diff --git a/4.x/_gen/data/billing_account.libsonnet b/4.x/_gen/data/billing_account.libsonnet
index ccbfa8f..4f451bf 100644
--- a/4.x/_gen/data/billing_account.libsonnet
+++ b/4.x/_gen/data/billing_account.libsonnet
@@ -2,27 +2,35 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='billing_account', url='', help='`billing_account` represents the `google_billing_account` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.data.billing_account.new` injects a new `data_google_billing_account` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.billing_account.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.billing_account` using the reference:\n\n    $._ref.data_google_billing_account.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_billing_account.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `billing_account` (`string`): Set the `billing_account` field on the resulting data source block. When `null`, the `billing_account` field will be omitted from the resulting object.\n  - `display_name` (`string`): Set the `display_name` field on the resulting data source block. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `open` (`bool`): Set the `open` field on the resulting data source block. When `null`, the `open` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.data.billing_account.new` injects a new `data_google_billing_account` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.billing_account.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.billing_account` using the reference:\n\n    $._ref.data_google_billing_account.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_billing_account.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `billing_account` (`string`): Set the `billing_account` field on the resulting data source block. When `null`, the `billing_account` field will be omitted from the resulting object.\n  - `display_name` (`string`): Set the `display_name` field on the resulting data source block. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `lookup_projects` (`bool`): Set the `lookup_projects` field on the resulting data source block. When `null`, the `lookup_projects` field will be omitted from the resulting object.\n  - `open` (`bool`): Set the `open` field on the resulting data source block. When `null`, the `open` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
   new(
     dataSrcLabel,
     billing_account=null,
     display_name=null,
+    lookup_projects=null,
     open=null,
     _meta={}
   ):: tf.withData(
     type='google_billing_account',
     label=dataSrcLabel,
-    attrs=self.newAttrs(billing_account=billing_account, display_name=display_name, open=open),
+    attrs=self.newAttrs(
+      billing_account=billing_account,
+      display_name=display_name,
+      lookup_projects=lookup_projects,
+      open=open
+    ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.data.billing_account.newAttrs` constructs a new object with attributes and blocks configured for the `billing_account`\nTerraform data source.\n\nUnlike [google.data.billing_account.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `billing_account` (`string`): Set the `billing_account` field on the resulting object. When `null`, the `billing_account` field will be omitted from the resulting object.\n  - `display_name` (`string`): Set the `display_name` field on the resulting object. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `open` (`bool`): Set the `open` field on the resulting object. When `null`, the `open` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `billing_account` data source into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.data.billing_account.newAttrs` constructs a new object with attributes and blocks configured for the `billing_account`\nTerraform data source.\n\nUnlike [google.data.billing_account.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `billing_account` (`string`): Set the `billing_account` field on the resulting object. When `null`, the `billing_account` field will be omitted from the resulting object.\n  - `display_name` (`string`): Set the `display_name` field on the resulting object. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `lookup_projects` (`bool`): Set the `lookup_projects` field on the resulting object. When `null`, the `lookup_projects` field will be omitted from the resulting object.\n  - `open` (`bool`): Set the `open` field on the resulting object. When `null`, the `open` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `billing_account` data source into the root Terraform configuration.\n', args=[]),
   newAttrs(
     billing_account=null,
     display_name=null,
+    lookup_projects=null,
     open=null
   ):: std.prune(a={
     billing_account: billing_account,
     display_name: display_name,
+    lookup_projects: lookup_projects,
     open: open,
   }),
   '#withBillingAccount':: d.fn(help='`google.string.withBillingAccount` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the billing_account field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `billing_account` field.\n', args=[]),
@@ -45,6 +53,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withLookupProjects':: d.fn(help='`google.bool.withLookupProjects` constructs a mixin object that can be merged into the `bool`\nTerraform data source block to set or update the lookup_projects field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `lookup_projects` field.\n', args=[]),
+  withLookupProjects(dataSrcLabel, value): {
+    data+: {
+      google_billing_account+: {
+        [dataSrcLabel]+: {
+          lookup_projects: value,
+        },
+      },
+    },
+  },
   '#withOpen':: d.fn(help='`google.bool.withOpen` constructs a mixin object that can be merged into the `bool`\nTerraform data source block to set or update the open field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `open` field.\n', args=[]),
   withOpen(dataSrcLabel, value): {
     data+: {
diff --git a/4.x/_gen/data/dataplex_datascan_iam_policy.libsonnet b/4.x/_gen/data/dataplex_datascan_iam_policy.libsonnet
new file mode 100644
index 0000000..a0a03b5
--- /dev/null
+++ b/4.x/_gen/data/dataplex_datascan_iam_policy.libsonnet
@@ -0,0 +1,58 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='dataplex_datascan_iam_policy', url='', help='`dataplex_datascan_iam_policy` represents the `google_dataplex_datascan_iam_policy` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.dataplex_datascan_iam_policy.new` injects a new `data_google_dataplex_datascan_iam_policy` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.dataplex_datascan_iam_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.dataplex_datascan_iam_policy` using the reference:\n\n    $._ref.data_google_dataplex_datascan_iam_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_dataplex_datascan_iam_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `data_scan_id` (`string`): Set the `data_scan_id` field on the resulting data source block.\n  - `location` (`string`): Set the `location` field on the resulting data source block. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    data_scan_id,
+    location=null,
+    project=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_dataplex_datascan_iam_policy',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(data_scan_id=data_scan_id, location=location, project=project),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.dataplex_datascan_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_datascan_iam_policy`\nTerraform data source.\n\nUnlike [google.data.dataplex_datascan_iam_policy.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `data_scan_id` (`string`): Set the `data_scan_id` field on the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `dataplex_datascan_iam_policy` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    data_scan_id,
+    location=null,
+    project=null
+  ):: std.prune(a={
+    data_scan_id: data_scan_id,
+    location: location,
+    project: project,
+  }),
+  '#withDataScanId':: d.fn(help='`google.string.withDataScanId` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the data_scan_id field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `data_scan_id` field.\n', args=[]),
+  withDataScanId(dataSrcLabel, value): {
+    data+: {
+      google_dataplex_datascan_iam_policy+: {
+        [dataSrcLabel]+: {
+          data_scan_id: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the location field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(dataSrcLabel, value): {
+    data+: {
+      google_dataplex_datascan_iam_policy+: {
+        [dataSrcLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_dataplex_datascan_iam_policy+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/main.libsonnet b/4.x/_gen/data/main.libsonnet
index 3b7fbb5..dd48b90 100644
--- a/4.x/_gen/data/main.libsonnet
+++ b/4.x/_gen/data/main.libsonnet
@@ -102,6 +102,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   data_catalog_taxonomy_iam_policy: (import 'data_catalog_taxonomy_iam_policy.libsonnet'),
   data_fusion_instance_iam_policy: (import 'data_fusion_instance_iam_policy.libsonnet'),
   dataplex_asset_iam_policy: (import 'dataplex_asset_iam_policy.libsonnet'),
+  dataplex_datascan_iam_policy: (import 'dataplex_datascan_iam_policy.libsonnet'),
   dataplex_lake_iam_policy: (import 'dataplex_lake_iam_policy.libsonnet'),
   dataplex_zone_iam_policy: (import 'dataplex_zone_iam_policy.libsonnet'),
   dataproc_autoscaling_policy_iam_policy: (import 'dataproc_autoscaling_policy_iam_policy.libsonnet'),
diff --git a/4.x/_gen/main.libsonnet b/4.x/_gen/main.libsonnet
index 0de4166..247f713 100644
--- a/4.x/_gen/main.libsonnet
+++ b/4.x/_gen/main.libsonnet
@@ -14,6 +14,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   access_context_manager_gcp_user_access_binding: (import 'resources/access_context_manager_gcp_user_access_binding.libsonnet'),
   access_context_manager_ingress_policy: (import 'resources/access_context_manager_ingress_policy.libsonnet'),
   access_context_manager_service_perimeter: (import 'resources/access_context_manager_service_perimeter.libsonnet'),
+  access_context_manager_service_perimeter_egress_policy: (import 'resources/access_context_manager_service_perimeter_egress_policy.libsonnet'),
+  access_context_manager_service_perimeter_ingress_policy: (import 'resources/access_context_manager_service_perimeter_ingress_policy.libsonnet'),
   access_context_manager_service_perimeter_resource: (import 'resources/access_context_manager_service_perimeter_resource.libsonnet'),
   access_context_manager_service_perimeters: (import 'resources/access_context_manager_service_perimeters.libsonnet'),
   active_directory_domain: (import 'resources/active_directory_domain.libsonnet'),
@@ -111,6 +113,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   binary_authorization_attestor_iam_policy: (import 'resources/binary_authorization_attestor_iam_policy.libsonnet'),
   binary_authorization_policy: (import 'resources/binary_authorization_policy.libsonnet'),
   certificate_manager_certificate: (import 'resources/certificate_manager_certificate.libsonnet'),
+  certificate_manager_certificate_issuance_config: (import 'resources/certificate_manager_certificate_issuance_config.libsonnet'),
   certificate_manager_certificate_map: (import 'resources/certificate_manager_certificate_map.libsonnet'),
   certificate_manager_certificate_map_entry: (import 'resources/certificate_manager_certificate_map_entry.libsonnet'),
   certificate_manager_dns_authorization: (import 'resources/certificate_manager_dns_authorization.libsonnet'),
@@ -312,6 +315,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   dataplex_asset_iam_binding: (import 'resources/dataplex_asset_iam_binding.libsonnet'),
   dataplex_asset_iam_member: (import 'resources/dataplex_asset_iam_member.libsonnet'),
   dataplex_asset_iam_policy: (import 'resources/dataplex_asset_iam_policy.libsonnet'),
+  dataplex_datascan: (import 'resources/dataplex_datascan.libsonnet'),
+  dataplex_datascan_iam_binding: (import 'resources/dataplex_datascan_iam_binding.libsonnet'),
+  dataplex_datascan_iam_member: (import 'resources/dataplex_datascan_iam_member.libsonnet'),
+  dataplex_datascan_iam_policy: (import 'resources/dataplex_datascan_iam_policy.libsonnet'),
   dataplex_lake: (import 'resources/dataplex_lake.libsonnet'),
   dataplex_lake_iam_binding: (import 'resources/dataplex_lake_iam_binding.libsonnet'),
   dataplex_lake_iam_member: (import 'resources/dataplex_lake_iam_member.libsonnet'),
diff --git a/4.x/_gen/resources/access_context_manager_service_perimeter_egress_policy.libsonnet b/4.x/_gen/resources/access_context_manager_service_perimeter_egress_policy.libsonnet
new file mode 100644
index 0000000..b3f2f3e
--- /dev/null
+++ b/4.x/_gen/resources/access_context_manager_service_perimeter_egress_policy.libsonnet
@@ -0,0 +1,160 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='access_context_manager_service_perimeter_egress_policy', url='', help='`access_context_manager_service_perimeter_egress_policy` represents the `google_access_context_manager_service_perimeter_egress_policy` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  egress_from:: {
+    '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter_egress_policy.egress_from.new` constructs a new object with attributes and blocks configured for the `egress_from`\nTerraform sub block.\n\n\n\n**Args**:\n  - `identities` (`list`): A list of identities that are allowed access through this 'EgressPolicy'.\nShould be in the format of email address. The email address should\nrepresent individual user or service account only. When `null`, the `identities` field will be omitted from the resulting object.\n  - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the\nperimeter. If left unspecified, then members of 'identities' field will\nbe allowed access. Possible values: ["ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `egress_from` sub block.\n', args=[]),
+    new(
+      identities=null,
+      identity_type=null
+    ):: std.prune(a={
+      identities: identities,
+      identity_type: identity_type,
+    }),
+  },
+  egress_to:: {
+    '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter_egress_policy.egress_to.new` constructs a new object with attributes and blocks configured for the `egress_to`\nTerraform sub block.\n\n\n\n**Args**:\n  - `external_resources` (`list`): A list of external resources that are allowed to be accessed. A request\nmatches if it contains an external resource in this list (Example:\ns3://bucket/path). Currently '*' is not allowed. When `null`, the `external_resources` field will be omitted from the resulting object.\n  - `resources` (`list`): A list of resources, currently only projects in the form\n'projects/<projectnumber>', that match this to stanza. A request matches\nif it contains a resource in this list. If * is specified for resources,\nthen this 'EgressTo' rule will authorize access to all resources outside\nthe perimeter. When `null`, the `resources` field will be omitted from the resulting object.\n  - `operations` (`list[obj]`): A list of 'ApiOperations' that this egress rule applies to. A request matches\nif it contains an operation/service in this list. When `null`, the `operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_egress_policy.egress_to.operations.new](#fn-egress_tooperationsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `egress_to` sub block.\n', args=[]),
+    new(
+      external_resources=null,
+      operations=null,
+      resources=null
+    ):: std.prune(a={
+      external_resources: external_resources,
+      operations: operations,
+      resources: resources,
+    }),
+    operations:: {
+      method_selectors:: {
+        '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter_egress_policy.egress_to.operations.method_selectors.new` constructs a new object with attributes and blocks configured for the `method_selectors`\nTerraform sub block.\n\n\n\n**Args**:\n  - `method` (`string`): Value for 'method' should be a valid method name for the corresponding\n'serviceName' in 'ApiOperation'. If '*' used as value for method,\nthen ALL methods and permissions are allowed. When `null`, the `method` field will be omitted from the resulting object.\n  - `permission` (`string`): Value for permission should be a valid Cloud IAM permission for the\ncorresponding 'serviceName' in 'ApiOperation'. When `null`, the `permission` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `method_selectors` sub block.\n', args=[]),
+        new(
+          method=null,
+          permission=null
+        ):: std.prune(a={
+          method: method,
+          permission: permission,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter_egress_policy.egress_to.operations.new` constructs a new object with attributes and blocks configured for the `operations`\nTerraform sub block.\n\n\n\n**Args**:\n  - `service_name` (`string`): The name of the API whose methods or permissions the 'IngressPolicy' or\n'EgressPolicy' want to allow. A single 'ApiOperation' with serviceName\nfield set to '*' will allow all methods AND permissions for all services. When `null`, the `service_name` field will be omitted from the resulting object.\n  - `method_selectors` (`list[obj]`): API methods or permissions to allow. Method or permission must belong\nto the service specified by 'serviceName' field. A single MethodSelector\nentry with '*' specified for the 'method' field will allow all methods\nAND permissions for the service specified in 'serviceName'. When `null`, the `method_selectors` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_egress_policy.egress_to.operations.method_selectors.new](#fn-egress_toegress_tomethod_selectorsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `operations` sub block.\n', args=[]),
+      new(
+        method_selectors=null,
+        service_name=null
+      ):: std.prune(a={
+        method_selectors: method_selectors,
+        service_name: service_name,
+      }),
+    },
+  },
+  '#new':: d.fn(help="\n`google.access_context_manager_service_perimeter_egress_policy.new` injects a new `google_access_context_manager_service_perimeter_egress_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.access_context_manager_service_perimeter_egress_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.access_context_manager_service_perimeter_egress_policy` using the reference:\n\n    $._ref.google_access_context_manager_service_perimeter_egress_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_access_context_manager_service_perimeter_egress_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `perimeter` (`string`): The name of the Service Perimeter to add this resource to.\n  - `egress_from` (`list[obj]`): Defines conditions on the source of a request causing this \u0026#39;EgressPolicy\u0026#39; to apply. When `null`, the `egress_from` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_egress_policy.egress_from.new](#fn-egress_fromnew) constructor.\n  - `egress_to` (`list[obj]`): Defines the conditions on the \u0026#39;ApiOperation\u0026#39; and destination resources that\ncause this \u0026#39;EgressPolicy\u0026#39; to apply. When `null`, the `egress_to` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_egress_policy.egress_to.new](#fn-egress_tonew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_egress_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    perimeter,
+    egress_from=null,
+    egress_to=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_access_context_manager_service_perimeter_egress_policy',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      egress_from=egress_from,
+      egress_to=egress_to,
+      perimeter=perimeter,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.access_context_manager_service_perimeter_egress_policy.newAttrs` constructs a new object with attributes and blocks configured for the `access_context_manager_service_perimeter_egress_policy`\nTerraform resource.\n\nUnlike [google.access_context_manager_service_perimeter_egress_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `perimeter` (`string`): The name of the Service Perimeter to add this resource to.\n  - `egress_from` (`list[obj]`): Defines conditions on the source of a request causing this 'EgressPolicy' to apply. When `null`, the `egress_from` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_egress_policy.egress_from.new](#fn-egress_fromnew) constructor.\n  - `egress_to` (`list[obj]`): Defines the conditions on the 'ApiOperation' and destination resources that\ncause this 'EgressPolicy' to apply. When `null`, the `egress_to` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_egress_policy.egress_to.new](#fn-egress_tonew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_egress_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `access_context_manager_service_perimeter_egress_policy` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    perimeter,
+    egress_from=null,
+    egress_to=null,
+    timeouts=null
+  ):: std.prune(a={
+    egress_from: egress_from,
+    egress_to: egress_to,
+    perimeter: perimeter,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter_egress_policy.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withEgressFrom':: d.fn(help='`google.list[obj].withEgressFrom` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the egress_from field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withEgressFromMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `egress_from` field.\n', args=[]),
+  withEgressFrom(resourceLabel, value): {
+    resource+: {
+      google_access_context_manager_service_perimeter_egress_policy+: {
+        [resourceLabel]+: {
+          egress_from: value,
+        },
+      },
+    },
+  },
+  '#withEgressFromMixin':: d.fn(help='`google.list[obj].withEgressFromMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the egress_from field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withEgressFrom](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `egress_from` field.\n', args=[]),
+  withEgressFromMixin(resourceLabel, value): {
+    resource+: {
+      google_access_context_manager_service_perimeter_egress_policy+: {
+        [resourceLabel]+: {
+          egress_from+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withEgressTo':: d.fn(help='`google.list[obj].withEgressTo` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the egress_to field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withEgressToMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `egress_to` field.\n', args=[]),
+  withEgressTo(resourceLabel, value): {
+    resource+: {
+      google_access_context_manager_service_perimeter_egress_policy+: {
+        [resourceLabel]+: {
+          egress_to: value,
+        },
+      },
+    },
+  },
+  '#withEgressToMixin':: d.fn(help='`google.list[obj].withEgressToMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the egress_to field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withEgressTo](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `egress_to` field.\n', args=[]),
+  withEgressToMixin(resourceLabel, value): {
+    resource+: {
+      google_access_context_manager_service_perimeter_egress_policy+: {
+        [resourceLabel]+: {
+          egress_to+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withPerimeter':: d.fn(help='`google.string.withPerimeter` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the perimeter field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `perimeter` field.\n', args=[]),
+  withPerimeter(resourceLabel, value): {
+    resource+: {
+      google_access_context_manager_service_perimeter_egress_policy+: {
+        [resourceLabel]+: {
+          perimeter: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_access_context_manager_service_perimeter_egress_policy+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_access_context_manager_service_perimeter_egress_policy+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/access_context_manager_service_perimeter_ingress_policy.libsonnet b/4.x/_gen/resources/access_context_manager_service_perimeter_ingress_policy.libsonnet
new file mode 100644
index 0000000..585d3fc
--- /dev/null
+++ b/4.x/_gen/resources/access_context_manager_service_perimeter_ingress_policy.libsonnet
@@ -0,0 +1,170 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='access_context_manager_service_perimeter_ingress_policy', url='', help='`access_context_manager_service_perimeter_ingress_policy` represents the `google_access_context_manager_service_perimeter_ingress_policy` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  ingress_from:: {
+    '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter_ingress_policy.ingress_from.new` constructs a new object with attributes and blocks configured for the `ingress_from`\nTerraform sub block.\n\n\n\n**Args**:\n  - `identities` (`list`): A list of identities that are allowed access through this ingress policy.\nShould be in the format of email address. The email address should represent\nindividual user or service account only. When `null`, the `identities` field will be omitted from the resulting object.\n  - `identity_type` (`string`): Specifies the type of identities that are allowed access from outside the\nperimeter. If left unspecified, then members of 'identities' field will be\nallowed access. Possible values: ["ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.\n  - `sources` (`list[obj]`): Sources that this 'IngressPolicy' authorizes access from. When `null`, the `sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_ingress_policy.ingress_from.sources.new](#fn-ingress_fromsourcesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `ingress_from` sub block.\n', args=[]),
+    new(
+      identities=null,
+      identity_type=null,
+      sources=null
+    ):: std.prune(a={
+      identities: identities,
+      identity_type: identity_type,
+      sources: sources,
+    }),
+    sources:: {
+      '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter_ingress_policy.ingress_from.sources.new` constructs a new object with attributes and blocks configured for the `sources`\nTerraform sub block.\n\n\n\n**Args**:\n  - `access_level` (`string`): An 'AccessLevel' resource name that allow resources within the\n'ServicePerimeters' to be accessed from the internet. 'AccessLevels' listed\nmust be in the same policy as this 'ServicePerimeter'. Referencing a nonexistent\n'AccessLevel' will cause an error. If no 'AccessLevel' names are listed,\nresources within the perimeter can only be accessed via Google Cloud calls\nwith request origins within the perimeter.\nExample 'accessPolicies/MY_POLICY/accessLevels/MY_LEVEL.'\nIf * is specified, then all IngressSources will be allowed. When `null`, the `access_level` field will be omitted from the resulting object.\n  - `resource` (`string`): A Google Cloud resource that is allowed to ingress the perimeter.\nRequests from these resources will be allowed to access perimeter data.\nCurrently only projects are allowed. Format 'projects/{project_number}'\nThe project may be in any Google Cloud organization, not just the\norganization that the perimeter is defined in. '*' is not allowed, the case\nof allowing all Google Cloud resources only is not supported. When `null`, the `resource` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `sources` sub block.\n', args=[]),
+      new(
+        access_level=null,
+        resource=null
+      ):: std.prune(a={
+        access_level: access_level,
+        resource: resource,
+      }),
+    },
+  },
+  ingress_to:: {
+    '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter_ingress_policy.ingress_to.new` constructs a new object with attributes and blocks configured for the `ingress_to`\nTerraform sub block.\n\n\n\n**Args**:\n  - `resources` (`list`): A list of resources, currently only projects in the form\n'projects/<projectnumber>', protected by this 'ServicePerimeter'\nthat are allowed to be accessed by sources defined in the\ncorresponding 'IngressFrom'. A request matches if it contains\na resource in this list. If '*' is specified for resources,\nthen this 'IngressTo' rule will authorize access to all\nresources inside the perimeter, provided that the request\nalso matches the 'operations' field. When `null`, the `resources` field will be omitted from the resulting object.\n  - `operations` (`list[obj]`): A list of 'ApiOperations' the sources specified in corresponding 'IngressFrom'\nare allowed to perform in this 'ServicePerimeter'. When `null`, the `operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_ingress_policy.ingress_to.operations.new](#fn-ingress_tooperationsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `ingress_to` sub block.\n', args=[]),
+    new(
+      operations=null,
+      resources=null
+    ):: std.prune(a={
+      operations: operations,
+      resources: resources,
+    }),
+    operations:: {
+      method_selectors:: {
+        '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter_ingress_policy.ingress_to.operations.method_selectors.new` constructs a new object with attributes and blocks configured for the `method_selectors`\nTerraform sub block.\n\n\n\n**Args**:\n  - `method` (`string`): Value for method should be a valid method name for the corresponding\nserviceName in 'ApiOperation'. If '*' used as value for 'method', then\nALL methods and permissions are allowed. When `null`, the `method` field will be omitted from the resulting object.\n  - `permission` (`string`): Value for permission should be a valid Cloud IAM permission for the\ncorresponding 'serviceName' in 'ApiOperation'. When `null`, the `permission` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `method_selectors` sub block.\n', args=[]),
+        new(
+          method=null,
+          permission=null
+        ):: std.prune(a={
+          method: method,
+          permission: permission,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter_ingress_policy.ingress_to.operations.new` constructs a new object with attributes and blocks configured for the `operations`\nTerraform sub block.\n\n\n\n**Args**:\n  - `service_name` (`string`): The name of the API whose methods or permissions the 'IngressPolicy' or\n'EgressPolicy' want to allow. A single 'ApiOperation' with 'serviceName'\nfield set to '*' will allow all methods AND permissions for all services. When `null`, the `service_name` field will be omitted from the resulting object.\n  - `method_selectors` (`list[obj]`): API methods or permissions to allow. Method or permission must belong to\nthe service specified by serviceName field. A single 'MethodSelector' entry\nwith '*' specified for the method field will allow all methods AND\npermissions for the service specified in 'serviceName'. When `null`, the `method_selectors` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_ingress_policy.ingress_to.operations.method_selectors.new](#fn-ingress_toingress_tomethod_selectorsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `operations` sub block.\n', args=[]),
+      new(
+        method_selectors=null,
+        service_name=null
+      ):: std.prune(a={
+        method_selectors: method_selectors,
+        service_name: service_name,
+      }),
+    },
+  },
+  '#new':: d.fn(help="\n`google.access_context_manager_service_perimeter_ingress_policy.new` injects a new `google_access_context_manager_service_perimeter_ingress_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.access_context_manager_service_perimeter_ingress_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.access_context_manager_service_perimeter_ingress_policy` using the reference:\n\n    $._ref.google_access_context_manager_service_perimeter_ingress_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_access_context_manager_service_perimeter_ingress_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `perimeter` (`string`): The name of the Service Perimeter to add this resource to.\n  - `ingress_from` (`list[obj]`): Defines the conditions on the source of a request causing this \u0026#39;IngressPolicy\u0026#39;\nto apply. When `null`, the `ingress_from` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_ingress_policy.ingress_from.new](#fn-ingress_fromnew) constructor.\n  - `ingress_to` (`list[obj]`): Defines the conditions on the \u0026#39;ApiOperation\u0026#39; and request destination that cause\nthis \u0026#39;IngressPolicy\u0026#39; to apply. When `null`, the `ingress_to` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_ingress_policy.ingress_to.new](#fn-ingress_tonew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_ingress_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    perimeter,
+    ingress_from=null,
+    ingress_to=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_access_context_manager_service_perimeter_ingress_policy',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      ingress_from=ingress_from,
+      ingress_to=ingress_to,
+      perimeter=perimeter,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.access_context_manager_service_perimeter_ingress_policy.newAttrs` constructs a new object with attributes and blocks configured for the `access_context_manager_service_perimeter_ingress_policy`\nTerraform resource.\n\nUnlike [google.access_context_manager_service_perimeter_ingress_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `perimeter` (`string`): The name of the Service Perimeter to add this resource to.\n  - `ingress_from` (`list[obj]`): Defines the conditions on the source of a request causing this 'IngressPolicy'\nto apply. When `null`, the `ingress_from` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_ingress_policy.ingress_from.new](#fn-ingress_fromnew) constructor.\n  - `ingress_to` (`list[obj]`): Defines the conditions on the 'ApiOperation' and request destination that cause\nthis 'IngressPolicy' to apply. When `null`, the `ingress_to` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_ingress_policy.ingress_to.new](#fn-ingress_tonew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_ingress_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `access_context_manager_service_perimeter_ingress_policy` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    perimeter,
+    ingress_from=null,
+    ingress_to=null,
+    timeouts=null
+  ):: std.prune(a={
+    ingress_from: ingress_from,
+    ingress_to: ingress_to,
+    perimeter: perimeter,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter_ingress_policy.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withIngressFrom':: d.fn(help='`google.list[obj].withIngressFrom` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the ingress_from field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withIngressFromMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `ingress_from` field.\n', args=[]),
+  withIngressFrom(resourceLabel, value): {
+    resource+: {
+      google_access_context_manager_service_perimeter_ingress_policy+: {
+        [resourceLabel]+: {
+          ingress_from: value,
+        },
+      },
+    },
+  },
+  '#withIngressFromMixin':: d.fn(help='`google.list[obj].withIngressFromMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the ingress_from field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withIngressFrom](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `ingress_from` field.\n', args=[]),
+  withIngressFromMixin(resourceLabel, value): {
+    resource+: {
+      google_access_context_manager_service_perimeter_ingress_policy+: {
+        [resourceLabel]+: {
+          ingress_from+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withIngressTo':: d.fn(help='`google.list[obj].withIngressTo` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the ingress_to field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withIngressToMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `ingress_to` field.\n', args=[]),
+  withIngressTo(resourceLabel, value): {
+    resource+: {
+      google_access_context_manager_service_perimeter_ingress_policy+: {
+        [resourceLabel]+: {
+          ingress_to: value,
+        },
+      },
+    },
+  },
+  '#withIngressToMixin':: d.fn(help='`google.list[obj].withIngressToMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the ingress_to field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withIngressTo](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `ingress_to` field.\n', args=[]),
+  withIngressToMixin(resourceLabel, value): {
+    resource+: {
+      google_access_context_manager_service_perimeter_ingress_policy+: {
+        [resourceLabel]+: {
+          ingress_to+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withPerimeter':: d.fn(help='`google.string.withPerimeter` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the perimeter field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `perimeter` field.\n', args=[]),
+  withPerimeter(resourceLabel, value): {
+    resource+: {
+      google_access_context_manager_service_perimeter_ingress_policy+: {
+        [resourceLabel]+: {
+          perimeter: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_access_context_manager_service_perimeter_ingress_policy+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_access_context_manager_service_perimeter_ingress_policy+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/certificate_manager_certificate_issuance_config.libsonnet b/4.x/_gen/resources/certificate_manager_certificate_issuance_config.libsonnet
new file mode 100644
index 0000000..8cee005
--- /dev/null
+++ b/4.x/_gen/resources/certificate_manager_certificate_issuance_config.libsonnet
@@ -0,0 +1,206 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='certificate_manager_certificate_issuance_config', url='', help='`certificate_manager_certificate_issuance_config` represents the `google_certificate_manager_certificate_issuance_config` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  certificate_authority_config:: {
+    certificate_authority_service_config:: {
+      '#new':: d.fn(help='\n`google.certificate_manager_certificate_issuance_config.certificate_authority_config.certificate_authority_service_config.new` constructs a new object with attributes and blocks configured for the `certificate_authority_service_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `ca_pool` (`string`): A CA pool resource used to issue a certificate.\nThe CA pool string has a relative resource path following the form\n"projects/{project}/locations/{location}/caPools/{caPool}".\n\n**Returns**:\n  - An attribute object that represents the `certificate_authority_service_config` sub block.\n', args=[]),
+      new(
+        ca_pool
+      ):: std.prune(a={
+        ca_pool: ca_pool,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.certificate_manager_certificate_issuance_config.certificate_authority_config.new` constructs a new object with attributes and blocks configured for the `certificate_authority_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `certificate_authority_service_config` (`list[obj]`): Defines a CertificateAuthorityServiceConfig. When `null`, the `certificate_authority_service_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.certificate_authority_config.certificate_authority_service_config.new](#fn-certificate_authority_configcertificate_authority_service_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `certificate_authority_config` sub block.\n', args=[]),
+    new(
+      certificate_authority_service_config=null
+    ):: std.prune(a={
+      certificate_authority_service_config: certificate_authority_service_config,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.certificate_manager_certificate_issuance_config.new` injects a new `google_certificate_manager_certificate_issuance_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_certificate_issuance_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_certificate_issuance_config` using the reference:\n\n    $._ref.google_certificate_manager_certificate_issuance_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_certificate_issuance_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): One or more paragraphs of text description of a CertificateIssuanceConfig. When `null`, the `description` field will be omitted from the resulting object.\n  - `key_algorithm` (`string`): Key algorithm to use when generating the private key. Possible values: [\u0026#34;RSA_2048\u0026#34;, \u0026#34;ECDSA_P256\u0026#34;]\n  - `labels` (`obj`): \u0026#39;Set of label tags associated with the CertificateIssuanceConfig resource.\n An object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): Lifetime of issued certificates. A duration in seconds with up to nine fractional digits, ending with \u0026#39;s\u0026#39;.\nExample: \u0026#34;1814400s\u0026#34;. Valid values are from 21 days (1814400s) to 30 days (2592000s)\n  - `location` (`string`): The Certificate Manager location. If not specified, \u0026#34;global\u0026#34; is used. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the certificate issuance config.\nCertificateIssuanceConfig names must be unique globally.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `rotation_window_percentage` (`number`): It specifies the percentage of elapsed time of the certificate lifetime to wait before renewing the certificate.\nMust be a number between 1-99, inclusive.\nYou must set the rotation window percentage in relation to the certificate lifetime so that certificate renewal occurs at least 7 days after\nthe certificate has been issued and at least 7 days before it expires.\n  - `certificate_authority_config` (`list[obj]`): The CA that issues the workload certificate. It includes the CA address, type, authentication to CA service, etc. When `null`, the `certificate_authority_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.certificate_authority_config.new](#fn-certificate_authority_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    key_algorithm,
+    lifetime,
+    name,
+    rotation_window_percentage,
+    certificate_authority_config=null,
+    description=null,
+    labels=null,
+    location=null,
+    project=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_certificate_manager_certificate_issuance_config',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      certificate_authority_config=certificate_authority_config,
+      description=description,
+      key_algorithm=key_algorithm,
+      labels=labels,
+      lifetime=lifetime,
+      location=location,
+      name=name,
+      project=project,
+      rotation_window_percentage=rotation_window_percentage,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.certificate_manager_certificate_issuance_config.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_certificate_issuance_config`\nTerraform resource.\n\nUnlike [google.certificate_manager_certificate_issuance_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): One or more paragraphs of text description of a CertificateIssuanceConfig. When `null`, the `description` field will be omitted from the resulting object.\n  - `key_algorithm` (`string`): Key algorithm to use when generating the private key. Possible values: ["RSA_2048", "ECDSA_P256"]\n  - `labels` (`obj`): 'Set of label tags associated with the CertificateIssuanceConfig resource.\n An object containing a list of "key": value pairs. Example: { "name": "wrench", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): Lifetime of issued certificates. A duration in seconds with up to nine fractional digits, ending with 's'.\nExample: "1814400s". Valid values are from 21 days (1814400s) to 30 days (2592000s)\n  - `location` (`string`): The Certificate Manager location. If not specified, "global" is used. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the certificate issuance config.\nCertificateIssuanceConfig names must be unique globally.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `rotation_window_percentage` (`number`): It specifies the percentage of elapsed time of the certificate lifetime to wait before renewing the certificate.\nMust be a number between 1-99, inclusive.\nYou must set the rotation window percentage in relation to the certificate lifetime so that certificate renewal occurs at least 7 days after\nthe certificate has been issued and at least 7 days before it expires.\n  - `certificate_authority_config` (`list[obj]`): The CA that issues the workload certificate. It includes the CA address, type, authentication to CA service, etc. When `null`, the `certificate_authority_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.certificate_authority_config.new](#fn-certificate_authority_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_certificate_issuance_config` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    key_algorithm,
+    lifetime,
+    name,
+    rotation_window_percentage,
+    certificate_authority_config=null,
+    description=null,
+    labels=null,
+    location=null,
+    project=null,
+    timeouts=null
+  ):: std.prune(a={
+    certificate_authority_config: certificate_authority_config,
+    description: description,
+    key_algorithm: key_algorithm,
+    labels: labels,
+    lifetime: lifetime,
+    location: location,
+    name: name,
+    project: project,
+    rotation_window_percentage: rotation_window_percentage,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.certificate_manager_certificate_issuance_config.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+    }),
+  },
+  '#withCertificateAuthorityConfig':: d.fn(help='`google.list[obj].withCertificateAuthorityConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the certificate_authority_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withCertificateAuthorityConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `certificate_authority_config` field.\n', args=[]),
+  withCertificateAuthorityConfig(resourceLabel, value): {
+    resource+: {
+      google_certificate_manager_certificate_issuance_config+: {
+        [resourceLabel]+: {
+          certificate_authority_config: value,
+        },
+      },
+    },
+  },
+  '#withCertificateAuthorityConfigMixin':: d.fn(help='`google.list[obj].withCertificateAuthorityConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the certificate_authority_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCertificateAuthorityConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `certificate_authority_config` field.\n', args=[]),
+  withCertificateAuthorityConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_certificate_manager_certificate_issuance_config+: {
+        [resourceLabel]+: {
+          certificate_authority_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_certificate_manager_certificate_issuance_config+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withKeyAlgorithm':: d.fn(help='`google.string.withKeyAlgorithm` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the key_algorithm field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `key_algorithm` field.\n', args=[]),
+  withKeyAlgorithm(resourceLabel, value): {
+    resource+: {
+      google_certificate_manager_certificate_issuance_config+: {
+        [resourceLabel]+: {
+          key_algorithm: value,
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_certificate_manager_certificate_issuance_config+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withLifetime':: d.fn(help='`google.string.withLifetime` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the lifetime field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `lifetime` field.\n', args=[]),
+  withLifetime(resourceLabel, value): {
+    resource+: {
+      google_certificate_manager_certificate_issuance_config+: {
+        [resourceLabel]+: {
+          lifetime: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_certificate_manager_certificate_issuance_config+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_certificate_manager_certificate_issuance_config+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_certificate_manager_certificate_issuance_config+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withRotationWindowPercentage':: d.fn(help='`google.number.withRotationWindowPercentage` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the rotation_window_percentage field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `rotation_window_percentage` field.\n', args=[]),
+  withRotationWindowPercentage(resourceLabel, value): {
+    resource+: {
+      google_certificate_manager_certificate_issuance_config+: {
+        [resourceLabel]+: {
+          rotation_window_percentage: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_certificate_manager_certificate_issuance_config+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_certificate_manager_certificate_issuance_config+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/data_loss_prevention_deidentify_template.libsonnet b/4.x/_gen/resources/data_loss_prevention_deidentify_template.libsonnet
index a0b64b5..ed34e0b 100644
--- a/4.x/_gen/resources/data_loss_prevention_deidentify_template.libsonnet
+++ b/4.x/_gen/resources/data_loss_prevention_deidentify_template.libsonnet
@@ -94,6 +94,164 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           primitive_transformation: primitive_transformation,
         }),
         primitive_transformation:: {
+          bucketing_config:: {
+            buckets:: {
+              max:: {
+                date_value:: {
+                  '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.date_value.new` constructs a new object with attributes and blocks configured for the `date_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `day` (`number`): Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant. When `null`, the `day` field will be omitted from the resulting object.\n  - `month` (`number`): Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day. When `null`, the `month` field will be omitted from the resulting object.\n  - `year` (`number`): Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year. When `null`, the `year` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `date_value` sub block.\n', args=[]),
+                  new(
+                    day=null,
+                    month=null,
+                    year=null
+                  ):: std.prune(a={
+                    day: day,
+                    month: month,
+                    year: year,
+                  }),
+                },
+                '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.new` constructs a new object with attributes and blocks configured for the `max`\nTerraform sub block.\n\n\n\n**Args**:\n  - `day_of_week_value` (`string`): Represents a day of the week. Possible values: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"] When `null`, the `day_of_week_value` field will be omitted from the resulting object.\n  - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.\n  - `integer_value` (`string`): An integer value (int64 format) When `null`, the `integer_value` field will be omitted from the resulting object.\n  - `string_value` (`string`): A string value. When `null`, the `string_value` field will be omitted from the resulting object.\n  - `timestamp_value` (`string`): A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". When `null`, the `timestamp_value` field will be omitted from the resulting object.\n  - `date_value` (`list[obj]`): Represents a whole or partial calendar date. When `null`, the `date_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.date_value.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsdate_valuenew) constructor.\n  - `time_value` (`list[obj]`): Represents a time of day. When `null`, the `time_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.time_value.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketstime_valuenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `max` sub block.\n', args=[]),
+                new(
+                  date_value=null,
+                  day_of_week_value=null,
+                  float_value=null,
+                  integer_value=null,
+                  string_value=null,
+                  time_value=null,
+                  timestamp_value=null
+                ):: std.prune(a={
+                  date_value: date_value,
+                  day_of_week_value: day_of_week_value,
+                  float_value: float_value,
+                  integer_value: integer_value,
+                  string_value: string_value,
+                  time_value: time_value,
+                  timestamp_value: timestamp_value,
+                }),
+                time_value:: {
+                  '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.time_value.new` constructs a new object with attributes and blocks configured for the `time_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `hours` (`number`): Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time. When `null`, the `hours` field will be omitted from the resulting object.\n  - `minutes` (`number`): Minutes of hour of day. Must be from 0 to 59. When `null`, the `minutes` field will be omitted from the resulting object.\n  - `nanos` (`number`): Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999. When `null`, the `nanos` field will be omitted from the resulting object.\n  - `seconds` (`number`): Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds. When `null`, the `seconds` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `time_value` sub block.\n', args=[]),
+                  new(
+                    hours=null,
+                    minutes=null,
+                    nanos=null,
+                    seconds=null
+                  ):: std.prune(a={
+                    hours: hours,
+                    minutes: minutes,
+                    nanos: nanos,
+                    seconds: seconds,
+                  }),
+                },
+              },
+              min:: {
+                date_value:: {
+                  '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.date_value.new` constructs a new object with attributes and blocks configured for the `date_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `day` (`number`): Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant. When `null`, the `day` field will be omitted from the resulting object.\n  - `month` (`number`): Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day. When `null`, the `month` field will be omitted from the resulting object.\n  - `year` (`number`): Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year. When `null`, the `year` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `date_value` sub block.\n', args=[]),
+                  new(
+                    day=null,
+                    month=null,
+                    year=null
+                  ):: std.prune(a={
+                    day: day,
+                    month: month,
+                    year: year,
+                  }),
+                },
+                '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.new` constructs a new object with attributes and blocks configured for the `min`\nTerraform sub block.\n\n\n\n**Args**:\n  - `day_of_week_value` (`string`): Represents a day of the week. Possible values: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"] When `null`, the `day_of_week_value` field will be omitted from the resulting object.\n  - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.\n  - `integer_value` (`string`): An integer value (int64 format) When `null`, the `integer_value` field will be omitted from the resulting object.\n  - `string_value` (`string`): A string value. When `null`, the `string_value` field will be omitted from the resulting object.\n  - `timestamp_value` (`string`): A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". When `null`, the `timestamp_value` field will be omitted from the resulting object.\n  - `date_value` (`list[obj]`): Represents a whole or partial calendar date. When `null`, the `date_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.date_value.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsdate_valuenew) constructor.\n  - `time_value` (`list[obj]`): Represents a time of day. When `null`, the `time_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.time_value.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketstime_valuenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `min` sub block.\n', args=[]),
+                new(
+                  date_value=null,
+                  day_of_week_value=null,
+                  float_value=null,
+                  integer_value=null,
+                  string_value=null,
+                  time_value=null,
+                  timestamp_value=null
+                ):: std.prune(a={
+                  date_value: date_value,
+                  day_of_week_value: day_of_week_value,
+                  float_value: float_value,
+                  integer_value: integer_value,
+                  string_value: string_value,
+                  time_value: time_value,
+                  timestamp_value: timestamp_value,
+                }),
+                time_value:: {
+                  '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.time_value.new` constructs a new object with attributes and blocks configured for the `time_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `hours` (`number`): Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time. When `null`, the `hours` field will be omitted from the resulting object.\n  - `minutes` (`number`): Minutes of hour of day. Must be from 0 to 59. When `null`, the `minutes` field will be omitted from the resulting object.\n  - `nanos` (`number`): Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999. When `null`, the `nanos` field will be omitted from the resulting object.\n  - `seconds` (`number`): Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds. When `null`, the `seconds` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `time_value` sub block.\n', args=[]),
+                  new(
+                    hours=null,
+                    minutes=null,
+                    nanos=null,
+                    seconds=null
+                  ):: std.prune(a={
+                    hours: hours,
+                    minutes: minutes,
+                    nanos: nanos,
+                    seconds: seconds,
+                  }),
+                },
+              },
+              '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.new` constructs a new object with attributes and blocks configured for the `buckets`\nTerraform sub block.\n\n\n\n**Args**:\n  - `max` (`list[obj]`): Upper bound of the range, exclusive; type must match min.\nThe 'max' block must only contain one argument. See the 'bucketing_config' block description for more information about choosing a data type. When `null`, the `max` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configmaxnew) constructor.\n  - `min` (`list[obj]`): Lower bound of the range, inclusive. Type should be the same as max if used.\nThe 'min' block must only contain one argument. See the 'bucketing_config' block description for more information about choosing a data type. When `null`, the `min` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configminnew) constructor.\n  - `replacement_value` (`list[obj]`): Replacement value for this bucket.\nThe 'replacement_value' block must only contain one argument. When `null`, the `replacement_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configreplacement_valuenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `buckets` sub block.\n', args=[]),
+              new(
+                max=null,
+                min=null,
+                replacement_value=null
+              ):: std.prune(a={
+                max: max,
+                min: min,
+                replacement_value: replacement_value,
+              }),
+              replacement_value:: {
+                date_value:: {
+                  '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.date_value.new` constructs a new object with attributes and blocks configured for the `date_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `day` (`number`): Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant. When `null`, the `day` field will be omitted from the resulting object.\n  - `month` (`number`): Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day. When `null`, the `month` field will be omitted from the resulting object.\n  - `year` (`number`): Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year. When `null`, the `year` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `date_value` sub block.\n', args=[]),
+                  new(
+                    day=null,
+                    month=null,
+                    year=null
+                  ):: std.prune(a={
+                    day: day,
+                    month: month,
+                    year: year,
+                  }),
+                },
+                '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.new` constructs a new object with attributes and blocks configured for the `replacement_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `day_of_week_value` (`string`): Represents a day of the week. Possible values: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"] When `null`, the `day_of_week_value` field will be omitted from the resulting object.\n  - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.\n  - `integer_value` (`string`): An integer value (int64 format) When `null`, the `integer_value` field will be omitted from the resulting object.\n  - `string_value` (`string`): A string value. When `null`, the `string_value` field will be omitted from the resulting object.\n  - `timestamp_value` (`string`): A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". When `null`, the `timestamp_value` field will be omitted from the resulting object.\n  - `date_value` (`list[obj]`): Represents a whole or partial calendar date. When `null`, the `date_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.date_value.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsdate_valuenew) constructor.\n  - `time_value` (`list[obj]`): Represents a time of day. When `null`, the `time_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.time_value.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketstime_valuenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `replacement_value` sub block.\n', args=[]),
+                new(
+                  date_value=null,
+                  day_of_week_value=null,
+                  float_value=null,
+                  integer_value=null,
+                  string_value=null,
+                  time_value=null,
+                  timestamp_value=null
+                ):: std.prune(a={
+                  date_value: date_value,
+                  day_of_week_value: day_of_week_value,
+                  float_value: float_value,
+                  integer_value: integer_value,
+                  string_value: string_value,
+                  time_value: time_value,
+                  timestamp_value: timestamp_value,
+                }),
+                time_value:: {
+                  '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.time_value.new` constructs a new object with attributes and blocks configured for the `time_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `hours` (`number`): Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time. When `null`, the `hours` field will be omitted from the resulting object.\n  - `minutes` (`number`): Minutes of hour of day. Must be from 0 to 59. When `null`, the `minutes` field will be omitted from the resulting object.\n  - `nanos` (`number`): Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999. When `null`, the `nanos` field will be omitted from the resulting object.\n  - `seconds` (`number`): Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds. When `null`, the `seconds` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `time_value` sub block.\n', args=[]),
+                  new(
+                    hours=null,
+                    minutes=null,
+                    nanos=null,
+                    seconds=null
+                  ):: std.prune(a={
+                    hours: hours,
+                    minutes: minutes,
+                    nanos: nanos,
+                    seconds: seconds,
+                  }),
+                },
+              },
+            },
+            '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.new` constructs a new object with attributes and blocks configured for the `bucketing_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `buckets` (`list[obj]`): Set of buckets. Ranges must be non-overlapping.\nBucket is represented as a range, along with replacement values. When `null`, the `buckets` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `bucketing_config` sub block.\n', args=[]),
+            new(
+              buckets=null
+            ):: std.prune(a={
+              buckets: buckets,
+            }),
+          },
           character_mask_config:: {
             characters_to_ignore:: {
               '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.character_mask_config.characters_to_ignore.new` constructs a new object with attributes and blocks configured for the `characters_to_ignore`\nTerraform sub block.\n\n\n\n**Args**:\n  - `characters_to_skip` (`string`): Characters to not transform when masking. When `null`, the `characters_to_skip` field will be omitted from the resulting object.\n  - `common_characters_to_ignore` (`string`): Common characters to not transform when masking. Useful to avoid removing punctuation. Possible values: ["NUMERIC", "ALPHA_UPPER_CASE", "ALPHA_LOWER_CASE", "PUNCTUATION", "WHITESPACE"] When `null`, the `common_characters_to_ignore` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `characters_to_ignore` sub block.\n', args=[]),
@@ -260,22 +418,130 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
               }),
             },
           },
-          '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.new` constructs a new object with attributes and blocks configured for the `primitive_transformation`\nTerraform sub block.\n\n\n\n**Args**:\n  - `replace_with_info_type_config` (`bool`): Replace each matching finding with the name of the info type. When `null`, the `replace_with_info_type_config` field will be omitted from the resulting object.\n  - `character_mask_config` (`list[obj]`): Partially mask a string by replacing a given number of characters with a fixed character.\nMasking can start from the beginning or end of the string. When `null`, the `character_mask_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.character_mask_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationscharacter_mask_confignew) constructor.\n  - `crypto_deterministic_config` (`list[obj]`): Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC [https://tools.ietf.org/html/rfc5297](https://tools.ietf.org/html/rfc5297). When `null`, the `crypto_deterministic_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationscrypto_deterministic_confignew) constructor.\n  - `crypto_replace_ffx_fpe_config` (`list[obj]`): Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the 'content.reidentify' API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See [https://cloud.google.com/dlp/docs/pseudonymization](https://cloud.google.com/dlp/docs/pseudonymization) to learn more.\n\nNote: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. When `null`, the `crypto_replace_ffx_fpe_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationscrypto_replace_ffx_fpe_confignew) constructor.\n  - `replace_config` (`list[obj]`): Replace each input value with a given value. When `null`, the `replace_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsreplace_confignew) constructor.\n  - `replace_dictionary_config` (`list[obj]`): Replace with a value randomly drawn (with replacement) from a dictionary. When `null`, the `replace_dictionary_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsreplace_dictionary_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `primitive_transformation` sub block.\n', args=[]),
+          date_shift_config:: {
+            context:: {
+              '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.context.new` constructs a new object with attributes and blocks configured for the `context`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): Name describing the field.\n\n**Returns**:\n  - An attribute object that represents the `context` sub block.\n', args=[]),
+              new(
+                name
+              ):: std.prune(a={
+                name: name,
+              }),
+            },
+            crypto_key:: {
+              kms_wrapped:: {
+                '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.kms_wrapped.new` constructs a new object with attributes and blocks configured for the `kms_wrapped`\nTerraform sub block.\n\n\n\n**Args**:\n  - `crypto_key_name` (`string`): The resource name of the KMS CryptoKey to use for unwrapping.\n  - `wrapped_key` (`string`): The wrapped data crypto key.\nA base64-encoded string.\n\n**Returns**:\n  - An attribute object that represents the `kms_wrapped` sub block.\n', args=[]),
+                new(
+                  crypto_key_name,
+                  wrapped_key
+                ):: std.prune(a={
+                  crypto_key_name: crypto_key_name,
+                  wrapped_key: wrapped_key,
+                }),
+              },
+              '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.new` constructs a new object with attributes and blocks configured for the `crypto_key`\nTerraform sub block.\n\n\n\n**Args**:\n  - `kms_wrapped` (`list[obj]`): KMS wrapped key.\nInclude to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt\nFor more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key).\nNote: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). When `null`, the `kms_wrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.kms_wrapped.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationdate_shift_configkms_wrappednew) constructor.\n  - `transient` (`list[obj]`): Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes. When `null`, the `transient` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.transient.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationdate_shift_configtransientnew) constructor.\n  - `unwrapped` (`list[obj]`): Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. When `null`, the `unwrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.unwrapped.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationdate_shift_configunwrappednew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `crypto_key` sub block.\n', args=[]),
+              new(
+                kms_wrapped=null,
+                transient=null,
+                unwrapped=null
+              ):: std.prune(a={
+                kms_wrapped: kms_wrapped,
+                transient: transient,
+                unwrapped: unwrapped,
+              }),
+              transient:: {
+                '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.transient.new` constructs a new object with attributes and blocks configured for the `transient`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate 'TransientCryptoKey' protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).\n\n**Returns**:\n  - An attribute object that represents the `transient` sub block.\n', args=[]),
+                new(
+                  name
+                ):: std.prune(a={
+                  name: name,
+                }),
+              },
+              unwrapped:: {
+                '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.unwrapped.new` constructs a new object with attributes and blocks configured for the `unwrapped`\nTerraform sub block.\n\n\n\n**Args**:\n  - `key` (`string`): A 128/192/256 bit key.\nA base64-encoded string.\n\n**Returns**:\n  - An attribute object that represents the `unwrapped` sub block.\n', args=[]),
+                new(
+                  key
+                ):: std.prune(a={
+                  key: key,
+                }),
+              },
+            },
+            '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.new` constructs a new object with attributes and blocks configured for the `date_shift_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `lower_bound_days` (`number`): Range of shift in days. Negative means shift to earlier in time.\n  - `upper_bound_days` (`number`): Range of shift in days. Actual shift will be selected at random within this range (inclusive ends).\nNegative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction.\n  - `context` (`list[obj]`): Points to the field that contains the context, for example, an entity id.\nIf set, must also set cryptoKey. If set, shift will be consistent for the given context. When `null`, the `context` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.context.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcontextnew) constructor.\n  - `crypto_key` (`list[obj]`): The key used by the encryption function. When `null`, the `crypto_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcrypto_keynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `date_shift_config` sub block.\n', args=[]),
+            new(
+              lower_bound_days,
+              upper_bound_days,
+              context=null,
+              crypto_key=null
+            ):: std.prune(a={
+              context: context,
+              crypto_key: crypto_key,
+              lower_bound_days: lower_bound_days,
+              upper_bound_days: upper_bound_days,
+            }),
+          },
+          fixed_size_bucketing_config:: {
+            lower_bound:: {
+              '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.lower_bound.new` constructs a new object with attributes and blocks configured for the `lower_bound`\nTerraform sub block.\n\n\n\n**Args**:\n  - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.\n  - `integer_value` (`string`): An integer value (int64 format) When `null`, the `integer_value` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `lower_bound` sub block.\n', args=[]),
+              new(
+                float_value=null,
+                integer_value=null
+              ):: std.prune(a={
+                float_value: float_value,
+                integer_value: integer_value,
+              }),
+            },
+            '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.new` constructs a new object with attributes and blocks configured for the `fixed_size_bucketing_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `bucket_size` (`number`): Size of each bucket (except for minimum and maximum buckets).\nSo if lower_bound = 10, upper_bound = 89, and bucketSize = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+.\nPrecision up to 2 decimals works.\n  - `lower_bound` (`list[obj]`): Lower bound value of buckets.\nAll values less than lower_bound are grouped together into a single bucket; for example if lower_bound = 10, then all values less than 10 are replaced with the value "-10".\nThe 'lower_bound' block must only contain one argument. See the 'fixed_size_bucketing_config' block description for more information about choosing a data type. When `null`, the `lower_bound` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.lower_bound.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationlower_boundnew) constructor.\n  - `upper_bound` (`list[obj]`): Upper bound value of buckets.\nAll values greater than upper_bound are grouped together into a single bucket; for example if upper_bound = 89, then all values greater than 89 are replaced with the value "89+".\nThe 'upper_bound' block must only contain one argument. See the 'fixed_size_bucketing_config' block description for more information about choosing a data type. When `null`, the `upper_bound` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.upper_bound.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationupper_boundnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `fixed_size_bucketing_config` sub block.\n', args=[]),
+            new(
+              bucket_size,
+              lower_bound=null,
+              upper_bound=null
+            ):: std.prune(a={
+              bucket_size: bucket_size,
+              lower_bound: lower_bound,
+              upper_bound: upper_bound,
+            }),
+            upper_bound:: {
+              '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.upper_bound.new` constructs a new object with attributes and blocks configured for the `upper_bound`\nTerraform sub block.\n\n\n\n**Args**:\n  - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.\n  - `integer_value` (`string`): An integer value (int64 format) When `null`, the `integer_value` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `upper_bound` sub block.\n', args=[]),
+              new(
+                float_value=null,
+                integer_value=null
+              ):: std.prune(a={
+                float_value: float_value,
+                integer_value: integer_value,
+              }),
+            },
+          },
+          '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.new` constructs a new object with attributes and blocks configured for the `primitive_transformation`\nTerraform sub block.\n\n\n\n**Args**:\n  - `replace_with_info_type_config` (`bool`): Replace each matching finding with the name of the info type. When `null`, the `replace_with_info_type_config` field will be omitted from the resulting object.\n  - `bucketing_config` (`list[obj]`): Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH\nThis can be used on data of type: number, long, string, timestamp.\nIf the provided value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing.\nSee https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. When `null`, the `bucketing_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsbucketing_confignew) constructor.\n  - `character_mask_config` (`list[obj]`): Partially mask a string by replacing a given number of characters with a fixed character.\nMasking can start from the beginning or end of the string. When `null`, the `character_mask_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.character_mask_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationscharacter_mask_confignew) constructor.\n  - `crypto_deterministic_config` (`list[obj]`): Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC [https://tools.ietf.org/html/rfc5297](https://tools.ietf.org/html/rfc5297). When `null`, the `crypto_deterministic_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationscrypto_deterministic_confignew) constructor.\n  - `crypto_replace_ffx_fpe_config` (`list[obj]`): Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the 'content.reidentify' API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See [https://cloud.google.com/dlp/docs/pseudonymization](https://cloud.google.com/dlp/docs/pseudonymization) to learn more.\n\nNote: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. When `null`, the `crypto_replace_ffx_fpe_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationscrypto_replace_ffx_fpe_confignew) constructor.\n  - `date_shift_config` (`list[obj]`): Shifts dates by random number of days, with option to be consistent for the same context. When `null`, the `date_shift_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsdate_shift_confignew) constructor.\n  - `fixed_size_bucketing_config` (`list[obj]`): Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies.\n\nThe transformed value will be a hyphenated string of {lower_bound}-{upper_bound}. For example, if lower_bound = 10 and upper_bound = 20, all values that are within this bucket will be replaced with "10-20".\n\nThis can be used on data of type: double, long.\n\nIf the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing.\n\nSee https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. When `null`, the `fixed_size_bucketing_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsfixed_size_bucketing_confignew) constructor.\n  - `redact_config` (`list[obj]`): Redact a given value. For example, if used with an InfoTypeTransformation transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. When `null`, the `redact_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.redact_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsredact_confignew) constructor.\n  - `replace_config` (`list[obj]`): Replace each input value with a given value. When `null`, the `replace_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsreplace_confignew) constructor.\n  - `replace_dictionary_config` (`list[obj]`): Replace with a value randomly drawn (with replacement) from a dictionary. When `null`, the `replace_dictionary_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsreplace_dictionary_confignew) constructor.\n  - `time_part_config` (`list[obj]`): For use with Date, Timestamp, and TimeOfDay, extract or preserve a portion of the value. When `null`, the `time_part_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.time_part_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationstime_part_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `primitive_transformation` sub block.\n', args=[]),
           new(
+            bucketing_config=null,
             character_mask_config=null,
             crypto_deterministic_config=null,
             crypto_replace_ffx_fpe_config=null,
+            date_shift_config=null,
+            fixed_size_bucketing_config=null,
+            redact_config=null,
             replace_config=null,
             replace_dictionary_config=null,
-            replace_with_info_type_config=null
+            replace_with_info_type_config=null,
+            time_part_config=null
           ):: std.prune(a={
+            bucketing_config: bucketing_config,
             character_mask_config: character_mask_config,
             crypto_deterministic_config: crypto_deterministic_config,
             crypto_replace_ffx_fpe_config: crypto_replace_ffx_fpe_config,
+            date_shift_config: date_shift_config,
+            fixed_size_bucketing_config: fixed_size_bucketing_config,
+            redact_config: redact_config,
             replace_config: replace_config,
             replace_dictionary_config: replace_dictionary_config,
             replace_with_info_type_config: replace_with_info_type_config,
+            time_part_config: time_part_config,
           }),
+          redact_config:: {
+            '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.redact_config.new` constructs a new object with attributes and blocks configured for the `redact_config`\nTerraform sub block.\n\n\n\n**Returns**:\n  - An attribute object that represents the `redact_config` sub block.\n', args=[]),
+            new(
+
+            ):: std.prune(a={}),
+          },
           replace_config:: {
             '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new` constructs a new object with attributes and blocks configured for the `replace_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `new_value` (`list[obj]`): Replace each input value with a given value.\nThe 'new_value' block must only contain one argument. For example when replacing the contents of a string-type field, only 'string_value' should be set. When `null`, the `new_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationnew_valuenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `replace_config` sub block.\n', args=[]),
             new(
@@ -348,6 +614,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
               }),
             },
           },
+          time_part_config:: {
+            '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.time_part_config.new` constructs a new object with attributes and blocks configured for the `time_part_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `part_to_extract` (`string`): The part of the time to keep. Possible values: ["YEAR", "MONTH", "DAY_OF_MONTH", "DAY_OF_WEEK", "WEEK_OF_YEAR", "HOUR_OF_DAY"] When `null`, the `part_to_extract` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `time_part_config` sub block.\n', args=[]),
+            new(
+              part_to_extract=null
+            ):: std.prune(a={
+              part_to_extract: part_to_extract,
+            }),
+          },
         },
       },
     },
@@ -465,14 +739,628 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
             name: name,
           }),
         },
-        '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.new` constructs a new object with attributes and blocks configured for the `field_transformations`\nTerraform sub block.\n\n\n\n**Args**:\n  - `condition` (`list[obj]`): Only apply the transformation if the condition evaluates to true for the given RecordCondition. The conditions are allowed to reference fields that are not used in the actual transformation.\nExample Use Cases:\n- Apply a different bucket transformation to an age column if the zip code column for the same record is within a specific range.\n- Redact a field if the date of birth field is greater than 85. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.new](#fn-deidentify_configdeidentify_configrecord_transformationsconditionnew) constructor.\n  - `fields` (`list[obj]`): Input field(s) to apply the transformation to. When you have columns that reference their position within a list, omit the index from the FieldId.\nFieldId name matching ignores the index. For example, instead of "contact.nums[0].type", use "contact.nums.type". When `null`, the `fields` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.fields.new](#fn-deidentify_configdeidentify_configrecord_transformationsfieldsnew) constructor.\n  - `primitive_transformation` (`list[obj]`): Apply the transformation to the entire field.\nThe 'primitive_transformation' block must only contain one argument, corresponding to the type of transformation. When `null`, the `primitive_transformation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.primitive_transformation.new](#fn-deidentify_configdeidentify_configrecord_transformationsprimitive_transformationnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `field_transformations` sub block.\n', args=[]),
+        info_type_transformations:: {
+          '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.new` constructs a new object with attributes and blocks configured for the `info_type_transformations`\nTerraform sub block.\n\n\n\n**Args**:\n  - `transformations` (`list[obj]`): Transformation for each infoType. Cannot specify more than one for a given infoType. When `null`, the `transformations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationstransformationsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `info_type_transformations` sub block.\n', args=[]),
+          new(
+            transformations=null
+          ):: std.prune(a={
+            transformations: transformations,
+          }),
+          transformations:: {
+            info_types:: {
+              '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.info_types.new` constructs a new object with attributes and blocks configured for the `info_types`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): Name of the information type.\n  - `version` (`string`): Version name for this InfoType. When `null`, the `version` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `info_types` sub block.\n', args=[]),
+              new(
+                name,
+                version=null
+              ):: std.prune(a={
+                name: name,
+                version: version,
+              }),
+            },
+            '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.new` constructs a new object with attributes and blocks configured for the `transformations`\nTerraform sub block.\n\n\n\n**Args**:\n  - `info_types` (`list[obj]`): InfoTypes to apply the transformation to. Leaving this empty will apply the transformation to apply to\nall findings that correspond to infoTypes that were requested in InspectConfig. When `null`, the `info_types` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.info_types.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationsinfo_typesnew) constructor.\n  - `primitive_transformation` (`list[obj]`): Apply the transformation to the entire field.\nThe 'primitive_transformation' block must only contain one argument, corresponding to the type of transformation. When `null`, the `primitive_transformation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationsprimitive_transformationnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `transformations` sub block.\n', args=[]),
+            new(
+              info_types=null,
+              primitive_transformation=null
+            ):: std.prune(a={
+              info_types: info_types,
+              primitive_transformation: primitive_transformation,
+            }),
+            primitive_transformation:: {
+              bucketing_config:: {
+                buckets:: {
+                  max:: {
+                    date_value:: {
+                      '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.date_value.new` constructs a new object with attributes and blocks configured for the `date_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `day` (`number`): Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant. When `null`, the `day` field will be omitted from the resulting object.\n  - `month` (`number`): Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day. When `null`, the `month` field will be omitted from the resulting object.\n  - `year` (`number`): Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year. When `null`, the `year` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `date_value` sub block.\n', args=[]),
+                      new(
+                        day=null,
+                        month=null,
+                        year=null
+                      ):: std.prune(a={
+                        day: day,
+                        month: month,
+                        year: year,
+                      }),
+                    },
+                    '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.new` constructs a new object with attributes and blocks configured for the `max`\nTerraform sub block.\n\n\n\n**Args**:\n  - `day_of_week_value` (`string`): Represents a day of the week. Possible values: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"] When `null`, the `day_of_week_value` field will be omitted from the resulting object.\n  - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.\n  - `integer_value` (`string`): An integer value (int64 format) When `null`, the `integer_value` field will be omitted from the resulting object.\n  - `string_value` (`string`): A string value. When `null`, the `string_value` field will be omitted from the resulting object.\n  - `timestamp_value` (`string`): A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". When `null`, the `timestamp_value` field will be omitted from the resulting object.\n  - `date_value` (`list[obj]`): Represents a whole or partial calendar date. When `null`, the `date_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.date_value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsdate_valuenew) constructor.\n  - `time_value` (`list[obj]`): Represents a time of day. When `null`, the `time_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.time_value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketstime_valuenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `max` sub block.\n', args=[]),
+                    new(
+                      date_value=null,
+                      day_of_week_value=null,
+                      float_value=null,
+                      integer_value=null,
+                      string_value=null,
+                      time_value=null,
+                      timestamp_value=null
+                    ):: std.prune(a={
+                      date_value: date_value,
+                      day_of_week_value: day_of_week_value,
+                      float_value: float_value,
+                      integer_value: integer_value,
+                      string_value: string_value,
+                      time_value: time_value,
+                      timestamp_value: timestamp_value,
+                    }),
+                    time_value:: {
+                      '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.time_value.new` constructs a new object with attributes and blocks configured for the `time_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `hours` (`number`): Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time. When `null`, the `hours` field will be omitted from the resulting object.\n  - `minutes` (`number`): Minutes of hour of day. Must be from 0 to 59. When `null`, the `minutes` field will be omitted from the resulting object.\n  - `nanos` (`number`): Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999. When `null`, the `nanos` field will be omitted from the resulting object.\n  - `seconds` (`number`): Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds. When `null`, the `seconds` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `time_value` sub block.\n', args=[]),
+                      new(
+                        hours=null,
+                        minutes=null,
+                        nanos=null,
+                        seconds=null
+                      ):: std.prune(a={
+                        hours: hours,
+                        minutes: minutes,
+                        nanos: nanos,
+                        seconds: seconds,
+                      }),
+                    },
+                  },
+                  min:: {
+                    date_value:: {
+                      '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.date_value.new` constructs a new object with attributes and blocks configured for the `date_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `day` (`number`): Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant. When `null`, the `day` field will be omitted from the resulting object.\n  - `month` (`number`): Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day. When `null`, the `month` field will be omitted from the resulting object.\n  - `year` (`number`): Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year. When `null`, the `year` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `date_value` sub block.\n', args=[]),
+                      new(
+                        day=null,
+                        month=null,
+                        year=null
+                      ):: std.prune(a={
+                        day: day,
+                        month: month,
+                        year: year,
+                      }),
+                    },
+                    '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.new` constructs a new object with attributes and blocks configured for the `min`\nTerraform sub block.\n\n\n\n**Args**:\n  - `day_of_week_value` (`string`): Represents a day of the week. Possible values: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"] When `null`, the `day_of_week_value` field will be omitted from the resulting object.\n  - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.\n  - `integer_value` (`string`): An integer value (int64 format) When `null`, the `integer_value` field will be omitted from the resulting object.\n  - `string_value` (`string`): A string value. When `null`, the `string_value` field will be omitted from the resulting object.\n  - `timestamp_value` (`string`): A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". When `null`, the `timestamp_value` field will be omitted from the resulting object.\n  - `date_value` (`list[obj]`): Represents a whole or partial calendar date. When `null`, the `date_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.date_value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsdate_valuenew) constructor.\n  - `time_value` (`list[obj]`): Represents a time of day. When `null`, the `time_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.time_value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketstime_valuenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `min` sub block.\n', args=[]),
+                    new(
+                      date_value=null,
+                      day_of_week_value=null,
+                      float_value=null,
+                      integer_value=null,
+                      string_value=null,
+                      time_value=null,
+                      timestamp_value=null
+                    ):: std.prune(a={
+                      date_value: date_value,
+                      day_of_week_value: day_of_week_value,
+                      float_value: float_value,
+                      integer_value: integer_value,
+                      string_value: string_value,
+                      time_value: time_value,
+                      timestamp_value: timestamp_value,
+                    }),
+                    time_value:: {
+                      '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.time_value.new` constructs a new object with attributes and blocks configured for the `time_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `hours` (`number`): Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time. When `null`, the `hours` field will be omitted from the resulting object.\n  - `minutes` (`number`): Minutes of hour of day. Must be from 0 to 59. When `null`, the `minutes` field will be omitted from the resulting object.\n  - `nanos` (`number`): Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999. When `null`, the `nanos` field will be omitted from the resulting object.\n  - `seconds` (`number`): Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds. When `null`, the `seconds` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `time_value` sub block.\n', args=[]),
+                      new(
+                        hours=null,
+                        minutes=null,
+                        nanos=null,
+                        seconds=null
+                      ):: std.prune(a={
+                        hours: hours,
+                        minutes: minutes,
+                        nanos: nanos,
+                        seconds: seconds,
+                      }),
+                    },
+                  },
+                  '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.new` constructs a new object with attributes and blocks configured for the `buckets`\nTerraform sub block.\n\n\n\n**Args**:\n  - `max` (`list[obj]`): Upper bound of the range, exclusive; type must match min.\nThe 'max' block must only contain one argument. See the 'bucketing_config' block description for more information about choosing a data type. When `null`, the `max` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configmaxnew) constructor.\n  - `min` (`list[obj]`): Lower bound of the range, inclusive. Type should be the same as max if used.\nThe 'min' block must only contain one argument. See the 'bucketing_config' block description for more information about choosing a data type. When `null`, the `min` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configminnew) constructor.\n  - `replacement_value` (`list[obj]`): Replacement value for this bucket.\nThe 'replacement_value' block must only contain one argument. When `null`, the `replacement_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configreplacement_valuenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `buckets` sub block.\n', args=[]),
+                  new(
+                    max=null,
+                    min=null,
+                    replacement_value=null
+                  ):: std.prune(a={
+                    max: max,
+                    min: min,
+                    replacement_value: replacement_value,
+                  }),
+                  replacement_value:: {
+                    date_value:: {
+                      '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.date_value.new` constructs a new object with attributes and blocks configured for the `date_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `day` (`number`): Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant. When `null`, the `day` field will be omitted from the resulting object.\n  - `month` (`number`): Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day. When `null`, the `month` field will be omitted from the resulting object.\n  - `year` (`number`): Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year. When `null`, the `year` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `date_value` sub block.\n', args=[]),
+                      new(
+                        day=null,
+                        month=null,
+                        year=null
+                      ):: std.prune(a={
+                        day: day,
+                        month: month,
+                        year: year,
+                      }),
+                    },
+                    '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.new` constructs a new object with attributes and blocks configured for the `replacement_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `day_of_week_value` (`string`): Represents a day of the week. Possible values: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"] When `null`, the `day_of_week_value` field will be omitted from the resulting object.\n  - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.\n  - `integer_value` (`string`): An integer value (int64 format) When `null`, the `integer_value` field will be omitted from the resulting object.\n  - `string_value` (`string`): A string value. When `null`, the `string_value` field will be omitted from the resulting object.\n  - `timestamp_value` (`string`): A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". When `null`, the `timestamp_value` field will be omitted from the resulting object.\n  - `date_value` (`list[obj]`): Represents a whole or partial calendar date. When `null`, the `date_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.date_value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsdate_valuenew) constructor.\n  - `time_value` (`list[obj]`): Represents a time of day. When `null`, the `time_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.time_value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketstime_valuenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `replacement_value` sub block.\n', args=[]),
+                    new(
+                      date_value=null,
+                      day_of_week_value=null,
+                      float_value=null,
+                      integer_value=null,
+                      string_value=null,
+                      time_value=null,
+                      timestamp_value=null
+                    ):: std.prune(a={
+                      date_value: date_value,
+                      day_of_week_value: day_of_week_value,
+                      float_value: float_value,
+                      integer_value: integer_value,
+                      string_value: string_value,
+                      time_value: time_value,
+                      timestamp_value: timestamp_value,
+                    }),
+                    time_value:: {
+                      '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.time_value.new` constructs a new object with attributes and blocks configured for the `time_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `hours` (`number`): Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time. When `null`, the `hours` field will be omitted from the resulting object.\n  - `minutes` (`number`): Minutes of hour of day. Must be from 0 to 59. When `null`, the `minutes` field will be omitted from the resulting object.\n  - `nanos` (`number`): Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999. When `null`, the `nanos` field will be omitted from the resulting object.\n  - `seconds` (`number`): Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds. When `null`, the `seconds` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `time_value` sub block.\n', args=[]),
+                      new(
+                        hours=null,
+                        minutes=null,
+                        nanos=null,
+                        seconds=null
+                      ):: std.prune(a={
+                        hours: hours,
+                        minutes: minutes,
+                        nanos: nanos,
+                        seconds: seconds,
+                      }),
+                    },
+                  },
+                },
+                '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.new` constructs a new object with attributes and blocks configured for the `bucketing_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `buckets` (`list[obj]`): Set of buckets. Ranges must be non-overlapping.\nBucket is represented as a range, along with replacement values. When `null`, the `buckets` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `bucketing_config` sub block.\n', args=[]),
+                new(
+                  buckets=null
+                ):: std.prune(a={
+                  buckets: buckets,
+                }),
+              },
+              character_mask_config:: {
+                characters_to_ignore:: {
+                  '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.character_mask_config.characters_to_ignore.new` constructs a new object with attributes and blocks configured for the `characters_to_ignore`\nTerraform sub block.\n\n\n\n**Args**:\n  - `characters_to_skip` (`string`): Characters to not transform when masking. Only one of this or 'common_characters_to_ignore' must be specified. When `null`, the `characters_to_skip` field will be omitted from the resulting object.\n  - `common_characters_to_ignore` (`string`): Common characters to not transform when masking. Useful to avoid removing punctuation. Only one of this or 'characters_to_skip' must be specified. Possible values: ["NUMERIC", "ALPHA_UPPER_CASE", "ALPHA_LOWER_CASE", "PUNCTUATION", "WHITESPACE"] When `null`, the `common_characters_to_ignore` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `characters_to_ignore` sub block.\n', args=[]),
+                  new(
+                    characters_to_skip=null,
+                    common_characters_to_ignore=null
+                  ):: std.prune(a={
+                    characters_to_skip: characters_to_skip,
+                    common_characters_to_ignore: common_characters_to_ignore,
+                  }),
+                },
+                '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.character_mask_config.new` constructs a new object with attributes and blocks configured for the `character_mask_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `masking_character` (`string`): Character to use to mask the sensitive values—for example, * for an alphabetic string such as a name, or 0 for a numeric string\nsuch as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to * for\nstrings, and 0 for digits. When `null`, the `masking_character` field will be omitted from the resulting object.\n  - `number_to_mask` (`number`): Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.\nIf number_to_mask is negative, this denotes inverse masking. Cloud DLP masks all but a number of characters. For example, suppose you have the following values:\n- 'masking_character' is *\n- 'number_to_mask' is -4\n- 'reverse_order' is false\n- 'characters_to_ignore' includes -\n- Input string is 1234-5678-9012-3456\n\nThe resulting de-identified string is ****-****-****-3456. Cloud DLP masks all but the last four characters. If reverseOrder is true, all but the first four characters are masked as 1234-****-****-****. When `null`, the `number_to_mask` field will be omitted from the resulting object.\n  - `reverse_order` (`bool`): Mask characters in reverse order. For example, if masking_character is 0, number_to_mask is 14, and reverse_order is 'false', then the\ninput string '1234-5678-9012-3456' is masked as '00000000000000-3456'. When `null`, the `reverse_order` field will be omitted from the resulting object.\n  - `characters_to_ignore` (`list[obj]`): Characters to skip when doing de-identification of a value. These will be left alone and skipped. When `null`, the `characters_to_ignore` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.character_mask_config.characters_to_ignore.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcharacters_to_ignorenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `character_mask_config` sub block.\n', args=[]),
+                new(
+                  characters_to_ignore=null,
+                  masking_character=null,
+                  number_to_mask=null,
+                  reverse_order=null
+                ):: std.prune(a={
+                  characters_to_ignore: characters_to_ignore,
+                  masking_character: masking_character,
+                  number_to_mask: number_to_mask,
+                  reverse_order: reverse_order,
+                }),
+              },
+              crypto_deterministic_config:: {
+                context:: {
+                  '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.context.new` constructs a new object with attributes and blocks configured for the `context`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): Name describing the field.\n\n**Returns**:\n  - An attribute object that represents the `context` sub block.\n', args=[]),
+                  new(
+                    name
+                  ):: std.prune(a={
+                    name: name,
+                  }),
+                },
+                crypto_key:: {
+                  kms_wrapped:: {
+                    '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.kms_wrapped.new` constructs a new object with attributes and blocks configured for the `kms_wrapped`\nTerraform sub block.\n\n\n\n**Args**:\n  - `crypto_key_name` (`string`): The resource name of the KMS CryptoKey to use for unwrapping.\n  - `wrapped_key` (`string`): The wrapped data crypto key.\n\nA base64-encoded string.\n\n**Returns**:\n  - An attribute object that represents the `kms_wrapped` sub block.\n', args=[]),
+                    new(
+                      crypto_key_name,
+                      wrapped_key
+                    ):: std.prune(a={
+                      crypto_key_name: crypto_key_name,
+                      wrapped_key: wrapped_key,
+                    }),
+                  },
+                  '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.new` constructs a new object with attributes and blocks configured for the `crypto_key`\nTerraform sub block.\n\n\n\n**Args**:\n  - `kms_wrapped` (`list[obj]`): KMS wrapped key.\nInclude to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt\nFor more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key). Only one of this, 'transient' or 'unwrapped' must be specified.\nNote: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). When `null`, the `kms_wrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.kms_wrapped.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_configkms_wrappednew) constructor.\n  - `transient` (`list[obj]`): Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes. Only one of this, 'unwrapped' or 'kms_wrapped' must be specified. When `null`, the `transient` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.transient.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_configtransientnew) constructor.\n  - `unwrapped` (`list[obj]`): Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. Only one of this, 'transient' or 'kms_wrapped' must be specified. When `null`, the `unwrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.unwrapped.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_configunwrappednew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `crypto_key` sub block.\n', args=[]),
+                  new(
+                    kms_wrapped=null,
+                    transient=null,
+                    unwrapped=null
+                  ):: std.prune(a={
+                    kms_wrapped: kms_wrapped,
+                    transient: transient,
+                    unwrapped: unwrapped,
+                  }),
+                  transient:: {
+                    '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.transient.new` constructs a new object with attributes and blocks configured for the `transient`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate 'TransientCryptoKey' protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).\n\n**Returns**:\n  - An attribute object that represents the `transient` sub block.\n', args=[]),
+                    new(
+                      name
+                    ):: std.prune(a={
+                      name: name,
+                    }),
+                  },
+                  unwrapped:: {
+                    '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.unwrapped.new` constructs a new object with attributes and blocks configured for the `unwrapped`\nTerraform sub block.\n\n\n\n**Args**:\n  - `key` (`string`): A 128/192/256 bit key.\n\nA base64-encoded string.\n\n**Returns**:\n  - An attribute object that represents the `unwrapped` sub block.\n', args=[]),
+                    new(
+                      key
+                    ):: std.prune(a={
+                      key: key,
+                    }),
+                  },
+                },
+                '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.new` constructs a new object with attributes and blocks configured for the `crypto_deterministic_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `context` (`list[obj]`): A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well.\n\nIf the context is not set, plaintext would be used as is for encryption. If the context is set but:\n\n1. there is no record present when transforming a given value or\n2. the field is not present when transforming a given value,\n\nplaintext would be used as is for encryption.\n\nNote that case (1) is expected when an InfoTypeTransformation is applied to both structured and unstructured ContentItems. When `null`, the `context` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.context.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcontextnew) constructor.\n  - `crypto_key` (`list[obj]`): The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use. When `null`, the `crypto_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_keynew) constructor.\n  - `surrogate_info_type` (`list[obj]`): The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate}\n\nFor example, if the name of custom info type is 'MY\\_TOKEN\\_INFO\\_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY\\_TOKEN\\_INFO\\_TYPE(3):abc'\n\nThis annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text.\n\nNote: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text.\n\nIn order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either\n\n*   reverse a surrogate that does not correspond to an actual identifier\n*   be unable to parse the surrogate and result in an error\n\nTherefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY\\_TOKEN\\_TYPE. When `null`, the `surrogate_info_type` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.surrogate_info_type.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationsurrogate_info_typenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `crypto_deterministic_config` sub block.\n', args=[]),
+                new(
+                  context=null,
+                  crypto_key=null,
+                  surrogate_info_type=null
+                ):: std.prune(a={
+                  context: context,
+                  crypto_key: crypto_key,
+                  surrogate_info_type: surrogate_info_type,
+                }),
+                surrogate_info_type:: {
+                  '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.surrogate_info_type.new` constructs a new object with attributes and blocks configured for the `surrogate_info_type`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at [https://cloud.google.com/dlp/docs/infotypes-reference](https://cloud.google.com/dlp/docs/infotypes-reference) when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern '[A-Za-z0-9$-_]{1,64}'.\n  - `version` (`string`): Optional version name for this InfoType. When `null`, the `version` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `surrogate_info_type` sub block.\n', args=[]),
+                  new(
+                    name,
+                    version=null
+                  ):: std.prune(a={
+                    name: name,
+                    version: version,
+                  }),
+                },
+              },
+              crypto_hash_config:: {
+                crypto_key:: {
+                  kms_wrapped:: {
+                    '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.kms_wrapped.new` constructs a new object with attributes and blocks configured for the `kms_wrapped`\nTerraform sub block.\n\n\n\n**Args**:\n  - `crypto_key_name` (`string`): The resource name of the KMS CryptoKey to use for unwrapping.\n  - `wrapped_key` (`string`): The wrapped data crypto key.\n\nA base64-encoded string.\n\n**Returns**:\n  - An attribute object that represents the `kms_wrapped` sub block.\n', args=[]),
+                    new(
+                      crypto_key_name,
+                      wrapped_key
+                    ):: std.prune(a={
+                      crypto_key_name: crypto_key_name,
+                      wrapped_key: wrapped_key,
+                    }),
+                  },
+                  '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.new` constructs a new object with attributes and blocks configured for the `crypto_key`\nTerraform sub block.\n\n\n\n**Args**:\n  - `kms_wrapped` (`list[obj]`): KMS wrapped key.\nInclude to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt\nFor more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key). Only one of this, 'transient' or 'unwrapped' must be specified.\nNote: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). When `null`, the `kms_wrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.kms_wrapped.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_hash_configkms_wrappednew) constructor.\n  - `transient` (`list[obj]`): Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes. Only one of this, 'unwrapped' or 'kms_wrapped' must be specified. When `null`, the `transient` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.transient.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_hash_configtransientnew) constructor.\n  - `unwrapped` (`list[obj]`): Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. Only one of this, 'transient' or 'kms_wrapped' must be specified. When `null`, the `unwrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.unwrapped.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_hash_configunwrappednew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `crypto_key` sub block.\n', args=[]),
+                  new(
+                    kms_wrapped=null,
+                    transient=null,
+                    unwrapped=null
+                  ):: std.prune(a={
+                    kms_wrapped: kms_wrapped,
+                    transient: transient,
+                    unwrapped: unwrapped,
+                  }),
+                  transient:: {
+                    '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.transient.new` constructs a new object with attributes and blocks configured for the `transient`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate 'TransientCryptoKey' protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).\n\n**Returns**:\n  - An attribute object that represents the `transient` sub block.\n', args=[]),
+                    new(
+                      name
+                    ):: std.prune(a={
+                      name: name,
+                    }),
+                  },
+                  unwrapped:: {
+                    '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.unwrapped.new` constructs a new object with attributes and blocks configured for the `unwrapped`\nTerraform sub block.\n\n\n\n**Args**:\n  - `key` (`string`): A 128/192/256 bit key.\n\nA base64-encoded string.\n\n**Returns**:\n  - An attribute object that represents the `unwrapped` sub block.\n', args=[]),
+                    new(
+                      key
+                    ):: std.prune(a={
+                      key: key,
+                    }),
+                  },
+                },
+                '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.new` constructs a new object with attributes and blocks configured for the `crypto_hash_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `crypto_key` (`list[obj]`): The key used by the encryption function. When `null`, the `crypto_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_keynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `crypto_hash_config` sub block.\n', args=[]),
+                new(
+                  crypto_key=null
+                ):: std.prune(a={
+                  crypto_key: crypto_key,
+                }),
+              },
+              crypto_replace_ffx_fpe_config:: {
+                context:: {
+                  '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.context.new` constructs a new object with attributes and blocks configured for the `context`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): Name describing the field.\n\n**Returns**:\n  - An attribute object that represents the `context` sub block.\n', args=[]),
+                  new(
+                    name
+                  ):: std.prune(a={
+                    name: name,
+                  }),
+                },
+                crypto_key:: {
+                  kms_wrapped:: {
+                    '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.kms_wrapped.new` constructs a new object with attributes and blocks configured for the `kms_wrapped`\nTerraform sub block.\n\n\n\n**Args**:\n  - `crypto_key_name` (`string`): The resource name of the KMS CryptoKey to use for unwrapping.\n  - `wrapped_key` (`string`): The wrapped data crypto key.\n\nA base64-encoded string.\n\n**Returns**:\n  - An attribute object that represents the `kms_wrapped` sub block.\n', args=[]),
+                    new(
+                      crypto_key_name,
+                      wrapped_key
+                    ):: std.prune(a={
+                      crypto_key_name: crypto_key_name,
+                      wrapped_key: wrapped_key,
+                    }),
+                  },
+                  '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.new` constructs a new object with attributes and blocks configured for the `crypto_key`\nTerraform sub block.\n\n\n\n**Args**:\n  - `kms_wrapped` (`list[obj]`): KMS wrapped key.\nInclude to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt\nFor more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key). Only one of this, 'transient' or 'unwrapped' must be specified.\nNote: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). When `null`, the `kms_wrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.kms_wrapped.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configkms_wrappednew) constructor.\n  - `transient` (`list[obj]`): Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes. Only one of this, 'unwrapped' or 'kms_wrapped' must be specified. When `null`, the `transient` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.transient.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configtransientnew) constructor.\n  - `unwrapped` (`list[obj]`): Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. Only one of this, 'transient' or 'kms_wrapped' must be specified. When `null`, the `unwrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.unwrapped.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configunwrappednew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `crypto_key` sub block.\n', args=[]),
+                  new(
+                    kms_wrapped=null,
+                    transient=null,
+                    unwrapped=null
+                  ):: std.prune(a={
+                    kms_wrapped: kms_wrapped,
+                    transient: transient,
+                    unwrapped: unwrapped,
+                  }),
+                  transient:: {
+                    '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.transient.new` constructs a new object with attributes and blocks configured for the `transient`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate 'TransientCryptoKey' protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).\n\n**Returns**:\n  - An attribute object that represents the `transient` sub block.\n', args=[]),
+                    new(
+                      name
+                    ):: std.prune(a={
+                      name: name,
+                    }),
+                  },
+                  unwrapped:: {
+                    '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.unwrapped.new` constructs a new object with attributes and blocks configured for the `unwrapped`\nTerraform sub block.\n\n\n\n**Args**:\n  - `key` (`string`): A 128/192/256 bit key.\n\nA base64-encoded string.\n\n**Returns**:\n  - An attribute object that represents the `unwrapped` sub block.\n', args=[]),
+                    new(
+                      key
+                    ):: std.prune(a={
+                      key: key,
+                    }),
+                  },
+                },
+                '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.new` constructs a new object with attributes and blocks configured for the `crypto_replace_ffx_fpe_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `common_alphabet` (`string`): Common alphabets. Only one of this, 'custom_alphabet' or 'radix' must be specified. Possible values: ["NUMERIC", "HEXADECIMAL", "UPPER_CASE_ALPHA_NUMERIC", "ALPHA_NUMERIC"] When `null`, the `common_alphabet` field will be omitted from the resulting object.\n  - `custom_alphabet` (`string`): This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range \\[2, 95\\]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is:\n\n''0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~'!@#$%^&*()_-+={[}]|:;"'<,>.?/''. Only one of this, 'common_alphabet' or 'radix' must be specified. When `null`, the `custom_alphabet` field will be omitted from the resulting object.\n  - `radix` (`number`): The native way to select the alphabet. Must be in the range \\[2, 95\\]. Only one of this, 'custom_alphabet' or 'common_alphabet' must be specified. When `null`, the `radix` field will be omitted from the resulting object.\n  - `context` (`list[obj]`): The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used.\n\nIf the context is set but:\n\n1.  there is no record present when transforming a given value or\n2.  the field is not present when transforming a given value,\n\na default tweak will be used.\n\nNote that case (1) is expected when an 'InfoTypeTransformation' is applied to both structured and non-structured 'ContentItem's. Currently, the referenced field may be of value type integer or string.\n\nThe tweak is constructed as a sequence of bytes in big endian byte order such that:\n\n*   a 64 bit integer is encoded followed by a single byte of value 1\n*   a string is encoded in UTF-8 format followed by a single byte of value 2 When `null`, the `context` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.context.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcontextnew) constructor.\n  - `crypto_key` (`list[obj]`): The key used by the encryption algorithm. When `null`, the `crypto_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_keynew) constructor.\n  - `surrogate_info_type` (`list[obj]`): The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info\\_type\\_name(surrogate\\_character\\_count):surrogate\n\nFor example, if the name of custom infoType is 'MY\\_TOKEN\\_INFO\\_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY\\_TOKEN\\_INFO\\_TYPE(3):abc'\n\nThis annotation identifies the surrogate when inspecting content using the custom infoType ['SurrogateType'](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text.\n\nIn order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY\\_TOKEN\\_TYPE When `null`, the `surrogate_info_type` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.surrogate_info_type.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationsurrogate_info_typenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `crypto_replace_ffx_fpe_config` sub block.\n', args=[]),
+                new(
+                  common_alphabet=null,
+                  context=null,
+                  crypto_key=null,
+                  custom_alphabet=null,
+                  radix=null,
+                  surrogate_info_type=null
+                ):: std.prune(a={
+                  common_alphabet: common_alphabet,
+                  context: context,
+                  crypto_key: crypto_key,
+                  custom_alphabet: custom_alphabet,
+                  radix: radix,
+                  surrogate_info_type: surrogate_info_type,
+                }),
+                surrogate_info_type:: {
+                  '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.surrogate_info_type.new` constructs a new object with attributes and blocks configured for the `surrogate_info_type`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at [https://cloud.google.com/dlp/docs/infotypes-reference](https://cloud.google.com/dlp/docs/infotypes-reference) when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern '[A-Za-z0-9$-_]{1,64}'.\n  - `version` (`string`): Optional version name for this InfoType. When `null`, the `version` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `surrogate_info_type` sub block.\n', args=[]),
+                  new(
+                    name,
+                    version=null
+                  ):: std.prune(a={
+                    name: name,
+                    version: version,
+                  }),
+                },
+              },
+              date_shift_config:: {
+                context:: {
+                  '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.context.new` constructs a new object with attributes and blocks configured for the `context`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): Name describing the field.\n\n**Returns**:\n  - An attribute object that represents the `context` sub block.\n', args=[]),
+                  new(
+                    name
+                  ):: std.prune(a={
+                    name: name,
+                  }),
+                },
+                crypto_key:: {
+                  kms_wrapped:: {
+                    '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.kms_wrapped.new` constructs a new object with attributes and blocks configured for the `kms_wrapped`\nTerraform sub block.\n\n\n\n**Args**:\n  - `crypto_key_name` (`string`): The resource name of the KMS CryptoKey to use for unwrapping.\n  - `wrapped_key` (`string`): The wrapped data crypto key.\n\nA base64-encoded string.\n\n**Returns**:\n  - An attribute object that represents the `kms_wrapped` sub block.\n', args=[]),
+                    new(
+                      crypto_key_name,
+                      wrapped_key
+                    ):: std.prune(a={
+                      crypto_key_name: crypto_key_name,
+                      wrapped_key: wrapped_key,
+                    }),
+                  },
+                  '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.new` constructs a new object with attributes and blocks configured for the `crypto_key`\nTerraform sub block.\n\n\n\n**Args**:\n  - `kms_wrapped` (`list[obj]`): KMS wrapped key.\nInclude to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt\nFor more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key). Only one of this, 'transient' or 'unwrapped' must be specified.\nNote: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). When `null`, the `kms_wrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.kms_wrapped.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationdate_shift_configkms_wrappednew) constructor.\n  - `transient` (`list[obj]`): Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes. Only one of this, 'unwrapped' or 'kms_wrapped' must be specified. When `null`, the `transient` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.transient.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationdate_shift_configtransientnew) constructor.\n  - `unwrapped` (`list[obj]`): Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. Only one of this, 'transient' or 'kms_wrapped' must be specified. When `null`, the `unwrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.unwrapped.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationdate_shift_configunwrappednew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `crypto_key` sub block.\n', args=[]),
+                  new(
+                    kms_wrapped=null,
+                    transient=null,
+                    unwrapped=null
+                  ):: std.prune(a={
+                    kms_wrapped: kms_wrapped,
+                    transient: transient,
+                    unwrapped: unwrapped,
+                  }),
+                  transient:: {
+                    '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.transient.new` constructs a new object with attributes and blocks configured for the `transient`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate 'TransientCryptoKey' protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).\n\n**Returns**:\n  - An attribute object that represents the `transient` sub block.\n', args=[]),
+                    new(
+                      name
+                    ):: std.prune(a={
+                      name: name,
+                    }),
+                  },
+                  unwrapped:: {
+                    '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.unwrapped.new` constructs a new object with attributes and blocks configured for the `unwrapped`\nTerraform sub block.\n\n\n\n**Args**:\n  - `key` (`string`): A 128/192/256 bit key.\n\nA base64-encoded string.\n\n**Returns**:\n  - An attribute object that represents the `unwrapped` sub block.\n', args=[]),
+                    new(
+                      key
+                    ):: std.prune(a={
+                      key: key,
+                    }),
+                  },
+                },
+                '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.new` constructs a new object with attributes and blocks configured for the `date_shift_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `lower_bound_days` (`number`): For example, -5 means shift date to at most 5 days back in the past.\n  - `upper_bound_days` (`number`): Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction.\n\nFor example, 3 means shift date to at most 3 days into the future.\n  - `context` (`list[obj]`): Points to the field that contains the context, for example, an entity id.\nIf set, must also set cryptoKey. If set, shift will be consistent for the given context. When `null`, the `context` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.context.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcontextnew) constructor.\n  - `crypto_key` (`list[obj]`): Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and cryptoKey. If set, must also set context. Can only be applied to table items. When `null`, the `crypto_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_keynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `date_shift_config` sub block.\n', args=[]),
+                new(
+                  lower_bound_days,
+                  upper_bound_days,
+                  context=null,
+                  crypto_key=null
+                ):: std.prune(a={
+                  context: context,
+                  crypto_key: crypto_key,
+                  lower_bound_days: lower_bound_days,
+                  upper_bound_days: upper_bound_days,
+                }),
+              },
+              fixed_size_bucketing_config:: {
+                lower_bound:: {
+                  '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.lower_bound.new` constructs a new object with attributes and blocks configured for the `lower_bound`\nTerraform sub block.\n\n\n\n**Args**:\n  - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.\n  - `integer_value` (`string`): An integer value (int64 format) When `null`, the `integer_value` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `lower_bound` sub block.\n', args=[]),
+                  new(
+                    float_value=null,
+                    integer_value=null
+                  ):: std.prune(a={
+                    float_value: float_value,
+                    integer_value: integer_value,
+                  }),
+                },
+                '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.new` constructs a new object with attributes and blocks configured for the `fixed_size_bucketing_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `bucket_size` (`number`): Size of each bucket (except for minimum and maximum buckets).\nSo if lower_bound = 10, upper_bound = 89, and bucketSize = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+.\nPrecision up to 2 decimals works.\n  - `lower_bound` (`list[obj]`): Lower bound value of buckets.\nAll values less than lower_bound are grouped together into a single bucket; for example if lower_bound = 10, then all values less than 10 are replaced with the value "-10".\nThe 'lower_bound' block must only contain one argument. See the 'fixed_size_bucketing_config' block description for more information about choosing a data type. When `null`, the `lower_bound` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.lower_bound.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationlower_boundnew) constructor.\n  - `upper_bound` (`list[obj]`): Upper bound value of buckets.\nAll values greater than upper_bound are grouped together into a single bucket; for example if upper_bound = 89, then all values greater than 89 are replaced with the value "89+".\nThe 'upper_bound' block must only contain one argument. See the 'fixed_size_bucketing_config' block description for more information about choosing a data type. When `null`, the `upper_bound` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.upper_bound.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationupper_boundnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `fixed_size_bucketing_config` sub block.\n', args=[]),
+                new(
+                  bucket_size,
+                  lower_bound=null,
+                  upper_bound=null
+                ):: std.prune(a={
+                  bucket_size: bucket_size,
+                  lower_bound: lower_bound,
+                  upper_bound: upper_bound,
+                }),
+                upper_bound:: {
+                  '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.upper_bound.new` constructs a new object with attributes and blocks configured for the `upper_bound`\nTerraform sub block.\n\n\n\n**Args**:\n  - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.\n  - `integer_value` (`string`): An integer value (int64 format) When `null`, the `integer_value` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `upper_bound` sub block.\n', args=[]),
+                  new(
+                    float_value=null,
+                    integer_value=null
+                  ):: std.prune(a={
+                    float_value: float_value,
+                    integer_value: integer_value,
+                  }),
+                },
+              },
+              '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.new` constructs a new object with attributes and blocks configured for the `primitive_transformation`\nTerraform sub block.\n\n\n\n**Args**:\n  - `bucketing_config` (`list[obj]`): Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH\nThis can be used on data of type: number, long, string, timestamp.\nIf the provided value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing.\nSee https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. When `null`, the `bucketing_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsbucketing_confignew) constructor.\n  - `character_mask_config` (`list[obj]`): Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3). When `null`, the `character_mask_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.character_mask_config.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationscharacter_mask_confignew) constructor.\n  - `crypto_deterministic_config` (`list[obj]`): Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC [https://tools.ietf.org/html/rfc5297](https://tools.ietf.org/html/rfc5297). When `null`, the `crypto_deterministic_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationscrypto_deterministic_confignew) constructor.\n  - `crypto_hash_config` (`list[obj]`): Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes.\nOutputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).\nCurrently, only string and integer values can be hashed.\nSee https://cloud.google.com/dlp/docs/pseudonymization to learn more. When `null`, the `crypto_hash_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationscrypto_hash_confignew) constructor.\n  - `crypto_replace_ffx_fpe_config` (`list[obj]`): Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the 'content.reidentify' API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See [https://cloud.google.com/dlp/docs/pseudonymization](https://cloud.google.com/dlp/docs/pseudonymization) to learn more.\n\nNote: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. When `null`, the `crypto_replace_ffx_fpe_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationscrypto_replace_ffx_fpe_confignew) constructor.\n  - `date_shift_config` (`list[obj]`): Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. When `null`, the `date_shift_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsdate_shift_confignew) constructor.\n  - `fixed_size_bucketing_config` (`list[obj]`): Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies.\n\nThe transformed value will be a hyphenated string of {lower_bound}-{upper_bound}. For example, if lower_bound = 10 and upper_bound = 20, all values that are within this bucket will be replaced with "10-20".\n\nThis can be used on data of type: double, long.\n\nIf the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing.\n\nSee https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. When `null`, the `fixed_size_bucketing_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsfixed_size_bucketing_confignew) constructor.\n  - `redact_config` (`list[obj]`): Redact a given value. For example, if used with an InfoTypeTransformation transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. When `null`, the `redact_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.redact_config.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsredact_confignew) constructor.\n  - `replace_config` (`list[obj]`): Replace each input value with a given value. When `null`, the `replace_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsreplace_confignew) constructor.\n  - `replace_dictionary_config` (`list[obj]`): Replace with a value randomly drawn (with replacement) from a dictionary. When `null`, the `replace_dictionary_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsreplace_dictionary_confignew) constructor.\n  - `replace_with_info_type_config` (`list[obj]`): Replace each matching finding with the name of the info type. When `null`, the `replace_with_info_type_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_with_info_type_config.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsreplace_with_info_type_confignew) constructor.\n  - `time_part_config` (`list[obj]`): For use with Date, Timestamp, and TimeOfDay, extract or preserve a portion of the value. When `null`, the `time_part_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.time_part_config.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationstime_part_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `primitive_transformation` sub block.\n', args=[]),
+              new(
+                bucketing_config=null,
+                character_mask_config=null,
+                crypto_deterministic_config=null,
+                crypto_hash_config=null,
+                crypto_replace_ffx_fpe_config=null,
+                date_shift_config=null,
+                fixed_size_bucketing_config=null,
+                redact_config=null,
+                replace_config=null,
+                replace_dictionary_config=null,
+                replace_with_info_type_config=null,
+                time_part_config=null
+              ):: std.prune(a={
+                bucketing_config: bucketing_config,
+                character_mask_config: character_mask_config,
+                crypto_deterministic_config: crypto_deterministic_config,
+                crypto_hash_config: crypto_hash_config,
+                crypto_replace_ffx_fpe_config: crypto_replace_ffx_fpe_config,
+                date_shift_config: date_shift_config,
+                fixed_size_bucketing_config: fixed_size_bucketing_config,
+                redact_config: redact_config,
+                replace_config: replace_config,
+                replace_dictionary_config: replace_dictionary_config,
+                replace_with_info_type_config: replace_with_info_type_config,
+                time_part_config: time_part_config,
+              }),
+              redact_config:: {
+                '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.redact_config.new` constructs a new object with attributes and blocks configured for the `redact_config`\nTerraform sub block.\n\n\n\n**Returns**:\n  - An attribute object that represents the `redact_config` sub block.\n', args=[]),
+                new(
+
+                ):: std.prune(a={}),
+              },
+              replace_config:: {
+                '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new` constructs a new object with attributes and blocks configured for the `replace_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `new_value` (`list[obj]`): Replace each input value with a given value.\nThe 'new_value' block must only contain one argument. For example when replacing the contents of a string-type field, only 'string_value' should be set. When `null`, the `new_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationnew_valuenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `replace_config` sub block.\n', args=[]),
+                new(
+                  new_value=null
+                ):: std.prune(a={
+                  new_value: new_value,
+                }),
+                new_value:: {
+                  date_value:: {
+                    '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.date_value.new` constructs a new object with attributes and blocks configured for the `date_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `day` (`number`): Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant. When `null`, the `day` field will be omitted from the resulting object.\n  - `month` (`number`): Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day. When `null`, the `month` field will be omitted from the resulting object.\n  - `year` (`number`): Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year. When `null`, the `year` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `date_value` sub block.\n', args=[]),
+                    new(
+                      day=null,
+                      month=null,
+                      year=null
+                    ):: std.prune(a={
+                      day: day,
+                      month: month,
+                      year: year,
+                    }),
+                  },
+                  '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.new` constructs a new object with attributes and blocks configured for the `new_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `boolean_value` (`bool`): A boolean value. When `null`, the `boolean_value` field will be omitted from the resulting object.\n  - `day_of_week_value` (`string`): Represents a day of the week. Possible values: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"] When `null`, the `day_of_week_value` field will be omitted from the resulting object.\n  - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.\n  - `integer_value` (`string`): An integer value (int64 format) When `null`, the `integer_value` field will be omitted from the resulting object.\n  - `string_value` (`string`): A string value. When `null`, the `string_value` field will be omitted from the resulting object.\n  - `timestamp_value` (`string`): A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.\nExamples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". When `null`, the `timestamp_value` field will be omitted from the resulting object.\n  - `date_value` (`list[obj]`): Represents a whole or partial calendar date. When `null`, the `date_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.date_value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationreplace_configdate_valuenew) constructor.\n  - `time_value` (`list[obj]`): Represents a time of day. When `null`, the `time_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.time_value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationreplace_configtime_valuenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `new_value` sub block.\n', args=[]),
+                  new(
+                    boolean_value=null,
+                    date_value=null,
+                    day_of_week_value=null,
+                    float_value=null,
+                    integer_value=null,
+                    string_value=null,
+                    time_value=null,
+                    timestamp_value=null
+                  ):: std.prune(a={
+                    boolean_value: boolean_value,
+                    date_value: date_value,
+                    day_of_week_value: day_of_week_value,
+                    float_value: float_value,
+                    integer_value: integer_value,
+                    string_value: string_value,
+                    time_value: time_value,
+                    timestamp_value: timestamp_value,
+                  }),
+                  time_value:: {
+                    '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.time_value.new` constructs a new object with attributes and blocks configured for the `time_value`\nTerraform sub block.\n\n\n\n**Args**:\n  - `hours` (`number`): Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time. When `null`, the `hours` field will be omitted from the resulting object.\n  - `minutes` (`number`): Minutes of hour of day. Must be from 0 to 59. When `null`, the `minutes` field will be omitted from the resulting object.\n  - `nanos` (`number`): Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999. When `null`, the `nanos` field will be omitted from the resulting object.\n  - `seconds` (`number`): Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds. When `null`, the `seconds` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `time_value` sub block.\n', args=[]),
+                    new(
+                      hours=null,
+                      minutes=null,
+                      nanos=null,
+                      seconds=null
+                    ):: std.prune(a={
+                      hours: hours,
+                      minutes: minutes,
+                      nanos: nanos,
+                      seconds: seconds,
+                    }),
+                  },
+                },
+              },
+              replace_dictionary_config:: {
+                '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.new` constructs a new object with attributes and blocks configured for the `replace_dictionary_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `word_list` (`list[obj]`): A list of words to select from for random replacement. The [limits](https://cloud.google.com/dlp/limits) page contains details about the size limits of dictionaries. When `null`, the `word_list` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.word_list.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationword_listnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `replace_dictionary_config` sub block.\n', args=[]),
+                new(
+                  word_list=null
+                ):: std.prune(a={
+                  word_list: word_list,
+                }),
+                word_list:: {
+                  '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.word_list.new` constructs a new object with attributes and blocks configured for the `word_list`\nTerraform sub block.\n\n\n\n**Args**:\n  - `words` (`list`): Words or phrases defining the dictionary. The dictionary must contain at least one phrase and every phrase must contain at least 2 characters that are letters or digits.\n\n**Returns**:\n  - An attribute object that represents the `word_list` sub block.\n', args=[]),
+                  new(
+                    words
+                  ):: std.prune(a={
+                    words: words,
+                  }),
+                },
+              },
+              replace_with_info_type_config:: {
+                '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_with_info_type_config.new` constructs a new object with attributes and blocks configured for the `replace_with_info_type_config`\nTerraform sub block.\n\n\n\n**Returns**:\n  - An attribute object that represents the `replace_with_info_type_config` sub block.\n', args=[]),
+                new(
+
+                ):: std.prune(a={}),
+              },
+              time_part_config:: {
+                '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.time_part_config.new` constructs a new object with attributes and blocks configured for the `time_part_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `part_to_extract` (`string`): The part of the time to keep. Possible values: ["YEAR", "MONTH", "DAY_OF_MONTH", "DAY_OF_WEEK", "WEEK_OF_YEAR", "HOUR_OF_DAY"]\n\n**Returns**:\n  - An attribute object that represents the `time_part_config` sub block.\n', args=[]),
+                new(
+                  part_to_extract
+                ):: std.prune(a={
+                  part_to_extract: part_to_extract,
+                }),
+              },
+            },
+          },
+        },
+        '#new':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.new` constructs a new object with attributes and blocks configured for the `field_transformations`\nTerraform sub block.\n\n\n\n**Args**:\n  - `condition` (`list[obj]`): Only apply the transformation if the condition evaluates to true for the given RecordCondition. The conditions are allowed to reference fields that are not used in the actual transformation.\nExample Use Cases:\n- Apply a different bucket transformation to an age column if the zip code column for the same record is within a specific range.\n- Redact a field if the date of birth field is greater than 85. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.new](#fn-deidentify_configdeidentify_configrecord_transformationsconditionnew) constructor.\n  - `fields` (`list[obj]`): Input field(s) to apply the transformation to. When you have columns that reference their position within a list, omit the index from the FieldId.\nFieldId name matching ignores the index. For example, instead of "contact.nums[0].type", use "contact.nums.type". When `null`, the `fields` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.fields.new](#fn-deidentify_configdeidentify_configrecord_transformationsfieldsnew) constructor.\n  - `info_type_transformations` (`list[obj]`): Treat the contents of the field as free text, and selectively transform content that matches an InfoType.\nOnly one of 'primitive_transformation' or 'info_type_transformations' must be specified. When `null`, the `info_type_transformations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.new](#fn-deidentify_configdeidentify_configrecord_transformationsinfo_type_transformationsnew) constructor.\n  - `primitive_transformation` (`list[obj]`): Apply the transformation to the entire field.\nThe 'primitive_transformation' block must only contain one argument, corresponding to the type of transformation.\nOnly one of 'primitive_transformation' or 'info_type_transformations' must be specified. When `null`, the `primitive_transformation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.primitive_transformation.new](#fn-deidentify_configdeidentify_configrecord_transformationsprimitive_transformationnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `field_transformations` sub block.\n', args=[]),
         new(
           condition=null,
           fields=null,
+          info_type_transformations=null,
           primitive_transformation=null
         ):: std.prune(a={
           condition: condition,
           fields: fields,
+          info_type_transformations: info_type_transformations,
           primitive_transformation: primitive_transformation,
         }),
         primitive_transformation:: {
@@ -1246,13 +2134,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
-  '#new':: d.fn(help="\n`google.data_loss_prevention_deidentify_template.new` injects a new `google_data_loss_prevention_deidentify_template` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data_loss_prevention_deidentify_template.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data_loss_prevention_deidentify_template` using the reference:\n\n    $._ref.google_data_loss_prevention_deidentify_template.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_data_loss_prevention_deidentify_template.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A description of the template. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User set display name of the template. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `parent` (`string`): The parent of the template in any of the following formats:\n\n* \u0026#39;projects/{{project}}\u0026#39;\n* \u0026#39;projects/{{project}}/locations/{{location}}\u0026#39;\n* \u0026#39;organizations/{{organization_id}}\u0026#39;\n* \u0026#39;organizations/{{organization_id}}/locations/{{location}}\u0026#39;\n  - `deidentify_config` (`list[obj]`): Configuration of the deidentify template When `null`, the `deidentify_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.new](#fn-deidentify_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.data_loss_prevention_deidentify_template.new` injects a new `google_data_loss_prevention_deidentify_template` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data_loss_prevention_deidentify_template.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data_loss_prevention_deidentify_template` using the reference:\n\n    $._ref.google_data_loss_prevention_deidentify_template.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_data_loss_prevention_deidentify_template.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A description of the template. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User set display name of the template. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `parent` (`string`): The parent of the template in any of the following formats:\n\n* \u0026#39;projects/{{project}}\u0026#39;\n* \u0026#39;projects/{{project}}/locations/{{location}}\u0026#39;\n* \u0026#39;organizations/{{organization_id}}\u0026#39;\n* \u0026#39;organizations/{{organization_id}}/locations/{{location}}\u0026#39;\n  - `template_id` (`string`): The template id can contain uppercase and lowercase letters, numbers, and hyphens;\nthat is, it must match the regular expression: [a-zA-Z\\d-_]\u0026#43;. The maximum length is\n100 characters. Can be empty to allow the system to generate one. When `null`, the `template_id` field will be omitted from the resulting object.\n  - `deidentify_config` (`list[obj]`): Configuration of the deidentify template When `null`, the `deidentify_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.new](#fn-deidentify_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     parent,
     deidentify_config=null,
     description=null,
     display_name=null,
+    template_id=null,
     timeouts=null,
     _meta={}
   ):: tf.withResource(
@@ -1263,22 +2152,25 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       description=description,
       display_name=display_name,
       parent=parent,
+      template_id=template_id,
       timeouts=timeouts
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.newAttrs` constructs a new object with attributes and blocks configured for the `data_loss_prevention_deidentify_template`\nTerraform resource.\n\nUnlike [google.data_loss_prevention_deidentify_template.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A description of the template. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User set display name of the template. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `parent` (`string`): The parent of the template in any of the following formats:\n\n* 'projects/{{project}}'\n* 'projects/{{project}}/locations/{{location}}'\n* 'organizations/{{organization_id}}'\n* 'organizations/{{organization_id}}/locations/{{location}}'\n  - `deidentify_config` (`list[obj]`): Configuration of the deidentify template When `null`, the `deidentify_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.new](#fn-deidentify_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `data_loss_prevention_deidentify_template` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.data_loss_prevention_deidentify_template.newAttrs` constructs a new object with attributes and blocks configured for the `data_loss_prevention_deidentify_template`\nTerraform resource.\n\nUnlike [google.data_loss_prevention_deidentify_template.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A description of the template. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User set display name of the template. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `parent` (`string`): The parent of the template in any of the following formats:\n\n* 'projects/{{project}}'\n* 'projects/{{project}}/locations/{{location}}'\n* 'organizations/{{organization_id}}'\n* 'organizations/{{organization_id}}/locations/{{location}}'\n  - `template_id` (`string`): The template id can contain uppercase and lowercase letters, numbers, and hyphens;\nthat is, it must match the regular expression: [a-zA-Z\\d-_]+. The maximum length is\n100 characters. Can be empty to allow the system to generate one. When `null`, the `template_id` field will be omitted from the resulting object.\n  - `deidentify_config` (`list[obj]`): Configuration of the deidentify template When `null`, the `deidentify_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.new](#fn-deidentify_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `data_loss_prevention_deidentify_template` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     parent,
     deidentify_config=null,
     description=null,
     display_name=null,
+    template_id=null,
     timeouts=null
   ):: std.prune(a={
     deidentify_config: deidentify_config,
     description: description,
     display_name: display_name,
     parent: parent,
+    template_id: template_id,
     timeouts: timeouts,
   }),
   timeouts:: {
@@ -1343,6 +2235,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withTemplateId':: d.fn(help='`google.string.withTemplateId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the template_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `template_id` field.\n', args=[]),
+  withTemplateId(resourceLabel, value): {
+    resource+: {
+      google_data_loss_prevention_deidentify_template+: {
+        [resourceLabel]+: {
+          template_id: value,
+        },
+      },
+    },
+  },
   '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
   withTimeouts(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/data_loss_prevention_inspect_template.libsonnet b/4.x/_gen/resources/data_loss_prevention_inspect_template.libsonnet
index 10ccfa1..360d861 100644
--- a/4.x/_gen/resources/data_loss_prevention_inspect_template.libsonnet
+++ b/4.x/_gen/resources/data_loss_prevention_inspect_template.libsonnet
@@ -318,13 +318,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
-  '#new':: d.fn(help="\n`google.data_loss_prevention_inspect_template.new` injects a new `google_data_loss_prevention_inspect_template` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data_loss_prevention_inspect_template.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data_loss_prevention_inspect_template` using the reference:\n\n    $._ref.google_data_loss_prevention_inspect_template.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_data_loss_prevention_inspect_template.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A description of the inspect template. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User set display name of the inspect template. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `parent` (`string`): The parent of the inspect template in any of the following formats:\n\n* \u0026#39;projects/{{project}}\u0026#39;\n* \u0026#39;projects/{{project}}/locations/{{location}}\u0026#39;\n* \u0026#39;organizations/{{organization_id}}\u0026#39;\n* \u0026#39;organizations/{{organization_id}}/locations/{{location}}\u0026#39;\n  - `inspect_config` (`list[obj]`): The core content of the template. When `null`, the `inspect_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_inspect_template.inspect_config.new](#fn-inspect_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_inspect_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.data_loss_prevention_inspect_template.new` injects a new `google_data_loss_prevention_inspect_template` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data_loss_prevention_inspect_template.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data_loss_prevention_inspect_template` using the reference:\n\n    $._ref.google_data_loss_prevention_inspect_template.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_data_loss_prevention_inspect_template.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A description of the inspect template. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User set display name of the inspect template. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `parent` (`string`): The parent of the inspect template in any of the following formats:\n\n* \u0026#39;projects/{{project}}\u0026#39;\n* \u0026#39;projects/{{project}}/locations/{{location}}\u0026#39;\n* \u0026#39;organizations/{{organization_id}}\u0026#39;\n* \u0026#39;organizations/{{organization_id}}/locations/{{location}}\u0026#39;\n  - `template_id` (`string`): The template id can contain uppercase and lowercase letters, numbers, and hyphens;\nthat is, it must match the regular expression: [a-zA-Z\\d-_]\u0026#43;. The maximum length is\n100 characters. Can be empty to allow the system to generate one. When `null`, the `template_id` field will be omitted from the resulting object.\n  - `inspect_config` (`list[obj]`): The core content of the template. When `null`, the `inspect_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_inspect_template.inspect_config.new](#fn-inspect_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_inspect_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     parent,
     description=null,
     display_name=null,
     inspect_config=null,
+    template_id=null,
     timeouts=null,
     _meta={}
   ):: tf.withResource(
@@ -335,22 +336,25 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       display_name=display_name,
       inspect_config=inspect_config,
       parent=parent,
+      template_id=template_id,
       timeouts=timeouts
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.data_loss_prevention_inspect_template.newAttrs` constructs a new object with attributes and blocks configured for the `data_loss_prevention_inspect_template`\nTerraform resource.\n\nUnlike [google.data_loss_prevention_inspect_template.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A description of the inspect template. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User set display name of the inspect template. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `parent` (`string`): The parent of the inspect template in any of the following formats:\n\n* 'projects/{{project}}'\n* 'projects/{{project}}/locations/{{location}}'\n* 'organizations/{{organization_id}}'\n* 'organizations/{{organization_id}}/locations/{{location}}'\n  - `inspect_config` (`list[obj]`): The core content of the template. When `null`, the `inspect_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_inspect_template.inspect_config.new](#fn-inspect_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_inspect_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `data_loss_prevention_inspect_template` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.data_loss_prevention_inspect_template.newAttrs` constructs a new object with attributes and blocks configured for the `data_loss_prevention_inspect_template`\nTerraform resource.\n\nUnlike [google.data_loss_prevention_inspect_template.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A description of the inspect template. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User set display name of the inspect template. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `parent` (`string`): The parent of the inspect template in any of the following formats:\n\n* 'projects/{{project}}'\n* 'projects/{{project}}/locations/{{location}}'\n* 'organizations/{{organization_id}}'\n* 'organizations/{{organization_id}}/locations/{{location}}'\n  - `template_id` (`string`): The template id can contain uppercase and lowercase letters, numbers, and hyphens;\nthat is, it must match the regular expression: [a-zA-Z\\d-_]+. The maximum length is\n100 characters. Can be empty to allow the system to generate one. When `null`, the `template_id` field will be omitted from the resulting object.\n  - `inspect_config` (`list[obj]`): The core content of the template. When `null`, the `inspect_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_inspect_template.inspect_config.new](#fn-inspect_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_inspect_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `data_loss_prevention_inspect_template` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     parent,
     description=null,
     display_name=null,
     inspect_config=null,
+    template_id=null,
     timeouts=null
   ):: std.prune(a={
     description: description,
     display_name: display_name,
     inspect_config: inspect_config,
     parent: parent,
+    template_id: template_id,
     timeouts: timeouts,
   }),
   timeouts:: {
@@ -415,6 +419,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withTemplateId':: d.fn(help='`google.string.withTemplateId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the template_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `template_id` field.\n', args=[]),
+  withTemplateId(resourceLabel, value): {
+    resource+: {
+      google_data_loss_prevention_inspect_template+: {
+        [resourceLabel]+: {
+          template_id: value,
+        },
+      },
+    },
+  },
   '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
   withTimeouts(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/data_loss_prevention_stored_info_type.libsonnet b/4.x/_gen/resources/data_loss_prevention_stored_info_type.libsonnet
index 1f3a63d..4cb2fb7 100644
--- a/4.x/_gen/resources/data_loss_prevention_stored_info_type.libsonnet
+++ b/4.x/_gen/resources/data_loss_prevention_stored_info_type.libsonnet
@@ -86,7 +86,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
   },
-  '#new':: d.fn(help="\n`google.data_loss_prevention_stored_info_type.new` injects a new `google_data_loss_prevention_stored_info_type` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data_loss_prevention_stored_info_type.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data_loss_prevention_stored_info_type` using the reference:\n\n    $._ref.google_data_loss_prevention_stored_info_type.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_data_loss_prevention_stored_info_type.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A description of the info type. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User set display name of the info type. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `parent` (`string`): The parent of the info type in any of the following formats:\n\n* \u0026#39;projects/{{project}}\u0026#39;\n* \u0026#39;projects/{{project}}/locations/{{location}}\u0026#39;\n* \u0026#39;organizations/{{organization_id}}\u0026#39;\n* \u0026#39;organizations/{{organization_id}}/locations/{{location}}\u0026#39;\n  - `dictionary` (`list[obj]`): Dictionary which defines the rule. When `null`, the `dictionary` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_stored_info_type.dictionary.new](#fn-dictionarynew) constructor.\n  - `large_custom_dictionary` (`list[obj]`): Dictionary which defines the rule. When `null`, the `large_custom_dictionary` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_stored_info_type.large_custom_dictionary.new](#fn-large_custom_dictionarynew) constructor.\n  - `regex` (`list[obj]`): Regular expression which defines the rule. When `null`, the `regex` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_stored_info_type.regex.new](#fn-regexnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_stored_info_type.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.data_loss_prevention_stored_info_type.new` injects a new `google_data_loss_prevention_stored_info_type` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data_loss_prevention_stored_info_type.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data_loss_prevention_stored_info_type` using the reference:\n\n    $._ref.google_data_loss_prevention_stored_info_type.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_data_loss_prevention_stored_info_type.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A description of the info type. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User set display name of the info type. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `parent` (`string`): The parent of the info type in any of the following formats:\n\n* \u0026#39;projects/{{project}}\u0026#39;\n* \u0026#39;projects/{{project}}/locations/{{location}}\u0026#39;\n* \u0026#39;organizations/{{organization_id}}\u0026#39;\n* \u0026#39;organizations/{{organization_id}}/locations/{{location}}\u0026#39;\n  - `stored_info_type_id` (`string`): The storedInfoType ID can contain uppercase and lowercase letters, numbers, and hyphens;\nthat is, it must match the regular expression: [a-zA-Z\\d-_]\u0026#43;. The maximum length is 100\ncharacters. Can be empty to allow the system to generate one. When `null`, the `stored_info_type_id` field will be omitted from the resulting object.\n  - `dictionary` (`list[obj]`): Dictionary which defines the rule. When `null`, the `dictionary` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_stored_info_type.dictionary.new](#fn-dictionarynew) constructor.\n  - `large_custom_dictionary` (`list[obj]`): Dictionary which defines the rule. When `null`, the `large_custom_dictionary` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_stored_info_type.large_custom_dictionary.new](#fn-large_custom_dictionarynew) constructor.\n  - `regex` (`list[obj]`): Regular expression which defines the rule. When `null`, the `regex` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_stored_info_type.regex.new](#fn-regexnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_stored_info_type.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     parent,
@@ -95,6 +95,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     display_name=null,
     large_custom_dictionary=null,
     regex=null,
+    stored_info_type_id=null,
     timeouts=null,
     _meta={}
   ):: tf.withResource(
@@ -107,11 +108,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       large_custom_dictionary=large_custom_dictionary,
       parent=parent,
       regex=regex,
+      stored_info_type_id=stored_info_type_id,
       timeouts=timeouts
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.data_loss_prevention_stored_info_type.newAttrs` constructs a new object with attributes and blocks configured for the `data_loss_prevention_stored_info_type`\nTerraform resource.\n\nUnlike [google.data_loss_prevention_stored_info_type.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A description of the info type. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User set display name of the info type. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `parent` (`string`): The parent of the info type in any of the following formats:\n\n* 'projects/{{project}}'\n* 'projects/{{project}}/locations/{{location}}'\n* 'organizations/{{organization_id}}'\n* 'organizations/{{organization_id}}/locations/{{location}}'\n  - `dictionary` (`list[obj]`): Dictionary which defines the rule. When `null`, the `dictionary` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_stored_info_type.dictionary.new](#fn-dictionarynew) constructor.\n  - `large_custom_dictionary` (`list[obj]`): Dictionary which defines the rule. When `null`, the `large_custom_dictionary` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_stored_info_type.large_custom_dictionary.new](#fn-large_custom_dictionarynew) constructor.\n  - `regex` (`list[obj]`): Regular expression which defines the rule. When `null`, the `regex` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_stored_info_type.regex.new](#fn-regexnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_stored_info_type.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `data_loss_prevention_stored_info_type` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.data_loss_prevention_stored_info_type.newAttrs` constructs a new object with attributes and blocks configured for the `data_loss_prevention_stored_info_type`\nTerraform resource.\n\nUnlike [google.data_loss_prevention_stored_info_type.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A description of the info type. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User set display name of the info type. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `parent` (`string`): The parent of the info type in any of the following formats:\n\n* 'projects/{{project}}'\n* 'projects/{{project}}/locations/{{location}}'\n* 'organizations/{{organization_id}}'\n* 'organizations/{{organization_id}}/locations/{{location}}'\n  - `stored_info_type_id` (`string`): The storedInfoType ID can contain uppercase and lowercase letters, numbers, and hyphens;\nthat is, it must match the regular expression: [a-zA-Z\\d-_]+. The maximum length is 100\ncharacters. Can be empty to allow the system to generate one. When `null`, the `stored_info_type_id` field will be omitted from the resulting object.\n  - `dictionary` (`list[obj]`): Dictionary which defines the rule. When `null`, the `dictionary` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_stored_info_type.dictionary.new](#fn-dictionarynew) constructor.\n  - `large_custom_dictionary` (`list[obj]`): Dictionary which defines the rule. When `null`, the `large_custom_dictionary` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_stored_info_type.large_custom_dictionary.new](#fn-large_custom_dictionarynew) constructor.\n  - `regex` (`list[obj]`): Regular expression which defines the rule. When `null`, the `regex` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_stored_info_type.regex.new](#fn-regexnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_stored_info_type.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `data_loss_prevention_stored_info_type` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     parent,
     description=null,
@@ -119,6 +121,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     display_name=null,
     large_custom_dictionary=null,
     regex=null,
+    stored_info_type_id=null,
     timeouts=null
   ):: std.prune(a={
     description: description,
@@ -127,6 +130,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     large_custom_dictionary: large_custom_dictionary,
     parent: parent,
     regex: regex,
+    stored_info_type_id: stored_info_type_id,
     timeouts: timeouts,
   }),
   regex:: {
@@ -241,6 +245,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withStoredInfoTypeId':: d.fn(help='`google.string.withStoredInfoTypeId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the stored_info_type_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `stored_info_type_id` field.\n', args=[]),
+  withStoredInfoTypeId(resourceLabel, value): {
+    resource+: {
+      google_data_loss_prevention_stored_info_type+: {
+        [resourceLabel]+: {
+          stored_info_type_id: value,
+        },
+      },
+    },
+  },
   '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
   withTimeouts(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/dataplex_datascan.libsonnet b/4.x/_gen/resources/dataplex_datascan.libsonnet
new file mode 100644
index 0000000..463a74e
--- /dev/null
+++ b/4.x/_gen/resources/dataplex_datascan.libsonnet
@@ -0,0 +1,406 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='dataplex_datascan', url='', help='`dataplex_datascan` represents the `google_dataplex_datascan` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  data:: {
+    '#new':: d.fn(help='\n`google.dataplex_datascan.data.new` constructs a new object with attributes and blocks configured for the `data`\nTerraform sub block.\n\n\n\n**Args**:\n  - `entity` (`string`): The Dataplex entity that represents the data source(e.g. BigQuery table) for Datascan. When `null`, the `entity` field will be omitted from the resulting object.\n  - `resource` (`string`): The service-qualified full resource name of the cloud resource for a DataScan job to scan against. The field could be:\n(Cloud Storage bucket for DataDiscoveryScan)BigQuery table of type "TABLE" for DataProfileScan/DataQualityScan. When `null`, the `resource` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `data` sub block.\n', args=[]),
+    new(
+      entity=null,
+      resource=null
+    ):: std.prune(a={
+      entity: entity,
+      resource: resource,
+    }),
+  },
+  data_profile_spec:: {
+    '#new':: d.fn(help='\n`google.dataplex_datascan.data_profile_spec.new` constructs a new object with attributes and blocks configured for the `data_profile_spec`\nTerraform sub block.\n\n\n\n**Args**:\n  - `row_filter` (`string`): A filter applied to all rows in a single DataScan job. The filter needs to be a valid SQL expression for a WHERE clause in BigQuery standard SQL syntax. Example: col1 >= 0 AND col2 < 10 When `null`, the `row_filter` field will be omitted from the resulting object.\n  - `sampling_percent` (`number`): The percentage of the records to be selected from the dataset for DataScan. When `null`, the `sampling_percent` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `data_profile_spec` sub block.\n', args=[]),
+    new(
+      row_filter=null,
+      sampling_percent=null
+    ):: std.prune(a={
+      row_filter: row_filter,
+      sampling_percent: sampling_percent,
+    }),
+  },
+  data_quality_spec:: {
+    '#new':: d.fn(help='\n`google.dataplex_datascan.data_quality_spec.new` constructs a new object with attributes and blocks configured for the `data_quality_spec`\nTerraform sub block.\n\n\n\n**Args**:\n  - `row_filter` (`string`): A filter applied to all rows in a single DataScan job. The filter needs to be a valid SQL expression for a WHERE clause in BigQuery standard SQL syntax. Example: col1 >= 0 AND col2 < 10 When `null`, the `row_filter` field will be omitted from the resulting object.\n  - `sampling_percent` (`number`): The percentage of the records to be selected from the dataset for DataScan. When `null`, the `sampling_percent` field will be omitted from the resulting object.\n  - `rules` (`list[obj]`): The list of rules to evaluate against a data source. At least one rule is required. When `null`, the `rules` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.rules.new](#fn-data_quality_specrulesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `data_quality_spec` sub block.\n', args=[]),
+    new(
+      row_filter=null,
+      rules=null,
+      sampling_percent=null
+    ):: std.prune(a={
+      row_filter: row_filter,
+      rules: rules,
+      sampling_percent: sampling_percent,
+    }),
+    rules:: {
+      '#new':: d.fn(help='\n`google.dataplex_datascan.data_quality_spec.rules.new` constructs a new object with attributes and blocks configured for the `rules`\nTerraform sub block.\n\n\n\n**Args**:\n  - `column` (`string`): The unnested column which this rule is evaluated against. When `null`, the `column` field will be omitted from the resulting object.\n  - `dimension` (`string`): The dimension a rule belongs to. Results are also aggregated at the dimension level. Supported dimensions are ["COMPLETENESS", "ACCURACY", "CONSISTENCY", "VALIDITY", "UNIQUENESS", "INTEGRITY"]\n  - `ignore_null` (`bool`): Rows with null values will automatically fail a rule, unless ignoreNull is true. In that case, such null rows are trivially considered passing. Only applicable to ColumnMap rules. When `null`, the `ignore_null` field will be omitted from the resulting object.\n  - `threshold` (`number`): The minimum ratio of passing_rows / total_rows required to pass this rule, with a range of [0.0, 1.0]. 0 indicates default value (i.e. 1.0). When `null`, the `threshold` field will be omitted from the resulting object.\n  - `non_null_expectation` (`list[obj]`): ColumnMap rule which evaluates whether each column value is null. When `null`, the `non_null_expectation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.rules.non_null_expectation.new](#fn-data_quality_specdata_quality_specnon_null_expectationnew) constructor.\n  - `range_expectation` (`list[obj]`): ColumnMap rule which evaluates whether each column value lies between a specified range. When `null`, the `range_expectation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.rules.range_expectation.new](#fn-data_quality_specdata_quality_specrange_expectationnew) constructor.\n  - `regex_expectation` (`list[obj]`): ColumnMap rule which evaluates whether each column value matches a specified regex. When `null`, the `regex_expectation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.rules.regex_expectation.new](#fn-data_quality_specdata_quality_specregex_expectationnew) constructor.\n  - `row_condition_expectation` (`list[obj]`): Table rule which evaluates whether each row passes the specified condition. When `null`, the `row_condition_expectation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.rules.row_condition_expectation.new](#fn-data_quality_specdata_quality_specrow_condition_expectationnew) constructor.\n  - `set_expectation` (`list[obj]`): ColumnMap rule which evaluates whether each column value is contained by a specified set. When `null`, the `set_expectation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.rules.set_expectation.new](#fn-data_quality_specdata_quality_specset_expectationnew) constructor.\n  - `statistic_range_expectation` (`list[obj]`): ColumnAggregate rule which evaluates whether the column aggregate statistic lies between a specified range. When `null`, the `statistic_range_expectation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.rules.statistic_range_expectation.new](#fn-data_quality_specdata_quality_specstatistic_range_expectationnew) constructor.\n  - `table_condition_expectation` (`list[obj]`): Table rule which evaluates whether the provided expression is true. When `null`, the `table_condition_expectation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.rules.table_condition_expectation.new](#fn-data_quality_specdata_quality_spectable_condition_expectationnew) constructor.\n  - `uniqueness_expectation` (`list[obj]`): ColumnAggregate rule which evaluates whether the column has duplicates. When `null`, the `uniqueness_expectation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.rules.uniqueness_expectation.new](#fn-data_quality_specdata_quality_specuniqueness_expectationnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `rules` sub block.\n', args=[]),
+      new(
+        dimension,
+        column=null,
+        ignore_null=null,
+        non_null_expectation=null,
+        range_expectation=null,
+        regex_expectation=null,
+        row_condition_expectation=null,
+        set_expectation=null,
+        statistic_range_expectation=null,
+        table_condition_expectation=null,
+        threshold=null,
+        uniqueness_expectation=null
+      ):: std.prune(a={
+        column: column,
+        dimension: dimension,
+        ignore_null: ignore_null,
+        non_null_expectation: non_null_expectation,
+        range_expectation: range_expectation,
+        regex_expectation: regex_expectation,
+        row_condition_expectation: row_condition_expectation,
+        set_expectation: set_expectation,
+        statistic_range_expectation: statistic_range_expectation,
+        table_condition_expectation: table_condition_expectation,
+        threshold: threshold,
+        uniqueness_expectation: uniqueness_expectation,
+      }),
+      non_null_expectation:: {
+        '#new':: d.fn(help='\n`google.dataplex_datascan.data_quality_spec.rules.non_null_expectation.new` constructs a new object with attributes and blocks configured for the `non_null_expectation`\nTerraform sub block.\n\n\n\n**Returns**:\n  - An attribute object that represents the `non_null_expectation` sub block.\n', args=[]),
+        new(
+
+        ):: std.prune(a={}),
+      },
+      range_expectation:: {
+        '#new':: d.fn(help='\n`google.dataplex_datascan.data_quality_spec.rules.range_expectation.new` constructs a new object with attributes and blocks configured for the `range_expectation`\nTerraform sub block.\n\n\n\n**Args**:\n  - `max_value` (`string`): The maximum column value allowed for a row to pass this validation. At least one of minValue and maxValue need to be provided. When `null`, the `max_value` field will be omitted from the resulting object.\n  - `min_value` (`string`): The minimum column value allowed for a row to pass this validation. At least one of minValue and maxValue need to be provided. When `null`, the `min_value` field will be omitted from the resulting object.\n  - `strict_max_enabled` (`bool`): Whether each value needs to be strictly lesser than ('<') the maximum, or if equality is allowed.\nOnly relevant if a maxValue has been defined. Default = false. When `null`, the `strict_max_enabled` field will be omitted from the resulting object.\n  - `strict_min_enabled` (`bool`): Whether each value needs to be strictly greater than ('>') the minimum, or if equality is allowed.\nOnly relevant if a minValue has been defined. Default = false. When `null`, the `strict_min_enabled` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `range_expectation` sub block.\n', args=[]),
+        new(
+          max_value=null,
+          min_value=null,
+          strict_max_enabled=null,
+          strict_min_enabled=null
+        ):: std.prune(a={
+          max_value: max_value,
+          min_value: min_value,
+          strict_max_enabled: strict_max_enabled,
+          strict_min_enabled: strict_min_enabled,
+        }),
+      },
+      regex_expectation:: {
+        '#new':: d.fn(help='\n`google.dataplex_datascan.data_quality_spec.rules.regex_expectation.new` constructs a new object with attributes and blocks configured for the `regex_expectation`\nTerraform sub block.\n\n\n\n**Args**:\n  - `regex` (`string`): A regular expression the column value is expected to match.\n\n**Returns**:\n  - An attribute object that represents the `regex_expectation` sub block.\n', args=[]),
+        new(
+          regex
+        ):: std.prune(a={
+          regex: regex,
+        }),
+      },
+      row_condition_expectation:: {
+        '#new':: d.fn(help='\n`google.dataplex_datascan.data_quality_spec.rules.row_condition_expectation.new` constructs a new object with attributes and blocks configured for the `row_condition_expectation`\nTerraform sub block.\n\n\n\n**Args**:\n  - `sql_expression` (`string`): The SQL expression.\n\n**Returns**:\n  - An attribute object that represents the `row_condition_expectation` sub block.\n', args=[]),
+        new(
+          sql_expression
+        ):: std.prune(a={
+          sql_expression: sql_expression,
+        }),
+      },
+      set_expectation:: {
+        '#new':: d.fn(help='\n`google.dataplex_datascan.data_quality_spec.rules.set_expectation.new` constructs a new object with attributes and blocks configured for the `set_expectation`\nTerraform sub block.\n\n\n\n**Args**:\n  - `values` (`list`): Expected values for the column value.\n\n**Returns**:\n  - An attribute object that represents the `set_expectation` sub block.\n', args=[]),
+        new(
+          values
+        ):: std.prune(a={
+          values: values,
+        }),
+      },
+      statistic_range_expectation:: {
+        '#new':: d.fn(help='\n`google.dataplex_datascan.data_quality_spec.rules.statistic_range_expectation.new` constructs a new object with attributes and blocks configured for the `statistic_range_expectation`\nTerraform sub block.\n\n\n\n**Args**:\n  - `max_value` (`string`): The maximum column statistic value allowed for a row to pass this validation.\nAt least one of minValue and maxValue need to be provided. When `null`, the `max_value` field will be omitted from the resulting object.\n  - `min_value` (`string`): The minimum column statistic value allowed for a row to pass this validation.\nAt least one of minValue and maxValue need to be provided. When `null`, the `min_value` field will be omitted from the resulting object.\n  - `statistic` (`string`): column statistics. Possible values: ["STATISTIC_UNDEFINED", "MEAN", "MIN", "MAX"]\n  - `strict_max_enabled` (`bool`): Whether column statistic needs to be strictly lesser than ('<') the maximum, or if equality is allowed.\nOnly relevant if a maxValue has been defined. Default = false. When `null`, the `strict_max_enabled` field will be omitted from the resulting object.\n  - `strict_min_enabled` (`bool`): Whether column statistic needs to be strictly greater than ('>') the minimum, or if equality is allowed.\nOnly relevant if a minValue has been defined. Default = false. When `null`, the `strict_min_enabled` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `statistic_range_expectation` sub block.\n', args=[]),
+        new(
+          statistic,
+          max_value=null,
+          min_value=null,
+          strict_max_enabled=null,
+          strict_min_enabled=null
+        ):: std.prune(a={
+          max_value: max_value,
+          min_value: min_value,
+          statistic: statistic,
+          strict_max_enabled: strict_max_enabled,
+          strict_min_enabled: strict_min_enabled,
+        }),
+      },
+      table_condition_expectation:: {
+        '#new':: d.fn(help='\n`google.dataplex_datascan.data_quality_spec.rules.table_condition_expectation.new` constructs a new object with attributes and blocks configured for the `table_condition_expectation`\nTerraform sub block.\n\n\n\n**Args**:\n  - `sql_expression` (`string`): The SQL expression.\n\n**Returns**:\n  - An attribute object that represents the `table_condition_expectation` sub block.\n', args=[]),
+        new(
+          sql_expression
+        ):: std.prune(a={
+          sql_expression: sql_expression,
+        }),
+      },
+      uniqueness_expectation:: {
+        '#new':: d.fn(help='\n`google.dataplex_datascan.data_quality_spec.rules.uniqueness_expectation.new` constructs a new object with attributes and blocks configured for the `uniqueness_expectation`\nTerraform sub block.\n\n\n\n**Returns**:\n  - An attribute object that represents the `uniqueness_expectation` sub block.\n', args=[]),
+        new(
+
+        ):: std.prune(a={}),
+      },
+    },
+  },
+  execution_spec:: {
+    '#new':: d.fn(help='\n`google.dataplex_datascan.execution_spec.new` constructs a new object with attributes and blocks configured for the `execution_spec`\nTerraform sub block.\n\n\n\n**Args**:\n  - `field` (`string`): The unnested field (of type Date or Timestamp) that contains values which monotonically increase over time. If not specified, a data scan will run for all data in the table. When `null`, the `field` field will be omitted from the resulting object.\n  - `trigger` (`list[obj]`): Spec related to how often and when a scan should be triggered. When `null`, the `trigger` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.execution_spec.trigger.new](#fn-execution_spectriggernew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `execution_spec` sub block.\n', args=[]),
+    new(
+      field=null,
+      trigger=null
+    ):: std.prune(a={
+      field: field,
+      trigger: trigger,
+    }),
+    trigger:: {
+      '#new':: d.fn(help='\n`google.dataplex_datascan.execution_spec.trigger.new` constructs a new object with attributes and blocks configured for the `trigger`\nTerraform sub block.\n\n\n\n**Args**:\n  - `on_demand` (`list[obj]`): The scan runs once via dataScans.run API. When `null`, the `on_demand` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.execution_spec.trigger.on_demand.new](#fn-execution_specexecution_specon_demandnew) constructor.\n  - `schedule` (`list[obj]`): The scan is scheduled to run periodically. When `null`, the `schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.execution_spec.trigger.schedule.new](#fn-execution_specexecution_specschedulenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `trigger` sub block.\n', args=[]),
+      new(
+        on_demand=null,
+        schedule=null
+      ):: std.prune(a={
+        on_demand: on_demand,
+        schedule: schedule,
+      }),
+      on_demand:: {
+        '#new':: d.fn(help='\n`google.dataplex_datascan.execution_spec.trigger.on_demand.new` constructs a new object with attributes and blocks configured for the `on_demand`\nTerraform sub block.\n\n\n\n**Returns**:\n  - An attribute object that represents the `on_demand` sub block.\n', args=[]),
+        new(
+
+        ):: std.prune(a={}),
+      },
+      schedule:: {
+        '#new':: d.fn(help='\n`google.dataplex_datascan.execution_spec.trigger.schedule.new` constructs a new object with attributes and blocks configured for the `schedule`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cron` (`string`): Cron schedule for running scans periodically. This field is required for Schedule scans.\n\n**Returns**:\n  - An attribute object that represents the `schedule` sub block.\n', args=[]),
+        new(
+          cron
+        ):: std.prune(a={
+          cron: cron,
+        }),
+      },
+    },
+  },
+  '#new':: d.fn(help="\n`google.dataplex_datascan.new` injects a new `google_dataplex_datascan` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataplex_datascan.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataplex_datascan` using the reference:\n\n    $._ref.google_dataplex_datascan.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataplex_datascan.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `data_scan_id` (`string`): DataScan identifier. Must contain only lowercase letters, numbers and hyphens. Must start with a letter. Must end with a number or a letter.\n  - `description` (`string`): Description of the scan. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the scan. A list of key-\u0026gt;value pairs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the data scan should reside.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `data` (`list[obj]`): The data source for DataScan. When `null`, the `data` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data.new](#fn-datanew) constructor.\n  - `data_profile_spec` (`list[obj]`): DataProfileScan related setting. When `null`, the `data_profile_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_profile_spec.new](#fn-data_profile_specnew) constructor.\n  - `data_quality_spec` (`list[obj]`): DataQualityScan related setting. When `null`, the `data_quality_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.new](#fn-data_quality_specnew) constructor.\n  - `execution_spec` (`list[obj]`): DataScan execution settings. When `null`, the `execution_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.execution_spec.new](#fn-execution_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    data_scan_id,
+    location,
+    data=null,
+    data_profile_spec=null,
+    data_quality_spec=null,
+    description=null,
+    display_name=null,
+    execution_spec=null,
+    labels=null,
+    project=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_dataplex_datascan',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      data=data,
+      data_profile_spec=data_profile_spec,
+      data_quality_spec=data_quality_spec,
+      data_scan_id=data_scan_id,
+      description=description,
+      display_name=display_name,
+      execution_spec=execution_spec,
+      labels=labels,
+      location=location,
+      project=project,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.dataplex_datascan.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_datascan`\nTerraform resource.\n\nUnlike [google.dataplex_datascan.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `data_scan_id` (`string`): DataScan identifier. Must contain only lowercase letters, numbers and hyphens. Must start with a letter. Must end with a number or a letter.\n  - `description` (`string`): Description of the scan. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the scan. A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the data scan should reside.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `data` (`list[obj]`): The data source for DataScan. When `null`, the `data` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data.new](#fn-datanew) constructor.\n  - `data_profile_spec` (`list[obj]`): DataProfileScan related setting. When `null`, the `data_profile_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_profile_spec.new](#fn-data_profile_specnew) constructor.\n  - `data_quality_spec` (`list[obj]`): DataQualityScan related setting. When `null`, the `data_quality_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.new](#fn-data_quality_specnew) constructor.\n  - `execution_spec` (`list[obj]`): DataScan execution settings. When `null`, the `execution_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.execution_spec.new](#fn-execution_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_datascan` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    data_scan_id,
+    location,
+    data=null,
+    data_profile_spec=null,
+    data_quality_spec=null,
+    description=null,
+    display_name=null,
+    execution_spec=null,
+    labels=null,
+    project=null,
+    timeouts=null
+  ):: std.prune(a={
+    data: data,
+    data_profile_spec: data_profile_spec,
+    data_quality_spec: data_quality_spec,
+    data_scan_id: data_scan_id,
+    description: description,
+    display_name: display_name,
+    execution_spec: execution_spec,
+    labels: labels,
+    location: location,
+    project: project,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.dataplex_datascan.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withData':: d.fn(help='`google.list[obj].withData` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the data field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withDataMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `data` field.\n', args=[]),
+  withData(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan+: {
+        [resourceLabel]+: {
+          data: value,
+        },
+      },
+    },
+  },
+  '#withDataMixin':: d.fn(help='`google.list[obj].withDataMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the data field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withData](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `data` field.\n', args=[]),
+  withDataMixin(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan+: {
+        [resourceLabel]+: {
+          data+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDataProfileSpec':: d.fn(help='`google.list[obj].withDataProfileSpec` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the data_profile_spec field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withDataProfileSpecMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `data_profile_spec` field.\n', args=[]),
+  withDataProfileSpec(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan+: {
+        [resourceLabel]+: {
+          data_profile_spec: value,
+        },
+      },
+    },
+  },
+  '#withDataProfileSpecMixin':: d.fn(help='`google.list[obj].withDataProfileSpecMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the data_profile_spec field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withDataProfileSpec](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `data_profile_spec` field.\n', args=[]),
+  withDataProfileSpecMixin(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan+: {
+        [resourceLabel]+: {
+          data_profile_spec+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDataQualitySpec':: d.fn(help='`google.list[obj].withDataQualitySpec` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the data_quality_spec field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withDataQualitySpecMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `data_quality_spec` field.\n', args=[]),
+  withDataQualitySpec(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan+: {
+        [resourceLabel]+: {
+          data_quality_spec: value,
+        },
+      },
+    },
+  },
+  '#withDataQualitySpecMixin':: d.fn(help='`google.list[obj].withDataQualitySpecMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the data_quality_spec field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withDataQualitySpec](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `data_quality_spec` field.\n', args=[]),
+  withDataQualitySpecMixin(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan+: {
+        [resourceLabel]+: {
+          data_quality_spec+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDataScanId':: d.fn(help='`google.string.withDataScanId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the data_scan_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `data_scan_id` field.\n', args=[]),
+  withDataScanId(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan+: {
+        [resourceLabel]+: {
+          data_scan_id: value,
+        },
+      },
+    },
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
+  withDisplayName(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan+: {
+        [resourceLabel]+: {
+          display_name: value,
+        },
+      },
+    },
+  },
+  '#withExecutionSpec':: d.fn(help='`google.list[obj].withExecutionSpec` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the execution_spec field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withExecutionSpecMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `execution_spec` field.\n', args=[]),
+  withExecutionSpec(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan+: {
+        [resourceLabel]+: {
+          execution_spec: value,
+        },
+      },
+    },
+  },
+  '#withExecutionSpecMixin':: d.fn(help='`google.list[obj].withExecutionSpecMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the execution_spec field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withExecutionSpec](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `execution_spec` field.\n', args=[]),
+  withExecutionSpecMixin(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan+: {
+        [resourceLabel]+: {
+          execution_spec+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/dataplex_datascan_iam_binding.libsonnet b/4.x/_gen/resources/dataplex_datascan_iam_binding.libsonnet
new file mode 100644
index 0000000..8a473b7
--- /dev/null
+++ b/4.x/_gen/resources/dataplex_datascan_iam_binding.libsonnet
@@ -0,0 +1,126 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='dataplex_datascan_iam_binding', url='', help='`dataplex_datascan_iam_binding` represents the `google_dataplex_datascan_iam_binding` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  condition:: {
+    '#new':: d.fn(help='\n`google.dataplex_datascan_iam_binding.condition.new` constructs a new object with attributes and blocks configured for the `condition`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Set the `expression` field on the resulting object.\n  - `title` (`string`): Set the `title` field on the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `condition` sub block.\n', args=[]),
+    new(
+      expression,
+      title,
+      description=null
+    ):: std.prune(a={
+      description: description,
+      expression: expression,
+      title: title,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.dataplex_datascan_iam_binding.new` injects a new `google_dataplex_datascan_iam_binding` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataplex_datascan_iam_binding.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataplex_datascan_iam_binding` using the reference:\n\n    $._ref.google_dataplex_datascan_iam_binding.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataplex_datascan_iam_binding.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `data_scan_id` (`string`): Set the `data_scan_id` field on the resulting resource block.\n  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.\n  - `members` (`list`): Set the `members` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting resource block.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan_iam_binding.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    data_scan_id,
+    members,
+    role,
+    condition=null,
+    location=null,
+    project=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_dataplex_datascan_iam_binding',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      condition=condition,
+      data_scan_id=data_scan_id,
+      location=location,
+      members=members,
+      project=project,
+      role=role
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.dataplex_datascan_iam_binding.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_datascan_iam_binding`\nTerraform resource.\n\nUnlike [google.dataplex_datascan_iam_binding.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `data_scan_id` (`string`): Set the `data_scan_id` field on the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.\n  - `members` (`list`): Set the `members` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting object.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan_iam_binding.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_datascan_iam_binding` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    data_scan_id,
+    members,
+    role,
+    condition=null,
+    location=null,
+    project=null
+  ):: std.prune(a={
+    condition: condition,
+    data_scan_id: data_scan_id,
+    location: location,
+    members: members,
+    project: project,
+    role: role,
+  }),
+  '#withCondition':: d.fn(help='`google.list[obj].withCondition` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withConditionMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
+  withCondition(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan_iam_binding+: {
+        [resourceLabel]+: {
+          condition: value,
+        },
+      },
+    },
+  },
+  '#withConditionMixin':: d.fn(help='`google.list[obj].withConditionMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCondition](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
+  withConditionMixin(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan_iam_binding+: {
+        [resourceLabel]+: {
+          condition+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDataScanId':: d.fn(help='`google.string.withDataScanId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the data_scan_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `data_scan_id` field.\n', args=[]),
+  withDataScanId(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan_iam_binding+: {
+        [resourceLabel]+: {
+          data_scan_id: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan_iam_binding+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withMembers':: d.fn(help='`google.list.withMembers` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the members field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `members` field.\n', args=[]),
+  withMembers(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan_iam_binding+: {
+        [resourceLabel]+: {
+          members: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan_iam_binding+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withRole':: d.fn(help='`google.string.withRole` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the role field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `role` field.\n', args=[]),
+  withRole(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan_iam_binding+: {
+        [resourceLabel]+: {
+          role: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/dataplex_datascan_iam_member.libsonnet b/4.x/_gen/resources/dataplex_datascan_iam_member.libsonnet
new file mode 100644
index 0000000..e8471f6
--- /dev/null
+++ b/4.x/_gen/resources/dataplex_datascan_iam_member.libsonnet
@@ -0,0 +1,126 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='dataplex_datascan_iam_member', url='', help='`dataplex_datascan_iam_member` represents the `google_dataplex_datascan_iam_member` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  condition:: {
+    '#new':: d.fn(help='\n`google.dataplex_datascan_iam_member.condition.new` constructs a new object with attributes and blocks configured for the `condition`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Set the `expression` field on the resulting object.\n  - `title` (`string`): Set the `title` field on the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `condition` sub block.\n', args=[]),
+    new(
+      expression,
+      title,
+      description=null
+    ):: std.prune(a={
+      description: description,
+      expression: expression,
+      title: title,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.dataplex_datascan_iam_member.new` injects a new `google_dataplex_datascan_iam_member` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataplex_datascan_iam_member.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataplex_datascan_iam_member` using the reference:\n\n    $._ref.google_dataplex_datascan_iam_member.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataplex_datascan_iam_member.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `data_scan_id` (`string`): Set the `data_scan_id` field on the resulting resource block.\n  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.\n  - `member` (`string`): Set the `member` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting resource block.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan_iam_member.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    data_scan_id,
+    member,
+    role,
+    condition=null,
+    location=null,
+    project=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_dataplex_datascan_iam_member',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      condition=condition,
+      data_scan_id=data_scan_id,
+      location=location,
+      member=member,
+      project=project,
+      role=role
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.dataplex_datascan_iam_member.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_datascan_iam_member`\nTerraform resource.\n\nUnlike [google.dataplex_datascan_iam_member.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `data_scan_id` (`string`): Set the `data_scan_id` field on the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.\n  - `member` (`string`): Set the `member` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting object.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan_iam_member.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_datascan_iam_member` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    data_scan_id,
+    member,
+    role,
+    condition=null,
+    location=null,
+    project=null
+  ):: std.prune(a={
+    condition: condition,
+    data_scan_id: data_scan_id,
+    location: location,
+    member: member,
+    project: project,
+    role: role,
+  }),
+  '#withCondition':: d.fn(help='`google.list[obj].withCondition` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withConditionMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
+  withCondition(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan_iam_member+: {
+        [resourceLabel]+: {
+          condition: value,
+        },
+      },
+    },
+  },
+  '#withConditionMixin':: d.fn(help='`google.list[obj].withConditionMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCondition](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
+  withConditionMixin(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan_iam_member+: {
+        [resourceLabel]+: {
+          condition+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDataScanId':: d.fn(help='`google.string.withDataScanId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the data_scan_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `data_scan_id` field.\n', args=[]),
+  withDataScanId(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan_iam_member+: {
+        [resourceLabel]+: {
+          data_scan_id: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan_iam_member+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withMember':: d.fn(help='`google.string.withMember` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the member field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `member` field.\n', args=[]),
+  withMember(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan_iam_member+: {
+        [resourceLabel]+: {
+          member: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan_iam_member+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withRole':: d.fn(help='`google.string.withRole` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the role field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `role` field.\n', args=[]),
+  withRole(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan_iam_member+: {
+        [resourceLabel]+: {
+          role: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/dataplex_datascan_iam_policy.libsonnet b/4.x/_gen/resources/dataplex_datascan_iam_policy.libsonnet
new file mode 100644
index 0000000..89397d4
--- /dev/null
+++ b/4.x/_gen/resources/dataplex_datascan_iam_policy.libsonnet
@@ -0,0 +1,76 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='dataplex_datascan_iam_policy', url='', help='`dataplex_datascan_iam_policy` represents the `google_dataplex_datascan_iam_policy` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.dataplex_datascan_iam_policy.new` injects a new `google_dataplex_datascan_iam_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataplex_datascan_iam_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataplex_datascan_iam_policy` using the reference:\n\n    $._ref.google_dataplex_datascan_iam_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataplex_datascan_iam_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `data_scan_id` (`string`): Set the `data_scan_id` field on the resulting resource block.\n  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.\n  - `policy_data` (`string`): Set the `policy_data` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    data_scan_id,
+    policy_data,
+    location=null,
+    project=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_dataplex_datascan_iam_policy',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      data_scan_id=data_scan_id,
+      location=location,
+      policy_data=policy_data,
+      project=project
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.dataplex_datascan_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_datascan_iam_policy`\nTerraform resource.\n\nUnlike [google.dataplex_datascan_iam_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `data_scan_id` (`string`): Set the `data_scan_id` field on the resulting object.\n  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.\n  - `policy_data` (`string`): Set the `policy_data` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_datascan_iam_policy` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    data_scan_id,
+    policy_data,
+    location=null,
+    project=null
+  ):: std.prune(a={
+    data_scan_id: data_scan_id,
+    location: location,
+    policy_data: policy_data,
+    project: project,
+  }),
+  '#withDataScanId':: d.fn(help='`google.string.withDataScanId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the data_scan_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `data_scan_id` field.\n', args=[]),
+  withDataScanId(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan_iam_policy+: {
+        [resourceLabel]+: {
+          data_scan_id: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan_iam_policy+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withPolicyData':: d.fn(help='`google.string.withPolicyData` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the policy_data field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `policy_data` field.\n', args=[]),
+  withPolicyData(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan_iam_policy+: {
+        [resourceLabel]+: {
+          policy_data: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_dataplex_datascan_iam_policy+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/kms_crypto_key.libsonnet b/4.x/_gen/resources/kms_crypto_key.libsonnet
index 0a89c67..8dc923b 100644
--- a/4.x/_gen/resources/kms_crypto_key.libsonnet
+++ b/4.x/_gen/resources/kms_crypto_key.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='kms_crypto_key', url='', help='`kms_crypto_key` represents the `google_kms_crypto_key` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.kms_crypto_key.new` injects a new `google_kms_crypto_key` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.kms_crypto_key.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.kms_crypto_key` using the reference:\n\n    $._ref.google_kms_crypto_key.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_kms_crypto_key.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `destroy_scheduled_duration` (`string`): The period of time that versions of this key spend in the DESTROY_SCHEDULED state before transitioning to DESTROYED.\nIf not specified at creation time, the default duration is 24 hours. When `null`, the `destroy_scheduled_duration` field will be omitted from the resulting object.\n  - `import_only` (`bool`): Whether this key may contain imported versions only. When `null`, the `import_only` field will be omitted from the resulting object.\n  - `key_ring` (`string`): The KeyRing that this key belongs to.\nFormat: \u0026#39;\u0026#39;projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}\u0026#39;\u0026#39;.\n  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the CryptoKey.\n  - `purpose` (`string`): The immutable purpose of this CryptoKey. See the\n[purpose reference](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys#CryptoKeyPurpose)\nfor possible inputs. Default value: \u0026#34;ENCRYPT_DECRYPT\u0026#34; Possible values: [\u0026#34;ENCRYPT_DECRYPT\u0026#34;, \u0026#34;ASYMMETRIC_SIGN\u0026#34;, \u0026#34;ASYMMETRIC_DECRYPT\u0026#34;, \u0026#34;MAC\u0026#34;] When `null`, the `purpose` field will be omitted from the resulting object.\n  - `rotation_period` (`string`): Every time this period passes, generate a new CryptoKeyVersion and set it as the primary.\nThe first rotation will take place after the specified period. The rotation period has\nthe format of a decimal number with up to 9 fractional digits, followed by the\nletter \u0026#39;s\u0026#39; (seconds). It must be greater than a day (ie, 86400). When `null`, the `rotation_period` field will be omitted from the resulting object.\n  - `skip_initial_version_creation` (`bool`): If set to true, the request will create a CryptoKey without any CryptoKeyVersions.\nYou must use the \u0026#39;google_kms_key_ring_import_job\u0026#39; resource to import the CryptoKeyVersion. When `null`, the `skip_initial_version_creation` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.kms_crypto_key.timeouts.new](#fn-timeoutsnew) constructor.\n  - `version_template` (`list[obj]`): A template describing settings for new crypto key versions. When `null`, the `version_template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.kms_crypto_key.version_template.new](#fn-version_templatenew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.kms_crypto_key.new` injects a new `google_kms_crypto_key` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.kms_crypto_key.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.kms_crypto_key` using the reference:\n\n    $._ref.google_kms_crypto_key.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_kms_crypto_key.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `destroy_scheduled_duration` (`string`): The period of time that versions of this key spend in the DESTROY_SCHEDULED state before transitioning to DESTROYED.\nIf not specified at creation time, the default duration is 24 hours. When `null`, the `destroy_scheduled_duration` field will be omitted from the resulting object.\n  - `import_only` (`bool`): Whether this key may contain imported versions only. When `null`, the `import_only` field will be omitted from the resulting object.\n  - `key_ring` (`string`): The KeyRing that this key belongs to.\nFormat: \u0026#39;\u0026#39;projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}\u0026#39;\u0026#39;.\n  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the CryptoKey.\n  - `purpose` (`string`): The immutable purpose of this CryptoKey. See the\n[purpose reference](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys#CryptoKeyPurpose)\nfor possible inputs.\nDefault value is \u0026#34;ENCRYPT_DECRYPT\u0026#34;. When `null`, the `purpose` field will be omitted from the resulting object.\n  - `rotation_period` (`string`): Every time this period passes, generate a new CryptoKeyVersion and set it as the primary.\nThe first rotation will take place after the specified period. The rotation period has\nthe format of a decimal number with up to 9 fractional digits, followed by the\nletter \u0026#39;s\u0026#39; (seconds). It must be greater than a day (ie, 86400). When `null`, the `rotation_period` field will be omitted from the resulting object.\n  - `skip_initial_version_creation` (`bool`): If set to true, the request will create a CryptoKey without any CryptoKeyVersions.\nYou must use the \u0026#39;google_kms_key_ring_import_job\u0026#39; resource to import the CryptoKeyVersion. When `null`, the `skip_initial_version_creation` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.kms_crypto_key.timeouts.new](#fn-timeoutsnew) constructor.\n  - `version_template` (`list[obj]`): A template describing settings for new crypto key versions. When `null`, the `version_template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.kms_crypto_key.version_template.new](#fn-version_templatenew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     key_ring,
@@ -33,7 +33,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.kms_crypto_key.newAttrs` constructs a new object with attributes and blocks configured for the `kms_crypto_key`\nTerraform resource.\n\nUnlike [google.kms_crypto_key.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `destroy_scheduled_duration` (`string`): The period of time that versions of this key spend in the DESTROY_SCHEDULED state before transitioning to DESTROYED.\nIf not specified at creation time, the default duration is 24 hours. When `null`, the `destroy_scheduled_duration` field will be omitted from the resulting object.\n  - `import_only` (`bool`): Whether this key may contain imported versions only. When `null`, the `import_only` field will be omitted from the resulting object.\n  - `key_ring` (`string`): The KeyRing that this key belongs to.\nFormat: ''projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}''.\n  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the CryptoKey.\n  - `purpose` (`string`): The immutable purpose of this CryptoKey. See the\n[purpose reference](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys#CryptoKeyPurpose)\nfor possible inputs. Default value: "ENCRYPT_DECRYPT" Possible values: ["ENCRYPT_DECRYPT", "ASYMMETRIC_SIGN", "ASYMMETRIC_DECRYPT", "MAC"] When `null`, the `purpose` field will be omitted from the resulting object.\n  - `rotation_period` (`string`): Every time this period passes, generate a new CryptoKeyVersion and set it as the primary.\nThe first rotation will take place after the specified period. The rotation period has\nthe format of a decimal number with up to 9 fractional digits, followed by the\nletter 's' (seconds). It must be greater than a day (ie, 86400). When `null`, the `rotation_period` field will be omitted from the resulting object.\n  - `skip_initial_version_creation` (`bool`): If set to true, the request will create a CryptoKey without any CryptoKeyVersions.\nYou must use the 'google_kms_key_ring_import_job' resource to import the CryptoKeyVersion. When `null`, the `skip_initial_version_creation` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.kms_crypto_key.timeouts.new](#fn-timeoutsnew) constructor.\n  - `version_template` (`list[obj]`): A template describing settings for new crypto key versions. When `null`, the `version_template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.kms_crypto_key.version_template.new](#fn-version_templatenew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `kms_crypto_key` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.kms_crypto_key.newAttrs` constructs a new object with attributes and blocks configured for the `kms_crypto_key`\nTerraform resource.\n\nUnlike [google.kms_crypto_key.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `destroy_scheduled_duration` (`string`): The period of time that versions of this key spend in the DESTROY_SCHEDULED state before transitioning to DESTROYED.\nIf not specified at creation time, the default duration is 24 hours. When `null`, the `destroy_scheduled_duration` field will be omitted from the resulting object.\n  - `import_only` (`bool`): Whether this key may contain imported versions only. When `null`, the `import_only` field will be omitted from the resulting object.\n  - `key_ring` (`string`): The KeyRing that this key belongs to.\nFormat: ''projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}''.\n  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the CryptoKey.\n  - `purpose` (`string`): The immutable purpose of this CryptoKey. See the\n[purpose reference](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys#CryptoKeyPurpose)\nfor possible inputs.\nDefault value is "ENCRYPT_DECRYPT". When `null`, the `purpose` field will be omitted from the resulting object.\n  - `rotation_period` (`string`): Every time this period passes, generate a new CryptoKeyVersion and set it as the primary.\nThe first rotation will take place after the specified period. The rotation period has\nthe format of a decimal number with up to 9 fractional digits, followed by the\nletter 's' (seconds). It must be greater than a day (ie, 86400). When `null`, the `rotation_period` field will be omitted from the resulting object.\n  - `skip_initial_version_creation` (`bool`): If set to true, the request will create a CryptoKey without any CryptoKeyVersions.\nYou must use the 'google_kms_key_ring_import_job' resource to import the CryptoKeyVersion. When `null`, the `skip_initial_version_creation` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.kms_crypto_key.timeouts.new](#fn-timeoutsnew) constructor.\n  - `version_template` (`list[obj]`): A template describing settings for new crypto key versions. When `null`, the `version_template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.kms_crypto_key.version_template.new](#fn-version_templatenew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `kms_crypto_key` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     key_ring,
     name,
diff --git a/docs/4.x/README.md b/docs/4.x/README.md
index 33b7351..d235d5c 100644
--- a/docs/4.x/README.md
+++ b/docs/4.x/README.md
@@ -23,6 +23,8 @@ project.
 * [access_context_manager_gcp_user_access_binding](access_context_manager_gcp_user_access_binding.md)
 * [access_context_manager_ingress_policy](access_context_manager_ingress_policy.md)
 * [access_context_manager_service_perimeter](access_context_manager_service_perimeter.md)
+* [access_context_manager_service_perimeter_egress_policy](access_context_manager_service_perimeter_egress_policy.md)
+* [access_context_manager_service_perimeter_ingress_policy](access_context_manager_service_perimeter_ingress_policy.md)
 * [access_context_manager_service_perimeter_resource](access_context_manager_service_perimeter_resource.md)
 * [access_context_manager_service_perimeters](access_context_manager_service_perimeters.md)
 * [active_directory_domain](active_directory_domain.md)
@@ -120,6 +122,7 @@ project.
 * [binary_authorization_attestor_iam_policy](binary_authorization_attestor_iam_policy.md)
 * [binary_authorization_policy](binary_authorization_policy.md)
 * [certificate_manager_certificate](certificate_manager_certificate.md)
+* [certificate_manager_certificate_issuance_config](certificate_manager_certificate_issuance_config.md)
 * [certificate_manager_certificate_map](certificate_manager_certificate_map.md)
 * [certificate_manager_certificate_map_entry](certificate_manager_certificate_map_entry.md)
 * [certificate_manager_dns_authorization](certificate_manager_dns_authorization.md)
@@ -322,6 +325,10 @@ project.
 * [dataplex_asset_iam_binding](dataplex_asset_iam_binding.md)
 * [dataplex_asset_iam_member](dataplex_asset_iam_member.md)
 * [dataplex_asset_iam_policy](dataplex_asset_iam_policy.md)
+* [dataplex_datascan](dataplex_datascan.md)
+* [dataplex_datascan_iam_binding](dataplex_datascan_iam_binding.md)
+* [dataplex_datascan_iam_member](dataplex_datascan_iam_member.md)
+* [dataplex_datascan_iam_policy](dataplex_datascan_iam_policy.md)
 * [dataplex_lake](dataplex_lake.md)
 * [dataplex_lake_iam_binding](dataplex_lake_iam_binding.md)
 * [dataplex_lake_iam_member](dataplex_lake_iam_member.md)
diff --git a/docs/4.x/access_context_manager_service_perimeter_egress_policy.md b/docs/4.x/access_context_manager_service_perimeter_egress_policy.md
new file mode 100644
index 0000000..b77be37
--- /dev/null
+++ b/docs/4.x/access_context_manager_service_perimeter_egress_policy.md
@@ -0,0 +1,367 @@
+---
+permalink: /access_context_manager_service_perimeter_egress_policy/
+---
+
+# access_context_manager_service_perimeter_egress_policy
+
+`access_context_manager_service_perimeter_egress_policy` represents the `google_access_context_manager_service_perimeter_egress_policy` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withEgressFrom()`](#fn-withegressfrom)
+* [`fn withEgressFromMixin()`](#fn-withegressfrommixin)
+* [`fn withEgressTo()`](#fn-withegressto)
+* [`fn withEgressToMixin()`](#fn-withegresstomixin)
+* [`fn withPerimeter()`](#fn-withperimeter)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj egress_from`](#obj-egress_from)
+  * [`fn new()`](#fn-egress_fromnew)
+* [`obj egress_to`](#obj-egress_to)
+  * [`fn new()`](#fn-egress_tonew)
+  * [`obj egress_to.operations`](#obj-egress_tooperations)
+    * [`fn new()`](#fn-egress_tooperationsnew)
+    * [`obj egress_to.operations.method_selectors`](#obj-egress_tooperationsmethod_selectors)
+      * [`fn new()`](#fn-egress_tooperationsmethod_selectorsnew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_service_perimeter_egress_policy.new` injects a new `google_access_context_manager_service_perimeter_egress_policy` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.access_context_manager_service_perimeter_egress_policy.new('some_id')
+
+You can get the reference to the `id` field of the created `google.access_context_manager_service_perimeter_egress_policy` using the reference:
+
+    $._ref.google_access_context_manager_service_perimeter_egress_policy.some_id.get('id')
+
+This is the same as directly entering `"${ google_access_context_manager_service_perimeter_egress_policy.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `perimeter` (`string`): The name of the Service Perimeter to add this resource to.
+  - `egress_from` (`list[obj]`): Defines conditions on the source of a request causing this 'EgressPolicy' to apply. When `null`, the `egress_from` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_egress_policy.egress_from.new](#fn-egress_fromnew) constructor.
+  - `egress_to` (`list[obj]`): Defines the conditions on the 'ApiOperation' and destination resources that
+cause this 'EgressPolicy' to apply. When `null`, the `egress_to` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_egress_policy.egress_to.new](#fn-egress_tonew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_egress_policy.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.access_context_manager_service_perimeter_egress_policy.newAttrs` constructs a new object with attributes and blocks configured for the `access_context_manager_service_perimeter_egress_policy`
+Terraform resource.
+
+Unlike [google.access_context_manager_service_perimeter_egress_policy.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `perimeter` (`string`): The name of the Service Perimeter to add this resource to.
+  - `egress_from` (`list[obj]`): Defines conditions on the source of a request causing this 'EgressPolicy' to apply. When `null`, the `egress_from` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_egress_policy.egress_from.new](#fn-egress_fromnew) constructor.
+  - `egress_to` (`list[obj]`): Defines the conditions on the 'ApiOperation' and destination resources that
+cause this 'EgressPolicy' to apply. When `null`, the `egress_to` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_egress_policy.egress_to.new](#fn-egress_tonew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_egress_policy.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `access_context_manager_service_perimeter_egress_policy` resource into the root Terraform configuration.
+
+
+### fn withEgressFrom
+
+```ts
+withEgressFrom()
+```
+
+`google.list[obj].withEgressFrom` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the egress_from field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withEgressFromMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `egress_from` field.
+
+
+### fn withEgressFromMixin
+
+```ts
+withEgressFromMixin()
+```
+
+`google.list[obj].withEgressFromMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the egress_from field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withEgressFrom](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `egress_from` field.
+
+
+### fn withEgressTo
+
+```ts
+withEgressTo()
+```
+
+`google.list[obj].withEgressTo` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the egress_to field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withEgressToMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `egress_to` field.
+
+
+### fn withEgressToMixin
+
+```ts
+withEgressToMixin()
+```
+
+`google.list[obj].withEgressToMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the egress_to field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withEgressTo](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `egress_to` field.
+
+
+### fn withPerimeter
+
+```ts
+withPerimeter()
+```
+
+`google.string.withPerimeter` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the perimeter field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `perimeter` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj egress_from
+
+
+
+### fn egress_from.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_service_perimeter_egress_policy.egress_from.new` constructs a new object with attributes and blocks configured for the `egress_from`
+Terraform sub block.
+
+
+
+**Args**:
+  - `identities` (`list`): A list of identities that are allowed access through this 'EgressPolicy'.
+Should be in the format of email address. The email address should
+represent individual user or service account only. When `null`, the `identities` field will be omitted from the resulting object.
+  - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the
+perimeter. If left unspecified, then members of 'identities' field will
+be allowed access. Possible values: ["ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `egress_from` sub block.
+
+
+## obj egress_to
+
+
+
+### fn egress_to.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_service_perimeter_egress_policy.egress_to.new` constructs a new object with attributes and blocks configured for the `egress_to`
+Terraform sub block.
+
+
+
+**Args**:
+  - `external_resources` (`list`): A list of external resources that are allowed to be accessed. A request
+matches if it contains an external resource in this list (Example:
+s3://bucket/path). Currently '*' is not allowed. When `null`, the `external_resources` field will be omitted from the resulting object.
+  - `resources` (`list`): A list of resources, currently only projects in the form
+'projects/<projectnumber>', that match this to stanza. A request matches
+if it contains a resource in this list. If * is specified for resources,
+then this 'EgressTo' rule will authorize access to all resources outside
+the perimeter. When `null`, the `resources` field will be omitted from the resulting object.
+  - `operations` (`list[obj]`): A list of 'ApiOperations' that this egress rule applies to. A request matches
+if it contains an operation/service in this list. When `null`, the `operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_egress_policy.egress_to.operations.new](#fn-egress_tooperationsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `egress_to` sub block.
+
+
+## obj egress_to.operations
+
+
+
+### fn egress_to.operations.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_service_perimeter_egress_policy.egress_to.operations.new` constructs a new object with attributes and blocks configured for the `operations`
+Terraform sub block.
+
+
+
+**Args**:
+  - `service_name` (`string`): The name of the API whose methods or permissions the 'IngressPolicy' or
+'EgressPolicy' want to allow. A single 'ApiOperation' with serviceName
+field set to '*' will allow all methods AND permissions for all services. When `null`, the `service_name` field will be omitted from the resulting object.
+  - `method_selectors` (`list[obj]`): API methods or permissions to allow. Method or permission must belong
+to the service specified by 'serviceName' field. A single MethodSelector
+entry with '*' specified for the 'method' field will allow all methods
+AND permissions for the service specified in 'serviceName'. When `null`, the `method_selectors` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_egress_policy.egress_to.operations.method_selectors.new](#fn-egress_toegress_tomethod_selectorsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `operations` sub block.
+
+
+## obj egress_to.operations.method_selectors
+
+
+
+### fn egress_to.operations.method_selectors.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_service_perimeter_egress_policy.egress_to.operations.method_selectors.new` constructs a new object with attributes and blocks configured for the `method_selectors`
+Terraform sub block.
+
+
+
+**Args**:
+  - `method` (`string`): Value for 'method' should be a valid method name for the corresponding
+'serviceName' in 'ApiOperation'. If '*' used as value for method,
+then ALL methods and permissions are allowed. When `null`, the `method` field will be omitted from the resulting object.
+  - `permission` (`string`): Value for permission should be a valid Cloud IAM permission for the
+corresponding 'serviceName' in 'ApiOperation'. When `null`, the `permission` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `method_selectors` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_service_perimeter_egress_policy.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/access_context_manager_service_perimeter_ingress_policy.md b/docs/4.x/access_context_manager_service_perimeter_ingress_policy.md
new file mode 100644
index 0000000..db0a0d8
--- /dev/null
+++ b/docs/4.x/access_context_manager_service_perimeter_ingress_policy.md
@@ -0,0 +1,408 @@
+---
+permalink: /access_context_manager_service_perimeter_ingress_policy/
+---
+
+# access_context_manager_service_perimeter_ingress_policy
+
+`access_context_manager_service_perimeter_ingress_policy` represents the `google_access_context_manager_service_perimeter_ingress_policy` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withIngressFrom()`](#fn-withingressfrom)
+* [`fn withIngressFromMixin()`](#fn-withingressfrommixin)
+* [`fn withIngressTo()`](#fn-withingressto)
+* [`fn withIngressToMixin()`](#fn-withingresstomixin)
+* [`fn withPerimeter()`](#fn-withperimeter)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj ingress_from`](#obj-ingress_from)
+  * [`fn new()`](#fn-ingress_fromnew)
+  * [`obj ingress_from.sources`](#obj-ingress_fromsources)
+    * [`fn new()`](#fn-ingress_fromsourcesnew)
+* [`obj ingress_to`](#obj-ingress_to)
+  * [`fn new()`](#fn-ingress_tonew)
+  * [`obj ingress_to.operations`](#obj-ingress_tooperations)
+    * [`fn new()`](#fn-ingress_tooperationsnew)
+    * [`obj ingress_to.operations.method_selectors`](#obj-ingress_tooperationsmethod_selectors)
+      * [`fn new()`](#fn-ingress_tooperationsmethod_selectorsnew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_service_perimeter_ingress_policy.new` injects a new `google_access_context_manager_service_perimeter_ingress_policy` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.access_context_manager_service_perimeter_ingress_policy.new('some_id')
+
+You can get the reference to the `id` field of the created `google.access_context_manager_service_perimeter_ingress_policy` using the reference:
+
+    $._ref.google_access_context_manager_service_perimeter_ingress_policy.some_id.get('id')
+
+This is the same as directly entering `"${ google_access_context_manager_service_perimeter_ingress_policy.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `perimeter` (`string`): The name of the Service Perimeter to add this resource to.
+  - `ingress_from` (`list[obj]`): Defines the conditions on the source of a request causing this 'IngressPolicy'
+to apply. When `null`, the `ingress_from` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_ingress_policy.ingress_from.new](#fn-ingress_fromnew) constructor.
+  - `ingress_to` (`list[obj]`): Defines the conditions on the 'ApiOperation' and request destination that cause
+this 'IngressPolicy' to apply. When `null`, the `ingress_to` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_ingress_policy.ingress_to.new](#fn-ingress_tonew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_ingress_policy.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.access_context_manager_service_perimeter_ingress_policy.newAttrs` constructs a new object with attributes and blocks configured for the `access_context_manager_service_perimeter_ingress_policy`
+Terraform resource.
+
+Unlike [google.access_context_manager_service_perimeter_ingress_policy.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `perimeter` (`string`): The name of the Service Perimeter to add this resource to.
+  - `ingress_from` (`list[obj]`): Defines the conditions on the source of a request causing this 'IngressPolicy'
+to apply. When `null`, the `ingress_from` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_ingress_policy.ingress_from.new](#fn-ingress_fromnew) constructor.
+  - `ingress_to` (`list[obj]`): Defines the conditions on the 'ApiOperation' and request destination that cause
+this 'IngressPolicy' to apply. When `null`, the `ingress_to` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_ingress_policy.ingress_to.new](#fn-ingress_tonew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_ingress_policy.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `access_context_manager_service_perimeter_ingress_policy` resource into the root Terraform configuration.
+
+
+### fn withIngressFrom
+
+```ts
+withIngressFrom()
+```
+
+`google.list[obj].withIngressFrom` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the ingress_from field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withIngressFromMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `ingress_from` field.
+
+
+### fn withIngressFromMixin
+
+```ts
+withIngressFromMixin()
+```
+
+`google.list[obj].withIngressFromMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the ingress_from field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withIngressFrom](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `ingress_from` field.
+
+
+### fn withIngressTo
+
+```ts
+withIngressTo()
+```
+
+`google.list[obj].withIngressTo` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the ingress_to field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withIngressToMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `ingress_to` field.
+
+
+### fn withIngressToMixin
+
+```ts
+withIngressToMixin()
+```
+
+`google.list[obj].withIngressToMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the ingress_to field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withIngressTo](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `ingress_to` field.
+
+
+### fn withPerimeter
+
+```ts
+withPerimeter()
+```
+
+`google.string.withPerimeter` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the perimeter field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `perimeter` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj ingress_from
+
+
+
+### fn ingress_from.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_service_perimeter_ingress_policy.ingress_from.new` constructs a new object with attributes and blocks configured for the `ingress_from`
+Terraform sub block.
+
+
+
+**Args**:
+  - `identities` (`list`): A list of identities that are allowed access through this ingress policy.
+Should be in the format of email address. The email address should represent
+individual user or service account only. When `null`, the `identities` field will be omitted from the resulting object.
+  - `identity_type` (`string`): Specifies the type of identities that are allowed access from outside the
+perimeter. If left unspecified, then members of 'identities' field will be
+allowed access. Possible values: ["ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.
+  - `sources` (`list[obj]`): Sources that this 'IngressPolicy' authorizes access from. When `null`, the `sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_ingress_policy.ingress_from.sources.new](#fn-ingress_fromsourcesnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `ingress_from` sub block.
+
+
+## obj ingress_from.sources
+
+
+
+### fn ingress_from.sources.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_service_perimeter_ingress_policy.ingress_from.sources.new` constructs a new object with attributes and blocks configured for the `sources`
+Terraform sub block.
+
+
+
+**Args**:
+  - `access_level` (`string`): An 'AccessLevel' resource name that allow resources within the
+'ServicePerimeters' to be accessed from the internet. 'AccessLevels' listed
+must be in the same policy as this 'ServicePerimeter'. Referencing a nonexistent
+'AccessLevel' will cause an error. If no 'AccessLevel' names are listed,
+resources within the perimeter can only be accessed via Google Cloud calls
+with request origins within the perimeter.
+Example 'accessPolicies/MY_POLICY/accessLevels/MY_LEVEL.'
+If * is specified, then all IngressSources will be allowed. When `null`, the `access_level` field will be omitted from the resulting object.
+  - `resource` (`string`): A Google Cloud resource that is allowed to ingress the perimeter.
+Requests from these resources will be allowed to access perimeter data.
+Currently only projects are allowed. Format 'projects/{project_number}'
+The project may be in any Google Cloud organization, not just the
+organization that the perimeter is defined in. '*' is not allowed, the case
+of allowing all Google Cloud resources only is not supported. When `null`, the `resource` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `sources` sub block.
+
+
+## obj ingress_to
+
+
+
+### fn ingress_to.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_service_perimeter_ingress_policy.ingress_to.new` constructs a new object with attributes and blocks configured for the `ingress_to`
+Terraform sub block.
+
+
+
+**Args**:
+  - `resources` (`list`): A list of resources, currently only projects in the form
+'projects/<projectnumber>', protected by this 'ServicePerimeter'
+that are allowed to be accessed by sources defined in the
+corresponding 'IngressFrom'. A request matches if it contains
+a resource in this list. If '*' is specified for resources,
+then this 'IngressTo' rule will authorize access to all
+resources inside the perimeter, provided that the request
+also matches the 'operations' field. When `null`, the `resources` field will be omitted from the resulting object.
+  - `operations` (`list[obj]`): A list of 'ApiOperations' the sources specified in corresponding 'IngressFrom'
+are allowed to perform in this 'ServicePerimeter'. When `null`, the `operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_ingress_policy.ingress_to.operations.new](#fn-ingress_tooperationsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `ingress_to` sub block.
+
+
+## obj ingress_to.operations
+
+
+
+### fn ingress_to.operations.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_service_perimeter_ingress_policy.ingress_to.operations.new` constructs a new object with attributes and blocks configured for the `operations`
+Terraform sub block.
+
+
+
+**Args**:
+  - `service_name` (`string`): The name of the API whose methods or permissions the 'IngressPolicy' or
+'EgressPolicy' want to allow. A single 'ApiOperation' with 'serviceName'
+field set to '*' will allow all methods AND permissions for all services. When `null`, the `service_name` field will be omitted from the resulting object.
+  - `method_selectors` (`list[obj]`): API methods or permissions to allow. Method or permission must belong to
+the service specified by serviceName field. A single 'MethodSelector' entry
+with '*' specified for the method field will allow all methods AND
+permissions for the service specified in 'serviceName'. When `null`, the `method_selectors` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_ingress_policy.ingress_to.operations.method_selectors.new](#fn-ingress_toingress_tomethod_selectorsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `operations` sub block.
+
+
+## obj ingress_to.operations.method_selectors
+
+
+
+### fn ingress_to.operations.method_selectors.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_service_perimeter_ingress_policy.ingress_to.operations.method_selectors.new` constructs a new object with attributes and blocks configured for the `method_selectors`
+Terraform sub block.
+
+
+
+**Args**:
+  - `method` (`string`): Value for method should be a valid method name for the corresponding
+serviceName in 'ApiOperation'. If '*' used as value for 'method', then
+ALL methods and permissions are allowed. When `null`, the `method` field will be omitted from the resulting object.
+  - `permission` (`string`): Value for permission should be a valid Cloud IAM permission for the
+corresponding 'serviceName' in 'ApiOperation'. When `null`, the `permission` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `method_selectors` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_service_perimeter_ingress_policy.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/certificate_manager_certificate_issuance_config.md b/docs/4.x/certificate_manager_certificate_issuance_config.md
new file mode 100644
index 0000000..6b3b7c0
--- /dev/null
+++ b/docs/4.x/certificate_manager_certificate_issuance_config.md
@@ -0,0 +1,396 @@
+---
+permalink: /certificate_manager_certificate_issuance_config/
+---
+
+# certificate_manager_certificate_issuance_config
+
+`certificate_manager_certificate_issuance_config` represents the `google_certificate_manager_certificate_issuance_config` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCertificateAuthorityConfig()`](#fn-withcertificateauthorityconfig)
+* [`fn withCertificateAuthorityConfigMixin()`](#fn-withcertificateauthorityconfigmixin)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withKeyAlgorithm()`](#fn-withkeyalgorithm)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withLifetime()`](#fn-withlifetime)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withRotationWindowPercentage()`](#fn-withrotationwindowpercentage)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj certificate_authority_config`](#obj-certificate_authority_config)
+  * [`fn new()`](#fn-certificate_authority_confignew)
+  * [`obj certificate_authority_config.certificate_authority_service_config`](#obj-certificate_authority_configcertificate_authority_service_config)
+    * [`fn new()`](#fn-certificate_authority_configcertificate_authority_service_confignew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.certificate_manager_certificate_issuance_config.new` injects a new `google_certificate_manager_certificate_issuance_config` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.certificate_manager_certificate_issuance_config.new('some_id')
+
+You can get the reference to the `id` field of the created `google.certificate_manager_certificate_issuance_config` using the reference:
+
+    $._ref.google_certificate_manager_certificate_issuance_config.some_id.get('id')
+
+This is the same as directly entering `"${ google_certificate_manager_certificate_issuance_config.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `description` (`string`): One or more paragraphs of text description of a CertificateIssuanceConfig. When `null`, the `description` field will be omitted from the resulting object.
+  - `key_algorithm` (`string`): Key algorithm to use when generating the private key. Possible values: ["RSA_2048", "ECDSA_P256"]
+  - `labels` (`obj`): 'Set of label tags associated with the CertificateIssuanceConfig resource.
+ An object containing a list of "key": value pairs. Example: { "name": "wrench", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+  - `lifetime` (`string`): Lifetime of issued certificates. A duration in seconds with up to nine fractional digits, ending with 's'.
+Example: "1814400s". Valid values are from 21 days (1814400s) to 30 days (2592000s)
+  - `location` (`string`): The Certificate Manager location. If not specified, "global" is used. When `null`, the `location` field will be omitted from the resulting object.
+  - `name` (`string`): A user-defined name of the certificate issuance config.
+CertificateIssuanceConfig names must be unique globally.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `rotation_window_percentage` (`number`): It specifies the percentage of elapsed time of the certificate lifetime to wait before renewing the certificate.
+Must be a number between 1-99, inclusive.
+You must set the rotation window percentage in relation to the certificate lifetime so that certificate renewal occurs at least 7 days after
+the certificate has been issued and at least 7 days before it expires.
+  - `certificate_authority_config` (`list[obj]`): The CA that issues the workload certificate. It includes the CA address, type, authentication to CA service, etc. When `null`, the `certificate_authority_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.certificate_authority_config.new](#fn-certificate_authority_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.certificate_manager_certificate_issuance_config.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_certificate_issuance_config`
+Terraform resource.
+
+Unlike [google.certificate_manager_certificate_issuance_config.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `description` (`string`): One or more paragraphs of text description of a CertificateIssuanceConfig. When `null`, the `description` field will be omitted from the resulting object.
+  - `key_algorithm` (`string`): Key algorithm to use when generating the private key. Possible values: ["RSA_2048", "ECDSA_P256"]
+  - `labels` (`obj`): 'Set of label tags associated with the CertificateIssuanceConfig resource.
+ An object containing a list of "key": value pairs. Example: { "name": "wrench", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+  - `lifetime` (`string`): Lifetime of issued certificates. A duration in seconds with up to nine fractional digits, ending with 's'.
+Example: "1814400s". Valid values are from 21 days (1814400s) to 30 days (2592000s)
+  - `location` (`string`): The Certificate Manager location. If not specified, "global" is used. When `null`, the `location` field will be omitted from the resulting object.
+  - `name` (`string`): A user-defined name of the certificate issuance config.
+CertificateIssuanceConfig names must be unique globally.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `rotation_window_percentage` (`number`): It specifies the percentage of elapsed time of the certificate lifetime to wait before renewing the certificate.
+Must be a number between 1-99, inclusive.
+You must set the rotation window percentage in relation to the certificate lifetime so that certificate renewal occurs at least 7 days after
+the certificate has been issued and at least 7 days before it expires.
+  - `certificate_authority_config` (`list[obj]`): The CA that issues the workload certificate. It includes the CA address, type, authentication to CA service, etc. When `null`, the `certificate_authority_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.certificate_authority_config.new](#fn-certificate_authority_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_certificate_issuance_config` resource into the root Terraform configuration.
+
+
+### fn withCertificateAuthorityConfig
+
+```ts
+withCertificateAuthorityConfig()
+```
+
+`google.list[obj].withCertificateAuthorityConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the certificate_authority_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withCertificateAuthorityConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `certificate_authority_config` field.
+
+
+### fn withCertificateAuthorityConfigMixin
+
+```ts
+withCertificateAuthorityConfigMixin()
+```
+
+`google.list[obj].withCertificateAuthorityConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the certificate_authority_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withCertificateAuthorityConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `certificate_authority_config` field.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withKeyAlgorithm
+
+```ts
+withKeyAlgorithm()
+```
+
+`google.string.withKeyAlgorithm` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the key_algorithm field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `key_algorithm` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withLifetime
+
+```ts
+withLifetime()
+```
+
+`google.string.withLifetime` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the lifetime field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `lifetime` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withRotationWindowPercentage
+
+```ts
+withRotationWindowPercentage()
+```
+
+`google.number.withRotationWindowPercentage` constructs a mixin object that can be merged into the `number`
+Terraform resource block to set or update the rotation_window_percentage field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`number`): The value to set for the `rotation_window_percentage` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj certificate_authority_config
+
+
+
+### fn certificate_authority_config.new
+
+```ts
+new()
+```
+
+
+`google.certificate_manager_certificate_issuance_config.certificate_authority_config.new` constructs a new object with attributes and blocks configured for the `certificate_authority_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `certificate_authority_service_config` (`list[obj]`): Defines a CertificateAuthorityServiceConfig. When `null`, the `certificate_authority_service_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.certificate_authority_config.certificate_authority_service_config.new](#fn-certificate_authority_configcertificate_authority_service_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `certificate_authority_config` sub block.
+
+
+## obj certificate_authority_config.certificate_authority_service_config
+
+
+
+### fn certificate_authority_config.certificate_authority_service_config.new
+
+```ts
+new()
+```
+
+
+`google.certificate_manager_certificate_issuance_config.certificate_authority_config.certificate_authority_service_config.new` constructs a new object with attributes and blocks configured for the `certificate_authority_service_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `ca_pool` (`string`): A CA pool resource used to issue a certificate.
+The CA pool string has a relative resource path following the form
+"projects/{project}/locations/{location}/caPools/{caPool}".
+
+**Returns**:
+  - An attribute object that represents the `certificate_authority_service_config` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.certificate_manager_certificate_issuance_config.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/data/billing_account.md b/docs/4.x/data/billing_account.md
index 1b2ab73..da10faf 100644
--- a/docs/4.x/data/billing_account.md
+++ b/docs/4.x/data/billing_account.md
@@ -17,6 +17,7 @@ This package contains functions and utilities for setting up the data source usi
 * [`fn newAttrs()`](#fn-newattrs)
 * [`fn withBillingAccount()`](#fn-withbillingaccount)
 * [`fn withDisplayName()`](#fn-withdisplayname)
+* [`fn withLookupProjects()`](#fn-withlookupprojects)
 * [`fn withOpen()`](#fn-withopen)
 
 ## Fields
@@ -50,6 +51,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `dataSrcLabel` (`string`): The name label of the block.
   - `billing_account` (`string`): Set the `billing_account` field on the resulting data source block. When `null`, the `billing_account` field will be omitted from the resulting object.
   - `display_name` (`string`): Set the `display_name` field on the resulting data source block. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `lookup_projects` (`bool`): Set the `lookup_projects` field on the resulting data source block. When `null`, the `lookup_projects` field will be omitted from the resulting object.
   - `open` (`bool`): Set the `open` field on the resulting data source block. When `null`, the `open` field will be omitted from the resulting object.
 
 **Returns**:
@@ -76,6 +78,7 @@ injecting into a complete block.
 **Args**:
   - `billing_account` (`string`): Set the `billing_account` field on the resulting object. When `null`, the `billing_account` field will be omitted from the resulting object.
   - `display_name` (`string`): Set the `display_name` field on the resulting object. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `lookup_projects` (`bool`): Set the `lookup_projects` field on the resulting object. When `null`, the `lookup_projects` field will be omitted from the resulting object.
   - `open` (`bool`): Set the `open` field on the resulting object. When `null`, the `open` field will be omitted from the resulting object.
 
 **Returns**:
@@ -114,6 +117,22 @@ Terraform data source block to set or update the display_name field.
   - `value` (`string`): The value to set for the `display_name` field.
 
 
+### fn withLookupProjects
+
+```ts
+withLookupProjects()
+```
+
+`google.bool.withLookupProjects` constructs a mixin object that can be merged into the `bool`
+Terraform data source block to set or update the lookup_projects field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `lookup_projects` field.
+
+
 ### fn withOpen
 
 ```ts
diff --git a/docs/4.x/data/dataplex_datascan_iam_policy.md b/docs/4.x/data/dataplex_datascan_iam_policy.md
new file mode 100644
index 0000000..e8c88c4
--- /dev/null
+++ b/docs/4.x/data/dataplex_datascan_iam_policy.md
@@ -0,0 +1,130 @@
+---
+permalink: /data/dataplex_datascan_iam_policy/
+---
+
+# data.dataplex_datascan_iam_policy
+
+`dataplex_datascan_iam_policy` represents the `google_dataplex_datascan_iam_policy` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDataScanId()`](#fn-withdatascanid)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withProject()`](#fn-withproject)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.dataplex_datascan_iam_policy.new` injects a new `data_google_dataplex_datascan_iam_policy` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.dataplex_datascan_iam_policy.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.dataplex_datascan_iam_policy` using the reference:
+
+    $._ref.data_google_dataplex_datascan_iam_policy.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_dataplex_datascan_iam_policy.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `data_scan_id` (`string`): Set the `data_scan_id` field on the resulting data source block.
+  - `location` (`string`): Set the `location` field on the resulting data source block. When `null`, the `location` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.dataplex_datascan_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_datascan_iam_policy`
+Terraform data source.
+
+Unlike [google.data.dataplex_datascan_iam_policy.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `data_scan_id` (`string`): Set the `data_scan_id` field on the resulting object.
+  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `dataplex_datascan_iam_policy` data source into the root Terraform configuration.
+
+
+### fn withDataScanId
+
+```ts
+withDataScanId()
+```
+
+`google.string.withDataScanId` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the data_scan_id field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `data_scan_id` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the location field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
diff --git a/docs/4.x/data/index.md b/docs/4.x/data/index.md
index e62bef6..0d0ec44 100644
--- a/docs/4.x/data/index.md
+++ b/docs/4.x/data/index.md
@@ -107,6 +107,7 @@ permalink: /data/
 * [data_catalog_taxonomy_iam_policy](data_catalog_taxonomy_iam_policy.md)
 * [data_fusion_instance_iam_policy](data_fusion_instance_iam_policy.md)
 * [dataplex_asset_iam_policy](dataplex_asset_iam_policy.md)
+* [dataplex_datascan_iam_policy](dataplex_datascan_iam_policy.md)
 * [dataplex_lake_iam_policy](dataplex_lake_iam_policy.md)
 * [dataplex_zone_iam_policy](dataplex_zone_iam_policy.md)
 * [dataproc_autoscaling_policy_iam_policy](dataproc_autoscaling_policy_iam_policy.md)
diff --git a/docs/4.x/data_loss_prevention_deidentify_template.md b/docs/4.x/data_loss_prevention_deidentify_template.md
index 9978c6c..402c7c1 100644
--- a/docs/4.x/data_loss_prevention_deidentify_template.md
+++ b/docs/4.x/data_loss_prevention_deidentify_template.md
@@ -20,6 +20,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withDisplayName()`](#fn-withdisplayname)
 * [`fn withParent()`](#fn-withparent)
+* [`fn withTemplateId()`](#fn-withtemplateid)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`obj deidentify_config`](#obj-deidentify_config)
@@ -46,6 +47,28 @@ This package contains functions and utilities for setting up the resource using
         * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsinfo_typesnew)
       * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformation)
         * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationnew)
+        * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_config)
+          * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_confignew)
+          * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbuckets)
+            * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsnew)
+            * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsmax)
+              * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsmaxnew)
+              * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.date_value`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsmaxdate_value)
+                * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsmaxdate_valuenew)
+              * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.time_value`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsmaxtime_value)
+                * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsmaxtime_valuenew)
+            * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsmin)
+              * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsminnew)
+              * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.date_value`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsmindate_value)
+                * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsmindate_valuenew)
+              * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.time_value`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsmintime_value)
+                * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsmintime_valuenew)
+            * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsreplacement_value)
+              * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsreplacement_valuenew)
+              * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.date_value`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsreplacement_valuedate_value)
+                * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsreplacement_valuedate_valuenew)
+              * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.time_value`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsreplacement_valuetime_value)
+                * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsreplacement_valuetime_valuenew)
         * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.character_mask_config`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationcharacter_mask_config)
           * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationcharacter_mask_confignew)
           * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.character_mask_config.characters_to_ignore`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationcharacter_mask_configcharacters_to_ignore)
@@ -78,6 +101,26 @@ This package contains functions and utilities for setting up the resource using
               * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configcrypto_keyunwrappednew)
           * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.surrogate_info_type`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configsurrogate_info_type)
             * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configsurrogate_info_typenew)
+        * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationdate_shift_config)
+          * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationdate_shift_confignew)
+          * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.context`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationdate_shift_configcontext)
+            * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationdate_shift_configcontextnew)
+          * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationdate_shift_configcrypto_key)
+            * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationdate_shift_configcrypto_keynew)
+            * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.kms_wrapped`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationdate_shift_configcrypto_keykms_wrapped)
+              * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationdate_shift_configcrypto_keykms_wrappednew)
+            * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.transient`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationdate_shift_configcrypto_keytransient)
+              * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationdate_shift_configcrypto_keytransientnew)
+            * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.unwrapped`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationdate_shift_configcrypto_keyunwrapped)
+              * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationdate_shift_configcrypto_keyunwrappednew)
+        * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationfixed_size_bucketing_config)
+          * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationfixed_size_bucketing_confignew)
+          * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.lower_bound`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationfixed_size_bucketing_configlower_bound)
+            * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationfixed_size_bucketing_configlower_boundnew)
+          * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.upper_bound`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationfixed_size_bucketing_configupper_bound)
+            * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationfixed_size_bucketing_configupper_boundnew)
+        * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.redact_config`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationredact_config)
+          * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationredact_confignew)
         * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationreplace_config)
           * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationreplace_confignew)
           * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationreplace_confignew_value)
@@ -90,6 +133,8 @@ This package contains functions and utilities for setting up the resource using
           * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationreplace_dictionary_confignew)
           * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.word_list`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationreplace_dictionary_configword_list)
             * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationreplace_dictionary_configword_listnew)
+        * [`obj deidentify_config.info_type_transformations.transformations.primitive_transformation.time_part_config`](#obj-deidentify_configinfo_type_transformationstransformationsprimitive_transformationtime_part_config)
+          * [`fn new()`](#fn-deidentify_configinfo_type_transformationstransformationsprimitive_transformationtime_part_confignew)
   * [`obj deidentify_config.record_transformations`](#obj-deidentify_configrecord_transformations)
     * [`fn new()`](#fn-deidentify_configrecord_transformationsnew)
     * [`obj deidentify_config.record_transformations.field_transformations`](#obj-deidentify_configrecord_transformationsfield_transformations)
@@ -112,6 +157,114 @@ This package contains functions and utilities for setting up the resource using
                   * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsconditionexpressionsconditionsconditionsvaluetime_valuenew)
       * [`obj deidentify_config.record_transformations.field_transformations.fields`](#obj-deidentify_configrecord_transformationsfield_transformationsfields)
         * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsfieldsnew)
+      * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformations)
+        * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationsnew)
+        * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformations)
+          * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsnew)
+          * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.info_types`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsinfo_types)
+            * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsinfo_typesnew)
+          * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformation)
+            * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationnew)
+            * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_config)
+              * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_confignew)
+              * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbuckets)
+                * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsnew)
+                * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsmax)
+                  * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsmaxnew)
+                  * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.date_value`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsmaxdate_value)
+                    * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsmaxdate_valuenew)
+                  * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.time_value`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsmaxtime_value)
+                    * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsmaxtime_valuenew)
+                * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsmin)
+                  * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsminnew)
+                  * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.date_value`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsmindate_value)
+                    * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsmindate_valuenew)
+                  * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.time_value`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsmintime_value)
+                    * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsmintime_valuenew)
+                * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsreplacement_value)
+                  * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsreplacement_valuenew)
+                  * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.date_value`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsreplacement_valuedate_value)
+                    * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsreplacement_valuedate_valuenew)
+                  * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.time_value`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsreplacement_valuetime_value)
+                    * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsreplacement_valuetime_valuenew)
+            * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.character_mask_config`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcharacter_mask_config)
+              * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcharacter_mask_confignew)
+              * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.character_mask_config.characters_to_ignore`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcharacter_mask_configcharacters_to_ignore)
+                * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcharacter_mask_configcharacters_to_ignorenew)
+            * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_config)
+              * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_confignew)
+              * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.context`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_configcontext)
+                * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_configcontextnew)
+              * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_configcrypto_key)
+                * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_configcrypto_keynew)
+                * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.kms_wrapped`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_configcrypto_keykms_wrapped)
+                  * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_configcrypto_keykms_wrappednew)
+                * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.transient`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_configcrypto_keytransient)
+                  * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_configcrypto_keytransientnew)
+                * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.unwrapped`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_configcrypto_keyunwrapped)
+                  * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_configcrypto_keyunwrappednew)
+              * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.surrogate_info_type`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_configsurrogate_info_type)
+                * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_configsurrogate_info_typenew)
+            * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_hash_config)
+              * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_hash_confignew)
+              * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_hash_configcrypto_key)
+                * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_hash_configcrypto_keynew)
+                * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.kms_wrapped`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_hash_configcrypto_keykms_wrapped)
+                  * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_hash_configcrypto_keykms_wrappednew)
+                * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.transient`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_hash_configcrypto_keytransient)
+                  * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_hash_configcrypto_keytransientnew)
+                * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.unwrapped`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_hash_configcrypto_keyunwrapped)
+                  * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_hash_configcrypto_keyunwrappednew)
+            * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_config)
+              * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_confignew)
+              * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.context`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configcontext)
+                * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configcontextnew)
+              * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configcrypto_key)
+                * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configcrypto_keynew)
+                * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.kms_wrapped`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configcrypto_keykms_wrapped)
+                  * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configcrypto_keykms_wrappednew)
+                * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.transient`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configcrypto_keytransient)
+                  * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configcrypto_keytransientnew)
+                * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.unwrapped`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configcrypto_keyunwrapped)
+                  * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configcrypto_keyunwrappednew)
+              * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.surrogate_info_type`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configsurrogate_info_type)
+                * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configsurrogate_info_typenew)
+            * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationdate_shift_config)
+              * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationdate_shift_confignew)
+              * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.context`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationdate_shift_configcontext)
+                * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationdate_shift_configcontextnew)
+              * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationdate_shift_configcrypto_key)
+                * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationdate_shift_configcrypto_keynew)
+                * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.kms_wrapped`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationdate_shift_configcrypto_keykms_wrapped)
+                  * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationdate_shift_configcrypto_keykms_wrappednew)
+                * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.transient`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationdate_shift_configcrypto_keytransient)
+                  * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationdate_shift_configcrypto_keytransientnew)
+                * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.unwrapped`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationdate_shift_configcrypto_keyunwrapped)
+                  * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationdate_shift_configcrypto_keyunwrappednew)
+            * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationfixed_size_bucketing_config)
+              * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationfixed_size_bucketing_confignew)
+              * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.lower_bound`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationfixed_size_bucketing_configlower_bound)
+                * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationfixed_size_bucketing_configlower_boundnew)
+              * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.upper_bound`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationfixed_size_bucketing_configupper_bound)
+                * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationfixed_size_bucketing_configupper_boundnew)
+            * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.redact_config`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationredact_config)
+              * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationredact_confignew)
+            * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationreplace_config)
+              * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationreplace_confignew)
+              * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new_value`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationreplace_confignew_value)
+                * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationreplace_confignew_valuenew)
+                * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.date_value`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationreplace_confignew_valuedate_value)
+                  * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationreplace_confignew_valuedate_valuenew)
+                * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.time_value`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationreplace_confignew_valuetime_value)
+                  * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationreplace_confignew_valuetime_valuenew)
+            * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationreplace_dictionary_config)
+              * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationreplace_dictionary_confignew)
+              * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.word_list`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationreplace_dictionary_configword_list)
+                * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationreplace_dictionary_configword_listnew)
+            * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_with_info_type_config`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationreplace_with_info_type_config)
+              * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationreplace_with_info_type_confignew)
+            * [`obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.time_part_config`](#obj-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationtime_part_config)
+              * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationtime_part_confignew)
       * [`obj deidentify_config.record_transformations.field_transformations.primitive_transformation`](#obj-deidentify_configrecord_transformationsfield_transformationsprimitive_transformation)
         * [`fn new()`](#fn-deidentify_configrecord_transformationsfield_transformationsprimitive_transformationnew)
         * [`obj deidentify_config.record_transformations.field_transformations.primitive_transformation.bucketing_config`](#obj-deidentify_configrecord_transformationsfield_transformationsprimitive_transformationbucketing_config)
@@ -278,6 +431,9 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 * 'projects/{{project}}/locations/{{location}}'
 * 'organizations/{{organization_id}}'
 * 'organizations/{{organization_id}}/locations/{{location}}'
+  - `template_id` (`string`): The template id can contain uppercase and lowercase letters, numbers, and hyphens;
+that is, it must match the regular expression: [a-zA-Z\d-_]+. The maximum length is
+100 characters. Can be empty to allow the system to generate one. When `null`, the `template_id` field will be omitted from the resulting object.
   - `deidentify_config` (`list[obj]`): Configuration of the deidentify template When `null`, the `deidentify_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.new](#fn-deidentify_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -311,6 +467,9 @@ injecting into a complete block.
 * 'projects/{{project}}/locations/{{location}}'
 * 'organizations/{{organization_id}}'
 * 'organizations/{{organization_id}}/locations/{{location}}'
+  - `template_id` (`string`): The template id can contain uppercase and lowercase letters, numbers, and hyphens;
+that is, it must match the regular expression: [a-zA-Z\d-_]+. The maximum length is
+100 characters. Can be empty to allow the system to generate one. When `null`, the `template_id` field will be omitted from the resulting object.
   - `deidentify_config` (`list[obj]`): Configuration of the deidentify template When `null`, the `deidentify_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.new](#fn-deidentify_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -403,6 +562,22 @@ Terraform resource block to set or update the parent field.
   - `value` (`string`): The value to set for the `parent` field.
 
 
+### fn withTemplateId
+
+```ts
+withTemplateId()
+```
+
+`google.string.withTemplateId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the template_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `template_id` field.
+
+
 ### fn withTimeouts
 
 ```ts
@@ -717,806 +892,2767 @@ Terraform sub block.
 
 **Args**:
   - `replace_with_info_type_config` (`bool`): Replace each matching finding with the name of the info type. When `null`, the `replace_with_info_type_config` field will be omitted from the resulting object.
+  - `bucketing_config` (`list[obj]`): Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH
+This can be used on data of type: number, long, string, timestamp.
+If the provided value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing.
+See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. When `null`, the `bucketing_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsbucketing_confignew) constructor.
   - `character_mask_config` (`list[obj]`): Partially mask a string by replacing a given number of characters with a fixed character.
 Masking can start from the beginning or end of the string. When `null`, the `character_mask_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.character_mask_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationscharacter_mask_confignew) constructor.
   - `crypto_deterministic_config` (`list[obj]`): Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC [https://tools.ietf.org/html/rfc5297](https://tools.ietf.org/html/rfc5297). When `null`, the `crypto_deterministic_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationscrypto_deterministic_confignew) constructor.
   - `crypto_replace_ffx_fpe_config` (`list[obj]`): Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the 'content.reidentify' API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See [https://cloud.google.com/dlp/docs/pseudonymization](https://cloud.google.com/dlp/docs/pseudonymization) to learn more.
 
 Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. When `null`, the `crypto_replace_ffx_fpe_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationscrypto_replace_ffx_fpe_confignew) constructor.
+  - `date_shift_config` (`list[obj]`): Shifts dates by random number of days, with option to be consistent for the same context. When `null`, the `date_shift_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsdate_shift_confignew) constructor.
+  - `fixed_size_bucketing_config` (`list[obj]`): Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies.
+
+The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}. For example, if lower_bound = 10 and upper_bound = 20, all values that are within this bucket will be replaced with "10-20".
+
+This can be used on data of type: double, long.
+
+If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing.
+
+See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. When `null`, the `fixed_size_bucketing_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsfixed_size_bucketing_confignew) constructor.
+  - `redact_config` (`list[obj]`): Redact a given value. For example, if used with an InfoTypeTransformation transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. When `null`, the `redact_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.redact_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsredact_confignew) constructor.
   - `replace_config` (`list[obj]`): Replace each input value with a given value. When `null`, the `replace_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsreplace_confignew) constructor.
   - `replace_dictionary_config` (`list[obj]`): Replace with a value randomly drawn (with replacement) from a dictionary. When `null`, the `replace_dictionary_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsreplace_dictionary_confignew) constructor.
+  - `time_part_config` (`list[obj]`): For use with Date, Timestamp, and TimeOfDay, extract or preserve a portion of the value. When `null`, the `time_part_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.time_part_config.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationstime_part_confignew) constructor.
 
 **Returns**:
   - An attribute object that represents the `primitive_transformation` sub block.
 
 
-## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.character_mask_config
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config
 
 
 
-### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.character_mask_config.new
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.character_mask_config.new` constructs a new object with attributes and blocks configured for the `character_mask_config`
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.new` constructs a new object with attributes and blocks configured for the `bucketing_config`
 Terraform sub block.
 
 
 
 **Args**:
-  - `masking_character` (`string`): Character to use to mask the sensitive values—for example, * for an alphabetic string such as a name, or 0 for a numeric string
-such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to * for
-strings, and 0 for digits. When `null`, the `masking_character` field will be omitted from the resulting object.
-  - `number_to_mask` (`number`): Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally. When `null`, the `number_to_mask` field will be omitted from the resulting object.
-  - `reverse_order` (`bool`): Mask characters in reverse order. For example, if masking_character is 0, number_to_mask is 14, and reverse_order is 'false', then the
-input string '1234-5678-9012-3456' is masked as '00000000000000-3456'. When `null`, the `reverse_order` field will be omitted from the resulting object.
-  - `characters_to_ignore` (`list[obj]`): Characters to skip when doing de-identification of a value. These will be left alone and skipped. When `null`, the `characters_to_ignore` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.character_mask_config.characters_to_ignore.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcharacters_to_ignorenew) constructor.
+  - `buckets` (`list[obj]`): Set of buckets. Ranges must be non-overlapping.
+Bucket is represented as a range, along with replacement values. When `null`, the `buckets` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketsnew) constructor.
 
 **Returns**:
-  - An attribute object that represents the `character_mask_config` sub block.
+  - An attribute object that represents the `bucketing_config` sub block.
 
 
-## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.character_mask_config.characters_to_ignore
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets
 
 
 
-### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.character_mask_config.characters_to_ignore.new
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.character_mask_config.characters_to_ignore.new` constructs a new object with attributes and blocks configured for the `characters_to_ignore`
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.new` constructs a new object with attributes and blocks configured for the `buckets`
 Terraform sub block.
 
 
 
 **Args**:
-  - `characters_to_skip` (`string`): Characters to not transform when masking. When `null`, the `characters_to_skip` field will be omitted from the resulting object.
-  - `common_characters_to_ignore` (`string`): Common characters to not transform when masking. Useful to avoid removing punctuation. Possible values: ["NUMERIC", "ALPHA_UPPER_CASE", "ALPHA_LOWER_CASE", "PUNCTUATION", "WHITESPACE"] When `null`, the `common_characters_to_ignore` field will be omitted from the resulting object.
+  - `max` (`list[obj]`): Upper bound of the range, exclusive; type must match min.
+The 'max' block must only contain one argument. See the 'bucketing_config' block description for more information about choosing a data type. When `null`, the `max` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configmaxnew) constructor.
+  - `min` (`list[obj]`): Lower bound of the range, inclusive. Type should be the same as max if used.
+The 'min' block must only contain one argument. See the 'bucketing_config' block description for more information about choosing a data type. When `null`, the `min` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configminnew) constructor.
+  - `replacement_value` (`list[obj]`): Replacement value for this bucket.
+The 'replacement_value' block must only contain one argument. When `null`, the `replacement_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configreplacement_valuenew) constructor.
 
 **Returns**:
-  - An attribute object that represents the `characters_to_ignore` sub block.
+  - An attribute object that represents the `buckets` sub block.
 
 
-## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max
 
 
 
-### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.new
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.new` constructs a new object with attributes and blocks configured for the `crypto_deterministic_config`
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.new` constructs a new object with attributes and blocks configured for the `max`
 Terraform sub block.
 
 
 
 **Args**:
-  - `context` (`list[obj]`): A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well.
-
-If the context is not set, plaintext would be used as is for encryption. If the context is set but:
-
-1.  there is no record present when transforming a given value or
-2.  the field is not present when transforming a given value,
-
-plaintext would be used as is for encryption.
-
-Note that case (1) is expected when an 'InfoTypeTransformation' is applied to both structured and non-structured 'ContentItem's. When `null`, the `context` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.context.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcontextnew) constructor.
-  - `crypto_key` (`list[obj]`): The key used by the encryption function. When `null`, the `crypto_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcrypto_keynew) constructor.
-  - `surrogate_info_type` (`list[obj]`): The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate}
-
-For example, if the name of custom info type is 'MY\_TOKEN\_INFO\_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY\_TOKEN\_INFO\_TYPE(3):abc'
-
-This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text.
-
-Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text.
-
-In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either
-
-*   reverse a surrogate that does not correspond to an actual identifier
-*   be unable to parse the surrogate and result in an error
-
-Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY\_TOKEN\_TYPE. When `null`, the `surrogate_info_type` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.surrogate_info_type.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationsurrogate_info_typenew) constructor.
+  - `day_of_week_value` (`string`): Represents a day of the week. Possible values: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"] When `null`, the `day_of_week_value` field will be omitted from the resulting object.
+  - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.
+  - `integer_value` (`string`): An integer value (int64 format) When `null`, the `integer_value` field will be omitted from the resulting object.
+  - `string_value` (`string`): A string value. When `null`, the `string_value` field will be omitted from the resulting object.
+  - `timestamp_value` (`string`): A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". When `null`, the `timestamp_value` field will be omitted from the resulting object.
+  - `date_value` (`list[obj]`): Represents a whole or partial calendar date. When `null`, the `date_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.date_value.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsdate_valuenew) constructor.
+  - `time_value` (`list[obj]`): Represents a time of day. When `null`, the `time_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.time_value.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketstime_valuenew) constructor.
 
 **Returns**:
-  - An attribute object that represents the `crypto_deterministic_config` sub block.
+  - An attribute object that represents the `max` sub block.
 
 
-## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.context
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.date_value
 
 
 
-### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.context.new
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.date_value.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.context.new` constructs a new object with attributes and blocks configured for the `context`
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.date_value.new` constructs a new object with attributes and blocks configured for the `date_value`
 Terraform sub block.
 
 
 
 **Args**:
-  - `name` (`string`): Name describing the field. When `null`, the `name` field will be omitted from the resulting object.
+  - `day` (`number`): Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant. When `null`, the `day` field will be omitted from the resulting object.
+  - `month` (`number`): Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day. When `null`, the `month` field will be omitted from the resulting object.
+  - `year` (`number`): Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year. When `null`, the `year` field will be omitted from the resulting object.
 
 **Returns**:
-  - An attribute object that represents the `context` sub block.
+  - An attribute object that represents the `date_value` sub block.
 
 
-## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.time_value
 
 
 
-### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.new
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.time_value.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.new` constructs a new object with attributes and blocks configured for the `crypto_key`
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.time_value.new` constructs a new object with attributes and blocks configured for the `time_value`
 Terraform sub block.
 
 
 
 **Args**:
-  - `kms_wrapped` (`list[obj]`): KMS wrapped key.
-Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt
-For more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key).
-Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). When `null`, the `kms_wrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.kms_wrapped.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_configkms_wrappednew) constructor.
-  - `transient` (`list[obj]`): Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes. When `null`, the `transient` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.transient.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_configtransientnew) constructor.
-  - `unwrapped` (`list[obj]`): Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. When `null`, the `unwrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.unwrapped.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_configunwrappednew) constructor.
+  - `hours` (`number`): Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time. When `null`, the `hours` field will be omitted from the resulting object.
+  - `minutes` (`number`): Minutes of hour of day. Must be from 0 to 59. When `null`, the `minutes` field will be omitted from the resulting object.
+  - `nanos` (`number`): Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999. When `null`, the `nanos` field will be omitted from the resulting object.
+  - `seconds` (`number`): Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds. When `null`, the `seconds` field will be omitted from the resulting object.
 
 **Returns**:
-  - An attribute object that represents the `crypto_key` sub block.
+  - An attribute object that represents the `time_value` sub block.
 
 
-## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.kms_wrapped
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min
 
 
 
-### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.kms_wrapped.new
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.kms_wrapped.new` constructs a new object with attributes and blocks configured for the `kms_wrapped`
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.new` constructs a new object with attributes and blocks configured for the `min`
 Terraform sub block.
 
 
 
 **Args**:
-  - `crypto_key_name` (`string`): The resource name of the KMS CryptoKey to use for unwrapping.
-  - `wrapped_key` (`string`): The wrapped data crypto key.
-
-A base64-encoded string.
+  - `day_of_week_value` (`string`): Represents a day of the week. Possible values: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"] When `null`, the `day_of_week_value` field will be omitted from the resulting object.
+  - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.
+  - `integer_value` (`string`): An integer value (int64 format) When `null`, the `integer_value` field will be omitted from the resulting object.
+  - `string_value` (`string`): A string value. When `null`, the `string_value` field will be omitted from the resulting object.
+  - `timestamp_value` (`string`): A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". When `null`, the `timestamp_value` field will be omitted from the resulting object.
+  - `date_value` (`list[obj]`): Represents a whole or partial calendar date. When `null`, the `date_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.date_value.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsdate_valuenew) constructor.
+  - `time_value` (`list[obj]`): Represents a time of day. When `null`, the `time_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.time_value.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketstime_valuenew) constructor.
 
 **Returns**:
-  - An attribute object that represents the `kms_wrapped` sub block.
+  - An attribute object that represents the `min` sub block.
 
 
-## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.transient
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.date_value
 
 
 
-### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.transient.new
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.date_value.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.transient.new` constructs a new object with attributes and blocks configured for the `transient`
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.date_value.new` constructs a new object with attributes and blocks configured for the `date_value`
 Terraform sub block.
 
 
 
 **Args**:
-  - `name` (`string`): Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate 'TransientCryptoKey' protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).
+  - `day` (`number`): Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant. When `null`, the `day` field will be omitted from the resulting object.
+  - `month` (`number`): Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day. When `null`, the `month` field will be omitted from the resulting object.
+  - `year` (`number`): Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year. When `null`, the `year` field will be omitted from the resulting object.
 
 **Returns**:
-  - An attribute object that represents the `transient` sub block.
+  - An attribute object that represents the `date_value` sub block.
 
 
-## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.unwrapped
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.time_value
 
 
 
-### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.unwrapped.new
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.time_value.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.unwrapped.new` constructs a new object with attributes and blocks configured for the `unwrapped`
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.time_value.new` constructs a new object with attributes and blocks configured for the `time_value`
 Terraform sub block.
 
 
 
 **Args**:
-  - `key` (`string`): A 128/192/256 bit key.
-
-A base64-encoded string.
+  - `hours` (`number`): Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time. When `null`, the `hours` field will be omitted from the resulting object.
+  - `minutes` (`number`): Minutes of hour of day. Must be from 0 to 59. When `null`, the `minutes` field will be omitted from the resulting object.
+  - `nanos` (`number`): Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999. When `null`, the `nanos` field will be omitted from the resulting object.
+  - `seconds` (`number`): Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds. When `null`, the `seconds` field will be omitted from the resulting object.
 
 **Returns**:
-  - An attribute object that represents the `unwrapped` sub block.
+  - An attribute object that represents the `time_value` sub block.
 
 
-## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.surrogate_info_type
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value
 
 
 
-### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.surrogate_info_type.new
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.surrogate_info_type.new` constructs a new object with attributes and blocks configured for the `surrogate_info_type`
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.new` constructs a new object with attributes and blocks configured for the `replacement_value`
 Terraform sub block.
 
 
 
 **Args**:
-  - `name` (`string`): Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at [https://cloud.google.com/dlp/docs/infotypes-reference](https://cloud.google.com/dlp/docs/infotypes-reference) when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern '[A-Za-z0-9$-_]{1,64}'. When `null`, the `name` field will be omitted from the resulting object.
-  - `version` (`string`): Optional version name for this InfoType. When `null`, the `version` field will be omitted from the resulting object.
+  - `day_of_week_value` (`string`): Represents a day of the week. Possible values: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"] When `null`, the `day_of_week_value` field will be omitted from the resulting object.
+  - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.
+  - `integer_value` (`string`): An integer value (int64 format) When `null`, the `integer_value` field will be omitted from the resulting object.
+  - `string_value` (`string`): A string value. When `null`, the `string_value` field will be omitted from the resulting object.
+  - `timestamp_value` (`string`): A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". When `null`, the `timestamp_value` field will be omitted from the resulting object.
+  - `date_value` (`list[obj]`): Represents a whole or partial calendar date. When `null`, the `date_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.date_value.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsdate_valuenew) constructor.
+  - `time_value` (`list[obj]`): Represents a time of day. When `null`, the `time_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.time_value.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketstime_valuenew) constructor.
 
 **Returns**:
-  - An attribute object that represents the `surrogate_info_type` sub block.
+  - An attribute object that represents the `replacement_value` sub block.
 
 
-## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.date_value
 
 
 
-### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.new
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.date_value.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.new` constructs a new object with attributes and blocks configured for the `crypto_replace_ffx_fpe_config`
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.date_value.new` constructs a new object with attributes and blocks configured for the `date_value`
 Terraform sub block.
 
 
 
 **Args**:
-  - `common_alphabet` (`string`): Common alphabets. Possible values: ["FFX_COMMON_NATIVE_ALPHABET_UNSPECIFIED", "NUMERIC", "HEXADECIMAL", "UPPER_CASE_ALPHA_NUMERIC", "ALPHA_NUMERIC"] When `null`, the `common_alphabet` field will be omitted from the resulting object.
-  - `custom_alphabet` (`string`): This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range \[2, 95\]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is:
-
-''0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~'!@#$%^&*()_-+={[}]|:;"'<,>.?/'' When `null`, the `custom_alphabet` field will be omitted from the resulting object.
-  - `radix` (`number`): The native way to select the alphabet. Must be in the range \[2, 95\]. When `null`, the `radix` field will be omitted from the resulting object.
-  - `context` (`list[obj]`): The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used.
-
-If the context is set but:
-
-1.  there is no record present when transforming a given value or
-2.  the field is not present when transforming a given value,
-
-a default tweak will be used.
-
-Note that case (1) is expected when an 'InfoTypeTransformation' is applied to both structured and non-structured 'ContentItem's. Currently, the referenced field may be of value type integer or string.
-
-The tweak is constructed as a sequence of bytes in big endian byte order such that:
-
-*   a 64 bit integer is encoded followed by a single byte of value 1
-*   a string is encoded in UTF-8 format followed by a single byte of value 2 When `null`, the `context` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.context.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcontextnew) constructor.
-  - `crypto_key` (`list[obj]`): The key used by the encryption algorithm. When `null`, the `crypto_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcrypto_keynew) constructor.
-  - `surrogate_info_type` (`list[obj]`): The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info\_type\_name(surrogate\_character\_count):surrogate
-
-For example, if the name of custom infoType is 'MY\_TOKEN\_INFO\_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY\_TOKEN\_INFO\_TYPE(3):abc'
-
-This annotation identifies the surrogate when inspecting content using the custom infoType ['SurrogateType'](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text.
-
-In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY\_TOKEN\_TYPE When `null`, the `surrogate_info_type` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.surrogate_info_type.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationsurrogate_info_typenew) constructor.
+  - `day` (`number`): Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant. When `null`, the `day` field will be omitted from the resulting object.
+  - `month` (`number`): Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day. When `null`, the `month` field will be omitted from the resulting object.
+  - `year` (`number`): Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year. When `null`, the `year` field will be omitted from the resulting object.
 
 **Returns**:
-  - An attribute object that represents the `crypto_replace_ffx_fpe_config` sub block.
+  - An attribute object that represents the `date_value` sub block.
 
 
-## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.context
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.time_value
 
 
 
-### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.context.new
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.time_value.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.context.new` constructs a new object with attributes and blocks configured for the `context`
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.time_value.new` constructs a new object with attributes and blocks configured for the `time_value`
 Terraform sub block.
 
 
 
 **Args**:
-  - `name` (`string`): Name describing the field. When `null`, the `name` field will be omitted from the resulting object.
+  - `hours` (`number`): Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time. When `null`, the `hours` field will be omitted from the resulting object.
+  - `minutes` (`number`): Minutes of hour of day. Must be from 0 to 59. When `null`, the `minutes` field will be omitted from the resulting object.
+  - `nanos` (`number`): Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999. When `null`, the `nanos` field will be omitted from the resulting object.
+  - `seconds` (`number`): Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds. When `null`, the `seconds` field will be omitted from the resulting object.
 
 **Returns**:
-  - An attribute object that represents the `context` sub block.
+  - An attribute object that represents the `time_value` sub block.
 
 
-## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.character_mask_config
 
 
 
-### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.new
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.character_mask_config.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.new` constructs a new object with attributes and blocks configured for the `crypto_key`
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.character_mask_config.new` constructs a new object with attributes and blocks configured for the `character_mask_config`
 Terraform sub block.
 
 
 
 **Args**:
-  - `kms_wrapped` (`list[obj]`): KMS wrapped key.
-Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt
-For more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key).
-Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). When `null`, the `kms_wrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.kms_wrapped.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configkms_wrappednew) constructor.
-  - `transient` (`list[obj]`): Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes. When `null`, the `transient` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.transient.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configtransientnew) constructor.
-  - `unwrapped` (`list[obj]`): Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. When `null`, the `unwrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.unwrapped.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configunwrappednew) constructor.
+  - `masking_character` (`string`): Character to use to mask the sensitive values—for example, * for an alphabetic string such as a name, or 0 for a numeric string
+such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to * for
+strings, and 0 for digits. When `null`, the `masking_character` field will be omitted from the resulting object.
+  - `number_to_mask` (`number`): Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally. When `null`, the `number_to_mask` field will be omitted from the resulting object.
+  - `reverse_order` (`bool`): Mask characters in reverse order. For example, if masking_character is 0, number_to_mask is 14, and reverse_order is 'false', then the
+input string '1234-5678-9012-3456' is masked as '00000000000000-3456'. When `null`, the `reverse_order` field will be omitted from the resulting object.
+  - `characters_to_ignore` (`list[obj]`): Characters to skip when doing de-identification of a value. These will be left alone and skipped. When `null`, the `characters_to_ignore` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.character_mask_config.characters_to_ignore.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcharacters_to_ignorenew) constructor.
 
 **Returns**:
-  - An attribute object that represents the `crypto_key` sub block.
+  - An attribute object that represents the `character_mask_config` sub block.
 
 
-## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.kms_wrapped
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.character_mask_config.characters_to_ignore
 
 
 
-### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.kms_wrapped.new
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.character_mask_config.characters_to_ignore.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.kms_wrapped.new` constructs a new object with attributes and blocks configured for the `kms_wrapped`
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.character_mask_config.characters_to_ignore.new` constructs a new object with attributes and blocks configured for the `characters_to_ignore`
 Terraform sub block.
 
 
 
 **Args**:
-  - `crypto_key_name` (`string`): The resource name of the KMS CryptoKey to use for unwrapping.
-  - `wrapped_key` (`string`): The wrapped data crypto key.
-
-A base64-encoded string.
+  - `characters_to_skip` (`string`): Characters to not transform when masking. When `null`, the `characters_to_skip` field will be omitted from the resulting object.
+  - `common_characters_to_ignore` (`string`): Common characters to not transform when masking. Useful to avoid removing punctuation. Possible values: ["NUMERIC", "ALPHA_UPPER_CASE", "ALPHA_LOWER_CASE", "PUNCTUATION", "WHITESPACE"] When `null`, the `common_characters_to_ignore` field will be omitted from the resulting object.
 
 **Returns**:
-  - An attribute object that represents the `kms_wrapped` sub block.
+  - An attribute object that represents the `characters_to_ignore` sub block.
 
 
-## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.transient
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config
 
 
 
-### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.transient.new
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.transient.new` constructs a new object with attributes and blocks configured for the `transient`
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.new` constructs a new object with attributes and blocks configured for the `crypto_deterministic_config`
 Terraform sub block.
 
 
 
 **Args**:
-  - `name` (`string`): Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate 'TransientCryptoKey' protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).
+  - `context` (`list[obj]`): A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well.
 
-**Returns**:
-  - An attribute object that represents the `transient` sub block.
+If the context is not set, plaintext would be used as is for encryption. If the context is set but:
 
+1.  there is no record present when transforming a given value or
+2.  the field is not present when transforming a given value,
 
-## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.unwrapped
+plaintext would be used as is for encryption.
 
+Note that case (1) is expected when an 'InfoTypeTransformation' is applied to both structured and non-structured 'ContentItem's. When `null`, the `context` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.context.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcontextnew) constructor.
+  - `crypto_key` (`list[obj]`): The key used by the encryption function. When `null`, the `crypto_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcrypto_keynew) constructor.
+  - `surrogate_info_type` (`list[obj]`): The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate}
 
+For example, if the name of custom info type is 'MY\_TOKEN\_INFO\_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY\_TOKEN\_INFO\_TYPE(3):abc'
 
-### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.unwrapped.new
+This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text.
+
+Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text.
+
+In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either
+
+*   reverse a surrogate that does not correspond to an actual identifier
+*   be unable to parse the surrogate and result in an error
+
+Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY\_TOKEN\_TYPE. When `null`, the `surrogate_info_type` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.surrogate_info_type.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationsurrogate_info_typenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `crypto_deterministic_config` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.context
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.context.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.context.new` constructs a new object with attributes and blocks configured for the `context`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name` (`string`): Name describing the field. When `null`, the `name` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `context` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.new` constructs a new object with attributes and blocks configured for the `crypto_key`
+Terraform sub block.
+
+
+
+**Args**:
+  - `kms_wrapped` (`list[obj]`): KMS wrapped key.
+Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt
+For more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key).
+Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). When `null`, the `kms_wrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.kms_wrapped.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_configkms_wrappednew) constructor.
+  - `transient` (`list[obj]`): Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes. When `null`, the `transient` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.transient.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_configtransientnew) constructor.
+  - `unwrapped` (`list[obj]`): Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. When `null`, the `unwrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.unwrapped.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_configunwrappednew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `crypto_key` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.kms_wrapped
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.kms_wrapped.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.kms_wrapped.new` constructs a new object with attributes and blocks configured for the `kms_wrapped`
+Terraform sub block.
+
+
+
+**Args**:
+  - `crypto_key_name` (`string`): The resource name of the KMS CryptoKey to use for unwrapping.
+  - `wrapped_key` (`string`): The wrapped data crypto key.
+
+A base64-encoded string.
+
+**Returns**:
+  - An attribute object that represents the `kms_wrapped` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.transient
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.transient.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.transient.new` constructs a new object with attributes and blocks configured for the `transient`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name` (`string`): Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate 'TransientCryptoKey' protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).
+
+**Returns**:
+  - An attribute object that represents the `transient` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.unwrapped
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.unwrapped.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.unwrapped.new` constructs a new object with attributes and blocks configured for the `unwrapped`
+Terraform sub block.
+
+
+
+**Args**:
+  - `key` (`string`): A 128/192/256 bit key.
+
+A base64-encoded string.
+
+**Returns**:
+  - An attribute object that represents the `unwrapped` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.surrogate_info_type
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.surrogate_info_type.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.surrogate_info_type.new` constructs a new object with attributes and blocks configured for the `surrogate_info_type`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name` (`string`): Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at [https://cloud.google.com/dlp/docs/infotypes-reference](https://cloud.google.com/dlp/docs/infotypes-reference) when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern '[A-Za-z0-9$-_]{1,64}'. When `null`, the `name` field will be omitted from the resulting object.
+  - `version` (`string`): Optional version name for this InfoType. When `null`, the `version` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `surrogate_info_type` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.new` constructs a new object with attributes and blocks configured for the `crypto_replace_ffx_fpe_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `common_alphabet` (`string`): Common alphabets. Possible values: ["FFX_COMMON_NATIVE_ALPHABET_UNSPECIFIED", "NUMERIC", "HEXADECIMAL", "UPPER_CASE_ALPHA_NUMERIC", "ALPHA_NUMERIC"] When `null`, the `common_alphabet` field will be omitted from the resulting object.
+  - `custom_alphabet` (`string`): This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range \[2, 95\]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is:
+
+''0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~'!@#$%^&*()_-+={[}]|:;"'<,>.?/'' When `null`, the `custom_alphabet` field will be omitted from the resulting object.
+  - `radix` (`number`): The native way to select the alphabet. Must be in the range \[2, 95\]. When `null`, the `radix` field will be omitted from the resulting object.
+  - `context` (`list[obj]`): The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used.
+
+If the context is set but:
+
+1.  there is no record present when transforming a given value or
+2.  the field is not present when transforming a given value,
+
+a default tweak will be used.
+
+Note that case (1) is expected when an 'InfoTypeTransformation' is applied to both structured and non-structured 'ContentItem's. Currently, the referenced field may be of value type integer or string.
+
+The tweak is constructed as a sequence of bytes in big endian byte order such that:
+
+*   a 64 bit integer is encoded followed by a single byte of value 1
+*   a string is encoded in UTF-8 format followed by a single byte of value 2 When `null`, the `context` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.context.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcontextnew) constructor.
+  - `crypto_key` (`list[obj]`): The key used by the encryption algorithm. When `null`, the `crypto_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcrypto_keynew) constructor.
+  - `surrogate_info_type` (`list[obj]`): The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info\_type\_name(surrogate\_character\_count):surrogate
+
+For example, if the name of custom infoType is 'MY\_TOKEN\_INFO\_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY\_TOKEN\_INFO\_TYPE(3):abc'
+
+This annotation identifies the surrogate when inspecting content using the custom infoType ['SurrogateType'](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text.
+
+In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY\_TOKEN\_TYPE When `null`, the `surrogate_info_type` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.surrogate_info_type.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationsurrogate_info_typenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `crypto_replace_ffx_fpe_config` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.context
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.context.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.context.new` constructs a new object with attributes and blocks configured for the `context`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name` (`string`): Name describing the field. When `null`, the `name` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `context` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.new` constructs a new object with attributes and blocks configured for the `crypto_key`
+Terraform sub block.
+
+
+
+**Args**:
+  - `kms_wrapped` (`list[obj]`): KMS wrapped key.
+Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt
+For more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key).
+Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). When `null`, the `kms_wrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.kms_wrapped.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configkms_wrappednew) constructor.
+  - `transient` (`list[obj]`): Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes. When `null`, the `transient` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.transient.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configtransientnew) constructor.
+  - `unwrapped` (`list[obj]`): Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. When `null`, the `unwrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.unwrapped.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configunwrappednew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `crypto_key` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.kms_wrapped
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.kms_wrapped.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.kms_wrapped.new` constructs a new object with attributes and blocks configured for the `kms_wrapped`
+Terraform sub block.
+
+
+
+**Args**:
+  - `crypto_key_name` (`string`): The resource name of the KMS CryptoKey to use for unwrapping.
+  - `wrapped_key` (`string`): The wrapped data crypto key.
+
+A base64-encoded string.
+
+**Returns**:
+  - An attribute object that represents the `kms_wrapped` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.transient
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.transient.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.transient.new` constructs a new object with attributes and blocks configured for the `transient`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name` (`string`): Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate 'TransientCryptoKey' protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).
+
+**Returns**:
+  - An attribute object that represents the `transient` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.unwrapped
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.unwrapped.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.unwrapped.new` constructs a new object with attributes and blocks configured for the `unwrapped`
+Terraform sub block.
+
+
+
+**Args**:
+  - `key` (`string`): A 128/192/256 bit key.
+
+A base64-encoded string.
+
+**Returns**:
+  - An attribute object that represents the `unwrapped` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.surrogate_info_type
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.surrogate_info_type.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.surrogate_info_type.new` constructs a new object with attributes and blocks configured for the `surrogate_info_type`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name` (`string`): Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at [https://cloud.google.com/dlp/docs/infotypes-reference](https://cloud.google.com/dlp/docs/infotypes-reference) when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern '[A-Za-z0-9$-_]{1,64}'. When `null`, the `name` field will be omitted from the resulting object.
+  - `version` (`string`): Optional version name for this InfoType. When `null`, the `version` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `surrogate_info_type` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.new` constructs a new object with attributes and blocks configured for the `date_shift_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `lower_bound_days` (`number`): Range of shift in days. Negative means shift to earlier in time.
+  - `upper_bound_days` (`number`): Range of shift in days. Actual shift will be selected at random within this range (inclusive ends).
+Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction.
+  - `context` (`list[obj]`): Points to the field that contains the context, for example, an entity id.
+If set, must also set cryptoKey. If set, shift will be consistent for the given context. When `null`, the `context` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.context.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcontextnew) constructor.
+  - `crypto_key` (`list[obj]`): The key used by the encryption function. When `null`, the `crypto_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationcrypto_keynew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `date_shift_config` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.context
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.context.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.context.new` constructs a new object with attributes and blocks configured for the `context`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name` (`string`): Name describing the field.
+
+**Returns**:
+  - An attribute object that represents the `context` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.new` constructs a new object with attributes and blocks configured for the `crypto_key`
+Terraform sub block.
+
+
+
+**Args**:
+  - `kms_wrapped` (`list[obj]`): KMS wrapped key.
+Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt
+For more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key).
+Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). When `null`, the `kms_wrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.kms_wrapped.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationdate_shift_configkms_wrappednew) constructor.
+  - `transient` (`list[obj]`): Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes. When `null`, the `transient` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.transient.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationdate_shift_configtransientnew) constructor.
+  - `unwrapped` (`list[obj]`): Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. When `null`, the `unwrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.unwrapped.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationdate_shift_configunwrappednew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `crypto_key` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.kms_wrapped
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.kms_wrapped.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.kms_wrapped.new` constructs a new object with attributes and blocks configured for the `kms_wrapped`
+Terraform sub block.
+
+
+
+**Args**:
+  - `crypto_key_name` (`string`): The resource name of the KMS CryptoKey to use for unwrapping.
+  - `wrapped_key` (`string`): The wrapped data crypto key.
+A base64-encoded string.
+
+**Returns**:
+  - An attribute object that represents the `kms_wrapped` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.transient
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.transient.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.transient.new` constructs a new object with attributes and blocks configured for the `transient`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name` (`string`): Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate 'TransientCryptoKey' protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).
+
+**Returns**:
+  - An attribute object that represents the `transient` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.unwrapped
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.unwrapped.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.unwrapped.new` constructs a new object with attributes and blocks configured for the `unwrapped`
+Terraform sub block.
+
+
+
+**Args**:
+  - `key` (`string`): A 128/192/256 bit key.
+A base64-encoded string.
+
+**Returns**:
+  - An attribute object that represents the `unwrapped` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.new` constructs a new object with attributes and blocks configured for the `fixed_size_bucketing_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `bucket_size` (`number`): Size of each bucket (except for minimum and maximum buckets).
+So if lower_bound = 10, upper_bound = 89, and bucketSize = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+.
+Precision up to 2 decimals works.
+  - `lower_bound` (`list[obj]`): Lower bound value of buckets.
+All values less than lower_bound are grouped together into a single bucket; for example if lower_bound = 10, then all values less than 10 are replaced with the value "-10".
+The 'lower_bound' block must only contain one argument. See the 'fixed_size_bucketing_config' block description for more information about choosing a data type. When `null`, the `lower_bound` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.lower_bound.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationlower_boundnew) constructor.
+  - `upper_bound` (`list[obj]`): Upper bound value of buckets.
+All values greater than upper_bound are grouped together into a single bucket; for example if upper_bound = 89, then all values greater than 89 are replaced with the value "89+".
+The 'upper_bound' block must only contain one argument. See the 'fixed_size_bucketing_config' block description for more information about choosing a data type. When `null`, the `upper_bound` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.upper_bound.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationupper_boundnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `fixed_size_bucketing_config` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.lower_bound
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.lower_bound.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.lower_bound.new` constructs a new object with attributes and blocks configured for the `lower_bound`
+Terraform sub block.
+
+
+
+**Args**:
+  - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.
+  - `integer_value` (`string`): An integer value (int64 format) When `null`, the `integer_value` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `lower_bound` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.upper_bound
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.upper_bound.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.upper_bound.new` constructs a new object with attributes and blocks configured for the `upper_bound`
+Terraform sub block.
+
+
+
+**Args**:
+  - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.
+  - `integer_value` (`string`): An integer value (int64 format) When `null`, the `integer_value` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `upper_bound` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.redact_config
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.redact_config.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.redact_config.new` constructs a new object with attributes and blocks configured for the `redact_config`
+Terraform sub block.
+
+
+
+**Returns**:
+  - An attribute object that represents the `redact_config` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new` constructs a new object with attributes and blocks configured for the `replace_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `new_value` (`list[obj]`): Replace each input value with a given value.
+The 'new_value' block must only contain one argument. For example when replacing the contents of a string-type field, only 'string_value' should be set. When `null`, the `new_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationnew_valuenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `replace_config` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.new` constructs a new object with attributes and blocks configured for the `new_value`
+Terraform sub block.
+
+
+
+**Args**:
+  - `boolean_value` (`bool`): A boolean value. When `null`, the `boolean_value` field will be omitted from the resulting object.
+  - `day_of_week_value` (`string`): Represents a day of the week. Possible values: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"] When `null`, the `day_of_week_value` field will be omitted from the resulting object.
+  - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.
+  - `integer_value` (`number`): An integer value. When `null`, the `integer_value` field will be omitted from the resulting object.
+  - `string_value` (`string`): A string value. When `null`, the `string_value` field will be omitted from the resulting object.
+  - `timestamp_value` (`string`): A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
+Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". When `null`, the `timestamp_value` field will be omitted from the resulting object.
+  - `date_value` (`list[obj]`): Represents a whole or partial calendar date. When `null`, the `date_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.date_value.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationreplace_configdate_valuenew) constructor.
+  - `time_value` (`list[obj]`): Represents a time of day. When `null`, the `time_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.time_value.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationreplace_configtime_valuenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `new_value` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.date_value
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.date_value.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.date_value.new` constructs a new object with attributes and blocks configured for the `date_value`
+Terraform sub block.
+
+
+
+**Args**:
+  - `day` (`number`): Day of month. Must be from 1 to 31 and valid for the year and month, or 0 if specifying a
+year by itself or a year and month where the day is not significant. When `null`, the `day` field will be omitted from the resulting object.
+  - `month` (`number`): Month of year. Must be from 1 to 12, or 0 if specifying a year without a month and day. When `null`, the `month` field will be omitted from the resulting object.
+  - `year` (`number`): Year of date. Must be from 1 to 9999, or 0 if specifying a date without a year. When `null`, the `year` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `date_value` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.time_value
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.time_value.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.time_value.new` constructs a new object with attributes and blocks configured for the `time_value`
+Terraform sub block.
+
+
+
+**Args**:
+  - `hours` (`number`): Hours of day in 24 hour format. Should be from 0 to 23. When `null`, the `hours` field will be omitted from the resulting object.
+  - `minutes` (`number`): Minutes of hour of day. Must be from 0 to 59. When `null`, the `minutes` field will be omitted from the resulting object.
+  - `nanos` (`number`): Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999. When `null`, the `nanos` field will be omitted from the resulting object.
+  - `seconds` (`number`): Seconds of minutes of the time. Must normally be from 0 to 59. When `null`, the `seconds` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `time_value` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.new` constructs a new object with attributes and blocks configured for the `replace_dictionary_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `word_list` (`list[obj]`): A list of words to select from for random replacement. The [limits](https://cloud.google.com/dlp/limits) page contains details about the size limits of dictionaries. When `null`, the `word_list` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.word_list.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationword_listnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `replace_dictionary_config` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.word_list
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.word_list.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.word_list.new` constructs a new object with attributes and blocks configured for the `word_list`
+Terraform sub block.
+
+
+
+**Args**:
+  - `words` (`list`): Words or phrases defining the dictionary. The dictionary must contain at least one phrase and every phrase must contain at least 2 characters that are letters or digits.
+
+**Returns**:
+  - An attribute object that represents the `word_list` sub block.
+
+
+## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.time_part_config
+
+
+
+### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.time_part_config.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.time_part_config.new` constructs a new object with attributes and blocks configured for the `time_part_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `part_to_extract` (`string`): The part of the time to keep. Possible values: ["YEAR", "MONTH", "DAY_OF_MONTH", "DAY_OF_WEEK", "WEEK_OF_YEAR", "HOUR_OF_DAY"] When `null`, the `part_to_extract` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `time_part_config` sub block.
+
+
+## obj deidentify_config.record_transformations
+
+
+
+### fn deidentify_config.record_transformations.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.new` constructs a new object with attributes and blocks configured for the `record_transformations`
+Terraform sub block.
+
+
+
+**Args**:
+  - `field_transformations` (`list[obj]`): Transform the record by applying various field transformations. When `null`, the `field_transformations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.new](#fn-deidentify_configdeidentify_configfield_transformationsnew) constructor.
+  - `record_suppressions` (`list[obj]`): Configuration defining which records get suppressed entirely. Records that match any suppression rule are omitted from the output. When `null`, the `record_suppressions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.record_suppressions.new](#fn-deidentify_configdeidentify_configrecord_suppressionsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `record_transformations` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.new` constructs a new object with attributes and blocks configured for the `field_transformations`
+Terraform sub block.
+
+
+
+**Args**:
+  - `condition` (`list[obj]`): Only apply the transformation if the condition evaluates to true for the given RecordCondition. The conditions are allowed to reference fields that are not used in the actual transformation.
+Example Use Cases:
+- Apply a different bucket transformation to an age column if the zip code column for the same record is within a specific range.
+- Redact a field if the date of birth field is greater than 85. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.new](#fn-deidentify_configdeidentify_configrecord_transformationsconditionnew) constructor.
+  - `fields` (`list[obj]`): Input field(s) to apply the transformation to. When you have columns that reference their position within a list, omit the index from the FieldId.
+FieldId name matching ignores the index. For example, instead of "contact.nums[0].type", use "contact.nums.type". When `null`, the `fields` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.fields.new](#fn-deidentify_configdeidentify_configrecord_transformationsfieldsnew) constructor.
+  - `info_type_transformations` (`list[obj]`): Treat the contents of the field as free text, and selectively transform content that matches an InfoType.
+Only one of 'primitive_transformation' or 'info_type_transformations' must be specified. When `null`, the `info_type_transformations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.new](#fn-deidentify_configdeidentify_configrecord_transformationsinfo_type_transformationsnew) constructor.
+  - `primitive_transformation` (`list[obj]`): Apply the transformation to the entire field.
+The 'primitive_transformation' block must only contain one argument, corresponding to the type of transformation.
+Only one of 'primitive_transformation' or 'info_type_transformations' must be specified. When `null`, the `primitive_transformation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.primitive_transformation.new](#fn-deidentify_configdeidentify_configrecord_transformationsprimitive_transformationnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `field_transformations` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.condition
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.condition.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.new` constructs a new object with attributes and blocks configured for the `condition`
+Terraform sub block.
+
+
+
+**Args**:
+  - `expressions` (`list[obj]`): An expression. When `null`, the `expressions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsexpressionsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `condition` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.condition.expressions
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.condition.expressions.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.new` constructs a new object with attributes and blocks configured for the `expressions`
+Terraform sub block.
+
+
+
+**Args**:
+  - `logical_operator` (`string`): The operator to apply to the result of conditions. Default and currently only supported value is AND Default value: "AND" Possible values: ["AND"] When `null`, the `logical_operator` field will be omitted from the resulting object.
+  - `conditions` (`list[obj]`): Conditions to apply to the expression. When `null`, the `conditions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsconditionconditionsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `expressions` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.condition.expressions.conditions
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.new` constructs a new object with attributes and blocks configured for the `conditions`
+Terraform sub block.
+
+
+
+**Args**:
+  - `conditions` (`list[obj]`): A collection of conditions. When `null`, the `conditions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsconditionexpressionsconditionsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `conditions` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.new` constructs a new object with attributes and blocks configured for the `conditions`
+Terraform sub block.
+
+
+
+**Args**:
+  - `operator` (`string`): Operator used to compare the field or infoType to the value. Possible values: ["EQUAL_TO", "NOT_EQUAL_TO", "GREATER_THAN", "LESS_THAN", "GREATER_THAN_OR_EQUALS", "LESS_THAN_OR_EQUALS", "EXISTS"]
+  - `field` (`list[obj]`): Field within the record this condition is evaluated against. When `null`, the `field` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.field.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsconditionexpressionsconditionsfieldnew) constructor.
+  - `value` (`list[obj]`): Value to compare against.
+The 'value' block must only contain one argument. For example when a condition is evaluated against a string-type field, only 'string_value' should be set.
+This argument is mandatory, except for conditions using the 'EXISTS' operator. When `null`, the `value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsconditionexpressionsconditionsvaluenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `conditions` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.field
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.field.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.field.new` constructs a new object with attributes and blocks configured for the `field`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name` (`string`): Name describing the field. When `null`, the `name` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `field` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.value
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.value.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.value.new` constructs a new object with attributes and blocks configured for the `value`
+Terraform sub block.
+
+
+
+**Args**:
+  - `boolean_value` (`bool`): A boolean value. When `null`, the `boolean_value` field will be omitted from the resulting object.
+  - `day_of_week_value` (`string`): Represents a day of the week. Possible values: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"] When `null`, the `day_of_week_value` field will be omitted from the resulting object.
+  - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.
+  - `integer_value` (`string`): An integer value (int64 format) When `null`, the `integer_value` field will be omitted from the resulting object.
+  - `string_value` (`string`): A string value. When `null`, the `string_value` field will be omitted from the resulting object.
+  - `timestamp_value` (`string`): A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". When `null`, the `timestamp_value` field will be omitted from the resulting object.
+  - `date_value` (`list[obj]`): Represents a whole or partial calendar date. When `null`, the `date_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.value.date_value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsconditionexpressionsconditionsconditionsdate_valuenew) constructor.
+  - `time_value` (`list[obj]`): Represents a time of day. When `null`, the `time_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.value.time_value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsconditionexpressionsconditionsconditionstime_valuenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `value` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.value.date_value
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.value.date_value.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.value.date_value.new` constructs a new object with attributes and blocks configured for the `date_value`
+Terraform sub block.
+
+
+
+**Args**:
+  - `day` (`number`): Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant. When `null`, the `day` field will be omitted from the resulting object.
+  - `month` (`number`): Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day. When `null`, the `month` field will be omitted from the resulting object.
+  - `year` (`number`): Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year. When `null`, the `year` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `date_value` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.value.time_value
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.value.time_value.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.value.time_value.new` constructs a new object with attributes and blocks configured for the `time_value`
+Terraform sub block.
+
+
+
+**Args**:
+  - `hours` (`number`): Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time. When `null`, the `hours` field will be omitted from the resulting object.
+  - `minutes` (`number`): Minutes of hour of day. Must be from 0 to 59. When `null`, the `minutes` field will be omitted from the resulting object.
+  - `nanos` (`number`): Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999. When `null`, the `nanos` field will be omitted from the resulting object.
+  - `seconds` (`number`): Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds. When `null`, the `seconds` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `time_value` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.fields
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.fields.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.fields.new` constructs a new object with attributes and blocks configured for the `fields`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name` (`string`): Name describing the field. When `null`, the `name` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `fields` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.new` constructs a new object with attributes and blocks configured for the `info_type_transformations`
+Terraform sub block.
+
+
+
+**Args**:
+  - `transformations` (`list[obj]`): Transformation for each infoType. Cannot specify more than one for a given infoType. When `null`, the `transformations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationstransformationsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `info_type_transformations` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.new` constructs a new object with attributes and blocks configured for the `transformations`
+Terraform sub block.
+
+
+
+**Args**:
+  - `info_types` (`list[obj]`): InfoTypes to apply the transformation to. Leaving this empty will apply the transformation to apply to
+all findings that correspond to infoTypes that were requested in InspectConfig. When `null`, the `info_types` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.info_types.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationsinfo_typesnew) constructor.
+  - `primitive_transformation` (`list[obj]`): Apply the transformation to the entire field.
+The 'primitive_transformation' block must only contain one argument, corresponding to the type of transformation. When `null`, the `primitive_transformation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationsprimitive_transformationnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `transformations` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.info_types
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.info_types.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.info_types.new` constructs a new object with attributes and blocks configured for the `info_types`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name` (`string`): Name of the information type.
+  - `version` (`string`): Version name for this InfoType. When `null`, the `version` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `info_types` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.new` constructs a new object with attributes and blocks configured for the `primitive_transformation`
+Terraform sub block.
+
+
+
+**Args**:
+  - `bucketing_config` (`list[obj]`): Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH
+This can be used on data of type: number, long, string, timestamp.
+If the provided value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing.
+See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. When `null`, the `bucketing_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsbucketing_confignew) constructor.
+  - `character_mask_config` (`list[obj]`): Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3). When `null`, the `character_mask_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.character_mask_config.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationscharacter_mask_confignew) constructor.
+  - `crypto_deterministic_config` (`list[obj]`): Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC [https://tools.ietf.org/html/rfc5297](https://tools.ietf.org/html/rfc5297). When `null`, the `crypto_deterministic_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationscrypto_deterministic_confignew) constructor.
+  - `crypto_hash_config` (`list[obj]`): Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes.
+Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).
+Currently, only string and integer values can be hashed.
+See https://cloud.google.com/dlp/docs/pseudonymization to learn more. When `null`, the `crypto_hash_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationscrypto_hash_confignew) constructor.
+  - `crypto_replace_ffx_fpe_config` (`list[obj]`): Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the 'content.reidentify' API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See [https://cloud.google.com/dlp/docs/pseudonymization](https://cloud.google.com/dlp/docs/pseudonymization) to learn more.
+
+Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. When `null`, the `crypto_replace_ffx_fpe_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationscrypto_replace_ffx_fpe_confignew) constructor.
+  - `date_shift_config` (`list[obj]`): Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. When `null`, the `date_shift_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsdate_shift_confignew) constructor.
+  - `fixed_size_bucketing_config` (`list[obj]`): Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies.
+
+The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}. For example, if lower_bound = 10 and upper_bound = 20, all values that are within this bucket will be replaced with "10-20".
+
+This can be used on data of type: double, long.
+
+If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing.
+
+See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. When `null`, the `fixed_size_bucketing_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsfixed_size_bucketing_confignew) constructor.
+  - `redact_config` (`list[obj]`): Redact a given value. For example, if used with an InfoTypeTransformation transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. When `null`, the `redact_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.redact_config.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsredact_confignew) constructor.
+  - `replace_config` (`list[obj]`): Replace each input value with a given value. When `null`, the `replace_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsreplace_confignew) constructor.
+  - `replace_dictionary_config` (`list[obj]`): Replace with a value randomly drawn (with replacement) from a dictionary. When `null`, the `replace_dictionary_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsreplace_dictionary_confignew) constructor.
+  - `replace_with_info_type_config` (`list[obj]`): Replace each matching finding with the name of the info type. When `null`, the `replace_with_info_type_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_with_info_type_config.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsreplace_with_info_type_confignew) constructor.
+  - `time_part_config` (`list[obj]`): For use with Date, Timestamp, and TimeOfDay, extract or preserve a portion of the value. When `null`, the `time_part_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.time_part_config.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationstime_part_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `primitive_transformation` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.new` constructs a new object with attributes and blocks configured for the `bucketing_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `buckets` (`list[obj]`): Set of buckets. Ranges must be non-overlapping.
+Bucket is represented as a range, along with replacement values. When `null`, the `buckets` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `bucketing_config` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.new` constructs a new object with attributes and blocks configured for the `buckets`
+Terraform sub block.
+
+
+
+**Args**:
+  - `max` (`list[obj]`): Upper bound of the range, exclusive; type must match min.
+The 'max' block must only contain one argument. See the 'bucketing_config' block description for more information about choosing a data type. When `null`, the `max` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configmaxnew) constructor.
+  - `min` (`list[obj]`): Lower bound of the range, inclusive. Type should be the same as max if used.
+The 'min' block must only contain one argument. See the 'bucketing_config' block description for more information about choosing a data type. When `null`, the `min` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configminnew) constructor.
+  - `replacement_value` (`list[obj]`): Replacement value for this bucket.
+The 'replacement_value' block must only contain one argument. When `null`, the `replacement_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configreplacement_valuenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `buckets` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.new` constructs a new object with attributes and blocks configured for the `max`
+Terraform sub block.
+
+
+
+**Args**:
+  - `day_of_week_value` (`string`): Represents a day of the week. Possible values: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"] When `null`, the `day_of_week_value` field will be omitted from the resulting object.
+  - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.
+  - `integer_value` (`string`): An integer value (int64 format) When `null`, the `integer_value` field will be omitted from the resulting object.
+  - `string_value` (`string`): A string value. When `null`, the `string_value` field will be omitted from the resulting object.
+  - `timestamp_value` (`string`): A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". When `null`, the `timestamp_value` field will be omitted from the resulting object.
+  - `date_value` (`list[obj]`): Represents a whole or partial calendar date. When `null`, the `date_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.date_value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsdate_valuenew) constructor.
+  - `time_value` (`list[obj]`): Represents a time of day. When `null`, the `time_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.time_value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketstime_valuenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `max` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.date_value
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.date_value.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.date_value.new` constructs a new object with attributes and blocks configured for the `date_value`
+Terraform sub block.
+
+
+
+**Args**:
+  - `day` (`number`): Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant. When `null`, the `day` field will be omitted from the resulting object.
+  - `month` (`number`): Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day. When `null`, the `month` field will be omitted from the resulting object.
+  - `year` (`number`): Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year. When `null`, the `year` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `date_value` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.time_value
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.time_value.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.max.time_value.new` constructs a new object with attributes and blocks configured for the `time_value`
+Terraform sub block.
+
+
+
+**Args**:
+  - `hours` (`number`): Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time. When `null`, the `hours` field will be omitted from the resulting object.
+  - `minutes` (`number`): Minutes of hour of day. Must be from 0 to 59. When `null`, the `minutes` field will be omitted from the resulting object.
+  - `nanos` (`number`): Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999. When `null`, the `nanos` field will be omitted from the resulting object.
+  - `seconds` (`number`): Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds. When `null`, the `seconds` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `time_value` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.new` constructs a new object with attributes and blocks configured for the `min`
+Terraform sub block.
+
+
+
+**Args**:
+  - `day_of_week_value` (`string`): Represents a day of the week. Possible values: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"] When `null`, the `day_of_week_value` field will be omitted from the resulting object.
+  - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.
+  - `integer_value` (`string`): An integer value (int64 format) When `null`, the `integer_value` field will be omitted from the resulting object.
+  - `string_value` (`string`): A string value. When `null`, the `string_value` field will be omitted from the resulting object.
+  - `timestamp_value` (`string`): A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". When `null`, the `timestamp_value` field will be omitted from the resulting object.
+  - `date_value` (`list[obj]`): Represents a whole or partial calendar date. When `null`, the `date_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.date_value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsdate_valuenew) constructor.
+  - `time_value` (`list[obj]`): Represents a time of day. When `null`, the `time_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.time_value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketstime_valuenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `min` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.date_value
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.date_value.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.date_value.new` constructs a new object with attributes and blocks configured for the `date_value`
+Terraform sub block.
+
+
+
+**Args**:
+  - `day` (`number`): Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant. When `null`, the `day` field will be omitted from the resulting object.
+  - `month` (`number`): Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day. When `null`, the `month` field will be omitted from the resulting object.
+  - `year` (`number`): Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year. When `null`, the `year` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `date_value` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.time_value
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.time_value.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.min.time_value.new` constructs a new object with attributes and blocks configured for the `time_value`
+Terraform sub block.
+
+
+
+**Args**:
+  - `hours` (`number`): Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time. When `null`, the `hours` field will be omitted from the resulting object.
+  - `minutes` (`number`): Minutes of hour of day. Must be from 0 to 59. When `null`, the `minutes` field will be omitted from the resulting object.
+  - `nanos` (`number`): Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999. When `null`, the `nanos` field will be omitted from the resulting object.
+  - `seconds` (`number`): Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds. When `null`, the `seconds` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `time_value` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.new` constructs a new object with attributes and blocks configured for the `replacement_value`
+Terraform sub block.
+
+
+
+**Args**:
+  - `day_of_week_value` (`string`): Represents a day of the week. Possible values: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"] When `null`, the `day_of_week_value` field will be omitted from the resulting object.
+  - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.
+  - `integer_value` (`string`): An integer value (int64 format) When `null`, the `integer_value` field will be omitted from the resulting object.
+  - `string_value` (`string`): A string value. When `null`, the `string_value` field will be omitted from the resulting object.
+  - `timestamp_value` (`string`): A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". When `null`, the `timestamp_value` field will be omitted from the resulting object.
+  - `date_value` (`list[obj]`): Represents a whole or partial calendar date. When `null`, the `date_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.date_value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketsdate_valuenew) constructor.
+  - `time_value` (`list[obj]`): Represents a time of day. When `null`, the `time_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.time_value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationbucketing_configbucketstime_valuenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `replacement_value` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.date_value
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.date_value.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.date_value.new` constructs a new object with attributes and blocks configured for the `date_value`
+Terraform sub block.
+
+
+
+**Args**:
+  - `day` (`number`): Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant. When `null`, the `day` field will be omitted from the resulting object.
+  - `month` (`number`): Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day. When `null`, the `month` field will be omitted from the resulting object.
+  - `year` (`number`): Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year. When `null`, the `year` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `date_value` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.time_value
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.time_value.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.bucketing_config.buckets.replacement_value.time_value.new` constructs a new object with attributes and blocks configured for the `time_value`
+Terraform sub block.
+
+
+
+**Args**:
+  - `hours` (`number`): Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time. When `null`, the `hours` field will be omitted from the resulting object.
+  - `minutes` (`number`): Minutes of hour of day. Must be from 0 to 59. When `null`, the `minutes` field will be omitted from the resulting object.
+  - `nanos` (`number`): Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999. When `null`, the `nanos` field will be omitted from the resulting object.
+  - `seconds` (`number`): Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds. When `null`, the `seconds` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `time_value` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.character_mask_config
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.character_mask_config.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.character_mask_config.new` constructs a new object with attributes and blocks configured for the `character_mask_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `masking_character` (`string`): Character to use to mask the sensitive values—for example, * for an alphabetic string such as a name, or 0 for a numeric string
+such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to * for
+strings, and 0 for digits. When `null`, the `masking_character` field will be omitted from the resulting object.
+  - `number_to_mask` (`number`): Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.
+If number_to_mask is negative, this denotes inverse masking. Cloud DLP masks all but a number of characters. For example, suppose you have the following values:
+- 'masking_character' is *
+- 'number_to_mask' is -4
+- 'reverse_order' is false
+- 'characters_to_ignore' includes -
+- Input string is 1234-5678-9012-3456
+
+The resulting de-identified string is ****-****-****-3456. Cloud DLP masks all but the last four characters. If reverseOrder is true, all but the first four characters are masked as 1234-****-****-****. When `null`, the `number_to_mask` field will be omitted from the resulting object.
+  - `reverse_order` (`bool`): Mask characters in reverse order. For example, if masking_character is 0, number_to_mask is 14, and reverse_order is 'false', then the
+input string '1234-5678-9012-3456' is masked as '00000000000000-3456'. When `null`, the `reverse_order` field will be omitted from the resulting object.
+  - `characters_to_ignore` (`list[obj]`): Characters to skip when doing de-identification of a value. These will be left alone and skipped. When `null`, the `characters_to_ignore` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.character_mask_config.characters_to_ignore.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcharacters_to_ignorenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `character_mask_config` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.character_mask_config.characters_to_ignore
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.character_mask_config.characters_to_ignore.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.character_mask_config.characters_to_ignore.new` constructs a new object with attributes and blocks configured for the `characters_to_ignore`
+Terraform sub block.
+
+
+
+**Args**:
+  - `characters_to_skip` (`string`): Characters to not transform when masking. Only one of this or 'common_characters_to_ignore' must be specified. When `null`, the `characters_to_skip` field will be omitted from the resulting object.
+  - `common_characters_to_ignore` (`string`): Common characters to not transform when masking. Useful to avoid removing punctuation. Only one of this or 'characters_to_skip' must be specified. Possible values: ["NUMERIC", "ALPHA_UPPER_CASE", "ALPHA_LOWER_CASE", "PUNCTUATION", "WHITESPACE"] When `null`, the `common_characters_to_ignore` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `characters_to_ignore` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.new` constructs a new object with attributes and blocks configured for the `crypto_deterministic_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `context` (`list[obj]`): A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well.
+
+If the context is not set, plaintext would be used as is for encryption. If the context is set but:
+
+1. there is no record present when transforming a given value or
+2. the field is not present when transforming a given value,
+
+plaintext would be used as is for encryption.
+
+Note that case (1) is expected when an InfoTypeTransformation is applied to both structured and unstructured ContentItems. When `null`, the `context` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.context.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcontextnew) constructor.
+  - `crypto_key` (`list[obj]`): The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use. When `null`, the `crypto_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_keynew) constructor.
+  - `surrogate_info_type` (`list[obj]`): The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate}
+
+For example, if the name of custom info type is 'MY\_TOKEN\_INFO\_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY\_TOKEN\_INFO\_TYPE(3):abc'
+
+This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text.
+
+Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text.
+
+In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either
+
+*   reverse a surrogate that does not correspond to an actual identifier
+*   be unable to parse the surrogate and result in an error
+
+Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY\_TOKEN\_TYPE. When `null`, the `surrogate_info_type` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.surrogate_info_type.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationsurrogate_info_typenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `crypto_deterministic_config` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.context
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.context.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.context.new` constructs a new object with attributes and blocks configured for the `context`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name` (`string`): Name describing the field.
+
+**Returns**:
+  - An attribute object that represents the `context` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.new` constructs a new object with attributes and blocks configured for the `crypto_key`
+Terraform sub block.
+
+
+
+**Args**:
+  - `kms_wrapped` (`list[obj]`): KMS wrapped key.
+Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt
+For more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key). Only one of this, 'transient' or 'unwrapped' must be specified.
+Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). When `null`, the `kms_wrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.kms_wrapped.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_configkms_wrappednew) constructor.
+  - `transient` (`list[obj]`): Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes. Only one of this, 'unwrapped' or 'kms_wrapped' must be specified. When `null`, the `transient` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.transient.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_configtransientnew) constructor.
+  - `unwrapped` (`list[obj]`): Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. Only one of this, 'transient' or 'kms_wrapped' must be specified. When `null`, the `unwrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.unwrapped.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_deterministic_configunwrappednew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `crypto_key` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.kms_wrapped
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.kms_wrapped.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.kms_wrapped.new` constructs a new object with attributes and blocks configured for the `kms_wrapped`
+Terraform sub block.
+
+
+
+**Args**:
+  - `crypto_key_name` (`string`): The resource name of the KMS CryptoKey to use for unwrapping.
+  - `wrapped_key` (`string`): The wrapped data crypto key.
+
+A base64-encoded string.
+
+**Returns**:
+  - An attribute object that represents the `kms_wrapped` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.transient
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.transient.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.transient.new` constructs a new object with attributes and blocks configured for the `transient`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name` (`string`): Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate 'TransientCryptoKey' protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).
+
+**Returns**:
+  - An attribute object that represents the `transient` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.unwrapped
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.unwrapped.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.crypto_key.unwrapped.new` constructs a new object with attributes and blocks configured for the `unwrapped`
+Terraform sub block.
+
+
+
+**Args**:
+  - `key` (`string`): A 128/192/256 bit key.
+
+A base64-encoded string.
+
+**Returns**:
+  - An attribute object that represents the `unwrapped` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.surrogate_info_type
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.surrogate_info_type.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_deterministic_config.surrogate_info_type.new` constructs a new object with attributes and blocks configured for the `surrogate_info_type`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name` (`string`): Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at [https://cloud.google.com/dlp/docs/infotypes-reference](https://cloud.google.com/dlp/docs/infotypes-reference) when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern '[A-Za-z0-9$-_]{1,64}'.
+  - `version` (`string`): Optional version name for this InfoType. When `null`, the `version` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `surrogate_info_type` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.new` constructs a new object with attributes and blocks configured for the `crypto_hash_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `crypto_key` (`list[obj]`): The key used by the encryption function. When `null`, the `crypto_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_keynew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `crypto_hash_config` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.new` constructs a new object with attributes and blocks configured for the `crypto_key`
+Terraform sub block.
+
+
+
+**Args**:
+  - `kms_wrapped` (`list[obj]`): KMS wrapped key.
+Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt
+For more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key). Only one of this, 'transient' or 'unwrapped' must be specified.
+Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). When `null`, the `kms_wrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.kms_wrapped.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_hash_configkms_wrappednew) constructor.
+  - `transient` (`list[obj]`): Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes. Only one of this, 'unwrapped' or 'kms_wrapped' must be specified. When `null`, the `transient` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.transient.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_hash_configtransientnew) constructor.
+  - `unwrapped` (`list[obj]`): Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. Only one of this, 'transient' or 'kms_wrapped' must be specified. When `null`, the `unwrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.unwrapped.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_hash_configunwrappednew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `crypto_key` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.kms_wrapped
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.kms_wrapped.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.kms_wrapped.new` constructs a new object with attributes and blocks configured for the `kms_wrapped`
+Terraform sub block.
+
+
+
+**Args**:
+  - `crypto_key_name` (`string`): The resource name of the KMS CryptoKey to use for unwrapping.
+  - `wrapped_key` (`string`): The wrapped data crypto key.
+
+A base64-encoded string.
+
+**Returns**:
+  - An attribute object that represents the `kms_wrapped` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.transient
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.transient.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.transient.new` constructs a new object with attributes and blocks configured for the `transient`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name` (`string`): Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate 'TransientCryptoKey' protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).
+
+**Returns**:
+  - An attribute object that represents the `transient` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.unwrapped
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.unwrapped.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_hash_config.crypto_key.unwrapped.new` constructs a new object with attributes and blocks configured for the `unwrapped`
+Terraform sub block.
+
+
+
+**Args**:
+  - `key` (`string`): A 128/192/256 bit key.
+
+A base64-encoded string.
+
+**Returns**:
+  - An attribute object that represents the `unwrapped` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.new` constructs a new object with attributes and blocks configured for the `crypto_replace_ffx_fpe_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `common_alphabet` (`string`): Common alphabets. Only one of this, 'custom_alphabet' or 'radix' must be specified. Possible values: ["NUMERIC", "HEXADECIMAL", "UPPER_CASE_ALPHA_NUMERIC", "ALPHA_NUMERIC"] When `null`, the `common_alphabet` field will be omitted from the resulting object.
+  - `custom_alphabet` (`string`): This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range \[2, 95\]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is:
+
+''0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~'!@#$%^&*()_-+={[}]|:;"'<,>.?/''. Only one of this, 'common_alphabet' or 'radix' must be specified. When `null`, the `custom_alphabet` field will be omitted from the resulting object.
+  - `radix` (`number`): The native way to select the alphabet. Must be in the range \[2, 95\]. Only one of this, 'custom_alphabet' or 'common_alphabet' must be specified. When `null`, the `radix` field will be omitted from the resulting object.
+  - `context` (`list[obj]`): The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used.
+
+If the context is set but:
+
+1.  there is no record present when transforming a given value or
+2.  the field is not present when transforming a given value,
+
+a default tweak will be used.
+
+Note that case (1) is expected when an 'InfoTypeTransformation' is applied to both structured and non-structured 'ContentItem's. Currently, the referenced field may be of value type integer or string.
+
+The tweak is constructed as a sequence of bytes in big endian byte order such that:
+
+*   a 64 bit integer is encoded followed by a single byte of value 1
+*   a string is encoded in UTF-8 format followed by a single byte of value 2 When `null`, the `context` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.context.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcontextnew) constructor.
+  - `crypto_key` (`list[obj]`): The key used by the encryption algorithm. When `null`, the `crypto_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_keynew) constructor.
+  - `surrogate_info_type` (`list[obj]`): The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info\_type\_name(surrogate\_character\_count):surrogate
+
+For example, if the name of custom infoType is 'MY\_TOKEN\_INFO\_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY\_TOKEN\_INFO\_TYPE(3):abc'
+
+This annotation identifies the surrogate when inspecting content using the custom infoType ['SurrogateType'](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text.
+
+In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY\_TOKEN\_TYPE When `null`, the `surrogate_info_type` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.surrogate_info_type.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationsurrogate_info_typenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `crypto_replace_ffx_fpe_config` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.context
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.context.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.context.new` constructs a new object with attributes and blocks configured for the `context`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name` (`string`): Name describing the field.
+
+**Returns**:
+  - An attribute object that represents the `context` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key
 
-```ts
-new()
-```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.unwrapped.new` constructs a new object with attributes and blocks configured for the `unwrapped`
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.new` constructs a new object with attributes and blocks configured for the `crypto_key`
 Terraform sub block.
 
 
 
 **Args**:
-  - `key` (`string`): A 128/192/256 bit key.
-
-A base64-encoded string.
+  - `kms_wrapped` (`list[obj]`): KMS wrapped key.
+Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt
+For more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key). Only one of this, 'transient' or 'unwrapped' must be specified.
+Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). When `null`, the `kms_wrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.kms_wrapped.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configkms_wrappednew) constructor.
+  - `transient` (`list[obj]`): Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes. Only one of this, 'unwrapped' or 'kms_wrapped' must be specified. When `null`, the `transient` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.transient.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configtransientnew) constructor.
+  - `unwrapped` (`list[obj]`): Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. Only one of this, 'transient' or 'kms_wrapped' must be specified. When `null`, the `unwrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.unwrapped.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_replace_ffx_fpe_configunwrappednew) constructor.
 
 **Returns**:
-  - An attribute object that represents the `unwrapped` sub block.
+  - An attribute object that represents the `crypto_key` sub block.
 
 
-## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.surrogate_info_type
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.kms_wrapped
 
 
 
-### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.surrogate_info_type.new
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.kms_wrapped.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.surrogate_info_type.new` constructs a new object with attributes and blocks configured for the `surrogate_info_type`
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.kms_wrapped.new` constructs a new object with attributes and blocks configured for the `kms_wrapped`
 Terraform sub block.
 
 
 
 **Args**:
-  - `name` (`string`): Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at [https://cloud.google.com/dlp/docs/infotypes-reference](https://cloud.google.com/dlp/docs/infotypes-reference) when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern '[A-Za-z0-9$-_]{1,64}'. When `null`, the `name` field will be omitted from the resulting object.
-  - `version` (`string`): Optional version name for this InfoType. When `null`, the `version` field will be omitted from the resulting object.
+  - `crypto_key_name` (`string`): The resource name of the KMS CryptoKey to use for unwrapping.
+  - `wrapped_key` (`string`): The wrapped data crypto key.
+
+A base64-encoded string.
 
 **Returns**:
-  - An attribute object that represents the `surrogate_info_type` sub block.
+  - An attribute object that represents the `kms_wrapped` sub block.
 
 
-## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.transient
 
 
 
-### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.transient.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new` constructs a new object with attributes and blocks configured for the `replace_config`
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.transient.new` constructs a new object with attributes and blocks configured for the `transient`
 Terraform sub block.
 
 
 
 **Args**:
-  - `new_value` (`list[obj]`): Replace each input value with a given value.
-The 'new_value' block must only contain one argument. For example when replacing the contents of a string-type field, only 'string_value' should be set. When `null`, the `new_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationnew_valuenew) constructor.
+  - `name` (`string`): Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate 'TransientCryptoKey' protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).
 
 **Returns**:
-  - An attribute object that represents the `replace_config` sub block.
+  - An attribute object that represents the `transient` sub block.
 
 
-## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.unwrapped
 
 
 
-### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.new
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.unwrapped.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.new` constructs a new object with attributes and blocks configured for the `new_value`
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.crypto_key.unwrapped.new` constructs a new object with attributes and blocks configured for the `unwrapped`
 Terraform sub block.
 
 
 
 **Args**:
-  - `boolean_value` (`bool`): A boolean value. When `null`, the `boolean_value` field will be omitted from the resulting object.
-  - `day_of_week_value` (`string`): Represents a day of the week. Possible values: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"] When `null`, the `day_of_week_value` field will be omitted from the resulting object.
-  - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.
-  - `integer_value` (`number`): An integer value. When `null`, the `integer_value` field will be omitted from the resulting object.
-  - `string_value` (`string`): A string value. When `null`, the `string_value` field will be omitted from the resulting object.
-  - `timestamp_value` (`string`): A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
-Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". When `null`, the `timestamp_value` field will be omitted from the resulting object.
-  - `date_value` (`list[obj]`): Represents a whole or partial calendar date. When `null`, the `date_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.date_value.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationreplace_configdate_valuenew) constructor.
-  - `time_value` (`list[obj]`): Represents a time of day. When `null`, the `time_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.time_value.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationreplace_configtime_valuenew) constructor.
+  - `key` (`string`): A 128/192/256 bit key.
+
+A base64-encoded string.
 
 **Returns**:
-  - An attribute object that represents the `new_value` sub block.
+  - An attribute object that represents the `unwrapped` sub block.
 
 
-## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.date_value
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.surrogate_info_type
 
 
 
-### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.date_value.new
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.surrogate_info_type.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.date_value.new` constructs a new object with attributes and blocks configured for the `date_value`
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.crypto_replace_ffx_fpe_config.surrogate_info_type.new` constructs a new object with attributes and blocks configured for the `surrogate_info_type`
 Terraform sub block.
 
 
 
 **Args**:
-  - `day` (`number`): Day of month. Must be from 1 to 31 and valid for the year and month, or 0 if specifying a
-year by itself or a year and month where the day is not significant. When `null`, the `day` field will be omitted from the resulting object.
-  - `month` (`number`): Month of year. Must be from 1 to 12, or 0 if specifying a year without a month and day. When `null`, the `month` field will be omitted from the resulting object.
-  - `year` (`number`): Year of date. Must be from 1 to 9999, or 0 if specifying a date without a year. When `null`, the `year` field will be omitted from the resulting object.
+  - `name` (`string`): Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at [https://cloud.google.com/dlp/docs/infotypes-reference](https://cloud.google.com/dlp/docs/infotypes-reference) when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern '[A-Za-z0-9$-_]{1,64}'.
+  - `version` (`string`): Optional version name for this InfoType. When `null`, the `version` field will be omitted from the resulting object.
 
 **Returns**:
-  - An attribute object that represents the `date_value` sub block.
+  - An attribute object that represents the `surrogate_info_type` sub block.
 
 
-## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.time_value
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config
 
 
 
-### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.time_value.new
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.time_value.new` constructs a new object with attributes and blocks configured for the `time_value`
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.new` constructs a new object with attributes and blocks configured for the `date_shift_config`
 Terraform sub block.
 
 
 
 **Args**:
-  - `hours` (`number`): Hours of day in 24 hour format. Should be from 0 to 23. When `null`, the `hours` field will be omitted from the resulting object.
-  - `minutes` (`number`): Minutes of hour of day. Must be from 0 to 59. When `null`, the `minutes` field will be omitted from the resulting object.
-  - `nanos` (`number`): Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999. When `null`, the `nanos` field will be omitted from the resulting object.
-  - `seconds` (`number`): Seconds of minutes of the time. Must normally be from 0 to 59. When `null`, the `seconds` field will be omitted from the resulting object.
+  - `lower_bound_days` (`number`): For example, -5 means shift date to at most 5 days back in the past.
+  - `upper_bound_days` (`number`): Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction.
+
+For example, 3 means shift date to at most 3 days into the future.
+  - `context` (`list[obj]`): Points to the field that contains the context, for example, an entity id.
+If set, must also set cryptoKey. If set, shift will be consistent for the given context. When `null`, the `context` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.context.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcontextnew) constructor.
+  - `crypto_key` (`list[obj]`): Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and cryptoKey. If set, must also set context. Can only be applied to table items. When `null`, the `crypto_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationcrypto_keynew) constructor.
 
 **Returns**:
-  - An attribute object that represents the `time_value` sub block.
+  - An attribute object that represents the `date_shift_config` sub block.
 
 
-## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.context
 
 
 
-### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.new
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.context.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.new` constructs a new object with attributes and blocks configured for the `replace_dictionary_config`
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.context.new` constructs a new object with attributes and blocks configured for the `context`
 Terraform sub block.
 
 
 
 **Args**:
-  - `word_list` (`list[obj]`): A list of words to select from for random replacement. The [limits](https://cloud.google.com/dlp/limits) page contains details about the size limits of dictionaries. When `null`, the `word_list` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.word_list.new](#fn-deidentify_configdeidentify_configinfo_type_transformationstransformationsprimitive_transformationword_listnew) constructor.
+  - `name` (`string`): Name describing the field.
 
 **Returns**:
-  - An attribute object that represents the `replace_dictionary_config` sub block.
+  - An attribute object that represents the `context` sub block.
 
 
-## obj deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.word_list
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key
 
 
 
-### fn deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.word_list.new
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.word_list.new` constructs a new object with attributes and blocks configured for the `word_list`
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.new` constructs a new object with attributes and blocks configured for the `crypto_key`
 Terraform sub block.
 
 
 
 **Args**:
-  - `words` (`list`): Words or phrases defining the dictionary. The dictionary must contain at least one phrase and every phrase must contain at least 2 characters that are letters or digits.
+  - `kms_wrapped` (`list[obj]`): KMS wrapped key.
+Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt
+For more information, see [Creating a wrapped key](https://cloud.google.com/dlp/docs/create-wrapped-key). Only one of this, 'transient' or 'unwrapped' must be specified.
+Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing). When `null`, the `kms_wrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.kms_wrapped.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationdate_shift_configkms_wrappednew) constructor.
+  - `transient` (`list[obj]`): Transient crypto key. Use this to have a random data crypto key generated. It will be discarded after the request finishes. Only one of this, 'unwrapped' or 'kms_wrapped' must be specified. When `null`, the `transient` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.transient.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationdate_shift_configtransientnew) constructor.
+  - `unwrapped` (`list[obj]`): Unwrapped crypto key. Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. Only one of this, 'transient' or 'kms_wrapped' must be specified. When `null`, the `unwrapped` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.unwrapped.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationdate_shift_configunwrappednew) constructor.
 
 **Returns**:
-  - An attribute object that represents the `word_list` sub block.
+  - An attribute object that represents the `crypto_key` sub block.
 
 
-## obj deidentify_config.record_transformations
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.kms_wrapped
 
 
 
-### fn deidentify_config.record_transformations.new
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.kms_wrapped.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.new` constructs a new object with attributes and blocks configured for the `record_transformations`
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.kms_wrapped.new` constructs a new object with attributes and blocks configured for the `kms_wrapped`
 Terraform sub block.
 
 
 
 **Args**:
-  - `field_transformations` (`list[obj]`): Transform the record by applying various field transformations. When `null`, the `field_transformations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.new](#fn-deidentify_configdeidentify_configfield_transformationsnew) constructor.
-  - `record_suppressions` (`list[obj]`): Configuration defining which records get suppressed entirely. Records that match any suppression rule are omitted from the output. When `null`, the `record_suppressions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.record_suppressions.new](#fn-deidentify_configdeidentify_configrecord_suppressionsnew) constructor.
+  - `crypto_key_name` (`string`): The resource name of the KMS CryptoKey to use for unwrapping.
+  - `wrapped_key` (`string`): The wrapped data crypto key.
+
+A base64-encoded string.
 
 **Returns**:
-  - An attribute object that represents the `record_transformations` sub block.
+  - An attribute object that represents the `kms_wrapped` sub block.
 
 
-## obj deidentify_config.record_transformations.field_transformations
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.transient
 
 
 
-### fn deidentify_config.record_transformations.field_transformations.new
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.transient.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.new` constructs a new object with attributes and blocks configured for the `field_transformations`
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.transient.new` constructs a new object with attributes and blocks configured for the `transient`
 Terraform sub block.
 
 
 
 **Args**:
-  - `condition` (`list[obj]`): Only apply the transformation if the condition evaluates to true for the given RecordCondition. The conditions are allowed to reference fields that are not used in the actual transformation.
-Example Use Cases:
-- Apply a different bucket transformation to an age column if the zip code column for the same record is within a specific range.
-- Redact a field if the date of birth field is greater than 85. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.new](#fn-deidentify_configdeidentify_configrecord_transformationsconditionnew) constructor.
-  - `fields` (`list[obj]`): Input field(s) to apply the transformation to. When you have columns that reference their position within a list, omit the index from the FieldId.
-FieldId name matching ignores the index. For example, instead of "contact.nums[0].type", use "contact.nums.type". When `null`, the `fields` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.fields.new](#fn-deidentify_configdeidentify_configrecord_transformationsfieldsnew) constructor.
-  - `primitive_transformation` (`list[obj]`): Apply the transformation to the entire field.
-The 'primitive_transformation' block must only contain one argument, corresponding to the type of transformation. When `null`, the `primitive_transformation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.primitive_transformation.new](#fn-deidentify_configdeidentify_configrecord_transformationsprimitive_transformationnew) constructor.
+  - `name` (`string`): Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate 'TransientCryptoKey' protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).
 
 **Returns**:
-  - An attribute object that represents the `field_transformations` sub block.
+  - An attribute object that represents the `transient` sub block.
 
 
-## obj deidentify_config.record_transformations.field_transformations.condition
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.unwrapped
 
 
 
-### fn deidentify_config.record_transformations.field_transformations.condition.new
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.unwrapped.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.new` constructs a new object with attributes and blocks configured for the `condition`
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.date_shift_config.crypto_key.unwrapped.new` constructs a new object with attributes and blocks configured for the `unwrapped`
 Terraform sub block.
 
 
 
 **Args**:
-  - `expressions` (`list[obj]`): An expression. When `null`, the `expressions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsexpressionsnew) constructor.
+  - `key` (`string`): A 128/192/256 bit key.
+
+A base64-encoded string.
 
 **Returns**:
-  - An attribute object that represents the `condition` sub block.
+  - An attribute object that represents the `unwrapped` sub block.
 
 
-## obj deidentify_config.record_transformations.field_transformations.condition.expressions
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config
 
 
 
-### fn deidentify_config.record_transformations.field_transformations.condition.expressions.new
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.new` constructs a new object with attributes and blocks configured for the `expressions`
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.new` constructs a new object with attributes and blocks configured for the `fixed_size_bucketing_config`
 Terraform sub block.
 
 
 
 **Args**:
-  - `logical_operator` (`string`): The operator to apply to the result of conditions. Default and currently only supported value is AND Default value: "AND" Possible values: ["AND"] When `null`, the `logical_operator` field will be omitted from the resulting object.
-  - `conditions` (`list[obj]`): Conditions to apply to the expression. When `null`, the `conditions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsconditionconditionsnew) constructor.
+  - `bucket_size` (`number`): Size of each bucket (except for minimum and maximum buckets).
+So if lower_bound = 10, upper_bound = 89, and bucketSize = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+.
+Precision up to 2 decimals works.
+  - `lower_bound` (`list[obj]`): Lower bound value of buckets.
+All values less than lower_bound are grouped together into a single bucket; for example if lower_bound = 10, then all values less than 10 are replaced with the value "-10".
+The 'lower_bound' block must only contain one argument. See the 'fixed_size_bucketing_config' block description for more information about choosing a data type. When `null`, the `lower_bound` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.lower_bound.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationlower_boundnew) constructor.
+  - `upper_bound` (`list[obj]`): Upper bound value of buckets.
+All values greater than upper_bound are grouped together into a single bucket; for example if upper_bound = 89, then all values greater than 89 are replaced with the value "89+".
+The 'upper_bound' block must only contain one argument. See the 'fixed_size_bucketing_config' block description for more information about choosing a data type. When `null`, the `upper_bound` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.upper_bound.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationupper_boundnew) constructor.
 
 **Returns**:
-  - An attribute object that represents the `expressions` sub block.
+  - An attribute object that represents the `fixed_size_bucketing_config` sub block.
 
 
-## obj deidentify_config.record_transformations.field_transformations.condition.expressions.conditions
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.lower_bound
 
 
 
-### fn deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.new
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.lower_bound.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.new` constructs a new object with attributes and blocks configured for the `conditions`
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.lower_bound.new` constructs a new object with attributes and blocks configured for the `lower_bound`
 Terraform sub block.
 
 
 
 **Args**:
-  - `conditions` (`list[obj]`): A collection of conditions. When `null`, the `conditions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsconditionexpressionsconditionsnew) constructor.
+  - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.
+  - `integer_value` (`string`): An integer value (int64 format) When `null`, the `integer_value` field will be omitted from the resulting object.
 
 **Returns**:
-  - An attribute object that represents the `conditions` sub block.
+  - An attribute object that represents the `lower_bound` sub block.
 
 
-## obj deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.upper_bound
 
 
 
-### fn deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.new
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.upper_bound.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.new` constructs a new object with attributes and blocks configured for the `conditions`
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.fixed_size_bucketing_config.upper_bound.new` constructs a new object with attributes and blocks configured for the `upper_bound`
 Terraform sub block.
 
 
 
 **Args**:
-  - `operator` (`string`): Operator used to compare the field or infoType to the value. Possible values: ["EQUAL_TO", "NOT_EQUAL_TO", "GREATER_THAN", "LESS_THAN", "GREATER_THAN_OR_EQUALS", "LESS_THAN_OR_EQUALS", "EXISTS"]
-  - `field` (`list[obj]`): Field within the record this condition is evaluated against. When `null`, the `field` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.field.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsconditionexpressionsconditionsfieldnew) constructor.
-  - `value` (`list[obj]`): Value to compare against.
-The 'value' block must only contain one argument. For example when a condition is evaluated against a string-type field, only 'string_value' should be set.
-This argument is mandatory, except for conditions using the 'EXISTS' operator. When `null`, the `value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsconditionexpressionsconditionsvaluenew) constructor.
+  - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.
+  - `integer_value` (`string`): An integer value (int64 format) When `null`, the `integer_value` field will be omitted from the resulting object.
 
 **Returns**:
-  - An attribute object that represents the `conditions` sub block.
+  - An attribute object that represents the `upper_bound` sub block.
 
 
-## obj deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.field
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.redact_config
 
 
 
-### fn deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.field.new
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.redact_config.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.field.new` constructs a new object with attributes and blocks configured for the `field`
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.redact_config.new` constructs a new object with attributes and blocks configured for the `redact_config`
+Terraform sub block.
+
+
+
+**Returns**:
+  - An attribute object that represents the `redact_config` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new` constructs a new object with attributes and blocks configured for the `replace_config`
 Terraform sub block.
 
 
 
 **Args**:
-  - `name` (`string`): Name describing the field. When `null`, the `name` field will be omitted from the resulting object.
+  - `new_value` (`list[obj]`): Replace each input value with a given value.
+The 'new_value' block must only contain one argument. For example when replacing the contents of a string-type field, only 'string_value' should be set. When `null`, the `new_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationnew_valuenew) constructor.
 
 **Returns**:
-  - An attribute object that represents the `field` sub block.
+  - An attribute object that represents the `replace_config` sub block.
 
 
-## obj deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.value
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new_value
 
 
 
-### fn deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.value.new
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.value.new` constructs a new object with attributes and blocks configured for the `value`
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.new` constructs a new object with attributes and blocks configured for the `new_value`
 Terraform sub block.
 
 
@@ -1527,26 +3663,27 @@ Terraform sub block.
   - `float_value` (`number`): A float value. When `null`, the `float_value` field will be omitted from the resulting object.
   - `integer_value` (`string`): An integer value (int64 format) When `null`, the `integer_value` field will be omitted from the resulting object.
   - `string_value` (`string`): A string value. When `null`, the `string_value` field will be omitted from the resulting object.
-  - `timestamp_value` (`string`): A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". When `null`, the `timestamp_value` field will be omitted from the resulting object.
-  - `date_value` (`list[obj]`): Represents a whole or partial calendar date. When `null`, the `date_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.value.date_value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsconditionexpressionsconditionsconditionsdate_valuenew) constructor.
-  - `time_value` (`list[obj]`): Represents a time of day. When `null`, the `time_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.value.time_value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsconditionexpressionsconditionsconditionstime_valuenew) constructor.
+  - `timestamp_value` (`string`): A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
+Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". When `null`, the `timestamp_value` field will be omitted from the resulting object.
+  - `date_value` (`list[obj]`): Represents a whole or partial calendar date. When `null`, the `date_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.date_value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationreplace_configdate_valuenew) constructor.
+  - `time_value` (`list[obj]`): Represents a time of day. When `null`, the `time_value` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.time_value.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationreplace_configtime_valuenew) constructor.
 
 **Returns**:
-  - An attribute object that represents the `value` sub block.
+  - An attribute object that represents the `new_value` sub block.
 
 
-## obj deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.value.date_value
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.date_value
 
 
 
-### fn deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.value.date_value.new
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.date_value.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.value.date_value.new` constructs a new object with attributes and blocks configured for the `date_value`
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.date_value.new` constructs a new object with attributes and blocks configured for the `date_value`
 Terraform sub block.
 
 
@@ -1560,18 +3697,18 @@ Terraform sub block.
   - An attribute object that represents the `date_value` sub block.
 
 
-## obj deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.value.time_value
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.time_value
 
 
 
-### fn deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.value.time_value.new
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.time_value.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.condition.expressions.conditions.conditions.value.time_value.new` constructs a new object with attributes and blocks configured for the `time_value`
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_config.new_value.time_value.new` constructs a new object with attributes and blocks configured for the `time_value`
 Terraform sub block.
 
 
@@ -1586,27 +3723,93 @@ Terraform sub block.
   - An attribute object that represents the `time_value` sub block.
 
 
-## obj deidentify_config.record_transformations.field_transformations.fields
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config
 
 
 
-### fn deidentify_config.record_transformations.field_transformations.fields.new
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.new
 
 ```ts
 new()
 ```
 
 
-`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.fields.new` constructs a new object with attributes and blocks configured for the `fields`
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.new` constructs a new object with attributes and blocks configured for the `replace_dictionary_config`
 Terraform sub block.
 
 
 
 **Args**:
-  - `name` (`string`): Name describing the field. When `null`, the `name` field will be omitted from the resulting object.
+  - `word_list` (`list[obj]`): A list of words to select from for random replacement. The [limits](https://cloud.google.com/dlp/limits) page contains details about the size limits of dictionaries. When `null`, the `word_list` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.word_list.new](#fn-deidentify_configdeidentify_configrecord_transformationsfield_transformationsinfo_type_transformationstransformationsprimitive_transformationword_listnew) constructor.
 
 **Returns**:
-  - An attribute object that represents the `fields` sub block.
+  - An attribute object that represents the `replace_dictionary_config` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.word_list
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.word_list.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_dictionary_config.word_list.new` constructs a new object with attributes and blocks configured for the `word_list`
+Terraform sub block.
+
+
+
+**Args**:
+  - `words` (`list`): Words or phrases defining the dictionary. The dictionary must contain at least one phrase and every phrase must contain at least 2 characters that are letters or digits.
+
+**Returns**:
+  - An attribute object that represents the `word_list` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_with_info_type_config
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_with_info_type_config.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.replace_with_info_type_config.new` constructs a new object with attributes and blocks configured for the `replace_with_info_type_config`
+Terraform sub block.
+
+
+
+**Returns**:
+  - An attribute object that represents the `replace_with_info_type_config` sub block.
+
+
+## obj deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.time_part_config
+
+
+
+### fn deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.time_part_config.new
+
+```ts
+new()
+```
+
+
+`google.data_loss_prevention_deidentify_template.deidentify_config.record_transformations.field_transformations.info_type_transformations.transformations.primitive_transformation.time_part_config.new` constructs a new object with attributes and blocks configured for the `time_part_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `part_to_extract` (`string`): The part of the time to keep. Possible values: ["YEAR", "MONTH", "DAY_OF_MONTH", "DAY_OF_WEEK", "WEEK_OF_YEAR", "HOUR_OF_DAY"]
+
+**Returns**:
+  - An attribute object that represents the `time_part_config` sub block.
 
 
 ## obj deidentify_config.record_transformations.field_transformations.primitive_transformation
diff --git a/docs/4.x/data_loss_prevention_inspect_template.md b/docs/4.x/data_loss_prevention_inspect_template.md
index b98e088..6008c7c 100644
--- a/docs/4.x/data_loss_prevention_inspect_template.md
+++ b/docs/4.x/data_loss_prevention_inspect_template.md
@@ -20,6 +20,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withInspectConfig()`](#fn-withinspectconfig)
 * [`fn withInspectConfigMixin()`](#fn-withinspectconfigmixin)
 * [`fn withParent()`](#fn-withparent)
+* [`fn withTemplateId()`](#fn-withtemplateid)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`obj inspect_config`](#obj-inspect_config)
@@ -122,6 +123,9 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 * 'projects/{{project}}/locations/{{location}}'
 * 'organizations/{{organization_id}}'
 * 'organizations/{{organization_id}}/locations/{{location}}'
+  - `template_id` (`string`): The template id can contain uppercase and lowercase letters, numbers, and hyphens;
+that is, it must match the regular expression: [a-zA-Z\d-_]+. The maximum length is
+100 characters. Can be empty to allow the system to generate one. When `null`, the `template_id` field will be omitted from the resulting object.
   - `inspect_config` (`list[obj]`): The core content of the template. When `null`, the `inspect_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_inspect_template.inspect_config.new](#fn-inspect_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_inspect_template.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -155,6 +159,9 @@ injecting into a complete block.
 * 'projects/{{project}}/locations/{{location}}'
 * 'organizations/{{organization_id}}'
 * 'organizations/{{organization_id}}/locations/{{location}}'
+  - `template_id` (`string`): The template id can contain uppercase and lowercase letters, numbers, and hyphens;
+that is, it must match the regular expression: [a-zA-Z\d-_]+. The maximum length is
+100 characters. Can be empty to allow the system to generate one. When `null`, the `template_id` field will be omitted from the resulting object.
   - `inspect_config` (`list[obj]`): The core content of the template. When `null`, the `inspect_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_inspect_template.inspect_config.new](#fn-inspect_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_inspect_template.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -247,6 +254,22 @@ Terraform resource block to set or update the parent field.
   - `value` (`string`): The value to set for the `parent` field.
 
 
+### fn withTemplateId
+
+```ts
+withTemplateId()
+```
+
+`google.string.withTemplateId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the template_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `template_id` field.
+
+
 ### fn withTimeouts
 
 ```ts
diff --git a/docs/4.x/data_loss_prevention_stored_info_type.md b/docs/4.x/data_loss_prevention_stored_info_type.md
index de2f1c9..4594994 100644
--- a/docs/4.x/data_loss_prevention_stored_info_type.md
+++ b/docs/4.x/data_loss_prevention_stored_info_type.md
@@ -24,6 +24,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withParent()`](#fn-withparent)
 * [`fn withRegex()`](#fn-withregex)
 * [`fn withRegexMixin()`](#fn-withregexmixin)
+* [`fn withStoredInfoTypeId()`](#fn-withstoredinfotypeid)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`obj dictionary`](#obj-dictionary)
@@ -86,6 +87,9 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 * 'projects/{{project}}/locations/{{location}}'
 * 'organizations/{{organization_id}}'
 * 'organizations/{{organization_id}}/locations/{{location}}'
+  - `stored_info_type_id` (`string`): The storedInfoType ID can contain uppercase and lowercase letters, numbers, and hyphens;
+that is, it must match the regular expression: [a-zA-Z\d-_]+. The maximum length is 100
+characters. Can be empty to allow the system to generate one. When `null`, the `stored_info_type_id` field will be omitted from the resulting object.
   - `dictionary` (`list[obj]`): Dictionary which defines the rule. When `null`, the `dictionary` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_stored_info_type.dictionary.new](#fn-dictionarynew) constructor.
   - `large_custom_dictionary` (`list[obj]`): Dictionary which defines the rule. When `null`, the `large_custom_dictionary` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_stored_info_type.large_custom_dictionary.new](#fn-large_custom_dictionarynew) constructor.
   - `regex` (`list[obj]`): Regular expression which defines the rule. When `null`, the `regex` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_stored_info_type.regex.new](#fn-regexnew) constructor.
@@ -121,6 +125,9 @@ injecting into a complete block.
 * 'projects/{{project}}/locations/{{location}}'
 * 'organizations/{{organization_id}}'
 * 'organizations/{{organization_id}}/locations/{{location}}'
+  - `stored_info_type_id` (`string`): The storedInfoType ID can contain uppercase and lowercase letters, numbers, and hyphens;
+that is, it must match the regular expression: [a-zA-Z\d-_]+. The maximum length is 100
+characters. Can be empty to allow the system to generate one. When `null`, the `stored_info_type_id` field will be omitted from the resulting object.
   - `dictionary` (`list[obj]`): Dictionary which defines the rule. When `null`, the `dictionary` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_stored_info_type.dictionary.new](#fn-dictionarynew) constructor.
   - `large_custom_dictionary` (`list[obj]`): Dictionary which defines the rule. When `null`, the `large_custom_dictionary` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_stored_info_type.large_custom_dictionary.new](#fn-large_custom_dictionarynew) constructor.
   - `regex` (`list[obj]`): Regular expression which defines the rule. When `null`, the `regex` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_loss_prevention_stored_info_type.regex.new](#fn-regexnew) constructor.
@@ -289,6 +296,22 @@ function.
   - `value` (`list[obj]`): The value to set for the `regex` field.
 
 
+### fn withStoredInfoTypeId
+
+```ts
+withStoredInfoTypeId()
+```
+
+`google.string.withStoredInfoTypeId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the stored_info_type_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `stored_info_type_id` field.
+
+
 ### fn withTimeouts
 
 ```ts
diff --git a/docs/4.x/dataplex_datascan.md b/docs/4.x/dataplex_datascan.md
new file mode 100644
index 0000000..5d2a13d
--- /dev/null
+++ b/docs/4.x/dataplex_datascan.md
@@ -0,0 +1,840 @@
+---
+permalink: /dataplex_datascan/
+---
+
+# dataplex_datascan
+
+`dataplex_datascan` represents the `google_dataplex_datascan` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withData()`](#fn-withdata)
+* [`fn withDataMixin()`](#fn-withdatamixin)
+* [`fn withDataProfileSpec()`](#fn-withdataprofilespec)
+* [`fn withDataProfileSpecMixin()`](#fn-withdataprofilespecmixin)
+* [`fn withDataQualitySpec()`](#fn-withdataqualityspec)
+* [`fn withDataQualitySpecMixin()`](#fn-withdataqualityspecmixin)
+* [`fn withDataScanId()`](#fn-withdatascanid)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withDisplayName()`](#fn-withdisplayname)
+* [`fn withExecutionSpec()`](#fn-withexecutionspec)
+* [`fn withExecutionSpecMixin()`](#fn-withexecutionspecmixin)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj data`](#obj-data)
+  * [`fn new()`](#fn-datanew)
+* [`obj data_profile_spec`](#obj-data_profile_spec)
+  * [`fn new()`](#fn-data_profile_specnew)
+* [`obj data_quality_spec`](#obj-data_quality_spec)
+  * [`fn new()`](#fn-data_quality_specnew)
+  * [`obj data_quality_spec.rules`](#obj-data_quality_specrules)
+    * [`fn new()`](#fn-data_quality_specrulesnew)
+    * [`obj data_quality_spec.rules.non_null_expectation`](#obj-data_quality_specrulesnon_null_expectation)
+      * [`fn new()`](#fn-data_quality_specrulesnon_null_expectationnew)
+    * [`obj data_quality_spec.rules.range_expectation`](#obj-data_quality_specrulesrange_expectation)
+      * [`fn new()`](#fn-data_quality_specrulesrange_expectationnew)
+    * [`obj data_quality_spec.rules.regex_expectation`](#obj-data_quality_specrulesregex_expectation)
+      * [`fn new()`](#fn-data_quality_specrulesregex_expectationnew)
+    * [`obj data_quality_spec.rules.row_condition_expectation`](#obj-data_quality_specrulesrow_condition_expectation)
+      * [`fn new()`](#fn-data_quality_specrulesrow_condition_expectationnew)
+    * [`obj data_quality_spec.rules.set_expectation`](#obj-data_quality_specrulesset_expectation)
+      * [`fn new()`](#fn-data_quality_specrulesset_expectationnew)
+    * [`obj data_quality_spec.rules.statistic_range_expectation`](#obj-data_quality_specrulesstatistic_range_expectation)
+      * [`fn new()`](#fn-data_quality_specrulesstatistic_range_expectationnew)
+    * [`obj data_quality_spec.rules.table_condition_expectation`](#obj-data_quality_specrulestable_condition_expectation)
+      * [`fn new()`](#fn-data_quality_specrulestable_condition_expectationnew)
+    * [`obj data_quality_spec.rules.uniqueness_expectation`](#obj-data_quality_specrulesuniqueness_expectation)
+      * [`fn new()`](#fn-data_quality_specrulesuniqueness_expectationnew)
+* [`obj execution_spec`](#obj-execution_spec)
+  * [`fn new()`](#fn-execution_specnew)
+  * [`obj execution_spec.trigger`](#obj-execution_spectrigger)
+    * [`fn new()`](#fn-execution_spectriggernew)
+    * [`obj execution_spec.trigger.on_demand`](#obj-execution_spectriggeron_demand)
+      * [`fn new()`](#fn-execution_spectriggeron_demandnew)
+    * [`obj execution_spec.trigger.schedule`](#obj-execution_spectriggerschedule)
+      * [`fn new()`](#fn-execution_spectriggerschedulenew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.dataplex_datascan.new` injects a new `google_dataplex_datascan` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.dataplex_datascan.new('some_id')
+
+You can get the reference to the `id` field of the created `google.dataplex_datascan` using the reference:
+
+    $._ref.google_dataplex_datascan.some_id.get('id')
+
+This is the same as directly entering `"${ google_dataplex_datascan.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `data_scan_id` (`string`): DataScan identifier. Must contain only lowercase letters, numbers and hyphens. Must start with a letter. Must end with a number or a letter.
+  - `description` (`string`): Description of the scan. When `null`, the `description` field will be omitted from the resulting object.
+  - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the scan. A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): The location where the data scan should reside.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `data` (`list[obj]`): The data source for DataScan. When `null`, the `data` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data.new](#fn-datanew) constructor.
+  - `data_profile_spec` (`list[obj]`): DataProfileScan related setting. When `null`, the `data_profile_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_profile_spec.new](#fn-data_profile_specnew) constructor.
+  - `data_quality_spec` (`list[obj]`): DataQualityScan related setting. When `null`, the `data_quality_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.new](#fn-data_quality_specnew) constructor.
+  - `execution_spec` (`list[obj]`): DataScan execution settings. When `null`, the `execution_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.execution_spec.new](#fn-execution_specnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.dataplex_datascan.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_datascan`
+Terraform resource.
+
+Unlike [google.dataplex_datascan.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `data_scan_id` (`string`): DataScan identifier. Must contain only lowercase letters, numbers and hyphens. Must start with a letter. Must end with a number or a letter.
+  - `description` (`string`): Description of the scan. When `null`, the `description` field will be omitted from the resulting object.
+  - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the scan. A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): The location where the data scan should reside.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `data` (`list[obj]`): The data source for DataScan. When `null`, the `data` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data.new](#fn-datanew) constructor.
+  - `data_profile_spec` (`list[obj]`): DataProfileScan related setting. When `null`, the `data_profile_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_profile_spec.new](#fn-data_profile_specnew) constructor.
+  - `data_quality_spec` (`list[obj]`): DataQualityScan related setting. When `null`, the `data_quality_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.new](#fn-data_quality_specnew) constructor.
+  - `execution_spec` (`list[obj]`): DataScan execution settings. When `null`, the `execution_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.execution_spec.new](#fn-execution_specnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_datascan` resource into the root Terraform configuration.
+
+
+### fn withData
+
+```ts
+withData()
+```
+
+`google.list[obj].withData` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the data field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withDataMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `data` field.
+
+
+### fn withDataMixin
+
+```ts
+withDataMixin()
+```
+
+`google.list[obj].withDataMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the data field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withData](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `data` field.
+
+
+### fn withDataProfileSpec
+
+```ts
+withDataProfileSpec()
+```
+
+`google.list[obj].withDataProfileSpec` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the data_profile_spec field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withDataProfileSpecMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `data_profile_spec` field.
+
+
+### fn withDataProfileSpecMixin
+
+```ts
+withDataProfileSpecMixin()
+```
+
+`google.list[obj].withDataProfileSpecMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the data_profile_spec field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withDataProfileSpec](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `data_profile_spec` field.
+
+
+### fn withDataQualitySpec
+
+```ts
+withDataQualitySpec()
+```
+
+`google.list[obj].withDataQualitySpec` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the data_quality_spec field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withDataQualitySpecMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `data_quality_spec` field.
+
+
+### fn withDataQualitySpecMixin
+
+```ts
+withDataQualitySpecMixin()
+```
+
+`google.list[obj].withDataQualitySpecMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the data_quality_spec field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withDataQualitySpec](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `data_quality_spec` field.
+
+
+### fn withDataScanId
+
+```ts
+withDataScanId()
+```
+
+`google.string.withDataScanId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the data_scan_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `data_scan_id` field.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withDisplayName
+
+```ts
+withDisplayName()
+```
+
+`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the display_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `display_name` field.
+
+
+### fn withExecutionSpec
+
+```ts
+withExecutionSpec()
+```
+
+`google.list[obj].withExecutionSpec` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the execution_spec field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withExecutionSpecMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `execution_spec` field.
+
+
+### fn withExecutionSpecMixin
+
+```ts
+withExecutionSpecMixin()
+```
+
+`google.list[obj].withExecutionSpecMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the execution_spec field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withExecutionSpec](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `execution_spec` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj data
+
+
+
+### fn data.new
+
+```ts
+new()
+```
+
+
+`google.dataplex_datascan.data.new` constructs a new object with attributes and blocks configured for the `data`
+Terraform sub block.
+
+
+
+**Args**:
+  - `entity` (`string`): The Dataplex entity that represents the data source(e.g. BigQuery table) for Datascan. When `null`, the `entity` field will be omitted from the resulting object.
+  - `resource` (`string`): The service-qualified full resource name of the cloud resource for a DataScan job to scan against. The field could be:
+(Cloud Storage bucket for DataDiscoveryScan)BigQuery table of type "TABLE" for DataProfileScan/DataQualityScan. When `null`, the `resource` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `data` sub block.
+
+
+## obj data_profile_spec
+
+
+
+### fn data_profile_spec.new
+
+```ts
+new()
+```
+
+
+`google.dataplex_datascan.data_profile_spec.new` constructs a new object with attributes and blocks configured for the `data_profile_spec`
+Terraform sub block.
+
+
+
+**Args**:
+  - `row_filter` (`string`): A filter applied to all rows in a single DataScan job. The filter needs to be a valid SQL expression for a WHERE clause in BigQuery standard SQL syntax. Example: col1 >= 0 AND col2 < 10 When `null`, the `row_filter` field will be omitted from the resulting object.
+  - `sampling_percent` (`number`): The percentage of the records to be selected from the dataset for DataScan. When `null`, the `sampling_percent` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `data_profile_spec` sub block.
+
+
+## obj data_quality_spec
+
+
+
+### fn data_quality_spec.new
+
+```ts
+new()
+```
+
+
+`google.dataplex_datascan.data_quality_spec.new` constructs a new object with attributes and blocks configured for the `data_quality_spec`
+Terraform sub block.
+
+
+
+**Args**:
+  - `row_filter` (`string`): A filter applied to all rows in a single DataScan job. The filter needs to be a valid SQL expression for a WHERE clause in BigQuery standard SQL syntax. Example: col1 >= 0 AND col2 < 10 When `null`, the `row_filter` field will be omitted from the resulting object.
+  - `sampling_percent` (`number`): The percentage of the records to be selected from the dataset for DataScan. When `null`, the `sampling_percent` field will be omitted from the resulting object.
+  - `rules` (`list[obj]`): The list of rules to evaluate against a data source. At least one rule is required. When `null`, the `rules` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.rules.new](#fn-data_quality_specrulesnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `data_quality_spec` sub block.
+
+
+## obj data_quality_spec.rules
+
+
+
+### fn data_quality_spec.rules.new
+
+```ts
+new()
+```
+
+
+`google.dataplex_datascan.data_quality_spec.rules.new` constructs a new object with attributes and blocks configured for the `rules`
+Terraform sub block.
+
+
+
+**Args**:
+  - `column` (`string`): The unnested column which this rule is evaluated against. When `null`, the `column` field will be omitted from the resulting object.
+  - `dimension` (`string`): The dimension a rule belongs to. Results are also aggregated at the dimension level. Supported dimensions are ["COMPLETENESS", "ACCURACY", "CONSISTENCY", "VALIDITY", "UNIQUENESS", "INTEGRITY"]
+  - `ignore_null` (`bool`): Rows with null values will automatically fail a rule, unless ignoreNull is true. In that case, such null rows are trivially considered passing. Only applicable to ColumnMap rules. When `null`, the `ignore_null` field will be omitted from the resulting object.
+  - `threshold` (`number`): The minimum ratio of passing_rows / total_rows required to pass this rule, with a range of [0.0, 1.0]. 0 indicates default value (i.e. 1.0). When `null`, the `threshold` field will be omitted from the resulting object.
+  - `non_null_expectation` (`list[obj]`): ColumnMap rule which evaluates whether each column value is null. When `null`, the `non_null_expectation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.rules.non_null_expectation.new](#fn-data_quality_specdata_quality_specnon_null_expectationnew) constructor.
+  - `range_expectation` (`list[obj]`): ColumnMap rule which evaluates whether each column value lies between a specified range. When `null`, the `range_expectation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.rules.range_expectation.new](#fn-data_quality_specdata_quality_specrange_expectationnew) constructor.
+  - `regex_expectation` (`list[obj]`): ColumnMap rule which evaluates whether each column value matches a specified regex. When `null`, the `regex_expectation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.rules.regex_expectation.new](#fn-data_quality_specdata_quality_specregex_expectationnew) constructor.
+  - `row_condition_expectation` (`list[obj]`): Table rule which evaluates whether each row passes the specified condition. When `null`, the `row_condition_expectation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.rules.row_condition_expectation.new](#fn-data_quality_specdata_quality_specrow_condition_expectationnew) constructor.
+  - `set_expectation` (`list[obj]`): ColumnMap rule which evaluates whether each column value is contained by a specified set. When `null`, the `set_expectation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.rules.set_expectation.new](#fn-data_quality_specdata_quality_specset_expectationnew) constructor.
+  - `statistic_range_expectation` (`list[obj]`): ColumnAggregate rule which evaluates whether the column aggregate statistic lies between a specified range. When `null`, the `statistic_range_expectation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.rules.statistic_range_expectation.new](#fn-data_quality_specdata_quality_specstatistic_range_expectationnew) constructor.
+  - `table_condition_expectation` (`list[obj]`): Table rule which evaluates whether the provided expression is true. When `null`, the `table_condition_expectation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.rules.table_condition_expectation.new](#fn-data_quality_specdata_quality_spectable_condition_expectationnew) constructor.
+  - `uniqueness_expectation` (`list[obj]`): ColumnAggregate rule which evaluates whether the column has duplicates. When `null`, the `uniqueness_expectation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.rules.uniqueness_expectation.new](#fn-data_quality_specdata_quality_specuniqueness_expectationnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `rules` sub block.
+
+
+## obj data_quality_spec.rules.non_null_expectation
+
+
+
+### fn data_quality_spec.rules.non_null_expectation.new
+
+```ts
+new()
+```
+
+
+`google.dataplex_datascan.data_quality_spec.rules.non_null_expectation.new` constructs a new object with attributes and blocks configured for the `non_null_expectation`
+Terraform sub block.
+
+
+
+**Returns**:
+  - An attribute object that represents the `non_null_expectation` sub block.
+
+
+## obj data_quality_spec.rules.range_expectation
+
+
+
+### fn data_quality_spec.rules.range_expectation.new
+
+```ts
+new()
+```
+
+
+`google.dataplex_datascan.data_quality_spec.rules.range_expectation.new` constructs a new object with attributes and blocks configured for the `range_expectation`
+Terraform sub block.
+
+
+
+**Args**:
+  - `max_value` (`string`): The maximum column value allowed for a row to pass this validation. At least one of minValue and maxValue need to be provided. When `null`, the `max_value` field will be omitted from the resulting object.
+  - `min_value` (`string`): The minimum column value allowed for a row to pass this validation. At least one of minValue and maxValue need to be provided. When `null`, the `min_value` field will be omitted from the resulting object.
+  - `strict_max_enabled` (`bool`): Whether each value needs to be strictly lesser than ('<') the maximum, or if equality is allowed.
+Only relevant if a maxValue has been defined. Default = false. When `null`, the `strict_max_enabled` field will be omitted from the resulting object.
+  - `strict_min_enabled` (`bool`): Whether each value needs to be strictly greater than ('>') the minimum, or if equality is allowed.
+Only relevant if a minValue has been defined. Default = false. When `null`, the `strict_min_enabled` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `range_expectation` sub block.
+
+
+## obj data_quality_spec.rules.regex_expectation
+
+
+
+### fn data_quality_spec.rules.regex_expectation.new
+
+```ts
+new()
+```
+
+
+`google.dataplex_datascan.data_quality_spec.rules.regex_expectation.new` constructs a new object with attributes and blocks configured for the `regex_expectation`
+Terraform sub block.
+
+
+
+**Args**:
+  - `regex` (`string`): A regular expression the column value is expected to match.
+
+**Returns**:
+  - An attribute object that represents the `regex_expectation` sub block.
+
+
+## obj data_quality_spec.rules.row_condition_expectation
+
+
+
+### fn data_quality_spec.rules.row_condition_expectation.new
+
+```ts
+new()
+```
+
+
+`google.dataplex_datascan.data_quality_spec.rules.row_condition_expectation.new` constructs a new object with attributes and blocks configured for the `row_condition_expectation`
+Terraform sub block.
+
+
+
+**Args**:
+  - `sql_expression` (`string`): The SQL expression.
+
+**Returns**:
+  - An attribute object that represents the `row_condition_expectation` sub block.
+
+
+## obj data_quality_spec.rules.set_expectation
+
+
+
+### fn data_quality_spec.rules.set_expectation.new
+
+```ts
+new()
+```
+
+
+`google.dataplex_datascan.data_quality_spec.rules.set_expectation.new` constructs a new object with attributes and blocks configured for the `set_expectation`
+Terraform sub block.
+
+
+
+**Args**:
+  - `values` (`list`): Expected values for the column value.
+
+**Returns**:
+  - An attribute object that represents the `set_expectation` sub block.
+
+
+## obj data_quality_spec.rules.statistic_range_expectation
+
+
+
+### fn data_quality_spec.rules.statistic_range_expectation.new
+
+```ts
+new()
+```
+
+
+`google.dataplex_datascan.data_quality_spec.rules.statistic_range_expectation.new` constructs a new object with attributes and blocks configured for the `statistic_range_expectation`
+Terraform sub block.
+
+
+
+**Args**:
+  - `max_value` (`string`): The maximum column statistic value allowed for a row to pass this validation.
+At least one of minValue and maxValue need to be provided. When `null`, the `max_value` field will be omitted from the resulting object.
+  - `min_value` (`string`): The minimum column statistic value allowed for a row to pass this validation.
+At least one of minValue and maxValue need to be provided. When `null`, the `min_value` field will be omitted from the resulting object.
+  - `statistic` (`string`): column statistics. Possible values: ["STATISTIC_UNDEFINED", "MEAN", "MIN", "MAX"]
+  - `strict_max_enabled` (`bool`): Whether column statistic needs to be strictly lesser than ('<') the maximum, or if equality is allowed.
+Only relevant if a maxValue has been defined. Default = false. When `null`, the `strict_max_enabled` field will be omitted from the resulting object.
+  - `strict_min_enabled` (`bool`): Whether column statistic needs to be strictly greater than ('>') the minimum, or if equality is allowed.
+Only relevant if a minValue has been defined. Default = false. When `null`, the `strict_min_enabled` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `statistic_range_expectation` sub block.
+
+
+## obj data_quality_spec.rules.table_condition_expectation
+
+
+
+### fn data_quality_spec.rules.table_condition_expectation.new
+
+```ts
+new()
+```
+
+
+`google.dataplex_datascan.data_quality_spec.rules.table_condition_expectation.new` constructs a new object with attributes and blocks configured for the `table_condition_expectation`
+Terraform sub block.
+
+
+
+**Args**:
+  - `sql_expression` (`string`): The SQL expression.
+
+**Returns**:
+  - An attribute object that represents the `table_condition_expectation` sub block.
+
+
+## obj data_quality_spec.rules.uniqueness_expectation
+
+
+
+### fn data_quality_spec.rules.uniqueness_expectation.new
+
+```ts
+new()
+```
+
+
+`google.dataplex_datascan.data_quality_spec.rules.uniqueness_expectation.new` constructs a new object with attributes and blocks configured for the `uniqueness_expectation`
+Terraform sub block.
+
+
+
+**Returns**:
+  - An attribute object that represents the `uniqueness_expectation` sub block.
+
+
+## obj execution_spec
+
+
+
+### fn execution_spec.new
+
+```ts
+new()
+```
+
+
+`google.dataplex_datascan.execution_spec.new` constructs a new object with attributes and blocks configured for the `execution_spec`
+Terraform sub block.
+
+
+
+**Args**:
+  - `field` (`string`): The unnested field (of type Date or Timestamp) that contains values which monotonically increase over time. If not specified, a data scan will run for all data in the table. When `null`, the `field` field will be omitted from the resulting object.
+  - `trigger` (`list[obj]`): Spec related to how often and when a scan should be triggered. When `null`, the `trigger` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.execution_spec.trigger.new](#fn-execution_spectriggernew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `execution_spec` sub block.
+
+
+## obj execution_spec.trigger
+
+
+
+### fn execution_spec.trigger.new
+
+```ts
+new()
+```
+
+
+`google.dataplex_datascan.execution_spec.trigger.new` constructs a new object with attributes and blocks configured for the `trigger`
+Terraform sub block.
+
+
+
+**Args**:
+  - `on_demand` (`list[obj]`): The scan runs once via dataScans.run API. When `null`, the `on_demand` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.execution_spec.trigger.on_demand.new](#fn-execution_specexecution_specon_demandnew) constructor.
+  - `schedule` (`list[obj]`): The scan is scheduled to run periodically. When `null`, the `schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.execution_spec.trigger.schedule.new](#fn-execution_specexecution_specschedulenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `trigger` sub block.
+
+
+## obj execution_spec.trigger.on_demand
+
+
+
+### fn execution_spec.trigger.on_demand.new
+
+```ts
+new()
+```
+
+
+`google.dataplex_datascan.execution_spec.trigger.on_demand.new` constructs a new object with attributes and blocks configured for the `on_demand`
+Terraform sub block.
+
+
+
+**Returns**:
+  - An attribute object that represents the `on_demand` sub block.
+
+
+## obj execution_spec.trigger.schedule
+
+
+
+### fn execution_spec.trigger.schedule.new
+
+```ts
+new()
+```
+
+
+`google.dataplex_datascan.execution_spec.trigger.schedule.new` constructs a new object with attributes and blocks configured for the `schedule`
+Terraform sub block.
+
+
+
+**Args**:
+  - `cron` (`string`): Cron schedule for running scans periodically. This field is required for Schedule scans.
+
+**Returns**:
+  - An attribute object that represents the `schedule` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.dataplex_datascan.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/dataplex_datascan_iam_binding.md b/docs/4.x/dataplex_datascan_iam_binding.md
new file mode 100644
index 0000000..fd15508
--- /dev/null
+++ b/docs/4.x/dataplex_datascan_iam_binding.md
@@ -0,0 +1,236 @@
+---
+permalink: /dataplex_datascan_iam_binding/
+---
+
+# dataplex_datascan_iam_binding
+
+`dataplex_datascan_iam_binding` represents the `google_dataplex_datascan_iam_binding` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCondition()`](#fn-withcondition)
+* [`fn withConditionMixin()`](#fn-withconditionmixin)
+* [`fn withDataScanId()`](#fn-withdatascanid)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withMembers()`](#fn-withmembers)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withRole()`](#fn-withrole)
+* [`obj condition`](#obj-condition)
+  * [`fn new()`](#fn-conditionnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.dataplex_datascan_iam_binding.new` injects a new `google_dataplex_datascan_iam_binding` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.dataplex_datascan_iam_binding.new('some_id')
+
+You can get the reference to the `id` field of the created `google.dataplex_datascan_iam_binding` using the reference:
+
+    $._ref.google_dataplex_datascan_iam_binding.some_id.get('id')
+
+This is the same as directly entering `"${ google_dataplex_datascan_iam_binding.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `data_scan_id` (`string`): Set the `data_scan_id` field on the resulting resource block.
+  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.
+  - `members` (`list`): Set the `members` field on the resulting resource block.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `role` (`string`): Set the `role` field on the resulting resource block.
+  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan_iam_binding.condition.new](#fn-conditionnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.dataplex_datascan_iam_binding.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_datascan_iam_binding`
+Terraform resource.
+
+Unlike [google.dataplex_datascan_iam_binding.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `data_scan_id` (`string`): Set the `data_scan_id` field on the resulting object.
+  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.
+  - `members` (`list`): Set the `members` field on the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `role` (`string`): Set the `role` field on the resulting object.
+  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan_iam_binding.condition.new](#fn-conditionnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_datascan_iam_binding` resource into the root Terraform configuration.
+
+
+### fn withCondition
+
+```ts
+withCondition()
+```
+
+`google.list[obj].withCondition` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the condition field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withConditionMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `condition` field.
+
+
+### fn withConditionMixin
+
+```ts
+withConditionMixin()
+```
+
+`google.list[obj].withConditionMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the condition field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withCondition](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `condition` field.
+
+
+### fn withDataScanId
+
+```ts
+withDataScanId()
+```
+
+`google.string.withDataScanId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the data_scan_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `data_scan_id` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withMembers
+
+```ts
+withMembers()
+```
+
+`google.list.withMembers` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the members field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `members` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withRole
+
+```ts
+withRole()
+```
+
+`google.string.withRole` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the role field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `role` field.
+
+
+## obj condition
+
+
+
+### fn condition.new
+
+```ts
+new()
+```
+
+
+`google.dataplex_datascan_iam_binding.condition.new` constructs a new object with attributes and blocks configured for the `condition`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.
+  - `expression` (`string`): Set the `expression` field on the resulting object.
+  - `title` (`string`): Set the `title` field on the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `condition` sub block.
diff --git a/docs/4.x/dataplex_datascan_iam_member.md b/docs/4.x/dataplex_datascan_iam_member.md
new file mode 100644
index 0000000..124b751
--- /dev/null
+++ b/docs/4.x/dataplex_datascan_iam_member.md
@@ -0,0 +1,236 @@
+---
+permalink: /dataplex_datascan_iam_member/
+---
+
+# dataplex_datascan_iam_member
+
+`dataplex_datascan_iam_member` represents the `google_dataplex_datascan_iam_member` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCondition()`](#fn-withcondition)
+* [`fn withConditionMixin()`](#fn-withconditionmixin)
+* [`fn withDataScanId()`](#fn-withdatascanid)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withMember()`](#fn-withmember)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withRole()`](#fn-withrole)
+* [`obj condition`](#obj-condition)
+  * [`fn new()`](#fn-conditionnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.dataplex_datascan_iam_member.new` injects a new `google_dataplex_datascan_iam_member` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.dataplex_datascan_iam_member.new('some_id')
+
+You can get the reference to the `id` field of the created `google.dataplex_datascan_iam_member` using the reference:
+
+    $._ref.google_dataplex_datascan_iam_member.some_id.get('id')
+
+This is the same as directly entering `"${ google_dataplex_datascan_iam_member.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `data_scan_id` (`string`): Set the `data_scan_id` field on the resulting resource block.
+  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.
+  - `member` (`string`): Set the `member` field on the resulting resource block.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `role` (`string`): Set the `role` field on the resulting resource block.
+  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan_iam_member.condition.new](#fn-conditionnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.dataplex_datascan_iam_member.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_datascan_iam_member`
+Terraform resource.
+
+Unlike [google.dataplex_datascan_iam_member.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `data_scan_id` (`string`): Set the `data_scan_id` field on the resulting object.
+  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.
+  - `member` (`string`): Set the `member` field on the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `role` (`string`): Set the `role` field on the resulting object.
+  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan_iam_member.condition.new](#fn-conditionnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_datascan_iam_member` resource into the root Terraform configuration.
+
+
+### fn withCondition
+
+```ts
+withCondition()
+```
+
+`google.list[obj].withCondition` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the condition field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withConditionMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `condition` field.
+
+
+### fn withConditionMixin
+
+```ts
+withConditionMixin()
+```
+
+`google.list[obj].withConditionMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the condition field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withCondition](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `condition` field.
+
+
+### fn withDataScanId
+
+```ts
+withDataScanId()
+```
+
+`google.string.withDataScanId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the data_scan_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `data_scan_id` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withMember
+
+```ts
+withMember()
+```
+
+`google.string.withMember` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the member field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `member` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withRole
+
+```ts
+withRole()
+```
+
+`google.string.withRole` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the role field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `role` field.
+
+
+## obj condition
+
+
+
+### fn condition.new
+
+```ts
+new()
+```
+
+
+`google.dataplex_datascan_iam_member.condition.new` constructs a new object with attributes and blocks configured for the `condition`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.
+  - `expression` (`string`): Set the `expression` field on the resulting object.
+  - `title` (`string`): Set the `title` field on the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `condition` sub block.
diff --git a/docs/4.x/dataplex_datascan_iam_policy.md b/docs/4.x/dataplex_datascan_iam_policy.md
new file mode 100644
index 0000000..502a73e
--- /dev/null
+++ b/docs/4.x/dataplex_datascan_iam_policy.md
@@ -0,0 +1,149 @@
+---
+permalink: /dataplex_datascan_iam_policy/
+---
+
+# dataplex_datascan_iam_policy
+
+`dataplex_datascan_iam_policy` represents the `google_dataplex_datascan_iam_policy` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDataScanId()`](#fn-withdatascanid)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withPolicyData()`](#fn-withpolicydata)
+* [`fn withProject()`](#fn-withproject)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.dataplex_datascan_iam_policy.new` injects a new `google_dataplex_datascan_iam_policy` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.dataplex_datascan_iam_policy.new('some_id')
+
+You can get the reference to the `id` field of the created `google.dataplex_datascan_iam_policy` using the reference:
+
+    $._ref.google_dataplex_datascan_iam_policy.some_id.get('id')
+
+This is the same as directly entering `"${ google_dataplex_datascan_iam_policy.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `data_scan_id` (`string`): Set the `data_scan_id` field on the resulting resource block.
+  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.
+  - `policy_data` (`string`): Set the `policy_data` field on the resulting resource block.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.dataplex_datascan_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_datascan_iam_policy`
+Terraform resource.
+
+Unlike [google.dataplex_datascan_iam_policy.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `data_scan_id` (`string`): Set the `data_scan_id` field on the resulting object.
+  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.
+  - `policy_data` (`string`): Set the `policy_data` field on the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_datascan_iam_policy` resource into the root Terraform configuration.
+
+
+### fn withDataScanId
+
+```ts
+withDataScanId()
+```
+
+`google.string.withDataScanId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the data_scan_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `data_scan_id` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withPolicyData
+
+```ts
+withPolicyData()
+```
+
+`google.string.withPolicyData` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the policy_data field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `policy_data` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
diff --git a/docs/4.x/kms_crypto_key.md b/docs/4.x/kms_crypto_key.md
index 460c96e..d0ee381 100644
--- a/docs/4.x/kms_crypto_key.md
+++ b/docs/4.x/kms_crypto_key.md
@@ -70,7 +70,8 @@ Format: ''projects/{{project}}/locations/{{location}}/keyRings/{{keyRing
   - `name` (`string`): The resource name for the CryptoKey.
   - `purpose` (`string`): The immutable purpose of this CryptoKey. See the
 [purpose reference](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys#CryptoKeyPurpose)
-for possible inputs. Default value: "ENCRYPT_DECRYPT" Possible values: ["ENCRYPT_DECRYPT", "ASYMMETRIC_SIGN", "ASYMMETRIC_DECRYPT", "MAC"] When `null`, the `purpose` field will be omitted from the resulting object.
+for possible inputs.
+Default value is "ENCRYPT_DECRYPT". When `null`, the `purpose` field will be omitted from the resulting object.
   - `rotation_period` (`string`): Every time this period passes, generate a new CryptoKeyVersion and set it as the primary.
 The first rotation will take place after the specified period. The rotation period has
 the format of a decimal number with up to 9 fractional digits, followed by the
@@ -111,7 +112,8 @@ Format: ''projects/{{project}}/locations/{{location}}/keyRings/{{keyRing
   - `name` (`string`): The resource name for the CryptoKey.
   - `purpose` (`string`): The immutable purpose of this CryptoKey. See the
 [purpose reference](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys#CryptoKeyPurpose)
-for possible inputs. Default value: "ENCRYPT_DECRYPT" Possible values: ["ENCRYPT_DECRYPT", "ASYMMETRIC_SIGN", "ASYMMETRIC_DECRYPT", "MAC"] When `null`, the `purpose` field will be omitted from the resulting object.
+for possible inputs.
+Default value is "ENCRYPT_DECRYPT". When `null`, the `purpose` field will be omitted from the resulting object.
   - `rotation_period` (`string`): Every time this period passes, generate a new CryptoKeyVersion and set it as the primary.
 The first rotation will take place after the specified period. The rotation period has
 the format of a decimal number with up to 9 fractional digits, followed by the