one more change

third_party/terraform/resources/resource_composer_environment.go.erb

@@ -275,6 +275,7 @@ func resourceComposerEnvironment() *schema.Resource {
 									"enable_private_endpoint": {
 										Type:         schema.TypeBool,
 										Optional:     true,
+										Default:      true,
 										AtLeastOneOf: []string{
 											"config.0.private_environment_config.0.enable_private_endpoint",
 											"config.0.private_environment_config.0.master_ipv4_cidr_block",

third_party/terraform/resources/resource_container_cluster.go.erb

@@ -422,7 +422,11 @@ func resourceContainerCluster() *schema.Resource {
 <% if version == 'ga' -%>
 							Required: true,
 <% else %>
-							Optional: true,
+							Optional:     true,
+							ExactlyOneOf: []string{
+								"maintenance_policy.0.daily_maintenance_window",
+								"maintenance_policy.0.recurring_window",
+							},
 <% end %>
 							MaxItems: 1,
 							Elem: &schema.Resource{
@@ -442,10 +446,13 @@ func resourceContainerCluster() *schema.Resource {
 						},
 <% unless version == 'ga' -%>
 						"recurring_window": {
-							Type: schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							ConflictsWith: []string{"maintenance_policy.0.daily_maintenance_window"},
+							Type:         schema.TypeList,
+							Optional:     true,
+							MaxItems:     1,
+							ExactlyOneOf: []string{
+								"maintenance_policy.0.daily_maintenance_window",
+								"maintenance_policy.0.recurring_window",
+							},
 							Elem: &schema.Resource{
 								Schema: map[string]*schema.Schema{
 									"start_time": {

third_party/terraform/website/docs/guides/version_3_upgrade.html.markdown

@@ -407,10 +407,14 @@ In an attempt to avoid allowing empty blocks in config files, at least one of `a
 Previously the default value of `use_ip_aliases` was `true`. In an attempt to avoid allowing empty blocks
 in config files, `use_ip_aliases` is now required on the `ip_allocation_policy` block.
 
-### `enable_private_endpoint` is now required on block `google_composer_environment.private_environment_config`
+### At least one of `enable_private_endpoint` or `master_ipv4_cidr_block` is now required on `google_composer_environment.config.private_environment_config`
 
-Previously the default value of `enable_private_endpoint` was `true`. In an attempt to avoid allowing empty blocks
-in config files, `enable_private_endpoint` is now required on the `private_environment_config` block.
+In an attempt to avoid allowing empty blocks in config files, at least one of `enable_private_endpoint` or `master_ipv4_cidr_block` is now required on the
+`config.private_environment_config` block.
+
+### At least one of `node_count`, `node_config`, `software_config` or `private_environment_config` required on `google_composer_environment.config`
+
+In an attempt to avoid allowing empty blocks in config files, at least one of `node_count`, `node_config`, `software_config` or `private_environment_config` is now required on the `config` block.
 
 ## Resource: `google_compute_backend_bucket`
 
@@ -1041,13 +1045,17 @@ required on the `master_authorized_networks_config` block.
 In an attempt to avoid allowing empty blocks in config files, `disabled` is now
 required on the different `google_container_cluster.addons_config` blocks.
 
+### Exactly one of `daily_maintenance_window` or `recurring_window` is now required on `google_container_cluster.maintenance_policy`
+
+In an attempt to avoid allowing empty blocks in config files, exactly one of `daily_maintenance_window` or `recurring_window` is now required on the
+`maintenance_policy` block.
+
 ### At least one of `http_load_balancing`, `horizontal_pod_autoscaling` , `network_policy_config`, `cloudrun_config`, or `istio_config` is now required on `google_container_cluster.addons_config`
 
 In an attempt to avoid allowing empty blocks in config files, at least one of `http_load_balancing`,
 `horizontal_pod_autoscaling` , `network_policy_config`, `cloudrun_config`, or `istio_config` is now required on the
 `addons_config` block.
 
-
 ### At least one of `username`, `password` or `client_certificate_config` is now required on `google_container_cluster.master_auth`
 
 In an attempt to avoid allowing empty blocks in config files, at least one of `username`, `password`
@@ -1341,6 +1349,11 @@ required on the `http_check.auth_info` block.
 In attempt to be more consistent with the API, exactly one of `list_policy`, `boolean_policy`,
 or `restore_policy` is now required on `google_organization_policy`.
 
+### Exactly one of `allow` or `deny` is now required on `google_organization_policy.list_policy`
+
+In an attempt to avoid allowing empty blocks in config files, exactly one of `allow` or `deny` is now
+required on the `list_policy` block.
+
 ### Exactly one of `all` or `values` is now required on `google_organization_policy.list_policy.allow` and `google_organization_policy.list_policy.deny`
 
 In an attempt to avoid allowing empty blocks in config files, exactly one of `all` or `values` is now