From a64ffa92acc78de3908a06a3370302af2c296217 Mon Sep 17 00:00:00 2001
From: Zhenhua Li <zhenhuali@google.com>
Date: Thu, 12 Sep 2024 12:16:34 -0700
Subject: [PATCH 1/4] Go copy comments script

---
 mmv1/description-copy.go | 258 ++++++++++++++++++++++++++++++++++++++-
 1 file changed, 253 insertions(+), 5 deletions(-)

diff --git a/mmv1/description-copy.go b/mmv1/description-copy.go
index 6af7ecdbe28a..715774252414 100644
--- a/mmv1/description-copy.go
+++ b/mmv1/description-copy.go
@@ -23,12 +23,261 @@ func CopyAllDescriptions(tempMode bool) {
 	}
 
 	for i, id := range identifiers {
-		CopyText(id, len(identifiers)-1 == i, tempMode)
+		CopyText(id, tempMode)
 	}
+
+	copyComments()
+}
+
+// TODO rewrite: ServicePerimeters.yaml is an exeption and needs manually fixing the comments over after switchover
+// Used to copy/paste comments from Ruby -> Go YAML files
+func copyComments() {
+	log.Printf("Starting to copy comments from Ruby yaml files to Go yaml files")
+
+	renamedFields := map[string]string{
+		"skip_sweeper": "exclude_sweeper",
+		"skip_delete":  "exclude_delete",
+		"values":       "enum_values",
+	}
+	var allProductFiles []string = make([]string, 0)
+	files, err := filepath.Glob("products/**/go_product.yaml")
+	if err != nil {
+		return
+	}
+	for _, filePath := range files {
+		dir := filepath.Dir(filePath)
+		allProductFiles = append(allProductFiles, fmt.Sprintf("products/%s", filepath.Base(dir)))
+	}
+
+	for _, productPath := range allProductFiles {
+		// Gather go and ruby file pairs
+		yamlMap := make(map[string][]string)
+		yamlPaths, err := filepath.Glob(fmt.Sprintf("%s/*", productPath))
+		if err != nil {
+			log.Fatalf("Cannot get yaml files: %v", err)
+		}
+		for _, yamlPath := range yamlPaths {
+			if strings.HasSuffix(yamlPath, "_new") {
+				continue
+			}
+			fileName := filepath.Base(yamlPath)
+			baseName, found := strings.CutPrefix(fileName, "go_")
+			if yamlMap[baseName] == nil {
+				yamlMap[baseName] = make([]string, 2)
+			}
+			if found {
+				yamlMap[baseName][1] = yamlPath
+			} else {
+				yamlMap[baseName][0] = yamlPath
+			}
+		}
+
+		for _, files := range yamlMap {
+			rubyPath := files[0]
+			goPath := files[1]
+
+			recordingComments := false
+			comments := ""
+			commentsMap := make(map[string]string, 0)
+			nestedNameLine := ""
+			previousNameLine := ""
+			trimmedPreviousLine := ""
+
+			// Ready Ruby yaml
+			wholeLineComment, err := regexp.Compile(`^\s*#.*?`)
+			if err != nil {
+				log.Fatalf("Cannot compile the regular expression: %v", err)
+			}
+
+			if err != nil {
+				log.Fatalf("Cannot compile the regular expression: %v", err)
+			}
+
+			file, _ := os.Open(rubyPath)
+			defer file.Close()
+			scanner := bufio.NewScanner(file)
+			for scanner.Scan() {
+				line := scanner.Text()
+				if line == "" {
+					if recordingComments {
+						comments = fmt.Sprintf("%s\n%s", comments, line)
+					}
+					continue
+				}
+
+				if wholeLineComment.MatchString(line) {
+					if !recordingComments {
+						recordingComments = true
+						comments = line
+					} else {
+						comments = fmt.Sprintf("%s\n%s", comments, line)
+					}
+				} else {
+					normalizedLine := line
+
+					indexOfComment := strings.Index(normalizedLine, " # ")
+					if indexOfComment > 0 { // The comments are in the same line with the code
+						comments = normalizedLine[indexOfComment:]
+						recordingComments = true
+						normalizedLine = strings.TrimRight(normalizedLine[:indexOfComment], " ")
+					}
+
+					normalizedLine = strings.ReplaceAll(normalizedLine, "'", "")
+					normalizedLine = strings.ReplaceAll(normalizedLine, `"`, "")
+					normalizedLine = strings.ReplaceAll(normalizedLine, `\`, "")
+					normalizedLine = strings.ReplaceAll(normalizedLine, ": :", ": ")
+					normalizedLine = strings.ReplaceAll(normalizedLine, "- :", "- ")
+					trimmed := strings.TrimSpace(normalizedLine)
+					index := strings.Index(normalizedLine, trimmed)
+
+					if index == 0 {
+						previousNameLine = ""
+						nestedNameLine = ""
+					} else if index >= 2 && (strings.HasPrefix(trimmedPreviousLine, "- !ruby/object") || strings.HasPrefix(trimmedPreviousLine, "--- !ruby/object")) {
+						normalizedLine = fmt.Sprintf("%s- %s", normalizedLine[:index-2], normalizedLine[index:])
+
+						if strings.HasPrefix(trimmed, "name:") {
+							if nestedNameLine != "" {
+								previousNameLine = nestedNameLine
+							}
+							nestedNameLine = normalizedLine
+						}
+					}
+
+					trimmedPreviousLine = trimmed
+
+					if recordingComments {
+						if !strings.HasPrefix(comments, "# Copyright") {
+							// The line is a type, for example - !ruby/object:Api::Type::Array.
+							// The lines of types are not present in Go yaml files
+							if strings.HasPrefix(trimmed, "- !ruby/object") || strings.HasPrefix(trimmed, "--- !ruby/object") {
+								continue
+							}
+
+							// Remove suffix " !ruby/object" as the types are not present in Go yaml files
+							indexOfRuby := strings.Index(normalizedLine, ": !ruby/object")
+							if indexOfRuby >= 0 {
+								normalizedLine = normalizedLine[:indexOfRuby+1]
+							}
+							// Remove suffix Api::Type::
+							indexOfRuby = strings.Index(normalizedLine, " Api::Type::")
+							if indexOfRuby >= 0 {
+								normalizedLine = normalizedLine[:indexOfRuby]
+							}
+
+							// Some fields are renamed during yaml file conversion
+							field := strings.Split(normalizedLine, ":")[0]
+							if shouldUseFieldName(normalizedLine) {
+								normalizedLine = field
+							}
+
+							field = strings.TrimSpace(field)
+							if goName, ok := renamedFields[field]; ok {
+								normalizedLine = strings.Replace(normalizedLine, field, goName, 1)
+							}
+
+							key := fmt.Sprintf("%s$%s$%s", previousNameLine, nestedNameLine, normalizedLine)
+							commentsMap[key] = comments
+						}
+						recordingComments = false
+						comments = ""
+					}
+				}
+			}
+
+			// Read Go yaml while writing to a temp file
+			firstLine := true
+			nestedNameLine = ""
+			previousNameLine = ""
+			newFilePath := fmt.Sprintf("%s_new", goPath)
+			fo, _ := os.Create(newFilePath)
+			w := bufio.NewWriter(fo)
+			file, _ = os.Open(goPath)
+			defer file.Close()
+			scanner = bufio.NewScanner(file)
+			for scanner.Scan() {
+				line := scanner.Text()
+
+				if firstLine {
+					if strings.Contains(line, "NOT CONVERTED - RUN YAML MODE") {
+						firstLine = false
+						continue
+					} else {
+						break
+					}
+				}
+
+				if len(commentsMap) > 0 && !wholeLineComment.MatchString(line) && line != "" { // This line is not a comment
+					normalizedLine := strings.ReplaceAll(line, "'", "")
+					normalizedLine = strings.ReplaceAll(normalizedLine, `"`, "")
+					trimmed := strings.TrimSpace(normalizedLine)
+					index := strings.Index(normalizedLine, trimmed)
+
+					if index == 0 {
+						previousNameLine = ""
+						nestedNameLine = ""
+					} else if index >= 2 && strings.HasPrefix(trimmed, "- name:") {
+						if nestedNameLine != "" {
+							previousNameLine = nestedNameLine
+						}
+						nestedNameLine = normalizedLine
+					}
+
+					field := strings.Split(normalizedLine, ":")[0]
+					if shouldUseFieldName(normalizedLine) {
+						normalizedLine = field
+					}
+
+					key := fmt.Sprintf("%s$%s$%s", previousNameLine, nestedNameLine, normalizedLine)
+					if comments, ok := commentsMap[key]; ok {
+						delete(commentsMap, key)
+						line = fmt.Sprintf("%s\n%s", comments, line)
+					}
+				}
+				_, err := w.WriteString(fmt.Sprintf("%s\n", line))
+				if err != nil {
+					log.Fatalf("Error when writing the line %s: %#v", line, err)
+				}
+			}
+
+			if !firstLine {
+				// Flush writes any buffered data to the underlying io.Writer.
+				if err = w.Flush(); err != nil {
+					panic(err)
+				}
+
+				if len(commentsMap) > 0 {
+					log.Printf("Some comments in rubyPath %s are not copied over: %#v", rubyPath, commentsMap)
+				}
+				// Overwrite original file with temp
+				os.Rename(newFilePath, goPath)
+			} else {
+				os.Remove(newFilePath)
+			}
+		}
+	}
+	log.Printf("Finished to copy comments from Ruby yaml files to Go yaml files")
+}
+
+// custom template files in Go yaml files have different names
+// The format of primary_resource_name for enum is different in Go yaml files
+func shouldUseFieldName(line string) bool {
+	filedNames := []string{
+		"templates/terraform/",
+		"primary_resource_name:",
+		"default_value:",
+		"deprecation_message:",
+	}
+	for _, fieldName := range filedNames {
+		if strings.Contains(line, fieldName) {
+			return true
+		}
+	}
+	return false
 }
 
 // Used to copy/paste text from Ruby -> Go YAML files
-func CopyText(identifier string, last, tempMode bool) {
+func CopyText(identifier string, tempMode bool) {
 	var allProductFiles []string = make([]string, 0)
 	glob := "products/**/go_product.yaml"
 	if tempMode {
@@ -135,14 +384,13 @@ func CopyText(identifier string, last, tempMode bool) {
 				if firstLine {
 					if strings.Contains(line, "NOT CONVERTED - RUN YAML MODE") {
 						firstLine = false
-						if !last {
-							w.WriteString(fmt.Sprintf("NOT CONVERTED - RUN YAML MODE\n"))
-						}
+						w.WriteString(fmt.Sprintf("NOT CONVERTED - RUN YAML MODE\n"))
 						continue
 					} else {
 						break
 					}
 				}
+
 				if strings.Contains(line, identifier) {
 					if index >= len(text) {
 						log.Printf("did not replace %s correctly! Is the file named correctly?", goPath)

From bbb42daa9b6c3c3dfa1da78919637a841aeae1da Mon Sep 17 00:00:00 2001
From: Zhenhua Li <zhenhuali@google.com>
Date: Fri, 13 Sep 2024 18:12:42 -0700
Subject: [PATCH 2/4] Add comments to Go yaml files + refresh

---
 mmv1/description-copy.go                      | 12 ++--
 .../accesscontextmanager/go_AccessLevel.yaml  | 11 ++++
 .../go_AccessLevelCondition.yaml              |  7 ++
 .../accesscontextmanager/go_AccessLevels.yaml | 10 +++
 .../accesscontextmanager/go_AccessPolicy.yaml |  1 +
 .../go_AuthorizedOrgsDesc.yaml                |  1 +
 .../accesscontextmanager/go_EgressPolicy.yaml |  1 +
 .../go_GcpUserAccessBinding.yaml              |  2 +
 .../go_IngressPolicy.yaml                     |  1 +
 .../go_ServicePerimeter.yaml                  |  9 +++
 ...go_ServicePerimeterDryRunEgressPolicy.yaml |  1 +
 ...o_ServicePerimeterDryRunIngressPolicy.yaml |  1 +
 .../go_ServicePerimeterDryRunResource.yaml    |  1 +
 .../go_ServicePerimeterEgressPolicy.yaml      |  1 +
 .../go_ServicePerimeterIngressPolicy.yaml     |  1 +
 .../go_ServicePerimeterResource.yaml          |  1 +
 .../go_ServicePerimeters.yaml                 | 28 ++++++++
 mmv1/products/activedirectory/go_Domain.yaml  |  5 ++
 .../activedirectory/go_DomainTrust.yaml       |  2 +
 mmv1/products/alloydb/go_Cluster.yaml         |  1 +
 mmv1/products/alloydb/go_Instance.yaml        |  1 +
 mmv1/products/alloydb/go_User.yaml            |  1 +
 mmv1/products/apigateway/go_ApiConfig.yaml    |  1 +
 mmv1/products/apigee/go_EnvKeystore.yaml      |  3 +
 mmv1/products/apigee/go_EnvReferences.yaml    |  3 +
 .../apigee/go_EnvgroupAttachment.yaml         |  2 +
 .../apigee/go_InstanceAttachment.yaml         |  1 +
 .../go_KeystoresAliasesSelfSignedCert.yaml    |  4 ++
 .../appengine/go_FlexibleAppVersion.yaml      |  2 +
 mmv1/products/appengine/go_Service.yaml       |  1 +
 .../appengine/go_StandardAppVersion.yaml      |  8 ++-
 .../artifactregistry/go_Repository.yaml       | 20 ++++++
 .../artifactregistry/go_VPCSCConfig.yaml      |  1 +
 .../backupdr/go_ManagementServer.yaml         |  1 +
 mmv1/products/beyondcorp/go_AppGateway.yaml   |  1 +
 mmv1/products/bigquery/go_Job.yaml            |  3 +
 mmv1/products/bigquery/go_Routine.yaml        |  3 +
 mmv1/products/bigquery/go_Table.yaml          |  5 ++
 .../bigqueryanalyticshub/go_Listing.yaml      |  1 +
 .../bigqueryconnection/go_Connection.yaml     |  5 ++
 mmv1/products/bigtable/go_AppProfile.yaml     |  4 ++
 .../binaryauthorization/go_Attestor.yaml      |  2 +
 .../certificatemanager/go_Certificate.yaml    |  3 +
 .../go_CertificateMapEntry.yaml               |  1 +
 mmv1/products/cloudbuild/go_Trigger.yaml      |  2 +
 mmv1/products/cloudbuildv2/go_Repository.yaml |  3 +
 .../clouddomains/go_Registration.yaml         |  4 ++
 .../cloudfunctions/go_CloudFunction.yaml      |  4 ++
 .../products/cloudfunctions2/go_Function.yaml | 13 ++++
 mmv1/products/cloudrun/go_Service.yaml        |  1 +
 mmv1/products/cloudrunv2/go_Job.yaml          | 36 ++++++++++
 mmv1/products/cloudrunv2/go_Service.yaml      | 39 +++++++++++
 .../composer/go_UserWorkloadsConfigMap.yaml   |  2 +
 mmv1/products/compute/go_Autoscaler.yaml      |  2 +
 mmv1/products/compute/go_BackendService.yaml  |  5 ++
 mmv1/products/compute/go_Disk.yaml            |  4 ++
 mmv1/products/compute/go_DiskType.yaml        |  7 ++
 .../compute/go_ExternalVpnGateway.yaml        |  1 +
 mmv1/products/compute/go_Firewall.yaml        |  8 +++
 mmv1/products/compute/go_ForwardingRule.yaml  | 10 +++
 .../compute/go_GlobalForwardingRule.yaml      | 11 ++++
 mmv1/products/compute/go_Image.yaml           |  3 +
 mmv1/products/compute/go_Instance.yaml        | 39 +++++++++++
 mmv1/products/compute/go_InstanceGroup.yaml   |  1 +
 .../compute/go_InstanceGroupManager.yaml      |  4 ++
 .../compute/go_InstanceGroupNamedPort.yaml    |  1 +
 mmv1/products/compute/go_License.yaml         |  1 +
 .../compute/go_ManagedSslCertificate.yaml     |  5 ++
 mmv1/products/compute/go_Network.yaml         |  1 +
 .../go_NetworkEdgeSecurityService.yaml        |  1 +
 .../go_NetworkPeeringRoutesConfig.yaml        |  2 +
 .../go_OrganizationSecurityPolicy.yaml        |  1 +
 ...OrganizationSecurityPolicyAssociation.yaml |  1 +
 .../go_OrganizationSecurityPolicyRule.yaml    |  1 +
 mmv1/products/compute/go_Region.yaml          |  1 +
 .../products/compute/go_RegionAutoscaler.yaml |  3 +
 .../compute/go_RegionBackendService.yaml      |  4 ++
 .../products/compute/go_RegionCommitment.yaml |  2 +
 mmv1/products/compute/go_RegionDisk.yaml      |  4 ++
 .../go_RegionInstanceGroupManager.yaml        |  3 +
 .../go_RegionNetworkEndpointGroup.yaml        |  4 ++
 .../compute/go_RegionSslCertificate.yaml      |  3 +
 .../compute/go_RegionTargetHttpsProxy.yaml    | 22 +++++++
 mmv1/products/compute/go_RegionUrlMap.yaml    | 13 ++++
 mmv1/products/compute/go_Reservation.yaml     |  2 +
 mmv1/products/compute/go_ResizeRequest.yaml   | 23 ++++++-
 mmv1/products/compute/go_Router.yaml          | 11 ++++
 mmv1/products/compute/go_RouterNat.yaml       |  4 ++
 .../compute/go_SecurityPolicyRule.yaml        | 13 ++++
 .../compute/go_ServiceAttachment.yaml         |  2 +
 mmv1/products/compute/go_Snapshot.yaml        | 10 +++
 mmv1/products/compute/go_SslCertificate.yaml  |  3 +
 mmv1/products/compute/go_SslPolicy.yaml       |  1 +
 .../products/compute/go_TargetHttpsProxy.yaml |  3 +
 mmv1/products/compute/go_UrlMap.yaml          | 21 ++++++
 mmv1/products/compute/go_Zone.yaml            |  1 +
 .../containerattached/go_Cluster.yaml         |  6 ++
 mmv1/products/datacatalog/go_Entry.yaml       |  2 +
 mmv1/products/datacatalog/go_Tag.yaml         |  1 +
 mmv1/products/datacatalog/go_Taxonomy.yaml    |  1 +
 mmv1/products/datafusion/go_Instance.yaml     |  5 ++
 .../datastream/go_ConnectionProfile.yaml      |  2 +
 .../datastream/go_PrivateConnection.yaml      |  1 +
 mmv1/products/datastream/go_Stream.yaml       |  4 ++
 .../deploymentmanager/go_Deployment.yaml      | 10 +++
 .../developerconnect/go_Connection.yaml       | 12 ++++
 .../go_GitRepositoryLink.yaml                 |  2 +
 mmv1/products/dialogflow/go_Agent.yaml        |  1 +
 mmv1/products/dialogflow/go_EntityType.yaml   |  1 +
 mmv1/products/dialogflow/go_Fulfillment.yaml  |  1 +
 mmv1/products/dialogflow/go_Intent.yaml       |  1 +
 mmv1/products/dialogflowcx/go_Agent.yaml      |  2 +
 mmv1/products/dialogflowcx/go_Flow.yaml       |  4 ++
 mmv1/products/dialogflowcx/go_Page.yaml       | 17 +++++
 mmv1/products/dialogflowcx/go_TestCase.yaml   |  6 ++
 mmv1/products/dlp/go_DeidentifyTemplate.yaml  | 43 ++++++++++++
 mmv1/products/dlp/go_DiscoveryConfig.yaml     | 10 +++
 mmv1/products/dlp/go_InspectTemplate.yaml     |  1 +
 mmv1/products/dlp/go_JobTrigger.yaml          | 66 +++++++++++++++++++
 mmv1/products/dlp/go_StoredInfoType.yaml      |  1 +
 mmv1/products/dns/go_ManagedZone.yaml         |  5 ++
 .../go_DocumentSchema.yaml                    |  1 +
 mmv1/products/edgecontainer/go_Cluster.yaml   |  4 ++
 mmv1/products/edgecontainer/go_NodePool.yaml  |  3 +
 .../edgecontainer/go_VpnConnection.yaml       |  1 +
 mmv1/products/filestore/go_Instance.yaml      |  3 +
 mmv1/products/firebase/go_AndroidApp.yaml     |  1 +
 mmv1/products/firebase/go_AppleApp.yaml       |  2 +
 mmv1/products/firebase/go_WebApp.yaml         |  2 +
 .../firebaseappcheck/go_AppAttestConfig.yaml  |  4 ++
 .../firebaseappcheck/go_DebugToken.yaml       |  2 +
 .../go_DeviceCheckConfig.yaml                 |  2 +
 .../go_PlayIntegrityConfig.yaml               |  3 +
 .../go_RecaptchaEnterpriseConfig.yaml         |  3 +
 .../go_RecaptchaV3Config.yaml                 |  3 +
 .../firebaseextensions/go_Instance.yaml       |  3 +
 .../firebasehosting/go_CustomDomain.yaml      |  4 ++
 mmv1/products/firebasehosting/go_Release.yaml |  1 +
 mmv1/products/firebasehosting/go_Version.yaml |  1 +
 mmv1/products/firebasestorage/go_Bucket.yaml  |  1 +
 mmv1/products/firestore/go_Document.yaml      |  1 +
 mmv1/products/firestore/go_Field.yaml         |  1 +
 mmv1/products/firestore/go_Index.yaml         |  5 ++
 mmv1/products/gkebackup/go_BackupPlan.yaml    |  5 ++
 mmv1/products/gkehub/go_Membership.yaml       |  1 +
 mmv1/products/gkehub2/go_Feature.yaml         |  2 +
 .../gkehub2/go_MembershipBinding.yaml         |  1 +
 .../gkehub2/go_MembershipRBACRoleBinding.yaml |  1 +
 mmv1/products/gkehub2/go_Namespace.yaml       |  1 +
 mmv1/products/gkehub2/go_Scope.yaml           |  1 +
 .../gkehub2/go_ScopeRBACRoleBinding.yaml      |  1 +
 .../iam2/go_AccessBoundaryPolicy.yaml         |  1 +
 mmv1/products/iap/go_AppEngineService.yaml    |  2 +
 mmv1/products/iap/go_AppEngineVersion.yaml    |  2 +
 mmv1/products/iap/go_Tunnel.yaml              |  2 +
 mmv1/products/iap/go_TunnelInstance.yaml      |  2 +
 mmv1/products/iap/go_Web.yaml                 |  2 +
 mmv1/products/iap/go_WebBackendService.yaml   |  2 +
 .../iap/go_WebRegionBackendService.yaml       |  2 +
 mmv1/products/iap/go_WebTypeAppEngine.yaml    |  2 +
 mmv1/products/iap/go_WebTypeCompute.yaml      |  2 +
 mmv1/products/identityplatform/go_Config.yaml |  2 +
 .../integrationconnectors/go_ManagedZone.yaml |  1 +
 mmv1/products/integrations/go_AuthConfig.yaml |  6 ++
 mmv1/products/kms/go_AutokeyConfig.yaml       |  6 ++
 mmv1/products/kms/go_KeyHandle.yaml           |  3 +
 mmv1/products/logging/go_FolderSettings.yaml  |  5 ++
 mmv1/products/logging/go_LinkedDataset.yaml   |  2 +
 mmv1/products/logging/go_LogView.yaml         |  2 +
 mmv1/products/logging/go_Metric.yaml          |  1 +
 .../logging/go_OrganizationSettings.yaml      |  4 ++
 mmv1/products/looker/go_Instance.yaml         | 13 ++++
 mmv1/products/metastore/go_Service.yaml       |  1 +
 mmv1/products/mlengine/go_Model.yaml          |  6 ++
 mmv1/products/monitoring/go_AlertPolicy.yaml  |  2 +
 .../monitoring/go_GenericService.yaml         |  2 +
 mmv1/products/monitoring/go_Group.yaml        |  1 +
 mmv1/products/monitoring/go_Slo.yaml          |  4 ++
 mmv1/products/netapp/go_ActiveDirectory.yaml  |  2 +
 mmv1/products/netapp/go_Backup.yaml           |  1 +
 mmv1/products/netapp/go_BackupPolicy.yaml     |  1 +
 mmv1/products/netapp/go_BackupVault.yaml      |  1 +
 mmv1/products/netapp/go_StoragePool.yaml      |  1 +
 mmv1/products/netapp/go_Volume.yaml           |  1 +
 .../products/netapp/go_VolumeReplication.yaml |  1 +
 mmv1/products/netapp/go_VolumeSnapshot.yaml   |  1 +
 mmv1/products/netapp/go_kmsconfig.yaml        |  9 +++
 .../go_PolicyBasedRoute.yaml                  |  8 +++
 .../networksecurity/go_AddressGroup.yaml      |  1 +
 .../networksecurity/go_ClientTlsPolicy.yaml   |  2 +
 .../go_ProjectAddressGroup.yaml               |  5 ++
 .../networkservices/go_EdgeCacheOrigin.yaml   |  3 +
 .../networkservices/go_EdgeCacheService.yaml  | 20 ++++++
 mmv1/products/notebooks/go_Instance.yaml      | 14 ++++
 mmv1/products/notebooks/go_Runtime.yaml       |  4 ++
 mmv1/products/osconfig/go_GuestPolicies.yaml  | 19 ++++++
 mmv1/products/oslogin/go_SSHPublicKey.yaml    |  1 +
 mmv1/products/privateca/go_Certificate.yaml   |  3 +
 .../privateca/go_CertificateAuthority.yaml    |  5 ++
 mmv1/products/pubsub/go_Topic.yaml            |  6 ++
 mmv1/products/pubsublite/go_Topic.yaml        |  1 +
 mmv1/products/redis/go_Instance.yaml          |  3 +
 mmv1/products/resourcemanager/go_Lien.yaml    |  5 ++
 .../secretmanager/go_SecretVersion.yaml       |  1 +
 .../securitycenter/go_FolderCustomModule.yaml |  1 +
 .../securitycenter/go_MuteConfig.yaml         |  1 +
 .../go_OrganizationCustomModule.yaml          |  1 +
 .../go_ProjectCustomModule.yaml               |  1 +
 ...erSecurityHealthAnalyticsCustomModule.yaml |  1 +
 ...onSecurityHealthAnalyticsCustomModule.yaml |  1 +
 ...ctSecurityHealthAnalyticsCustomModule.yaml |  1 +
 mmv1/products/securityposture/go_Posture.yaml |  1 +
 .../go_VPCServiceControls.yaml                |  3 +
 mmv1/products/spanner/go_Database.yaml        |  5 ++
 mmv1/products/spanner/go_Instance.yaml        |  7 ++
 mmv1/products/spanner/go_InstanceConfig.yaml  |  1 +
 mmv1/products/sql/go_Database.yaml            |  2 +
 mmv1/products/storage/go_Bucket.yaml          |  3 +
 .../go_DefaultObjectAccessControl.yaml        |  1 +
 mmv1/products/storage/go_HmacKey.yaml         |  2 +
 mmv1/products/storage/go_ManagedFolder.yaml   |  5 ++
 .../storage/go_ObjectAccessControl.yaml       |  1 +
 mmv1/products/tpu/go_Node.yaml                |  1 +
 .../vertexai/go_DeploymentResourcePool.yaml   |  1 +
 mmv1/products/vertexai/go_FeatureGroup.yaml   |  1 +
 .../vertexai/go_FeatureOnlineStore.yaml       |  3 +
 .../go_FeatureOnlineStoreFeatureview.yaml     |  1 +
 mmv1/products/vertexai/go_Index.yaml          |  3 +
 mmv1/products/vertexai/go_IndexEndpoint.yaml  |  1 +
 .../go_IndexEndpointDeployedIndex.yaml        |  6 ++
 mmv1/products/vmwareengine/go_Cluster.yaml    |  1 +
 .../vmwareengine/go_ExternalAccessRule.yaml   |  1 +
 .../vmwareengine/go_ExternalAddress.yaml      |  1 +
 mmv1/products/vmwareengine/go_Network.yaml    |  1 +
 .../workstations/go_WorkstationCluster.yaml   |  1 +
 .../workstations/go_WorkstationConfig.yaml    |  4 ++
 .../go/secret_manager_regional_secret.tf.tmpl |  1 -
 237 files changed, 1066 insertions(+), 7 deletions(-)

diff --git a/mmv1/description-copy.go b/mmv1/description-copy.go
index 715774252414..181fe1934a38 100644
--- a/mmv1/description-copy.go
+++ b/mmv1/description-copy.go
@@ -22,7 +22,7 @@ func CopyAllDescriptions(tempMode bool) {
 		"attributes:",
 	}
 
-	for i, id := range identifiers {
+	for _, id := range identifiers {
 		CopyText(id, tempMode)
 	}
 
@@ -35,9 +35,13 @@ func copyComments() {
 	log.Printf("Starting to copy comments from Ruby yaml files to Go yaml files")
 
 	renamedFields := map[string]string{
-		"skip_sweeper": "exclude_sweeper",
-		"skip_delete":  "exclude_delete",
-		"values":       "enum_values",
+		"skip_sweeper":           "exclude_sweeper",
+		"skip_delete":            "exclude_delete",
+		"skip_test":              "exclude_test",
+		"skip_import_test":       "exclude_import_test",
+		"skip_docs":              "exclude_docs",
+		"skip_attribution_label": "exclude_attribution_label",
+		"values":                 "enum_values",
 	}
 	var allProductFiles []string = make([]string, 0)
 	files, err := filepath.Glob("products/**/go_product.yaml")
diff --git a/mmv1/products/accesscontextmanager/go_AccessLevel.yaml b/mmv1/products/accesscontextmanager/go_AccessLevel.yaml
index 6222de4133a0..b659d38cde1c 100644
--- a/mmv1/products/accesscontextmanager/go_AccessLevel.yaml
+++ b/mmv1/products/accesscontextmanager/go_AccessLevel.yaml
@@ -13,6 +13,7 @@
 
 # Warning: This is a temporary file, and should not be edited directly
 ---
+# This is the singular of `AccessLevels`, any changes here should be made to `AccessLevels` as well
 name: 'AccessLevel'
 description: |
   An AccessLevel is a label that can be applied to requests to GCP services,
@@ -31,6 +32,11 @@ docs:
 id_format: '{{name}}'
 base_url: ''
 self_link: '{{name}}'
+# This is an unusual API, so we need to use a few fields to map the methods
+# to the right URL.
+# create_url is the Create URL
+# base_url is the Get and Delete and Patch URL. It is empty on purpose.
+# List won't work yet. It should share a URL with Create.
 create_url: '{{parent}}/accessLevels'
 update_verb: 'PATCH'
 update_mask: true
@@ -57,6 +63,7 @@ async:
 custom_code:
   encoder: 'templates/terraform/encoders/go/access_level_never_send_parent.go.tmpl'
   custom_import: 'templates/terraform/custom_import/go/set_access_policy_parent_from_self_link.go.tmpl'
+# Skipping the sweeper due to the non-standard base_url
 exclude_sweeper: true
 examples:
   - name: 'access_context_manager_access_level_basic'
@@ -65,6 +72,8 @@ examples:
       access_level_name: 'chromeos_no_lock'
     exclude_test: true
 parameters:
+  # Parent is a path parameter that _cannot_ be read or sent in the request at all.
+  # This must be done at the provider level.
   - name: 'parent'
     type: String
     description: |
@@ -111,6 +120,8 @@ properties:
         enum_values:
           - 'AND'
           - 'OR'
+      # All of the false defaults below here are omitted on purpose.
+      # Let's keep this as simple as possible, since they will all be set by the API.
       - name: 'conditions'
         type: Array
         description: |
diff --git a/mmv1/products/accesscontextmanager/go_AccessLevelCondition.yaml b/mmv1/products/accesscontextmanager/go_AccessLevelCondition.yaml
index ac68bbd4b4c0..2f55b8fb1c6c 100644
--- a/mmv1/products/accesscontextmanager/go_AccessLevelCondition.yaml
+++ b/mmv1/products/accesscontextmanager/go_AccessLevelCondition.yaml
@@ -37,6 +37,11 @@ docs:
 id_format: '{{access_level}}'
 base_url: ''
 self_link: '{{access_level}}'
+# This is an unusual API, so we need to use a few fields to map the methods
+# to the right URL.
+# create_url is the Create URL
+# base_url is the Get and Delete and Patch URL. It is empty on purpose.
+# List won't work yet. It should share a URL with Create.
 create_url: '{{access_level}}'
 create_verb: 'PATCH'
 update_mask: true
@@ -45,6 +50,7 @@ immutable: true
 mutex: '{{access_level}}'
 import_format:
   - '{{access_level}}'
+ # no unique way to specify
 exclude_import: true
 timeouts:
   insert_minutes: 20
@@ -73,6 +79,7 @@ nested_query:
   modify_by_patch: true
 custom_code:
 exclude_tgc: true
+# Skipping the sweeper due to the non-standard base_url and because this is fine-grained under AccessLevel
 exclude_sweeper: true
 examples:
   - name: 'access_context_manager_access_level_condition_basic'
diff --git a/mmv1/products/accesscontextmanager/go_AccessLevels.yaml b/mmv1/products/accesscontextmanager/go_AccessLevels.yaml
index cf5c5a1bc586..57c3340d7697 100644
--- a/mmv1/products/accesscontextmanager/go_AccessLevels.yaml
+++ b/mmv1/products/accesscontextmanager/go_AccessLevels.yaml
@@ -13,6 +13,7 @@
 
 # Warning: This is a temporary file, and should not be edited directly
 ---
+# This is the plural of `AccessLevel`, any changes here should be made to `AccessLevel` as well
 name: 'AccessLevels'
 description: |
   Replace all existing Access Levels in an Access Policy with the Access Levels provided. This is done atomically.
@@ -57,6 +58,7 @@ async:
 custom_code:
   custom_delete: 'templates/terraform/custom_delete/go/replace_all_access_levels_empty_list.go.tmpl'
   custom_import: 'templates/terraform/custom_import/go/set_access_policy_parent_from_access_policy.go.tmpl'
+# Skipping the sweeper due to the non-standard base_url
 exclude_sweeper: true
 examples:
   - name: 'access_context_manager_access_levels_basic'
@@ -66,6 +68,8 @@ examples:
       access_level_name2: 'mac_no_lock'
     exclude_test: true
 parameters:
+  # Parent is a path parameter that _cannot_ be read or sent in the request at all.
+  # This must be done at the provider level.
   - name: 'parent'
     type: String
     description: |
@@ -105,6 +109,8 @@ properties:
           type: NestedObject
           description: |
             A set of predefined conditions for the access level and a combining function.
+          # conflicts:
+          #   - custom
           properties:
             - name: 'combiningFunction'
               type: Enum
@@ -119,6 +125,8 @@ properties:
               enum_values:
                 - 'AND'
                 - 'OR'
+            # All of the false defaults below here are omitted on purpose.
+            # Let's keep this as simple as possible, since they will all be set by the API.
             - name: 'conditions'
               type: Array
               description: |
@@ -282,6 +290,8 @@ properties:
           description: |
             Custom access level conditions are set using the Cloud Common Expression Language to represent the necessary conditions for the level to apply to a request.
             See CEL spec at: https://github.com/google/cel-spec.
+          # conflicts:
+          #   - basic
           properties:
             - name: 'expr'
               type: NestedObject
diff --git a/mmv1/products/accesscontextmanager/go_AccessPolicy.yaml b/mmv1/products/accesscontextmanager/go_AccessPolicy.yaml
index c2aed810f9c0..eea5576d488e 100644
--- a/mmv1/products/accesscontextmanager/go_AccessPolicy.yaml
+++ b/mmv1/products/accesscontextmanager/go_AccessPolicy.yaml
@@ -67,6 +67,7 @@ iam_policy:
     - '{{name}}'
 custom_code:
   post_create: 'templates/terraform/post_create/go/accesspolicy.tmpl'
+# Skipping the sweeper due to the non-standard base_url
 exclude_sweeper: true
 examples:
   - name: 'access_context_manager_access_policy_basic'
diff --git a/mmv1/products/accesscontextmanager/go_AuthorizedOrgsDesc.yaml b/mmv1/products/accesscontextmanager/go_AuthorizedOrgsDesc.yaml
index 7d9c7c3c0f7c..2f8c75feaab0 100644
--- a/mmv1/products/accesscontextmanager/go_AuthorizedOrgsDesc.yaml
+++ b/mmv1/products/accesscontextmanager/go_AuthorizedOrgsDesc.yaml
@@ -61,6 +61,7 @@ custom_code:
   post_create: 'templates/terraform/post_create/go/sleep_2_min.go.tmpl'
   pre_update: 'templates/terraform/update_mask.go.tmpl'
   custom_import: 'templates/terraform/custom_import/go/set_access_policy_parent_from_self_link.go.tmpl'
+# Skipping the sweeper due to the non-standard base_url
 exclude_sweeper: true
 examples:
   - name: 'access_context_manager_authorized_orgs_desc_basic'
diff --git a/mmv1/products/accesscontextmanager/go_EgressPolicy.yaml b/mmv1/products/accesscontextmanager/go_EgressPolicy.yaml
index ad68fce5a52c..4894e4367b37 100644
--- a/mmv1/products/accesscontextmanager/go_EgressPolicy.yaml
+++ b/mmv1/products/accesscontextmanager/go_EgressPolicy.yaml
@@ -59,6 +59,7 @@ nested_query:
 custom_code:
   custom_import: 'templates/terraform/custom_import/go/access_context_manager_service_perimeter_egress_policy.go.tmpl'
 exclude_tgc: true
+# Skipping the sweeper due to the non-standard base_url and because this is fine-grained under ServicePerimeter/IngressPolicy
 exclude_sweeper: true
 parameters:
   - name: 'egressPolicyName'
diff --git a/mmv1/products/accesscontextmanager/go_GcpUserAccessBinding.yaml b/mmv1/products/accesscontextmanager/go_GcpUserAccessBinding.yaml
index 67ffbce593b4..6ecbf3ca748a 100644
--- a/mmv1/products/accesscontextmanager/go_GcpUserAccessBinding.yaml
+++ b/mmv1/products/accesscontextmanager/go_GcpUserAccessBinding.yaml
@@ -61,6 +61,8 @@ examples:
       cust_id: 'CUST_ID'
     exclude_test: true
 parameters:
+  # Parent is a path parameter that _cannot_ be read or sent in the request at all.
+  # This must be done at the provider level.
   - name: 'organizationId'
     type: String
     description: |
diff --git a/mmv1/products/accesscontextmanager/go_IngressPolicy.yaml b/mmv1/products/accesscontextmanager/go_IngressPolicy.yaml
index 8825c458dc64..660b3ce850f2 100644
--- a/mmv1/products/accesscontextmanager/go_IngressPolicy.yaml
+++ b/mmv1/products/accesscontextmanager/go_IngressPolicy.yaml
@@ -59,6 +59,7 @@ nested_query:
 custom_code:
   custom_import: 'templates/terraform/custom_import/go/access_context_manager_service_perimeter_ingress_policy.go.tmpl'
 exclude_tgc: true
+# Skipping the sweeper due to the non-standard base_url and because this is fine-grained under ServicePerimeter/IngressPolicy
 exclude_sweeper: true
 parameters:
   - name: 'ingressPolicyName'
diff --git a/mmv1/products/accesscontextmanager/go_ServicePerimeter.yaml b/mmv1/products/accesscontextmanager/go_ServicePerimeter.yaml
index 50f505efbcbe..abc47eb3911a 100644
--- a/mmv1/products/accesscontextmanager/go_ServicePerimeter.yaml
+++ b/mmv1/products/accesscontextmanager/go_ServicePerimeter.yaml
@@ -13,6 +13,7 @@
 
 # Warning: This is a temporary file, and should not be edited directly
 ---
+# This is the singular of `ServicePerimeters`, any changes here should be made to `ServicePerimeters` as well
 name: 'ServicePerimeter'
 description: |
   ServicePerimeter describes a set of GCP resources which can freely import
@@ -38,6 +39,11 @@ docs:
 id_format: '{{name}}'
 base_url: ''
 self_link: '{{name}}'
+# This is an unusual API, so we need to use a few fields to map the methods
+# to the right URL.
+# create_url is the Create URL
+# base_url is the Get and Delete and Patch URL. It is empty on purpose.
+# List won't work yet. It should share a URL with Create.
 create_url: '{{parent}}/servicePerimeters'
 update_verb: 'PATCH'
 update_mask: true
@@ -65,6 +71,7 @@ async:
 custom_code:
   encoder: 'templates/terraform/encoders/go/access_level_never_send_parent.go.tmpl'
   custom_import: 'templates/terraform/custom_import/go/set_access_policy_parent_from_self_link.go.tmpl'
+# Skipping the sweeper due to the non-standard base_url
 exclude_sweeper: true
 examples:
   - name: 'access_context_manager_service_perimeter_basic'
@@ -84,6 +91,8 @@ examples:
       service_perimeter_name: 'restrict_bigquery_dryrun_storage'
     exclude_test: true
 parameters:
+  # Parent is a path parameter that _cannot_ be read or sent in the request at all.
+  # This must be done at the provider level.
   - name: 'parent'
     type: String
     description: |
diff --git a/mmv1/products/accesscontextmanager/go_ServicePerimeterDryRunEgressPolicy.yaml b/mmv1/products/accesscontextmanager/go_ServicePerimeterDryRunEgressPolicy.yaml
index 61416d9e26b5..1dea303179ef 100644
--- a/mmv1/products/accesscontextmanager/go_ServicePerimeterDryRunEgressPolicy.yaml
+++ b/mmv1/products/accesscontextmanager/go_ServicePerimeterDryRunEgressPolicy.yaml
@@ -76,6 +76,7 @@ custom_code:
   pre_delete: 'templates/terraform/pre_create/go/access_context_manager_dry_run_resource.go.tmpl'
   custom_import: 'templates/terraform/custom_import/go/access_context_manager_service_perimeter_ingress_policy.go.tmpl'
 exclude_tgc: true
+# Skipping the sweeper due to the non-standard base_url and because this is fine-grained under ServicePerimeter
 exclude_sweeper: true
 examples:
   - name: 'access_context_manager_service_perimeter_dry_run_egress_policy'
diff --git a/mmv1/products/accesscontextmanager/go_ServicePerimeterDryRunIngressPolicy.yaml b/mmv1/products/accesscontextmanager/go_ServicePerimeterDryRunIngressPolicy.yaml
index b39a45b33606..cf6dd439c94e 100644
--- a/mmv1/products/accesscontextmanager/go_ServicePerimeterDryRunIngressPolicy.yaml
+++ b/mmv1/products/accesscontextmanager/go_ServicePerimeterDryRunIngressPolicy.yaml
@@ -77,6 +77,7 @@ custom_code:
   pre_delete: 'templates/terraform/pre_create/go/access_context_manager_dry_run_resource.go.tmpl'
   custom_import: 'templates/terraform/custom_import/go/access_context_manager_service_perimeter_ingress_policy.go.tmpl'
 exclude_tgc: true
+# Skipping the sweeper due to the non-standard base_url and because this is fine-grained under ServicePerimeter
 exclude_sweeper: true
 examples:
   - name: 'access_context_manager_service_perimeter_dry_run_ingress_policy'
diff --git a/mmv1/products/accesscontextmanager/go_ServicePerimeterDryRunResource.yaml b/mmv1/products/accesscontextmanager/go_ServicePerimeterDryRunResource.yaml
index 85829795f983..0be705bbae19 100644
--- a/mmv1/products/accesscontextmanager/go_ServicePerimeterDryRunResource.yaml
+++ b/mmv1/products/accesscontextmanager/go_ServicePerimeterDryRunResource.yaml
@@ -78,6 +78,7 @@ custom_code:
   pre_delete: 'templates/terraform/pre_create/go/access_context_manager_dry_run_resource.go.tmpl'
   custom_import: 'templates/terraform/custom_import/go/access_context_manager_service_perimeter_resource.go.tmpl'
 exclude_tgc: true
+# Skipping the sweeper due to the non-standard base_url and because this is fine-grained under ServicePerimeter
 exclude_sweeper: true
 examples:
   - name: 'access_context_manager_service_perimeter_dry_run_resource_basic'
diff --git a/mmv1/products/accesscontextmanager/go_ServicePerimeterEgressPolicy.yaml b/mmv1/products/accesscontextmanager/go_ServicePerimeterEgressPolicy.yaml
index 4602a7ccb364..40283a310426 100644
--- a/mmv1/products/accesscontextmanager/go_ServicePerimeterEgressPolicy.yaml
+++ b/mmv1/products/accesscontextmanager/go_ServicePerimeterEgressPolicy.yaml
@@ -73,6 +73,7 @@ nested_query:
 custom_code:
   custom_import: 'templates/terraform/custom_import/go/access_context_manager_service_perimeter_ingress_policy.go.tmpl'
 exclude_tgc: true
+# Skipping the sweeper due to the non-standard base_url and because this is fine-grained under ServicePerimeter
 exclude_sweeper: true
 examples:
   - name: 'access_context_manager_service_perimeter_egress_policy'
diff --git a/mmv1/products/accesscontextmanager/go_ServicePerimeterIngressPolicy.yaml b/mmv1/products/accesscontextmanager/go_ServicePerimeterIngressPolicy.yaml
index 2a820ad6e6a3..7bdfa9623697 100644
--- a/mmv1/products/accesscontextmanager/go_ServicePerimeterIngressPolicy.yaml
+++ b/mmv1/products/accesscontextmanager/go_ServicePerimeterIngressPolicy.yaml
@@ -74,6 +74,7 @@ nested_query:
 custom_code:
   custom_import: 'templates/terraform/custom_import/go/access_context_manager_service_perimeter_ingress_policy.go.tmpl'
 exclude_tgc: true
+# Skipping the sweeper due to the non-standard base_url and because this is fine-grained under ServicePerimeter
 exclude_sweeper: true
 examples:
   - name: 'access_context_manager_service_perimeter_ingress_policy'
diff --git a/mmv1/products/accesscontextmanager/go_ServicePerimeterResource.yaml b/mmv1/products/accesscontextmanager/go_ServicePerimeterResource.yaml
index 83920287e774..e0a8248568eb 100644
--- a/mmv1/products/accesscontextmanager/go_ServicePerimeterResource.yaml
+++ b/mmv1/products/accesscontextmanager/go_ServicePerimeterResource.yaml
@@ -75,6 +75,7 @@ nested_query:
 custom_code:
   custom_import: 'templates/terraform/custom_import/go/access_context_manager_service_perimeter_resource.go.tmpl'
 exclude_tgc: true
+# Skipping the sweeper due to the non-standard base_url and because this is fine-grained under ServicePerimeter
 exclude_sweeper: true
 examples:
   - name: 'access_context_manager_service_perimeter_resource_basic'
diff --git a/mmv1/products/accesscontextmanager/go_ServicePerimeters.yaml b/mmv1/products/accesscontextmanager/go_ServicePerimeters.yaml
index f731f1104c21..5e3f3e16994b 100644
--- a/mmv1/products/accesscontextmanager/go_ServicePerimeters.yaml
+++ b/mmv1/products/accesscontextmanager/go_ServicePerimeters.yaml
@@ -13,6 +13,7 @@
 
 # Warning: This is a temporary file, and should not be edited directly
 ---
+ # This is the plural of `ServicePerimeter`, any changes here should be made to `ServicePerimeter` as well
 name: 'ServicePerimeters'
 description: |
   Replace all existing Service Perimeters in an Access Policy with the Service Perimeters provided. This is done atomically.
@@ -51,6 +52,7 @@ async:
 custom_code:
   custom_delete: 'templates/terraform/custom_delete/go/replace_all_service_perimeters_empty_list.go.tmpl'
   custom_import: 'templates/terraform/custom_import/go/set_access_policy_parent_from_access_policy.go.tmpl'
+# Skipping the sweeper due to the non-standard base_url
 exclude_sweeper: true
 examples:
   - name: 'access_context_manager_service_perimeters_basic'
@@ -60,6 +62,8 @@ examples:
       service_perimeter_name: 'restrict_storage'
     exclude_test: true
 parameters:
+  # Parent is a path parameter that _cannot_ be read or sent in the request at all.
+  # This must be done at the provider level.
   - name: 'parent'
     type: String
     description: |
@@ -144,6 +148,12 @@ properties:
                 Currently only projects are allowed.
                 Format: projects/{project_number}
               is_set: true
+              # TODO: (mbang) won't work for arrays yet, uncomment here once they are supported.
+              # (github.com/hashicorp/terraform-plugin-sdk/issues/470)
+              # at_least_one_of:
+              #   - status.0.resources
+              #   - status.0.access_levels
+              #   - status.0.restricted_services
               item_type:
                 type: String
             - name: 'accessLevels'
@@ -160,6 +170,12 @@ properties:
 
                 Format: accessPolicies/{policy_id}/accessLevels/{access_level_name}
               is_set: true
+              # TODO: (mbang) won't work for arrays yet, uncomment here once they are supported.
+              # (github.com/hashicorp/terraform-plugin-sdk/issues/470)
+              # at_least_one_of:
+              #   - spec.0.resources
+              #   - spec.0.access_levels
+              #   - spec.0.restricted_services
               item_type:
                 type: String
             - name: 'restrictedServices'
@@ -171,6 +187,12 @@ properties:
                 buckets inside the perimeter must meet the perimeter's access
                 restrictions.
               is_set: true
+              # TODO: (mbang) won't work for arrays yet, uncomment here once they are supported.
+              # (github.com/hashicorp/terraform-plugin-sdk/issues/470)
+              # at_least_one_of:
+              #   - spec.0.resources
+              #   - spec.0.access_levels
+              #   - spec.0.restricted_services
               item_type:
                 type: String
             - name: 'vpcAccessibleServices'
@@ -437,6 +459,12 @@ properties:
                 A list of GCP resources that are inside of the service perimeter.
                 Currently only projects are allowed.
                 Format: projects/{project_number}
+              # TODO: (mbang) won't work for arrays yet, uncomment here once they are supported.
+              # (github.com/hashicorp/terraform-plugin-sdk/issues/470)
+              # at_least_one_of:
+              #   - spec.0.resources
+              #   - spec.0.access_levels
+              #   - spec.0.restricted_services
               is_set: true
               item_type:
                 type: String
diff --git a/mmv1/products/activedirectory/go_Domain.yaml b/mmv1/products/activedirectory/go_Domain.yaml
index 603ee52e4659..178f80abb609 100644
--- a/mmv1/products/activedirectory/go_Domain.yaml
+++ b/mmv1/products/activedirectory/go_Domain.yaml
@@ -27,6 +27,7 @@ self_link: '{{name}}'
 create_url: 'projects/{{project}}/locations/global/domains?domainName={{domain_name}}'
 update_verb: 'PATCH'
 update_mask: true
+ # equivalent to {{name}}, but makes sweepers work
 delete_url: 'projects/{{project}}/locations/global/domains/{{domain_name}}'
 import_format:
   - '{{name}}'
@@ -42,6 +43,7 @@ async:
     base_url: '{{op_id}}'
     path: 'name'
     wait_ms: 1000
+      # It takes about 35-40 mins to get the resource created
     timeouts:
       insert_minutes: 60
       update_minutes: 60
@@ -63,6 +65,9 @@ examples:
     primary_resource_id: 'ad-domain'
     vars:
       name: 'myorg'
+      # the part of the domain before the first "." must be <15 chars, and
+      # the random suffix is 10 chars. In order to make sure these get swept,
+      # 'tfgen' is the only option here.
       domain_name: 'tfgen'
     ignore_read_extra:
       - 'deletion_protection'
diff --git a/mmv1/products/activedirectory/go_DomainTrust.yaml b/mmv1/products/activedirectory/go_DomainTrust.yaml
index ebf71c09f3dc..60b0e94df18d 100644
--- a/mmv1/products/activedirectory/go_DomainTrust.yaml
+++ b/mmv1/products/activedirectory/go_DomainTrust.yaml
@@ -27,6 +27,7 @@ self_link: 'projects/{{project}}/locations/global/domains/{{domain}}'
 create_url: 'projects/{{project}}/locations/global/domains/{{domain}}:attachTrust'
 update_url: 'projects/{{project}}/locations/global/domains/{{domain}}:reconfigureTrust'
 update_verb: 'POST'
+  # Resource custom delete function needs to be modified any time when the resource schema is edited
 delete_url: 'projects/{{project}}/locations/global/domains/{{domain}}:detachTrust'
 delete_verb: 'POST'
 import_format:
@@ -60,6 +61,7 @@ custom_code:
   encoder: 'templates/terraform/encoders/go/active_directory_domain_trust.go.tmpl'
   update_encoder: 'templates/terraform/update_encoder/go/active_directory_domain_trust.go.tmpl'
   decoder: 'templates/terraform/decoders/go/unwrap_resource.go.tmpl'
+    # Delete function needs to be modified any time when the resource schema is edited
   custom_delete: 'templates/terraform/custom_delete/go/active_directory_domain_trust.go.tmpl'
 examples:
   - name: 'active_directory_domain_trust_basic'
diff --git a/mmv1/products/alloydb/go_Cluster.yaml b/mmv1/products/alloydb/go_Cluster.yaml
index 70aa5ed847a0..668c7a570a59 100644
--- a/mmv1/products/alloydb/go_Cluster.yaml
+++ b/mmv1/products/alloydb/go_Cluster.yaml
@@ -65,6 +65,7 @@ custom_code:
   pre_create: 'templates/terraform/pre_create/go/alloydb_cluster.go.tmpl'
   pre_update: 'templates/terraform/pre_update/go/alloydb_cluster.go.tmpl'
   pre_delete: 'templates/terraform/pre_delete/go/alloydb_cluster.go.tmpl'
+# Skipping the sweeper because we need to force-delete clusters.
 exclude_sweeper: true
 examples:
   - name: 'alloydb_cluster_basic'
diff --git a/mmv1/products/alloydb/go_Instance.yaml b/mmv1/products/alloydb/go_Instance.yaml
index b760ce55bf6e..2b660e0e30be 100644
--- a/mmv1/products/alloydb/go_Instance.yaml
+++ b/mmv1/products/alloydb/go_Instance.yaml
@@ -57,6 +57,7 @@ custom_code:
   pre_create: 'templates/terraform/pre_create/go/alloydb_instance.go.tmpl'
   pre_delete: 'templates/terraform/pre_delete/go/alloydb_instance.go.tmpl'
   custom_import: 'templates/terraform/custom_import/go/alloydb_instance.go.tmpl'
+# Skipping the sweeper because instances will be deleted during cluster sweeps
 exclude_sweeper: true
 examples:
   - name: 'alloydb_instance_basic'
diff --git a/mmv1/products/alloydb/go_User.yaml b/mmv1/products/alloydb/go_User.yaml
index 52abd2e5c4dc..08b25010d222 100644
--- a/mmv1/products/alloydb/go_User.yaml
+++ b/mmv1/products/alloydb/go_User.yaml
@@ -34,6 +34,7 @@ timeouts:
 autogen_async: true
 custom_code:
   custom_import: 'templates/terraform/custom_import/go/alloydb_user.go.tmpl'
+# Skipping the sweeper because instances will be deleted during cluster sweeps
 exclude_sweeper: true
 examples:
   - name: 'alloydb_user_builtin'
diff --git a/mmv1/products/apigateway/go_ApiConfig.yaml b/mmv1/products/apigateway/go_ApiConfig.yaml
index c6c66f3ece3d..e5098a29a65d 100644
--- a/mmv1/products/apigateway/go_ApiConfig.yaml
+++ b/mmv1/products/apigateway/go_ApiConfig.yaml
@@ -70,6 +70,7 @@ custom_code:
 examples:
   - name: 'apigateway_api_config_basic'
     primary_resource_id: 'api_cfg'
+    # Need to pass 2 ids into a Sprintf - parent resource id also needed to identify primary resource
     primary_resource_name: 'fmt.Sprintf("tf-test-my-api%s", context["random_suffix"]), fmt.Sprintf("tf-test-my-config%s", context["random_suffix"])'
     min_version: 'beta'
     vars:
diff --git a/mmv1/products/apigee/go_EnvKeystore.yaml b/mmv1/products/apigee/go_EnvKeystore.yaml
index a179e359d276..c62c5abe99e2 100644
--- a/mmv1/products/apigee/go_EnvKeystore.yaml
+++ b/mmv1/products/apigee/go_EnvKeystore.yaml
@@ -29,6 +29,7 @@ immutable: true
 import_format:
   - '{{env_id}}/keystores/{{name}}'
   - '{{env_id}}/{{name}}'
+      # Resource creation race
 timeouts:
   insert_minutes: 1
   update_minutes: 20
@@ -38,6 +39,8 @@ custom_code:
   custom_import: 'templates/terraform/custom_import/go/apigee_environment_keystore.go.tmpl'
 exclude_sweeper: true
 examples:
+  # This is a more verbose version of the above that creates all
+  # the resources needed for the acceptance test.
   - name: 'apigee_environment_keystore_test'
     primary_resource_id: 'apigee_environment_keystore'
     test_env_vars:
diff --git a/mmv1/products/apigee/go_EnvReferences.yaml b/mmv1/products/apigee/go_EnvReferences.yaml
index c8dafecf0b1e..1c02ceff31a1 100644
--- a/mmv1/products/apigee/go_EnvReferences.yaml
+++ b/mmv1/products/apigee/go_EnvReferences.yaml
@@ -29,6 +29,7 @@ immutable: true
 import_format:
   - '{{env_id}}/references/{{name}}'
   - '{{env_id}}/{{name}}'
+      # Resource creation race
 timeouts:
   insert_minutes: 1
   update_minutes: 20
@@ -38,6 +39,8 @@ custom_code:
   custom_import: 'templates/terraform/custom_import/go/apigee_environment_reference.go.tmpl'
 exclude_sweeper: true
 examples:
+  # This is a more verbose version of the above that creates all
+  # the resources needed for the acceptance test.
   - name: 'apigee_environment_reference_test'
     primary_resource_id: 'apigee_environment_reference'
     test_env_vars:
diff --git a/mmv1/products/apigee/go_EnvgroupAttachment.yaml b/mmv1/products/apigee/go_EnvgroupAttachment.yaml
index 5e4333f35730..092af54ff581 100644
--- a/mmv1/products/apigee/go_EnvgroupAttachment.yaml
+++ b/mmv1/products/apigee/go_EnvgroupAttachment.yaml
@@ -52,6 +52,8 @@ custom_code:
 exclude_sweeper: true
 examples:
   - name: 'apigee_environment_group_attachment_basic'
+      # This is a more verbose version of the above that creates all
+      # the resources needed for the acceptance test.
     vars:
       project_id: 'my-project'
       envgroup_name: 'my-envgroup'
diff --git a/mmv1/products/apigee/go_InstanceAttachment.yaml b/mmv1/products/apigee/go_InstanceAttachment.yaml
index bb3ea8e3170a..0a1cef6c1414 100644
--- a/mmv1/products/apigee/go_InstanceAttachment.yaml
+++ b/mmv1/products/apigee/go_InstanceAttachment.yaml
@@ -50,6 +50,7 @@ async:
     message: 'message'
 custom_code:
   custom_import: 'templates/terraform/custom_import/go/apigee_instance_attachment.go.tmpl'
+# Skipping the sweeper due to the non-standard instance_id
 exclude_sweeper: true
 examples:
   - name: 'apigee_instance_attachment_basic'
diff --git a/mmv1/products/apigee/go_KeystoresAliasesSelfSignedCert.yaml b/mmv1/products/apigee/go_KeystoresAliasesSelfSignedCert.yaml
index f65b3467f924..b14209330fa9 100644
--- a/mmv1/products/apigee/go_KeystoresAliasesSelfSignedCert.yaml
+++ b/mmv1/products/apigee/go_KeystoresAliasesSelfSignedCert.yaml
@@ -28,6 +28,7 @@ delete_url: 'organizations/{{org_id}}/environments/{{environment}}/keystores/{{k
 immutable: true
 import_format:
   - 'organizations/{{org_id}}/environments/{{environment}}/keystores/{{keystore}}/aliases/{{alias}}'
+# Resource creation race
 timeouts:
   insert_minutes: 30
   update_minutes: 20
@@ -37,6 +38,8 @@ custom_code:
   custom_import: 'templates/terraform/custom_import/go/apigee_env_keystore_alias_self_signed_cert.go.tmpl'
 exclude_sweeper: true
 examples:
+    # This is a more verbose version of the above that creates all
+    # the resources needed for the acceptance test.
   - name: 'apigee_env_keystore_alias_self_signed_cert'
     primary_resource_id: 'apigee_environment_keystore_ss_alias'
     vars:
@@ -47,6 +50,7 @@ examples:
     test_env_vars:
       org_id: 'ORG_ID'
       billing_account: 'BILLING_ACCT'
+    # Resource uses multipart boundary which by default is random
     skip_vcr: true
 parameters:
   - name: 'orgId'
diff --git a/mmv1/products/appengine/go_FlexibleAppVersion.yaml b/mmv1/products/appengine/go_FlexibleAppVersion.yaml
index 6a35b60a9b8d..77bcc059c282 100644
--- a/mmv1/products/appengine/go_FlexibleAppVersion.yaml
+++ b/mmv1/products/appengine/go_FlexibleAppVersion.yaml
@@ -328,6 +328,7 @@ properties:
             - 'REDIRECT_HTTP_RESPONSE_CODE_307'
         - name: 'script'
           type: NestedObject
+          # TODO (mbang): Exactly one of script, staticFiles, or apiEndpoint must be set
           description: |
             Executes a script to handle the requests that match this URL pattern.
             Only the auto value is supported for Node.js in the App Engine standard environment, for example "script:" "auto".
@@ -339,6 +340,7 @@ properties:
               required: true
         - name: 'staticFiles'
           type: NestedObject
+          # TODO (mbang): Exactly one of script, staticFiles, or apiEndpoint must be set
           description: |
             Files served directly to the user for a given URL, such as images, CSS stylesheets, or JavaScript source files.
             Static file handlers describe which files in the application directory are static files, and which URLs serve them.
diff --git a/mmv1/products/appengine/go_Service.yaml b/mmv1/products/appengine/go_Service.yaml
index e8ec7bec64ac..a120675a3d96 100644
--- a/mmv1/products/appengine/go_Service.yaml
+++ b/mmv1/products/appengine/go_Service.yaml
@@ -18,6 +18,7 @@ description: |
   A Service resource is a logical component of an application that can share state and communicate in a secure fashion with other services.
   For example, an application that handles customer requests might include separate services to handle tasks such as backend data analysis or API requests from mobile devices.
   Each service has a collection of versions that define a specific set of code used to implement the functionality of that service.
+# Used as a resource reference
 exclude: true
 references:
   guides:
diff --git a/mmv1/products/appengine/go_StandardAppVersion.yaml b/mmv1/products/appengine/go_StandardAppVersion.yaml
index 4f58b560c1b2..bfc1111ab787 100644
--- a/mmv1/products/appengine/go_StandardAppVersion.yaml
+++ b/mmv1/products/appengine/go_StandardAppVersion.yaml
@@ -13,6 +13,10 @@
 
 # Warning: This is a temporary file, and should not be edited directly
 ---
+# StandardAppVersion and FlexibleAppVersion use the same API endpoint (apps.services.versions)
+# They are split apart as some of the fields will are necessary for one and not the other, and
+# other fields may have different defaults.  However, some fields are the same.  If fixing a bug
+# in one, please check the other for the same fix.
 name: 'StandardAppVersion'
 description: |
   Standard App Version resource to create a new version of standard GAE Application.
@@ -186,6 +190,7 @@ properties:
             - 'REDIRECT_HTTP_RESPONSE_CODE_307'
         - name: 'script'
           type: NestedObject
+          # TODO (mbang): Exactly one of script, staticFiles, or apiEndpoint must be set
           description: |
             Executes a script to handle the requests that match this URL pattern.
             Only the auto value is supported for Node.js in the App Engine standard environment, for example "script:" "auto".
@@ -197,6 +202,7 @@ properties:
               required: true
         - name: 'staticFiles'
           type: NestedObject
+          # TODO (mbang): Exactly one of script, staticFiles, or apiEndpoint must be set
           description: |
             Files served directly to the user for a given URL, such as images, CSS stylesheets, or JavaScript source files. Static file handlers describe which files in the application directory are static files, and which URLs serve them.
           properties:
@@ -360,6 +366,7 @@ properties:
     conflicts:
       - basic_scaling
       - manual_scaling
+    # This flattener is entirely handwritten and must be updated with **any** new field or subfield
     custom_flatten: 'templates/terraform/custom_flatten/go/appengine_standardappversion_automatic_scaling_handlenil.go.tmpl'
     properties:
       - name: 'maxConcurrentRequests'
@@ -441,5 +448,4 @@ properties:
 
           **Note:** When managing the number of instances at runtime through the App Engine Admin API or the (now deprecated) Python 2
           Modules API set_num_instances() you must use `lifecycle.ignore_changes = ["manual_scaling"[0].instances]` to prevent drift detection.
-
         required: true
diff --git a/mmv1/products/artifactregistry/go_Repository.yaml b/mmv1/products/artifactregistry/go_Repository.yaml
index 78f935f9d065..9c48e6b45b4b 100644
--- a/mmv1/products/artifactregistry/go_Repository.yaml
+++ b/mmv1/products/artifactregistry/go_Repository.yaml
@@ -50,6 +50,7 @@ async:
 iam_policy:
   method_name_separator: ':'
   allowed_iam_role: 'roles/artifactregistry.reader'
+    # TODO (camthornton): Change to repository_id in 4.0
   parent_resource_attribute: 'repository'
   base_url: 'projects/{{project}}/locations/{{location}}/repositories/{{name}}'
   example_config_body: 'templates/terraform/iam/go/iam_attributes.go.tmpl'
@@ -117,6 +118,8 @@ examples:
       secret_resource_id: 'example-remote-secret'
       username: 'remote-username'
       secret_data: 'remote-password'
+    # Ignore this field as it is INPUT_ONLY. AR will not return this in the
+    # response.
     ignore_read_extra:
       - 'remote_repository_config.0.disable_upstream_validation'
   - name: 'artifact_registry_repository_remote_docker_custom_with_auth'
@@ -129,6 +132,8 @@ examples:
       username: 'remote-username'
       secret_data: 'remote-password'
     ignore_read_extra:
+      # Ignore this field as it is INPUT_ONLY. AR will not return this in the
+      # response.
       - 'remote_repository_config.0.disable_upstream_validation'
   - name: 'artifact_registry_repository_remote_maven_custom_with_auth'
     primary_resource_id: 'my-repo'
@@ -140,6 +145,8 @@ examples:
       username: 'remote-username'
       secret_data: 'remote-password'
     ignore_read_extra:
+      # Ignore this field as it is INPUT_ONLY. AR will not return this in the
+      # response.
       - 'remote_repository_config.0.disable_upstream_validation'
   - name: 'artifact_registry_repository_remote_npm_custom_with_auth'
     primary_resource_id: 'my-repo'
@@ -151,6 +158,8 @@ examples:
       username: 'remote-username'
       secret_data: 'remote-password'
     ignore_read_extra:
+      # Ignore this field as it is INPUT_ONLY. AR will not return this in the
+      # response.
       - 'remote_repository_config.0.disable_upstream_validation'
   - name: 'artifact_registry_repository_remote_python_custom_with_auth'
     primary_resource_id: 'my-repo'
@@ -162,6 +171,8 @@ examples:
       username: 'remote-username'
       secret_data: 'remote-password'
     ignore_read_extra:
+      # Ignore this field as it is INPUT_ONLY. AR will not return this in the
+      # response.
       - 'remote_repository_config.0.disable_upstream_validation'
 parameters:
 properties:
@@ -246,6 +257,7 @@ properties:
       format type.
     allow_empty_object: true
     properties:
+      # Maven properties.
       - name: 'allowSnapshotOverwrites'
         type: Boolean
         description: |-
@@ -327,6 +339,7 @@ properties:
           type: NestedObject
           description: |-
             Policy condition for matching versions.
+          # TODO (jrsb): exactly_one_of: condition, mostRecentVersions
           properties:
             - name: 'tagState'
               type: Enum
@@ -370,6 +383,7 @@ properties:
           description: |-
             Policy condition for retaining a minimum number of versions. May only be
             specified with a Keep action.
+          # TODO (jrsb): exactly_one_of: condition, mostRecentVersions
           properties:
             - name: 'packageNamePrefixes'
               type: Array
@@ -449,6 +463,7 @@ properties:
             conflicts:
               - remoteRepositoryConfig.0.docker_repository.0.custom_repository
             custom_flatten: 'templates/terraform/custom_flatten/go/default_if_empty.tmpl'
+            # Eventually lets delete default_value and custom_flatten in a major release
             default_value: "DOCKER_HUB"
             enum_values:
               - 'DOCKER_HUB'
@@ -486,6 +501,7 @@ properties:
             conflicts:
               - remoteRepositoryConfig.0.maven_repository.0.custom_repository
             custom_flatten: 'templates/terraform/custom_flatten/go/default_if_empty.tmpl'
+            # Eventually lets delete default_value and custom_flatten in a major release
             default_value: "MAVEN_CENTRAL"
             enum_values:
               - 'MAVEN_CENTRAL'
@@ -523,6 +539,7 @@ properties:
             conflicts:
               - remoteRepositoryConfig.0.npm_repository.0.custom_repository
             custom_flatten: 'templates/terraform/custom_flatten/go/default_if_empty.tmpl'
+            # Eventually lets delete default_value and custom_flatten in a major release
             default_value: "NPMJS"
             enum_values:
               - 'NPMJS'
@@ -560,6 +577,7 @@ properties:
             conflicts:
               - remoteRepositoryConfig.0.python_repository.0.custom_repository
             custom_flatten: 'templates/terraform/custom_flatten/go/default_if_empty.tmpl'
+            # Eventually lets delete default_value and custom_flatten in a major release
             default_value: "PYPI"
             enum_values:
               - 'PYPI'
@@ -643,6 +661,8 @@ properties:
         description: |-
           If true, the remote repository upstream and upstream credentials will
           not be validated.
+        # Ignore read on this field because it is INPUT_ONLY.
+        # Need to use custom flatten because ignore_read doesn't work with nested fields.
         custom_flatten: 'templates/terraform/custom_flatten/go/artifactregistry_rr_disable_upstream_validation.go.tmpl'
   - name: 'cleanupPolicyDryRun'
     type: Boolean
diff --git a/mmv1/products/artifactregistry/go_VPCSCConfig.yaml b/mmv1/products/artifactregistry/go_VPCSCConfig.yaml
index 44e7a34a46be..acee47dde771 100644
--- a/mmv1/products/artifactregistry/go_VPCSCConfig.yaml
+++ b/mmv1/products/artifactregistry/go_VPCSCConfig.yaml
@@ -39,6 +39,7 @@ timeouts:
 async:
   actions: ['']
   type: 'OpAsync'
+  # necessary to compile
   operation:
     base_url: '{{op_id}}'
   result:
diff --git a/mmv1/products/backupdr/go_ManagementServer.yaml b/mmv1/products/backupdr/go_ManagementServer.yaml
index dfff40886359..aeec4ec97fd3 100644
--- a/mmv1/products/backupdr/go_ManagementServer.yaml
+++ b/mmv1/products/backupdr/go_ManagementServer.yaml
@@ -104,6 +104,7 @@ properties:
           default_value: "PRIVATE_SERVICE_ACCESS"
           enum_values:
             - 'PRIVATE_SERVICE_ACCESS'
+  ## outputs
   - name: 'oauth2ClientId'
     type: String
     description: |
diff --git a/mmv1/products/beyondcorp/go_AppGateway.yaml b/mmv1/products/beyondcorp/go_AppGateway.yaml
index ce6b17482dd0..4e241268ac3d 100644
--- a/mmv1/products/beyondcorp/go_AppGateway.yaml
+++ b/mmv1/products/beyondcorp/go_AppGateway.yaml
@@ -27,6 +27,7 @@ docs:
 base_url: 'projects/{{project}}/locations/{{region}}/appGateways'
 self_link: 'projects/{{project}}/locations/{{region}}/appGateways/{{name}}'
 create_url: 'projects/{{project}}/locations/{{region}}/appGateways?app_gateway_id={{name}}'
+# This resources is not updatable
 immutable: true
 timeouts:
   insert_minutes: 20
diff --git a/mmv1/products/bigquery/go_Job.yaml b/mmv1/products/bigquery/go_Job.yaml
index 49021a08eb1b..206be442b5f9 100644
--- a/mmv1/products/bigquery/go_Job.yaml
+++ b/mmv1/products/bigquery/go_Job.yaml
@@ -79,6 +79,7 @@ examples:
     primary_resource_id: 'job'
     vars:
       job_id: 'job_load'
+ # Keep small(er) to avoid downstream acctest having too-long a bucket name
       bucket_name: 'bq-geojson'
     test_env_vars:
       project: 'PROJECT_NAME'
@@ -225,11 +226,13 @@ properties:
               properties:
                 - name: 'resourceUri'
                   type: String
+                  # TODO (mbang): exactly_one_of: resourceUri, inlineCode
                   description:
                     'A code resource to load from a Google Cloud Storage URI
                     (gs://bucket/path).'
                 - name: 'inlineCode'
                   type: String
+                  # TODO (mbang): exactly_one_of: resourceUri, inlineCode
                   description: |
                     An inline resource that contains code for a user-defined function (UDF).
                     Providing a inline code resource is equivalent to providing a URI for a file containing the same code.
diff --git a/mmv1/products/bigquery/go_Routine.yaml b/mmv1/products/bigquery/go_Routine.yaml
index d32edae01f3c..820f9f60792f 100644
--- a/mmv1/products/bigquery/go_Routine.yaml
+++ b/mmv1/products/bigquery/go_Routine.yaml
@@ -158,6 +158,9 @@ properties:
             - 'IN'
             - 'OUT'
             - 'INOUT'
+        # This is a string instead of a NestedObject because schemas contain ColumnSchemas,
+        # which can contain nested StandardSqlDataType.
+        # We'll have people provide the json blob for the schema instead.
         - name: 'dataType'
           type: String
           description: |
diff --git a/mmv1/products/bigquery/go_Table.yaml b/mmv1/products/bigquery/go_Table.yaml
index 47bf6a9707a8..6aa09b83cc74 100644
--- a/mmv1/products/bigquery/go_Table.yaml
+++ b/mmv1/products/bigquery/go_Table.yaml
@@ -46,6 +46,8 @@ examples:
       dataset_id: 'dataset_id'
       table_id: 'table_id'
 parameters:
+  # TODO(alexstephen): Remove once we have support for placing
+  # nested object fields in URL
   - name: 'dataset'
     type: String
     description: Name of the dataset
@@ -162,6 +164,7 @@ properties:
                 function (UDF). Providing a inline code resource is
                 equivalent to providing a URI for a file containing the
                 same code.
+            # TODO: Convert into cross-product ResourceRef
             - name: 'resourceUri'
               type: String
               description: |
@@ -326,6 +329,8 @@ properties:
           - 'PARQUET'
           - 'ICEBERG'
           - 'DELTA_LAKE'
+      # TODO: Investigate if this is feasible as a ResourceRef
+      # This is a very complicated ResourceRef (one-to-many, where the many are cross-product).
       - name: 'sourceUris'
         type: Array
         description: |
diff --git a/mmv1/products/bigqueryanalyticshub/go_Listing.yaml b/mmv1/products/bigqueryanalyticshub/go_Listing.yaml
index 8df9c1449f62..ed980a56addc 100644
--- a/mmv1/products/bigqueryanalyticshub/go_Listing.yaml
+++ b/mmv1/products/bigqueryanalyticshub/go_Listing.yaml
@@ -41,6 +41,7 @@ iam_policy:
     - 'projects/{{project}}/locations/{{location}}/dataExchanges/{{data_exchange_id}}/listings/{{listing_id}}'
     - '{{listing_id}}'
 custom_code:
+# Skipping the sweeper due to the non-standard base_url
 exclude_sweeper: true
 examples:
   - name: 'bigquery_analyticshub_listing_basic'
diff --git a/mmv1/products/bigqueryconnection/go_Connection.yaml b/mmv1/products/bigqueryconnection/go_Connection.yaml
index 2ec68a1d7d0a..f273f84aee60 100644
--- a/mmv1/products/bigqueryconnection/go_Connection.yaml
+++ b/mmv1/products/bigqueryconnection/go_Connection.yaml
@@ -63,8 +63,10 @@ examples:
     test_vars_overrides:
       'deletion_protection': 'false'
     ignore_read_extra:
+ # password removed
       - 'cloud_sql.0.credential'
     external_providers: ["random", "time"]
+      # Random provider
     skip_vcr: true
   - name: 'bigquery_connection_full'
     primary_resource_id: 'connection'
@@ -76,8 +78,10 @@ examples:
     test_vars_overrides:
       'deletion_protection': 'false'
     ignore_read_extra:
+ # password removed
       - 'cloud_sql.0.credential'
     external_providers: ["random", "time"]
+      # Random provider
     skip_vcr: true
   - name: 'bigquery_connection_aws'
     primary_resource_id: 'connection'
@@ -122,6 +126,7 @@ examples:
       'kms_key_name': 'acctest.BootstrapKMSKey(t).CryptoKey.Name'
       'policyChanged': 'acctest.BootstrapPSARole(t, "bq-", "bigquery-encryption", "roles/cloudkms.cryptoKeyEncrypterDecrypter")'
     ignore_read_extra:
+ # password removed
       - 'cloud_sql.0.credential'
 parameters:
 properties:
diff --git a/mmv1/products/bigtable/go_AppProfile.yaml b/mmv1/products/bigtable/go_AppProfile.yaml
index 02e6df173b1e..a27468ef9708 100644
--- a/mmv1/products/bigtable/go_AppProfile.yaml
+++ b/mmv1/products/bigtable/go_AppProfile.yaml
@@ -51,6 +51,7 @@ examples:
       'deletion_protection': 'false'
     ignore_read_extra:
       - 'ignore_warnings'
+    # bigtable instance does not use the shared HTTP client, this test creates an instance
     skip_vcr: true
   - name: 'bigtable_app_profile_singlecluster'
     primary_resource_id: 'ap'
@@ -62,6 +63,7 @@ examples:
       'deletion_protection': 'false'
     ignore_read_extra:
       - 'ignore_warnings'
+    # bigtable instance does not use the shared HTTP client, this test creates an instance
     skip_vcr: true
   - name: 'bigtable_app_profile_multicluster'
     primary_resource_id: 'ap'
@@ -73,6 +75,7 @@ examples:
       'deletion_protection': 'false'
     ignore_read_extra:
       - 'ignore_warnings'
+    # bigtable instance does not use the shared HTTP client, this test creates an instance
     skip_vcr: true
   - name: 'bigtable_app_profile_priority'
     primary_resource_id: 'ap'
@@ -84,6 +87,7 @@ examples:
       'deletion_protection': 'false'
     ignore_read_extra:
       - 'ignore_warnings'
+    # bigtable instance does not use the shared HTTP client, this test creates an instance
     skip_vcr: true
 parameters:
   - name: 'appProfileId'
diff --git a/mmv1/products/binaryauthorization/go_Attestor.yaml b/mmv1/products/binaryauthorization/go_Attestor.yaml
index 9886d9253635..83d27fcaea1a 100644
--- a/mmv1/products/binaryauthorization/go_Attestor.yaml
+++ b/mmv1/products/binaryauthorization/go_Attestor.yaml
@@ -115,6 +115,7 @@ properties:
               default_from_api: true
             - name: 'asciiArmoredPgpPublicKey'
               type: String
+              # TODO (mbang): Exactly one of asciiArmoredPgpPublicKey or pkixPublicKey must be set
               description: |
                 ASCII-armored representation of a PGP public key, as the
                 entire output by the command
@@ -127,6 +128,7 @@ properties:
                 be overwritten by the API-calculated ID.
             - name: 'pkixPublicKey'
               type: NestedObject
+              # TODO (mbang): Exactly one of asciiArmoredPgpPublicKey or pkixPublicKey must be set
               description: |
                 A raw PKIX SubjectPublicKeyInfo format public key.
 
diff --git a/mmv1/products/certificatemanager/go_Certificate.yaml b/mmv1/products/certificatemanager/go_Certificate.yaml
index 82e1f6a4d775..e2632d05433b 100644
--- a/mmv1/products/certificatemanager/go_Certificate.yaml
+++ b/mmv1/products/certificatemanager/go_Certificate.yaml
@@ -228,6 +228,9 @@ properties:
           Either issuanceConfig or dnsAuthorizations should be specificed, but not both.
 
         immutable: true
+        # when the certificate is created with issuanceConfig in the format "projects/{{project_id}}/locations/global/certificateIssuanceConfigs/{{CICName}}", the
+        # format changes in the response message to "projects/{{project_number}}/locations/global/certificateIssuanceConfigs/{{CICName}}". That causes the tests to fail
+        # that's why "tpgresource.CompareResourceNames" is needed.
         diff_suppress_func: 'tpgresource.CompareResourceNames'
       - name: 'state'
         type: String
diff --git a/mmv1/products/certificatemanager/go_CertificateMapEntry.yaml b/mmv1/products/certificatemanager/go_CertificateMapEntry.yaml
index 94217838ffd0..dc9f20b31689 100644
--- a/mmv1/products/certificatemanager/go_CertificateMapEntry.yaml
+++ b/mmv1/products/certificatemanager/go_CertificateMapEntry.yaml
@@ -54,6 +54,7 @@ examples:
 parameters:
   - name: 'name'
     type: String
+      # url_param_only: true
     description: |
       A user-defined name of the Certificate Map Entry. Certificate Map Entry
       names must be unique globally and match pattern
diff --git a/mmv1/products/cloudbuild/go_Trigger.yaml b/mmv1/products/cloudbuild/go_Trigger.yaml
index d36831ca79ae..b142f4a5f337 100644
--- a/mmv1/products/cloudbuild/go_Trigger.yaml
+++ b/mmv1/products/cloudbuild/go_Trigger.yaml
@@ -23,10 +23,12 @@ references:
 docs:
   note: |
     You can retrieve the email of the Cloud Build Service Account used in jobs by using the `google_project_service_identity` resource.
+# For global triggers, the id format is changed to projects/{{project}}/triggers/{{trigger_id}} via code overrides.
 id_format: 'projects/{{project}}/locations/{{location}}/triggers/{{trigger_id}}'
 base_url: 'projects/{{project}}/locations/{{location}}/triggers'
 self_link: 'projects/{{project}}/locations/{{location}}/triggers/{{trigger_id}}'
 update_verb: 'PATCH'
+  # import by default only works with old-style self links ending in a name
 import_format:
   - 'projects/{{project}}/triggers/{{trigger_id}}'
   - 'projects/{{project}}/locations/{{location}}/triggers/{{trigger_id}}'
diff --git a/mmv1/products/cloudbuildv2/go_Repository.yaml b/mmv1/products/cloudbuildv2/go_Repository.yaml
index dd259bb269b3..5f1c97ee7464 100644
--- a/mmv1/products/cloudbuildv2/go_Repository.yaml
+++ b/mmv1/products/cloudbuildv2/go_Repository.yaml
@@ -41,6 +41,8 @@ custom_code:
 exclude_tgc: true
 legacy_long_form_project: true
 examples:
+# These tests depend on secrets stored in a separate project, so we prefer not
+# to show them in the docs.
   - name: 'cloudbuildv2_repository_ghe'
     primary_resource_id: 'primary'
     vars:
@@ -69,6 +71,7 @@ parameters:
     description: The location for the resource
     url_param_only: true
     immutable: true
+ # EXTRACT_FROM_FIELD_IF_EMPTY
     default_from_api: true
   - name: 'parent_connection'
     type: ResourceRef
diff --git a/mmv1/products/clouddomains/go_Registration.yaml b/mmv1/products/clouddomains/go_Registration.yaml
index aef7500edbec..bcd6e77d4527 100644
--- a/mmv1/products/clouddomains/go_Registration.yaml
+++ b/mmv1/products/clouddomains/go_Registration.yaml
@@ -29,6 +29,7 @@ id_format: 'projects/{{project}}/locations/{{location}}/registrations/{{domain_n
 base_url: 'projects/{{project}}/locations/{{location}}/registrations'
 self_link: 'projects/{{project}}/locations/{{location}}/registrations/{{domain_name}}'
 create_url: 'projects/{{project}}/locations/{{location}}/registrations:register'
+# Cannot be deleted
 exclude_delete: true
 immutable: true
 import_format:
@@ -245,6 +246,7 @@ properties:
           Warning: For new Registrations, the registrant receives an email confirmation that they must complete within 15 days to
           avoid domain suspension.
         required: true
+        # ignore read on phone and fax numbers. Need to use custom flatten because ignore_read doesn't work with nested fields
         custom_flatten: 'templates/terraform/custom_flatten/go/clouddomains_ignore_numbers_registrant.go.tmpl'
         properties:
           - name: 'email'
@@ -317,6 +319,7 @@ properties:
           Warning: For new Registrations, the registrant receives an email confirmation that they must complete within 15 days to
           avoid domain suspension.
         required: true
+        # ignore read on phone and fax numbers. Need to use custom flatten because ignore_read doesn't work with nested fields
         custom_flatten: 'templates/terraform/custom_flatten/go/clouddomains_ignore_numbers_admin.go.tmpl'
         properties:
           - name: 'email'
@@ -389,6 +392,7 @@ properties:
           Warning: For new Registrations, the registrant receives an email confirmation that they must complete within 15 days to
           avoid domain suspension.
         required: true
+        # ignore read on phone and fax numbers. Need to use custom flatten because ignore_read doesn't work with nested fields
         custom_flatten: 'templates/terraform/custom_flatten/go/clouddomains_ignore_numbers_technical.go.tmpl'
         properties:
           - name: 'email'
diff --git a/mmv1/products/cloudfunctions/go_CloudFunction.yaml b/mmv1/products/cloudfunctions/go_CloudFunction.yaml
index d1a1891774e0..e8ba6ea7a8b1 100644
--- a/mmv1/products/cloudfunctions/go_CloudFunction.yaml
+++ b/mmv1/products/cloudfunctions/go_CloudFunction.yaml
@@ -62,6 +62,10 @@ parameters:
     type: String
     description: The location of this cloud function.
     required: true
+    # This is not a real API field.
+    # This is a more user-centric way for users to specify
+    # that they want to use a HTTP Trigger rather than
+    # send httpsTrigger with an empty dictionary.
   - name: 'trigger_http'
     type: Boolean
     description: 'Use HTTP to trigger this function'
diff --git a/mmv1/products/cloudfunctions2/go_Function.yaml b/mmv1/products/cloudfunctions2/go_Function.yaml
index d87921508590..332e055661b1 100644
--- a/mmv1/products/cloudfunctions2/go_Function.yaml
+++ b/mmv1/products/cloudfunctions2/go_Function.yaml
@@ -40,6 +40,7 @@ async:
     base_url: '{{op_id}}'
     path: 'name'
     wait_ms: 1000
+    # It takes about 35-40 mins to get the resource created
     timeouts:
       insert_minutes: 60
       update_minutes: 60
@@ -74,6 +75,7 @@ examples:
     test_vars_overrides:
       'location': '"us-central1"'
       'zip_path': '"./test-fixtures/function-source.zip"'
+        # ignore these fields during import step
     ignore_read_extra:
       - 'build_config.0.source.0.storage_source.0.object'
       - 'build_config.0.source.0.storage_source.0.bucket'
@@ -91,6 +93,7 @@ examples:
       'zip_path': '"./test-fixtures/function-source-pubsub.zip"'
       'primary_resource_id': '"terraform-test"'
       'location': '"us-central1"'
+        # ignore these fields during import step
     ignore_read_extra:
       - 'build_config.0.source.0.storage_source.0.object'
       - 'build_config.0.source.0.storage_source.0.bucket'
@@ -107,6 +110,7 @@ examples:
       'primary_resource_id': '"terraform-test"'
       'location': '"us-central1"'
       'zip_path': '"./test-fixtures/function-source.zip"'
+        # ignore these fields during import step
     ignore_read_extra:
       - 'build_config.0.source.0.storage_source.0.object'
       - 'build_config.0.source.0.storage_source.0.bucket'
@@ -125,6 +129,7 @@ examples:
       'zip_path': '"./test-fixtures/function-source-eventarc-gcs.zip"'
       'primary_resource_id': '"terraform-test"'
       'policyChanged': 'acctest.BootstrapPSARole(t, "service-", "gcp-sa-pubsub", "roles/cloudkms.cryptoKeyEncrypterDecrypter")'
+        # ignore these fields during import step
     ignore_read_extra:
       - 'build_config.0.source.0.storage_source.0.object'
       - 'build_config.0.source.0.storage_source.0.bucket'
@@ -142,6 +147,7 @@ examples:
       'zip_path': '"./test-fixtures/function-source-eventarc-gcs.zip"'
       'primary_resource_id': '"terraform-test"'
       'policyChanged': 'acctest.BootstrapPSARole(t, "service-", "gcp-sa-pubsub", "roles/cloudkms.cryptoKeyEncrypterDecrypter")'
+        # ignore these fields during import step
     ignore_read_extra:
       - 'build_config.0.source.0.storage_source.0.object'
       - 'build_config.0.source.0.storage_source.0.bucket'
@@ -158,6 +164,7 @@ examples:
     test_vars_overrides:
       'location': '"us-central1"'
       'zip_path': '"./test-fixtures/function-source.zip"'
+        # ignore these fields during import step
     ignore_read_extra:
       - 'build_config.0.source.0.storage_source.0.object'
       - 'build_config.0.source.0.storage_source.0.bucket'
@@ -175,6 +182,7 @@ examples:
       'location': '"us-central1"'
       'zip_path': '"./test-fixtures/function-source.zip"'
       'policyChanged': 'acctest.BootstrapPSARole(t, "service-", "gcp-sa-pubsub", "roles/cloudkms.cryptoKeyEncrypterDecrypter")'
+        # ignore these fields during import step
     ignore_read_extra:
       - 'build_config.0.source.0.storage_source.0.object'
       - 'build_config.0.source.0.storage_source.0.bucket'
@@ -191,6 +199,7 @@ examples:
       'location': '"us-central1"'
       'zip_path': '"./test-fixtures/function-source.zip"'
       'policyChanged': 'acctest.BootstrapPSARole(t, "service-", "gcp-sa-pubsub", "roles/cloudkms.cryptoKeyEncrypterDecrypter")'
+        # ignore these fields during import step
     ignore_read_extra:
       - 'build_config.0.source.0.storage_source.0.object'
       - 'build_config.0.source.0.storage_source.0.bucket'
@@ -206,6 +215,7 @@ examples:
     test_vars_overrides:
       'location': '"us-central1"'
       'zip_path': '"./test-fixtures/function-source.zip"'
+        # ignore these fields during import step
     ignore_read_extra:
       - 'build_config.0.source.0.storage_source.0.object'
       - 'build_config.0.source.0.storage_source.0.bucket'
@@ -226,6 +236,7 @@ examples:
       'kms_key_name': 'acctest.BootstrapKMSKeyInLocation(t, "us-central1").CryptoKey.Name'
       'location': '"us-central1"'
       'zip_path': '"./test-fixtures/function-source.zip"'
+    # ignore these fields during import step
     ignore_read_extra:
       - 'build_config.0.source.0.storage_source.0.object'
       - 'build_config.0.source.0.storage_source.0.bucket'
@@ -259,6 +270,7 @@ examples:
       'zip_path': '"./test-fixtures/function-source-pubsub.zip"'
       'primary_resource_id': '"terraform-test"'
       'location': '"europe-west6"'
+        # ignore these fields during import step
     ignore_read_extra:
       - 'build_config.0.source.0.storage_source.0.object'
       - 'build_config.0.source.0.storage_source.0.bucket'
@@ -277,6 +289,7 @@ examples:
       'zip_path': '"./test-fixtures/function-source-pubsub.zip"'
       'primary_resource_id': '"terraform-test"'
       'location': '"europe-west6"'
+        # ignore these fields during import step
     ignore_read_extra:
       - 'build_config.0.source.0.storage_source.0.object'
       - 'build_config.0.source.0.storage_source.0.bucket'
diff --git a/mmv1/products/cloudrun/go_Service.yaml b/mmv1/products/cloudrun/go_Service.yaml
index e9fe84bd7e72..cd4b9a634396 100644
--- a/mmv1/products/cloudrun/go_Service.yaml
+++ b/mmv1/products/cloudrun/go_Service.yaml
@@ -157,6 +157,7 @@ properties:
       Is required when creating resources. Name is primarily intended
       for creation idempotence and configuration definition. Cannot be updated.
       More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+    # This is a convenience field as terraform expects `name` to be a top level property
     url_param_only: true
     required: true
     immutable: true
diff --git a/mmv1/products/cloudrunv2/go_Job.yaml b/mmv1/products/cloudrunv2/go_Job.yaml
index 23209dbbd24d..2e498df9a805 100644
--- a/mmv1/products/cloudrunv2/go_Job.yaml
+++ b/mmv1/products/cloudrunv2/go_Job.yaml
@@ -357,10 +357,16 @@ properties:
                         type: String
                         description: |-
                           Literal value of the environment variable. Defaults to "" and the maximum allowed length is 32768 characters. Variable references are not supported in Cloud Run.
+                        # exactly_one_of:
+                        #   - template.0.template.0.containers.0.env.0.value
+                        #   - template.0.template.0.containers.0.env.0.valueSource
                       - name: 'valueSource'
                         type: NestedObject
                         description: |-
                           Source for the environment variable's value.
+                        # exactly_one_of:
+                        #   - template.0.template.0.containers.0.env.0.value
+                        #   - template.0.template.0.containers.0.env.0.valueSource
                         properties:
                           - name: 'secretKeyRef'
                             type: NestedObject
@@ -442,6 +448,12 @@ properties:
                   type: NestedObject
                   description: |-
                     Secret represents a secret that should populate this volume. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
+                  # exactly_one_of:
+                  #   - template.0.template.0.volumes.0.secret
+                  #   - template.0.template.0.volumes.0.cloudSqlInstance
+                  #   - template.0.template.0.volumes.0.emptyDir
+                  #   - template.0.volumes.0.gcs
+                  #   - template.0.volumes.0.nfs
                   properties:
                     - name: 'secret'
                       type: String
@@ -477,6 +489,12 @@ properties:
                   type: NestedObject
                   description: |-
                     For Cloud SQL volumes, contains the specific instances that should be mounted. Visit https://cloud.google.com/sql/docs/mysql/connect-run for more information on how to connect Cloud SQL and Cloud Run.
+                  # exactly_one_of:
+                  #   - template.0.template.0.volumes.0.secret
+                  #   - template.0.template.0.volumes.0.cloudSqlInstance
+                  #   - template.0.template.0.volumes.0.emptyDir
+                  #   - template.0.volumes.0.gcs
+                  #   - template.0.volumes.0.nfs
                   properties:
                     - name: 'instances'
                       type: Array
@@ -489,6 +507,12 @@ properties:
                   description: |-
                     Ephemeral storage used as a shared volume.
                   min_version: 'beta'
+                  # exactly_one_of:
+                  #   - template.0.template.0.volumes.0.secret
+                  #   - template.0.template.0.volumes.0.cloudSqlInstance
+                  #   - template.0.template.0.volumes.0.emptyDir
+                  #   - template.0.volumes.0.gcs
+                  #   - template.0.volumes.0.nfs
                   properties:
                     - name: 'medium'
                       type: Enum
@@ -505,6 +529,12 @@ properties:
                   type: NestedObject
                   description: |-
                     Cloud Storage bucket mounted as a volume using GCSFuse.
+                  # exactly_one_of:
+                  #   - template.0.volumes.0.secret
+                  #   - template.0.volumes.0.cloudSqlInstance
+                  #   - template.0.volumes.0.emptyDir
+                  #   - template.0.volumes.0.gcs
+                  #   - template.0.volumes.0.nfs
                   properties:
                     - name: 'bucket'
                       type: String
@@ -519,6 +549,12 @@ properties:
                   type: NestedObject
                   description: |-
                     NFS share mounted as a volume.
+                  # exactly_one_of:
+                  #   - template.0.volumes.0.secret
+                  #   - template.0.volumes.0.cloudSqlInstance
+                  #   - template.0.volumes.0.emptyDir
+                  #   - template.0.volumes.0.gcs
+                  #   - template.0.volumes.0.nfs
                   properties:
                     - name: 'server'
                       type: String
diff --git a/mmv1/products/cloudrunv2/go_Service.yaml b/mmv1/products/cloudrunv2/go_Service.yaml
index 30cc4dbc0f09..ff0bc7cb52a6 100644
--- a/mmv1/products/cloudrunv2/go_Service.yaml
+++ b/mmv1/products/cloudrunv2/go_Service.yaml
@@ -130,6 +130,7 @@ examples:
       cloud_run_service_name: 'cloudrun-service'
     ignore_read_extra:
       - 'deletion_protection'
+    # Currently failing
     skip_vcr: true
   - name: 'cloudrunv2_service_mount_nfs'
     primary_resource_id: 'default'
@@ -138,6 +139,7 @@ examples:
       cloud_run_service_name: 'cloudrun-service'
     ignore_read_extra:
       - 'deletion_protection'
+    # Currently failing
     skip_vcr: true
   - name: 'cloudrunv2_service_mesh'
     primary_resource_id: 'default'
@@ -459,10 +461,16 @@ properties:
                     type: String
                     description: |-
                       Literal value of the environment variable. Defaults to "" and the maximum allowed length is 32768 characters. Variable references are not supported in Cloud Run.
+                    # exactly_one_of:
+                    #   - template.0.containers.0.env.0.value
+                    #   - template.0.containers.0.env.0.valueSource
                   - name: 'valueSource'
                     type: NestedObject
                     description: |-
                       Source for the environment variable's value.
+                    # exactly_one_of:
+                    #   - template.0.containers.0.env.0.value
+                    #   - template.0.containers.0.env.0.valueSource
                     properties:
                       - name: 'secretKeyRef'
                         type: NestedObject
@@ -570,6 +578,10 @@ properties:
                     HTTPGet specifies the http request to perform.
                   send_empty_value: true
                   allow_empty_object: true
+                  # exactly_one_of:
+                  #   - template.0.containers.0.startupProbe.0.httpGet
+                  #   - template.0.containers.0.startupProbe.0.tcpSocket
+                  #   - template.0.containers.0.startupProbe.0.grpc
                   properties:
                     - name: 'path'
                       type: String
@@ -698,6 +710,10 @@ properties:
                     TCPSocket specifies an action involving a TCP port. Exactly one of HTTPGet or TCPSocket must be specified.
                   send_empty_value: true
                   allow_empty_object: true
+                  # exactly_one_of:
+                  #   - template.0.containers.0.startupProbe.0.httpGet
+                  #   - template.0.containers.0.startupProbe.0.tcpSocket
+                  #   - template.0.containers.0.startupProbe.0.grpc
                   properties:
                     - name: 'port'
                       type: Integer
@@ -711,6 +727,10 @@ properties:
                     GRPC specifies an action involving a GRPC port.
                   send_empty_value: true
                   allow_empty_object: true
+                  # exactly_one_of:
+                  #   - template.0.containers.0.startupProbe.0.httpGet
+                  #   - template.0.containers.0.startupProbe.0.tcpSocket
+                  #   - template.0.containers.0.startupProbe.0.grpc
                   properties:
                     - name: 'port'
                       type: Integer
@@ -746,6 +766,10 @@ properties:
               type: NestedObject
               description: |-
                 Secret represents a secret that should populate this volume. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
+              # exactly_one_of:
+              #   - template.0.volumes.0.secret
+              #   - template.0.volumes.0.cloudSqlInstance
+              #   - template.0.volumes.0.emptyDir
               properties:
                 - name: 'secret'
                   type: String
@@ -780,6 +804,11 @@ properties:
               type: NestedObject
               description: |-
                 For Cloud SQL volumes, contains the specific instances that should be mounted. Visit https://cloud.google.com/sql/docs/mysql/connect-run for more information on how to connect Cloud SQL and Cloud Run.
+              # exactly_one_of:
+              #   - template.0.volumes.0.secret
+              #   - template.0.volumes.0.cloudSqlInstance
+              #   - template.0.volumes.0.emptyDir
+              #   - template.0.volumes.0.gcs
               properties:
                 - name: 'instances'
                   type: Array
@@ -793,6 +822,11 @@ properties:
               description: |-
                 Ephemeral storage used as a shared volume.
               min_version: 'beta'
+              # exactly_one_of:
+              #   - template.0.volumes.0.secret
+              #   - template.0.volumes.0.cloudSqlInstance
+              #   - template.0.volumes.0.emptyDir
+              #   - template.0.volumes.0.gcs
               properties:
                 - name: 'medium'
                   type: Enum
@@ -809,6 +843,11 @@ properties:
               type: NestedObject
               description: |-
                 Cloud Storage bucket mounted as a volume using GCSFuse. This feature is only supported in the gen2 execution environment.
+              # exactly_one_of:
+              #   - template.0.volumes.0.secret
+              #   - template.0.volumes.0.cloudSqlInstance
+              #   - template.0.volumes.0.emptyDir
+              #   - template.0.volumes.0.gcs
               properties:
                 - name: 'bucket'
                   type: String
diff --git a/mmv1/products/composer/go_UserWorkloadsConfigMap.yaml b/mmv1/products/composer/go_UserWorkloadsConfigMap.yaml
index 3fbf966eb003..2a47b1003352 100644
--- a/mmv1/products/composer/go_UserWorkloadsConfigMap.yaml
+++ b/mmv1/products/composer/go_UserWorkloadsConfigMap.yaml
@@ -20,10 +20,12 @@ description: |
 min_version: 'beta'
 references:
   guides:
+  # TODO: add v1 reference when this is moved to ga
   api: 'https://cloud.google.com/composer/docs/reference/rest/v1beta1/projects.locations.environments.userWorkloadsConfigMaps'
 docs:
 base_url: 'projects/{{project}}/locations/{{region}}/environments/{{environment}}/userWorkloadsConfigMaps'
 self_link: 'projects/{{project}}/locations/{{region}}/environments/{{environment}}/userWorkloadsConfigMaps/{{name}}'
+# Overrides one or more timeouts, in minutes. All timeouts default to 20.
 timeouts:
   insert_minutes: 1
   update_minutes: 1
diff --git a/mmv1/products/compute/go_Autoscaler.yaml b/mmv1/products/compute/go_Autoscaler.yaml
index d34abc20405f..566a016d5289 100644
--- a/mmv1/products/compute/go_Autoscaler.yaml
+++ b/mmv1/products/compute/go_Autoscaler.yaml
@@ -58,6 +58,8 @@ examples:
       instance_template_name: 'my-instance-template'
       target_pool_name: 'my-target-pool'
       igm_name: 'my-igm'
+        # Add test_vars_overrides and oics_vars_overrides to fix the failing test,
+        # which is caused by upgradting terraform-plugin-sdk to 2.24.0.
       provider_name: 'google-beta'
       provider_alias: ''
     test_vars_overrides:
diff --git a/mmv1/products/compute/go_BackendService.yaml b/mmv1/products/compute/go_BackendService.yaml
index e8b2fb83a159..daa0bb68b534 100644
--- a/mmv1/products/compute/go_BackendService.yaml
+++ b/mmv1/products/compute/go_BackendService.yaml
@@ -774,6 +774,9 @@ properties:
       [Choosing a load balancer](https://cloud.google.com/load-balancing/docs/backend-service).
     immutable: true
     default_value: "EXTERNAL"
+    # If you're modifying this value, it probably means Global ILB is now
+    # an option. If that's the case, all of the documentation is based on
+    # this resource supporting external load balancing only.
     enum_values:
       - 'EXTERNAL'
       - 'INTERNAL_SELF_MANAGED'
@@ -1189,6 +1192,7 @@ properties:
           - 'outlier_detection.0.success_rate_minimum_hosts'
           - 'outlier_detection.0.success_rate_request_volume'
           - 'outlier_detection.0.success_rate_stdev_factor'
+  # 'port' is deprecated
   - name: 'portName'
     type: String
     description: |
@@ -1204,6 +1208,7 @@ properties:
       types and may result in errors if used with the GA API. **NOTE**: With protocol “UNSPECIFIED”,
       the backend service can be used by Layer 4 Internal Load Balancing or Network Load Balancing
       with TCP/UDP/L3_DEFAULT Forwarding Rule protocol.
+    # TODO: make a ResourceRef to Security Policy
     default_from_api: true
     enum_values:
       - 'HTTP'
diff --git a/mmv1/products/compute/go_Disk.yaml b/mmv1/products/compute/go_Disk.yaml
index dcb86260ec13..4e75789df28f 100644
--- a/mmv1/products/compute/go_Disk.yaml
+++ b/mmv1/products/compute/go_Disk.yaml
@@ -119,6 +119,7 @@ parameters:
           The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied
           encryption key that protects this resource.
         output: true
+        # TODO(chrisst) Change to ResourceRef once KMS is in Magic Modules
       - name: 'kmsKeySelfLink'
         type: String
         description: |
@@ -223,6 +224,7 @@ parameters:
         description: |
           Specifies a 256-bit customer-supplied encryption key, encoded in
           RFC 4648 base64 to either encrypt or decrypt this resource.
+        # TODO(chrisst) Change to ResourceRef once KMS is in Magic Modules
       - name: 'kmsKeySelfLink'
         type: String
         description: |
@@ -346,6 +348,8 @@ properties:
     description: |
       Specifies the disk interface to use for attaching this disk, which is either SCSI or NVME. The default is SCSI.
     min_version: 'beta'
+    # interface is removed using url_param_only to preserve schema definition
+    # and prevent sending or reading in API requests
     url_param_only: true
     diff_suppress_func: 'AlwaysDiffSuppress'
     default_value: "SCSI"
diff --git a/mmv1/products/compute/go_DiskType.yaml b/mmv1/products/compute/go_DiskType.yaml
index 66ba1be72cfc..4c7c8a2fd67d 100644
--- a/mmv1/products/compute/go_DiskType.yaml
+++ b/mmv1/products/compute/go_DiskType.yaml
@@ -15,11 +15,18 @@
 ---
 name: 'DiskType'
 kind: 'compute#diskType'
+# TODO(nelsonjr): Search all documentation for references of using URL (like
+# the description below) and replace with the proper reference to the
+# corresponding type.
 description: |
   Represents a DiskType resource. A DiskType resource represents the type
   of disk to use, such as a pd-ssd, pd-balanced or pd-standard. To reference a disk
   type, use the disk type's full or partial URL.
 exclude: true
+# TODO(nelsonjr): Temporarily make DiskType virtual so no tests gets
+# triggered for create. Implement support for read only objects, and delete
+# the virtual tag
+# | readonly: true
 readonly: true
 docs:
 base_url: 'projects/{{project}}/zones/{{zone}}/diskTypes'
diff --git a/mmv1/products/compute/go_ExternalVpnGateway.yaml b/mmv1/products/compute/go_ExternalVpnGateway.yaml
index 94ead6f1246f..20af60194ef1 100644
--- a/mmv1/products/compute/go_ExternalVpnGateway.yaml
+++ b/mmv1/products/compute/go_ExternalVpnGateway.yaml
@@ -53,6 +53,7 @@ examples:
       external_gateway_name: 'external-gateway'
       global_address_name: 'global-address'
       router_name: 'ha-vpn-router1'
+      # Multiple fine-grained resources
     skip_vcr: true
   - name: 'only_external_vpn_gateway_full'
     primary_resource_id: 'external_gateway'
diff --git a/mmv1/products/compute/go_Firewall.yaml b/mmv1/products/compute/go_Firewall.yaml
index 0b36c5309d57..b7c7caa55ca8 100644
--- a/mmv1/products/compute/go_Firewall.yaml
+++ b/mmv1/products/compute/go_Firewall.yaml
@@ -80,6 +80,10 @@ examples:
       project: 'PROJECT_NAME'
 parameters:
 properties:
+  # TODO(nelsonjr): [nice to have] Make the format here simpler to use, in
+  # the form of # 22/tcp, [12345-23456]/tcp. It requires a conversion
+  # function to the # final JSON format expected by the API for this
+  # proposal to work.
   - name: 'allow'
     type: Array
     description: |
@@ -95,6 +99,8 @@ properties:
     item_type:
       type: NestedObject
       properties:
+        # IPProtocol has to be string, instead of Enum because user can
+        # specify the protocol by number as well.
         - name: 'protocol'
           type: String
           description: |
@@ -135,6 +141,8 @@ properties:
     item_type:
       type: NestedObject
       properties:
+        # IPProtocol has to be string, instead of Enum because user can
+        # specify the protocol by number as well.
         - name: 'protocol'
           type: String
           description: |
diff --git a/mmv1/products/compute/go_ForwardingRule.yaml b/mmv1/products/compute/go_ForwardingRule.yaml
index 173ebb1c8f88..884ed769c166 100644
--- a/mmv1/products/compute/go_ForwardingRule.yaml
+++ b/mmv1/products/compute/go_ForwardingRule.yaml
@@ -265,6 +265,7 @@ properties:
     description: |
       An optional description of this resource. Provide this property when
       you create the resource.
+  # This is a multi-resource resource reference (Address, GlobalAddress)
   - name: 'IPAddress'
     type: String
     description: |
@@ -335,6 +336,8 @@ properties:
       - 'SCTP'
       - 'ICMP'
       - 'L3_DEFAULT'
+  # This is a multi-resource resource reference (BackendService (global), RegionBackendService)
+  # We have custom expands that manage this.
   - name: 'backendService'
     type: ResourceRef
     description: |
@@ -389,6 +392,10 @@ properties:
       For Private Service Connect forwarding rules that forward traffic to Google
       APIs, a network must be provided.
     default_from_api: true
+    # TODO(nelsonjr): When implementing new types enable converting the
+    # manifest input from a single value to a range of form NN-NN. The API
+    # accepts a single value, e.g. '80', but the API stores and returns
+    # '80-80'. This causes idempotency false positive.
     custom_expand: 'templates/terraform/custom_expand/go/resourceref_with_validation.go.tmpl'
     resource: 'Network'
     imports: 'selfLink'
@@ -461,6 +468,9 @@ properties:
       If the network specified is in auto subnet mode, this field is optional.
       However, a subnetwork must be specified if the network is in custom subnet
       mode or when creating external forwarding rule with IPv6.
+    # This is a multi-resource resource reference (TargetHttp(s)Proxy,
+    # TargetSslProxy, TargetTcpProxy, TargetVpnGateway, TargetPool,
+    # TargetInstance)
     default_from_api: true
     custom_expand: 'templates/terraform/custom_expand/go/resourceref_with_validation.go.tmpl'
     resource: 'Subnetwork'
diff --git a/mmv1/products/compute/go_GlobalForwardingRule.yaml b/mmv1/products/compute/go_GlobalForwardingRule.yaml
index 62f67a72ef72..73e58307c9ae 100644
--- a/mmv1/products/compute/go_GlobalForwardingRule.yaml
+++ b/mmv1/products/compute/go_GlobalForwardingRule.yaml
@@ -214,6 +214,7 @@ properties:
     description: |
       An optional description of this resource. Provide this property when
       you create the resource.
+  # This is a multi-resource resource reference (Address, GlobalAddress)
   - name: 'IPAddress'
     type: String
     description: |
@@ -407,6 +408,10 @@ properties:
       For Private Service Connect forwarding rules that forward traffic to Google
       APIs, a network must be provided.
     default_from_api: true
+  # TODO(nelsonjr): When implementing new types enable converting the
+  # manifest input from a single value to a range of form NN-NN. The API
+  # accepts a single value, e.g. '80', but the API stores and returns
+  # '80-80'. This causes idempotency false positive.
     custom_expand: 'templates/terraform/custom_expand/go/resourceref_with_validation.go.tmpl'
     resource: 'Network'
     imports: 'selfLink'
@@ -434,6 +439,9 @@ properties:
 
       @pattern: \d+(?:-\d+)?
     diff_suppress_func: 'PortRangeDiffSuppress'
+    # This is a multi-resource resource reference (TargetHttp(s)Proxy,
+    # TargetSslProxy, TargetTcpProxy, TargetVpnGateway, TargetPool,
+    # TargetInstance)
   - name: 'subnetwork'
     type: ResourceRef
     description: |
@@ -444,6 +452,9 @@ properties:
       If the network specified is in auto subnet mode, this field is optional.
       However, a subnetwork must be specified if the network is in custom subnet
       mode or when creating external forwarding rule with IPv6.
+    # This is a multi-resource resource reference (TargetHttp(s)Proxy,
+    # TargetSslProxy, TargetTcpProxy, TargetVpnGateway, TargetPool,
+    # TargetInstance)
     default_from_api: true
     custom_expand: 'templates/terraform/custom_expand/go/resourceref_with_validation.go.tmpl'
     resource: 'Subnetwork'
diff --git a/mmv1/products/compute/go_Image.yaml b/mmv1/products/compute/go_Image.yaml
index 8c004475ea42..55a917c8956f 100644
--- a/mmv1/products/compute/go_Image.yaml
+++ b/mmv1/products/compute/go_Image.yaml
@@ -110,6 +110,8 @@ properties:
     type: Integer
     description: |
       Size of the image when restored onto a persistent disk (in GB).
+    # TODO(alexstephen): Build family support.
+    # Families use a different API
     default_from_api: true
   - name: 'family'
     type: String
@@ -227,6 +229,7 @@ properties:
           An optional SHA1 checksum of the disk image before unpackaging.
           This is provided by the client when the disk image is created.
         api_name: sha1Checksum
+      # TODO(alexstephen): Figure out cross-module ResourceRefs
       - name: 'source'
         type: String
         description: |
diff --git a/mmv1/products/compute/go_Instance.yaml b/mmv1/products/compute/go_Instance.yaml
index fc6c7e57bee3..9061e750f677 100644
--- a/mmv1/products/compute/go_Instance.yaml
+++ b/mmv1/products/compute/go_Instance.yaml
@@ -80,6 +80,8 @@ properties:
     type: Boolean
     description: Whether the resource should be protected against deletion.
     update_url: '/projects/{{project}}/zones/{{zone}}/instances/{resourceId}/setDeletionProtection'
+    # The code for this update is custom because MM doesn't support
+    # sending empty bodies + the new option as a request parameter.
     update_verb: 'POST'
   - name: 'disks'
     type: Array
@@ -163,6 +165,7 @@ properties:
             - name: 'diskSizeGb'
               type: Integer
               description: Specifies the size of the disk in base-2 GB.
+            # diskStorageType - deprecated
             - name: 'diskType'
               type: ResourceRef
               description: |
@@ -251,6 +254,9 @@ properties:
           enum_values:
             - 'SCSI'
             - 'NVME'
+        # Ignoring kind - It's a constant and we don't need it.
+        # TODO(alexstephen): Place in licenses - it's a Array of
+        # ResourceRefs
         - name: 'mode'
           type: Enum
           description: |
@@ -260,6 +266,7 @@ properties:
           enum_values:
             - 'READ_WRITE'
             - 'READ_ONLY'
+        # This is the name, not selfLink of a disk.
         - name: 'source'
           type: ResourceRef
           description: |
@@ -299,6 +306,8 @@ properties:
           description: |
             The number of the guest accelerator cards exposed to this
             instance.
+        # TODO(alexstephen): Change to ResourceRef once AcceleratorType is
+        # created.
         - name: 'acceleratorType'
           type: String
           description: |
@@ -333,6 +342,26 @@ properties:
       Labels to apply to this instance.  A list of key->value pairs.
     update_url: 'projects/{{project}}/zones/{{zone}}/instances/{{name}}/setLabels'
     update_verb: 'POST'
+  # TODO(nelsonjr): Implement updating metadata *after* resource is created.
+
+  # Expose instance 'metadata' as a simple name/value pair hash. However the API
+  # defines metadata as a NestedObject with the following layout:
+  #
+  # metadata {
+  #   fingerprint: 'hash-of-last-metadata'
+  #   items: [
+  #     {
+  #       key: 'metadata1-key'
+  #       value: 'metadata1-value'
+  #     },
+  #     ...
+  #   ]
+  # }
+  #
+  # Fingerprint is an optimistic locking mechanism for updates, which requires
+  # adding the 'fingerprint' of the last metadata to allow update.
+  #
+  # To comply with the API please add an encoder: and decoder: to the provider.
   - name: 'metadata'
     type: KeyValuePairs
     description: |
@@ -344,6 +373,7 @@ properties:
     description: 'A reference to a machine type which defines VM kind.'
     update_url: 'projects/{{project}}/zones/{{zone}}/instances/{{name}}/setMachineType'
     update_verb: 'POST'
+    # TODO(alexstephen): Add metadata
     custom_expand: 'templates/terraform/custom_expand/go/resourceref_with_validation.go.tmpl'
     resource: 'MachineType'
     imports: 'selfLink'
@@ -383,6 +413,7 @@ properties:
           item_type:
             type: NestedObject
             properties:
+              # 'kind' is not needed for object convergence
               - name: 'name'
                 type: String
                 description: |
@@ -506,6 +537,7 @@ properties:
             subnet mode, providing the subnetwork is optional. If
             the network is in custom subnet mode, then this field
             should be specified.
+          # networkInterfaces.kind is not necessary for convergence.
           custom_expand: 'templates/terraform/custom_expand/go/resourceref_with_validation.go.tmpl'
           resource: 'Subnetwork'
           imports: 'selfLink'
@@ -565,6 +597,8 @@ properties:
     description:
       Configuration for various parameters related to shielded instances.
     update_url: 'projects/{{project}}/instances/{{name}}/updateShieldedInstanceConfig'
+    # The code for this update method is custom because MM does not support
+    # sending just the nested properties
     update_verb: 'PATCH'
     properties:
       - name: 'enableSecureBoot'
@@ -619,6 +653,10 @@ properties:
 
       As a user, use RUNNING to keep a machine "on" and TERMINATED to
       turn a machine off
+    # GCP API shows this as output: true.
+    # This is incorrect because you can make actions on the Instance (start, stop)
+    # In an idempotent world, the best way to express these actions is to
+    # change the status value.
     enum_values:
       - 'PROVISIONING'
       - 'STAGING'
@@ -640,6 +678,7 @@ properties:
       by the setTags method. Each tag within the list must comply with
       RFC1035.
     properties:
+      # TODO(alexstephen) Investigate bytes type
       - name: 'fingerprint'
         type: String
         description: |
diff --git a/mmv1/products/compute/go_InstanceGroup.yaml b/mmv1/products/compute/go_InstanceGroup.yaml
index e8a8db948e4b..f647746e873c 100644
--- a/mmv1/products/compute/go_InstanceGroup.yaml
+++ b/mmv1/products/compute/go_InstanceGroup.yaml
@@ -63,6 +63,7 @@ properties:
     description: |
       An optional description of this resource. Provide this property when
       you create the resource.
+  # 'fingerprint' not applicable to state convergence.
   - name: 'id'
     type: Integer
     description: 'A unique identifier for this instance group.'
diff --git a/mmv1/products/compute/go_InstanceGroupManager.yaml b/mmv1/products/compute/go_InstanceGroupManager.yaml
index 395d3d79857c..47d7e1a82353 100644
--- a/mmv1/products/compute/go_InstanceGroupManager.yaml
+++ b/mmv1/products/compute/go_InstanceGroupManager.yaml
@@ -24,6 +24,7 @@ description: |
   verify the status of the individual instances.
 
   A managed instance group can have up to 1000 VM instances per group.
+# Used as a resource reference
 exclude: true
 docs:
 base_url: 'projects/{{project}}/zones/{{zone}}/instanceGroupManagers'
@@ -146,6 +147,7 @@ properties:
       An optional description of this resource. Provide this property when
       you create the resource.
     immutable: true
+  # fingerprint ignored as it is an internal locking detail
   - name: 'id'
     type: Integer
     description: 'A unique identifier for this resource'
@@ -164,6 +166,7 @@ properties:
       group. The group uses this template to create all new instances in the
       managed instance group.
     required: true
+  # kind is internal transport detail
     custom_expand: 'templates/terraform/custom_expand/go/resourceref_with_validation.go.tmpl'
     resource: 'InstanceTemplate'
     imports: 'selfLink'
@@ -173,6 +176,7 @@ properties:
       The name of the managed instance group. The name must be 1-63
       characters long, and comply with RFC1035.
     required: true
+  # TODO(nelsonjr): Make namedPorts a NameValue(name[string], port[integer])
   - name: 'namedPorts'
     type: Array
     description:
diff --git a/mmv1/products/compute/go_InstanceGroupNamedPort.yaml b/mmv1/products/compute/go_InstanceGroupNamedPort.yaml
index b5f75c41bb05..57f8e2e45687 100644
--- a/mmv1/products/compute/go_InstanceGroupNamedPort.yaml
+++ b/mmv1/products/compute/go_InstanceGroupNamedPort.yaml
@@ -72,6 +72,7 @@ examples:
       deletion_protection: 'true'
     test_vars_overrides:
       'deletion_protection': 'false'
+      # Multiple fine-grained resources
     skip_vcr: true
 parameters:
   - name: 'group'
diff --git a/mmv1/products/compute/go_License.yaml b/mmv1/products/compute/go_License.yaml
index 4a49360fa220..7774d584f274 100644
--- a/mmv1/products/compute/go_License.yaml
+++ b/mmv1/products/compute/go_License.yaml
@@ -19,6 +19,7 @@ description: |
   A License resource represents a software license. Licenses are used to
   track software usage in images, persistent disks, snapshots, and virtual
   machine instances.
+# Used as a resource reference
 exclude: true
 readonly: true
 docs:
diff --git a/mmv1/products/compute/go_ManagedSslCertificate.yaml b/mmv1/products/compute/go_ManagedSslCertificate.yaml
index 18c4f8028e3e..c82a9c15b95e 100644
--- a/mmv1/products/compute/go_ManagedSslCertificate.yaml
+++ b/mmv1/products/compute/go_ManagedSslCertificate.yaml
@@ -46,6 +46,8 @@ immutable: true
 timeouts:
   insert_minutes: 30
   update_minutes: 30
+    # Deletes can take 20-30 minutes to complete, since they depend
+    # on the provisioning process either succeeding or failing completely.
   delete_minutes: 30
 async:
   actions: ['create', 'delete', 'update']
@@ -58,6 +60,8 @@ async:
     timeouts:
       insert_minutes: 30
       update_minutes: 30
+      # Deletes can take 20-30 minutes to complete, since they depend
+      # on the provisioning process either succeeding or failing completely.
       delete_minutes: 30
   result:
     path: 'targetLink'
@@ -82,6 +86,7 @@ examples:
   - name: 'managed_ssl_certificate_recreation'
     primary_resource_id: 'cert'
     external_providers: ["random", "time"]
+      # Random provider
     skip_vcr: true
 parameters:
 properties:
diff --git a/mmv1/products/compute/go_Network.yaml b/mmv1/products/compute/go_Network.yaml
index 690cdd17dc0c..770588aa5e37 100644
--- a/mmv1/products/compute/go_Network.yaml
+++ b/mmv1/products/compute/go_Network.yaml
@@ -86,6 +86,7 @@ properties:
     description: |
       The gateway address for default routing out of the network. This value
       is selected by GCP.
+    # We override this here so that the name is more aesthetic
     api_name: gatewayIPv4
     output: true
   - name: 'name'
diff --git a/mmv1/products/compute/go_NetworkEdgeSecurityService.yaml b/mmv1/products/compute/go_NetworkEdgeSecurityService.yaml
index b5a0b831a7a6..b0f7c0ed4cdd 100644
--- a/mmv1/products/compute/go_NetworkEdgeSecurityService.yaml
+++ b/mmv1/products/compute/go_NetworkEdgeSecurityService.yaml
@@ -49,6 +49,7 @@ async:
     path: 'error/errors'
     message: 'message'
 custom_code:
+# Skipping the sweeper since we need to sweep multiple regions
 exclude_sweeper: true
 examples:
   - name: 'compute_network_edge_security_service_basic'
diff --git a/mmv1/products/compute/go_NetworkPeeringRoutesConfig.yaml b/mmv1/products/compute/go_NetworkPeeringRoutesConfig.yaml
index 363a1dedf9e5..4545e35d6d93 100644
--- a/mmv1/products/compute/go_NetworkPeeringRoutesConfig.yaml
+++ b/mmv1/products/compute/go_NetworkPeeringRoutesConfig.yaml
@@ -79,6 +79,7 @@ examples:
       deletion_protection: 'true'
     test_vars_overrides:
       'deletion_protection': 'false'
+    # currently failing
     skip_vcr: true
 parameters:
   - name: 'network'
@@ -95,6 +96,7 @@ properties:
     type: String
     description: |
       Name of the peering.
+    # renamed to make it clear that this is an existing peering
     api_name: name
     required: true
   - name: 'exportCustomRoutes'
diff --git a/mmv1/products/compute/go_OrganizationSecurityPolicy.yaml b/mmv1/products/compute/go_OrganizationSecurityPolicy.yaml
index c9033fe12929..05ff97e7318e 100644
--- a/mmv1/products/compute/go_OrganizationSecurityPolicy.yaml
+++ b/mmv1/products/compute/go_OrganizationSecurityPolicy.yaml
@@ -37,6 +37,7 @@ custom_code:
   post_create: 'templates/terraform/post_create/go/org_security_policy.go.tmpl'
   post_delete: 'templates/terraform/post_delete/go/org_security_policy.go.tmpl'
   post_update: 'templates/terraform/post_update/go/org_security_policy.go.tmpl'
+    # TODO: Remove once b/154369201 is closed.
   test_check_destroy: 'templates/terraform/custom_check_destroy/go/skip_delete_during_test.go.tmpl'
 examples:
   - name: 'organization_security_policy_basic'
diff --git a/mmv1/products/compute/go_OrganizationSecurityPolicyAssociation.yaml b/mmv1/products/compute/go_OrganizationSecurityPolicyAssociation.yaml
index 3101fac1305e..402c1ce71829 100644
--- a/mmv1/products/compute/go_OrganizationSecurityPolicyAssociation.yaml
+++ b/mmv1/products/compute/go_OrganizationSecurityPolicyAssociation.yaml
@@ -38,6 +38,7 @@ timeouts:
 custom_code:
   post_create: 'templates/terraform/post_create/go/org_security_policy_association.go.tmpl'
   post_delete: 'templates/terraform/post_create/go/org_security_policy_association.go.tmpl'
+    # TODO: Remove once b/154369201 is closed.
   test_check_destroy: 'templates/terraform/custom_check_destroy/go/skip_delete_during_test.go.tmpl'
 read_error_transform: 'transformSecurityPolicyAssociationReadError'
 examples:
diff --git a/mmv1/products/compute/go_OrganizationSecurityPolicyRule.yaml b/mmv1/products/compute/go_OrganizationSecurityPolicyRule.yaml
index 54fa3324ecf7..fb4105c9f607 100644
--- a/mmv1/products/compute/go_OrganizationSecurityPolicyRule.yaml
+++ b/mmv1/products/compute/go_OrganizationSecurityPolicyRule.yaml
@@ -40,6 +40,7 @@ custom_code:
   post_create: 'templates/terraform/post_create/go/org_security_policy_rule.go.tmpl'
   post_delete: 'templates/terraform/post_create/go/org_security_policy_rule.go.tmpl'
   post_update: 'templates/terraform/post_create/go/org_security_policy_rule.go.tmpl'
+    # TODO: Remove once b/154369201 is closed.
   test_check_destroy: 'templates/terraform/custom_check_destroy/go/skip_delete_during_test.go.tmpl'
 examples:
   - name: 'organization_security_policy_rule_basic'
diff --git a/mmv1/products/compute/go_Region.yaml b/mmv1/products/compute/go_Region.yaml
index 6f79a1d0dcdf..da81ccb93b8c 100644
--- a/mmv1/products/compute/go_Region.yaml
+++ b/mmv1/products/compute/go_Region.yaml
@@ -19,6 +19,7 @@ description: |
   Represents a Region resource. A region is a specific geographical
   location where you can run your resources. Each region has one or more
   zones
+# Used as a resource reference
 exclude: true
 readonly: true
 docs:
diff --git a/mmv1/products/compute/go_RegionAutoscaler.yaml b/mmv1/products/compute/go_RegionAutoscaler.yaml
index da1746780c73..c5619660ac20 100644
--- a/mmv1/products/compute/go_RegionAutoscaler.yaml
+++ b/mmv1/products/compute/go_RegionAutoscaler.yaml
@@ -400,6 +400,9 @@ properties:
                 A description of a scaling schedule.
   - name: 'target'
     type: String
+    # TODO(#303): resourceref once RegionIGM exists
+    # resource: 'RegionInstanceGroupManager'
+    # imports: 'selfLink'
     description: |
       URL of the managed instance group that this autoscaler will scale.
     required: true
diff --git a/mmv1/products/compute/go_RegionBackendService.yaml b/mmv1/products/compute/go_RegionBackendService.yaml
index cc3ddf1eb1ad..fed219a2bdf3 100644
--- a/mmv1/products/compute/go_RegionBackendService.yaml
+++ b/mmv1/products/compute/go_RegionBackendService.yaml
@@ -657,6 +657,7 @@ properties:
     description: |
       Creation timestamp in RFC3339 text format.
     output: true
+  # customRequestHeaders only supported for EXTERNAL load balancing
   - name: 'description'
     type: String
     description: |
@@ -1115,6 +1116,9 @@ properties:
       The default is HTTP. **NOTE**: HTTP2 is only valid for beta HTTP/2 load balancer
       types and may result in errors if used with the GA API.
     default_from_api: true
+    # This is removed to avoid breaking terraform, as default values cannot be
+    # unspecified. Providers should include this as needed via overrides
+    # default_value: :TCP
     enum_values:
       - 'HTTP'
       - 'HTTPS'
diff --git a/mmv1/products/compute/go_RegionCommitment.yaml b/mmv1/products/compute/go_RegionCommitment.yaml
index 75ffc0a72ea1..b1f9cc354b8a 100644
--- a/mmv1/products/compute/go_RegionCommitment.yaml
+++ b/mmv1/products/compute/go_RegionCommitment.yaml
@@ -28,7 +28,9 @@ references:
 docs:
 base_url: 'projects/{{project}}/regions/{{region}}/commitments'
 has_self_link: true
+# Cannot be deleted
 exclude_delete: true
+# Cannot be updated (as of implementation date)
 immutable: true
 timeouts:
   insert_minutes: 20
diff --git a/mmv1/products/compute/go_RegionDisk.yaml b/mmv1/products/compute/go_RegionDisk.yaml
index 102da442751a..799b151d9444 100644
--- a/mmv1/products/compute/go_RegionDisk.yaml
+++ b/mmv1/products/compute/go_RegionDisk.yaml
@@ -130,6 +130,7 @@ parameters:
           The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied
           encryption key that protects this resource.
         output: true
+        # TODO(chrisst) Change to ResourceRef once KMS is in Magic Modules
       - name: 'kmsKeyName'
         type: String
         description: |
@@ -162,6 +163,7 @@ parameters:
         description: |
           Specifies a 256-bit customer-supplied encryption key, encoded in
           RFC 4648 base64 to either encrypt or decrypt this resource.
+        # TODO(chrisst) Change to ResourceRef once KMS is in Magic Modules
       - name: 'kmsKeyName'
         type: String
         description: |
@@ -294,6 +296,8 @@ properties:
     description: |
       Specifies the disk interface to use for attaching this disk, which is either SCSI or NVME. The default is SCSI.
     min_version: 'beta'
+    # interface is removed using url_param_only to preserve schema definition
+    # and prevent sending or reading in API requests
     url_param_only: true
     diff_suppress_func: 'AlwaysDiffSuppress'
     default_value: "SCSI"
diff --git a/mmv1/products/compute/go_RegionInstanceGroupManager.yaml b/mmv1/products/compute/go_RegionInstanceGroupManager.yaml
index ef3fb3c81954..9c3f3698c53f 100644
--- a/mmv1/products/compute/go_RegionInstanceGroupManager.yaml
+++ b/mmv1/products/compute/go_RegionInstanceGroupManager.yaml
@@ -146,6 +146,7 @@ properties:
       An optional description of this resource. Provide this property when
       you create the resource.
     immutable: true
+  # fingerprint ignored as it is an internal locking detail
   - name: 'id'
     type: Integer
     description: 'A unique identifier for this resource'
@@ -164,6 +165,7 @@ properties:
       group. The group uses this template to create all new instances in the
       managed instance group.
     required: true
+  # kind is internal transport detail
     custom_expand: 'templates/terraform/custom_expand/go/resourceref_with_validation.go.tmpl'
     resource: 'InstanceTemplate'
     imports: 'selfLink'
@@ -173,6 +175,7 @@ properties:
       The name of the managed instance group. The name must be 1-63
       characters long, and comply with RFC1035.
     required: true
+  # TODO(nelsonjr): Make namedPorts a NameValue(name[string], port[integer])
   - name: 'namedPorts'
     type: Array
     description:
diff --git a/mmv1/products/compute/go_RegionNetworkEndpointGroup.yaml b/mmv1/products/compute/go_RegionNetworkEndpointGroup.yaml
index 916e7fb82e2c..b622e7203c0d 100644
--- a/mmv1/products/compute/go_RegionNetworkEndpointGroup.yaml
+++ b/mmv1/products/compute/go_RegionNetworkEndpointGroup.yaml
@@ -296,6 +296,10 @@ properties:
     properties:
       - name: 'platform'
         type: String
+        # Docs (https://cloud.google.com/compute/docs/reference/rest/beta/regionNetworkEndpointGroups) say support is offered for:
+        # API Gateway: apigateway.googleapis.com, App Engine: appengine.googleapis.com,
+        # Cloud Functions: cloudfunctions.googleapis.com, Cloud Run: run.googleapis.com
+        # However, only API Gateway is currently supported
         description: |
           The platform of the NEG backend target(s). Possible values:
           API Gateway: apigateway.googleapis.com
diff --git a/mmv1/products/compute/go_RegionSslCertificate.yaml b/mmv1/products/compute/go_RegionSslCertificate.yaml
index 6893009d4216..8b0f25c2da33 100644
--- a/mmv1/products/compute/go_RegionSslCertificate.yaml
+++ b/mmv1/products/compute/go_RegionSslCertificate.yaml
@@ -63,10 +63,12 @@ examples:
     primary_resource_id: 'default'
     ignore_read_extra:
       - 'name_prefix'
+      # Uses id.UniqueId
     skip_vcr: true
   - name: 'region_ssl_certificate_random_provider'
     primary_resource_id: 'default'
     external_providers: ["random", "time"]
+      # Uses id.UniqueId
     skip_vcr: true
   - name: 'region_ssl_certificate_target_https_proxies'
     primary_resource_id: 'default'
@@ -77,6 +79,7 @@ examples:
       region_health_check_name: 'http-health-check'
     ignore_read_extra:
       - 'name_prefix'
+      # Uses id.UniqueId
     skip_vcr: true
 parameters:
   - name: 'region'
diff --git a/mmv1/products/compute/go_RegionTargetHttpsProxy.yaml b/mmv1/products/compute/go_RegionTargetHttpsProxy.yaml
index 7a2dfcec9f70..3a56c4fa08eb 100644
--- a/mmv1/products/compute/go_RegionTargetHttpsProxy.yaml
+++ b/mmv1/products/compute/go_RegionTargetHttpsProxy.yaml
@@ -45,6 +45,9 @@ async:
     message: 'message'
 custom_code:
   encoder: 'templates/terraform/encoders/go/compute_region_target_https_proxy.go.tmpl'
+  # update_encoder is usually the same as encoder by default. This resource is an uncommon case where the whole resource
+  # is marked to be immutable, but we have a field specific update that overrides it (e.g certifiacteManagerCertificates).
+  # This causes the encoder logic to not be applied during update.
   update_encoder: 'templates/terraform/encoders/go/compute_region_target_https_proxy.go.tmpl'
   decoder: 'templates/terraform/decoders/go/compute_region_target_https_proxy.go.tmpl'
 examples:
@@ -121,6 +124,25 @@ properties:
       character, which cannot be a dash.
     required: true
     immutable: true
+  # This field is present in the schema but as of 2019 Sep 23 attempting to set it fails with
+  # a 400 "QUIC override is supported only with global TargetHttpsProxy". jamessynge@ said in an
+  # email sent on 2019 Sep 20 that support for this "is probably far in the future."
+  # - !ruby/object:Api::Type::Enum
+  #   name: 'quicOverride'
+  #   description: |
+  #     Specifies the QUIC override policy for this resource. This determines
+  #     whether the load balancer will attempt to negotiate QUIC with clients
+  #     or not. Can specify one of NONE, ENABLE, or DISABLE. If NONE is
+  #     specified, uses the QUIC policy with no user overrides, which is
+  #     equivalent to DISABLE. Not specifying this field is equivalent to
+  #     specifying NONE.
+  #   values:
+  #     - :NONE
+  #     - :ENABLE
+  #     - :DISABLE
+  #   update_verb: :POST
+  #   update_url:
+  #     'projects/{{project}}/regions/{{region}}/targetHttpsProxies/{{name}}/setQuicOverride'
   - name: 'certificateManagerCertificates'
     type: Array
     description: |
diff --git a/mmv1/products/compute/go_RegionUrlMap.yaml b/mmv1/products/compute/go_RegionUrlMap.yaml
index 80e63ab0db54..c5721e56a3b4 100644
--- a/mmv1/products/compute/go_RegionUrlMap.yaml
+++ b/mmv1/products/compute/go_RegionUrlMap.yaml
@@ -171,6 +171,7 @@ properties:
     description: |
       An optional description of this resource. Provide this property when
       you create the resource.
+  # 'fingerprint' used internally for object consistency.
   - name: 'host_rule'
     type: Array
     description: 'The list of HostRules to use against the URL.'
@@ -238,6 +239,12 @@ properties:
             none of the pathRules defined by this PathMatcher is matched by
             the URL's path portion.
           custom_expand: 'templates/terraform/custom_expand/go/resourceref_with_validation.go.tmpl'
+          # TODO: (mbang) won't work for array path matchers yet, uncomment here once they are supported.
+          # (github.com/hashicorp/terraform-plugin-sdk/issues/470)
+          # TODO: add defaultRouteAction.weightedBackendService here once they are supported.
+          # exactly_one_of:
+          #   - path_matchers.0.default_service
+          #   - path_matchers.0.default_url_redirect
           resource: 'RegionBackendService'
           imports: 'selfLink'
         - name: 'description'
@@ -1448,6 +1455,12 @@ properties:
                     required: true
         - name: 'defaultUrlRedirect'
           type: NestedObject
+          # TODO: (mbang) won't work for array path matchers yet, uncomment here once they are supported.
+          # (github.com/hashicorp/terraform-plugin-sdk/issues/470)
+          # TODO: add defaultRouteAction.weightedBackendService here once they are supported.
+          # exactly_one_of:
+          #   - path_matchers.0.default_service
+          #   - path_matchers.0.default_url_redirect
           description: |
             When none of the specified hostRules match, the request is redirected to a URL specified
             by defaultUrlRedirect. If defaultUrlRedirect is specified, defaultService or
diff --git a/mmv1/products/compute/go_Reservation.yaml b/mmv1/products/compute/go_Reservation.yaml
index 79673fc796e0..0dd439601ba7 100644
--- a/mmv1/products/compute/go_Reservation.yaml
+++ b/mmv1/products/compute/go_Reservation.yaml
@@ -116,6 +116,8 @@ properties:
       consume this reservation. Otherwise, it can be consumed by VMs with
       affinity for any reservation. Defaults to false.
     immutable: true
+    # Not a hard API default, but this should help avoid a unset/true/false
+    # trinary.
     default_value: false
   - name: 'status'
     type: String
diff --git a/mmv1/products/compute/go_ResizeRequest.yaml b/mmv1/products/compute/go_ResizeRequest.yaml
index 56606b7dd427..eada52878a1a 100644
--- a/mmv1/products/compute/go_ResizeRequest.yaml
+++ b/mmv1/products/compute/go_ResizeRequest.yaml
@@ -23,19 +23,29 @@ description: |
   With Dynamic Workload Scheduler in Flex Start mode, you submit a GPU capacity request for your AI/ML jobs by indicating how many you need, a duration, and your preferred region. Dynamic Workload Scheduler intelligently persists the request; once the capacity becomes available, it automatically provisions your VMs enabling your workloads to run continuously for the entire duration of the capacity allocation.
 references:
   guides:
+    # Link to quickstart in the API's Guides section. For example:
+    # 'Create and connect to a database': 'https://cloud.google.com/alloydb/docs/quickstart/create-and-connect'
     'QUICKSTART_TITLE': 'https://cloud.google.com/compute/docs/instance-groups/create-resize-requests-mig'
+  # Link to the REST API reference for the resource. For example,
+  # https://cloud.google.com/alloydb/docs/reference/rest/v1/projects.locations.backups
   api: 'https://cloud.google.com/compute/docs/reference/rest/v1/instanceGroupManagerResizeRequests'
 docs:
+### List Method ###
 base_url: 'projects/{{project}}/zones/{{zone}}/instanceGroupManagers/{{instance_group_manager}}/resizeRequests'
+### Get Method
 self_link: 'projects/{{project}}/zones/{{zone}}/instanceGroupManagers/{{instance_group_manager}}/resizeRequests/{{name}}'
 immutable: true
 timeouts:
   insert_minutes: 20
   update_minutes: 20
   delete_minutes: 20
+# Sets parameters for handling operations returned by the API.
 async:
   actions: ['create', 'delete', 'update']
   type: 'OpAsync'
+  # Overrides which API calls return operations. Default: ['create',
+  # 'update', 'delete']
+  # actions: ['create', 'update', 'delete']
   operation:
     base_url: '{{op_id}}'
     kind: 'compute#operation'
@@ -47,13 +57,22 @@ async:
   error:
     path: 'error/errors'
     message: 'message'
+### Update method ###
+# Resize requests are currently not update-able
+
+### Delete Method ###
+# Custom delete method to handle resize request cancellations vs. deletions.
+# If a resize request is in the ACCEPTED state, it must be canceled before it can be
+# deleted. If a resize request is NOT in the ACCEPTED state, it can be directly deleted.
 custom_code:
   custom_delete: 'templates/terraform/custom_delete/go/compute_mig_resize_request_delete.go.tmpl'
+# Examples for testing
 examples:
   - name: 'compute_mig_resize_request'
     primary_resource_id: 'a3_resize_request'
     vars:
       resize_request_name: 'a3-dws'
+# Resize request parameters injected via URL
 parameters:
   - name: 'zone'
     type: ResourceRef
@@ -73,6 +92,7 @@ parameters:
     required: true
     resource: 'InstanceGroupManager'
     imports: 'name'
+# Non-URL parameters including input and output parameters
 properties:
   - name: 'creationTimestamp'
     type: Time
@@ -124,6 +144,7 @@ properties:
       [Output only] Status of the request.
     output: true
     properties:
+      # Status.error
       - name: 'error'
         type: NestedObject
         description: |
@@ -253,6 +274,7 @@ properties:
                         description: |
                           The localized error message in the above locale.
                         output: true
+      # Status.lastAttempt
       - name: 'lastAttempt'
         type: NestedObject
         description: |
@@ -387,5 +409,4 @@ properties:
                             type: String
                             description: |
                               The localized error message in the above locale.
-
                             output: true
diff --git a/mmv1/products/compute/go_Router.yaml b/mmv1/products/compute/go_Router.yaml
index a444f3212099..84eb7d6656c9 100644
--- a/mmv1/products/compute/go_Router.yaml
+++ b/mmv1/products/compute/go_Router.yaml
@@ -24,6 +24,9 @@ references:
 docs:
 base_url: 'projects/{{project}}/regions/{{region}}/routers'
 has_self_link: true
+# Since Terraform has separate resources for router, router interface, and
+# router peer, calling PUT on the router will delete the interface and peer.
+# Use patch instead.
 update_verb: 'PATCH'
 mutex: 'router/{{region}}/{{name}}'
 timeouts:
@@ -104,6 +107,13 @@ properties:
       A reference to the network to which this router belongs.
     required: true
     immutable: true
+  # TODO: Figure out the story for interfaces/bgpPeers. Right
+  # now in Terraform we have three separate resources: router,
+  # router_interface, and router_peer. Decide whether we want to keep that
+  # pattern for the other providers, keep it unique for Terraform, or add
+  # these fields to the Terraform resource (and then within that, decide
+  # whether to deprecate router_interface and router_peer or leave them
+  # alone).
     custom_expand: 'templates/terraform/custom_expand/go/resourceref_with_validation.go.tmpl'
     resource: 'Network'
     imports: 'selfLink'
@@ -142,6 +152,7 @@ properties:
 
           This enum field has the one valid value: ALL_SUBNETS
         send_empty_value: true
+ # TODO(#324): enum?
         item_type:
           type: String
       - name: 'advertisedIpRanges'
diff --git a/mmv1/products/compute/go_RouterNat.yaml b/mmv1/products/compute/go_RouterNat.yaml
index badc509eb0f6..9ac775009908 100644
--- a/mmv1/products/compute/go_RouterNat.yaml
+++ b/mmv1/products/compute/go_RouterNat.yaml
@@ -68,6 +68,10 @@ custom_diff:
   - 'resourceComputeRouterNatDrainNatIpsCustomDiff'
 exclude_tgc: true
 examples:
+  # These examples are not used to autogenerate tests, as fine-grained
+  # resources do not fit the normal test flow - we need to test deletion
+  # in a test step while parent resource still exists vs in CheckDestroy
+  # when all resources have been deleted.
   - name: 'router_nat_basic'
     primary_resource_id: 'nat'
     vars:
diff --git a/mmv1/products/compute/go_SecurityPolicyRule.yaml b/mmv1/products/compute/go_SecurityPolicyRule.yaml
index ba8a045b9183..6b5de6fb585f 100644
--- a/mmv1/products/compute/go_SecurityPolicyRule.yaml
+++ b/mmv1/products/compute/go_SecurityPolicyRule.yaml
@@ -110,6 +110,19 @@ properties:
             description: |
               Textual representation of an expression in Common Expression Language syntax. The application context of the containing message determines which well-known feature set of CEL is supported.
             required: true
+          # >> These fields are not yet supported, following the global security policy resource.
+          # - !ruby/object:Api::Type::String
+          #   name: 'title'
+          #   description: |
+          #     Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+          # - !ruby/object:Api::Type::String
+          #   name: 'description'
+          #   description: |
+          #     Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+          # - !ruby/object:Api::Type::String
+          #   name: 'location'
+          #   description: |
+          #     Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
       - name: 'exprOptions'
         type: NestedObject
         description: |
diff --git a/mmv1/products/compute/go_ServiceAttachment.yaml b/mmv1/products/compute/go_ServiceAttachment.yaml
index 71752ff0aba5..5df7b4505bf4 100644
--- a/mmv1/products/compute/go_ServiceAttachment.yaml
+++ b/mmv1/products/compute/go_ServiceAttachment.yaml
@@ -231,11 +231,13 @@ properties:
       properties:
         - name: 'projectIdOrNum'
           type: String
+          # TODO (laurensknoll): add exactly_one_of when it can be applied to lists (https://github.com/hashicorp/terraform-plugin-sdk/issues/470)
           description: |
             A project that is allowed to connect to this service attachment.
             Only one of project_id_or_num and network_url may be set.
         - name: 'networkUrl'
           type: String
+          # TODO (laurensknoll): add exactly_one_of when it can be applied to lists (https://github.com/hashicorp/terraform-plugin-sdk/issues/470)
           description: |
             The network that is allowed to connect to this service attachment.
             Only one of project_id_or_num and network_url may be set.
diff --git a/mmv1/products/compute/go_Snapshot.yaml b/mmv1/products/compute/go_Snapshot.yaml
index 10c2a2a645d1..084f6addf38a 100644
--- a/mmv1/products/compute/go_Snapshot.yaml
+++ b/mmv1/products/compute/go_Snapshot.yaml
@@ -41,6 +41,9 @@ timeouts:
   insert_minutes: 20
   update_minutes: 20
   delete_minutes: 20
+# 'createSnapshot' is a zonal operation while 'snapshot.delete' is a global
+# operation. we'll leave the object as global operation and use the disk's
+# zonal operation for the create action.
 async:
   actions: ['create', 'delete', 'update']
   type: 'OpAsync'
@@ -85,6 +88,7 @@ parameters:
     description: 'A reference to the disk used to create this snapshot.'
     required: true
     immutable: true
+    # ignore_read in providers - this is only used in Create
     diff_suppress_func: 'tpgresource.CompareSelfLinkOrResourceName'
     custom_expand: 'templates/terraform/custom_expand/go/resourceref_with_validation.go.tmpl'
     resource: 'Disk'
@@ -130,6 +134,7 @@ parameters:
           The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied
           encryption key that protects this resource.
         output: true
+        # TODO(chrisst) Change to ResourceRef once KMS is in Magic Modules
       - name: 'kmsKeySelfLink'
         type: String
         description: |
@@ -140,6 +145,7 @@ parameters:
         description: |
           The service account used for the encryption request for the given KMS key.
           If absent, the Compute Engine Service Agent service account is used.
+    # ignore_read in providers - this is only used in Create
   - name: 'sourceDiskEncryptionKey'
     type: NestedObject
     description: |
@@ -153,6 +159,7 @@ parameters:
         description: |
           Specifies a 256-bit customer-supplied encryption key, encoded in
           RFC 4648 base64 to either encrypt or decrypt this resource.
+        # The docs list this field but it is never returned.
         sensitive: true
       - name: 'kmsKeyServiceAccount'
         type: String
@@ -169,6 +176,7 @@ properties:
     description: 'The unique identifier for the resource.'
     api_name: id
     output: true
+  # 'status' not useful for object convergence.
   - name: 'diskSizeGb'
     type: Integer
     description: 'Size of the snapshot, specified in GB.'
@@ -198,6 +206,7 @@ properties:
     type: String
     description: 'An optional description of this resource.'
     immutable: true
+  # 'sourceDiskId' not useful for object convergence.
   - name: 'storageBytes'
     type: Integer
     description: |
@@ -205,6 +214,7 @@ properties:
       storage, this number is expected to change with snapshot
       creation/deletion.
     output: true
+  # 'storageBytesStatus' not useful for object convergence.
   - name: 'storageLocations'
     type: Array
     description: |
diff --git a/mmv1/products/compute/go_SslCertificate.yaml b/mmv1/products/compute/go_SslCertificate.yaml
index 913043468170..dd9b66e9dd2b 100644
--- a/mmv1/products/compute/go_SslCertificate.yaml
+++ b/mmv1/products/compute/go_SslCertificate.yaml
@@ -62,10 +62,12 @@ examples:
     primary_resource_id: 'default'
     ignore_read_extra:
       - 'name_prefix'
+      # Uses id.UniqueId
     skip_vcr: true
   - name: 'ssl_certificate_random_provider'
     primary_resource_id: 'default'
     external_providers: ["random", "time"]
+      # Uses id.UniqueId
     skip_vcr: true
   - name: 'ssl_certificate_target_https_proxies'
     primary_resource_id: 'default'
@@ -76,6 +78,7 @@ examples:
       http_health_check_name: 'http-health-check'
     ignore_read_extra:
       - 'name_prefix'
+      # Uses id.UniqueId
     skip_vcr: true
 parameters:
 properties:
diff --git a/mmv1/products/compute/go_SslPolicy.yaml b/mmv1/products/compute/go_SslPolicy.yaml
index 7ee4898da65e..f84a7345f86e 100644
--- a/mmv1/products/compute/go_SslPolicy.yaml
+++ b/mmv1/products/compute/go_SslPolicy.yaml
@@ -79,6 +79,7 @@ properties:
       character, which cannot be a dash.
     required: true
     immutable: true
+    # TODO: profile, minTlsVersion, enabledFeatures, customFeatures, fingerprint, warnings, kind
   - name: 'profile'
     type: Enum
     description: |
diff --git a/mmv1/products/compute/go_TargetHttpsProxy.yaml b/mmv1/products/compute/go_TargetHttpsProxy.yaml
index 7449030a949e..b0af3e28c227 100644
--- a/mmv1/products/compute/go_TargetHttpsProxy.yaml
+++ b/mmv1/products/compute/go_TargetHttpsProxy.yaml
@@ -47,6 +47,9 @@ async:
 collection_url_key: 'items'
 custom_code:
   encoder: 'templates/terraform/encoders/go/compute_target_https_proxy.go.tmpl'
+  # update_encoder is usually the same as encoder by default. This resource is an uncommon case where the whole resource
+  # is marked to be immutable, but we have a field specific update that overrides it (e.g certifiacteManagerCertificates).
+  # This causes the encoder logic to not be applied during update.
   update_encoder: 'templates/terraform/encoders/go/compute_target_https_proxy.go.tmpl'
   decoder: 'templates/terraform/decoders/go/compute_target_https_proxy.go.tmpl'
 examples:
diff --git a/mmv1/products/compute/go_UrlMap.yaml b/mmv1/products/compute/go_UrlMap.yaml
index 30ddaa909679..3f6e53e127b2 100644
--- a/mmv1/products/compute/go_UrlMap.yaml
+++ b/mmv1/products/compute/go_UrlMap.yaml
@@ -303,6 +303,12 @@ properties:
         - name: 'defaultService'
           type: ResourceRef
           description: The backend service or backend bucket to use when none of the given paths match.
+          # TODO: (mbang) won't work for array path matchers yet, uncomment here once they are supported.
+          # (github.com/hashicorp/terraform-plugin-sdk/issues/470)
+          # exactly_one_of:
+          #   - path_matchers.0.default_service
+          #   - path_matchers.0.default_url_redirect
+          #   - path_matchers.0.default_route_action.0.weighted_backend_services
           custom_expand: 'templates/terraform/custom_expand/go/reference_to_backend.tmpl'
           resource: 'BackendService'
           imports: 'selfLink'
@@ -1687,6 +1693,12 @@ properties:
                     default_value: false
         - name: 'defaultUrlRedirect'
           type: NestedObject
+          # TODO: (mbang) won't work for array path matchers yet, uncomment here once they are supported.
+          # (github.com/hashicorp/terraform-plugin-sdk/issues/470)
+          # exactly_one_of:
+          #   - path_matchers.0.default_service
+          #   - path_matchers.0.default_url_redirect
+          #   - path_matchers.0.default_route_action.0.weighted_backend_services
           description: |
             When none of the specified hostRules match, the request is redirected to a URL specified
             by defaultUrlRedirect. If defaultUrlRedirect is specified, defaultService or
@@ -1754,6 +1766,9 @@ properties:
               required: true
         - name: 'defaultRouteAction'
           type: NestedObject
+          # TODO: (mbang) conflicts also won't work for array path matchers yet, uncomment here once supported.
+          # conflicts:
+          #   - path_matcher.path_matcher.default_url_redirect
           description: |
             defaultRouteAction takes effect when none of the pathRules or routeRules match. The load balancer performs
             advanced routing actions like URL rewrites, header transformations, etc. prior to forwarding the request
@@ -1764,6 +1779,12 @@ properties:
           properties:
             - name: 'weightedBackendServices'
               type: Array
+              # TODO: (mbang) won't work for array path matchers yet, uncomment here once they are supported.
+              # (github.com/hashicorp/terraform-plugin-sdk/issues/470)
+              # exactly_one_of:
+              #   - path_matchers.0.default_service
+              #   - path_matchers.0.default_url_redirect
+              #   - path_matchers.0.default_route_action.0.weighted_backend_services
               description: |
                 A list of weighted backend services to send traffic to when a route match occurs.
                 The weights determine the fraction of traffic that flows to their corresponding backend service.
diff --git a/mmv1/products/compute/go_Zone.yaml b/mmv1/products/compute/go_Zone.yaml
index 9b8252602f55..a88b4719203a 100644
--- a/mmv1/products/compute/go_Zone.yaml
+++ b/mmv1/products/compute/go_Zone.yaml
@@ -16,6 +16,7 @@
 name: 'Zone'
 kind: 'compute#zone'
 description: 'Represents a Zone resource.'
+# Used as a resource reference
 exclude: true
 readonly: true
 docs:
diff --git a/mmv1/products/containerattached/go_Cluster.yaml b/mmv1/products/containerattached/go_Cluster.yaml
index e9bbfae0add5..aeb083d656a9 100644
--- a/mmv1/products/containerattached/go_Cluster.yaml
+++ b/mmv1/products/containerattached/go_Cluster.yaml
@@ -230,6 +230,12 @@ properties:
     type: NestedObject
     description: |
       Logging configuration.
+    # If the user doesn't specify a loggingConfig, the server will supply a default value. Instead of
+    # letting that happen and allowing the config and state to get mismatched, just manually send an
+    # empty object if the user doesn't set anything and require the user to explicitly set the field if a
+    # value is desired.
+    # If the loggingConfig passed to the server is empty, an empty object is returned, so the diff in that
+    # case needs to be ignored.
     send_empty_value: true
     allow_empty_object: true
     diff_suppress_func: 'suppressAttachedClustersLoggingConfigDiff'
diff --git a/mmv1/products/datacatalog/go_Entry.yaml b/mmv1/products/datacatalog/go_Entry.yaml
index 5f7a7202245c..f9bd9a07d813 100644
--- a/mmv1/products/datacatalog/go_Entry.yaml
+++ b/mmv1/products/datacatalog/go_Entry.yaml
@@ -98,6 +98,8 @@ properties:
     type: String
     description: |
       Entry description, which can consist of several sentences or paragraphs that describe entry contents.
+    # This is a string instead of a NestedObject because schemas contain ColumnSchemas, which can contain nested ColumnSchemas.
+    # We'll have people provide the json blob for the schema instead.
   - name: 'schema'
     type: String
     description: |
diff --git a/mmv1/products/datacatalog/go_Tag.yaml b/mmv1/products/datacatalog/go_Tag.yaml
index dae1fed0f13a..f0adc93dd1a7 100644
--- a/mmv1/products/datacatalog/go_Tag.yaml
+++ b/mmv1/products/datacatalog/go_Tag.yaml
@@ -75,6 +75,7 @@ examples:
       force_delete: 'false'
     test_vars_overrides:
       'force_delete': 'true'
+    # Multiple fine-grained resources
     skip_vcr: true
   - name: 'data_catalog_entry_tag_false'
     primary_resource_id: 'basic_tag'
diff --git a/mmv1/products/datacatalog/go_Taxonomy.yaml b/mmv1/products/datacatalog/go_Taxonomy.yaml
index b83492638d70..0f374a8d913c 100644
--- a/mmv1/products/datacatalog/go_Taxonomy.yaml
+++ b/mmv1/products/datacatalog/go_Taxonomy.yaml
@@ -87,6 +87,7 @@ properties:
     description: |
       A list of policy types that are activated for this taxonomy. If not set,
       defaults to an empty list.
+ # TOOD: should this be enum or string
     item_type:
       type: Enum
       description: 'Defines policy types where policy tag can be used for'
diff --git a/mmv1/products/datafusion/go_Instance.yaml b/mmv1/products/datafusion/go_Instance.yaml
index 8b442a23bb01..75367e86383d 100644
--- a/mmv1/products/datafusion/go_Instance.yaml
+++ b/mmv1/products/datafusion/go_Instance.yaml
@@ -60,6 +60,7 @@ examples:
       instance_name: 'my-instance'
       prober_test_run: ''
     test_vars_overrides:
+      # Mark for testing to avoid service networking connection usage that is not cleaned up
       'prober_test_run': '`options = { prober_test_run = "true" }`'
   - name: 'data_fusion_instance_full'
     primary_resource_id: 'extended_instance'
@@ -69,6 +70,7 @@ examples:
       network_name: 'datafusion-full-network'
       prober_test_run: ''
     test_vars_overrides:
+      # Mark for testing to avoid service networking connection usage that is not cleaned up
       'prober_test_run': '`options = { prober_test_run = "true" }`'
   - name: 'data_fusion_instance_psc'
     primary_resource_id: 'psc_instance'
@@ -79,6 +81,7 @@ examples:
       attachment_name: 'datafusion-psc-attachment'
       prober_test_run: ''
     test_vars_overrides:
+      # Mark for testing to avoid service networking connection usage that is not cleaned up
       'prober_test_run': '`options = { prober_test_run = "true" }`'
   - name: 'data_fusion_instance_cmek'
     primary_resource_id: 'cmek'
@@ -90,6 +93,7 @@ examples:
       instance_name: 'my-instance'
       prober_test_run: ''
     test_vars_overrides:
+      # Mark for testing to avoid service networking connection usage that is not cleaned up
       'prober_test_run': '`options = { prober_test_run = "true" }`'
   - name: 'data_fusion_instance_event'
     primary_resource_id: 'event'
@@ -213,6 +217,7 @@ properties:
     type: String
     description: |
       Service account which will be used to access resources in the customer project.
+ # This field is deprecated and needs to be absent in GA provider.
     min_version: 'beta'
     output: true
     deprecation_message: '`service_account` is deprecated and will be removed in a future major release. Instead, use `tenant_project_id` to extract the tenant project ID.'
diff --git a/mmv1/products/datastream/go_ConnectionProfile.yaml b/mmv1/products/datastream/go_ConnectionProfile.yaml
index 0ee594fda00c..b50b403dfd90 100644
--- a/mmv1/products/datastream/go_ConnectionProfile.yaml
+++ b/mmv1/products/datastream/go_ConnectionProfile.yaml
@@ -63,11 +63,13 @@ examples:
     test_vars_overrides:
       'deletion_protection': 'false'
     external_providers: ["random", "time"]
+    # Random provider
     skip_vcr: true
   - name: 'datastream_connection_profile_full'
     primary_resource_id: 'default'
     vars:
       connection_profile_id: 'my-profile'
+      # Workaround for https://github.com/hashicorp/terraform-provider-google/issues/12410
     ignore_read_extra:
       - 'forward_ssh_connectivity.0.password'
   - name: 'datastream_connection_profile_postgres'
diff --git a/mmv1/products/datastream/go_PrivateConnection.yaml b/mmv1/products/datastream/go_PrivateConnection.yaml
index 1a4d6550ef51..542696ef361d 100644
--- a/mmv1/products/datastream/go_PrivateConnection.yaml
+++ b/mmv1/products/datastream/go_PrivateConnection.yaml
@@ -50,6 +50,7 @@ custom_code:
   post_create: 'templates/terraform/post_create/go/private_connection.go.tmpl'
   pre_delete: 'templates/terraform/pre_delete/go/private_connection.go.tmpl'
   post_import: 'templates/terraform/post_import/go/private_connection.go.tmpl'
+# Skipping the sweeper since the resource needs force-deletion
 exclude_sweeper: true
 schema_version: 1
 state_upgraders: true
diff --git a/mmv1/products/datastream/go_Stream.yaml b/mmv1/products/datastream/go_Stream.yaml
index 8cf5c80fc700..c7dde97bda0e 100644
--- a/mmv1/products/datastream/go_Stream.yaml
+++ b/mmv1/products/datastream/go_Stream.yaml
@@ -88,6 +88,7 @@ examples:
       'deletion_protection': 'false'
       'stream_cmek': 'acctest.BootstrapKMSKeyInLocation(t, "us-central1").CryptoKey.Name'
     external_providers: ["random", "time"]
+      # Random provider
     skip_vcr: true
   - name: 'datastream_stream_postgresql'
     primary_resource_id: 'default'
@@ -143,6 +144,7 @@ examples:
       sql_user_name: 'my-user'
       source_connection_profile_id: 'source-profile'
     external_providers: ["random", "time"]
+    # Random provider
     skip_vcr: true
   - name: 'datastream_stream_bigquery'
     primary_resource_id: 'default'
@@ -159,6 +161,7 @@ examples:
       'deletion_protection': 'false'
       'bigquery_destination_table_kms_key_name': 'acctest.BootstrapKMSKeyInLocation(t, "us-central1").CryptoKey.Name'
     external_providers: ["random", "time"]
+      # Random provider
     skip_vcr: true
   - name: 'datastream_stream_bigquery_append_only'
     primary_resource_id: 'default'
@@ -173,6 +176,7 @@ examples:
     test_vars_overrides:
       'deletion_protection': 'false'
     external_providers: ["random", "time"]
+      # Random provider
     skip_vcr: true
 virtual_fields:
   - name: 'desired_state'
diff --git a/mmv1/products/deploymentmanager/go_Deployment.yaml b/mmv1/products/deploymentmanager/go_Deployment.yaml
index d79bb7f73cdb..b138c01b60e1 100644
--- a/mmv1/products/deploymentmanager/go_Deployment.yaml
+++ b/mmv1/products/deploymentmanager/go_Deployment.yaml
@@ -39,9 +39,11 @@ create_url: 'projects/{{project}}/global/deployments?preview={{preview}}&createP
 update_url: 'projects/{{project}}/global/deployments/{{name}}?preview={{preview}}&createPolicy={{create_policy}}&deletePolicy={{delete_policy}}'
 update_verb: 'PATCH'
 delete_url: 'projects/{{project}}/global/deployments/{{name}}?deletePolicy={{delete_policy}}'
+# A deployment is updatable, but we need to have custom update behavior.
 immutable: true
 import_format:
   - 'projects/{{project}}/deployments/{{name}}'
+ # Very long to support very long deployments
 timeouts:
   insert_minutes: 60
   update_minutes: 60
@@ -61,7 +63,9 @@ async:
     path: 'error/errors'
     message: 'message'
 custom_code:
+  # Custom diff to force new if 'preview' is true
   constants: 'templates/terraform/constants/go/deployment_manager_deployment.go.tmpl'
+  # post-create failure: Delete deployment if an invalid deployment was created
   post_create_failure: 'templates/terraform/post_create_failure/go/delete_on_failure.go.tmpl'
 custom_diff:
   - 'customDiffDeploymentManagerDeployment'
@@ -79,6 +83,8 @@ examples:
       deployment_name: 'my-deployment'
     exclude_test: true
 parameters:
+  # These properties are query parameters given on create/update/delete.
+  # They should be tracked and updatable.
   - name: 'createPolicy'
     type: Enum
     description: |
@@ -106,6 +112,7 @@ parameters:
     enum_values:
       - 'ABANDON'
       - 'DELETE'
+    # Custom Update
   - name: 'preview'
     type: Boolean
     description: |
@@ -128,6 +135,7 @@ properties:
     description: |
       Unique name for the deployment
     required: true
+    # Custom Update
   - name: 'description'
     type: String
     description: |
@@ -135,6 +143,7 @@ properties:
     update_url: 'projects/{{project}}/global/deployments/{{name}}?preview={{preview}}&createPolicy={{create_policy}}&deletePolicy={{delete_policy}}'
     update_id: '1_non-preview'
     fingerprint_name: 'fingerprint'
+    # Custom Update
   - name: 'labels'
     type: Array
     description: |
@@ -155,6 +164,7 @@ properties:
           type: String
           description: |
             Value of label.
+    # Custom Update
   - name: 'target'
     type: NestedObject
     description: |
diff --git a/mmv1/products/developerconnect/go_Connection.yaml b/mmv1/products/developerconnect/go_Connection.yaml
index f60cd4718e51..f4b5a94856d1 100644
--- a/mmv1/products/developerconnect/go_Connection.yaml
+++ b/mmv1/products/developerconnect/go_Connection.yaml
@@ -19,6 +19,18 @@ description: |
 min_version: 'beta'
 docs:
 id_format: 'projects/{{project}}/locations/{{location}}/connections/{{connection_id}}'
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 base_url: 'projects/{{project}}/locations/{{location}}/connections'
 self_link: 'projects/{{project}}/locations/{{location}}/connections/{{connection_id}}'
 create_url: 'projects/{{project}}/locations/{{location}}/connections?connectionId={{connection_id}}'
diff --git a/mmv1/products/developerconnect/go_GitRepositoryLink.yaml b/mmv1/products/developerconnect/go_GitRepositoryLink.yaml
index 2117313bdf25..a870379945bf 100644
--- a/mmv1/products/developerconnect/go_GitRepositoryLink.yaml
+++ b/mmv1/products/developerconnect/go_GitRepositoryLink.yaml
@@ -44,6 +44,8 @@ async:
     message: 'message'
 custom_code:
 examples:
+  # These tests depend on secrets stored in a separate project, so we prefer not
+  # to show them in the docs.
   - name: 'developer_connect_git_repository_link_github'
     primary_resource_id: 'primary'
     min_version: 'beta'
diff --git a/mmv1/products/dialogflow/go_Agent.yaml b/mmv1/products/dialogflow/go_Agent.yaml
index 78d202bb759b..d2e4d1c259f5 100644
--- a/mmv1/products/dialogflow/go_Agent.yaml
+++ b/mmv1/products/dialogflow/go_Agent.yaml
@@ -24,6 +24,7 @@ references:
     'Official Documentation': 'https://cloud.google.com/dialogflow/docs/'
   api: 'https://cloud.google.com/dialogflow/docs/reference/rest/v2/projects/agent'
 docs:
+# Only one agent per project, API does not have an agent ID
 id_format: '{{project}}'
 base_url: 'projects/{{project}}/agent'
 self_link: 'projects/{{project}}/agent'
diff --git a/mmv1/products/dialogflow/go_EntityType.yaml b/mmv1/products/dialogflow/go_EntityType.yaml
index 8bd157a240e9..2c2974e0e3da 100644
--- a/mmv1/products/dialogflow/go_EntityType.yaml
+++ b/mmv1/products/dialogflow/go_EntityType.yaml
@@ -34,6 +34,7 @@ timeouts:
 custom_code:
   post_create: 'templates/terraform/post_create/go/set_computed_name.tmpl'
   custom_import: 'templates/terraform/custom_import/go/self_link_as_name_set_project.go.tmpl'
+# Skip sweeper gen since this is a child resource.
 exclude_sweeper: true
 examples:
   - name: 'dialogflow_entity_type_basic'
diff --git a/mmv1/products/dialogflow/go_Fulfillment.yaml b/mmv1/products/dialogflow/go_Fulfillment.yaml
index 0317e5532ddb..15a9dbb42547 100644
--- a/mmv1/products/dialogflow/go_Fulfillment.yaml
+++ b/mmv1/products/dialogflow/go_Fulfillment.yaml
@@ -40,6 +40,7 @@ timeouts:
 custom_code:
   post_create: 'templates/terraform/post_create/go/set_computed_name.tmpl'
   custom_import: 'templates/terraform/custom_import/go/self_link_as_name_set_project.go.tmpl'
+# Skip sweeper gen since this is a child resource.
 exclude_sweeper: true
 examples:
   - name: 'dialogflow_fulfillment_basic'
diff --git a/mmv1/products/dialogflow/go_Intent.yaml b/mmv1/products/dialogflow/go_Intent.yaml
index 67f548742814..38dfae270454 100644
--- a/mmv1/products/dialogflow/go_Intent.yaml
+++ b/mmv1/products/dialogflow/go_Intent.yaml
@@ -35,6 +35,7 @@ timeouts:
 custom_code:
   post_create: 'templates/terraform/post_create/go/set_computed_name.tmpl'
   custom_import: 'templates/terraform/custom_import/go/self_link_as_name_set_project.go.tmpl'
+# Skip sweeper gen since this is a child resource.
 exclude_sweeper: true
 examples:
   - name: 'dialogflow_intent_basic'
diff --git a/mmv1/products/dialogflowcx/go_Agent.yaml b/mmv1/products/dialogflowcx/go_Agent.yaml
index 7f30aef48335..e3f791c09f8a 100644
--- a/mmv1/products/dialogflowcx/go_Agent.yaml
+++ b/mmv1/products/dialogflowcx/go_Agent.yaml
@@ -170,6 +170,7 @@ properties:
         type: NestedObject
         description: |
           Settings of integration with GitHub.
+ # accessToken comes from config, no response
         custom_flatten: 'templates/terraform/custom_flatten/go/dialogflowcx_agent_git_integration_settings_github_settings.go.tmpl'
         properties:
           - name: 'displayName'
@@ -202,6 +203,7 @@ properties:
       Settings related to speech synthesizing.
     allow_empty_object: true
     properties:
+      # This is a map of language -> some settings. List of languages is large and constantly expanding so we use a string instead of a NestedObject with 100 properties.
       - name: 'synthesizeSpeechConfigs'
         type: String
         description: |
diff --git a/mmv1/products/dialogflowcx/go_Flow.yaml b/mmv1/products/dialogflowcx/go_Flow.yaml
index e993ec897858..dee86dc3f2ea 100644
--- a/mmv1/products/dialogflowcx/go_Flow.yaml
+++ b/mmv1/products/dialogflowcx/go_Flow.yaml
@@ -160,6 +160,7 @@ properties:
                         description: |
                           Whether the playback of this message can be interrupted by the end user's speech and the client can then starts the next Dialogflow request.
                         output: true
+                  # This can be an arbitrary json blob, so we use a string instead of a NestedObject.
                   - name: 'payload'
                     type: String
                     description: |
@@ -178,6 +179,7 @@ properties:
                       * In the entryFulfillment of a Page if entering the page indicates that the conversation succeeded.
                       * In a webhook response when you determine that you handled the customer issue.
                     properties:
+                      # This can be an arbitrary json blob, so we use a string instead of a NestedObject.
                       - name: 'metadata'
                         type: String
                         description: |
@@ -214,6 +216,7 @@ properties:
                       * In the entryFulfillment of a Page if entering the page indicates something went extremely wrong in the conversation.
                       * In a webhook response when you determine that the customer issue can only be handled by a human.
                     properties:
+                      # This can be an arbitrary json blob, so we use a string instead of a NestedObject.
                       - name: 'metadata'
                         type: String
                         description: |
@@ -287,6 +290,7 @@ properties:
               item_type:
                 type: NestedObject
                 properties:
+                  # This object has a recursive schema so we use a string instead of a NestedObject
                   - name: 'cases'
                     type: String
                     description: |
diff --git a/mmv1/products/dialogflowcx/go_Page.yaml b/mmv1/products/dialogflowcx/go_Page.yaml
index ef1a086db882..2367c539ed91 100644
--- a/mmv1/products/dialogflowcx/go_Page.yaml
+++ b/mmv1/products/dialogflowcx/go_Page.yaml
@@ -115,6 +115,7 @@ properties:
                   description: |
                     Whether the playback of this message can be interrupted by the end user's speech and the client can then starts the next Dialogflow request.
                   output: true
+            # This can be an arbitrary json blob, so we use a string instead of a NestedObject.
             - name: 'payload'
               type: String
               description: |
@@ -133,6 +134,7 @@ properties:
                 * In the entryFulfillment of a Page if entering the page indicates that the conversation succeeded.
                 * In a webhook response when you determine that you handled the customer issue.
               properties:
+                # This can be an arbitrary json blob, so we use a string instead of a NestedObject.
                 - name: 'metadata'
                   type: String
                   description: |
@@ -169,6 +171,7 @@ properties:
                 * In the entryFulfillment of a Page if entering the page indicates something went extremely wrong in the conversation.
                 * In a webhook response when you determine that the customer issue can only be handled by a human.
               properties:
+                # This can be an arbitrary json blob, so we use a string instead of a NestedObject.
                 - name: 'metadata'
                   type: String
                   description: |
@@ -242,6 +245,7 @@ properties:
         item_type:
           type: NestedObject
           properties:
+            # This object has a recursive schema so we use a string instead of a NestedObject
             - name: 'cases'
               type: String
               description: |
@@ -319,6 +323,7 @@ properties:
                                 description: |
                                   Whether the playback of this message can be interrupted by the end user's speech and the client can then starts the next Dialogflow request.
                                 output: true
+                          # This can be an arbitrary json blob, so we use a string instead of a NestedObject.
                           - name: 'payload'
                             type: String
                             description: |
@@ -337,6 +342,7 @@ properties:
                               * In the entryFulfillment of a Page if entering the page indicates that the conversation succeeded.
                               * In a webhook response when you determine that you handled the customer issue.
                             properties:
+                              # This can be an arbitrary json blob, so we use a string instead of a NestedObject.
                               - name: 'metadata'
                                 type: String
                                 description: |
@@ -373,6 +379,7 @@ properties:
                               * In the entryFulfillment of a Page if entering the page indicates something went extremely wrong in the conversation.
                               * In a webhook response when you determine that the customer issue can only be handled by a human.
                             properties:
+                              # This can be an arbitrary json blob, so we use a string instead of a NestedObject.
                               - name: 'metadata'
                                 type: String
                                 description: |
@@ -446,6 +453,7 @@ properties:
                       item_type:
                         type: NestedObject
                         properties:
+                          # This object has a recursive schema so we use a string instead of a NestedObject
                           - name: 'cases'
                             type: String
                             description: |
@@ -514,6 +522,7 @@ properties:
                                       description: |
                                         Whether the playback of this message can be interrupted by the end user's speech and the client can then starts the next Dialogflow request.
                                       output: true
+                                # This can be an arbitrary json blob, so we use a string instead of a NestedObject.
                                 - name: 'payload'
                                   type: String
                                   description: |
@@ -532,6 +541,7 @@ properties:
                                     * In the entryFulfillment of a Page if entering the page indicates that the conversation succeeded.
                                     * In a webhook response when you determine that you handled the customer issue.
                                   properties:
+                                    # This can be an arbitrary json blob, so we use a string instead of a NestedObject.
                                     - name: 'metadata'
                                       type: String
                                       description: |
@@ -568,6 +578,7 @@ properties:
                                     * In the entryFulfillment of a Page if entering the page indicates something went extremely wrong in the conversation.
                                     * In a webhook response when you determine that the customer issue can only be handled by a human.
                                   properties:
+                                    # This can be an arbitrary json blob, so we use a string instead of a NestedObject.
                                     - name: 'metadata'
                                       type: String
                                       description: |
@@ -641,6 +652,7 @@ properties:
                             item_type:
                               type: NestedObject
                               properties:
+                                # This object has a recursive schema so we use a string instead of a NestedObject
                                 - name: 'cases'
                                   type: String
                                   description: |
@@ -661,6 +673,7 @@ properties:
                         description: |
                           The target flow to transition to.
                           Format: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>.
+            # This can be an arbitrary value, so we use a string instead of a NestedObject.
             - name: 'defaultValue'
               type: String
               description: |
@@ -772,6 +785,7 @@ properties:
                         description: |
                           Whether the playback of this message can be interrupted by the end user's speech and the client can then starts the next Dialogflow request.
                         output: true
+                  # This can be an arbitrary json blob, so we use a string instead of a NestedObject.
                   - name: 'payload'
                     type: String
                     description: |
@@ -790,6 +804,7 @@ properties:
                       * In the entryFulfillment of a Page if entering the page indicates that the conversation succeeded.
                       * In a webhook response when you determine that you handled the customer issue.
                     properties:
+                      # This can be an arbitrary json blob, so we use a string instead of a NestedObject.
                       - name: 'metadata'
                         type: String
                         description: |
@@ -826,6 +841,7 @@ properties:
                       * In the entryFulfillment of a Page if entering the page indicates something went extremely wrong in the conversation.
                       * In a webhook response when you determine that the customer issue can only be handled by a human.
                     properties:
+                      # This can be an arbitrary json blob, so we use a string instead of a NestedObject.
                       - name: 'metadata'
                         type: String
                         description: |
@@ -899,6 +915,7 @@ properties:
               item_type:
                 type: NestedObject
                 properties:
+                  # This object has a recursive schema so we use a string instead of a NestedObject
                   - name: 'cases'
                     type: String
                     description: |
diff --git a/mmv1/products/dialogflowcx/go_TestCase.yaml b/mmv1/products/dialogflowcx/go_TestCase.yaml
index e768e5c4731d..b980298167fb 100644
--- a/mmv1/products/dialogflowcx/go_TestCase.yaml
+++ b/mmv1/products/dialogflowcx/go_TestCase.yaml
@@ -122,6 +122,7 @@ properties:
               description: |
                 User input. Supports text input, event input, dtmf input in the test case.
               properties:
+                # Does not support intent or audio as of this writing. https://cloud.google.com/dialogflow/cx/docs/reference/rest/v3/ConversationTurn#userinput
                 - name: 'languageCode'
                   type: String
                   description: |
@@ -162,6 +163,7 @@ properties:
                       type: String
                       description: |
                         The finish digit (if any).
+            # This can be an arbitrary json blob, so we use a string instead of a NestedObject.
             - name: 'injectedParameters'
               type: String
               description: |
@@ -184,6 +186,7 @@ properties:
           description: |
             The virtual agent output.
           properties:
+            # This can be an arbitrary json blob, so we use a string instead of a NestedObject.
             - name: 'sessionParameters'
               type: String
               description: |
@@ -207,6 +210,7 @@ properties:
                   type: String
                   description: |
                     The human-readable name of the intent, unique within the agent.
+                  # Output only because you can't set it independently of name; if they don't match, displayName is ignored and may lead to spurious changes
                   output: true
             - name: 'currentPage'
               type: NestedObject
@@ -312,6 +316,7 @@ properties:
                           type: String
                           description: |
                             The finish digit (if any).
+                # This can be an arbitrary json blob, so we use a string instead of a NestedObject.
                 - name: 'injectedParameters'
                   type: String
                   description: |
@@ -334,6 +339,7 @@ properties:
               description: |
                 The virtual agent output.
               properties:
+                # This can be an arbitrary json blob, so we use a string instead of a NestedObject.
                 - name: 'sessionParameters'
                   type: String
                   description: |
diff --git a/mmv1/products/dlp/go_DeidentifyTemplate.yaml b/mmv1/products/dlp/go_DeidentifyTemplate.yaml
index 3ffd73c7a16b..5c6729daaa2c 100644
--- a/mmv1/products/dlp/go_DeidentifyTemplate.yaml
+++ b/mmv1/products/dlp/go_DeidentifyTemplate.yaml
@@ -36,6 +36,7 @@ custom_code:
   update_encoder: 'templates/terraform/encoders/go/wrap_object.go.tmpl'
   decoder: 'templates/terraform/decoders/go/dlp_template_id.go.tmpl'
   custom_import: 'templates/terraform/custom_import/go/dlp_import.go.tmpl'
+# Skip sweeper due to non-standard URL
 exclude_sweeper: true
 examples:
   - name: 'dlp_deidentify_template_basic'
@@ -187,18 +188,22 @@ properties:
                   description:
                     Apply transformation to all findings not specified in other
                     ImageTransformation's selectedInfoTypes.
+                    # The fields below are necessary to include the "allInfoTypes" transformation in the payload
                   send_empty_value: true
                   allow_empty_object: true
                   properties:
+ # Meant to be an empty object with no properties - see here : https://cloud.google.com/dlp/docs/reference/rest/v2/projects.deidentifyTemplates#allinfotypes
                     []
                 - name: 'allText'
                   type: NestedObject
                   description:
                     Apply transformation to all text that doesn't match an
                     infoType.
+                    # The fields below are necessary to include the "allText" transformation in the payload
                   send_empty_value: true
                   allow_empty_object: true
                   properties:
+ # Meant to be an empty object with no properties - see here : https://cloud.google.com/dlp/docs/reference/rest/v2/projects.deidentifyTemplates#alltext
                     []
       - name: 'infoTypeTransformations'
         type: NestedObject
@@ -613,10 +618,15 @@ properties:
                           description: |
                             Common alphabets.
                           enum_values:
+ # Unused.
                             - 'FFX_COMMON_NATIVE_ALPHABET_UNSPECIFIED'
+ # [0-9] (radix of 10)
                             - 'NUMERIC'
+ # [0-9A-F] (radix of 16)
                             - 'HEXADECIMAL'
+ # [0-9A-Z] (radix of 36)
                             - 'UPPER_CASE_ALPHA_NUMERIC'
+ # [0-9A-Za-z] (radix of 62)
                             - 'ALPHA_NUMERIC'
                         - name: 'customAlphabet'
                           type: String
@@ -1036,19 +1046,28 @@ properties:
                           type: Enum
                           description: The part of the time to keep.
                           enum_values:
+ # [0-9999]
                             - 'YEAR'
+ # [1-12]
                             - 'MONTH'
+ # [1-31]
                             - 'DAY_OF_MONTH'
+ # [1-7]
                             - 'DAY_OF_WEEK'
+ # [1-53]
                             - 'WEEK_OF_YEAR'
+ # [0-23]
                             - 'HOUR_OF_DAY'
                     - name: 'redactConfig'
                       type: NestedObject
                       description: |
                         Redact a given value. For example, if used with an InfoTypeTransformation transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '.
+                      # The fields below are necessary to include the "redactConfig" transformation in the payload
+                      # A side-effect is null values when the field is unused, see: https://github.com/hashicorp/terraform-provider-google/issues/13201
                       send_empty_value: true
                       allow_empty_object: true
                       properties:
+ # Meant to be an empty object with no properties - see here : https://cloud.google.com/dlp/docs/reference/rest/v2/projects.deidentifyTemplates#redactconfig
                         []
                     - name: 'cryptoHashConfig'
                       type: NestedObject
@@ -1227,6 +1246,7 @@ properties:
                                             description: |
                                               Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.
                                             validation:
+ # "An API may choose to allow the value "24:00:00" for scenarios like business closing time."
                                               function: 'validation.IntBetween(0, 24)'
                                           - name: 'minutes'
                                             type: Integer
@@ -1243,6 +1263,7 @@ properties:
                                               API may allow the value 60 if it
                                               allows leap-seconds.
                                             validation:
+ # "An API may allow the value 60 if it allows leap-seconds."
                                               function: 'validation.IntBetween(0, 60)'
                                           - name: 'nanos'
                                             type: Integer
@@ -1341,6 +1362,7 @@ properties:
                                   description: |
                                     Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.
                                   validation:
+ # "An API may choose to allow the value "24:00:00" for scenarios like business closing time."
                                     function: 'validation.IntBetween(0, 24)'
                                 - name: 'minutes'
                                   type: Integer
@@ -1356,6 +1378,7 @@ properties:
                                     normally be from 0 to 59. An API may allow
                                     the value 60 if it allows leap-seconds.
                                   validation:
+ # "An API may allow the value 60 if it allows leap-seconds."
                                     function: 'validation.IntBetween(0, 60)'
                                 - name: 'nanos'
                                   type: Integer
@@ -1407,9 +1430,12 @@ properties:
                       type: NestedObject
                       description: |
                         Redact a given value. For example, if used with an InfoTypeTransformation transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '.
+                      # The fields below are necessary to include the "redactConfig" transformation in the payload
+                      # A side-effect is null values when the field is unused, see: https://github.com/hashicorp/terraform-provider-google/issues/13201
                       send_empty_value: true
                       allow_empty_object: true
                       properties:
+ # Meant to be an empty object with no properties - see here : https://cloud.google.com/dlp/docs/reference/rest/v2/projects.deidentifyTemplates#redactconfig
                         []
                     - name: 'characterMaskConfig'
                       type: NestedObject
@@ -2314,6 +2340,7 @@ properties:
                               required: true
                               item_type:
                                 type: String
+                # infoTypeTransformations inside the recordTransformations
                 - name: 'infoTypeTransformations'
                   type: NestedObject
                   description: |
@@ -2466,9 +2493,12 @@ properties:
                                 type: NestedObject
                                 description: |
                                   Redact a given value. For example, if used with an InfoTypeTransformation transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '.
+                                # The fields below are necessary to include the "redactConfig" transformation in the payload
+                                # A side-effect is null values when the field is unused, see: https://github.com/hashicorp/terraform-provider-google/issues/13201
                                 send_empty_value: true
                                 allow_empty_object: true
                                 properties:
+ # Meant to be an empty object with no properties - see here : https://cloud.google.com/dlp/docs/reference/rest/v2/projects.deidentifyTemplates#redactconfig
                                   []
                               - name: 'characterMaskConfig'
                                 type: NestedObject
@@ -2638,9 +2668,13 @@ properties:
                                     description: |
                                       Common alphabets. Only one of this, `custom_alphabet` or `radix` must be specified.
                                     enum_values:
+ # [0-9] (radix of 10)
                                       - 'NUMERIC'
+ # [0-9A-F] (radix of 16)
                                       - 'HEXADECIMAL'
+ # [0-9A-Z] (radix of 36)
                                       - 'UPPER_CASE_ALPHA_NUMERIC'
+ # [0-9A-Za-z] (radix of 62)
                                       - 'ALPHA_NUMERIC'
                                   - name: 'customAlphabet'
                                     type: String
@@ -2991,9 +3025,12 @@ properties:
                                 type: NestedObject
                                 description: |
                                   Replace each matching finding with the name of the info type.
+                                # The fields below are necessary to include the "replaceWithInfoTypeConfig" transformation in the payload
+                                # A side-effect is null values when the field is unused, see: https://github.com/hashicorp/terraform-provider-google/issues/13201
                                 send_empty_value: true
                                 allow_empty_object: true
                                 properties:
+ # Meant to be an empty object with no properties - see here : https://cloud.google.com/dlp/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.ReplaceWithInfoTypeConfig
                                   []
                               - name: 'timePartConfig'
                                 type: NestedObject
@@ -3006,11 +3043,17 @@ properties:
                                     description: The part of the time to keep.
                                     required: true
                                     enum_values:
+ # [0-9999]
                                       - 'YEAR'
+ # [1-12]
                                       - 'MONTH'
+ # [1-31]
                                       - 'DAY_OF_MONTH'
+ # [1-7]
                                       - 'DAY_OF_WEEK'
+ # [1-53]
                                       - 'WEEK_OF_YEAR'
+ # [0-23]
                                       - 'HOUR_OF_DAY'
                               - name: 'cryptoHashConfig'
                                 type: NestedObject
diff --git a/mmv1/products/dlp/go_DiscoveryConfig.yaml b/mmv1/products/dlp/go_DiscoveryConfig.yaml
index 8eb47869790d..d7c050cf9d61 100644
--- a/mmv1/products/dlp/go_DiscoveryConfig.yaml
+++ b/mmv1/products/dlp/go_DiscoveryConfig.yaml
@@ -13,7 +13,9 @@
 
 # Warning: This is a temporary file, and should not be edited directly
 ---
+# API resource name
 name: 'DiscoveryConfig'
+# Resource description for the provider documentation.
 description: |
   Configuration for discovery to scan resources for profile generation. Only one discovery configuration may exist per organization, folder, or project.
 references:
@@ -289,9 +291,11 @@ properties:
                 - name: 'otherTables'
                   type: NestedObject
                   description: Catch-all. This should always be the last filter in the list because anything above it will apply first.
+                    # The fields below are necessary to include the "otherTables" filter in the payload
                   send_empty_value: true
                   allow_empty_object: true
                   properties:
+ # Meant to be an empty object with no properties - see here : https://cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/organizations.locations.discoveryConfigs#allotherbigquerytables
                     []
                 - name: 'tableReference'
                   type: NestedObject
@@ -404,9 +408,11 @@ properties:
             - name: 'disabled'
               type: NestedObject
               description: 'Tables that match this filter will not have profiles created.'
+                # The fields below are necessary to include the "disabled" filter in the payload
               send_empty_value: true
               allow_empty_object: true
               properties:
+ # Meant to be an empty object with no properties - see here : https://cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/organizations.locations.discoveryConfigs#disabled
                 []
         - name: 'cloudSqlTarget'
           type: NestedObject
@@ -449,6 +455,7 @@ properties:
                   send_empty_value: true
                   allow_empty_object: true
                   properties:
+ # Meant to be an empty object with no properties. The fields below are necessary to include the "others" filter in the payload
                     []
                 - name: 'databaseResourceReference'
                   type: NestedObject
@@ -552,9 +559,11 @@ properties:
         - name: 'secretsTarget'
           type: NestedObject
           description: Discovery target that looks for credentials and secrets stored in cloud resource metadata and reports them as vulnerabilities to Security Command Center. Only one target of this type is allowed.
+            # The fields below are necessary to include the "secretsDiscoveryTarget" target in the payload
           send_empty_value: true
           allow_empty_object: true
           properties:
+ # Meant to be an empty object with no properties - see here : https://cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/organizations.locations.discoveryConfigs#DiscoveryConfig.SecretsDiscoveryTarget
             []
         - name: 'cloudStorageTarget'
           type: NestedObject
@@ -605,6 +614,7 @@ properties:
                   send_empty_value: true
                   allow_empty_object: true
                   properties:
+ # Meant to be an empty object with no properties. The fields below are necessary to include the "others" filter in the payload
                     []
             - name: 'conditions'
               type: NestedObject
diff --git a/mmv1/products/dlp/go_InspectTemplate.yaml b/mmv1/products/dlp/go_InspectTemplate.yaml
index b9fce74fd8c3..5b7cef9fb559 100644
--- a/mmv1/products/dlp/go_InspectTemplate.yaml
+++ b/mmv1/products/dlp/go_InspectTemplate.yaml
@@ -36,6 +36,7 @@ custom_code:
   update_encoder: 'templates/terraform/encoders/go/wrap_object.go.tmpl'
   decoder: 'templates/terraform/decoders/go/dlp_template_id.go.tmpl'
   custom_import: 'templates/terraform/custom_import/go/dlp_import.go.tmpl'
+# Skip sweeper due to non-standard URL
 exclude_sweeper: true
 examples:
   - name: 'dlp_inspect_template_basic'
diff --git a/mmv1/products/dlp/go_JobTrigger.yaml b/mmv1/products/dlp/go_JobTrigger.yaml
index 73c8d72c8915..23c2fdeccd93 100644
--- a/mmv1/products/dlp/go_JobTrigger.yaml
+++ b/mmv1/products/dlp/go_JobTrigger.yaml
@@ -36,6 +36,7 @@ custom_code:
   update_encoder: 'templates/terraform/encoders/go/wrap_object.go.tmpl'
   decoder: 'templates/terraform/decoders/go/dlp_job_trigger.go.tmpl'
   custom_import: 'templates/terraform/custom_import/go/dlp_import.go.tmpl'
+# Skip sweeper due to non-standard URL
 exclude_sweeper: true
 examples:
   - name: 'dlp_job_trigger_basic'
@@ -725,9 +726,11 @@ properties:
                   type: NestedObject
                   description: |
                     Message for detecting output from deidentification transformations that support reversing.
+                  # The fields below are necessary to include the "surrogateType" in the payload
                   send_empty_value: true
                   allow_empty_object: true
                   properties:
+ # Meant to be an empty object with no properties - see here : https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#SurrogateType
                     []
       - name: 'storageConfig'
         type: NestedObject
@@ -1061,6 +1064,15 @@ properties:
           properties:
             - name: 'saveFindings'
               type: NestedObject
+              # TODO: uncomment here once they are supported(github.com/hashicorp/terraform-plugin-sdk/issues/470)
+              # exactly_one_of:
+              #   - save_findings
+              #   - pub_sub
+              #   - publish_findings_to_cloud_data_catalog
+              #   - publish_summary_to_cscc
+              #   - job_notification_emails
+              #   - deidentify
+              #   - publish_to_stackdriver
               description: |
                 If set, the detailed findings will be persisted to the specified OutputStorageConfig. Only a single instance of this action can be specified. Compatible with: Inspect, Risk
               properties:
@@ -1110,6 +1122,15 @@ properties:
                         - 'ALL_COLUMNS'
             - name: 'pubSub'
               type: NestedObject
+              # TODO: uncomment here once they are supported(github.com/hashicorp/terraform-plugin-sdk/issues/470)
+              # exactly_one_of:
+              #   - save_findings
+              #   - pub_sub
+              #   - publish_findings_to_cloud_data_catalog
+              #   - publish_summary_to_cscc
+              #   - job_notification_emails
+              #   - deidentify
+              #   - publish_to_stackdriver
               description: |
                 Publish a message into a given Pub/Sub topic when the job completes.
               properties:
@@ -1123,6 +1144,15 @@ properties:
               description: |
                 Publish the result summary of a DlpJob to the Cloud Security Command Center.
               send_empty_value: true
+              # TODO: uncomment here once they are supported(github.com/hashicorp/terraform-plugin-sdk/issues/470)
+              # exactly_one_of:
+              #   - save_findings
+              #   - pub_sub
+              #   - publish_findings_to_cloud_data_catalog
+              #   - publish_summary_to_cscc
+              #   - job_notification_emails
+              #   - deidentify
+              #   - publish_to_stackdriver
               allow_empty_object: true
               properties:
                 []
@@ -1131,6 +1161,15 @@ properties:
               description: |
                 Publish findings of a DlpJob to Data Catalog.
               send_empty_value: true
+              # TODO: uncomment here once they are supported(github.com/hashicorp/terraform-plugin-sdk/issues/470)
+              # exactly_one_of:
+              #   - save_findings
+              #   - pub_sub
+              #   - publish_findings_to_cloud_data_catalog
+              #   - publish_summary_to_cscc
+              #   - job_notification_emails
+              #   - deidentify
+              #   - publish_to_stackdriver
               allow_empty_object: true
               properties:
                 []
@@ -1139,11 +1178,29 @@ properties:
               description: |
                 Sends an email when the job completes. The email goes to IAM project owners and technical Essential Contacts.
               send_empty_value: true
+              # TODO: uncomment here once they are supported(github.com/hashicorp/terraform-plugin-sdk/issues/470)
+              # exactly_one_of:
+              #   - save_findings
+              #   - pub_sub
+              #   - publish_findings_to_cloud_data_catalog
+              #   - publish_summary_to_cscc
+              #   - job_notification_emails
+              #   - deidentify
+              #   - publish_to_stackdriver
               allow_empty_object: true
               properties:
                 []
             - name: 'deidentify'
               type: NestedObject
+              # TODO: uncomment here once they are supported(github.com/hashicorp/terraform-plugin-sdk/issues/470)
+              # exactly_one_of:
+              #   - save_findings
+              #   - pub_sub
+              #   - publish_findings_to_cloud_data_catalog
+              #   - publish_summary_to_cscc
+              #   - job_notification_emails
+              #   - deidentify
+              #   - publish_to_stackdriver
               description: |
                 Create a de-identified copy of the requested table or files.
               properties:
@@ -1227,6 +1284,15 @@ properties:
               description: |
                 Enable Stackdriver metric dlp.googleapis.com/findingCount.
               send_empty_value: true
+              # TODO: uncomment here once they are supported(github.com/hashicorp/terraform-plugin-sdk/issues/470)
+              # exactly_one_of:
+              #   - save_findings
+              #   - pub_sub
+              #   - publish_findings_to_cloud_data_catalog
+              #   - publish_summary_to_cscc
+              #   - job_notification_emails
+              #   - deidentify
+              #   - publish_to_stackdriver
               allow_empty_object: true
               properties:
                 []
diff --git a/mmv1/products/dlp/go_StoredInfoType.yaml b/mmv1/products/dlp/go_StoredInfoType.yaml
index dd4c79b6fec2..f8105491786f 100644
--- a/mmv1/products/dlp/go_StoredInfoType.yaml
+++ b/mmv1/products/dlp/go_StoredInfoType.yaml
@@ -46,6 +46,7 @@ custom_code:
   custom_import: 'templates/terraform/custom_import/go/dlp_import.go.tmpl'
 custom_diff:
   - 'storedInfoTypeCustomizeDiff'
+# Skip sweeper due to non-standard URL
 exclude_sweeper: true
 examples:
   - name: 'dlp_stored_info_type_basic'
diff --git a/mmv1/products/dns/go_ManagedZone.yaml b/mmv1/products/dns/go_ManagedZone.yaml
index c616ba0e3ca2..15a53b68c853 100644
--- a/mmv1/products/dns/go_ManagedZone.yaml
+++ b/mmv1/products/dns/go_ManagedZone.yaml
@@ -63,6 +63,7 @@ examples:
   - name: 'dns_managed_zone_basic'
     primary_resource_id: 'example-zone'
     external_providers: ["random", "time"]
+      # Randomness from random provider
     skip_vcr: true
   - name: 'dns_managed_zone_private'
     primary_resource_id: 'private-zone'
@@ -312,6 +313,8 @@ properties:
         item_type:
           type: NestedObject
           properties:
+            # TODO(drebes): Make 'networkUrl' a ResourceRef once cross-module references
+            # are possible.
             - name: 'networkUrl'
               type: String
               description: |
@@ -372,6 +375,8 @@ properties:
         description: 'The network with which to peer.'
         required: true
         properties:
+          # TODO(drebes): Make 'networkUrl' a ResourceRef once cross-module references
+          # are possible.
           - name: 'networkUrl'
             type: String
             description: |
diff --git a/mmv1/products/documentaiwarehouse/go_DocumentSchema.yaml b/mmv1/products/documentaiwarehouse/go_DocumentSchema.yaml
index eaaf7a08b75c..3f771b1e5cfc 100644
--- a/mmv1/products/documentaiwarehouse/go_DocumentSchema.yaml
+++ b/mmv1/products/documentaiwarehouse/go_DocumentSchema.yaml
@@ -128,6 +128,7 @@ properties:
                 type: String
                 description: |
                   The Doc AI processor type name.
+        # select any one of the property types (integer, float, text, property, enum, dateTime, map, timestamp)
         - name: 'integerTypeOptions'
           type: NestedObject
           description: |
diff --git a/mmv1/products/edgecontainer/go_Cluster.yaml b/mmv1/products/edgecontainer/go_Cluster.yaml
index 2ea64ff01269..8bbeda31749e 100644
--- a/mmv1/products/edgecontainer/go_Cluster.yaml
+++ b/mmv1/products/edgecontainer/go_Cluster.yaml
@@ -57,12 +57,16 @@ examples:
     primary_resource_id: 'default'
     vars:
       edgecontainer_cluster_name: 'basic-cluster'
+    # Currently failing
     skip_vcr: true
   - name: 'edgecontainer_cluster_with_maintenance_window'
     primary_resource_id: 'default'
     vars:
       edgecontainer_cluster_name: 'cluster-with-maintenance'
+    # Currently failing
     skip_vcr: true
+  # Skip the local control plane cluster test as we only have limited machine resources.
+  # Instead the local control plane cluster test will be tested in the node pool test.
   - name: 'edgecontainer_local_control_plane_cluster'
     primary_resource_id: 'default'
     vars:
diff --git a/mmv1/products/edgecontainer/go_NodePool.yaml b/mmv1/products/edgecontainer/go_NodePool.yaml
index 28f05430f938..22eb633d1b4e 100644
--- a/mmv1/products/edgecontainer/go_NodePool.yaml
+++ b/mmv1/products/edgecontainer/go_NodePool.yaml
@@ -53,6 +53,9 @@ async:
     message: 'message'
 custom_code:
 examples:
+  # Skip the node-pool test as we only have limited machine resources
+  # The node-pool creation is tested in edgecontainer_local_control_plane_node_pool_internal
+  # in order to avoid exposing the node location and machine name to public.
   - name: 'edgecontainer_node_pool'
     primary_resource_id: 'default'
     exclude_test: true
diff --git a/mmv1/products/edgecontainer/go_VpnConnection.yaml b/mmv1/products/edgecontainer/go_VpnConnection.yaml
index 900a597887c0..54e0df428056 100644
--- a/mmv1/products/edgecontainer/go_VpnConnection.yaml
+++ b/mmv1/products/edgecontainer/go_VpnConnection.yaml
@@ -47,6 +47,7 @@ async:
     message: 'message'
 custom_code:
 examples:
+  # Skip the vpnconnection test as we only have limited machine resources, and the vpn connection is not a critical feature.
   - name: 'edgecontainer_vpn_connection'
     primary_resource_id: 'default'
     exclude_test: true
diff --git a/mmv1/products/filestore/go_Instance.yaml b/mmv1/products/filestore/go_Instance.yaml
index 310812a20130..9ea726e4f017 100644
--- a/mmv1/products/filestore/go_Instance.yaml
+++ b/mmv1/products/filestore/go_Instance.yaml
@@ -251,6 +251,9 @@ properties:
             addresses reserved for this instance.
           immutable: true
           default_from_api: true
+          # When using connectMode=PRIVATE_SERVICE_ACCESS, the returned value
+          # won't match the sent value as the returned value is an IP range
+          # from the provided named range.
           custom_flatten: 'templates/terraform/custom_flatten/go/filestore_instance_networks_reserved_ip_range.go.tmpl'
         - name: 'ipAddresses'
           type: Array
diff --git a/mmv1/products/firebase/go_AndroidApp.yaml b/mmv1/products/firebase/go_AndroidApp.yaml
index 1461f92b5c00..7363e9305d2c 100644
--- a/mmv1/products/firebase/go_AndroidApp.yaml
+++ b/mmv1/products/firebase/go_AndroidApp.yaml
@@ -56,6 +56,7 @@ identity:
   - name
 custom_code:
   custom_delete: 'templates/terraform/custom_delete/go/firebase_app_deletion_policy.tmpl'
+# Sweeper skipped as this resource has customized deletion.
 exclude_sweeper: true
 examples:
   - name: 'firebase_android_app_basic'
diff --git a/mmv1/products/firebase/go_AppleApp.yaml b/mmv1/products/firebase/go_AppleApp.yaml
index 8f3b8e961845..e57ab666b772 100644
--- a/mmv1/products/firebase/go_AppleApp.yaml
+++ b/mmv1/products/firebase/go_AppleApp.yaml
@@ -56,6 +56,7 @@ identity:
   - name
 custom_code:
   custom_delete: 'templates/terraform/custom_delete/go/firebase_app_deletion_policy.tmpl'
+# Sweeper skipped as this resource has customized deletion.
 exclude_sweeper: true
 examples:
   - name: 'firebase_apple_app_basic'
@@ -75,6 +76,7 @@ examples:
       display_name: 'Display Name Full'
       bundle_id: 'apple.app.12345'
       app_store_id: '12345'
+ # Has to be a 10-digit number.
       team_id: '9987654321'
       api_key_name: 'api-key'
     test_env_vars:
diff --git a/mmv1/products/firebase/go_WebApp.yaml b/mmv1/products/firebase/go_WebApp.yaml
index d96ff75bf4e5..fceb68fca592 100644
--- a/mmv1/products/firebase/go_WebApp.yaml
+++ b/mmv1/products/firebase/go_WebApp.yaml
@@ -56,8 +56,10 @@ identity:
   - name
 custom_code:
   custom_delete: 'templates/terraform/custom_delete/go/firebase_app_deletion_policy.tmpl'
+# Sweeper skipped as this resource has customized deletion.
 exclude_sweeper: true
 examples:
+ # TODO: https://github.com/hashicorp/terraform-provider-google/issues/14158
   - name: 'firebase_web_app_basic'
     primary_resource_id: 'basic'
     min_version: 'beta'
diff --git a/mmv1/products/firebaseappcheck/go_AppAttestConfig.yaml b/mmv1/products/firebaseappcheck/go_AppAttestConfig.yaml
index c2026a9d1c81..8ec602740d4e 100644
--- a/mmv1/products/firebaseappcheck/go_AppAttestConfig.yaml
+++ b/mmv1/products/firebaseappcheck/go_AppAttestConfig.yaml
@@ -43,17 +43,20 @@ examples:
     primary_resource_id: 'default'
     min_version: 'beta'
     vars:
+      # Don't add random suffix
       team_id: '9987654321'
       bundle_id: 'bundle.id.appattest'
     test_env_vars:
       project_id: 'PROJECT_NAME'
     test_vars_overrides:
       'team_id': '"9987654321"'
+    # Need the time_sleep resource
     external_providers: ["random", "time"]
   - name: 'firebase_app_check_app_attest_config_full'
     primary_resource_id: 'default'
     min_version: 'beta'
     vars:
+      # Don't add random suffix
       team_id: '9987654321'
       bundle_id: 'bundle.id.appattest'
       token_ttl: '7200s'
@@ -62,6 +65,7 @@ examples:
     test_vars_overrides:
       'team_id': '"9987654321"'
       'token_ttl': '"7200s"'
+    # Need the time_sleep resource
     external_providers: ["random", "time"]
 parameters:
   - name: 'app_id'
diff --git a/mmv1/products/firebaseappcheck/go_DebugToken.yaml b/mmv1/products/firebaseappcheck/go_DebugToken.yaml
index cc0afd770dfb..3d868ff9d505 100644
--- a/mmv1/products/firebaseappcheck/go_DebugToken.yaml
+++ b/mmv1/products/firebaseappcheck/go_DebugToken.yaml
@@ -49,7 +49,9 @@ examples:
     test_env_vars:
       project_id: 'PROJECT_NAME'
     test_vars_overrides:
+      # Don't add prefix. This string is a random UUID4
       'token': '"5E728315-E121-467F-BCA1-1FE71130BB98"'
+    # Need the time_sleep resource
     external_providers: ["random", "time"]
 parameters:
   - name: 'app_id'
diff --git a/mmv1/products/firebaseappcheck/go_DeviceCheckConfig.yaml b/mmv1/products/firebaseappcheck/go_DeviceCheckConfig.yaml
index d34a53f11063..f17241e43c0f 100644
--- a/mmv1/products/firebaseappcheck/go_DeviceCheckConfig.yaml
+++ b/mmv1/products/firebaseappcheck/go_DeviceCheckConfig.yaml
@@ -51,9 +51,11 @@ examples:
     test_env_vars:
       project_id: 'PROJECT_NAME'
     test_vars_overrides:
+      # Don't add random suffix
       'private_key_path': '"test-fixtures/private-key-2.p8"'
       'team_id': '"9987654321"'
       'token_ttl': '"7200s"'
+    # Need the time_sleep resource
     external_providers: ["random", "time"]
 parameters:
   - name: 'app_id'
diff --git a/mmv1/products/firebaseappcheck/go_PlayIntegrityConfig.yaml b/mmv1/products/firebaseappcheck/go_PlayIntegrityConfig.yaml
index a91ccd95f407..818368f659f8 100644
--- a/mmv1/products/firebaseappcheck/go_PlayIntegrityConfig.yaml
+++ b/mmv1/products/firebaseappcheck/go_PlayIntegrityConfig.yaml
@@ -46,17 +46,20 @@ examples:
       package_name: 'package.name.playintegrity'
     test_env_vars:
       project_id: 'PROJECT_NAME'
+    # Need the time_sleep resource
     external_providers: ["random", "time"]
   - name: 'firebase_app_check_play_integrity_config_full'
     primary_resource_id: 'default'
     min_version: 'beta'
     vars:
       package_name: 'package.name.playintegrity'
+      # Don't add random suffix
       token_ttl: '7200s'
     test_env_vars:
       project_id: 'PROJECT_NAME'
     test_vars_overrides:
       'token_ttl': '"7200s"'
+    # Need the time_sleep resource
     external_providers: ["random", "time"]
 parameters:
   - name: 'app_id'
diff --git a/mmv1/products/firebaseappcheck/go_RecaptchaEnterpriseConfig.yaml b/mmv1/products/firebaseappcheck/go_RecaptchaEnterpriseConfig.yaml
index ae5a3f9428bb..4c3abaa1442a 100644
--- a/mmv1/products/firebaseappcheck/go_RecaptchaEnterpriseConfig.yaml
+++ b/mmv1/products/firebaseappcheck/go_RecaptchaEnterpriseConfig.yaml
@@ -42,13 +42,16 @@ examples:
     primary_resource_id: 'default'
     min_version: 'beta'
     vars:
+      # Don't add random suffix
       token_ttl: '7200s'
+      # A valid key, but is actually unusable
       site_key: '6LdpMXIpAAAAANkwWQPgEdjEhal7ugkH9RK9ytuw'
     test_env_vars:
       project_id: 'PROJECT_NAME'
     test_vars_overrides:
       'token_ttl': '"7200s"'
       'site_key': '"6LdpMXIpAAAAANkwWQPgEdjEhal7ugkH9RK9ytuw"'
+    # Need the time_sleep resource
     external_providers: ["random", "time"]
 parameters:
   - name: 'app_id'
diff --git a/mmv1/products/firebaseappcheck/go_RecaptchaV3Config.yaml b/mmv1/products/firebaseappcheck/go_RecaptchaV3Config.yaml
index ca6e373c87f0..193154c1f606 100644
--- a/mmv1/products/firebaseappcheck/go_RecaptchaV3Config.yaml
+++ b/mmv1/products/firebaseappcheck/go_RecaptchaV3Config.yaml
@@ -42,13 +42,16 @@ examples:
     primary_resource_id: 'default'
     min_version: 'beta'
     vars:
+      # Don't add random suffix
       token_ttl: '7200s'
+      # A valid secret, but is actually unusable
       site_secret: '6Lf9YnQpAAAAAC3-MHmdAllTbPwTZxpUw5d34YzX'
     test_env_vars:
       project_id: 'PROJECT_NAME'
     test_vars_overrides:
       'token_ttl': '"7200s"'
       'site_secret': '"6Lf9YnQpAAAAAC3-MHmdAllTbPwTZxpUw5d34YzX"'
+    # Need the time_sleep resource
     external_providers: ["random", "time"]
 parameters:
   - name: 'app_id'
diff --git a/mmv1/products/firebaseextensions/go_Instance.yaml b/mmv1/products/firebaseextensions/go_Instance.yaml
index b82662f69de6..44a6f766e526 100644
--- a/mmv1/products/firebaseextensions/go_Instance.yaml
+++ b/mmv1/products/firebaseextensions/go_Instance.yaml
@@ -25,6 +25,7 @@ self_link: 'projects/{{project}}/instances/{{instance_id}}'
 create_url: 'projects/{{project}}/instances?instanceId={{instance_id}}'
 update_verb: 'PATCH'
 update_mask: true
+  # TODO: add API field once documentation is ready
 import_format:
   - 'projects/{{project}}/instances/{{instance_id}}'
   - '{{project}}/{{instance_id}}'
@@ -53,6 +54,7 @@ examples:
     primary_resource_id: 'resize_image'
     min_version: 'beta'
     vars:
+      # using a hyphen "-"" because underscore is not a valid instance ID
       instance-id: 'storage-resize-images'
       bucket_id: 'bucket-id'
       service-account-id: 's-a'
@@ -130,6 +132,7 @@ properties:
         type: String
         description: The ref of the Extension from the Registry (e.g. publisher-id/awesome-extension)
         min_version: 'beta'
+        # Installing from an extensionRef is the only way for now
         required: true
         immutable: true
       - name: 'extensionVersion'
diff --git a/mmv1/products/firebasehosting/go_CustomDomain.yaml b/mmv1/products/firebasehosting/go_CustomDomain.yaml
index bd23cd30be48..5d87b37ea85c 100644
--- a/mmv1/products/firebasehosting/go_CustomDomain.yaml
+++ b/mmv1/products/firebasehosting/go_CustomDomain.yaml
@@ -65,7 +65,9 @@ examples:
     test_env_vars:
       project_id: 'PROJECT_NAME'
     test_vars_overrides:
+      # Use the default hosting site for the project in tests
       'site_id': 'envvar.GetTestProjectFromEnv()'
+      # Don't add random suffix
       'custom_domain': '"basic.custom.domain.com"'
   - name: 'firebasehosting_customdomain_full'
     primary_resource_id: 'default'
@@ -77,6 +79,7 @@ examples:
     test_env_vars:
       project_id: 'PROJECT_NAME'
     test_vars_overrides:
+      # Don't add random suffix
       'custom_domain': '"full.source.domain.com"'
       'redirect_target': '"destination.domain.com"'
   - name: 'firebasehosting_customdomain_cloud_run'
@@ -84,6 +87,7 @@ examples:
     min_version: 'beta'
     vars:
       site_id: 'site-id'
+      # Don't add random suffix
       custom_domain: 'run.custom.domain.com'
       cloud_run_service_id: 'cloud-run-service-via-hosting'
       deletion_protection: 'true'
diff --git a/mmv1/products/firebasehosting/go_Release.yaml b/mmv1/products/firebasehosting/go_Release.yaml
index 16d3bb19fd3d..dd04b2e9cd46 100644
--- a/mmv1/products/firebasehosting/go_Release.yaml
+++ b/mmv1/products/firebasehosting/go_Release.yaml
@@ -26,6 +26,7 @@ base_url: 'sites/{{site_id}}/channels/{{channel_id}}/releases'
 self_link: 'sites/{{site_id}}/channels/{{channel_id}}/releases/{{release_id}}'
 create_url: 'sites/{{site_id}}/channels/{{channel_id}}/releases?versionName={{version_name}}'
 exclude_delete: true
+ # not updatable
 immutable: true
 import_format:
   - 'sites/{{site_id}}/releases/{{release_id}}'
diff --git a/mmv1/products/firebasehosting/go_Version.yaml b/mmv1/products/firebasehosting/go_Version.yaml
index 14d0133a69d1..0ab44e8490a2 100644
--- a/mmv1/products/firebasehosting/go_Version.yaml
+++ b/mmv1/products/firebasehosting/go_Version.yaml
@@ -26,6 +26,7 @@ base_url: 'sites/{{site_id}}/versions'
 self_link: 'sites/{{site_id}}/versions/{{version_id}}'
 create_url: 'sites/{{site_id}}/versions'
 exclude_delete: true
+ # not updatable
 immutable: true
 import_format:
   - 'sites/{{site_id}}/versions/{{version_id}}'
diff --git a/mmv1/products/firebasestorage/go_Bucket.yaml b/mmv1/products/firebasestorage/go_Bucket.yaml
index 160d6fcb48b9..c7d840a2c06b 100644
--- a/mmv1/products/firebasestorage/go_Bucket.yaml
+++ b/mmv1/products/firebasestorage/go_Bucket.yaml
@@ -28,6 +28,7 @@ self_link: 'projects/{{project}}/buckets/{{bucket_id}}'
 create_url: 'projects/{{project}}/buckets/{{bucket_id}}:addFirebase'
 delete_url: 'projects/{{project}}/buckets/{{bucket_id}}:removeFirebase'
 delete_verb: 'POST'
+ # Does not support update operation. There is nothing to update.
 immutable: true
 import_format:
   - 'projects/{{project}}/buckets/{{bucket_id}}'
diff --git a/mmv1/products/firestore/go_Document.yaml b/mmv1/products/firestore/go_Document.yaml
index 813872fc7406..b1f8bbdabbc2 100644
--- a/mmv1/products/firestore/go_Document.yaml
+++ b/mmv1/products/firestore/go_Document.yaml
@@ -96,6 +96,7 @@ properties:
     description: |
       A relative path to the collection this document exists within
     output: true
+    # This is a string instead of a NestedObject because fields can be deeply nested
   - name: 'fields'
     type: String
     description: |
diff --git a/mmv1/products/firestore/go_Field.yaml b/mmv1/products/firestore/go_Field.yaml
index 13a85020ff9f..97c7b7120707 100644
--- a/mmv1/products/firestore/go_Field.yaml
+++ b/mmv1/products/firestore/go_Field.yaml
@@ -60,6 +60,7 @@ custom_code:
   custom_delete: 'templates/terraform/custom_delete/go/firestore_field_delete.go.tmpl'
   custom_import: 'templates/terraform/custom_import/go/firestore_field.go.tmpl'
   test_check_destroy: 'templates/terraform/custom_check_destroy/go/firestore_field.go.tmpl'
+# Sweeper skipped as this resource has customized deletion.
 exclude_sweeper: true
 error_retry_predicates:
 
diff --git a/mmv1/products/firestore/go_Index.yaml b/mmv1/products/firestore/go_Index.yaml
index 917271fadca3..e54a8c2dccd0 100644
--- a/mmv1/products/firestore/go_Index.yaml
+++ b/mmv1/products/firestore/go_Index.yaml
@@ -140,6 +140,7 @@ properties:
             Name of the field.
         - name: 'order'
           type: Enum
+          # TODO (mbang): Exactly one of order, arrayConfig, or vectorConfig must be set
           description: |
             Indicates that this field supports ordering by the specified order or comparing using =, <, <=, >, >=.
             Only one of `order`, `arrayConfig`, and `vectorConfig` can be specified.
@@ -148,6 +149,7 @@ properties:
             - 'DESCENDING'
         - name: 'arrayConfig'
           type: Enum
+          # TODO (mbang): Exactly one of order, arrayConfig, or vectorConfig must be set
           description: |
             Indicates that this field supports operations on arrayValues. Only one of `order`, `arrayConfig`, and
             `vectorConfig` can be specified.
@@ -155,6 +157,7 @@ properties:
             - 'CONTAINS'
         - name: 'vectorConfig'
           type: NestedObject
+          # TODO (mbang): Exactly one of order, arrayConfig, or vectorConfig must be set
           description: |
             Indicates that this field supports vector search operations. Only one of `order`, `arrayConfig`, and
             `vectorConfig` can be specified. Vector Fields should come after the field path `__name__`.
@@ -171,5 +174,7 @@ properties:
               send_empty_value: true
               allow_empty_object: true
               properties:
+ # Meant to be an empty object with no properties.
                 []
+    # Single field indexes _exist_, but the API only lets us manage composite ones.
     min_size: 2
diff --git a/mmv1/products/gkebackup/go_BackupPlan.yaml b/mmv1/products/gkebackup/go_BackupPlan.yaml
index 744b8913f87d..ee660fe0bb3c 100644
--- a/mmv1/products/gkebackup/go_BackupPlan.yaml
+++ b/mmv1/products/gkebackup/go_BackupPlan.yaml
@@ -269,6 +269,7 @@ properties:
               All the time and date values in exclusionWindows entry in the API are in UTC. We
               only allow <=1 recurrence (daily or weekly) exclusion window for a BackupPlan while no
               restriction on number of single occurrence windows.
+            # Exclusion Window Object
             item_type:
               type: NestedObject
               properties:
@@ -310,6 +311,7 @@ properties:
                     function: 'verify.ValidateDuration()'
                 - name: 'singleOccurrenceDate'
                   type: NestedObject
+                  # TODO (cmfeng): add exactly_one_of when it can be applied to lists (https://github.com/hashicorp/terraform-plugin-sdk/issues/470)
                   description: |
                     No recurrence. The exclusion window occurs only once and on this date in UTC.
                     Only one of singleOccurrenceDate, daily and daysOfWeek may be set.
@@ -328,12 +330,14 @@ properties:
                         Day of a month.
                 - name: 'daily'
                   type: Boolean
+                  # TODO (cmfeng): add exactly_one_of when it can be applied to lists (https://github.com/hashicorp/terraform-plugin-sdk/issues/470)
                   description: |
                     The exclusion window occurs every day if set to "True".
                     Specifying this field to "False" is an error.
                     Only one of singleOccurrenceDate, daily and daysOfWeek may be set.
                 - name: 'daysOfWeek'
                   type: NestedObject
+                  # TODO (cmfeng): add exactly_one_of when it can be applied to lists (https://github.com/hashicorp/terraform-plugin-sdk/issues/470)
                   description: |
                     The exclusion window occurs on these days of each week in UTC.
                     Only one of singleOccurrenceDate, daily and daysOfWeek may be set.
@@ -354,6 +358,7 @@ properties:
                           - 'FRIDAY'
                           - 'SATURDAY'
                           - 'SUNDAY'
+            # Exclusion Window Object - End
   - name: 'etag'
     type: String
     description: |
diff --git a/mmv1/products/gkehub/go_Membership.yaml b/mmv1/products/gkehub/go_Membership.yaml
index 3ab1d759b24f..18cb3c1b1181 100644
--- a/mmv1/products/gkehub/go_Membership.yaml
+++ b/mmv1/products/gkehub/go_Membership.yaml
@@ -58,6 +58,7 @@ iam_policy:
     - '{{membership_id}}'
 custom_code:
   constants: 'templates/terraform/constants/go/gke_hub_membership_diff.go.tmpl'
+# Skip sweeper gen since this is a child resource.
 exclude_sweeper: true
 schema_version: 1
 state_upgraders: true
diff --git a/mmv1/products/gkehub2/go_Feature.yaml b/mmv1/products/gkehub2/go_Feature.yaml
index 4c8a7a53b6ca..926774cbb47c 100644
--- a/mmv1/products/gkehub2/go_Feature.yaml
+++ b/mmv1/products/gkehub2/go_Feature.yaml
@@ -57,6 +57,7 @@ iam_policy:
     - 'projects/{{project}}/locations/{{location}}/features/{{name}}'
     - '{{name}}'
 custom_code:
+# Skip sweeper gen since this is a child resource.
 exclude_sweeper: true
 legacy_long_form_project: true
 examples:
@@ -473,6 +474,7 @@ properties:
               - name: 'policyContent'
                 type: NestedObject
                 description: 'Specifies the desired policy content on the cluster.'
+                # default_from_api: true
                 properties:
                   - name: 'templateLibrary'
                     type: NestedObject
diff --git a/mmv1/products/gkehub2/go_MembershipBinding.yaml b/mmv1/products/gkehub2/go_MembershipBinding.yaml
index 86784cb74762..0309999b61f6 100644
--- a/mmv1/products/gkehub2/go_MembershipBinding.yaml
+++ b/mmv1/products/gkehub2/go_MembershipBinding.yaml
@@ -50,6 +50,7 @@ async:
     path: 'error/errors'
     message: 'message'
 custom_code:
+# Skip sweeper gen since this is a child resource.
 exclude_sweeper: true
 examples:
   - name: 'gkehub_membership_binding_basic'
diff --git a/mmv1/products/gkehub2/go_MembershipRBACRoleBinding.yaml b/mmv1/products/gkehub2/go_MembershipRBACRoleBinding.yaml
index 32cac4809a70..a484b7ddd8ea 100644
--- a/mmv1/products/gkehub2/go_MembershipRBACRoleBinding.yaml
+++ b/mmv1/products/gkehub2/go_MembershipRBACRoleBinding.yaml
@@ -49,6 +49,7 @@ async:
     path: 'error/errors'
     message: 'message'
 custom_code:
+# Skip sweeper gen since this is a child resource.
 exclude_sweeper: true
 examples:
   - name: 'gkehub_membership_rbac_role_binding_basic'
diff --git a/mmv1/products/gkehub2/go_Namespace.yaml b/mmv1/products/gkehub2/go_Namespace.yaml
index e0443ecdb15a..28bea068c43a 100644
--- a/mmv1/products/gkehub2/go_Namespace.yaml
+++ b/mmv1/products/gkehub2/go_Namespace.yaml
@@ -50,6 +50,7 @@ async:
     path: 'error/errors'
     message: 'message'
 custom_code:
+# Skip sweeper gen since this is a child resource.
 exclude_sweeper: true
 examples:
   - name: 'gkehub_namespace_basic'
diff --git a/mmv1/products/gkehub2/go_Scope.yaml b/mmv1/products/gkehub2/go_Scope.yaml
index 2f1b33d04f31..3da5520d45ec 100644
--- a/mmv1/products/gkehub2/go_Scope.yaml
+++ b/mmv1/products/gkehub2/go_Scope.yaml
@@ -57,6 +57,7 @@ iam_policy:
     - 'projects/{{project}}/locations/global/scopes/{{scope_id}}'
     - '{{scope_id}}'
 custom_code:
+# Skip sweeper gen since this is a child resource.
 exclude_sweeper: true
 examples:
   - name: 'gkehub_scope_basic'
diff --git a/mmv1/products/gkehub2/go_ScopeRBACRoleBinding.yaml b/mmv1/products/gkehub2/go_ScopeRBACRoleBinding.yaml
index 7c2177b810da..30a18c362895 100644
--- a/mmv1/products/gkehub2/go_ScopeRBACRoleBinding.yaml
+++ b/mmv1/products/gkehub2/go_ScopeRBACRoleBinding.yaml
@@ -50,6 +50,7 @@ async:
     path: 'error/errors'
     message: 'message'
 custom_code:
+# Skip sweeper gen since this is a child resource.
 exclude_sweeper: true
 examples:
   - name: 'gkehub_scope_rbac_role_binding_basic'
diff --git a/mmv1/products/iam2/go_AccessBoundaryPolicy.yaml b/mmv1/products/iam2/go_AccessBoundaryPolicy.yaml
index 2209675fc009..c30262089d5f 100644
--- a/mmv1/products/iam2/go_AccessBoundaryPolicy.yaml
+++ b/mmv1/products/iam2/go_AccessBoundaryPolicy.yaml
@@ -43,6 +43,7 @@ async:
     path: 'error'
     message: 'message'
 custom_code:
+# Skipping sweeper since this is a child resource
 exclude_sweeper: true
 examples:
   - name: 'iam_access_boundary_policy_basic'
diff --git a/mmv1/products/iap/go_AppEngineService.yaml b/mmv1/products/iap/go_AppEngineService.yaml
index b03f86ab6fe3..d8c92a199810 100644
--- a/mmv1/products/iap/go_AppEngineService.yaml
+++ b/mmv1/products/iap/go_AppEngineService.yaml
@@ -16,6 +16,8 @@
 name: 'AppEngineService'
 description: |
   Only used to generate IAM resources
+# This resource is only used to generate IAM resources. They do not correspond to real
+# GCP resources, and should not be used to generate anything other than IAM support.
 exclude_resource: true
 docs:
 id_format: 'projects/{{project}}/iap_web/appengine-{{appId}}/services/{{service}}'
diff --git a/mmv1/products/iap/go_AppEngineVersion.yaml b/mmv1/products/iap/go_AppEngineVersion.yaml
index 214f51121270..6a6f773f6cf7 100644
--- a/mmv1/products/iap/go_AppEngineVersion.yaml
+++ b/mmv1/products/iap/go_AppEngineVersion.yaml
@@ -16,6 +16,8 @@
 name: 'AppEngineVersion'
 description: |
   Only used to generate IAM resources
+# This resource is only used to generate IAM resources. They do not correspond to real
+# GCP resources, and should not be used to generate anything other than IAM support.
 exclude_resource: true
 docs:
 id_format: 'projects/{{project}}/iap_web/appengine-{{appId}}/services/{{service}}/versions/{{versionId}}'
diff --git a/mmv1/products/iap/go_Tunnel.yaml b/mmv1/products/iap/go_Tunnel.yaml
index 579403fff911..14ee4daa317b 100644
--- a/mmv1/products/iap/go_Tunnel.yaml
+++ b/mmv1/products/iap/go_Tunnel.yaml
@@ -16,6 +16,8 @@
 name: 'Tunnel'
 description: |
   Only used to generate IAM resources
+# This resource is only used to generate IAM resources. They do not correspond to real
+# GCP resources, and should not be used to generate anything other than IAM support.
 exclude_resource: true
 docs:
 id_format: 'projects/{{project}}/iap_tunnel'
diff --git a/mmv1/products/iap/go_TunnelInstance.yaml b/mmv1/products/iap/go_TunnelInstance.yaml
index bcf8b4636274..6e0e232841f7 100644
--- a/mmv1/products/iap/go_TunnelInstance.yaml
+++ b/mmv1/products/iap/go_TunnelInstance.yaml
@@ -16,6 +16,8 @@
 name: 'TunnelInstance'
 description: |
   Only used to generate IAM resources
+# This resource is only used to generate IAM resources. They do not correspond to real
+# GCP resources, and should not be used to generate anything other than IAM support.
 exclude_resource: true
 docs:
 id_format: 'projects/{{project}}/iap_tunnel/zones/{{zone}}/instances/{{name}}'
diff --git a/mmv1/products/iap/go_Web.yaml b/mmv1/products/iap/go_Web.yaml
index be47416e9a4f..e5c294d4cd46 100644
--- a/mmv1/products/iap/go_Web.yaml
+++ b/mmv1/products/iap/go_Web.yaml
@@ -16,6 +16,8 @@
 name: 'Web'
 description: |
   Only used to generate IAM resources
+# This resource is only used to generate IAM resources. They do not correspond to real
+# GCP resources, and should not be used to generate anything other than IAM support.
 exclude_resource: true
 docs:
 id_format: 'projects/{{project}}/iap_web'
diff --git a/mmv1/products/iap/go_WebBackendService.yaml b/mmv1/products/iap/go_WebBackendService.yaml
index 4edbdb2becaf..31048594f813 100644
--- a/mmv1/products/iap/go_WebBackendService.yaml
+++ b/mmv1/products/iap/go_WebBackendService.yaml
@@ -16,6 +16,8 @@
 name: 'WebBackendService'
 description: |
   Only used to generate IAM resources
+# This resource is only used to generate IAM resources. They do not correspond to real
+# GCP resources, and should not be used to generate anything other than IAM support.
 exclude_resource: true
 docs:
 id_format: 'projects/{{project}}/iap_web/compute/services/{{name}}'
diff --git a/mmv1/products/iap/go_WebRegionBackendService.yaml b/mmv1/products/iap/go_WebRegionBackendService.yaml
index 31884a391f80..742e3c797540 100644
--- a/mmv1/products/iap/go_WebRegionBackendService.yaml
+++ b/mmv1/products/iap/go_WebRegionBackendService.yaml
@@ -16,6 +16,8 @@
 name: 'WebRegionBackendService'
 description: |
   Only used to generate IAM resources
+# This resource is only used to generate IAM resources. They do not correspond to real
+# GCP resources, and should not be used to generate anything other than IAM support.
 exclude_resource: true
 docs:
 id_format: 'projects/{{project}}/iap_web/compute-{{region}}/services/{{name}}'
diff --git a/mmv1/products/iap/go_WebTypeAppEngine.yaml b/mmv1/products/iap/go_WebTypeAppEngine.yaml
index 65eb368de26d..2fa082816abd 100644
--- a/mmv1/products/iap/go_WebTypeAppEngine.yaml
+++ b/mmv1/products/iap/go_WebTypeAppEngine.yaml
@@ -16,6 +16,8 @@
 name: 'WebTypeAppEngine'
 description: |
   Only used to generate IAM resources
+# This resource is only used to generate IAM resources. They do not correspond to real
+# GCP resources, and should not be used to generate anything other than IAM support.
 exclude_resource: true
 docs:
 id_format: 'projects/{{project}}/iap_web/appengine-{{appId}}'
diff --git a/mmv1/products/iap/go_WebTypeCompute.yaml b/mmv1/products/iap/go_WebTypeCompute.yaml
index 6db797568cbf..ec20d60afae9 100644
--- a/mmv1/products/iap/go_WebTypeCompute.yaml
+++ b/mmv1/products/iap/go_WebTypeCompute.yaml
@@ -16,6 +16,8 @@
 name: 'WebTypeCompute'
 description: |
   Only used to generate IAM resources
+# This resource is only used to generate IAM resources. They do not correspond to real
+# GCP resources, and should not be used to generate anything other than IAM support.
 exclude_resource: true
 docs:
 id_format: 'projects/{{project}}/iap_web/compute'
diff --git a/mmv1/products/identityplatform/go_Config.yaml b/mmv1/products/identityplatform/go_Config.yaml
index 7d1d4125a8d7..161f9c96ae76 100644
--- a/mmv1/products/identityplatform/go_Config.yaml
+++ b/mmv1/products/identityplatform/go_Config.yaml
@@ -53,7 +53,9 @@ examples:
     test_env_vars:
       org_id: 'ORG_ID'
       billing_acct: 'BILLING_ACCT'
+        # Resource creation race
     test_vars_overrides:
+      # Set quota start time for the following day.
       'quota_start_time': 'time.Now().AddDate(0, 0, 1).Format(time.RFC3339)'
     ignore_read_extra:
       - 'client.0.api_key'
diff --git a/mmv1/products/integrationconnectors/go_ManagedZone.yaml b/mmv1/products/integrationconnectors/go_ManagedZone.yaml
index e7c9eaaf0e71..96d847342576 100644
--- a/mmv1/products/integrationconnectors/go_ManagedZone.yaml
+++ b/mmv1/products/integrationconnectors/go_ManagedZone.yaml
@@ -57,6 +57,7 @@ examples:
     test_env_vars:
       org_id: 'ORG_ID'
       billing_account: 'BILLING_ACCT'
+      # Resource creation race
     skip_vcr: true
 parameters:
   - name: 'name'
diff --git a/mmv1/products/integrations/go_AuthConfig.yaml b/mmv1/products/integrations/go_AuthConfig.yaml
index e0db45aa38c8..13ad0d13eee9 100644
--- a/mmv1/products/integrations/go_AuthConfig.yaml
+++ b/mmv1/products/integrations/go_AuthConfig.yaml
@@ -307,6 +307,7 @@ properties:
             type: NestedObject
             description: |
               Token parameters for the auth request.
+ # ParameterMap
             properties:
               - name: 'entries'
                 type: Array
@@ -314,16 +315,19 @@ properties:
                   A list of parameter map entries.
                 item_type:
                   type: NestedObject
+ # ParameterMapEntry
                   properties:
                     - name: 'key'
                       type: NestedObject
                       description: |
                         Key of the map entry.
+ # ParameterMapField
                       properties:
                         - name: 'literalValue'
                           type: NestedObject
                           description: |
                             Passing a literal value
+ # ValueType
                           properties:
                             - name: 'stringValue'
                               type: String
@@ -333,11 +337,13 @@ properties:
                       type: NestedObject
                       description: |
                         Value of the map entry.
+ # ParameterMapField
                       properties:
                         - name: 'literalValue'
                           type: NestedObject
                           description: |
                             Passing a literal value
+ # ValueType
                           properties:
                             - name: 'stringValue'
                               type: String
diff --git a/mmv1/products/kms/go_AutokeyConfig.yaml b/mmv1/products/kms/go_AutokeyConfig.yaml
index 4a902196418e..41c0a6526f4d 100644
--- a/mmv1/products/kms/go_AutokeyConfig.yaml
+++ b/mmv1/products/kms/go_AutokeyConfig.yaml
@@ -14,6 +14,7 @@
 # Warning: This is a temporary file, and should not be edited directly
 ---
 name: 'AutokeyConfig'
+# This resource is currently in public preview.
 description: |
   `AutokeyConfig` is a singleton resource used to configure the auto-provisioning
   flow of CryptoKeys for CMEK.
@@ -31,6 +32,8 @@ docs:
 id_format: 'folders/{{folder}}/autokeyConfig'
 base_url: 'folders/{{folder}}/autokeyConfig'
 self_link: 'folders/{{folder}}/autokeyConfig'
+# This is a singleton resource that is already created, so create
+# is really an update, and therefore should be PATCHed.
 create_url: 'folders/{{folder}}/autokeyConfig?updateMask=keyProject'
 create_verb: 'PATCH'
 update_url: 'folders/{{folder}}/autokeyConfig?updateMask=keyProject'
@@ -50,6 +53,7 @@ custom_code:
   pre_update: 'templates/terraform/pre_update/go/kms_autokey_config_folder.go.tmpl'
   pre_delete: 'templates/terraform/pre_delete/go/kms_autokey_config_folder.go.tmpl'
   test_check_destroy: 'templates/terraform/custom_check_destroy/go/kms_autokey_config.go.tmpl'
+# Using a handwritten sweeper because of pre_delete.
 exclude_sweeper: true
 examples:
   - name: 'kms_autokey_config_all'
@@ -62,6 +66,8 @@ examples:
       org_id: 'ORG_ID'
       billing_account: 'BILLING_ACCT'
     external_providers: ["random", "time"]
+    # Need the time_sleep resource
+    # Currently failing
     skip_vcr: true
 parameters:
   - name: 'folder'
diff --git a/mmv1/products/kms/go_KeyHandle.yaml b/mmv1/products/kms/go_KeyHandle.yaml
index 906a8850f0b5..f7c13b2b340e 100644
--- a/mmv1/products/kms/go_KeyHandle.yaml
+++ b/mmv1/products/kms/go_KeyHandle.yaml
@@ -14,6 +14,7 @@
 # Warning: This is a temporary file, and should not be edited directly
 ---
 name: 'KeyHandle'
+# This resource is currently in public preview.
 description: |
   A `KeyHandle` is a resource used to auto-provision CryptoKeys for CMEK.
 
@@ -60,6 +61,8 @@ examples:
       org_id: 'ORG_ID'
       billing_account: 'BILLING_ACCT'
     external_providers: ["random", "time"]
+    # Need the time_sleep resource
+    # Currently failing
     skip_vcr: true
 parameters:
   - name: 'location'
diff --git a/mmv1/products/logging/go_FolderSettings.yaml b/mmv1/products/logging/go_FolderSettings.yaml
index fe179405f32f..00975a73654e 100644
--- a/mmv1/products/logging/go_FolderSettings.yaml
+++ b/mmv1/products/logging/go_FolderSettings.yaml
@@ -23,10 +23,15 @@ references:
 docs:
 base_url: 'folders/{{folder}}/settings'
 self_link: 'folders/{{folder}}/settings'
+# Hardcode the updateMask since d.HasChanged does not work on create.
 create_url: 'folders/{{folder}}/settings?updateMask=disableDefaultSink,storageLocation,kmsKeyName'
+# This is a singleton resource that already is created, so create
+# is really an update, and therefore should be PATCHed.
 create_verb: 'PATCH'
 update_url: 'folders/{{folder}}/settings?updateMask=disableDefaultSink,storageLocation,kmsKeyName'
 update_verb: 'PATCH'
+# update_mask: true
+# This is a singleton resource that cannot be deleted, so skip delete.
 exclude_delete: true
 import_format:
   - 'folders/{{folder}}/settings'
diff --git a/mmv1/products/logging/go_LinkedDataset.yaml b/mmv1/products/logging/go_LinkedDataset.yaml
index 3376cfca938e..53c5e435269d 100644
--- a/mmv1/products/logging/go_LinkedDataset.yaml
+++ b/mmv1/products/logging/go_LinkedDataset.yaml
@@ -48,6 +48,7 @@ async:
     message: 'message'
 custom_code:
   encoder: 'templates/terraform/encoders/go/logging_linked_dataset.go.tmpl'
+# Skip sweeper gen since this is a child resource.
 exclude_sweeper: true
 examples:
   - name: 'logging_linked_dataset_basic'
@@ -85,6 +86,7 @@ parameters:
     url_param_only: true
     immutable: true
     default_from_api: true
+ # Make this a String for now since we don't have a good way to reference multiple resources.
   - name: 'bucket'
     type: String
     description: The bucket to which the linked dataset is attached.
diff --git a/mmv1/products/logging/go_LogView.yaml b/mmv1/products/logging/go_LogView.yaml
index a9131dd9ac4e..ac3a96d67e6d 100644
--- a/mmv1/products/logging/go_LogView.yaml
+++ b/mmv1/products/logging/go_LogView.yaml
@@ -45,6 +45,7 @@ iam_policy:
 custom_code:
   encoder: 'templates/terraform/encoders/go/logging_log_view.go.tmpl'
   pre_read: 'templates/terraform/pre_read/go/logging_log_view.go.tmpl'
+# Skipping sweeper since this is a child resource.
 exclude_sweeper: true
 examples:
   - name: 'logging_log_view_basic'
@@ -74,6 +75,7 @@ parameters:
     url_param_only: true
     immutable: true
     default_from_api: true
+ # Make this a String for now since we don't have a good way to reference multiple resources.
   - name: 'bucket'
     type: String
     description: The bucket of the resource
diff --git a/mmv1/products/logging/go_Metric.yaml b/mmv1/products/logging/go_Metric.yaml
index a7c86c8da182..98fa732c6629 100644
--- a/mmv1/products/logging/go_Metric.yaml
+++ b/mmv1/products/logging/go_Metric.yaml
@@ -25,6 +25,7 @@ references:
 docs:
 id_format: '{{name}}'
 base_url: 'projects/{{project}}/metrics'
+# The % in self_link indicates that the name value should be URL-encoded.
 self_link: 'projects/{{project}}/metrics/{{%name}}'
 mutex: 'customMetric/{{project}}'
 import_format:
diff --git a/mmv1/products/logging/go_OrganizationSettings.yaml b/mmv1/products/logging/go_OrganizationSettings.yaml
index ecddbe3db5e5..132304056fd8 100644
--- a/mmv1/products/logging/go_OrganizationSettings.yaml
+++ b/mmv1/products/logging/go_OrganizationSettings.yaml
@@ -23,10 +23,14 @@ references:
 docs:
 base_url: 'organizations/{{organization}}/settings'
 self_link: 'organizations/{{organization}}/settings'
+# Hardcode the updateMask since d.HasChanged does not work on create.
 create_url: 'organizations/{{organization}}/settings?updateMask=disableDefaultSink,storageLocation,kmsKeyName'
+# This is a singleton resource that already is created, so create
+# is really an update, and therefore should be PATCHed.
 create_verb: 'PATCH'
 update_url: 'organizations/{{organization}}/settings?updateMask=disableDefaultSink,storageLocation,kmsKeyName'
 update_verb: 'PATCH'
+# This is a singleton resource that cannot be deleted, so skip delete.
 exclude_delete: true
 import_format:
   - 'organizations/{{organization}}/settings'
diff --git a/mmv1/products/looker/go_Instance.yaml b/mmv1/products/looker/go_Instance.yaml
index 51369ab453c6..510fbf172aca 100644
--- a/mmv1/products/looker/go_Instance.yaml
+++ b/mmv1/products/looker/go_Instance.yaml
@@ -104,6 +104,7 @@ parameters:
     immutable: true
     default_from_api: true
 properties:
+  # Admin Settings Object
   - name: 'adminSettings'
     type: NestedObject
     description: |
@@ -122,6 +123,7 @@ properties:
           existing list of allowed email domains.
         item_type:
           type: String
+  # Admin Settings Object - End
   - name: 'consumerNetwork'
     type: String
     description: |
@@ -134,6 +136,7 @@ properties:
       The time the instance was created in RFC3339 UTC "Zulu" format,
       accurate to nanoseconds.
     output: true
+  # Deny Maintenance Period Object
   - name: 'denyMaintenancePeriod'
     type: NestedObject
     description: |
@@ -226,11 +229,13 @@ properties:
               Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
             validation:
               function: 'validation.IntBetween(0,999999999)'
+  # Deny Maintenance Period Object - End
   - name: 'egressPublicIp'
     type: String
     description: |
       Public Egress IP (IPv4).
     output: true
+  # Encryption Config Object
   - name: 'encryptionConfig'
     type: NestedObject
     description: |
@@ -254,6 +259,7 @@ properties:
         description: |
           Full name and version of the CMEK key currently in use to encrypt Looker data.
         output: true
+  # Encryption Config  Object - End
   - name: 'ingressPrivateIp'
     type: String
     description: |
@@ -274,6 +280,7 @@ properties:
     description: |
       Looker instance URI which can be used to access the Looker Instance UI.
     output: true
+  # Maintenance Window Object
   - name: 'maintenanceWindow'
     type: NestedObject
     description: |
@@ -334,6 +341,7 @@ properties:
               Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.
             validation:
               function: 'validation.IntBetween(0,999999999)'
+  # Maintenance Window Object - End
   - name: 'name'
     type: String
     description: |
@@ -343,6 +351,7 @@ properties:
     immutable: true
     validation:
       regex: '^[a-z][a-z0-9-]{0,61}[a-z0-9]$'
+  # Oauth Object
   - name: 'oauthConfig'
     type: NestedObject
     description: |
@@ -359,6 +368,7 @@ properties:
         description: |
           The client secret for the Oauth config.
         required: true
+  # Oauth Object - End
   - name: 'platformEdition'
     type: Enum
     description: |
@@ -397,6 +407,7 @@ properties:
       The time the instance was updated in RFC3339 UTC "Zulu" format,
       accurate to nanoseconds.
     output: true
+  # UserMetadata Object
   - name: 'userMetadata'
     type: NestedObject
     description: |
@@ -423,6 +434,8 @@ properties:
         type: Integer
         description: |
           Number of additional Developer Users to allocate to the Looker Instance.
+  # UserMetadata Object - End
+  # CustomDomain Object
   - name: 'customDomain'
     type: NestedObject
     description: |
diff --git a/mmv1/products/metastore/go_Service.yaml b/mmv1/products/metastore/go_Service.yaml
index c45a8edf3f71..01873b30387d 100644
--- a/mmv1/products/metastore/go_Service.yaml
+++ b/mmv1/products/metastore/go_Service.yaml
@@ -175,6 +175,7 @@ properties:
   - name: 'labels'
     type: KeyValueLabels
     description: 'User-defined labels for the metastore service.'
+  # This is an x-product resource reference.
   - name: 'network'
     type: String
     description: |
diff --git a/mmv1/products/mlengine/go_Model.yaml b/mmv1/products/mlengine/go_Model.yaml
index 6a019e48941d..46fa47f61406 100644
--- a/mmv1/products/mlengine/go_Model.yaml
+++ b/mmv1/products/mlengine/go_Model.yaml
@@ -26,6 +26,7 @@ references:
 docs:
 base_url: 'projects/{{project}}/models'
 self_link: 'projects/{{project}}/models/{{name}}'
+# This resources is not updatable (outside of versions, which is a version-level method)
 immutable: true
 timeouts:
   insert_minutes: 20
@@ -67,6 +68,9 @@ properties:
   - name: 'description'
     type: String
     description: The description specified for the model when it was created.
+  # Ignoring most of defaultVersion.
+  # Only name should be exposed. Use the Version resource to learn more
+  # about versions.
   - name: 'defaultVersion'
     type: NestedObject
     description: |
@@ -77,6 +81,8 @@ properties:
         type: String
         description: The name specified for the version when it was created.
         required: true
+  # Even though only one region is supported, keeping this as an array
+  # to future-proof it.
   - name: 'regions'
     type: Array
     description: |
diff --git a/mmv1/products/monitoring/go_AlertPolicy.yaml b/mmv1/products/monitoring/go_AlertPolicy.yaml
index ec15803a22b1..682c6abaaf35 100644
--- a/mmv1/products/monitoring/go_AlertPolicy.yaml
+++ b/mmv1/products/monitoring/go_AlertPolicy.yaml
@@ -46,6 +46,7 @@ error_abort_predicates:
 
   - 'transport_tpg.Is429QuotaError'
 examples:
+  # skipping tests because the API is full of race conditions
   - name: 'monitoring_alert_policy_basic'
     primary_resource_id: 'alert_policy'
     vars:
@@ -911,6 +912,7 @@ properties:
                 valid Prometheus label name.
   - name: 'notificationChannels'
     type: Array
+    # TODO chrisst - turn this into a resource ref
     description: |
       Identifies the notification channels to which notifications should be
       sent when incidents are opened or closed or when new violations occur
diff --git a/mmv1/products/monitoring/go_GenericService.yaml b/mmv1/products/monitoring/go_GenericService.yaml
index 7b3f3c3d10e4..6728861f817c 100644
--- a/mmv1/products/monitoring/go_GenericService.yaml
+++ b/mmv1/products/monitoring/go_GenericService.yaml
@@ -82,6 +82,7 @@ properties:
     type: NestedObject
     description: |
       Configuration for how to query telemetry on a Service.
+    # Non custom service have non-editable telemetry
     output: true
     properties:
       - name: 'resourceName'
@@ -96,6 +97,7 @@ properties:
       A well-known service type, defined by its service type and service labels.
       Valid values of service types and services labels are described at
       https://cloud.google.com/stackdriver/docs/solutions/slo-monitoring/api/api-structures#basic-svc-w-basic-sli
+    # BasicService info can be set on creation but is then immutable.
     immutable: true
     properties:
       - name: 'serviceType'
diff --git a/mmv1/products/monitoring/go_Group.yaml b/mmv1/products/monitoring/go_Group.yaml
index ee70098be811..842d892ad557 100644
--- a/mmv1/products/monitoring/go_Group.yaml
+++ b/mmv1/products/monitoring/go_Group.yaml
@@ -54,6 +54,7 @@ parameters:
 properties:
   - name: 'parentName'
     type: String
+    # TODO chrisst - turn into self-reference if possible.
     description: |
       The name of the group's parent, if it has one. The format is
       "projects/{project_id_or_number}/groups/{group_id}". For
diff --git a/mmv1/products/monitoring/go_Slo.yaml b/mmv1/products/monitoring/go_Slo.yaml
index 06c2fd900d4e..13c8e2ad9ed7 100644
--- a/mmv1/products/monitoring/go_Slo.yaml
+++ b/mmv1/products/monitoring/go_Slo.yaml
@@ -30,6 +30,7 @@ references:
 docs:
 id_format: '{{name}}'
 base_url: 'v3/projects/{{project}}/services/{{service}}/serviceLevelObjectives'
+# name = projects/{{project}}/services/{{service}}/serviceLevelObjectives/{{slo_id}}
 self_link: 'v3/{{name}}'
 create_url: 'v3/projects/{{project}}/services/{{service}}/serviceLevelObjectives?serviceLevelObjectiveId={{slo_id}}'
 update_verb: 'PATCH'
@@ -405,12 +406,15 @@ properties:
           - 'service_level_indicator.0.request_based_sli'
           - 'service_level_indicator.0.windows_based_sli'
         properties:
+          # NOTE: If adding properties to windowsBasedSli, remember to add to the
+          # custom updateMask fields in property overrides.
           - name: 'windowPeriod'
             type: String
             description: |
               Duration over which window quality is evaluated, given as a
               duration string "{X}s" representing X seconds. Must be an
               integer fraction of a day and at least 60s.
+          # START window_criterion FIELDS
           - name: 'goodBadMetricFilter'
             type: String
             description: |
diff --git a/mmv1/products/netapp/go_ActiveDirectory.yaml b/mmv1/products/netapp/go_ActiveDirectory.yaml
index 0a54f0e6b4a2..1fc9dc1e9a70 100644
--- a/mmv1/products/netapp/go_ActiveDirectory.yaml
+++ b/mmv1/products/netapp/go_ActiveDirectory.yaml
@@ -44,6 +44,7 @@ async:
   result:
     resource_inside_response: false
 custom_code:
+# Skipping the sweeper since we need to sweep multiple regions
 exclude_sweeper: true
 examples:
   - name: 'netapp_active_directory_full'
@@ -66,6 +67,7 @@ parameters:
     required: true
     immutable: true
 properties:
+  # Fields go here
   - name: 'createTime'
     type: String
     description: |
diff --git a/mmv1/products/netapp/go_Backup.yaml b/mmv1/products/netapp/go_Backup.yaml
index ef59aba8d377..95fb9147493c 100644
--- a/mmv1/products/netapp/go_Backup.yaml
+++ b/mmv1/products/netapp/go_Backup.yaml
@@ -57,6 +57,7 @@ async:
   result:
     resource_inside_response: false
 custom_code:
+# Skipping the sweeper since we need to sweep multiple regions
 exclude_sweeper: true
 examples:
   - name: 'netapp_backup'
diff --git a/mmv1/products/netapp/go_BackupPolicy.yaml b/mmv1/products/netapp/go_BackupPolicy.yaml
index 8dfdd20e9f45..71982d08f5fb 100644
--- a/mmv1/products/netapp/go_BackupPolicy.yaml
+++ b/mmv1/products/netapp/go_BackupPolicy.yaml
@@ -46,6 +46,7 @@ async:
   result:
     resource_inside_response: false
 custom_code:
+# Skipping the sweeper since we need to sweep multiple regions
 exclude_sweeper: true
 examples:
   - name: 'netapp_backup_policy_full'
diff --git a/mmv1/products/netapp/go_BackupVault.yaml b/mmv1/products/netapp/go_BackupVault.yaml
index 4438a7ef5cab..c2481d642300 100644
--- a/mmv1/products/netapp/go_BackupVault.yaml
+++ b/mmv1/products/netapp/go_BackupVault.yaml
@@ -45,6 +45,7 @@ async:
   result:
     resource_inside_response: false
 custom_code:
+# Skipping the sweeper since we need to sweep multiple regions
 exclude_sweeper: true
 examples:
   - name: 'netapp_backup_vault'
diff --git a/mmv1/products/netapp/go_StoragePool.yaml b/mmv1/products/netapp/go_StoragePool.yaml
index 5abe5fab0e91..29648c84d15b 100644
--- a/mmv1/products/netapp/go_StoragePool.yaml
+++ b/mmv1/products/netapp/go_StoragePool.yaml
@@ -68,6 +68,7 @@ async:
     resource_inside_response: false
 custom_code:
   pre_update: 'templates/terraform/pre_update/go/netapp_storagepool.go.tmpl'
+# Skipping the sweeper since we need to sweep multiple regions
 exclude_sweeper: true
 examples:
   - name: 'Storage_pool_create'
diff --git a/mmv1/products/netapp/go_Volume.yaml b/mmv1/products/netapp/go_Volume.yaml
index 3f38983fa3cb..1312eb5c7c26 100644
--- a/mmv1/products/netapp/go_Volume.yaml
+++ b/mmv1/products/netapp/go_Volume.yaml
@@ -287,6 +287,7 @@ properties:
     description: |-
       Used to create this volume from a snapshot (= cloning) or an backup.
     immutable: true
+    # This parameter is only used at CREATE. READs will omit it.
     ignore_read: true
     properties:
       - name: 'sourceSnapshot'
diff --git a/mmv1/products/netapp/go_VolumeReplication.yaml b/mmv1/products/netapp/go_VolumeReplication.yaml
index b4b9b6382bc1..3c38699de70e 100644
--- a/mmv1/products/netapp/go_VolumeReplication.yaml
+++ b/mmv1/products/netapp/go_VolumeReplication.yaml
@@ -251,6 +251,7 @@ properties:
     type: NestedObject
     description: |-
       Destination volume parameters.
+    # destinationVolumeParameters is only used on CREATE. Will not be returned on READ.
     ignore_read: true
     properties:
       - name: 'storagePool'
diff --git a/mmv1/products/netapp/go_VolumeSnapshot.yaml b/mmv1/products/netapp/go_VolumeSnapshot.yaml
index a4196499accc..664b1b5b9cfd 100644
--- a/mmv1/products/netapp/go_VolumeSnapshot.yaml
+++ b/mmv1/products/netapp/go_VolumeSnapshot.yaml
@@ -45,6 +45,7 @@ async:
   result:
     resource_inside_response: false
 custom_code:
+# Skipping the sweeper since we need to sweep multiple regions
 exclude_sweeper: true
 examples:
   - name: 'volume_snapshot_create'
diff --git a/mmv1/products/netapp/go_kmsconfig.yaml b/mmv1/products/netapp/go_kmsconfig.yaml
index 4bc287146cc1..90e34b7650c6 100644
--- a/mmv1/products/netapp/go_kmsconfig.yaml
+++ b/mmv1/products/netapp/go_kmsconfig.yaml
@@ -13,6 +13,7 @@
 
 # Warning: This is a temporary file, and should not be edited directly
 ---
+# API resource name
 name: 'kmsconfig'
 description: |
   NetApp Volumes always encrypts your data at rest using volume-specific keys.
@@ -20,7 +21,10 @@ description: |
   A CMEK policy (customer-managed encryption key) warps such volume-specific keys in a key stored in Cloud Key Management Service (KMS).
 references:
   guides:
+    # Link to quickstart in the API's Guides section. For example:
+    # 'Create and connect to a database': 'https://cloud.google.com/alloydb/docs/quickstart/create-and-connect'
     'Documentation': 'https://cloud.google.com/netapp/volumes/docs/configure-and-use/cmek/cmek-overview'
+  # Link to the REST API reference for the resource. For example,
   api: 'https://cloud.google.com/netapp/volumes/docs/reference/rest/v1/projects.locations.kmsConfigs'
 docs:
 id_format: 'projects/{{project}}/locations/{{location}}/kmsConfigs/{{name}}'
@@ -40,12 +44,16 @@ autogen_async: true
 async:
   actions: ['create', 'delete', 'update']
   type: 'OpAsync'
+  # Overrides which API calls return operations. Default: ['create',
+  # 'update', 'delete']
+  # actions: ['create', 'update', 'delete']
   operation:
     base_url: '{{op_id}}'
   result:
     resource_inside_response: false
 custom_code:
   post_create: 'templates/terraform/post_create/go/KMS_Verify.go.tmpl'
+# Skipping the sweeper since we need to sweep multiple regions
 exclude_sweeper: true
 examples:
   - name: 'kmsConfig_create'
@@ -62,6 +70,7 @@ parameters:
     url_param_only: true
     required: true
     immutable: true
+    # OK: This needs to be 'name' IMHO
   - name: 'name'
     type: String
     description: |
diff --git a/mmv1/products/networkconnectivity/go_PolicyBasedRoute.yaml b/mmv1/products/networkconnectivity/go_PolicyBasedRoute.yaml
index ceeab7c6d7b2..6c07cad86521 100644
--- a/mmv1/products/networkconnectivity/go_PolicyBasedRoute.yaml
+++ b/mmv1/products/networkconnectivity/go_PolicyBasedRoute.yaml
@@ -94,6 +94,7 @@ properties:
         required: true
         enum_values:
           - 'IPV4'
+ # probably could have been an enum, but it's a string in the API
       - name: 'ipProtocol'
         type: String
         description: |
@@ -113,6 +114,7 @@ properties:
     type: Enum
     description: |
       Other routes that will be referenced to determine the next hop of the packet.
+ # next_hop union
     exactly_one_of:
       - 'next_hop_ilb_ip'
       - 'next_hop_other_routes'
@@ -122,6 +124,7 @@ properties:
     type: String
     description: |
       The IP address of a global-access-enabled L4 ILB that is the next hop for matching packets.
+ # next_hop union
     exactly_one_of:
       - 'next_hop_ilb_ip'
       - 'next_hop_other_routes'
@@ -134,6 +137,7 @@ properties:
     type: NestedObject
     description: |
       VM instances to which this policy-based route applies to.
+ # target union
     conflicts:
       - interconnect_attachment
     properties:
@@ -141,6 +145,7 @@ properties:
         type: Array
         description: |
           A list of VM instance tags that this policy-based route applies to. VM instances that have ANY of tags specified here will install this PBR.
+ # optional in API docs, but that doesn't make sense here
         required: true
         item_type:
           type: String
@@ -148,6 +153,7 @@ properties:
     type: NestedObject
     description: |
       The interconnect attachments that this policy-based route applies to.
+ # target union
     conflicts:
       - virtual_machine
     properties:
@@ -155,6 +161,7 @@ properties:
         type: String
         description: |
           Cloud region to install this policy-based route on for Interconnect attachments. Use `all` to install it on all Interconnect attachments.
+ # optional in API docs, but that doesn't make sense here
         required: true
   - name: 'createTime'
     type: Time
@@ -179,6 +186,7 @@ properties:
     item_type:
       type: NestedObject
       properties:
+ # technically enum, but doesn't matter for output fields
         - name: 'code'
           type: String
           description: |
diff --git a/mmv1/products/networksecurity/go_AddressGroup.yaml b/mmv1/products/networksecurity/go_AddressGroup.yaml
index 0b9066b233d0..56988d8c1240 100644
--- a/mmv1/products/networksecurity/go_AddressGroup.yaml
+++ b/mmv1/products/networksecurity/go_AddressGroup.yaml
@@ -16,6 +16,7 @@
 name: 'AddressGroup'
 description: |
   AddressGroup is a resource that specifies how a collection of IP/DNS used in Firewall Policy.
+ # TODO(diogoesteves): change the url to GA once it is available.
 references:
   guides:
     'Use AddressGroups': 'https://cloud.google.com/vpc/docs/use-address-groups-firewall-policies'
diff --git a/mmv1/products/networksecurity/go_ClientTlsPolicy.yaml b/mmv1/products/networksecurity/go_ClientTlsPolicy.yaml
index 5166caf08361..2c38b23682e6 100644
--- a/mmv1/products/networksecurity/go_ClientTlsPolicy.yaml
+++ b/mmv1/products/networksecurity/go_ClientTlsPolicy.yaml
@@ -55,11 +55,13 @@ examples:
     primary_resource_id: 'default'
     vars:
       resource_name: 'my-client-tls-policy'
+    # Currently failing
     skip_vcr: true
   - name: 'network_security_client_tls_policy_advanced'
     primary_resource_id: 'default'
     vars:
       resource_name: 'my-client-tls-policy'
+    # Currently failing
     skip_vcr: true
 parameters:
   - name: 'name'
diff --git a/mmv1/products/networksecurity/go_ProjectAddressGroup.yaml b/mmv1/products/networksecurity/go_ProjectAddressGroup.yaml
index b40c4862f41a..d8ec96c0b822 100644
--- a/mmv1/products/networksecurity/go_ProjectAddressGroup.yaml
+++ b/mmv1/products/networksecurity/go_ProjectAddressGroup.yaml
@@ -15,6 +15,11 @@
 ---
 name: 'ProjectAddressGroup'
 legacy_name: 'google_network_security_address_group'
+# This resource is only used to generate IAM resources. They do not correspond to real
+# GCP resources, and should not be used to generate anything other than IAM support.
+# IAM resources for AddressGroup are moved to a separate configuration because the AddressGroup
+# resourcesupports both organization and project levels,
+# but IAM support exists only on the project level Address Groups
 description: |
   Only used to generate IAM resources for project level address groups
 exclude_resource: true
diff --git a/mmv1/products/networkservices/go_EdgeCacheOrigin.yaml b/mmv1/products/networkservices/go_EdgeCacheOrigin.yaml
index 2a759fa8057f..70791d6207ee 100644
--- a/mmv1/products/networkservices/go_EdgeCacheOrigin.yaml
+++ b/mmv1/products/networkservices/go_EdgeCacheOrigin.yaml
@@ -99,6 +99,7 @@ properties:
       When providing an FQDN (hostname), it must be publicly resolvable (e.g. via Google public DNS) and IP addresses must be publicly routable.  It must not contain a protocol (e.g., https://) and it must not contain any slashes.
       If a Cloud Storage bucket is provided, it must be in the canonical "gs://bucketname" format. Other forms, such as "storage.googleapis.com", will be rejected.
     required: true
+ # default http2 from api
   - name: 'protocol'
     type: Enum
     description: |
@@ -110,6 +111,7 @@ properties:
       - 'HTTP2'
       - 'HTTPS'
       - 'HTTP'
+ # default from api
   - name: 'port'
     type: Integer
     description: |
@@ -142,6 +144,7 @@ properties:
       The value of timeout.maxAttemptsTimeout dictates the timeout across all origins.
       A reference to a Topic resource.
     diff_suppress_func: 'tpgresource.CompareResourceNames'
+ # default CONNECT_FAILURE from api
   - name: 'retryConditions'
     type: Array
     description: |
diff --git a/mmv1/products/networkservices/go_EdgeCacheService.yaml b/mmv1/products/networkservices/go_EdgeCacheService.yaml
index 861bb4a867c1..bdf97a26b388 100644
--- a/mmv1/products/networkservices/go_EdgeCacheService.yaml
+++ b/mmv1/products/networkservices/go_EdgeCacheService.yaml
@@ -88,11 +88,13 @@ properties:
   - name: 'labels'
     type: KeyValueLabels
     description: 'Set of label tags associated with the EdgeCache resource.'
+ # default from api
   - name: 'disableQuic'
     type: Boolean
     description: |
       HTTP/3 (IETF QUIC) and Google QUIC are enabled by default.
     default_from_api: true
+ # default from api
   - name: 'disableHttp2'
     type: Boolean
     description: |
@@ -101,6 +103,7 @@ properties:
       HTTP/2 (h2) is enabled by default and recommended for performance. HTTP/2 improves connection re-use and reduces connection setup overhead by sending multiple streams over the same connection.
 
       Some legacy HTTP clients may have issues with HTTP/2 connections due to broken HTTP/2 implementations. Setting this to true will prevent HTTP/2 from being advertised and negotiated.
+ # default from api
   - name: 'requireTls'
     type: Boolean
     description: |
@@ -241,6 +244,7 @@ properties:
                     item_type:
                       type: NestedObject
                       properties:
+ # default from api
                         - name: 'ignoreCase'
                           type: Boolean
                           description: |
@@ -275,6 +279,7 @@ properties:
                                 type: String
                                 description: |
                                   The value of the header must end with the contents of suffixMatch.
+ # default from api
                               - name: 'invertMatch'
                                 type: Boolean
                                 description: |
@@ -328,6 +333,9 @@ properties:
                             For satisfying the matchRule condition, the path of the request must exactly match the value specified in fullPathMatch after removing any query parameters and anchor that may be part of the original URL.
                     min_size: 1
                     max_size: 5
+                          # TODO: (scottsuarez) conflicts also won't work for array path matchers yet, uncomment here once supported.
+                          # conflicts:
+                          #   - Routing.PathMatcher.RouteRule.prefixMatch
                   - name: 'headerAction'
                     type: NestedObject
                     description: |
@@ -351,6 +359,7 @@ properties:
                               description: |
                                 The value of the header to add.
                               required: true
+ # default from api
                             - name: 'replace'
                               type: Boolean
                               description: |
@@ -427,6 +436,7 @@ properties:
                         description: |
                           The policy to use for defining caching and signed request behaviour for requests that match this route.
                         properties:
+ # default from api
                           - name: 'cacheMode'
                             type: Enum
                             description: |
@@ -452,6 +462,7 @@ properties:
 
                               When the cache mode is set to "USE_ORIGIN_HEADERS" or "BYPASS_CACHE", you must omit this field.
                               A duration in seconds terminated by 's'. Example: "3s".
+ # defalt from api
                           - name: 'defaultTtl'
                             type: String
                             description: |
@@ -471,6 +482,7 @@ properties:
 
                               A duration in seconds terminated by 's'. Example: "3s".
                             default_from_api: true
+ # defalt from api
                           - name: 'maxTtl'
                             type: String
                             description: |
@@ -494,6 +506,7 @@ properties:
                             description: |
                               Defines the request parameters that contribute to the cache key.
                             properties:
+ # default from api
                               - name: 'includeProtocol'
                                 type: Boolean
                                 description: |
@@ -509,6 +522,7 @@ properties:
                                   excludeQueryParameters. If neither includeQueryParameters nor
                                   excludeQueryParameters is set, the entire query string will be
                                   included.
+ # default from api
                               - name: 'excludeHost'
                                 type: Boolean
                                 description: |
@@ -584,6 +598,7 @@ properties:
                               - TTLs must be >= 0 (where 0 is "always revalidate") and <= 86400s (1 day)
 
                               Note that when specifying an explicit negativeCachingPolicy, you should take care to specify a cache TTL for all response codes that you wish to cache. The CDNPolicy will not apply any default negative caching when a policy exists.
+ # default from api
                           - name: 'signedRequestMode'
                             type: Enum
                             description: |
@@ -597,6 +612,7 @@ properties:
                               - 'DISABLED'
                               - 'REQUIRE_SIGNATURES'
                               - 'REQUIRE_TOKENS'
+ # resource ref, EdgeCacheKeyset?
                           - name: 'signedRequestKeyset'
                             type: String
                             description: |
@@ -839,6 +855,7 @@ properties:
                           The prefix that replaces the prefixMatch specified in the routeRule, retaining the remaining portion of the URL before redirecting the request.
 
                           prefixRedirect cannot be supplied together with pathRedirect. Supply one alone or neither. If neither is supplied, the path of the original request will be used for the redirect.
+ # default from api
                       - name: 'redirectResponseCode'
                         type: Enum
                         description: |
@@ -858,6 +875,7 @@ properties:
                           - 'SEE_OTHER'
                           - 'TEMPORARY_REDIRECT'
                           - 'PERMANENT_REDIRECT'
+ # default from api
                       - name: 'httpsRedirect'
                         type: Boolean
                         description: |
@@ -865,6 +883,7 @@ properties:
 
                           This can only be set if there is at least one (1) edgeSslCertificate set on the service.
                         default_from_api: true
+ # default from api
                       - name: 'stripQuery'
                         type: Boolean
                         description: |
@@ -879,6 +898,7 @@ properties:
     description: |
       Specifies the logging options for the traffic served by this service. If logging is enabled, logs will be exported to Cloud Logging.
     properties:
+ # default from api
       - name: 'enable'
         type: Boolean
         description: |
diff --git a/mmv1/products/notebooks/go_Instance.yaml b/mmv1/products/notebooks/go_Instance.yaml
index 3b83a469a51f..204146c9e93e 100644
--- a/mmv1/products/notebooks/go_Instance.yaml
+++ b/mmv1/products/notebooks/go_Instance.yaml
@@ -63,6 +63,8 @@ custom_code:
   post_update: 'templates/terraform/post_update/go/notebooks_instance.go.tmpl'
 schema_version: 1
 state_upgraders: true
+# This resource should not be removed until the 2025 major release or later.
+# Check instance availability first before fully removing.
 deprecation_message: '`google_notebook_instance` is deprecated and will be removed in a future major release. Use `google_workbench_instance` instead.'
 examples:
   - name: 'notebook_instance_basic'
@@ -131,6 +133,11 @@ properties:
     description: |
       A reference to a machine type which defines VM kind.
     required: true
+    # Machine Type is updatable, but requires the instance to be stopped, just like
+    # for compute instances.
+    # TODO: Implement allow_stopping_for_update here and for acceleratorConfig
+    # update_verb: :PATCH
+    # update_url: 'projects/{{project}}/locations/{{location}}/instances/{{name}}:setMachineType'
     diff_suppress_func: 'tpgresource.CompareSelfLinkOrResourceName'
     custom_flatten: 'templates/terraform/custom_flatten/go/name_from_self_link.tmpl'
   - name: 'postStartupScript'
@@ -184,6 +191,11 @@ properties:
       The hardware accelerator used on this instance. If you use accelerators,
       make sure that your configuration has enough vCPUs and memory to support the
       machineType you have selected.
+    # AcceleratorConfig is updatable, but requires the instance to be stopped, just like
+    # for compute instances.
+    # TODO: Implement allow_stopping_for_update here and for machineType.
+    # update_verb: :PATCH
+    # update_url: 'projects/{{project}}/locations/{{location}}/instances/{{name}}:setAccelerator'
     properties:
       - name: 'type'
         type: Enum
@@ -385,6 +397,8 @@ properties:
     description: |
       Custom metadata to apply to this instance.
       An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+    # This was added as part of https://github.com/GoogleCloudPlatform/magic-modules/pull/3761 to
+    # avoid detecting drift, since this field is partially server-managed.
     ignore_read: true
     update_url: 'projects/{{project}}/locations/{{location}}/instances/{{name}}:updateMetadataItems'
     update_verb: 'PATCH'
diff --git a/mmv1/products/notebooks/go_Runtime.yaml b/mmv1/products/notebooks/go_Runtime.yaml
index fab8c676956a..6e99d75c5471 100644
--- a/mmv1/products/notebooks/go_Runtime.yaml
+++ b/mmv1/products/notebooks/go_Runtime.yaml
@@ -21,6 +21,9 @@ description: |
   ~> **Note:** Due to limitations of the Notebooks Runtime API, many fields
   in this resource do not properly detect drift. These fields will also not
   appear in state once imported.
+# When set, if any parameter change, they will get recreated.
+# Use wisely because any `update_url:` in the hierarchy below this will get ignored.
+# immutable: true
 references:
   guides:
     'Official Documentation': 'https://cloud.google.com/ai-platform-notebooks'
@@ -52,6 +55,7 @@ async:
 iam_policy:
   method_name_separator: ':'
   parent_resource_attribute: 'runtime_name'
+  # Sets the base url for base_url:GetIamPolicy and base_url:SetIamPolicy in function `qualifyRuntimeUrl`
   base_url: 'projects/{{project}}/locations/{{location}}/runtimes/{{runtime_name}}'
   example_config_body: 'templates/terraform/iam/go/iam_attributes.go.tmpl'
   import_format:
diff --git a/mmv1/products/osconfig/go_GuestPolicies.yaml b/mmv1/products/osconfig/go_GuestPolicies.yaml
index 0b99185d68ec..ab15678b0801 100644
--- a/mmv1/products/osconfig/go_GuestPolicies.yaml
+++ b/mmv1/products/osconfig/go_GuestPolicies.yaml
@@ -43,18 +43,21 @@ examples:
       instance_name: 'guest-policy-inst'
       guest_policy_id: 'guest-policy'
     ignore_read_extra:
+ # project number is returned in rest response
       - 'project'
   - name: 'os_config_guest_policies_packages'
     primary_resource_id: 'guest_policies'
     vars:
       guest_policy_id: 'guest-policy'
     ignore_read_extra:
+ # project number is returned in rest response
       - 'project'
   - name: 'os_config_guest_policies_recipes'
     primary_resource_id: 'guest_policies'
     vars:
       guest_policy_id: 'guest-policy'
     ignore_read_extra:
+ # project number is returned in rest response
       - 'project'
 parameters:
   - name: 'guestPolicyId'
@@ -249,6 +252,7 @@ properties:
           description: |
             An Apt Repository.
           min_version: 'beta'
+          # TODO (mbang): add exactly_one_of when it can be applied to lists (https://github.com/hashicorp/terraform-plugin-sdk/issues/470)
           properties:
             - name: 'archiveType'
               type: Enum
@@ -290,6 +294,7 @@ properties:
           description: |
             A Yum Repository.
           min_version: 'beta'
+          # TODO (mbang): add exactly_one_of when it can be applied to lists (https://github.com/hashicorp/terraform-plugin-sdk/issues/470)
           properties:
             - name: 'id'
               type: String
@@ -321,6 +326,7 @@ properties:
           description: |
             A Zypper Repository.
           min_version: 'beta'
+          # TODO (mbang): add exactly_one_of when it can be applied to lists (https://github.com/hashicorp/terraform-plugin-sdk/issues/470)
           properties:
             - name: 'id'
               type: String
@@ -352,6 +358,7 @@ properties:
           description: |
             A Goo Repository.
           min_version: 'beta'
+          # TODO (mbang): add exactly_one_of when it can be applied to lists (https://github.com/hashicorp/terraform-plugin-sdk/issues/470)
           properties:
             - name: 'name'
               type: String
@@ -415,6 +422,7 @@ properties:
                 description: |
                   A generic remote artifact.
                 min_version: 'beta'
+                # TODO (mbang): add `conflicts` when it can be applied to lists (https://github.com/hashicorp/terraform-plugin-sdk/issues/470)
                 properties:
                   - name: 'uri'
                     type: String
@@ -433,6 +441,7 @@ properties:
                 description: |
                   A Google Cloud Storage artifact.
                 min_version: 'beta'
+                # TODO (mbang): add `conflicts` when it can be applied to lists (https://github.com/hashicorp/terraform-plugin-sdk/issues/470)
                 properties:
                   - name: 'bucket'
                     type: String
@@ -466,6 +475,7 @@ properties:
                 description: |
                   Copies a file onto the instance.
                 min_version: 'beta'
+                # TODO (mbang): add exactly_one_of when it can be applied to lists (https://github.com/hashicorp/terraform-plugin-sdk/issues/470)
                 properties:
                   - name: 'artifactId'
                     type: String
@@ -502,6 +512,7 @@ properties:
                 description: |
                   Extracts an archive into the specified directory.
                 min_version: 'beta'
+                # TODO (mbang): add exactly_one_of when it can be applied to lists (https://github.com/hashicorp/terraform-plugin-sdk/issues/470)
                 properties:
                   - name: 'artifactId'
                     type: String
@@ -533,6 +544,7 @@ properties:
                 description: |
                   Installs an MSI file.
                 min_version: 'beta'
+                # TODO (mbang): add exactly_one_of when it can be applied to lists (https://github.com/hashicorp/terraform-plugin-sdk/issues/470)
                 properties:
                   - name: 'artifactId'
                     type: String
@@ -561,6 +573,7 @@ properties:
                 description: |
                   Installs a deb file via dpkg.
                 min_version: 'beta'
+                # TODO (mbang): add exactly_one_of when it can be applied to lists (https://github.com/hashicorp/terraform-plugin-sdk/issues/470)
                 properties:
                   - name: 'artifactId'
                     type: String
@@ -573,6 +586,7 @@ properties:
                 description: |
                   Installs an rpm file via the rpm utility.
                 min_version: 'beta'
+                # TODO (mbang): add exactly_one_of when it can be applied to lists (https://github.com/hashicorp/terraform-plugin-sdk/issues/470)
                 properties:
                   - name: 'artifactId'
                     type: String
@@ -585,6 +599,7 @@ properties:
                 description: |
                   Executes an artifact or local file.
                 min_version: 'beta'
+                # TODO (mbang): add exactly_one_of when it can be applied to lists (https://github.com/hashicorp/terraform-plugin-sdk/issues/470)
                 properties:
                   - name: 'args'
                     type: Array
@@ -604,16 +619,19 @@ properties:
                     description: |
                       The id of the relevant artifact in the recipe.
                     min_version: 'beta'
+                    # TODO (mbang): add exactly_one_of when it can be applied to lists (https://github.com/hashicorp/terraform-plugin-sdk/issues/470)
                   - name: 'localPath'
                     type: String
                     description: |
                       The absolute path of the file on the local filesystem.
                     min_version: 'beta'
+                    # TODO (mbang): add exactly_one_of when it can be applied to lists (https://github.com/hashicorp/terraform-plugin-sdk/issues/470)
               - name: 'scriptRun'
                 type: NestedObject
                 description: |
                   Runs commands in a shell.
                 min_version: 'beta'
+                # TODO (mbang): add exactly_one_of when it can be applied to lists (https://github.com/hashicorp/terraform-plugin-sdk/issues/470)
                 properties:
                   - name: 'script'
                     type: String
@@ -652,6 +670,7 @@ properties:
                 description: |
                   Copies a file onto the instance.
                 min_version: 'beta'
+                # TODO (mbang): add exactly_one_of when it can be applied to lists (https://github.com/hashicorp/terraform-plugin-sdk/issues/470)
                 properties:
                   - name: 'artifactId'
                     type: String
diff --git a/mmv1/products/oslogin/go_SSHPublicKey.yaml b/mmv1/products/oslogin/go_SSHPublicKey.yaml
index 8d871d66453c..501a1f682a90 100644
--- a/mmv1/products/oslogin/go_SSHPublicKey.yaml
+++ b/mmv1/products/oslogin/go_SSHPublicKey.yaml
@@ -36,6 +36,7 @@ timeouts:
 custom_code:
   pre_create: 'templates/terraform/pre_create/go/os_login_ssh_public_key.go.tmpl'
   post_create: 'templates/terraform/post_create/go/sshkeyfingerprint.go.tmpl'
+# Skip sweeper since due to URL containing user ID
 exclude_sweeper: true
 examples:
   - name: 'os_login_ssh_key_basic'
diff --git a/mmv1/products/privateca/go_Certificate.yaml b/mmv1/products/privateca/go_Certificate.yaml
index dbab780ce54a..2e69fd21d390 100644
--- a/mmv1/products/privateca/go_Certificate.yaml
+++ b/mmv1/products/privateca/go_Certificate.yaml
@@ -120,6 +120,7 @@ properties:
       "notAfterTime" fields inside an X.509 certificate. A duration in seconds with up to nine
       fractional digits, terminated by 's'. Example: "3.5s".
     immutable: true
+ # 10 years
     default_value: "315360000s"
   - name: 'revocationDetails'
     type: NestedObject
@@ -658,6 +659,8 @@ properties:
       Output only. The time at which this CertificateAuthority was updated.
       This is in RFC3339 text format.
     output: true
+    # Note: would be a resourceref, except that CertificateTemplate is in the DCL
+    # and we don't have references across mmv1-dcl bridge yet.
   - name: 'certificateTemplate'
     type: String
     description: |
diff --git a/mmv1/products/privateca/go_CertificateAuthority.yaml b/mmv1/products/privateca/go_CertificateAuthority.yaml
index d03ec2542d44..aadd01d638bd 100644
--- a/mmv1/products/privateca/go_CertificateAuthority.yaml
+++ b/mmv1/products/privateca/go_CertificateAuthority.yaml
@@ -91,6 +91,8 @@ examples:
     ignore_read_extra:
       - 'deletion_protection'
       - 'subordinate_config.0.certificate_authority'
+      # This example ultimately generates a random id making replaying impossible at
+      # https://github.com/hashicorp/terraform-provider-google-beta/blob/22bfbbcf2250054e622743c4a35a872e43ed5aed/google-beta/privateca_ca_utils.go#L147
     skip_vcr: true
   - name: 'privateca_certificate_authority_byo_key'
     primary_resource_id: 'default'
@@ -124,6 +126,7 @@ examples:
       'deletion_protection': 'false'
     ignore_read_extra:
       - 'deletion_protection'
+    # Multiple IAM bindings on the same key cause non-determinism
     skip_vcr: true
 virtual_fields:
   - name: 'deletion_protection'
@@ -637,6 +640,7 @@ properties:
       "notAfterTime" fields inside an X.509 certificate. A duration in seconds with up to nine
       fractional digits, terminated by 's'. Example: "3.5s".
     immutable: true
+ # 10 years
     default_value: "315360000s"
   - name: 'keySpec'
     type: NestedObject
@@ -692,6 +696,7 @@ properties:
           - 'subordinate_config.0.certificate_authority'
           - 'subordinate_config.0.pem_issuer_chain'
         diff_suppress_func: 'tpgresource.CompareResourceNames'
+        # certificateAuthority is not included in the response since the sub-CA is activated via specifing pemIssuerChain
         custom_flatten: 'templates/terraform/custom_flatten/go/privateca_certificate_authority_subordinate_config_certificate_authority.go.tmpl'
       - name: 'pemIssuerChain'
         type: NestedObject
diff --git a/mmv1/products/pubsub/go_Topic.yaml b/mmv1/products/pubsub/go_Topic.yaml
index e51e1fb6220e..2ffabc582bd8 100644
--- a/mmv1/products/pubsub/go_Topic.yaml
+++ b/mmv1/products/pubsub/go_Topic.yaml
@@ -33,6 +33,12 @@ timeouts:
   insert_minutes: 20
   update_minutes: 20
   delete_minutes: 20
+  # PubSub resources don't have operations but are negatively cached
+  # and eventually consistent.
+  # Because some users check whether the PubSub resource exists prior
+  # to applying a new resource, we need to add this PollAsync to GET the
+  # resource until it exists and the negative cached result goes away.
+  # Context: hashicorp/terraform-provider-google#4993
 async:
   type: 'PollAsync'
   check_response_func_existence: 'transport_tpg.PollCheckForExistence'
diff --git a/mmv1/products/pubsublite/go_Topic.yaml b/mmv1/products/pubsublite/go_Topic.yaml
index 0d1c97a866a5..39b40f777782 100644
--- a/mmv1/products/pubsublite/go_Topic.yaml
+++ b/mmv1/products/pubsublite/go_Topic.yaml
@@ -39,6 +39,7 @@ examples:
     vars:
       reservation_name: 'example-reservation'
       topic_name: 'example-topic'
+    #   update_encoder: templates/terraform/update_encoder/pubsub_topic.erb
 parameters:
   - name: 'region'
     type: String
diff --git a/mmv1/products/redis/go_Instance.yaml b/mmv1/products/redis/go_Instance.yaml
index a7c1b8079587..9e936526c53c 100644
--- a/mmv1/products/redis/go_Instance.yaml
+++ b/mmv1/products/redis/go_Instance.yaml
@@ -112,6 +112,7 @@ examples:
       'prevent_destroy': 'false'
     exclude_test: true
 parameters:
+  # TODO: resourceref?
   - name: 'region'
     type: String
     description: |
@@ -425,6 +426,8 @@ properties:
       unique and non-overlapping with existing subnets in an authorized
       network.
     immutable: true
+    # In some situations the returned IP range may not match the sent value
+    # but will be a subset of the range.
     ignore_read: true
     default_from_api: true
   - name: 'tier'
diff --git a/mmv1/products/resourcemanager/go_Lien.yaml b/mmv1/products/resourcemanager/go_Lien.yaml
index f5a598993a04..d711cb83ed2c 100644
--- a/mmv1/products/resourcemanager/go_Lien.yaml
+++ b/mmv1/products/resourcemanager/go_Lien.yaml
@@ -20,6 +20,11 @@ description:
 docs:
 id_format: '{{name}}'
 base_url: 'liens'
+# This resource has some issues - it returns a list when you query for it.
+# You can't use the same URL for GET and DELETE.  This here is the URL that
+# we use for GET, and the DELETE is in custom code.  If this happens a lot,
+# we might build a more general solution, but this is the only resource I know
+# of where that happens.
 self_link: 'liens?parent={{parent}}'
 immutable: true
 import_format:
diff --git a/mmv1/products/secretmanager/go_SecretVersion.yaml b/mmv1/products/secretmanager/go_SecretVersion.yaml
index babd7e10b155..f0e963295c27 100644
--- a/mmv1/products/secretmanager/go_SecretVersion.yaml
+++ b/mmv1/products/secretmanager/go_SecretVersion.yaml
@@ -38,6 +38,7 @@ custom_code:
   custom_update: 'templates/terraform/custom_update/go/secret_version.go.tmpl'
   pre_delete: 'templates/terraform/pre_delete/go/secret_version_deletion_policy.go.tmpl'
   custom_import: 'templates/terraform/custom_import/go/secret_version.go.tmpl'
+# Sweeper skipped as this resource has customized deletion.
 exclude_sweeper: true
 examples:
   - name: 'secret_version_basic'
diff --git a/mmv1/products/securitycenter/go_FolderCustomModule.yaml b/mmv1/products/securitycenter/go_FolderCustomModule.yaml
index fda6b99d7d04..cd6283602865 100644
--- a/mmv1/products/securitycenter/go_FolderCustomModule.yaml
+++ b/mmv1/products/securitycenter/go_FolderCustomModule.yaml
@@ -87,6 +87,7 @@ properties:
       characters or underscores only.
     required: true
     immutable: true
+    # API error for invalid display names is just "INVALID_ARGUMENT" with no details
     validation:
       function: 'verify.ValidateRegexp(`^[a-z][\w_]{0,127}$`)'
   - name: 'enablementState'
diff --git a/mmv1/products/securitycenter/go_MuteConfig.yaml b/mmv1/products/securitycenter/go_MuteConfig.yaml
index 6db903ec8930..64d37deb4ffd 100644
--- a/mmv1/products/securitycenter/go_MuteConfig.yaml
+++ b/mmv1/products/securitycenter/go_MuteConfig.yaml
@@ -36,6 +36,7 @@ timeouts:
   delete_minutes: 20
 custom_code:
   custom_import: 'templates/terraform/custom_import/go/scc_mute_config.go.tmpl'
+# Skipping sweeper since this is a child resource
 exclude_sweeper: true
 examples:
   - name: 'scc_mute_config'
diff --git a/mmv1/products/securitycenter/go_OrganizationCustomModule.yaml b/mmv1/products/securitycenter/go_OrganizationCustomModule.yaml
index 31d14ff8bd1f..7d5611d386ba 100644
--- a/mmv1/products/securitycenter/go_OrganizationCustomModule.yaml
+++ b/mmv1/products/securitycenter/go_OrganizationCustomModule.yaml
@@ -81,6 +81,7 @@ properties:
       characters or underscores only.
     required: true
     immutable: true
+    # API error for invalid display names is just "INVALID_ARGUMENT" with no details
     validation:
       function: 'verify.ValidateRegexp(`^[a-z][\w_]{0,127}$`)'
   - name: 'enablementState'
diff --git a/mmv1/products/securitycenter/go_ProjectCustomModule.yaml b/mmv1/products/securitycenter/go_ProjectCustomModule.yaml
index f56b38e82c5b..8d4e39d1a15b 100644
--- a/mmv1/products/securitycenter/go_ProjectCustomModule.yaml
+++ b/mmv1/products/securitycenter/go_ProjectCustomModule.yaml
@@ -65,6 +65,7 @@ properties:
       characters or underscores only.
     required: true
     immutable: true
+    # API error for invalid display names is just "INVALID_ARGUMENT" with no details
     validation:
       function: 'verify.ValidateRegexp(`^[a-z][\w_]{0,127}$`)'
   - name: 'enablementState'
diff --git a/mmv1/products/securitycentermanagement/go_FolderSecurityHealthAnalyticsCustomModule.yaml b/mmv1/products/securitycentermanagement/go_FolderSecurityHealthAnalyticsCustomModule.yaml
index b6566b457493..beaf8401baf3 100644
--- a/mmv1/products/securitycentermanagement/go_FolderSecurityHealthAnalyticsCustomModule.yaml
+++ b/mmv1/products/securitycentermanagement/go_FolderSecurityHealthAnalyticsCustomModule.yaml
@@ -95,6 +95,7 @@ properties:
       128 characters, start with a lowercase letter, and contain alphanumeric
       characters or underscores only.
     immutable: true
+    # API error for invalid display names is just "INVALID_ARGUMENT" with no details
     validation:
       function: 'verify.ValidateRegexp(`^[a-z][\w_]{0,127}$`)'
   - name: 'enablementState'
diff --git a/mmv1/products/securitycentermanagement/go_OrganizationSecurityHealthAnalyticsCustomModule.yaml b/mmv1/products/securitycentermanagement/go_OrganizationSecurityHealthAnalyticsCustomModule.yaml
index 1286372ddd94..75ea32a3231e 100644
--- a/mmv1/products/securitycentermanagement/go_OrganizationSecurityHealthAnalyticsCustomModule.yaml
+++ b/mmv1/products/securitycentermanagement/go_OrganizationSecurityHealthAnalyticsCustomModule.yaml
@@ -88,6 +88,7 @@ properties:
       128 characters, start with a lowercase letter, and contain alphanumeric
       characters or underscores only.
     immutable: true
+    # API error for invalid display names is just "INVALID_ARGUMENT" with no details
     validation:
       function: 'verify.ValidateRegexp(`^[a-z][\w_]{0,127}$`)'
   - name: 'enablementState'
diff --git a/mmv1/products/securitycentermanagement/go_ProjectSecurityHealthAnalyticsCustomModule.yaml b/mmv1/products/securitycentermanagement/go_ProjectSecurityHealthAnalyticsCustomModule.yaml
index 1728fcb3d3eb..28f9de32c34c 100644
--- a/mmv1/products/securitycentermanagement/go_ProjectSecurityHealthAnalyticsCustomModule.yaml
+++ b/mmv1/products/securitycentermanagement/go_ProjectSecurityHealthAnalyticsCustomModule.yaml
@@ -74,6 +74,7 @@ properties:
       characters or underscores only.
     required: false
     immutable: true
+    # API error for invalid display names is just "INVALID_ARGUMENT" with no details
     validation:
       function: 'verify.ValidateRegexp(`^[a-z][\w_]{0,127}$`)'
   - name: 'enablementState'
diff --git a/mmv1/products/securityposture/go_Posture.yaml b/mmv1/products/securityposture/go_Posture.yaml
index 8dd2666ac729..a844f603ad44 100644
--- a/mmv1/products/securityposture/go_Posture.yaml
+++ b/mmv1/products/securityposture/go_Posture.yaml
@@ -37,6 +37,7 @@ timeouts:
   update_minutes: 20
   delete_minutes: 20
 autogen_async: true
+# Sets parameters for handling operations returned by the API.
 async:
   actions: ['create', 'delete', 'update']
   type: 'OpAsync'
diff --git a/mmv1/products/servicenetworking/go_VPCServiceControls.yaml b/mmv1/products/servicenetworking/go_VPCServiceControls.yaml
index f6898076b4a1..4a5dfe42769e 100644
--- a/mmv1/products/servicenetworking/go_VPCServiceControls.yaml
+++ b/mmv1/products/servicenetworking/go_VPCServiceControls.yaml
@@ -62,6 +62,7 @@ timeouts:
   delete_minutes: 20
 autogen_async: true
 async:
+ # we just need the boilerplate async code, we'll call the methods manually
   actions: ['']
   type: 'OpAsync'
   operation:
@@ -74,6 +75,7 @@ custom_code:
   custom_create: 'templates/terraform/custom_create/go/service_networking_vpc_service_controls.go.tmpl'
   pre_read: 'templates/terraform/pre_read/go/service_networking_vpc_service_controls.go.tmpl'
   custom_update: 'templates/terraform/custom_create/go/service_networking_vpc_service_controls.go.tmpl'
+ # excluding tgc because of helpers in custom_code.constants
 exclude_tgc: true
 examples:
   - name: 'service_networking_vpc_service_controls_basic'
@@ -102,6 +104,7 @@ parameters:
     type: String
     description: |-
       The id of the Google Cloud project containing the consumer network.
+    # required: true
     immutable: true
     ignore_read: true
 properties:
diff --git a/mmv1/products/spanner/go_Database.yaml b/mmv1/products/spanner/go_Database.yaml
index 0d81d80bf695..be1d04fa2011 100644
--- a/mmv1/products/spanner/go_Database.yaml
+++ b/mmv1/products/spanner/go_Database.yaml
@@ -66,6 +66,7 @@ custom_code:
   pre_delete: 'templates/terraform/pre_delete/go/resource_spanner_database.go.tmpl'
 custom_diff:
   - 'resourceSpannerDBDdlCustomDiff'
+# Sweeper skipped as this resource has customized deletion.
 exclude_sweeper: true
 examples:
   - name: 'spanner_database_basic'
@@ -74,6 +75,7 @@ examples:
       database_name: 'my-database'
     ignore_read_extra:
       - 'deletion_protection'
+      # Randomness due to spanner instance
     skip_vcr: true
 virtual_fields:
   - name: 'deletion_protection'
@@ -96,6 +98,9 @@ parameters:
     resource: 'Instance'
     imports: 'name'
 properties:
+  # This resource returns only one attribute ("name") from which we parse
+  # "instance", "name", and "project".  You will need custom code handling
+  # to deal with this resource.
   - name: 'name'
     type: String
     description: |
diff --git a/mmv1/products/spanner/go_Instance.yaml b/mmv1/products/spanner/go_Instance.yaml
index a2db24ead4d8..00b5c1cb3f8f 100644
--- a/mmv1/products/spanner/go_Instance.yaml
+++ b/mmv1/products/spanner/go_Instance.yaml
@@ -58,15 +58,19 @@ custom_code:
 examples:
   - name: 'spanner_instance_basic'
     primary_resource_id: 'example'
+      # Randomness
     skip_vcr: true
   - name: 'spanner_instance_processing_units'
     primary_resource_id: 'example'
+      # Randomness
     skip_vcr: true
   - name: 'spanner_instance_with_autoscaling'
     primary_resource_id: 'example'
+      # Randomness
     skip_vcr: true
   - name: 'spanner_instance_multi_regional'
     primary_resource_id: 'example'
+      # Randomness
     skip_vcr: true
 virtual_fields:
   - name: 'force_destroy'
@@ -86,6 +90,9 @@ properties:
       If not provided, a random string starting with `tf-` will be selected.
     required: true
     immutable: true
+        # This resource supports a sort of odd autogenerate-if-not-set
+        # system, which is done in the encoder.  Consequently we have
+        # to interpret "not set" as "use the name in state".
     default_from_api: true
     custom_flatten: 'templates/terraform/custom_flatten/go/name_from_self_link.tmpl'
     validation:
diff --git a/mmv1/products/spanner/go_InstanceConfig.yaml b/mmv1/products/spanner/go_InstanceConfig.yaml
index 93a46032b8d0..4dfb72521dca 100644
--- a/mmv1/products/spanner/go_InstanceConfig.yaml
+++ b/mmv1/products/spanner/go_InstanceConfig.yaml
@@ -48,6 +48,7 @@ custom_code:
   update_encoder: 'templates/terraform/update_encoder/go/spanner_instance_config_update.go.tmpl'
   decoder: 'templates/terraform/decoders/go/spanner_instance_config.go.tmpl'
 exclude_tgc: true
+# Sweeper skipped as this resource has customized deletion.
 exclude_sweeper: true
 examples:
   - name: 'spanner_instance_config_basic'
diff --git a/mmv1/products/sql/go_Database.yaml b/mmv1/products/sql/go_Database.yaml
index 2de7597ee6a3..5cf544e7074c 100644
--- a/mmv1/products/sql/go_Database.yaml
+++ b/mmv1/products/sql/go_Database.yaml
@@ -49,6 +49,7 @@ async:
 collection_url_key: 'items'
 custom_code:
   pre_delete: 'templates/terraform/pre_delete/go/sql_database_deletion_policy.tmpl'
+# Sweeper skipped as this resource has customized deletion.
 exclude_sweeper: true
 read_error_transform: 'transformSQLDatabaseReadError'
 examples:
@@ -71,6 +72,7 @@ examples:
     ignore_read_extra:
       - 'deletion_policy'
 virtual_fields:
+  # TODO: make this an enum in a future major version. If using this field as a reference, look at PerInstanceConfig's minimal_action field for enum configuration.
   - name: 'deletion_policy'
     description: |
       The deletion policy for the database. Setting ABANDON allows the resource
diff --git a/mmv1/products/storage/go_Bucket.yaml b/mmv1/products/storage/go_Bucket.yaml
index 827721f1ee95..cca7aeda60ae 100644
--- a/mmv1/products/storage/go_Bucket.yaml
+++ b/mmv1/products/storage/go_Bucket.yaml
@@ -133,6 +133,7 @@ properties:
         - name: 'entityId'
           type: String
           description: 'The ID for the entity'
+        # | 'etag' is not applicable for state convergence.
         - name: 'id'
           type: String
           description: 'The ID of the access-control entry.'
@@ -238,6 +239,7 @@ properties:
           type: String
           description: 'The ID for the entity'
           output: true
+        # | 'etag' is not applicable for state convergence.
         - name: 'generation'
           type: Integer
           description:
@@ -273,6 +275,7 @@ properties:
           enum_values:
             - 'OWNER'
             - 'READER'
+  # | 'etag' is not applicable for state convergence.
   - name: 'id'
     type: String
     description: |
diff --git a/mmv1/products/storage/go_DefaultObjectAccessControl.yaml b/mmv1/products/storage/go_DefaultObjectAccessControl.yaml
index e037896ed661..67ea59cdce51 100644
--- a/mmv1/products/storage/go_DefaultObjectAccessControl.yaml
+++ b/mmv1/products/storage/go_DefaultObjectAccessControl.yaml
@@ -85,6 +85,7 @@ properties:
     type: String
     description: 'The ID for the entity'
     output: true
+  # | 'etag' is not applicable for state convergence.
   - name: 'generation'
     type: Integer
     description:
diff --git a/mmv1/products/storage/go_HmacKey.yaml b/mmv1/products/storage/go_HmacKey.yaml
index 6fff892071f2..463c6b35269b 100644
--- a/mmv1/products/storage/go_HmacKey.yaml
+++ b/mmv1/products/storage/go_HmacKey.yaml
@@ -32,6 +32,7 @@ id_format: 'projects/{{project}}/hmacKeys/{{access_id}}'
 base_url: 'projects/{{project}}/hmacKeys'
 self_link: 'projects/{{project}}/hmacKeys/{{access_id}}'
 create_url: 'projects/{{project}}/hmacKeys?serviceAccountEmail={{service_account_email}}'
+# technically updatable, but implemented as custom update for new fingerprint support
 immutable: true
 import_format:
   - 'projects/{{project}}/hmacKeys/{{access_id}}'
@@ -73,6 +74,7 @@ properties:
     fingerprint_name: 'etag'
     default_value: "ACTIVE"
     enum_values:
+    # - :DELETED (not directly settable)
       - 'ACTIVE'
       - 'INACTIVE'
   - name: 'secret'
diff --git a/mmv1/products/storage/go_ManagedFolder.yaml b/mmv1/products/storage/go_ManagedFolder.yaml
index 8d31979c7d79..de2a1aac13cf 100644
--- a/mmv1/products/storage/go_ManagedFolder.yaml
+++ b/mmv1/products/storage/go_ManagedFolder.yaml
@@ -37,6 +37,7 @@ base_url: 'b/{{bucket}}/managedFolders'
 self_link: 'b/{{bucket}}/managedFolders/{{%name}}'
 has_self_link: true
 delete_url: 'b/{{bucket}}/managedFolders/{{%name}}?allowNonEmpty={{force_destroy}}'
+# iam_policy: handwritten in mmv1/third_party/terraform/services/storage/iam_storage_managed_folder.go
 import_format:
   - '{{bucket}}/managedFolders/{{%name}}'
   - '{{bucket}}/{{%name}}'
@@ -46,6 +47,7 @@ timeouts:
   delete_minutes: 20
 custom_code:
   custom_update: 'templates/terraform/custom_update/go/storage_managed_folder.go.tmpl'
+ # Skipping sweeper since this is a child resource.
 exclude_sweeper: true
 examples:
   - name: 'storage_managed_folder_basic'
@@ -78,6 +80,9 @@ parameters:
       trailing '/'. For example, `example_dir/example_dir2/`.
     required: true
     immutable: true
+    # The API returns values with trailing slashes, even if not
+    # provided. Enforcing trailing slashes prevents diffs and ensures
+    # consistent output.
     validation:
       regex: '/$'
 properties:
diff --git a/mmv1/products/storage/go_ObjectAccessControl.yaml b/mmv1/products/storage/go_ObjectAccessControl.yaml
index 5c299257cc7d..e82dd5bf6f13 100644
--- a/mmv1/products/storage/go_ObjectAccessControl.yaml
+++ b/mmv1/products/storage/go_ObjectAccessControl.yaml
@@ -84,6 +84,7 @@ properties:
     type: String
     description: 'The ID for the entity'
     output: true
+  # | 'etag' is not applicable for state convergence.
   - name: 'generation'
     type: Integer
     description:
diff --git a/mmv1/products/tpu/go_Node.yaml b/mmv1/products/tpu/go_Node.yaml
index eca44ad76855..d925b7c2fed4 100644
--- a/mmv1/products/tpu/go_Node.yaml
+++ b/mmv1/products/tpu/go_Node.yaml
@@ -68,6 +68,7 @@ examples:
       'network_name': 'acctest.BootstrapSharedServiceNetworkingConnection(t, "vpc-network-1")'
     exclude_docs: true
 parameters:
+  # TODO: resourceref?
   - name: 'zone'
     type: String
     description: |
diff --git a/mmv1/products/vertexai/go_DeploymentResourcePool.yaml b/mmv1/products/vertexai/go_DeploymentResourcePool.yaml
index 0caa5de4d348..8189f606717a 100644
--- a/mmv1/products/vertexai/go_DeploymentResourcePool.yaml
+++ b/mmv1/products/vertexai/go_DeploymentResourcePool.yaml
@@ -24,6 +24,7 @@ docs:
 base_url: 'projects/{{project}}/locations/{{region}}/deploymentResourcePools'
 self_link: 'projects/{{project}}/locations/{{region}}/deploymentResourcePools/{{name}}'
 create_url: 'projects/{{project}}/locations/{{region}}/deploymentResourcePools'
+# No method is not defined for DeploymentResourcePools
 immutable: true
 timeouts:
   insert_minutes: 20
diff --git a/mmv1/products/vertexai/go_FeatureGroup.yaml b/mmv1/products/vertexai/go_FeatureGroup.yaml
index 0e125b998f18..241a5d566c46 100644
--- a/mmv1/products/vertexai/go_FeatureGroup.yaml
+++ b/mmv1/products/vertexai/go_FeatureGroup.yaml
@@ -81,6 +81,7 @@ properties:
   - name: 'description'
     type: String
     description: The description of the FeatureGroup.
+    # When API starts returning description, this line should be removed.
     custom_flatten: 'templates/terraform/custom_flatten/go/vertex_ai_feature_group_ignore_description.go.tmpl'
   - name: 'bigQuery'
     type: NestedObject
diff --git a/mmv1/products/vertexai/go_FeatureOnlineStore.yaml b/mmv1/products/vertexai/go_FeatureOnlineStore.yaml
index 9838eac120ae..99c6a8580c58 100644
--- a/mmv1/products/vertexai/go_FeatureOnlineStore.yaml
+++ b/mmv1/products/vertexai/go_FeatureOnlineStore.yaml
@@ -64,6 +64,7 @@ examples:
       name: 'example_feature_online_store_beta_bigtable'
     ignore_read_extra:
       - 'force_destroy'
+    # currently failing
     skip_vcr: true
 virtual_fields:
   - name: 'force_destroy'
@@ -138,6 +139,7 @@ properties:
     type: NestedObject
     description:
       Settings for the Optimized store that will be created to serve featureValues for all FeatureViews under this FeatureOnlineStore
+      # The fields below are necessary to include the "Optimized" transformation in the payload
     send_empty_value: true
     allow_empty_object: true
     conflicts:
@@ -146,6 +148,7 @@ properties:
       - 'bigtable'
       - 'optimized'
     properties:
+ # Meant to be an empty object with no properties - see here : https://cloud.google.com/vertex-ai/docs/reference/rest/v1beta1/projects.locations.featureOnlineStores#Optimized
       []
   - name: 'dedicatedServingEndpoint'
     type: NestedObject
diff --git a/mmv1/products/vertexai/go_FeatureOnlineStoreFeatureview.yaml b/mmv1/products/vertexai/go_FeatureOnlineStoreFeatureview.yaml
index 6c87c539f517..9314aeaa2045 100644
--- a/mmv1/products/vertexai/go_FeatureOnlineStoreFeatureview.yaml
+++ b/mmv1/products/vertexai/go_FeatureOnlineStoreFeatureview.yaml
@@ -70,6 +70,7 @@ examples:
     min_version: 'beta'
     vars:
       name: 'example_feature_view_vector_search'
+    # currently failing
     skip_vcr: true
 parameters:
   - name: 'featureOnlineStore'
diff --git a/mmv1/products/vertexai/go_Index.yaml b/mmv1/products/vertexai/go_Index.yaml
index 3c8194076c33..af0331caf14e 100644
--- a/mmv1/products/vertexai/go_Index.yaml
+++ b/mmv1/products/vertexai/go_Index.yaml
@@ -86,6 +86,9 @@ properties:
   - name: 'description'
     type: String
     description: The description of the Index.
+  # Please take a look at the following links for the original definition:
+  # https://cloud.google.com/vertex-ai/docs/matching-engine/create-manage-index#create_index-drest
+  # https://cloud.google.com/vertex-ai/docs/matching-engine/configuring-indexes
   - name: 'metadata'
     type: NestedObject
     description: An additional information about the Index
diff --git a/mmv1/products/vertexai/go_IndexEndpoint.yaml b/mmv1/products/vertexai/go_IndexEndpoint.yaml
index e277f39bb2e7..6985729df8c8 100644
--- a/mmv1/products/vertexai/go_IndexEndpoint.yaml
+++ b/mmv1/products/vertexai/go_IndexEndpoint.yaml
@@ -74,6 +74,7 @@ parameters:
     url_param_only: true
     immutable: true
 properties:
+  # Intentionally deployedIndexes[] is not included because it's an output-only field and another terraform resource will manage a deployed index.
   - name: 'name'
     type: String
     description: The resource name of the Index.
diff --git a/mmv1/products/vertexai/go_IndexEndpointDeployedIndex.yaml b/mmv1/products/vertexai/go_IndexEndpointDeployedIndex.yaml
index 6dfd2652e01f..1f8249d5c23a 100644
--- a/mmv1/products/vertexai/go_IndexEndpointDeployedIndex.yaml
+++ b/mmv1/products/vertexai/go_IndexEndpointDeployedIndex.yaml
@@ -187,6 +187,7 @@ properties:
     description: |
       A description of resources that the DeployedIndex uses, which to large degree are decided by Vertex AI, and optionally allows only a modest additional configuration.
 
+    # Note: Having the fields within automaticResouces not being marked as immutable was done in order to support the ability to update such fields. See : https://github.com/GoogleCloudPlatform/magic-modules/pull/11039#issuecomment-2209316648
     default_from_api: true
     properties:
       - name: 'minReplicaCount'
@@ -216,12 +217,15 @@ properties:
 
         n1-standard-16 and n1-standard-32 are still available, but we recommend e2-standard-16 and e2-highmem-16 for cost efficiency.
 
+    # Having fields within dedicatedResources not being marked as immutable as well as removing
+    # fields such as acceleratorType, acceleratorCount, tpuTopology was done in order to support the ability to update such fields. This is discussed extensively [here](https://github.com/GoogleCloudPlatform/magic-modules/pull/11039#issuecomment-2209316648).
     properties:
       - name: 'machineSpec'
         type: NestedObject
         description: |
           The minimum number of replicas this DeployedModel will be always deployed on.
         required: true
+            # This field (and its nested fields) is not updatable via the mutateDeployedIndex method in the API, which is the only update method usable by this 'fine-grained' resource. This is why the field is marked as immutable despite the API docs not marking the field as immutable.
         immutable: true
         properties:
           - name: 'machineType'
@@ -281,6 +285,7 @@ properties:
       The value should be the name of the address (https://cloud.google.com/compute/docs/reference/rest/v1/addresses) Example: ['vertex-ai-ip-range'].
 
       For more information about subnets and network IP ranges, please see https://cloud.google.com/vpc/docs/subnets#manually_created_subnet_ip_ranges.
+    # This field is not updatable via the mutateDeployedIndex method in the API, which is the only update method usable by this 'fine-grained' resource. This is why the field is marked as immutable despite the API docs not marking the field as immutable.
     immutable: true
     item_type:
       type: String
@@ -290,5 +295,6 @@ properties:
       The deployment group can be no longer than 64 characters (eg: 'test', 'prod'). If not set, we will use the 'default' deployment group.
       Creating deployment_groups with reserved_ip_ranges is a recommended practice when the peered network has multiple peering ranges. This creates your deployments from predictable IP spaces for easier traffic administration. Also, one deployment_group (except 'default') can only be used with the same reserved_ip_ranges which means if the deployment_group has been used with reserved_ip_ranges: [a, b, c], using it with [a, b] or [d, e] is disallowed. [See the official documentation here](https://cloud.google.com/vertex-ai/docs/reference/rest/v1/projects.locations.indexEndpoints#DeployedIndex.FIELDS.deployment_group).
       Note: we only support up to 5 deployment groups (not including 'default').
+    # This field is not updatable via the mutateDeployedIndex method in the API, which is the only update method usable by this 'fine-grained' resource. This is why the field is marked as immutable despite the API docs not marking the field as immutable.
     immutable: true
     default_value: "default"
diff --git a/mmv1/products/vmwareengine/go_Cluster.yaml b/mmv1/products/vmwareengine/go_Cluster.yaml
index 628bc2d10685..307ffe088917 100644
--- a/mmv1/products/vmwareengine/go_Cluster.yaml
+++ b/mmv1/products/vmwareengine/go_Cluster.yaml
@@ -52,6 +52,7 @@ async:
     message: 'message'
   include_project: true
 custom_code:
+# There is a handwritten sweeper that provides a list of locations to sweep
 exclude_sweeper: true
 error_abort_predicates:
 
diff --git a/mmv1/products/vmwareengine/go_ExternalAccessRule.yaml b/mmv1/products/vmwareengine/go_ExternalAccessRule.yaml
index 4597842abb22..41d29f73ae78 100644
--- a/mmv1/products/vmwareengine/go_ExternalAccessRule.yaml
+++ b/mmv1/products/vmwareengine/go_ExternalAccessRule.yaml
@@ -48,6 +48,7 @@ async:
     message: 'message'
   include_project: true
 custom_code:
+# There is a handwritten sweeper that provides a list of locations to sweep
 exclude_sweeper: true
 examples:
   - name: 'vmware_engine_external_access_rule_basic'
diff --git a/mmv1/products/vmwareengine/go_ExternalAddress.yaml b/mmv1/products/vmwareengine/go_ExternalAddress.yaml
index 850a9f41dcb3..4a8267f88822 100644
--- a/mmv1/products/vmwareengine/go_ExternalAddress.yaml
+++ b/mmv1/products/vmwareengine/go_ExternalAddress.yaml
@@ -52,6 +52,7 @@ async:
     message: 'message'
   include_project: true
 custom_code:
+# There is a handwritten sweeper that provides a list of locations to sweep
 exclude_sweeper: true
 error_retry_predicates:
 
diff --git a/mmv1/products/vmwareengine/go_Network.yaml b/mmv1/products/vmwareengine/go_Network.yaml
index f47e7ebaf84a..16ede79d24fd 100644
--- a/mmv1/products/vmwareengine/go_Network.yaml
+++ b/mmv1/products/vmwareengine/go_Network.yaml
@@ -46,6 +46,7 @@ async:
     path: 'error'
     message: 'message'
 custom_code:
+# There is a handwritten sweeper that provides a list of locations to sweep
 exclude_sweeper: true
 examples:
   - name: 'vmware_engine_network_standard'
diff --git a/mmv1/products/workstations/go_WorkstationCluster.yaml b/mmv1/products/workstations/go_WorkstationCluster.yaml
index e602afbc048e..86abef5dc92d 100644
--- a/mmv1/products/workstations/go_WorkstationCluster.yaml
+++ b/mmv1/products/workstations/go_WorkstationCluster.yaml
@@ -82,6 +82,7 @@ parameters:
       The location where the workstation cluster should reside.
     min_version: 'beta'
     url_param_only: true
+    # TODO(esu): Change to required, as it's not possible for this field to be omitted on the API side.
     immutable: true
 properties:
   - name: 'name'
diff --git a/mmv1/products/workstations/go_WorkstationConfig.yaml b/mmv1/products/workstations/go_WorkstationConfig.yaml
index 5547fb552941..62ad4b51e10d 100644
--- a/mmv1/products/workstations/go_WorkstationConfig.yaml
+++ b/mmv1/products/workstations/go_WorkstationConfig.yaml
@@ -341,6 +341,7 @@ properties:
             properties:
               - name: 'enableConfidentialCompute'
                 type: Boolean
+                # TODO(esu): Change this to required in next breaking release.
                 description: |
                   Whether the instance has confidential compute enabled.
                 min_version: 'beta'
@@ -492,6 +493,7 @@ properties:
               description: |
                 Name of the snapshot to use as the source for the disk. This can be the snapshot's `self_link`, `id`, or a string in the format of `projects/{project}/global/snapshots/{snapshot}`. If set, `sizeGb` and `fsType` must be empty. Can only be updated if it has an existing value.
               min_version: 'beta'
+              # TODO(esu): Add conflicting fields once complex lists are supported.
   - name: 'ephemeralDirectories'
     type: Array
     description: |
@@ -548,6 +550,7 @@ properties:
       Container that will be run for each workstation using this configuration when that workstation is started.
     min_version: 'beta'
     default_from_api: true
+    # Mask fields must be sent as distinct keys, else some fields will upsert rather than be replaced.
     update_mask_fields:
       - 'container.image'
       - 'container.command'
@@ -581,6 +584,7 @@ properties:
         description: |
           If set, overrides the default DIR specified by the image.
         min_version: 'beta'
+        # Allow unsetting to revert to container default.
         send_empty_value: true
       - name: 'env'
         type: KeyValuePairs
diff --git a/mmv1/templates/terraform/iam/example_config_body/go/secret_manager_regional_secret.tf.tmpl b/mmv1/templates/terraform/iam/example_config_body/go/secret_manager_regional_secret.tf.tmpl
index fc10adcc521c..324d07d37a8d 100644
--- a/mmv1/templates/terraform/iam/example_config_body/go/secret_manager_regional_secret.tf.tmpl
+++ b/mmv1/templates/terraform/iam/example_config_body/go/secret_manager_regional_secret.tf.tmpl
@@ -1,4 +1,3 @@
-
   project = google_secret_manager_regional_secret.regional-secret-basic.project
   location = google_secret_manager_regional_secret.regional-secret-basic.location
   secret_id = google_secret_manager_regional_secret.regional-secret-basic.secret_id

From 09968b0fd90bb43f5e0cbfc19e12483e1ea98333 Mon Sep 17 00:00:00 2001
From: Zhenhua Li <zhenhuali@google.com>
Date: Mon, 16 Sep 2024 14:22:11 -0700
Subject: [PATCH 3/4] Add tempmode to copyComments function

---
 mmv1/description-copy.go | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/mmv1/description-copy.go b/mmv1/description-copy.go
index 181fe1934a38..08c8adaaad3c 100644
--- a/mmv1/description-copy.go
+++ b/mmv1/description-copy.go
@@ -26,12 +26,12 @@ func CopyAllDescriptions(tempMode bool) {
 		CopyText(id, tempMode)
 	}
 
-	copyComments()
+	copyComments(tempMode)
 }
 
 // TODO rewrite: ServicePerimeters.yaml is an exeption and needs manually fixing the comments over after switchover
 // Used to copy/paste comments from Ruby -> Go YAML files
-func copyComments() {
+func copyComments(tempMode bool) {
 	log.Printf("Starting to copy comments from Ruby yaml files to Go yaml files")
 
 	renamedFields := map[string]string{
@@ -41,10 +41,17 @@ func copyComments() {
 		"skip_import_test":       "exclude_import_test",
 		"skip_docs":              "exclude_docs",
 		"skip_attribution_label": "exclude_attribution_label",
+		"skip_read":              "exclude_read",
+		"skip_default_cdiff":     "exclude_default_cdiff",
+		"skip_docs_values":       "skip_docs_values",
 		"values":                 "enum_values",
 	}
 	var allProductFiles []string = make([]string, 0)
-	files, err := filepath.Glob("products/**/go_product.yaml")
+	glob := "products/**/go_product.yaml"
+	if tempMode {
+		glob = "products/**/*.temp"
+	}
+	files, err := filepath.Glob(glob)
 	if err != nil {
 		return
 	}
@@ -64,6 +71,20 @@ func copyComments() {
 			if strings.HasSuffix(yamlPath, "_new") {
 				continue
 			}
+
+			if tempMode {
+				cutName, found := strings.CutSuffix(yamlPath, ".temp")
+				if !found {
+					continue
+				}
+
+				baseName := filepath.Base(yamlPath)
+				yamlMap[baseName] = make([]string, 2)
+				yamlMap[baseName][1] = yamlPath
+				yamlMap[baseName][0] = cutName
+				continue
+			}
+
 			fileName := filepath.Base(yamlPath)
 			baseName, found := strings.CutPrefix(fileName, "go_")
 			if yamlMap[baseName] == nil {

From 407dd81ae1951ba0d02929b57b435f2f45522bd5 Mon Sep 17 00:00:00 2001
From: Zhenhua Li <zhenhuali@google.com>
Date: Mon, 16 Sep 2024 14:22:54 -0700
Subject: [PATCH 4/4] Resolve the conflicts after rebasing the main branch

---
 .../go_GcpUserAccessBinding.yaml               |  1 +
 mmv1/products/activedirectory/go_Domain.yaml   |  1 +
 .../activedirectory/go_DomainTrust.yaml        |  3 +++
 mmv1/products/activedirectory/go_Peering.yaml  |  1 +
 mmv1/products/alloydb/go_Backup.yaml           |  1 +
 .../products/apigee/go_EndpointAttachment.yaml |  3 +++
 mmv1/products/apigee/go_Envgroup.yaml          |  3 +++
 .../products/apigee/go_EnvgroupAttachment.yaml |  1 +
 mmv1/products/apigee/go_Environment.yaml       |  5 +++++
 mmv1/products/apigee/go_Instance.yaml          | 13 +++++++++++++
 .../products/apigee/go_InstanceAttachment.yaml |  3 +++
 mmv1/products/apigee/go_NatAddress.yaml        |  3 +++
 mmv1/products/apigee/go_Organization.yaml      | 18 ++++++++++++++++++
 .../appengine/go_FlexibleAppVersion.yaml       |  1 +
 .../artifactregistry/go_VPCSCConfig.yaml       |  1 +
 mmv1/products/bigquery/go_DatasetAccess.yaml   |  4 ++++
 mmv1/products/bigquery/go_Job.yaml             |  3 +++
 .../products/clouddomains/go_Registration.yaml | 11 +++++++++++
 mmv1/products/cloudfunctions2/go_Function.yaml |  2 ++
 mmv1/products/cloudidentity/go_Group.yaml      |  1 +
 .../cloudidentity/go_GroupMembership.yaml      |  2 ++
 mmv1/products/cloudids/go_Endpoint.yaml        |  1 +
 mmv1/products/compute/go_Address.yaml          |  2 ++
 mmv1/products/compute/go_ForwardingRule.yaml   |  1 +
 .../compute/go_GlobalForwardingRule.yaml       |  1 +
 .../compute/go_GlobalNetworkEndpoint.yaml      |  4 ++++
 mmv1/products/compute/go_HaVpnGateway.yaml     |  2 ++
 mmv1/products/compute/go_NetworkEndpoint.yaml  |  4 ++++
 mmv1/products/compute/go_NetworkEndpoints.yaml |  4 ++++
 .../products/compute/go_PerInstanceConfig.yaml |  4 ++++
 .../compute/go_PublicAdvertisedPrefix.yaml     |  2 ++
 .../compute/go_PublicDelegatedPrefix.yaml      |  2 ++
 mmv1/products/compute/go_RegionCommitment.yaml |  4 ++++
 .../compute/go_RegionNetworkEndpoint.yaml      |  4 ++++
 .../compute/go_RegionPerInstanceConfig.yaml    |  4 ++++
 .../compute/go_RegionSecurityPolicyRule.yaml   |  2 ++
 mmv1/products/compute/go_RegionUrlMap.yaml     |  1 +
 mmv1/products/compute/go_Reservation.yaml      |  1 +
 mmv1/products/compute/go_UrlMap.yaml           |  1 +
 .../containeranalysis/go_Occurrence.yaml       |  1 +
 mmv1/products/datacatalog/go_Tag.yaml          |  1 +
 mmv1/products/dataform/go_Repository.yaml      |  8 ++++++++
 mmv1/products/dataplex/go_Datascan.yaml        |  1 +
 mmv1/products/dataplex/go_Task.yaml            |  1 +
 mmv1/products/datastream/go_Stream.yaml        |  2 ++
 .../developerconnect/go_Connection.yaml        | 12 ------------
 .../documentaiwarehouse/go_DocumentSchema.yaml |  1 +
 .../documentaiwarehouse/go_Location.yaml       |  1 +
 mmv1/products/edgecontainer/go_NodePool.yaml   |  5 +++++
 mmv1/products/filestore/go_Instance.yaml       |  1 +
 mmv1/products/iap/go_AppEngineService.yaml     |  1 +
 .../go_DefaultSupportedIdpConfig.yaml          |  2 ++
 mmv1/products/integrations/go_AuthConfig.yaml  |  1 +
 mmv1/products/kms/go_KeyRing.yaml              |  6 ++++++
 .../logging/go_OrganizationSettings.yaml       |  1 +
 mmv1/products/monitoring/go_AlertPolicy.yaml   |  3 +++
 .../monitoring/go_NotificationChannel.yaml     |  1 +
 .../networksecurity/go_FirewallEndpoint.yaml   |  1 +
 .../go_FirewallEndpointAssociation.yaml        |  2 ++
 .../privateca/go_CertificateAuthority.yaml     |  3 +++
 .../go_RegionalSecret.yaml                     | 14 ++++++++++++++
 .../go_EventThreatDetectionCustomModule.yaml   |  1 +
 mmv1/products/securitycenter/go_Source.yaml    |  1 +
 ...zationEventThreatDetectionCustomModule.yaml |  1 +
 .../go_OrganizationSource.yaml                 |  1 +
 .../products/storagetransfer/go_AgentPool.yaml |  1 +
 mmv1/products/vertexai/go_Endpoint.yaml        |  1 +
 mmv1/products/vertexai/go_IndexEndpoint.yaml   |  1 +
 .../go_IndexEndpointDeployedIndex.yaml         |  7 ++++---
 mmv1/products/vmwareengine/go_Cluster.yaml     |  2 ++
 .../vmwareengine/go_ExternalAccessRule.yaml    |  2 ++
 .../vmwareengine/go_ExternalAddress.yaml       |  1 +
 mmv1/products/vmwareengine/go_Network.yaml     |  1 +
 .../products/vmwareengine/go_PrivateCloud.yaml |  2 ++
 mmv1/products/vmwareengine/go_Subnet.yaml      |  1 +
 .../go/secret_manager_regional_secret.tf.tmpl  |  1 +
 76 files changed, 203 insertions(+), 15 deletions(-)

diff --git a/mmv1/products/accesscontextmanager/go_GcpUserAccessBinding.yaml b/mmv1/products/accesscontextmanager/go_GcpUserAccessBinding.yaml
index 6ecbf3ca748a..7bf14c1faa7a 100644
--- a/mmv1/products/accesscontextmanager/go_GcpUserAccessBinding.yaml
+++ b/mmv1/products/accesscontextmanager/go_GcpUserAccessBinding.yaml
@@ -59,6 +59,7 @@ examples:
       org_id: 'ORG_ID'
       org_domain: 'ORG_DOMAIN'
       cust_id: 'CUST_ID'
+    # Has a handwritten test due to AccessPolicy-related tests needing to run synchronously
     exclude_test: true
 parameters:
   # Parent is a path parameter that _cannot_ be read or sent in the request at all.
diff --git a/mmv1/products/activedirectory/go_Domain.yaml b/mmv1/products/activedirectory/go_Domain.yaml
index 178f80abb609..c97c51bee848 100644
--- a/mmv1/products/activedirectory/go_Domain.yaml
+++ b/mmv1/products/activedirectory/go_Domain.yaml
@@ -71,6 +71,7 @@ examples:
       domain_name: 'tfgen'
     ignore_read_extra:
       - 'deletion_protection'
+    # skip the test until Active Directory setup issue got resolved
     exclude_test: true
 virtual_fields:
   - name: 'deletion_protection'
diff --git a/mmv1/products/activedirectory/go_DomainTrust.yaml b/mmv1/products/activedirectory/go_DomainTrust.yaml
index 60b0e94df18d..27a34ef49887 100644
--- a/mmv1/products/activedirectory/go_DomainTrust.yaml
+++ b/mmv1/products/activedirectory/go_DomainTrust.yaml
@@ -66,6 +66,9 @@ custom_code:
 examples:
   - name: 'active_directory_domain_trust_basic'
     primary_resource_id: 'ad-domain-trust'
+      # Fine-grained resource need different autogenerated tests, as
+      # we need to check destroy during a test step where the parent resource
+      # still exists and we need to validate that child resource has been deleted
     exclude_test: true
 parameters:
   - name: 'domain'
diff --git a/mmv1/products/activedirectory/go_Peering.yaml b/mmv1/products/activedirectory/go_Peering.yaml
index 425ab97ef999..c21f077f780c 100644
--- a/mmv1/products/activedirectory/go_Peering.yaml
+++ b/mmv1/products/activedirectory/go_Peering.yaml
@@ -58,6 +58,7 @@ examples:
     test_env_vars:
       org_id: 'ORG_ID'
       billing_account: 'BILLING_ACCT'
+      # skip the test until Active Directory setup issue got resolved
     exclude_test: true
     exclude_import_test: true
 parameters:
diff --git a/mmv1/products/alloydb/go_Backup.yaml b/mmv1/products/alloydb/go_Backup.yaml
index bcfa659e85aa..99f794982de4 100644
--- a/mmv1/products/alloydb/go_Backup.yaml
+++ b/mmv1/products/alloydb/go_Backup.yaml
@@ -90,6 +90,7 @@ examples:
       - 'reconciling'
       - 'update_time'
     exclude_docs: true
+    # https://github.com/hashicorp/terraform-provider-google/issues/16231
     skip_vcr: true
 parameters:
   - name: 'backupId'
diff --git a/mmv1/products/apigee/go_EndpointAttachment.yaml b/mmv1/products/apigee/go_EndpointAttachment.yaml
index 9bdde7c85e9a..63c0ef97d604 100644
--- a/mmv1/products/apigee/go_EndpointAttachment.yaml
+++ b/mmv1/products/apigee/go_EndpointAttachment.yaml
@@ -53,12 +53,15 @@ exclude_sweeper: true
 examples:
   - name: 'apigee_endpoint_attachment_basic'
     exclude_test: true
+      # This is a more verbose version of the above that creates all
+      # the resources needed for the acceptance test.
   - name: 'apigee_endpoint_attachment_basic_test'
     primary_resource_id: 'apigee_endpoint_attachment'
     test_env_vars:
       org_id: 'ORG_ID'
       billing_account: 'BILLING_ACCT'
     exclude_docs: true
+      # Resource creation race
     skip_vcr: true
 parameters:
   - name: 'orgId'
diff --git a/mmv1/products/apigee/go_Envgroup.yaml b/mmv1/products/apigee/go_Envgroup.yaml
index d62f040de901..0c5fdee4bf10 100644
--- a/mmv1/products/apigee/go_Envgroup.yaml
+++ b/mmv1/products/apigee/go_Envgroup.yaml
@@ -54,12 +54,15 @@ examples:
     vars:
       envgroup_name: 'my-envgroup'
     exclude_test: true
+      # This is a more verbose version of the above that creates all
+      # the resources needed for the acceptance test.
   - name: 'apigee_environment_group_basic_test'
     primary_resource_id: 'apigee_environment_group'
     test_env_vars:
       org_id: 'ORG_ID'
       billing_account: 'BILLING_ACCT'
     exclude_docs: true
+      # Resource creation race
     skip_vcr: true
 parameters:
   - name: 'orgId'
diff --git a/mmv1/products/apigee/go_EnvgroupAttachment.yaml b/mmv1/products/apigee/go_EnvgroupAttachment.yaml
index 092af54ff581..30aef3a00b65 100644
--- a/mmv1/products/apigee/go_EnvgroupAttachment.yaml
+++ b/mmv1/products/apigee/go_EnvgroupAttachment.yaml
@@ -65,6 +65,7 @@ examples:
       org_id: 'ORG_ID'
       billing_account: 'BILLING_ACCT'
     exclude_docs: true
+      # Resource creation race
     skip_vcr: true
 parameters:
   - name: 'envgroupId'
diff --git a/mmv1/products/apigee/go_Environment.yaml b/mmv1/products/apigee/go_Environment.yaml
index 35aa69656ba7..3b56c304e878 100644
--- a/mmv1/products/apigee/go_Environment.yaml
+++ b/mmv1/products/apigee/go_Environment.yaml
@@ -64,6 +64,8 @@ examples:
     vars:
       environment_name: 'my-environment'
     exclude_test: true
+      # This is a more verbose version of the above that creates all
+      # the resources needed for the acceptance test.
   - name: 'apigee_environment_basic_test'
     primary_resource_id: 'apigee_environment'
     primary_resource_name: 'fmt.Sprintf("organizations/tf-test%s", context["random_suffix"]), fmt.Sprintf("tf-test%s", context["random_suffix"])'
@@ -71,6 +73,7 @@ examples:
       org_id: 'ORG_ID'
       billing_account: 'BILLING_ACCT'
     exclude_docs: true
+      # Resource creation race
     skip_vcr: true
   - name: 'apigee_environment_basic_deployment_apiproxy_type_test'
     primary_resource_id: 'apigee_environment'
@@ -79,6 +82,7 @@ examples:
       org_id: 'ORG_ID'
       billing_account: 'BILLING_ACCT'
     exclude_docs: true
+      # Resource creation race
     skip_vcr: true
   - name: 'apigee_environment_patch_update_test'
     primary_resource_id: 'apigee_environment'
@@ -88,6 +92,7 @@ examples:
       org_id: 'ORG_ID'
       billing_account: 'BILLING_ACCT'
     exclude_docs: true
+      # Resource creation race
     skip_vcr: true
 parameters:
   - name: 'orgId'
diff --git a/mmv1/products/apigee/go_Instance.yaml b/mmv1/products/apigee/go_Instance.yaml
index 14fe68440663..77b1d9639f37 100644
--- a/mmv1/products/apigee/go_Instance.yaml
+++ b/mmv1/products/apigee/go_Instance.yaml
@@ -60,39 +60,50 @@ examples:
     vars:
       instance_name: 'my-instance-name'
     exclude_test: true
+      # This is a more verbose version of the above that creates all
+      # the resources needed for the acceptance test.
   - name: 'apigee_instance_basic_test'
     primary_resource_id: 'apigee_instance'
     test_env_vars:
       org_id: 'ORG_ID'
       billing_account: 'BILLING_ACCT'
     exclude_docs: true
+      # Resource creation race
     skip_vcr: true
   - name: 'apigee_instance_cidr_range'
     vars:
       instance_name: 'my-instance-name'
     exclude_test: true
+      # This is a more verbose version of the above that creates all
+      # the resources needed for the acceptance test.
   - name: 'apigee_instance_cidr_range_test'
     primary_resource_id: 'apigee_instance'
     test_env_vars:
       org_id: 'ORG_ID'
       billing_account: 'BILLING_ACCT'
     exclude_docs: true
+      # Resource creation race
     skip_vcr: true
   - name: 'apigee_instance_ip_range'
     vars:
       instance_name: 'my-instance-name'
     exclude_test: true
+      # This is a more verbose version of the above that creates all
+      # the resources needed for the acceptance test.
   - name: 'apigee_instance_ip_range_test'
     primary_resource_id: 'apigee_instance'
     test_env_vars:
       org_id: 'ORG_ID'
       billing_account: 'BILLING_ACCT'
     exclude_docs: true
+      # Resource creation race
     skip_vcr: true
   - name: 'apigee_instance_full'
     vars:
       instance_name: 'my-instance-name'
     exclude_test: true
+      # This is a more verbose version of the above that creates all
+      # the resources needed for the acceptance test.
   - name: 'apigee_instance_full_test'
     primary_resource_id: 'apigee_instance'
     min_version: 'beta'
@@ -100,6 +111,7 @@ examples:
       org_id: 'ORG_ID'
       billing_account: 'BILLING_ACCT'
     exclude_docs: true
+      # Resource creation race
     skip_vcr: true
   - name: 'apigee_instance_service_attachment_basic_test'
     primary_resource_id: 'apigee_instance'
@@ -107,6 +119,7 @@ examples:
       org_id: 'ORG_ID'
       billing_account: 'BILLING_ACCT'
     exclude_docs: true
+      # Resource creation race
     skip_vcr: true
 parameters:
   - name: 'orgId'
diff --git a/mmv1/products/apigee/go_InstanceAttachment.yaml b/mmv1/products/apigee/go_InstanceAttachment.yaml
index 0a1cef6c1414..ab24ecf367e9 100644
--- a/mmv1/products/apigee/go_InstanceAttachment.yaml
+++ b/mmv1/products/apigee/go_InstanceAttachment.yaml
@@ -59,12 +59,15 @@ examples:
       instance_name: 'my-instance-name'
       environment_name: 'my-environment-name'
     exclude_test: true
+      # This is a more verbose version of the above that creates all
+      # the resources needed for the acceptance test.
   - name: 'apigee_instance_attachment_basic_test'
     primary_resource_id: 'apigee_instance_attachment'
     test_env_vars:
       org_id: 'ORG_ID'
       billing_account: 'BILLING_ACCT'
     exclude_docs: true
+      # Resource creation race
     skip_vcr: true
 parameters:
   - name: 'instanceId'
diff --git a/mmv1/products/apigee/go_NatAddress.yaml b/mmv1/products/apigee/go_NatAddress.yaml
index 2dacf3a29d13..249ecf8296f1 100644
--- a/mmv1/products/apigee/go_NatAddress.yaml
+++ b/mmv1/products/apigee/go_NatAddress.yaml
@@ -56,12 +56,15 @@ examples:
     vars:
       nat_address_name: 'my-nat-address'
     exclude_test: true
+      # This is a more verbose version of the above that creates all
+      # the resources needed for the acceptance test.
   - name: 'apigee_nat_address_basic_test'
     primary_resource_id: 'apigee_nat_address'
     test_env_vars:
       org_id: 'ORG_ID'
       billing_account: 'BILLING_ACCT'
     exclude_docs: true
+      # Resource creation race
     skip_vcr: true
 parameters:
   - name: 'instanceId'
diff --git a/mmv1/products/apigee/go_Organization.yaml b/mmv1/products/apigee/go_Organization.yaml
index 6eafb9bd559e..2a4f8324aa12 100644
--- a/mmv1/products/apigee/go_Organization.yaml
+++ b/mmv1/products/apigee/go_Organization.yaml
@@ -53,6 +53,8 @@ custom_code:
 examples:
   - name: 'apigee_organization_cloud_basic'
     exclude_test: true
+  # This is a more verbose version of the above that creates all
+  # the resources needed for the acceptance test.
   - name: 'apigee_organization_cloud_basic_test'
     primary_resource_id: 'org'
     test_env_vars:
@@ -61,9 +63,12 @@ examples:
     ignore_read_extra:
       - 'properties'
     exclude_docs: true
+    # Resource creation race
     skip_vcr: true
   - name: 'apigee_organization_cloud_basic_disable_vpc_peering'
     exclude_test: true
+  # This is a more verbose version of the above that creates all
+  # the resources needed for the acceptance test.
   - name: 'apigee_organization_cloud_basic_disable_vpc_peering_test'
     primary_resource_id: 'org'
     test_env_vars:
@@ -72,9 +77,14 @@ examples:
     ignore_read_extra:
       - 'properties'
     exclude_docs: true
+    # Resource creation race
     skip_vcr: true
   - name: 'apigee_organization_cloud_full'
     exclude_test: true
+  # This is a more verbose version of the above that creates all
+  # the resources needed for the acceptance test. While all Apigee
+  # resources in this test are in the GA API, we depend on a service
+  # identity resource which is only available in the beta provider.
   - name: 'apigee_organization_cloud_full_test'
     primary_resource_id: 'org'
     min_version: 'beta'
@@ -84,9 +94,14 @@ examples:
     ignore_read_extra:
       - 'properties'
     exclude_docs: true
+    # Resource creation race
     skip_vcr: true
   - name: 'apigee_organization_cloud_full_disable_vpc_peering'
     exclude_test: true
+  # This is a more verbose version of the above that creates all
+  # the resources needed for the acceptance test. While all Apigee
+  # resources in this test are in the GA API, we depend on a service
+  # identity resource which is only available in the beta provider.
   - name: 'apigee_organization_cloud_full_disable_vpc_peering_test'
     primary_resource_id: 'org'
     min_version: 'beta'
@@ -96,6 +111,7 @@ examples:
     ignore_read_extra:
       - 'properties'
     exclude_docs: true
+    # Resource creation race
     skip_vcr: true
   - name: 'apigee_organization_retention_test'
     primary_resource_id: 'org'
@@ -104,6 +120,7 @@ examples:
       org_id: 'ORG_ID'
       billing_account: 'BILLING_ACCT'
     exclude_docs: true
+    # Resource creation race
     skip_vcr: true
   - name: 'apigee_organization_drz_test'
     primary_resource_id: 'org'
@@ -112,6 +129,7 @@ examples:
       org_id: 'ORG_ID'
       billing_account: 'BILLING_ACCT'
     exclude_docs: true
+      # Resource creation race
     skip_vcr: true
 parameters:
   - name: 'projectId'
diff --git a/mmv1/products/appengine/go_FlexibleAppVersion.yaml b/mmv1/products/appengine/go_FlexibleAppVersion.yaml
index 77bcc059c282..257f9a0c29da 100644
--- a/mmv1/products/appengine/go_FlexibleAppVersion.yaml
+++ b/mmv1/products/appengine/go_FlexibleAppVersion.yaml
@@ -76,6 +76,7 @@ examples:
     ignore_read_extra:
       - 'noop_on_destroy'
       - 'deployment.0.zip'
+    # https://github.com/hashicorp/terraform-provider-google/issues/19040
     exclude_test: true
 virtual_fields:
   - name: 'noop_on_destroy'
diff --git a/mmv1/products/artifactregistry/go_VPCSCConfig.yaml b/mmv1/products/artifactregistry/go_VPCSCConfig.yaml
index acee47dde771..a1582a58cc4b 100644
--- a/mmv1/products/artifactregistry/go_VPCSCConfig.yaml
+++ b/mmv1/products/artifactregistry/go_VPCSCConfig.yaml
@@ -49,6 +49,7 @@ custom_code:
 examples:
   - name: 'artifact_registry_vpcsc_config'
     primary_resource_id: 'my-config'
+    # Requires VPC SC Policy configured on organization
     exclude_test: true
 parameters:
   - name: 'location'
diff --git a/mmv1/products/bigquery/go_DatasetAccess.yaml b/mmv1/products/bigquery/go_DatasetAccess.yaml
index 48ce406b6019..ab766f7e9dd0 100644
--- a/mmv1/products/bigquery/go_DatasetAccess.yaml
+++ b/mmv1/products/bigquery/go_DatasetAccess.yaml
@@ -73,6 +73,7 @@ examples:
     vars:
       dataset_id: 'example_dataset'
       account_name: 'bqowner'
+ # not importable
     exclude_test: true
   - name: 'bigquery_dataset_access_view'
     primary_resource_id: 'access'
@@ -80,12 +81,14 @@ examples:
       dataset_id: 'example_dataset'
       dataset_id2: 'example_dataset2'
       table_id: 'example_table'
+ # not importable
     exclude_test: true
   - name: 'bigquery_dataset_access_authorized_dataset'
     primary_resource_id: 'access'
     vars:
       private: 'private'
       public: 'public'
+ # not importable
     exclude_test: true
   - name: 'bigquery_dataset_access_authorized_routine'
     primary_resource_id: 'authorized_routine'
@@ -93,6 +96,7 @@ examples:
       private_dataset: 'private_dataset'
       public_dataset: 'public_dataset'
       public_routine: 'public_routine'
+ # not importable
     exclude_test: true
 parameters:
 properties:
diff --git a/mmv1/products/bigquery/go_Job.yaml b/mmv1/products/bigquery/go_Job.yaml
index 206be442b5f9..b359f2d41742 100644
--- a/mmv1/products/bigquery/go_Job.yaml
+++ b/mmv1/products/bigquery/go_Job.yaml
@@ -101,6 +101,7 @@ examples:
       - 'etag'
       - 'load.0.destination_table.0.table_id'
       - 'status.0.state'
+ # there are a lot of examples for this resource, so omitting some that are similar to others
     exclude_docs: true
   - name: 'bigquery_job_copy'
     primary_resource_id: 'job'
@@ -129,6 +130,7 @@ examples:
       - 'copy.0.source_tables.0.table_id'
       - 'copy.0.source_tables.1.table_id'
       - 'status.0.state'
+ # there are a lot of examples for this resource, so omitting some that are similar to others
     exclude_docs: true
   - name: 'bigquery_job_extract'
     primary_resource_id: 'job'
@@ -147,6 +149,7 @@ examples:
       - 'etag'
       - 'extract.0.source_table.0.table_id'
       - 'status.0.state'
+ # there are a lot of examples for this resource, so omitting some that are similar to others
     exclude_docs: true
 parameters:
 properties:
diff --git a/mmv1/products/clouddomains/go_Registration.yaml b/mmv1/products/clouddomains/go_Registration.yaml
index bcd6e77d4527..23d41e383b91 100644
--- a/mmv1/products/clouddomains/go_Registration.yaml
+++ b/mmv1/products/clouddomains/go_Registration.yaml
@@ -59,7 +59,18 @@ custom_code:
 examples:
   - name: 'clouddomains_registration_full'
     primary_resource_id: 'my_registration'
+    # Must be tested in staging environment with all-time unique domains
     exclude_test: true
+    # ignore_read_extra:
+    #   - 'contact_settings.0.registrant_contact.0.phone_number'
+    #   - 'contact_settings.0.registrant_contact.0.fax_number'
+    #   - 'contact_settings.0.registrant_contact.0.postal_address'
+    #   - 'contact_settings.0.admin_contact.0.phone_number'
+    #   - 'contact_settings.0.admin_contact.0.fax_number'
+    #   - 'contact_settings.0.admin_contact.0.postal_address'
+    #   - 'contact_settings.0.technical_contact.0.phone_number'
+    #   - 'contact_settings.0.technical_contact.0.fax_number'
+    #   - 'contact_settings.0.technical_contact.0.postal_address'
 parameters:
   - name: 'location'
     type: String
diff --git a/mmv1/products/cloudfunctions2/go_Function.yaml b/mmv1/products/cloudfunctions2/go_Function.yaml
index 332e055661b1..6cdd462ac726 100644
--- a/mmv1/products/cloudfunctions2/go_Function.yaml
+++ b/mmv1/products/cloudfunctions2/go_Function.yaml
@@ -240,6 +240,7 @@ examples:
     ignore_read_extra:
       - 'build_config.0.source.0.storage_source.0.object'
       - 'build_config.0.source.0.storage_source.0.bucket'
+ # the example file is written in a repetitive way to help acc tests, so exclude
     exclude_docs: true
     skip_vcr: true
   - name: 'cloudfunctions2_cmek_docs'
@@ -254,6 +255,7 @@ examples:
       unencoded-ar-repo: 'ar-repo'
       kms_key_name: 'cmek-key'
       project: 'my-project-name'
+ # this example file will cause IAM conflicts between tests if used to make a test
     exclude_test: true
   - name: 'cloudfunctions2_abiu'
     primary_resource_id: 'function'
diff --git a/mmv1/products/cloudidentity/go_Group.yaml b/mmv1/products/cloudidentity/go_Group.yaml
index b05a814c452d..a70024d6d5bd 100644
--- a/mmv1/products/cloudidentity/go_Group.yaml
+++ b/mmv1/products/cloudidentity/go_Group.yaml
@@ -57,6 +57,7 @@ examples:
     test_env_vars:
       org_domain: 'ORG_DOMAIN'
       cust_id: 'CUST_ID'
+    # Has a handwritten test due to CloudIdentityGroup-related tests needing to run synchronously
     exclude_test: true
 parameters:
   - name: 'initialGroupConfig'
diff --git a/mmv1/products/cloudidentity/go_GroupMembership.yaml b/mmv1/products/cloudidentity/go_GroupMembership.yaml
index 85068efba3ab..32f83d3fa536 100644
--- a/mmv1/products/cloudidentity/go_GroupMembership.yaml
+++ b/mmv1/products/cloudidentity/go_GroupMembership.yaml
@@ -50,6 +50,7 @@ examples:
     test_env_vars:
       org_domain: 'ORG_DOMAIN'
       cust_id: 'CUST_ID'
+    # Has a handwritten test due to CloudIdentityGroup-related tests needing to run synchronously
     exclude_test: true
   - name: 'cloud_identity_group_membership_user'
     primary_resource_id: 'cloud_identity_group_membership_basic'
@@ -59,6 +60,7 @@ examples:
       org_domain: 'ORG_DOMAIN'
       cust_id: 'CUST_ID'
       identity_user: 'IDENTITY_USER'
+    # Has a handwritten test due to CloudIdentityGroup-related tests needing to run synchronously
     exclude_test: true
 parameters:
   - name: 'group'
diff --git a/mmv1/products/cloudids/go_Endpoint.yaml b/mmv1/products/cloudids/go_Endpoint.yaml
index b70ea42afe03..bf82294490fb 100644
--- a/mmv1/products/cloudids/go_Endpoint.yaml
+++ b/mmv1/products/cloudids/go_Endpoint.yaml
@@ -51,6 +51,7 @@ exclude_sweeper: true
 examples:
   - name: 'cloudids_endpoint'
     primary_resource_id: 'example-endpoint'
+    # skip_test set to true since the example is identical to what's in the _test.go file.
     exclude_test: true
 parameters:
   - name: 'location'
diff --git a/mmv1/products/compute/go_Address.yaml b/mmv1/products/compute/go_Address.yaml
index b6fffa672af5..76623c07133a 100644
--- a/mmv1/products/compute/go_Address.yaml
+++ b/mmv1/products/compute/go_Address.yaml
@@ -78,7 +78,9 @@ examples:
     primary_resource_id: 'internal_with_shared_loadbalancer_vip'
     vars:
       address_name: 'my-internal-address'
+ # It is almost identical to internal_with_gce_endpoint
     exclude_docs: true
+  # TODO(rileykarson): Remove this example when instance is supported
   - name: 'instance_with_ip'
     primary_resource_id: 'static'
     vars:
diff --git a/mmv1/products/compute/go_ForwardingRule.yaml b/mmv1/products/compute/go_ForwardingRule.yaml
index 884ed769c166..204b6303b8e9 100644
--- a/mmv1/products/compute/go_ForwardingRule.yaml
+++ b/mmv1/products/compute/go_ForwardingRule.yaml
@@ -19,6 +19,7 @@ description: |
   A ForwardingRule resource. A ForwardingRule resource specifies which pool
   of target virtual machines to forward a packet to if it matches the given
   [IPAddress, IPProtocol, portRange] tuple.
+# Has a separate endpoint for labels
 exclude_attribution_label: true
 references:
   guides:
diff --git a/mmv1/products/compute/go_GlobalForwardingRule.yaml b/mmv1/products/compute/go_GlobalForwardingRule.yaml
index 73e58307c9ae..9bdd5c337254 100644
--- a/mmv1/products/compute/go_GlobalForwardingRule.yaml
+++ b/mmv1/products/compute/go_GlobalForwardingRule.yaml
@@ -22,6 +22,7 @@ description: |
   balancing.
 
   For more information, see https://cloud.google.com/compute/docs/load-balancing/http/
+# Has a separate endpoint for labels
 exclude_attribution_label: true
 docs:
 base_url: 'projects/{{project}}/global/forwardingRules'
diff --git a/mmv1/products/compute/go_GlobalNetworkEndpoint.yaml b/mmv1/products/compute/go_GlobalNetworkEndpoint.yaml
index d35d3606ffa1..e16ff73fe52d 100644
--- a/mmv1/products/compute/go_GlobalNetworkEndpoint.yaml
+++ b/mmv1/products/compute/go_GlobalNetworkEndpoint.yaml
@@ -71,6 +71,10 @@ examples:
     primary_resource_id: 'default-endpoint'
     vars:
       neg_name: 'my-lb-neg'
+      # Fine-grained resource need different autogenerated tests, as
+      # we need to check destroy during a test step where the parent resource
+      # still exists, rather than during CheckDestroy (when read returns
+      # nothing because the parent resource has then also been destroyed)
     exclude_test: true
 parameters:
   - name: 'globalNetworkEndpointGroup'
diff --git a/mmv1/products/compute/go_HaVpnGateway.yaml b/mmv1/products/compute/go_HaVpnGateway.yaml
index c8992c4f6b9c..fa5373c7ad37 100644
--- a/mmv1/products/compute/go_HaVpnGateway.yaml
+++ b/mmv1/products/compute/go_HaVpnGateway.yaml
@@ -70,6 +70,7 @@ examples:
       router2_name: 'ha-vpn-router2'
     exclude_test: true
     exclude_docs: true
+      # Multiple fine-grained resources
     skip_vcr: true
   - name: 'compute_ha_vpn_gateway_encrypted_interconnect'
     primary_resource_id: 'vpn-gateway'
@@ -81,6 +82,7 @@ examples:
       address2_name: 'test-address2'
       router_name: 'test-router'
       network_name: 'test-network'
+      # TODO: https://github.com/hashicorp/terraform-provider-google/issues/11504
     exclude_test: true
 parameters:
   - name: 'region'
diff --git a/mmv1/products/compute/go_NetworkEndpoint.yaml b/mmv1/products/compute/go_NetworkEndpoint.yaml
index 2ef73b81a452..e83b373ed865 100644
--- a/mmv1/products/compute/go_NetworkEndpoint.yaml
+++ b/mmv1/products/compute/go_NetworkEndpoint.yaml
@@ -80,6 +80,10 @@ examples:
       instance_name: 'endpoint-instance'
       network_name: 'neg-network'
       subnetwork_name: 'neg-subnetwork'
+      # Fine-grained resource need different autogenerated tests, as
+      # we need to check destroy during a test step where the parent resource
+      # still exists, rather than during CheckDestroy (when read returns
+      # nothing because the parent resource has then also been destroyed)
     exclude_test: true
 parameters:
   - name: 'zone'
diff --git a/mmv1/products/compute/go_NetworkEndpoints.yaml b/mmv1/products/compute/go_NetworkEndpoints.yaml
index 73fa84c6dfe7..7fadfe885b54 100644
--- a/mmv1/products/compute/go_NetworkEndpoints.yaml
+++ b/mmv1/products/compute/go_NetworkEndpoints.yaml
@@ -81,6 +81,10 @@ examples:
       instance_name: 'endpoint-instance'
       network_name: 'neg-network'
       subnetwork_name: 'neg-subnetwork'
+      # Fine-grained resource need different autogenerated tests, as
+      # we need to check destroy during a test step where the parent resource
+      # still exists, rather than during CheckDestroy (when read returns
+      # nothing because the parent resource has then also been destroyed)
     exclude_test: true
 parameters:
   - name: 'zone'
diff --git a/mmv1/products/compute/go_PerInstanceConfig.yaml b/mmv1/products/compute/go_PerInstanceConfig.yaml
index 6a7dc1b33a8a..a0e782eb0a23 100644
--- a/mmv1/products/compute/go_PerInstanceConfig.yaml
+++ b/mmv1/products/compute/go_PerInstanceConfig.yaml
@@ -70,6 +70,10 @@ examples:
       template_name: 'my-template'
       igm_name: 'my-igm'
       disk_name: 'my-disk-name'
+      # Fine-grained resource need different autogenerated tests, as
+      # we need to check destroy during a test step where the parent resource
+      # still exists, rather than during CheckDestroy (when read returns
+      # nothing because the parent resource has then also been destroyed)
     exclude_test: true
 virtual_fields:
   - name: 'minimal_action'
diff --git a/mmv1/products/compute/go_PublicAdvertisedPrefix.yaml b/mmv1/products/compute/go_PublicAdvertisedPrefix.yaml
index 23c999455fe1..22b3103e3bab 100644
--- a/mmv1/products/compute/go_PublicAdvertisedPrefix.yaml
+++ b/mmv1/products/compute/go_PublicAdvertisedPrefix.yaml
@@ -50,6 +50,8 @@ examples:
       prefixes_name: 'my-prefix'
     test_env_vars:
       desc: 'PAP_DESCRIPTION'
+    # PAPs have very low quota limits and a shared testing range so serialized tests exist in:
+    # resource_compute_public_advertised_prefix_test.go
     exclude_test: true
 parameters:
 properties:
diff --git a/mmv1/products/compute/go_PublicDelegatedPrefix.yaml b/mmv1/products/compute/go_PublicDelegatedPrefix.yaml
index 172db2f9d343..2f18589dd719 100644
--- a/mmv1/products/compute/go_PublicDelegatedPrefix.yaml
+++ b/mmv1/products/compute/go_PublicDelegatedPrefix.yaml
@@ -50,6 +50,8 @@ examples:
       prefixes_name: 'my-prefix'
     test_env_vars:
       desc: 'PAP_DESCRIPTION'
+    # PAPs have very low quota limits and a shared testing range so serialized tests exist in:
+    # resource_compute_public_advertised_prefix_test.go
     exclude_test: true
 parameters:
 properties:
diff --git a/mmv1/products/compute/go_RegionCommitment.yaml b/mmv1/products/compute/go_RegionCommitment.yaml
index b1f9cc354b8a..b287a1369e9d 100644
--- a/mmv1/products/compute/go_RegionCommitment.yaml
+++ b/mmv1/products/compute/go_RegionCommitment.yaml
@@ -57,11 +57,15 @@ examples:
     primary_resource_id: 'foobar'
     vars:
       region_commitment_name: 'my-region-commitment'
+    # Creating a resource means signing a contract
+    # Spanning years that cannot be deleted
     exclude_test: true
   - name: 'compute_region_commitment_full'
     primary_resource_id: 'foobar'
     vars:
       region_commitment_name: 'my-full-commitment'
+    # Creating a resource means signing a contract
+    # Spanning years that cannot be deleted
     exclude_test: true
 parameters:
   - name: 'region'
diff --git a/mmv1/products/compute/go_RegionNetworkEndpoint.yaml b/mmv1/products/compute/go_RegionNetworkEndpoint.yaml
index 8f444da0bf00..7db438a8f1f7 100644
--- a/mmv1/products/compute/go_RegionNetworkEndpoint.yaml
+++ b/mmv1/products/compute/go_RegionNetworkEndpoint.yaml
@@ -87,6 +87,10 @@ examples:
       subnetwork_name: 'subnetwork'
       instance_name: 'instance'
       neg_name: 'portmap-neg'
+      # Fine-grained resource need different autogenerated tests, as
+      # we need to check destroy during a test step where the parent resource
+      # still exists, rather than during CheckDestroy (when read returns
+      # nothing because the parent resource has then also been destroyed)
     exclude_test: true
 parameters:
   - name: 'region'
diff --git a/mmv1/products/compute/go_RegionPerInstanceConfig.yaml b/mmv1/products/compute/go_RegionPerInstanceConfig.yaml
index 1e112cad808c..57b7f9a6bbaf 100644
--- a/mmv1/products/compute/go_RegionPerInstanceConfig.yaml
+++ b/mmv1/products/compute/go_RegionPerInstanceConfig.yaml
@@ -71,6 +71,10 @@ examples:
       template_name: 'my-template'
       igm_name: 'my-rigm'
       disk_name: 'my-disk-name'
+      # Fine-grained resource need different autogenerated tests, as
+      # we need to check destroy during a test step where the parent resource
+      # still exists, rather than during CheckDestroy (when read returns
+      # nothing because the parent resource has then also been destroyed)
     exclude_test: true
 virtual_fields:
   - name: 'minimal_action'
diff --git a/mmv1/products/compute/go_RegionSecurityPolicyRule.yaml b/mmv1/products/compute/go_RegionSecurityPolicyRule.yaml
index 6f4d49dfe609..07804a0621ab 100644
--- a/mmv1/products/compute/go_RegionSecurityPolicyRule.yaml
+++ b/mmv1/products/compute/go_RegionSecurityPolicyRule.yaml
@@ -73,6 +73,8 @@ examples:
     min_version: 'beta'
     vars:
       sec_policy_name: 'policyfornetworkmatch'
+    # it needs to run synchronously because a region can have only one google_compute_network_edge_security_service.
+    # there is a robust handwritten test which covers this scenario.
     exclude_test: true
 parameters:
   - name: 'region'
diff --git a/mmv1/products/compute/go_RegionUrlMap.yaml b/mmv1/products/compute/go_RegionUrlMap.yaml
index c5721e56a3b4..401067154ee8 100644
--- a/mmv1/products/compute/go_RegionUrlMap.yaml
+++ b/mmv1/products/compute/go_RegionUrlMap.yaml
@@ -122,6 +122,7 @@ examples:
       regional_l7_xlb_map: 'regional-l7-xlb-map'
       l7_xlb_proxy: 'l7-xlb-proxy'
       l7_xlb_forwarding_rule: 'l7-xlb-forwarding-rule'
+ # Similar to other samples
     exclude_test: true
     exclude_docs: true
   - name: 'region_url_map_path_template_match'
diff --git a/mmv1/products/compute/go_Reservation.yaml b/mmv1/products/compute/go_Reservation.yaml
index 0dd439601ba7..987061daeb2a 100644
--- a/mmv1/products/compute/go_Reservation.yaml
+++ b/mmv1/products/compute/go_Reservation.yaml
@@ -69,6 +69,7 @@ examples:
       org_id: 'ORG_ID'
       billing_account: 'BILLING_ACCT'
     exclude_docs: true
+      # Resource creation race
     skip_vcr: true
 parameters:
   - name: 'zone'
diff --git a/mmv1/products/compute/go_UrlMap.yaml b/mmv1/products/compute/go_UrlMap.yaml
index 3f6e53e127b2..8a7fb48c2929 100644
--- a/mmv1/products/compute/go_UrlMap.yaml
+++ b/mmv1/products/compute/go_UrlMap.yaml
@@ -108,6 +108,7 @@ examples:
     ignore_read_extra:
       - 'metadata'
       - 'metadata_startup_script'
+ # Very similar to external_http_lb_mig_backend_custom_header
     exclude_test: true
     exclude_docs: true
   - name: 'url_map_path_template_match'
diff --git a/mmv1/products/containeranalysis/go_Occurrence.yaml b/mmv1/products/containeranalysis/go_Occurrence.yaml
index 0c45a07cdf86..8f4a3a1a341f 100644
--- a/mmv1/products/containeranalysis/go_Occurrence.yaml
+++ b/mmv1/products/containeranalysis/go_Occurrence.yaml
@@ -44,6 +44,7 @@ examples:
     vars:
       note_name: 'attestation-note'
       attestor: 'attestor'
+    # Occurrence requires custom logic for signing payloads.
     exclude_test: true
 parameters:
 properties:
diff --git a/mmv1/products/datacatalog/go_Tag.yaml b/mmv1/products/datacatalog/go_Tag.yaml
index f0adc93dd1a7..a63bafbebfed 100644
--- a/mmv1/products/datacatalog/go_Tag.yaml
+++ b/mmv1/products/datacatalog/go_Tag.yaml
@@ -86,6 +86,7 @@ examples:
       force_delete: 'false'
     test_vars_overrides:
       'force_delete': 'true'
+ # omitting doc as it is almost identical to the case of data_catalog_entry_tag_basic
     exclude_docs: true
 parameters:
   - name: 'parent'
diff --git a/mmv1/products/dataform/go_Repository.yaml b/mmv1/products/dataform/go_Repository.yaml
index 25eccff3b275..e2d02c9c7163 100644
--- a/mmv1/products/dataform/go_Repository.yaml
+++ b/mmv1/products/dataform/go_Repository.yaml
@@ -49,6 +49,8 @@ examples:
       secret_name: 'my-secret'
       key_ring_name: 'example-key-ring'
       crypto_key_name: 'example-crypto-key-name'
+    # This example is used in the docs to address this issue
+    # See : https://github.com/hashicorp/terraform-provider-google/issues/17335
     exclude_test: true
   - name: 'dataform_repository_with_cloudsource_repo'
     primary_resource_id: 'dataform_repository'
@@ -61,6 +63,9 @@ examples:
       secret_name: 'my-secret'
       key_ring_name: 'example-key-ring'
       crypto_key_name: 'example-crypto-key-name'
+    # Although the Terraform config can be applied without error, the connection between Dataform and the SourceRepo aren't yet functional
+    # See : https://github.com/hashicorp/terraform-provider-google/issues/17335
+    # See : https://issuetracker.google.com/issues/287850319
     exclude_docs: true
   - name: 'dataform_repository_with_cloudsource_repo_and_ssh'
     primary_resource_id: 'dataform_repository'
@@ -70,6 +75,9 @@ examples:
       dataform_repository_name: 'dataform_repository'
       data: 'secret-data'
       secret_name: 'my-secret'
+    # Although the Terraform config can be applied without error, the connection between Dataform and the SourceRepo aren't yet functional
+    # See : https://github.com/hashicorp/terraform-provider-google/issues/17335
+    # See : https://issuetracker.google.com/issues/287850319
     exclude_docs: true
 parameters:
   - name: 'region'
diff --git a/mmv1/products/dataplex/go_Datascan.yaml b/mmv1/products/dataplex/go_Datascan.yaml
index 668d5fca0e40..8bb9d8f79fff 100644
--- a/mmv1/products/dataplex/go_Datascan.yaml
+++ b/mmv1/products/dataplex/go_Datascan.yaml
@@ -16,6 +16,7 @@
 name: 'Datascan'
 description: |
   Represents a user-visible job which provides the insights for the related data source.
+# User-provided label cannot start with goog-
 exclude_attribution_label: true
 references:
   guides:
diff --git a/mmv1/products/dataplex/go_Task.yaml b/mmv1/products/dataplex/go_Task.yaml
index 592e88ead4aa..c603754d6167 100644
--- a/mmv1/products/dataplex/go_Task.yaml
+++ b/mmv1/products/dataplex/go_Task.yaml
@@ -16,6 +16,7 @@
 name: 'Task'
 description: |
   A Dataplex task represents the work that you want Dataplex to do on a schedule. It encapsulates code, parameters, and the schedule.
+# User-provided label cannot start with goog-
 exclude_attribution_label: true
 references:
   guides:
diff --git a/mmv1/products/datastream/go_Stream.yaml b/mmv1/products/datastream/go_Stream.yaml
index c7dde97bda0e..f005f4347e8c 100644
--- a/mmv1/products/datastream/go_Stream.yaml
+++ b/mmv1/products/datastream/go_Stream.yaml
@@ -71,6 +71,7 @@ examples:
       'deletion_protection': 'false'
     external_providers: ["random", "time"]
     exclude_docs: true
+      # Random provider
     skip_vcr: true
   - name: 'datastream_stream_full'
     primary_resource_id: 'default'
@@ -133,6 +134,7 @@ examples:
       stream_id: 'stream'
     test_vars_overrides:
       'deletion_protection': 'false'
+    # Requires SQLServer Configuration
     exclude_test: true
   - name: 'datastream_stream_postgresql_bigquery_dataset_id'
     primary_resource_id: 'default'
diff --git a/mmv1/products/developerconnect/go_Connection.yaml b/mmv1/products/developerconnect/go_Connection.yaml
index f4b5a94856d1..f60cd4718e51 100644
--- a/mmv1/products/developerconnect/go_Connection.yaml
+++ b/mmv1/products/developerconnect/go_Connection.yaml
@@ -19,18 +19,6 @@ description: |
 min_version: 'beta'
 docs:
 id_format: 'projects/{{project}}/locations/{{location}}/connections/{{connection_id}}'
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
 base_url: 'projects/{{project}}/locations/{{location}}/connections'
 self_link: 'projects/{{project}}/locations/{{location}}/connections/{{connection_id}}'
 create_url: 'projects/{{project}}/locations/{{location}}/connections?connectionId={{connection_id}}'
diff --git a/mmv1/products/documentaiwarehouse/go_DocumentSchema.yaml b/mmv1/products/documentaiwarehouse/go_DocumentSchema.yaml
index 3f771b1e5cfc..fcfec08836ac 100644
--- a/mmv1/products/documentaiwarehouse/go_DocumentSchema.yaml
+++ b/mmv1/products/documentaiwarehouse/go_DocumentSchema.yaml
@@ -34,6 +34,7 @@ custom_code:
 examples:
   - name: 'document_ai_warehouse_document_schema_text'
     primary_resource_id: 'example_text'
+    # docs only, testing is done in an update test
     exclude_test: true
 parameters:
   - name: 'project_number'
diff --git a/mmv1/products/documentaiwarehouse/go_Location.yaml b/mmv1/products/documentaiwarehouse/go_Location.yaml
index b66a069a7776..3ad3efc311d2 100644
--- a/mmv1/products/documentaiwarehouse/go_Location.yaml
+++ b/mmv1/products/documentaiwarehouse/go_Location.yaml
@@ -50,6 +50,7 @@ exclude_sweeper: true
 examples:
   - name: 'document_ai_warehouse_location'
     primary_resource_id: 'example'
+    # docs only, testing is done in a DocumentSchema update test
     exclude_test: true
 parameters:
   - name: 'project_number'
diff --git a/mmv1/products/edgecontainer/go_NodePool.yaml b/mmv1/products/edgecontainer/go_NodePool.yaml
index 22eb633d1b4e..fb08b346f254 100644
--- a/mmv1/products/edgecontainer/go_NodePool.yaml
+++ b/mmv1/products/edgecontainer/go_NodePool.yaml
@@ -65,6 +65,11 @@ examples:
   - name: 'edgecontainer_local_control_plane_node_pool'
     primary_resource_id: 'default'
     exclude_test: true
+  # Skip the docs generation for the edgecontainer_local_control_plane_node_pool_internal test
+  # to avoid leaking the machine name, and node location to public.
+  # Skip the vcr test because as we only have limited machine resources and we don't want it run
+  # in github presubmit test.
+  # TODO: enable the test when GDCE have extra prod rack for TF e2e testing.
   - name: 'edgecontainer_local_control_plane_node_pool_internal'
     primary_resource_id: 'default'
     exclude_test: true
diff --git a/mmv1/products/filestore/go_Instance.yaml b/mmv1/products/filestore/go_Instance.yaml
index 9ea726e4f017..c1e5a186b977 100644
--- a/mmv1/products/filestore/go_Instance.yaml
+++ b/mmv1/products/filestore/go_Instance.yaml
@@ -71,6 +71,7 @@ examples:
     primary_resource_id: 'instance'
     vars:
       instance_name: 'test-instance'
+    # https://github.com/GoogleCloudPlatform/magic-modules/pull/5875#discussion_r844285335
     exclude_test: true
 parameters:
   - name: 'zone'
diff --git a/mmv1/products/iap/go_AppEngineService.yaml b/mmv1/products/iap/go_AppEngineService.yaml
index d8c92a199810..e4275b2928b1 100644
--- a/mmv1/products/iap/go_AppEngineService.yaml
+++ b/mmv1/products/iap/go_AppEngineService.yaml
@@ -48,6 +48,7 @@ examples:
     test_env_vars:
       org_id: 'ORG_ID'
       billing_account: 'BILLING_ACCT'
+    # https://github.com/hashicorp/terraform-provider-google/issues/18936
     exclude_test: true
 parameters:
 properties:
diff --git a/mmv1/products/identityplatform/go_DefaultSupportedIdpConfig.yaml b/mmv1/products/identityplatform/go_DefaultSupportedIdpConfig.yaml
index ed143e76a777..76039d73dcb5 100644
--- a/mmv1/products/identityplatform/go_DefaultSupportedIdpConfig.yaml
+++ b/mmv1/products/identityplatform/go_DefaultSupportedIdpConfig.yaml
@@ -36,6 +36,8 @@ custom_code:
 examples:
   - name: 'identity_platform_default_supported_idp_config_basic'
     primary_resource_id: 'idp_config'
+      # Skip test due to operating on singleton and the handwritten update test handles this
+      # If we could spin up a project and enable identity platform we could test this separately
     exclude_test: true
 parameters:
 properties:
diff --git a/mmv1/products/integrations/go_AuthConfig.yaml b/mmv1/products/integrations/go_AuthConfig.yaml
index 13ad0d13eee9..f2680bdc0eb3 100644
--- a/mmv1/products/integrations/go_AuthConfig.yaml
+++ b/mmv1/products/integrations/go_AuthConfig.yaml
@@ -43,6 +43,7 @@ examples:
     primary_resource_id: 'basic_example'
     vars:
       auth_config_name: 'test-authconfig'
+ # This is already part of other examples.
     exclude_test: true
   - name: 'integrations_auth_config_advance'
     primary_resource_id: 'advance_example'
diff --git a/mmv1/products/kms/go_KeyRing.yaml b/mmv1/products/kms/go_KeyRing.yaml
index 18c8548d75eb..ccf0c59190e6 100644
--- a/mmv1/products/kms/go_KeyRing.yaml
+++ b/mmv1/products/kms/go_KeyRing.yaml
@@ -44,6 +44,12 @@ custom_code:
 examples:
   - name: 'kms_key_ring_basic'
     primary_resource_id: 'example-keyring'
+      # Because we can't really delete the resource, we get an error of
+      # dangling resources with the auto generated tests. The hand-written
+      # tests do a better job at testing that the key was removed from state
+      # and that no keyrings are left behind since they create (and destroy)
+      # a project just for this test, but they require org level IAM roles
+      # for the test service account.
     exclude_test: true
 parameters:
   - name: 'location'
diff --git a/mmv1/products/logging/go_OrganizationSettings.yaml b/mmv1/products/logging/go_OrganizationSettings.yaml
index 132304056fd8..ab0840edbbe7 100644
--- a/mmv1/products/logging/go_OrganizationSettings.yaml
+++ b/mmv1/products/logging/go_OrganizationSettings.yaml
@@ -46,6 +46,7 @@ examples:
       key_name: 'kms-key'
     test_env_vars:
       org_id: 'ORG_TARGET'
+    # Covered by update test.
     exclude_test: true
 parameters:
   - name: 'organization'
diff --git a/mmv1/products/monitoring/go_AlertPolicy.yaml b/mmv1/products/monitoring/go_AlertPolicy.yaml
index 682c6abaaf35..a490d99c0fe9 100644
--- a/mmv1/products/monitoring/go_AlertPolicy.yaml
+++ b/mmv1/products/monitoring/go_AlertPolicy.yaml
@@ -52,16 +52,19 @@ examples:
     vars:
       alert_policy_display_name: 'My Alert Policy'
     exclude_test: true
+  # skipping tests because the API is full of race conditions
   - name: 'monitoring_alert_policy_evaluation_missing_data'
     primary_resource_id: 'alert_policy'
     vars:
       alert_policy_display_name: 'My Alert Policy'
     exclude_test: true
+  # skipping tests because the API is full of race conditions
   - name: 'monitoring_alert_policy_forecast_options'
     primary_resource_id: 'alert_policy'
     vars:
       alert_policy_display_name: 'My Alert Policy'
     exclude_test: true
+  # skipping tests because the API is full of race conditions
   - name: 'monitoring_alert_policy_promql_condition'
     primary_resource_id: 'alert_policy'
     vars:
diff --git a/mmv1/products/monitoring/go_NotificationChannel.yaml b/mmv1/products/monitoring/go_NotificationChannel.yaml
index f29abeaee44d..9f6ed58de6bb 100644
--- a/mmv1/products/monitoring/go_NotificationChannel.yaml
+++ b/mmv1/products/monitoring/go_NotificationChannel.yaml
@@ -69,6 +69,7 @@ examples:
     primary_resource_id: 'default'
     vars:
       display_name: 'Sensitive Notification Channel test'
+      # sensitive labels will fail the import verification step.
     exclude_test: true
 virtual_fields:
   - name: 'force_delete'
diff --git a/mmv1/products/networksecurity/go_FirewallEndpoint.yaml b/mmv1/products/networksecurity/go_FirewallEndpoint.yaml
index ce8e36bd2a74..e0e37fb5205c 100644
--- a/mmv1/products/networksecurity/go_FirewallEndpoint.yaml
+++ b/mmv1/products/networksecurity/go_FirewallEndpoint.yaml
@@ -59,6 +59,7 @@ examples:
     test_env_vars:
       org_id: 'ORG_ID'
       project: 'PROJECT_NAME'
+ # update tests will take care of create and update. Firewall endpoint creation is too long.
     exclude_test: true
 parameters:
   - name: 'name'
diff --git a/mmv1/products/networksecurity/go_FirewallEndpointAssociation.yaml b/mmv1/products/networksecurity/go_FirewallEndpointAssociation.yaml
index a7a1923fb1bf..7d3b06033a7a 100644
--- a/mmv1/products/networksecurity/go_FirewallEndpointAssociation.yaml
+++ b/mmv1/products/networksecurity/go_FirewallEndpointAssociation.yaml
@@ -59,6 +59,8 @@ examples:
     test_env_vars:
       org_id: 'ORG_ID'
       project: 'PROJECT_NAME'
+    # Handwritten test will take care of creates and updates.
+    # Firewall endpoint association creation is subjet to firewall endpoint creation which is long and expensive.
     exclude_test: true
 parameters:
   - name: 'name'
diff --git a/mmv1/products/privateca/go_CertificateAuthority.yaml b/mmv1/products/privateca/go_CertificateAuthority.yaml
index aadd01d638bd..7d29bbd2b36b 100644
--- a/mmv1/products/privateca/go_CertificateAuthority.yaml
+++ b/mmv1/products/privateca/go_CertificateAuthority.yaml
@@ -109,7 +109,10 @@ examples:
       'deletion_protection': 'false'
     ignore_read_extra:
       - 'deletion_protection'
+    # Skip test because it depends on a beta resource, but PrivateCA does
+    # not have a beta endpoint
     exclude_test: true
+      # Multiple IAM bindings on the same key cause non-determinism
     skip_vcr: true
   - name: 'privateca_certificate_authority_custom_ski'
     primary_resource_id: 'default'
diff --git a/mmv1/products/secretmanagerregional/go_RegionalSecret.yaml b/mmv1/products/secretmanagerregional/go_RegionalSecret.yaml
index 86495df18f5e..5668c9249878 100644
--- a/mmv1/products/secretmanagerregional/go_RegionalSecret.yaml
+++ b/mmv1/products/secretmanagerregional/go_RegionalSecret.yaml
@@ -18,6 +18,7 @@ description: |
   A Regional Secret is a logical secret whose value and versions can be created and accessed within a region only.
 references:
   guides:
+  # TODO : Update the below api reference link
   api: 'https://cloud.google.com/secret-manager/docs/reference/rest/v1/projects.secrets'
 docs:
 base_url: 'projects/{{project}}/locations/{{location}}/secrets'
@@ -137,6 +138,19 @@ properties:
 
       An object containing a list of "key": value pairs. Example:
       { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+  # TODO : Add versionAliases field support once google_secret_manager_regional_secret_version is added
+  # - !ruby/object:Api::Type::KeyValuePairs
+  #   name: versionAliases
+  #   description: |
+  #     Mapping from version alias to version name.
+
+  #     A version alias is a string with a maximum length of 63 characters and can contain
+  #     uppercase and lowercase letters, numerals, and the hyphen (-) and underscore ('_')
+  #     characters. An alias string must start with a letter and cannot be the string
+  #     'latest' or 'NEW'. No more than 50 aliases can be assigned to a given secret.
+
+  #     An object containing a list of "key": value pairs. Example:
+  #     { "name": "wrench", "mass": "1.3kg", "count": "3" }.
   - name: 'customerManagedEncryption'
     type: NestedObject
     description: |
diff --git a/mmv1/products/securitycenter/go_EventThreatDetectionCustomModule.yaml b/mmv1/products/securitycenter/go_EventThreatDetectionCustomModule.yaml
index 7ab70852ea37..b5307ad37468 100644
--- a/mmv1/products/securitycenter/go_EventThreatDetectionCustomModule.yaml
+++ b/mmv1/products/securitycenter/go_EventThreatDetectionCustomModule.yaml
@@ -41,6 +41,7 @@ examples:
       type: 'CONFIGURABLE_BAD_IP'
     test_env_vars:
       org_id: 'ORG_ID'
+    # Has a handwritten update test
     exclude_test: true
 parameters:
   - name: 'organization'
diff --git a/mmv1/products/securitycenter/go_Source.yaml b/mmv1/products/securitycenter/go_Source.yaml
index 25fd3b50afab..c5d2bcdb0c99 100644
--- a/mmv1/products/securitycenter/go_Source.yaml
+++ b/mmv1/products/securitycenter/go_Source.yaml
@@ -52,6 +52,7 @@ examples:
       source_display_name: 'My Source'
     test_env_vars:
       org_id: 'ORG_ID'
+      # resource can't be destroyed, so checkdestroy fails unnecessarily
     exclude_test: true
 parameters:
   - name: 'organization'
diff --git a/mmv1/products/securitycentermanagement/go_OrganizationEventThreatDetectionCustomModule.yaml b/mmv1/products/securitycentermanagement/go_OrganizationEventThreatDetectionCustomModule.yaml
index f21d6f897f36..2fb789923add 100644
--- a/mmv1/products/securitycentermanagement/go_OrganizationEventThreatDetectionCustomModule.yaml
+++ b/mmv1/products/securitycentermanagement/go_OrganizationEventThreatDetectionCustomModule.yaml
@@ -41,6 +41,7 @@ examples:
       type: 'CONFIGURABLE_BAD_IP'
     test_env_vars:
       org_id: 'ORG_ID'
+    # Has a handwritten update test
     exclude_test: true
 parameters:
   - name: 'organization'
diff --git a/mmv1/products/securitycenterv2/go_OrganizationSource.yaml b/mmv1/products/securitycenterv2/go_OrganizationSource.yaml
index 82a6caa5094d..b73c90fa1fab 100644
--- a/mmv1/products/securitycenterv2/go_OrganizationSource.yaml
+++ b/mmv1/products/securitycenterv2/go_OrganizationSource.yaml
@@ -52,6 +52,7 @@ examples:
       source_display_name: 'My Source'
     test_env_vars:
       org_id: 'ORG_ID'
+      # resource can't be destroyed, so checkdestroy fails unnecessarily
     exclude_test: true
 parameters:
   - name: 'organization'
diff --git a/mmv1/products/storagetransfer/go_AgentPool.yaml b/mmv1/products/storagetransfer/go_AgentPool.yaml
index e73efe00eb52..b1b432a2ad04 100644
--- a/mmv1/products/storagetransfer/go_AgentPool.yaml
+++ b/mmv1/products/storagetransfer/go_AgentPool.yaml
@@ -41,6 +41,7 @@ examples:
       agent-pool-name: 'agent-pool-example'
     test_env_vars:
       project_id: 'PROJECT_NAME'
+      # Skip generating this test as the example is covered in resource_storage_transfer_agent_pool_test.go
     exclude_test: true
 parameters:
 properties:
diff --git a/mmv1/products/vertexai/go_Endpoint.yaml b/mmv1/products/vertexai/go_Endpoint.yaml
index 9e3622490261..cb5370436ae5 100644
--- a/mmv1/products/vertexai/go_Endpoint.yaml
+++ b/mmv1/products/vertexai/go_Endpoint.yaml
@@ -64,6 +64,7 @@ examples:
       address_name: 'address-name'
       kms_key_name: 'kms-name'
       network_name: 'network-name'
+      # Test is covered by handwritten test to include an update.
     exclude_test: true
 parameters:
   - name: 'location'
diff --git a/mmv1/products/vertexai/go_IndexEndpoint.yaml b/mmv1/products/vertexai/go_IndexEndpoint.yaml
index 6985729df8c8..d53f4ef623c9 100644
--- a/mmv1/products/vertexai/go_IndexEndpoint.yaml
+++ b/mmv1/products/vertexai/go_IndexEndpoint.yaml
@@ -61,6 +61,7 @@ examples:
     primary_resource_id: 'index_endpoint'
   - name: 'vertex_ai_index_endpoint_with_false_psc'
     primary_resource_id: 'index_endpoint'
+    # It's not distinguishable if the psc is false or not set, so we need to skip the test.
     exclude_import_test: true
     exclude_docs: true
   - name: 'vertex_ai_index_endpoint_with_public_endpoint'
diff --git a/mmv1/products/vertexai/go_IndexEndpointDeployedIndex.yaml b/mmv1/products/vertexai/go_IndexEndpointDeployedIndex.yaml
index 1f8249d5c23a..6d3d0e76bb59 100644
--- a/mmv1/products/vertexai/go_IndexEndpointDeployedIndex.yaml
+++ b/mmv1/products/vertexai/go_IndexEndpointDeployedIndex.yaml
@@ -225,7 +225,7 @@ properties:
         description: |
           The minimum number of replicas this DeployedModel will be always deployed on.
         required: true
-            # This field (and its nested fields) is not updatable via the mutateDeployedIndex method in the API, which is the only update method usable by this 'fine-grained' resource. This is why the field is marked as immutable despite the API docs not marking the field as immutable.
+        # This field (and its nested fields) is not updatable via the mutateDeployedIndex method in the API, which is the only update method usable by this 'fine-grained' resource. This is why the field is marked as immutable despite the API docs not marking the field as immutable.
         immutable: true
         properties:
           - name: 'machineType'
@@ -251,12 +251,14 @@ properties:
     type: Boolean
     description: |
       If true, private endpoint's access logs are sent to Cloud Logging.
+    # This field is not updatable via the mutateDeployedIndex method in the API, which is the only update method usable by this 'fine-grained' resource. This is why the field is marked as immutable despite the API docs not marking the field as immutable.
     immutable: true
     default_value: false
   - name: 'deployedIndexAuthConfig'
     type: NestedObject
     description: |
       If set, the authentication is enabled for the private endpoint.
+    # This field (and its nested fields) is not updatable via the mutateDeployedIndex method in the API, which is the only update method usable by this 'fine-grained' resource. This is why the field is marked as immutable despite the API docs not marking the field as immutable.
     immutable: true
     properties:
       - name: 'authProvider'
@@ -285,8 +287,8 @@ properties:
       The value should be the name of the address (https://cloud.google.com/compute/docs/reference/rest/v1/addresses) Example: ['vertex-ai-ip-range'].
 
       For more information about subnets and network IP ranges, please see https://cloud.google.com/vpc/docs/subnets#manually_created_subnet_ip_ranges.
-    # This field is not updatable via the mutateDeployedIndex method in the API, which is the only update method usable by this 'fine-grained' resource. This is why the field is marked as immutable despite the API docs not marking the field as immutable.
     immutable: true
+    # This field is not updatable via the mutateDeployedIndex method in the API, which is the only update method usable by this 'fine-grained' resource. This is why the field is marked as immutable despite the API docs not marking the field as immutable.
     item_type:
       type: String
   - name: 'deploymentGroup'
@@ -295,6 +297,5 @@ properties:
       The deployment group can be no longer than 64 characters (eg: 'test', 'prod'). If not set, we will use the 'default' deployment group.
       Creating deployment_groups with reserved_ip_ranges is a recommended practice when the peered network has multiple peering ranges. This creates your deployments from predictable IP spaces for easier traffic administration. Also, one deployment_group (except 'default') can only be used with the same reserved_ip_ranges which means if the deployment_group has been used with reserved_ip_ranges: [a, b, c], using it with [a, b] or [d, e] is disallowed. [See the official documentation here](https://cloud.google.com/vertex-ai/docs/reference/rest/v1/projects.locations.indexEndpoints#DeployedIndex.FIELDS.deployment_group).
       Note: we only support up to 5 deployment groups (not including 'default').
-    # This field is not updatable via the mutateDeployedIndex method in the API, which is the only update method usable by this 'fine-grained' resource. This is why the field is marked as immutable despite the API docs not marking the field as immutable.
     immutable: true
     default_value: "default"
diff --git a/mmv1/products/vmwareengine/go_Cluster.yaml b/mmv1/products/vmwareengine/go_Cluster.yaml
index 307ffe088917..9bd7b0adae34 100644
--- a/mmv1/products/vmwareengine/go_Cluster.yaml
+++ b/mmv1/products/vmwareengine/go_Cluster.yaml
@@ -67,6 +67,7 @@ examples:
       management_cluster_id: 'sample-mgmt-cluster'
     test_env_vars:
       region: 'REGION'
+ # update tests will take care of create and update. PC and cluster creation is expensive and node reservation is required.
     exclude_test: true
   - name: 'vmware_engine_cluster_full'
     primary_resource_id: 'vmw-ext-cluster'
@@ -77,6 +78,7 @@ examples:
       management_cluster_id: 'sample-mgmt-cluster'
     test_env_vars:
       region: 'REGION'
+ # update tests will take care of create and update. PC and cluster creation is expensive and node reservation is required.
     exclude_test: true
 parameters:
   - name: 'parent'
diff --git a/mmv1/products/vmwareengine/go_ExternalAccessRule.yaml b/mmv1/products/vmwareengine/go_ExternalAccessRule.yaml
index 41d29f73ae78..38259e619e6c 100644
--- a/mmv1/products/vmwareengine/go_ExternalAccessRule.yaml
+++ b/mmv1/products/vmwareengine/go_ExternalAccessRule.yaml
@@ -59,6 +59,7 @@ examples:
       network_policy_id: 'sample-np'
     test_env_vars:
       region: 'REGION'
+ # update tests will take care of create and update. The test id dependent on PC creation, which is expensive and requires node reservation.
     exclude_test: true
   - name: 'vmware_engine_external_access_rule_full'
     primary_resource_id: 'vmw-engine-external-access-rule'
@@ -71,6 +72,7 @@ examples:
       external_address_id: 'sample-ea'
     test_env_vars:
       region: 'REGION'
+ # update tests will take care of create and update. The test id dependent on PC creation, which is expensive and requires node reservation.
     exclude_test: true
 parameters:
   - name: 'parent'
diff --git a/mmv1/products/vmwareengine/go_ExternalAddress.yaml b/mmv1/products/vmwareengine/go_ExternalAddress.yaml
index 4a8267f88822..61b1bba597bb 100644
--- a/mmv1/products/vmwareengine/go_ExternalAddress.yaml
+++ b/mmv1/products/vmwareengine/go_ExternalAddress.yaml
@@ -66,6 +66,7 @@ examples:
       private_cloud_id: 'sample-pc'
       management_cluster_id: 'sample-mgmt-cluster'
       network_policy_id: 'sample-np'
+ # update tests will take care of all CRUD tests. Parent PC creation is expensive and node reservation is required.
     exclude_test: true
 parameters:
   - name: 'parent'
diff --git a/mmv1/products/vmwareengine/go_Network.yaml b/mmv1/products/vmwareengine/go_Network.yaml
index 16ede79d24fd..ccb93ccc3497 100644
--- a/mmv1/products/vmwareengine/go_Network.yaml
+++ b/mmv1/products/vmwareengine/go_Network.yaml
@@ -60,6 +60,7 @@ examples:
       org_id: 'ORG_ID'
       billing_account: 'BILLING_ACCT'
     external_providers: ["random", "time"]
+ # update tests will take care of create and update. Legacy network needs to be created on an isolated project.
     exclude_test: true
 parameters:
   - name: 'location'
diff --git a/mmv1/products/vmwareengine/go_PrivateCloud.yaml b/mmv1/products/vmwareengine/go_PrivateCloud.yaml
index 1e920239df4f..d161f29c96d1 100644
--- a/mmv1/products/vmwareengine/go_PrivateCloud.yaml
+++ b/mmv1/products/vmwareengine/go_PrivateCloud.yaml
@@ -68,6 +68,7 @@ examples:
       management_cluster_id: 'sample-mgmt-cluster'
     test_env_vars:
       region: 'REGION'
+ # update tests will take care of create and update. PC creation is expensive and node reservation is required.
     exclude_test: true
   - name: 'vmware_engine_private_cloud_full'
     primary_resource_id: 'vmw-engine-pc'
@@ -77,6 +78,7 @@ examples:
       management_cluster_id: 'sample-mgmt-cluster'
     test_env_vars:
       region: 'REGION'
+ # update tests will take care of create and update. PC creation is expensive and node reservation is required.
     exclude_test: true
 virtual_fields:
   - name: 'deletion_delay_hours'
diff --git a/mmv1/products/vmwareengine/go_Subnet.yaml b/mmv1/products/vmwareengine/go_Subnet.yaml
index e7fe92083e2a..bbdeea232677 100644
--- a/mmv1/products/vmwareengine/go_Subnet.yaml
+++ b/mmv1/products/vmwareengine/go_Subnet.yaml
@@ -62,6 +62,7 @@ examples:
       subnet_id: 'service-1'
     test_env_vars:
       region: 'REGION'
+ # update tests will take care of read and update. Parent PC creation is expensive and node reservation is required.
     exclude_test: true
 parameters:
   - name: 'parent'
diff --git a/mmv1/templates/terraform/iam/example_config_body/go/secret_manager_regional_secret.tf.tmpl b/mmv1/templates/terraform/iam/example_config_body/go/secret_manager_regional_secret.tf.tmpl
index 324d07d37a8d..fc10adcc521c 100644
--- a/mmv1/templates/terraform/iam/example_config_body/go/secret_manager_regional_secret.tf.tmpl
+++ b/mmv1/templates/terraform/iam/example_config_body/go/secret_manager_regional_secret.tf.tmpl
@@ -1,3 +1,4 @@
+
   project = google_secret_manager_regional_secret.regional-secret-basic.project
   location = google_secret_manager_regional_secret.regional-secret-basic.location
   secret_id = google_secret_manager_regional_secret.regional-secret-basic.secret_id