object. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting object. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.identity.new](#fn-identitynew) constructor.\n  - `logs` (`list[obj]`): Set the `logs` field on the resulting object. When `null`, the `logs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.logs.new](#fn-logsnew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting object. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.site_config.new](#fn-site_confignew) constructor.\n  - `sticky_settings` (`list[obj]`): Set the `sticky_settings` field on the resulting object. When `null`, the `sticky_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.sticky_settings.new](#fn-sticky_settingsnew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting object. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `windows_web_app` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
@@ -525,6 +527,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     identity=null,
     key_vault_reference_identity_id=null,
     logs=null,
+    public_network_access_enabled=null,
     site_config=null,
     sticky_settings=null,
     storage_account=null,
@@ -549,6 +552,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     location: location,
     logs: logs,
     name: name,
+    public_network_access_enabled: public_network_access_enabled,
     resource_group_name: resource_group_name,
     service_plan_id: service_plan_id,
     site_config: site_config,
@@ -1093,6 +1097,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withPublicNetworkAccessEnabled':: d.fn(help='`azurerm.bool.withPublicNetworkAccessEnabled` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the public_network_access_enabled field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `public_network_access_enabled` field.\n', args=[]),
+  withPublicNetworkAccessEnabled(resourceLabel, value): {
+    resource+: {
+      azurerm_windows_web_app+: {
+        [resourceLabel]+: {
+          public_network_access_enabled: value,
+        },
+      },
+    },
+  },
   '#withResourceGroupName':: d.fn(help='`azurerm.string.withResourceGroupName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the resource_group_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `resource_group_name` field.\n', args=[]),
   withResourceGroupName(resourceLabel, value): {
     resource+: {
diff --git a/3.x/_gen/resources/windows_web_app_slot.libsonnet b/3.x/_gen/resources/windows_web_app_slot.libsonnet
index 19317344..ab726f83 100644
--- a/3.x/_gen/resources/windows_web_app_slot.libsonnet
+++ b/3.x/_gen/resources/windows_web_app_slot.libsonnet
@@ -444,7 +444,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       http_logs: http_logs,
     }),
   },
-  '#new':: d.fn(help="\n`azurerm.windows_web_app_slot.new` injects a new `azurerm_windows_web_app_slot` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    azurerm.windows_web_app_slot.new('some_id')\n\nYou can get the reference to the `id` field of the created `azurerm.windows_web_app_slot` using the reference:\n\n    $._ref.azurerm_windows_web_app_slot.some_id.get('id')\n\nThis is the same as directly entering `\"${ azurerm_windows_web_app_slot.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `app_service_id` (`string`): Set the `app_service_id` field on the resulting resource block.\n  - `app_settings` (`obj`): Set the `app_settings` field on the resulting resource block. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `client_affinity_enabled` (`bool`): Set the `client_affinity_enabled` field on the resulting resource block. When `null`, the `client_affinity_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Set the `client_certificate_enabled` field on the resulting resource block. When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): Set the `client_certificate_mode` field on the resulting resource block. When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Set the `enabled` field on the resulting resource block. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Set the `https_only` field on the resulting resource block. When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): Set the `key_vault_reference_identity_id` field on the resulting resource block. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting resource block.\n  - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting resource block. When `null`, the `service_plan_id` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting resource block. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `zip_deploy_file` (`string`): The local path and filename of the Zip packaged application to deploy to this Windows Web App. **Note:** Using this value requires `WEBSITE_RUN_FROM_PACKAGE=1` on the App in `app_settings`. When `null`, the `zip_deploy_file` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting resource block. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting resource block. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting resource block. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting resource block. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting resource block. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.identity.new](#fn-identitynew) constructor.\n  - `logs` (`list[obj]`): Set the `logs` field on the resulting resource block. When `null`, the `logs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.logs.new](#fn-logsnew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting resource block. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.site_config.new](#fn-site_confignew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting resource block. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`azurerm.windows_web_app_slot.new` injects a new `azurerm_windows_web_app_slot` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    azurerm.windows_web_app_slot.new('some_id')\n\nYou can get the reference to the `id` field of the created `azurerm.windows_web_app_slot` using the reference:\n\n    $._ref.azurerm_windows_web_app_slot.some_id.get('id')\n\nThis is the same as directly entering `\"${ azurerm_windows_web_app_slot.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `app_service_id` (`string`): Set the `app_service_id` field on the resulting resource block.\n  - `app_settings` (`obj`): Set the `app_settings` field on the resulting resource block. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `client_affinity_enabled` (`bool`): Set the `client_affinity_enabled` field on the resulting resource block. When `null`, the `client_affinity_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Set the `client_certificate_enabled` field on the resulting resource block. When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): Set the `client_certificate_mode` field on the resulting resource block. When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Set the `enabled` field on the resulting resource block. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Set the `https_only` field on the resulting resource block. When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): Set the `key_vault_reference_identity_id` field on the resulting resource block. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting resource block.\n  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting resource block. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.\n  - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting resource block. When `null`, the `service_plan_id` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting resource block. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `zip_deploy_file` (`string`): The local path and filename of the Zip packaged application to deploy to this Windows Web App. **Note:** Using this value requires `WEBSITE_RUN_FROM_PACKAGE=1` on the App in `app_settings`. When `null`, the `zip_deploy_file` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting resource block. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting resource block. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting resource block. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting resource block. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting resource block. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.identity.new](#fn-identitynew) constructor.\n  - `logs` (`list[obj]`): Set the `logs` field on the resulting resource block. When `null`, the `logs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.logs.new](#fn-logsnew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting resource block. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.site_config.new](#fn-site_confignew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting resource block. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     app_service_id,
@@ -463,6 +463,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     identity=null,
     key_vault_reference_identity_id=null,
     logs=null,
+    public_network_access_enabled=null,
     service_plan_id=null,
     site_config=null,
     storage_account=null,
@@ -491,6 +492,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       key_vault_reference_identity_id=key_vault_reference_identity_id,
       logs=logs,
       name=name,
+      public_network_access_enabled=public_network_access_enabled,
       service_plan_id=service_plan_id,
       site_config=site_config,
       storage_account=storage_account,
@@ -501,7 +503,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`azurerm.windows_web_app_slot.newAttrs` constructs a new object with attributes and blocks configured for the `windows_web_app_slot`\nTerraform resource.\n\nUnlike [azurerm.windows_web_app_slot.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `app_service_id` (`string`): Set the `app_service_id` field on the resulting object.\n  - `app_settings` (`obj`): Set the `app_settings` field on the resulting object. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `client_affinity_enabled` (`bool`): Set the `client_affinity_enabled` field on the resulting object. When `null`, the `client_affinity_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Set the `client_certificate_enabled` field on the resulting object. When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): Set the `client_certificate_mode` field on the resulting object. When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Set the `enabled` field on the resulting object. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Set the `https_only` field on the resulting object. When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): Set the `key_vault_reference_identity_id` field on the resulting object. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting object. When `null`, the `service_plan_id` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting object. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `zip_deploy_file` (`string`): The local path and filename of the Zip packaged application to deploy to this Windows Web App. **Note:** Using this value requires `WEBSITE_RUN_FROM_PACKAGE=1` on the App in `app_settings`. When `null`, the `zip_deploy_file` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting object. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting object. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting object. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting object. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting object. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.identity.new](#fn-identitynew) constructor.\n  - `logs` (`list[obj]`): Set the `logs` field on the resulting object. When `null`, the `logs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.logs.new](#fn-logsnew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting object. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.site_config.new](#fn-site_confignew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting object. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `windows_web_app_slot` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`azurerm.windows_web_app_slot.newAttrs` constructs a new object with attributes and blocks configured for the `windows_web_app_slot`\nTerraform resource.\n\nUnlike [azurerm.windows_web_app_slot.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `app_service_id` (`string`): Set the `app_service_id` field on the resulting object.\n  - `app_settings` (`obj`): Set the `app_settings` field on the resulting object. When `null`, the `app_settings` field will be omitted from the resulting object.\n  - `client_affinity_enabled` (`bool`): Set the `client_affinity_enabled` field on the resulting object. When `null`, the `client_affinity_enabled` field will be omitted from the resulting object.\n  - `client_certificate_enabled` (`bool`): Set the `client_certificate_enabled` field on the resulting object. When `null`, the `client_certificate_enabled` field will be omitted from the resulting object.\n  - `client_certificate_exclusion_paths` (`string`): Paths to exclude when using client certificates, separated by ; When `null`, the `client_certificate_exclusion_paths` field will be omitted from the resulting object.\n  - `client_certificate_mode` (`string`): Set the `client_certificate_mode` field on the resulting object. When `null`, the `client_certificate_mode` field will be omitted from the resulting object.\n  - `enabled` (`bool`): Set the `enabled` field on the resulting object. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `https_only` (`bool`): Set the `https_only` field on the resulting object. When `null`, the `https_only` field will be omitted from the resulting object.\n  - `key_vault_reference_identity_id` (`string`): Set the `key_vault_reference_identity_id` field on the resulting object. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting object. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.\n  - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting object. When `null`, the `service_plan_id` field will be omitted from the resulting object.\n  - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.\n  - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting object. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.\n  - `zip_deploy_file` (`string`): The local path and filename of the Zip packaged application to deploy to this Windows Web App. **Note:** Using this value requires `WEBSITE_RUN_FROM_PACKAGE=1` on the App in `app_settings`. When `null`, the `zip_deploy_file` field will be omitted from the resulting object.\n  - `auth_settings` (`list[obj]`): Set the `auth_settings` field on the resulting object. When `null`, the `auth_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.auth_settings.new](#fn-auth_settingsnew) constructor.\n  - `auth_settings_v2` (`list[obj]`): Set the `auth_settings_v2` field on the resulting object. When `null`, the `auth_settings_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.auth_settings_v2.new](#fn-auth_settings_v2new) constructor.\n  - `backup` (`list[obj]`): Set the `backup` field on the resulting object. When `null`, the `backup` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.backup.new](#fn-backupnew) constructor.\n  - `connection_string` (`list[obj]`): Set the `connection_string` field on the resulting object. When `null`, the `connection_string` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.connection_string.new](#fn-connection_stringnew) constructor.\n  - `identity` (`list[obj]`): Set the `identity` field on the resulting object. When `null`, the `identity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.identity.new](#fn-identitynew) constructor.\n  - `logs` (`list[obj]`): Set the `logs` field on the resulting object. When `null`, the `logs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.logs.new](#fn-logsnew) constructor.\n  - `site_config` (`list[obj]`): Set the `site_config` field on the resulting object. When `null`, the `site_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.site_config.new](#fn-site_confignew) constructor.\n  - `storage_account` (`list[obj]`): Set the `storage_account` field on the resulting object. When `null`, the `storage_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.storage_account.new](#fn-storage_accountnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.windows_web_app_slot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `windows_web_app_slot` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     app_service_id,
     name,
@@ -519,6 +521,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     identity=null,
     key_vault_reference_identity_id=null,
     logs=null,
+    public_network_access_enabled=null,
     service_plan_id=null,
     site_config=null,
     storage_account=null,
@@ -543,6 +546,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     key_vault_reference_identity_id: key_vault_reference_identity_id,
     logs: logs,
     name: name,
+    public_network_access_enabled: public_network_access_enabled,
     service_plan_id: service_plan_id,
     site_config: site_config,
     storage_account: storage_account,
@@ -1077,6 +1081,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withPublicNetworkAccessEnabled':: d.fn(help='`azurerm.bool.withPublicNetworkAccessEnabled` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the public_network_access_enabled field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `public_network_access_enabled` field.\n', args=[]),
+  withPublicNetworkAccessEnabled(resourceLabel, value): {
+    resource+: {
+      azurerm_windows_web_app_slot+: {
+        [resourceLabel]+: {
+          public_network_access_enabled: value,
+        },
+      },
+    },
+  },
   '#withServicePlanId':: d.fn(help='`azurerm.string.withServicePlanId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the service_plan_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `service_plan_id` field.\n', args=[]),
   withServicePlanId(resourceLabel, value): {
     resource+: {
diff --git a/docs/3.x/README.md b/docs/3.x/README.md
index 18fab95d..066ab702 100644
--- a/docs/3.x/README.md
+++ b/docs/3.x/README.md
@@ -101,6 +101,7 @@ project.
 * [arc_kubernetes_cluster_extension](arc_kubernetes_cluster_extension.md)
 * [arc_kubernetes_flux_configuration](arc_kubernetes_flux_configuration.md)
 * [arc_machine_extension](arc_machine_extension.md)
+* [arc_private_link_scope](arc_private_link_scope.md)
 * [attestation_provider](attestation_provider.md)
 * [automanage_configuration](automanage_configuration.md)
 * [automation_account](automation_account.md)
@@ -444,6 +445,7 @@ project.
 * [kusto_cluster_customer_managed_key](kusto_cluster_customer_managed_key.md)
 * [kusto_cluster_managed_private_endpoint](kusto_cluster_managed_private_endpoint.md)
 * [kusto_cluster_principal_assignment](kusto_cluster_principal_assignment.md)
+* [kusto_cosmosdb_data_connection](kusto_cosmosdb_data_connection.md)
 * [kusto_database](kusto_database.md)
 * [kusto_database_principal_assignment](kusto_database_principal_assignment.md)
 * [kusto_eventgrid_data_connection](kusto_eventgrid_data_connection.md)
@@ -661,6 +663,8 @@ project.
 * [orbital_contact_profile](orbital_contact_profile.md)
 * [orbital_spacecraft](orbital_spacecraft.md)
 * [orchestrated_virtual_machine_scale_set](orchestrated_virtual_machine_scale_set.md)
+* [pim_active_role_assignment](pim_active_role_assignment.md)
+* [pim_eligible_role_assignment](pim_eligible_role_assignment.md)
 * [point_to_site_vpn_gateway](point_to_site_vpn_gateway.md)
 * [policy_definition](policy_definition.md)
 * [policy_set_definition](policy_set_definition.md)
diff --git a/docs/3.x/arc_private_link_scope.md b/docs/3.x/arc_private_link_scope.md
new file mode 100644
index 00000000..00a994fb
--- /dev/null
+++ b/docs/3.x/arc_private_link_scope.md
@@ -0,0 +1,236 @@
+---
+permalink: /arc_private_link_scope/
+---
+
+# arc_private_link_scope
+
+`arc_private_link_scope` represents the `azurerm_arc_private_link_scope` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withPublicNetworkAccessEnabled()`](#fn-withpublicnetworkaccessenabled)
+* [`fn withResourceGroupName()`](#fn-withresourcegroupname)
+* [`fn withTags()`](#fn-withtags)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`azurerm.arc_private_link_scope.new` injects a new `azurerm_arc_private_link_scope` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    azurerm.arc_private_link_scope.new('some_id')
+
+You can get the reference to the `id` field of the created `azurerm.arc_private_link_scope` using the reference:
+
+    $._ref.azurerm_arc_private_link_scope.some_id.get('id')
+
+This is the same as directly entering `"${ azurerm_arc_private_link_scope.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `location` (`string`): Set the `location` field on the resulting resource block.
+  - `name` (`string`): Set the `name` field on the resulting resource block.
+  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting resource block. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.
+  - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting resource block.
+  - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.arc_private_link_scope.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`azurerm.arc_private_link_scope.newAttrs` constructs a new object with attributes and blocks configured for the `arc_private_link_scope`
+Terraform resource.
+
+Unlike [azurerm.arc_private_link_scope.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `location` (`string`): Set the `location` field on the resulting object.
+  - `name` (`string`): Set the `name` field on the resulting object.
+  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting object. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.
+  - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting object.
+  - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.arc_private_link_scope.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `arc_private_link_scope` resource into the root Terraform configuration.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`azurerm.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`azurerm.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withPublicNetworkAccessEnabled
+
+```ts
+withPublicNetworkAccessEnabled()
+```
+
+`azurerm.bool.withPublicNetworkAccessEnabled` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the public_network_access_enabled field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `public_network_access_enabled` field.
+
+
+### fn withResourceGroupName
+
+```ts
+withResourceGroupName()
+```
+
+`azurerm.string.withResourceGroupName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the resource_group_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `resource_group_name` field.
+
+
+### fn withTags
+
+```ts
+withTags()
+```
+
+`azurerm.obj.withTags` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the tags field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `tags` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`azurerm.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [azurerm.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`azurerm.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [azurerm.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`azurerm.arc_private_link_scope.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `read` (`string`): Set the `read` field on the resulting object. When `null`, the `read` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/3.x/attestation_provider.md b/docs/3.x/attestation_provider.md
index 21dc00d8..4b64c076 100644
--- a/docs/3.x/attestation_provider.md
+++ b/docs/3.x/attestation_provider.md
@@ -22,6 +22,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withPolicyMixin()`](#fn-withpolicymixin)
 * [`fn withPolicySigningCertificateData()`](#fn-withpolicysigningcertificatedata)
 * [`fn withResourceGroupName()`](#fn-withresourcegroupname)
+* [`fn withSevSnpPolicyBase64()`](#fn-withsevsnppolicybase64)
 * [`fn withSgxEnclavePolicyBase64()`](#fn-withsgxenclavepolicybase64)
 * [`fn withTags()`](#fn-withtags)
 * [`fn withTimeouts()`](#fn-withtimeouts)
@@ -66,6 +67,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `open_enclave_policy_base64` (`string`): Set the `open_enclave_policy_base64` field on the resulting resource block. When `null`, the `open_enclave_policy_base64` field will be omitted from the resulting object.
   - `policy_signing_certificate_data` (`string`): Set the `policy_signing_certificate_data` field on the resulting resource block. When `null`, the `policy_signing_certificate_data` field will be omitted from the resulting object.
   - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting resource block.
+  - `sev_snp_policy_base64` (`string`): Set the `sev_snp_policy_base64` field on the resulting resource block. When `null`, the `sev_snp_policy_base64` field will be omitted from the resulting object.
   - `sgx_enclave_policy_base64` (`string`): Set the `sgx_enclave_policy_base64` field on the resulting resource block. When `null`, the `sgx_enclave_policy_base64` field will be omitted from the resulting object.
   - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.
   - `tpm_policy_base64` (`string`): Set the `tpm_policy_base64` field on the resulting resource block. When `null`, the `tpm_policy_base64` field will be omitted from the resulting object.
@@ -99,6 +101,7 @@ injecting into a complete block.
   - `open_enclave_policy_base64` (`string`): Set the `open_enclave_policy_base64` field on the resulting object. When `null`, the `open_enclave_policy_base64` field will be omitted from the resulting object.
   - `policy_signing_certificate_data` (`string`): Set the `policy_signing_certificate_data` field on the resulting object. When `null`, the `policy_signing_certificate_data` field will be omitted from the resulting object.
   - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting object.
+  - `sev_snp_policy_base64` (`string`): Set the `sev_snp_policy_base64` field on the resulting object. When `null`, the `sev_snp_policy_base64` field will be omitted from the resulting object.
   - `sgx_enclave_policy_base64` (`string`): Set the `sgx_enclave_policy_base64` field on the resulting object. When `null`, the `sgx_enclave_policy_base64` field will be omitted from the resulting object.
   - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.
   - `tpm_policy_base64` (`string`): Set the `tpm_policy_base64` field on the resulting object. When `null`, the `tpm_policy_base64` field will be omitted from the resulting object.
@@ -226,6 +229,22 @@ Terraform resource block to set or update the resource_group_name field.
   - `value` (`string`): The value to set for the `resource_group_name` field.
 
 
+### fn withSevSnpPolicyBase64
+
+```ts
+withSevSnpPolicyBase64()
+```
+
+`azurerm.string.withSevSnpPolicyBase64` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the sev_snp_policy_base64 field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `sev_snp_policy_base64` field.
+
+
 ### fn withSgxEnclavePolicyBase64
 
 ```ts
diff --git a/docs/3.x/cognitive_deployment.md b/docs/3.x/cognitive_deployment.md
index 18c140f0..71d567fc 100644
--- a/docs/3.x/cognitive_deployment.md
+++ b/docs/3.x/cognitive_deployment.md
@@ -300,6 +300,10 @@ Terraform sub block.
 
 
 **Args**:
+  - `capacity` (`number`): Set the `capacity` field on the resulting object. When `null`, the `capacity` field will be omitted from the resulting object.
+  - `family` (`string`): Set the `family` field on the resulting object. When `null`, the `family` field will be omitted from the resulting object.
+  - `size` (`string`): Set the `size` field on the resulting object. When `null`, the `size` field will be omitted from the resulting object.
+  - `tier` (`string`): Set the `tier` field on the resulting object. When `null`, the `tier` field will be omitted from the resulting object.
   - `type` (`string`): Set the `type` field on the resulting object.
 
 **Returns**:
diff --git a/docs/3.x/data/automation_variables.md b/docs/3.x/data/automation_variables.md
new file mode 100644
index 00000000..74d19560
--- /dev/null
+++ b/docs/3.x/data/automation_variables.md
@@ -0,0 +1,157 @@
+---
+permalink: /data/automation_variables/
+---
+
+# data.automation_variables
+
+`automation_variables` represents the `azurerm_automation_variables` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAutomationAccountId()`](#fn-withautomationaccountid)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`azurerm.data.automation_variables.new` injects a new `data_azurerm_automation_variables` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    azurerm.data.automation_variables.new('some_id')
+
+You can get the reference to the `id` field of the created `azurerm.data.automation_variables` using the reference:
+
+    $._ref.data_azurerm_automation_variables.some_id.get('id')
+
+This is the same as directly entering `"${ data_azurerm_automation_variables.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `automation_account_id` (`string`): Set the `automation_account_id` field on the resulting data source block.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting data source block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.data.automation_variables.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`azurerm.data.automation_variables.newAttrs` constructs a new object with attributes and blocks configured for the `automation_variables`
+Terraform data source.
+
+Unlike [azurerm.data.automation_variables.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `automation_account_id` (`string`): Set the `automation_account_id` field on the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.data.automation_variables.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `automation_variables` data source into the root Terraform configuration.
+
+
+### fn withAutomationAccountId
+
+```ts
+withAutomationAccountId()
+```
+
+`azurerm.string.withAutomationAccountId` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the automation_account_id field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `automation_account_id` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`azurerm.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform data source block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [azurerm.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`azurerm.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform data source block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [azurerm.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`azurerm.automation_variables.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `read` (`string`): Set the `read` field on the resulting object. When `null`, the `read` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/3.x/data/index.md b/docs/3.x/data/index.md
index b3e3b592..8996f70d 100644
--- a/docs/3.x/data/index.md
+++ b/docs/3.x/data/index.md
@@ -36,6 +36,7 @@ permalink: /data/
 * [automation_variable_datetime](automation_variable_datetime.md)
 * [automation_variable_int](automation_variable_int.md)
 * [automation_variable_string](automation_variable_string.md)
+* [automation_variables](automation_variables.md)
 * [availability_set](availability_set.md)
 * [backup_policy_file_share](backup_policy_file_share.md)
 * [backup_policy_vm](backup_policy_vm.md)
diff --git a/docs/3.x/kusto_cosmosdb_data_connection.md b/docs/3.x/kusto_cosmosdb_data_connection.md
new file mode 100644
index 00000000..1f88ce08
--- /dev/null
+++ b/docs/3.x/kusto_cosmosdb_data_connection.md
@@ -0,0 +1,292 @@
+---
+permalink: /kusto_cosmosdb_data_connection/
+---
+
+# kusto_cosmosdb_data_connection
+
+`kusto_cosmosdb_data_connection` represents the `azurerm_kusto_cosmosdb_data_connection` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCosmosdbContainerId()`](#fn-withcosmosdbcontainerid)
+* [`fn withKustoDatabaseId()`](#fn-withkustodatabaseid)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withManagedIdentityId()`](#fn-withmanagedidentityid)
+* [`fn withMappingRuleName()`](#fn-withmappingrulename)
+* [`fn withName()`](#fn-withname)
+* [`fn withRetrievalStartDate()`](#fn-withretrievalstartdate)
+* [`fn withTableName()`](#fn-withtablename)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`azurerm.kusto_cosmosdb_data_connection.new` injects a new `azurerm_kusto_cosmosdb_data_connection` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    azurerm.kusto_cosmosdb_data_connection.new('some_id')
+
+You can get the reference to the `id` field of the created `azurerm.kusto_cosmosdb_data_connection` using the reference:
+
+    $._ref.azurerm_kusto_cosmosdb_data_connection.some_id.get('id')
+
+This is the same as directly entering `"${ azurerm_kusto_cosmosdb_data_connection.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `cosmosdb_container_id` (`string`): Set the `cosmosdb_container_id` field on the resulting resource block.
+  - `kusto_database_id` (`string`): Set the `kusto_database_id` field on the resulting resource block.
+  - `location` (`string`): Set the `location` field on the resulting resource block.
+  - `managed_identity_id` (`string`): Set the `managed_identity_id` field on the resulting resource block.
+  - `mapping_rule_name` (`string`): Set the `mapping_rule_name` field on the resulting resource block. When `null`, the `mapping_rule_name` field will be omitted from the resulting object.
+  - `name` (`string`): Set the `name` field on the resulting resource block.
+  - `retrieval_start_date` (`string`): Set the `retrieval_start_date` field on the resulting resource block. When `null`, the `retrieval_start_date` field will be omitted from the resulting object.
+  - `table_name` (`string`): Set the `table_name` field on the resulting resource block.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.kusto_cosmosdb_data_connection.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`azurerm.kusto_cosmosdb_data_connection.newAttrs` constructs a new object with attributes and blocks configured for the `kusto_cosmosdb_data_connection`
+Terraform resource.
+
+Unlike [azurerm.kusto_cosmosdb_data_connection.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `cosmosdb_container_id` (`string`): Set the `cosmosdb_container_id` field on the resulting object.
+  - `kusto_database_id` (`string`): Set the `kusto_database_id` field on the resulting object.
+  - `location` (`string`): Set the `location` field on the resulting object.
+  - `managed_identity_id` (`string`): Set the `managed_identity_id` field on the resulting object.
+  - `mapping_rule_name` (`string`): Set the `mapping_rule_name` field on the resulting object. When `null`, the `mapping_rule_name` field will be omitted from the resulting object.
+  - `name` (`string`): Set the `name` field on the resulting object.
+  - `retrieval_start_date` (`string`): Set the `retrieval_start_date` field on the resulting object. When `null`, the `retrieval_start_date` field will be omitted from the resulting object.
+  - `table_name` (`string`): Set the `table_name` field on the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.kusto_cosmosdb_data_connection.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `kusto_cosmosdb_data_connection` resource into the root Terraform configuration.
+
+
+### fn withCosmosdbContainerId
+
+```ts
+withCosmosdbContainerId()
+```
+
+`azurerm.string.withCosmosdbContainerId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the cosmosdb_container_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `cosmosdb_container_id` field.
+
+
+### fn withKustoDatabaseId
+
+```ts
+withKustoDatabaseId()
+```
+
+`azurerm.string.withKustoDatabaseId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the kusto_database_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `kusto_database_id` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`azurerm.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withManagedIdentityId
+
+```ts
+withManagedIdentityId()
+```
+
+`azurerm.string.withManagedIdentityId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the managed_identity_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `managed_identity_id` field.
+
+
+### fn withMappingRuleName
+
+```ts
+withMappingRuleName()
+```
+
+`azurerm.string.withMappingRuleName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the mapping_rule_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `mapping_rule_name` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`azurerm.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withRetrievalStartDate
+
+```ts
+withRetrievalStartDate()
+```
+
+`azurerm.string.withRetrievalStartDate` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the retrieval_start_date field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `retrieval_start_date` field.
+
+
+### fn withTableName
+
+```ts
+withTableName()
+```
+
+`azurerm.string.withTableName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the table_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `table_name` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`azurerm.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [azurerm.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`azurerm.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [azurerm.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`azurerm.kusto_cosmosdb_data_connection.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `read` (`string`): Set the `read` field on the resulting object. When `null`, the `read` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/3.x/linux_function_app.md b/docs/3.x/linux_function_app.md
index 5836f35c..36f4881c 100644
--- a/docs/3.x/linux_function_app.md
+++ b/docs/3.x/linux_function_app.md
@@ -38,6 +38,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withKeyVaultReferenceIdentityId()`](#fn-withkeyvaultreferenceidentityid)
 * [`fn withLocation()`](#fn-withlocation)
 * [`fn withName()`](#fn-withname)
+* [`fn withPublicNetworkAccessEnabled()`](#fn-withpublicnetworkaccessenabled)
 * [`fn withResourceGroupName()`](#fn-withresourcegroupname)
 * [`fn withServicePlanId()`](#fn-withserviceplanid)
 * [`fn withSiteConfig()`](#fn-withsiteconfig)
@@ -162,6 +163,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `key_vault_reference_identity_id` (`string`): The User Assigned Identity to use for Key Vault access. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.
   - `location` (`string`): Set the `location` field on the resulting resource block.
   - `name` (`string`): Specifies the name of the Function App.
+  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting resource block. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.
   - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting resource block.
   - `service_plan_id` (`string`): The ID of the App Service Plan within which to create this Function App
   - `storage_account_access_key` (`string`): The access key which will be used to access the storage account for the Function App. When `null`, the `storage_account_access_key` field will be omitted from the resulting object.
@@ -216,6 +218,7 @@ injecting into a complete block.
   - `key_vault_reference_identity_id` (`string`): The User Assigned Identity to use for Key Vault access. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.
   - `location` (`string`): Set the `location` field on the resulting object.
   - `name` (`string`): Specifies the name of the Function App.
+  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting object. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.
   - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting object.
   - `service_plan_id` (`string`): The ID of the App Service Plan within which to create this Function App
   - `storage_account_access_key` (`string`): The access key which will be used to access the storage account for the Function App. When `null`, the `storage_account_access_key` field will be omitted from the resulting object.
@@ -632,6 +635,22 @@ Terraform resource block to set or update the name field.
   - `value` (`string`): The value to set for the `name` field.
 
 
+### fn withPublicNetworkAccessEnabled
+
+```ts
+withPublicNetworkAccessEnabled()
+```
+
+`azurerm.bool.withPublicNetworkAccessEnabled` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the public_network_access_enabled field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `public_network_access_enabled` field.
+
+
 ### fn withResourceGroupName
 
 ```ts
diff --git a/docs/3.x/linux_function_app_slot.md b/docs/3.x/linux_function_app_slot.md
index b97d8298..3e42b90e 100644
--- a/docs/3.x/linux_function_app_slot.md
+++ b/docs/3.x/linux_function_app_slot.md
@@ -38,6 +38,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withIdentityMixin()`](#fn-withidentitymixin)
 * [`fn withKeyVaultReferenceIdentityId()`](#fn-withkeyvaultreferenceidentityid)
 * [`fn withName()`](#fn-withname)
+* [`fn withPublicNetworkAccessEnabled()`](#fn-withpublicnetworkaccessenabled)
 * [`fn withServicePlanId()`](#fn-withserviceplanid)
 * [`fn withSiteConfig()`](#fn-withsiteconfig)
 * [`fn withSiteConfigMixin()`](#fn-withsiteconfigmixin)
@@ -156,6 +157,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `https_only` (`bool`): Can the Function App Slot only be accessed via HTTPS? When `null`, the `https_only` field will be omitted from the resulting object.
   - `key_vault_reference_identity_id` (`string`): The User Assigned Identity to use for Key Vault access. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.
   - `name` (`string`): Specifies the name of the Function App Slot.
+  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting resource block. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.
   - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting resource block. When `null`, the `service_plan_id` field will be omitted from the resulting object.
   - `storage_account_access_key` (`string`): The access key which will be used to access the storage account for the Function App Slot. When `null`, the `storage_account_access_key` field will be omitted from the resulting object.
   - `storage_account_name` (`string`): The backend storage account name which will be used by this Function App Slot. When `null`, the `storage_account_name` field will be omitted from the resulting object.
@@ -207,6 +209,7 @@ injecting into a complete block.
   - `https_only` (`bool`): Can the Function App Slot only be accessed via HTTPS? When `null`, the `https_only` field will be omitted from the resulting object.
   - `key_vault_reference_identity_id` (`string`): The User Assigned Identity to use for Key Vault access. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.
   - `name` (`string`): Specifies the name of the Function App Slot.
+  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting object. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.
   - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting object. When `null`, the `service_plan_id` field will be omitted from the resulting object.
   - `storage_account_access_key` (`string`): The access key which will be used to access the storage account for the Function App Slot. When `null`, the `storage_account_access_key` field will be omitted from the resulting object.
   - `storage_account_name` (`string`): The backend storage account name which will be used by this Function App Slot. When `null`, the `storage_account_name` field will be omitted from the resulting object.
@@ -620,6 +623,22 @@ Terraform resource block to set or update the name field.
   - `value` (`string`): The value to set for the `name` field.
 
 
+### fn withPublicNetworkAccessEnabled
+
+```ts
+withPublicNetworkAccessEnabled()
+```
+
+`azurerm.bool.withPublicNetworkAccessEnabled` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the public_network_access_enabled field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `public_network_access_enabled` field.
+
+
 ### fn withServicePlanId
 
 ```ts
diff --git a/docs/3.x/linux_web_app.md b/docs/3.x/linux_web_app.md
index 797bdf89..4ad7b15a 100644
--- a/docs/3.x/linux_web_app.md
+++ b/docs/3.x/linux_web_app.md
@@ -37,6 +37,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withLogs()`](#fn-withlogs)
 * [`fn withLogsMixin()`](#fn-withlogsmixin)
 * [`fn withName()`](#fn-withname)
+* [`fn withPublicNetworkAccessEnabled()`](#fn-withpublicnetworkaccessenabled)
 * [`fn withResourceGroupName()`](#fn-withresourcegroupname)
 * [`fn withServicePlanId()`](#fn-withserviceplanid)
 * [`fn withSiteConfig()`](#fn-withsiteconfig)
@@ -174,6 +175,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `key_vault_reference_identity_id` (`string`): Set the `key_vault_reference_identity_id` field on the resulting resource block. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.
   - `location` (`string`): Set the `location` field on the resulting resource block.
   - `name` (`string`): Set the `name` field on the resulting resource block.
+  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting resource block. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.
   - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting resource block.
   - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting resource block.
   - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.
@@ -222,6 +224,7 @@ injecting into a complete block.
   - `key_vault_reference_identity_id` (`string`): Set the `key_vault_reference_identity_id` field on the resulting object. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.
   - `location` (`string`): Set the `location` field on the resulting object.
   - `name` (`string`): Set the `name` field on the resulting object.
+  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting object. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.
   - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting object.
   - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting object.
   - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.
@@ -624,6 +627,22 @@ Terraform resource block to set or update the name field.
   - `value` (`string`): The value to set for the `name` field.
 
 
+### fn withPublicNetworkAccessEnabled
+
+```ts
+withPublicNetworkAccessEnabled()
+```
+
+`azurerm.bool.withPublicNetworkAccessEnabled` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the public_network_access_enabled field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `public_network_access_enabled` field.
+
+
 ### fn withResourceGroupName
 
 ```ts
diff --git a/docs/3.x/linux_web_app_slot.md b/docs/3.x/linux_web_app_slot.md
index 25d8b3ec..f0e58e40 100644
--- a/docs/3.x/linux_web_app_slot.md
+++ b/docs/3.x/linux_web_app_slot.md
@@ -37,6 +37,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withLogs()`](#fn-withlogs)
 * [`fn withLogsMixin()`](#fn-withlogsmixin)
 * [`fn withName()`](#fn-withname)
+* [`fn withPublicNetworkAccessEnabled()`](#fn-withpublicnetworkaccessenabled)
 * [`fn withServicePlanId()`](#fn-withserviceplanid)
 * [`fn withSiteConfig()`](#fn-withsiteconfig)
 * [`fn withSiteConfigMixin()`](#fn-withsiteconfigmixin)
@@ -169,6 +170,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `https_only` (`bool`): Set the `https_only` field on the resulting resource block. When `null`, the `https_only` field will be omitted from the resulting object.
   - `key_vault_reference_identity_id` (`string`): Set the `key_vault_reference_identity_id` field on the resulting resource block. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.
   - `name` (`string`): Set the `name` field on the resulting resource block.
+  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting resource block. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.
   - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting resource block. When `null`, the `service_plan_id` field will be omitted from the resulting object.
   - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.
   - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting resource block. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.
@@ -215,6 +217,7 @@ injecting into a complete block.
   - `https_only` (`bool`): Set the `https_only` field on the resulting object. When `null`, the `https_only` field will be omitted from the resulting object.
   - `key_vault_reference_identity_id` (`string`): Set the `key_vault_reference_identity_id` field on the resulting object. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.
   - `name` (`string`): Set the `name` field on the resulting object.
+  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting object. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.
   - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting object. When `null`, the `service_plan_id` field will be omitted from the resulting object.
   - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.
   - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting object. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.
@@ -615,6 +618,22 @@ Terraform resource block to set or update the name field.
   - `value` (`string`): The value to set for the `name` field.
 
 
+### fn withPublicNetworkAccessEnabled
+
+```ts
+withPublicNetworkAccessEnabled()
+```
+
+`azurerm.bool.withPublicNetworkAccessEnabled` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the public_network_access_enabled field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `public_network_access_enabled` field.
+
+
 ### fn withServicePlanId
 
 ```ts
diff --git a/docs/3.x/pim_active_role_assignment.md b/docs/3.x/pim_active_role_assignment.md
new file mode 100644
index 00000000..86518fd9
--- /dev/null
+++ b/docs/3.x/pim_active_role_assignment.md
@@ -0,0 +1,377 @@
+---
+permalink: /pim_active_role_assignment/
+---
+
+# pim_active_role_assignment
+
+`pim_active_role_assignment` represents the `azurerm_pim_active_role_assignment` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withJustification()`](#fn-withjustification)
+* [`fn withPrincipalId()`](#fn-withprincipalid)
+* [`fn withRoleDefinitionId()`](#fn-withroledefinitionid)
+* [`fn withSchedule()`](#fn-withschedule)
+* [`fn withScheduleMixin()`](#fn-withschedulemixin)
+* [`fn withScope()`](#fn-withscope)
+* [`fn withTicket()`](#fn-withticket)
+* [`fn withTicketMixin()`](#fn-withticketmixin)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj schedule`](#obj-schedule)
+  * [`fn new()`](#fn-schedulenew)
+  * [`obj schedule.expiration`](#obj-scheduleexpiration)
+    * [`fn new()`](#fn-scheduleexpirationnew)
+* [`obj ticket`](#obj-ticket)
+  * [`fn new()`](#fn-ticketnew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`azurerm.pim_active_role_assignment.new` injects a new `azurerm_pim_active_role_assignment` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    azurerm.pim_active_role_assignment.new('some_id')
+
+You can get the reference to the `id` field of the created `azurerm.pim_active_role_assignment` using the reference:
+
+    $._ref.azurerm_pim_active_role_assignment.some_id.get('id')
+
+This is the same as directly entering `"${ azurerm_pim_active_role_assignment.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `justification` (`string`): The justification of the role assignment. When `null`, the `justification` field will be omitted from the resulting object.
+  - `principal_id` (`string`): The principal id.
+  - `role_definition_id` (`string`): The role definition id.
+  - `scope` (`string`): The scope.
+  - `schedule` (`list[obj]`): The schedule details of this role assignment. When `null`, the `schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_active_role_assignment.schedule.new](#fn-schedulenew) constructor.
+  - `ticket` (`list[obj]`): The ticket details. When `null`, the `ticket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_active_role_assignment.ticket.new](#fn-ticketnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_active_role_assignment.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`azurerm.pim_active_role_assignment.newAttrs` constructs a new object with attributes and blocks configured for the `pim_active_role_assignment`
+Terraform resource.
+
+Unlike [azurerm.pim_active_role_assignment.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `justification` (`string`): The justification of the role assignment. When `null`, the `justification` field will be omitted from the resulting object.
+  - `principal_id` (`string`): The principal id.
+  - `role_definition_id` (`string`): The role definition id.
+  - `scope` (`string`): The scope.
+  - `schedule` (`list[obj]`): The schedule details of this role assignment. When `null`, the `schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_active_role_assignment.schedule.new](#fn-schedulenew) constructor.
+  - `ticket` (`list[obj]`): The ticket details. When `null`, the `ticket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_active_role_assignment.ticket.new](#fn-ticketnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_active_role_assignment.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pim_active_role_assignment` resource into the root Terraform configuration.
+
+
+### fn withJustification
+
+```ts
+withJustification()
+```
+
+`azurerm.string.withJustification` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the justification field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `justification` field.
+
+
+### fn withPrincipalId
+
+```ts
+withPrincipalId()
+```
+
+`azurerm.string.withPrincipalId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the principal_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `principal_id` field.
+
+
+### fn withRoleDefinitionId
+
+```ts
+withRoleDefinitionId()
+```
+
+`azurerm.string.withRoleDefinitionId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the role_definition_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `role_definition_id` field.
+
+
+### fn withSchedule
+
+```ts
+withSchedule()
+```
+
+`azurerm.list[obj].withSchedule` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the schedule field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [azurerm.list[obj].withScheduleMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `schedule` field.
+
+
+### fn withScheduleMixin
+
+```ts
+withScheduleMixin()
+```
+
+`azurerm.list[obj].withScheduleMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the schedule field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [azurerm.list[obj].withSchedule](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `schedule` field.
+
+
+### fn withScope
+
+```ts
+withScope()
+```
+
+`azurerm.string.withScope` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the scope field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `scope` field.
+
+
+### fn withTicket
+
+```ts
+withTicket()
+```
+
+`azurerm.list[obj].withTicket` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the ticket field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [azurerm.list[obj].withTicketMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `ticket` field.
+
+
+### fn withTicketMixin
+
+```ts
+withTicketMixin()
+```
+
+`azurerm.list[obj].withTicketMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the ticket field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [azurerm.list[obj].withTicket](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `ticket` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`azurerm.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [azurerm.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`azurerm.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [azurerm.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj schedule
+
+
+
+### fn schedule.new
+
+```ts
+new()
+```
+
+
+`azurerm.pim_active_role_assignment.schedule.new` constructs a new object with attributes and blocks configured for the `schedule`
+Terraform sub block.
+
+
+
+**Args**:
+  - `start_date_time` (`string`): The start date time. When `null`, the `start_date_time` field will be omitted from the resulting object.
+  - `expiration` (`list[obj]`): Set the `expiration` field on the resulting object. When `null`, the `expiration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_active_role_assignment.schedule.expiration.new](#fn-scheduleexpirationnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `schedule` sub block.
+
+
+## obj schedule.expiration
+
+
+
+### fn schedule.expiration.new
+
+```ts
+new()
+```
+
+
+`azurerm.pim_active_role_assignment.schedule.expiration.new` constructs a new object with attributes and blocks configured for the `expiration`
+Terraform sub block.
+
+
+
+**Args**:
+  - `duration_days` (`number`): The duration of the assignment in days. When `null`, the `duration_days` field will be omitted from the resulting object.
+  - `duration_hours` (`number`): The duration of the assignment in hours. When `null`, the `duration_hours` field will be omitted from the resulting object.
+  - `end_date_time` (`string`): The end date time of the assignment. When `null`, the `end_date_time` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `expiration` sub block.
+
+
+## obj ticket
+
+
+
+### fn ticket.new
+
+```ts
+new()
+```
+
+
+`azurerm.pim_active_role_assignment.ticket.new` constructs a new object with attributes and blocks configured for the `ticket`
+Terraform sub block.
+
+
+
+**Args**:
+  - `number` (`string`): The ticket number. When `null`, the `number` field will be omitted from the resulting object.
+  - `system` (`string`): The ticket system. When `null`, the `system` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `ticket` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`azurerm.pim_active_role_assignment.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `read` (`string`): Set the `read` field on the resulting object. When `null`, the `read` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/3.x/pim_eligible_role_assignment.md b/docs/3.x/pim_eligible_role_assignment.md
new file mode 100644
index 00000000..6c934ec0
--- /dev/null
+++ b/docs/3.x/pim_eligible_role_assignment.md
@@ -0,0 +1,377 @@
+---
+permalink: /pim_eligible_role_assignment/
+---
+
+# pim_eligible_role_assignment
+
+`pim_eligible_role_assignment` represents the `azurerm_pim_eligible_role_assignment` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withJustification()`](#fn-withjustification)
+* [`fn withPrincipalId()`](#fn-withprincipalid)
+* [`fn withRoleDefinitionId()`](#fn-withroledefinitionid)
+* [`fn withSchedule()`](#fn-withschedule)
+* [`fn withScheduleMixin()`](#fn-withschedulemixin)
+* [`fn withScope()`](#fn-withscope)
+* [`fn withTicket()`](#fn-withticket)
+* [`fn withTicketMixin()`](#fn-withticketmixin)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj schedule`](#obj-schedule)
+  * [`fn new()`](#fn-schedulenew)
+  * [`obj schedule.expiration`](#obj-scheduleexpiration)
+    * [`fn new()`](#fn-scheduleexpirationnew)
+* [`obj ticket`](#obj-ticket)
+  * [`fn new()`](#fn-ticketnew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`azurerm.pim_eligible_role_assignment.new` injects a new `azurerm_pim_eligible_role_assignment` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    azurerm.pim_eligible_role_assignment.new('some_id')
+
+You can get the reference to the `id` field of the created `azurerm.pim_eligible_role_assignment` using the reference:
+
+    $._ref.azurerm_pim_eligible_role_assignment.some_id.get('id')
+
+This is the same as directly entering `"${ azurerm_pim_eligible_role_assignment.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `justification` (`string`): The justification of the eligible role assignment. When `null`, the `justification` field will be omitted from the resulting object.
+  - `principal_id` (`string`): The principal id.
+  - `role_definition_id` (`string`): The role definition id.
+  - `scope` (`string`): The scope.
+  - `schedule` (`list[obj]`): The schedule details of this eligible role assignment. When `null`, the `schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_eligible_role_assignment.schedule.new](#fn-schedulenew) constructor.
+  - `ticket` (`list[obj]`): Ticket details relating to the assignment. When `null`, the `ticket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_eligible_role_assignment.ticket.new](#fn-ticketnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_eligible_role_assignment.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`azurerm.pim_eligible_role_assignment.newAttrs` constructs a new object with attributes and blocks configured for the `pim_eligible_role_assignment`
+Terraform resource.
+
+Unlike [azurerm.pim_eligible_role_assignment.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `justification` (`string`): The justification of the eligible role assignment. When `null`, the `justification` field will be omitted from the resulting object.
+  - `principal_id` (`string`): The principal id.
+  - `role_definition_id` (`string`): The role definition id.
+  - `scope` (`string`): The scope.
+  - `schedule` (`list[obj]`): The schedule details of this eligible role assignment. When `null`, the `schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_eligible_role_assignment.schedule.new](#fn-schedulenew) constructor.
+  - `ticket` (`list[obj]`): Ticket details relating to the assignment. When `null`, the `ticket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_eligible_role_assignment.ticket.new](#fn-ticketnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_eligible_role_assignment.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pim_eligible_role_assignment` resource into the root Terraform configuration.
+
+
+### fn withJustification
+
+```ts
+withJustification()
+```
+
+`azurerm.string.withJustification` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the justification field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `justification` field.
+
+
+### fn withPrincipalId
+
+```ts
+withPrincipalId()
+```
+
+`azurerm.string.withPrincipalId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the principal_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `principal_id` field.
+
+
+### fn withRoleDefinitionId
+
+```ts
+withRoleDefinitionId()
+```
+
+`azurerm.string.withRoleDefinitionId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the role_definition_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `role_definition_id` field.
+
+
+### fn withSchedule
+
+```ts
+withSchedule()
+```
+
+`azurerm.list[obj].withSchedule` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the schedule field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [azurerm.list[obj].withScheduleMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `schedule` field.
+
+
+### fn withScheduleMixin
+
+```ts
+withScheduleMixin()
+```
+
+`azurerm.list[obj].withScheduleMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the schedule field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [azurerm.list[obj].withSchedule](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `schedule` field.
+
+
+### fn withScope
+
+```ts
+withScope()
+```
+
+`azurerm.string.withScope` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the scope field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `scope` field.
+
+
+### fn withTicket
+
+```ts
+withTicket()
+```
+
+`azurerm.list[obj].withTicket` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the ticket field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [azurerm.list[obj].withTicketMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `ticket` field.
+
+
+### fn withTicketMixin
+
+```ts
+withTicketMixin()
+```
+
+`azurerm.list[obj].withTicketMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the ticket field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [azurerm.list[obj].withTicket](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `ticket` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`azurerm.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [azurerm.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`azurerm.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [azurerm.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj schedule
+
+
+
+### fn schedule.new
+
+```ts
+new()
+```
+
+
+`azurerm.pim_eligible_role_assignment.schedule.new` constructs a new object with attributes and blocks configured for the `schedule`
+Terraform sub block.
+
+
+
+**Args**:
+  - `start_date_time` (`string`): The start date time. When `null`, the `start_date_time` field will be omitted from the resulting object.
+  - `expiration` (`list[obj]`): Set the `expiration` field on the resulting object. When `null`, the `expiration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [azurerm.pim_eligible_role_assignment.schedule.expiration.new](#fn-scheduleexpirationnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `schedule` sub block.
+
+
+## obj schedule.expiration
+
+
+
+### fn schedule.expiration.new
+
+```ts
+new()
+```
+
+
+`azurerm.pim_eligible_role_assignment.schedule.expiration.new` constructs a new object with attributes and blocks configured for the `expiration`
+Terraform sub block.
+
+
+
+**Args**:
+  - `duration_days` (`number`): The duration of the assignment in days. When `null`, the `duration_days` field will be omitted from the resulting object.
+  - `duration_hours` (`number`): The duration of the assignment in hours. When `null`, the `duration_hours` field will be omitted from the resulting object.
+  - `end_date_time` (`string`): The end date time of the assignment. When `null`, the `end_date_time` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `expiration` sub block.
+
+
+## obj ticket
+
+
+
+### fn ticket.new
+
+```ts
+new()
+```
+
+
+`azurerm.pim_eligible_role_assignment.ticket.new` constructs a new object with attributes and blocks configured for the `ticket`
+Terraform sub block.
+
+
+
+**Args**:
+  - `number` (`string`): The ticket number. When `null`, the `number` field will be omitted from the resulting object.
+  - `system` (`string`): The ticket system. When `null`, the `system` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `ticket` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`azurerm.pim_eligible_role_assignment.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `read` (`string`): Set the `read` field on the resulting object. When `null`, the `read` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/3.x/spring_cloud_gateway.md b/docs/3.x/spring_cloud_gateway.md
index dc5fbfc1..28ee06d9 100644
--- a/docs/3.x/spring_cloud_gateway.md
+++ b/docs/3.x/spring_cloud_gateway.md
@@ -552,6 +552,7 @@ Terraform sub block.
 **Args**:
   - `allowed_headers` (`list`): Set the `allowed_headers` field on the resulting object. When `null`, the `allowed_headers` field will be omitted from the resulting object.
   - `allowed_methods` (`list`): Set the `allowed_methods` field on the resulting object. When `null`, the `allowed_methods` field will be omitted from the resulting object.
+  - `allowed_origin_patterns` (`list`): Set the `allowed_origin_patterns` field on the resulting object. When `null`, the `allowed_origin_patterns` field will be omitted from the resulting object.
   - `allowed_origins` (`list`): Set the `allowed_origins` field on the resulting object. When `null`, the `allowed_origins` field will be omitted from the resulting object.
   - `credentials_allowed` (`bool`): Set the `credentials_allowed` field on the resulting object. When `null`, the `credentials_allowed` field will be omitted from the resulting object.
   - `exposed_headers` (`list`): Set the `exposed_headers` field on the resulting object. When `null`, the `exposed_headers` field will be omitted from the resulting object.
diff --git a/docs/3.x/windows_function_app.md b/docs/3.x/windows_function_app.md
index 4c135b6a..0a5fbf03 100644
--- a/docs/3.x/windows_function_app.md
+++ b/docs/3.x/windows_function_app.md
@@ -38,6 +38,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withKeyVaultReferenceIdentityId()`](#fn-withkeyvaultreferenceidentityid)
 * [`fn withLocation()`](#fn-withlocation)
 * [`fn withName()`](#fn-withname)
+* [`fn withPublicNetworkAccessEnabled()`](#fn-withpublicnetworkaccessenabled)
 * [`fn withResourceGroupName()`](#fn-withresourcegroupname)
 * [`fn withServicePlanId()`](#fn-withserviceplanid)
 * [`fn withSiteConfig()`](#fn-withsiteconfig)
@@ -160,6 +161,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `key_vault_reference_identity_id` (`string`): The User Assigned Identity to use for Key Vault access. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.
   - `location` (`string`): Set the `location` field on the resulting resource block.
   - `name` (`string`): Specifies the name of the Function App.
+  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting resource block. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.
   - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting resource block.
   - `service_plan_id` (`string`): The ID of the App Service Plan within which to create this Function App
   - `storage_account_access_key` (`string`): The access key which will be used to access the storage account for the Function App. When `null`, the `storage_account_access_key` field will be omitted from the resulting object.
@@ -214,6 +216,7 @@ injecting into a complete block.
   - `key_vault_reference_identity_id` (`string`): The User Assigned Identity to use for Key Vault access. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.
   - `location` (`string`): Set the `location` field on the resulting object.
   - `name` (`string`): Specifies the name of the Function App.
+  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting object. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.
   - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting object.
   - `service_plan_id` (`string`): The ID of the App Service Plan within which to create this Function App
   - `storage_account_access_key` (`string`): The access key which will be used to access the storage account for the Function App. When `null`, the `storage_account_access_key` field will be omitted from the resulting object.
@@ -630,6 +633,22 @@ Terraform resource block to set or update the name field.
   - `value` (`string`): The value to set for the `name` field.
 
 
+### fn withPublicNetworkAccessEnabled
+
+```ts
+withPublicNetworkAccessEnabled()
+```
+
+`azurerm.bool.withPublicNetworkAccessEnabled` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the public_network_access_enabled field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `public_network_access_enabled` field.
+
+
 ### fn withResourceGroupName
 
 ```ts
diff --git a/docs/3.x/windows_function_app_slot.md b/docs/3.x/windows_function_app_slot.md
index 0be6f8ed..da545938 100644
--- a/docs/3.x/windows_function_app_slot.md
+++ b/docs/3.x/windows_function_app_slot.md
@@ -38,6 +38,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withIdentityMixin()`](#fn-withidentitymixin)
 * [`fn withKeyVaultReferenceIdentityId()`](#fn-withkeyvaultreferenceidentityid)
 * [`fn withName()`](#fn-withname)
+* [`fn withPublicNetworkAccessEnabled()`](#fn-withpublicnetworkaccessenabled)
 * [`fn withServicePlanId()`](#fn-withserviceplanid)
 * [`fn withSiteConfig()`](#fn-withsiteconfig)
 * [`fn withSiteConfigMixin()`](#fn-withsiteconfigmixin)
@@ -154,6 +155,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `https_only` (`bool`): Can the Function App Slot only be accessed via HTTPS? When `null`, the `https_only` field will be omitted from the resulting object.
   - `key_vault_reference_identity_id` (`string`): The User Assigned Identity to use for Key Vault access. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.
   - `name` (`string`): Specifies the name of the Windows Function App Slot.
+  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting resource block. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.
   - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting resource block. When `null`, the `service_plan_id` field will be omitted from the resulting object.
   - `storage_account_access_key` (`string`): The access key which will be used to access the storage account for the Function App Slot. When `null`, the `storage_account_access_key` field will be omitted from the resulting object.
   - `storage_account_name` (`string`): The backend storage account name which will be used by this Function App Slot. When `null`, the `storage_account_name` field will be omitted from the resulting object.
@@ -205,6 +207,7 @@ injecting into a complete block.
   - `https_only` (`bool`): Can the Function App Slot only be accessed via HTTPS? When `null`, the `https_only` field will be omitted from the resulting object.
   - `key_vault_reference_identity_id` (`string`): The User Assigned Identity to use for Key Vault access. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.
   - `name` (`string`): Specifies the name of the Windows Function App Slot.
+  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting object. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.
   - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting object. When `null`, the `service_plan_id` field will be omitted from the resulting object.
   - `storage_account_access_key` (`string`): The access key which will be used to access the storage account for the Function App Slot. When `null`, the `storage_account_access_key` field will be omitted from the resulting object.
   - `storage_account_name` (`string`): The backend storage account name which will be used by this Function App Slot. When `null`, the `storage_account_name` field will be omitted from the resulting object.
@@ -618,6 +621,22 @@ Terraform resource block to set or update the name field.
   - `value` (`string`): The value to set for the `name` field.
 
 
+### fn withPublicNetworkAccessEnabled
+
+```ts
+withPublicNetworkAccessEnabled()
+```
+
+`azurerm.bool.withPublicNetworkAccessEnabled` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the public_network_access_enabled field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `public_network_access_enabled` field.
+
+
 ### fn withServicePlanId
 
 ```ts
diff --git a/docs/3.x/windows_web_app.md b/docs/3.x/windows_web_app.md
index d93f25c6..2e376b8f 100644
--- a/docs/3.x/windows_web_app.md
+++ b/docs/3.x/windows_web_app.md
@@ -37,6 +37,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withLogs()`](#fn-withlogs)
 * [`fn withLogsMixin()`](#fn-withlogsmixin)
 * [`fn withName()`](#fn-withname)
+* [`fn withPublicNetworkAccessEnabled()`](#fn-withpublicnetworkaccessenabled)
 * [`fn withResourceGroupName()`](#fn-withresourcegroupname)
 * [`fn withServicePlanId()`](#fn-withserviceplanid)
 * [`fn withSiteConfig()`](#fn-withsiteconfig)
@@ -180,6 +181,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `key_vault_reference_identity_id` (`string`): Set the `key_vault_reference_identity_id` field on the resulting resource block. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.
   - `location` (`string`): Set the `location` field on the resulting resource block.
   - `name` (`string`): Set the `name` field on the resulting resource block.
+  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting resource block. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.
   - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting resource block.
   - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting resource block.
   - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.
@@ -228,6 +230,7 @@ injecting into a complete block.
   - `key_vault_reference_identity_id` (`string`): Set the `key_vault_reference_identity_id` field on the resulting object. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.
   - `location` (`string`): Set the `location` field on the resulting object.
   - `name` (`string`): Set the `name` field on the resulting object.
+  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting object. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.
   - `resource_group_name` (`string`): Set the `resource_group_name` field on the resulting object.
   - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting object.
   - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.
@@ -630,6 +633,22 @@ Terraform resource block to set or update the name field.
   - `value` (`string`): The value to set for the `name` field.
 
 
+### fn withPublicNetworkAccessEnabled
+
+```ts
+withPublicNetworkAccessEnabled()
+```
+
+`azurerm.bool.withPublicNetworkAccessEnabled` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the public_network_access_enabled field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `public_network_access_enabled` field.
+
+
 ### fn withResourceGroupName
 
 ```ts
diff --git a/docs/3.x/windows_web_app_slot.md b/docs/3.x/windows_web_app_slot.md
index a77095d0..350cbffe 100644
--- a/docs/3.x/windows_web_app_slot.md
+++ b/docs/3.x/windows_web_app_slot.md
@@ -37,6 +37,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withLogs()`](#fn-withlogs)
 * [`fn withLogsMixin()`](#fn-withlogsmixin)
 * [`fn withName()`](#fn-withname)
+* [`fn withPublicNetworkAccessEnabled()`](#fn-withpublicnetworkaccessenabled)
 * [`fn withServicePlanId()`](#fn-withserviceplanid)
 * [`fn withSiteConfig()`](#fn-withsiteconfig)
 * [`fn withSiteConfigMixin()`](#fn-withsiteconfigmixin)
@@ -175,6 +176,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `https_only` (`bool`): Set the `https_only` field on the resulting resource block. When `null`, the `https_only` field will be omitted from the resulting object.
   - `key_vault_reference_identity_id` (`string`): Set the `key_vault_reference_identity_id` field on the resulting resource block. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.
   - `name` (`string`): Set the `name` field on the resulting resource block.
+  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting resource block. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.
   - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting resource block. When `null`, the `service_plan_id` field will be omitted from the resulting object.
   - `tags` (`obj`): Set the `tags` field on the resulting resource block. When `null`, the `tags` field will be omitted from the resulting object.
   - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting resource block. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.
@@ -221,6 +223,7 @@ injecting into a complete block.
   - `https_only` (`bool`): Set the `https_only` field on the resulting object. When `null`, the `https_only` field will be omitted from the resulting object.
   - `key_vault_reference_identity_id` (`string`): Set the `key_vault_reference_identity_id` field on the resulting object. When `null`, the `key_vault_reference_identity_id` field will be omitted from the resulting object.
   - `name` (`string`): Set the `name` field on the resulting object.
+  - `public_network_access_enabled` (`bool`): Set the `public_network_access_enabled` field on the resulting object. When `null`, the `public_network_access_enabled` field will be omitted from the resulting object.
   - `service_plan_id` (`string`): Set the `service_plan_id` field on the resulting object. When `null`, the `service_plan_id` field will be omitted from the resulting object.
   - `tags` (`obj`): Set the `tags` field on the resulting object. When `null`, the `tags` field will be omitted from the resulting object.
   - `virtual_network_subnet_id` (`string`): Set the `virtual_network_subnet_id` field on the resulting object. When `null`, the `virtual_network_subnet_id` field will be omitted from the resulting object.
@@ -621,6 +624,22 @@ Terraform resource block to set or update the name field.
   - `value` (`string`): The value to set for the `name` field.
 
 
+### fn withPublicNetworkAccessEnabled
+
+```ts
+withPublicNetworkAccessEnabled()
+```
+
+`azurerm.bool.withPublicNetworkAccessEnabled` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the public_network_access_enabled field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `public_network_access_enabled` field.
+
+
 ### fn withServicePlanId
 
 ```ts