pulumi-gcp 7.24.0a1716588893__py3-none-any.whl → 7.25.0__py3-none-any.whl

pulumi_gcp/eventarc/channel.py

@@ -333,7 +333,8 @@ class Channel(pulumi.CustomResource):
             name="channel",
             project=test_project.project_id,
             crypto_key_name=key1["id"],
-            third_party_provider=f"projects/{test_project.project_id}/locations/us-west1/providers/datadog")
+            third_party_provider=f"projects/{test_project.project_id}/locations/us-west1/providers/datadog",
+            opts=pulumi.ResourceOptions(depends_on=[key1_member]))
         ```
 
         ## Import
@@ -402,7 +403,8 @@ class Channel(pulumi.CustomResource):
             name="channel",
             project=test_project.project_id,
             crypto_key_name=key1["id"],
-            third_party_provider=f"projects/{test_project.project_id}/locations/us-west1/providers/datadog")
+            third_party_provider=f"projects/{test_project.project_id}/locations/us-west1/providers/datadog",
+            opts=pulumi.ResourceOptions(depends_on=[key1_member]))
         ```
 
         ## Import

pulumi_gcp/eventarc/google_channel_config.py

@@ -219,7 +219,8 @@ class GoogleChannelConfig(pulumi.CustomResource):
             location="us-west1",
             name="channel",
             project=test_project.project_id,
-            crypto_key_name=key1["id"])
+            crypto_key_name=key1["id"],
+            opts=pulumi.ResourceOptions(depends_on=[key1_member]))
         ```
 
         ## Import
@@ -286,7 +287,8 @@ class GoogleChannelConfig(pulumi.CustomResource):
             location="us-west1",
             name="channel",
             project=test_project.project_id,
-            crypto_key_name=key1["id"])
+            crypto_key_name=key1["id"],
+            opts=pulumi.ResourceOptions(depends_on=[key1_member]))
         ```
 
         ## Import

pulumi_gcp/firebase/app_check_app_attest_config.py

@@ -201,10 +201,12 @@ class AppCheckAppAttestConfig(pulumi.CustomResource):
             team_id="9987654321")
         # It takes a while for App Check to recognize the new app
         # If your app already exists, you don't have to wait 30 seconds.
-        wait30s = time.index.Sleep("wait_30s", create_duration=30s)
+        wait30s = time.index.Sleep("wait_30s", create_duration=30s,
+        opts=pulumi.ResourceOptions(depends_on=[default]))
         default_app_check_app_attest_config = gcp.firebase.AppCheckAppAttestConfig("default",
             project="my-project-name",
-            app_id=default.app_id)
+            app_id=default.app_id,
+            opts=pulumi.ResourceOptions(depends_on=[wait30s]))
         ```
         ### Firebase App Check App Attest Config Full
 
@@ -220,11 +222,13 @@ class AppCheckAppAttestConfig(pulumi.CustomResource):
             team_id="9987654321")
         # It takes a while for App Check to recognize the new app
         # If your app already exists, you don't have to wait 30 seconds.
-        wait30s = time.index.Sleep("wait_30s", create_duration=30s)
+        wait30s = time.index.Sleep("wait_30s", create_duration=30s,
+        opts=pulumi.ResourceOptions(depends_on=[default]))
         default_app_check_app_attest_config = gcp.firebase.AppCheckAppAttestConfig("default",
             project="my-project-name",
             app_id=default.app_id,
-            token_ttl="7200s")
+            token_ttl="7200s",
+            opts=pulumi.ResourceOptions(depends_on=[wait30s]))
         ```
 
         ## Import
@@ -296,10 +300,12 @@ class AppCheckAppAttestConfig(pulumi.CustomResource):
             team_id="9987654321")
         # It takes a while for App Check to recognize the new app
         # If your app already exists, you don't have to wait 30 seconds.
-        wait30s = time.index.Sleep("wait_30s", create_duration=30s)
+        wait30s = time.index.Sleep("wait_30s", create_duration=30s,
+        opts=pulumi.ResourceOptions(depends_on=[default]))
         default_app_check_app_attest_config = gcp.firebase.AppCheckAppAttestConfig("default",
             project="my-project-name",
-            app_id=default.app_id)
+            app_id=default.app_id,
+            opts=pulumi.ResourceOptions(depends_on=[wait30s]))
         ```
         ### Firebase App Check App Attest Config Full
 
@@ -315,11 +321,13 @@ class AppCheckAppAttestConfig(pulumi.CustomResource):
             team_id="9987654321")
         # It takes a while for App Check to recognize the new app
         # If your app already exists, you don't have to wait 30 seconds.
-        wait30s = time.index.Sleep("wait_30s", create_duration=30s)
+        wait30s = time.index.Sleep("wait_30s", create_duration=30s,
+        opts=pulumi.ResourceOptions(depends_on=[default]))
         default_app_check_app_attest_config = gcp.firebase.AppCheckAppAttestConfig("default",
             project="my-project-name",
             app_id=default.app_id,
-            token_ttl="7200s")
+            token_ttl="7200s",
+            opts=pulumi.ResourceOptions(depends_on=[wait30s]))
         ```
 
         ## Import

pulumi_gcp/firebase/app_check_debug_token.py

@@ -256,12 +256,14 @@ class AppCheckDebugToken(pulumi.CustomResource):
             display_name="Web App for debug token")
         # It takes a while for App Check to recognize the new app
         # If your app already exists, you don't have to wait 30 seconds.
-        wait30s = time.index.Sleep("wait_30s", create_duration=30s)
+        wait30s = time.index.Sleep("wait_30s", create_duration=30s,
+        opts=pulumi.ResourceOptions(depends_on=[default]))
         default_app_check_debug_token = gcp.firebase.AppCheckDebugToken("default",
             project="my-project-name",
             app_id=default.app_id,
             display_name="Debug Token",
-            token="00000000-AAAA-BBBB-CCCC-000000000000")
+            token="00000000-AAAA-BBBB-CCCC-000000000000",
+            opts=pulumi.ResourceOptions(depends_on=[wait30s]))
         ```
 
         ## Import
@@ -340,12 +342,14 @@ class AppCheckDebugToken(pulumi.CustomResource):
             display_name="Web App for debug token")
         # It takes a while for App Check to recognize the new app
         # If your app already exists, you don't have to wait 30 seconds.
-        wait30s = time.index.Sleep("wait_30s", create_duration=30s)
+        wait30s = time.index.Sleep("wait_30s", create_duration=30s,
+        opts=pulumi.ResourceOptions(depends_on=[default]))
         default_app_check_debug_token = gcp.firebase.AppCheckDebugToken("default",
             project="my-project-name",
             app_id=default.app_id,
             display_name="Debug Token",
-            token="00000000-AAAA-BBBB-CCCC-000000000000")
+            token="00000000-AAAA-BBBB-CCCC-000000000000",
+            opts=pulumi.ResourceOptions(depends_on=[wait30s]))
         ```
 
         ## Import

pulumi_gcp/firebase/app_check_device_check_config.py

@@ -288,13 +288,15 @@ class AppCheckDeviceCheckConfig(pulumi.CustomResource):
             team_id="9987654321")
         # It takes a while for App Check to recognize the new app
         # If your app already exists, you don't have to wait 30 seconds.
-        wait30s = time.index.Sleep("wait_30s", create_duration=30s)
+        wait30s = time.index.Sleep("wait_30s", create_duration=30s,
+        opts=pulumi.ResourceOptions(depends_on=[default]))
         default_app_check_device_check_config = gcp.firebase.AppCheckDeviceCheckConfig("default",
             project="my-project-name",
             app_id=default.app_id,
             token_ttl="7200s",
             key_id="Key ID",
-            private_key=std.file(input="path/to/private-key.p8").result)
+            private_key=std.file(input="path/to/private-key.p8").result,
+            opts=pulumi.ResourceOptions(depends_on=[wait30s]))
         ```
 
         ## Import
@@ -370,13 +372,15 @@ class AppCheckDeviceCheckConfig(pulumi.CustomResource):
             team_id="9987654321")
         # It takes a while for App Check to recognize the new app
         # If your app already exists, you don't have to wait 30 seconds.
-        wait30s = time.index.Sleep("wait_30s", create_duration=30s)
+        wait30s = time.index.Sleep("wait_30s", create_duration=30s,
+        opts=pulumi.ResourceOptions(depends_on=[default]))
         default_app_check_device_check_config = gcp.firebase.AppCheckDeviceCheckConfig("default",
             project="my-project-name",
             app_id=default.app_id,
             token_ttl="7200s",
             key_id="Key ID",
-            private_key=std.file(input="path/to/private-key.p8").result)
+            private_key=std.file(input="path/to/private-key.p8").result,
+            opts=pulumi.ResourceOptions(depends_on=[wait30s]))
         ```
 
         ## Import

pulumi_gcp/firebase/app_check_play_integrity_config.py

@@ -207,10 +207,12 @@ class AppCheckPlayIntegrityConfig(pulumi.CustomResource):
             sha256_hashes=["2145bdf698b8715039bd0e83f2069bed435ac21ca1b2c3d4e5f6123456789abc"])
         # It takes a while for App Check to recognize the new app
         # If your app already exists, you don't have to wait 30 seconds.
-        wait30s = time.index.Sleep("wait_30s", create_duration=30s)
+        wait30s = time.index.Sleep("wait_30s", create_duration=30s,
+        opts=pulumi.ResourceOptions(depends_on=[default]))
         default_app_check_play_integrity_config = gcp.firebase.AppCheckPlayIntegrityConfig("default",
             project="my-project-name",
-            app_id=default.app_id)
+            app_id=default.app_id,
+            opts=pulumi.ResourceOptions(depends_on=[wait30s]))
         ```
         ### Firebase App Check Play Integrity Config Full
 
@@ -232,11 +234,13 @@ class AppCheckPlayIntegrityConfig(pulumi.CustomResource):
             sha256_hashes=["2145bdf698b8715039bd0e83f2069bed435ac21ca1b2c3d4e5f6123456789abc"])
         # It takes a while for App Check to recognize the new app
         # If your app already exists, you don't have to wait 30 seconds.
-        wait30s = time.index.Sleep("wait_30s", create_duration=30s)
+        wait30s = time.index.Sleep("wait_30s", create_duration=30s,
+        opts=pulumi.ResourceOptions(depends_on=[default]))
         default_app_check_play_integrity_config = gcp.firebase.AppCheckPlayIntegrityConfig("default",
             project="my-project-name",
             app_id=default.app_id,
-            token_ttl="7200s")
+            token_ttl="7200s",
+            opts=pulumi.ResourceOptions(depends_on=[wait30s]))
         ```
 
         ## Import
@@ -314,10 +318,12 @@ class AppCheckPlayIntegrityConfig(pulumi.CustomResource):
             sha256_hashes=["2145bdf698b8715039bd0e83f2069bed435ac21ca1b2c3d4e5f6123456789abc"])
         # It takes a while for App Check to recognize the new app
         # If your app already exists, you don't have to wait 30 seconds.
-        wait30s = time.index.Sleep("wait_30s", create_duration=30s)
+        wait30s = time.index.Sleep("wait_30s", create_duration=30s,
+        opts=pulumi.ResourceOptions(depends_on=[default]))
         default_app_check_play_integrity_config = gcp.firebase.AppCheckPlayIntegrityConfig("default",
             project="my-project-name",
-            app_id=default.app_id)
+            app_id=default.app_id,
+            opts=pulumi.ResourceOptions(depends_on=[wait30s]))
         ```
         ### Firebase App Check Play Integrity Config Full
 
@@ -339,11 +345,13 @@ class AppCheckPlayIntegrityConfig(pulumi.CustomResource):
             sha256_hashes=["2145bdf698b8715039bd0e83f2069bed435ac21ca1b2c3d4e5f6123456789abc"])
         # It takes a while for App Check to recognize the new app
         # If your app already exists, you don't have to wait 30 seconds.
-        wait30s = time.index.Sleep("wait_30s", create_duration=30s)
+        wait30s = time.index.Sleep("wait_30s", create_duration=30s,
+        opts=pulumi.ResourceOptions(depends_on=[default]))
         default_app_check_play_integrity_config = gcp.firebase.AppCheckPlayIntegrityConfig("default",
             project="my-project-name",
             app_id=default.app_id,
-            token_ttl="7200s")
+            token_ttl="7200s",
+            opts=pulumi.ResourceOptions(depends_on=[wait30s]))
         ```
 
         ## Import

pulumi_gcp/firebase/app_check_recaptcha_enterprise_config.py

@@ -239,12 +239,14 @@ class AppCheckRecaptchaEnterpriseConfig(pulumi.CustomResource):
             display_name="Web App for reCAPTCHA Enterprise")
         # It takes a while for App Check to recognize the new app
         # If your app already exists, you don't have to wait 30 seconds.
-        wait30s = time.index.Sleep("wait_30s", create_duration=30s)
+        wait30s = time.index.Sleep("wait_30s", create_duration=30s,
+        opts=pulumi.ResourceOptions(depends_on=[default]))
         default_app_check_recaptcha_enterprise_config = gcp.firebase.AppCheckRecaptchaEnterpriseConfig("default",
             project="my-project-name",
             app_id=default.app_id,
             site_key="6LdpMXIpAAAAANkwWQPgEdjEhal7ugkH9RK9ytuw",
-            token_ttl="7200s")
+            token_ttl="7200s",
+            opts=pulumi.ResourceOptions(depends_on=[wait30s]))
         ```
 
         ## Import
@@ -320,12 +322,14 @@ class AppCheckRecaptchaEnterpriseConfig(pulumi.CustomResource):
             display_name="Web App for reCAPTCHA Enterprise")
         # It takes a while for App Check to recognize the new app
         # If your app already exists, you don't have to wait 30 seconds.
-        wait30s = time.index.Sleep("wait_30s", create_duration=30s)
+        wait30s = time.index.Sleep("wait_30s", create_duration=30s,
+        opts=pulumi.ResourceOptions(depends_on=[default]))
         default_app_check_recaptcha_enterprise_config = gcp.firebase.AppCheckRecaptchaEnterpriseConfig("default",
             project="my-project-name",
             app_id=default.app_id,
             site_key="6LdpMXIpAAAAANkwWQPgEdjEhal7ugkH9RK9ytuw",
-            token_ttl="7200s")
+            token_ttl="7200s",
+            opts=pulumi.ResourceOptions(depends_on=[wait30s]))
         ```
 
         ## Import

pulumi_gcp/firebase/app_check_recaptcha_v3_config.py

@@ -254,12 +254,14 @@ class AppCheckRecaptchaV3Config(pulumi.CustomResource):
             display_name="Web App for reCAPTCHA V3")
         # It takes a while for App Check to recognize the new app
         # If your app already exists, you don't have to wait 30 seconds.
-        wait30s = time.index.Sleep("wait_30s", create_duration=30s)
+        wait30s = time.index.Sleep("wait_30s", create_duration=30s,
+        opts=pulumi.ResourceOptions(depends_on=[default]))
         default_app_check_recaptcha_v3_config = gcp.firebase.AppCheckRecaptchaV3Config("default",
             project="my-project-name",
             app_id=default.app_id,
             site_secret="6Lf9YnQpAAAAAC3-MHmdAllTbPwTZxpUw5d34YzX",
-            token_ttl="7200s")
+            token_ttl="7200s",
+            opts=pulumi.ResourceOptions(depends_on=[wait30s]))
         ```
 
         ## Import
@@ -331,12 +333,14 @@ class AppCheckRecaptchaV3Config(pulumi.CustomResource):
             display_name="Web App for reCAPTCHA V3")
         # It takes a while for App Check to recognize the new app
         # If your app already exists, you don't have to wait 30 seconds.
-        wait30s = time.index.Sleep("wait_30s", create_duration=30s)
+        wait30s = time.index.Sleep("wait_30s", create_duration=30s,
+        opts=pulumi.ResourceOptions(depends_on=[default]))
         default_app_check_recaptcha_v3_config = gcp.firebase.AppCheckRecaptchaV3Config("default",
             project="my-project-name",
             app_id=default.app_id,
             site_secret="6Lf9YnQpAAAAAC3-MHmdAllTbPwTZxpUw5d34YzX",
-            token_ttl="7200s")
+            token_ttl="7200s",
+            opts=pulumi.ResourceOptions(depends_on=[wait30s]))
         ```
 
         ## Import

pulumi_gcp/firebase/app_check_service_config.py

@@ -194,7 +194,8 @@ class AppCheckServiceConfig(pulumi.CustomResource):
             disable_on_destroy=False)
         default = gcp.firebase.AppCheckServiceConfig("default",
             project="my-project-name",
-            service_id="firestore.googleapis.com")
+            service_id="firestore.googleapis.com",
+            opts=pulumi.ResourceOptions(depends_on=[appcheck]))
         ```
         ### Firebase App Check Service Config Enforced
 
@@ -209,7 +210,8 @@ class AppCheckServiceConfig(pulumi.CustomResource):
         default = gcp.firebase.AppCheckServiceConfig("default",
             project="my-project-name",
             service_id="firebasestorage.googleapis.com",
-            enforcement_mode="ENFORCED")
+            enforcement_mode="ENFORCED",
+            opts=pulumi.ResourceOptions(depends_on=[appcheck]))
         ```
         ### Firebase App Check Service Config Unenforced
 
@@ -224,7 +226,8 @@ class AppCheckServiceConfig(pulumi.CustomResource):
         default = gcp.firebase.AppCheckServiceConfig("default",
             project="my-project-name",
             service_id="identitytoolkit.googleapis.com",
-            enforcement_mode="UNENFORCED")
+            enforcement_mode="UNENFORCED",
+            opts=pulumi.ResourceOptions(depends_on=[appcheck]))
         ```
 
         ## Import
@@ -293,7 +296,8 @@ class AppCheckServiceConfig(pulumi.CustomResource):
             disable_on_destroy=False)
         default = gcp.firebase.AppCheckServiceConfig("default",
             project="my-project-name",
-            service_id="firestore.googleapis.com")
+            service_id="firestore.googleapis.com",
+            opts=pulumi.ResourceOptions(depends_on=[appcheck]))
         ```
         ### Firebase App Check Service Config Enforced
 
@@ -308,7 +312,8 @@ class AppCheckServiceConfig(pulumi.CustomResource):
         default = gcp.firebase.AppCheckServiceConfig("default",
             project="my-project-name",
             service_id="firebasestorage.googleapis.com",
-            enforcement_mode="ENFORCED")
+            enforcement_mode="ENFORCED",
+            opts=pulumi.ResourceOptions(depends_on=[appcheck]))
         ```
         ### Firebase App Check Service Config Unenforced
 
@@ -323,7 +328,8 @@ class AppCheckServiceConfig(pulumi.CustomResource):
         default = gcp.firebase.AppCheckServiceConfig("default",
             project="my-project-name",
             service_id="identitytoolkit.googleapis.com",
-            enforcement_mode="UNENFORCED")
+            enforcement_mode="UNENFORCED",
+            opts=pulumi.ResourceOptions(depends_on=[appcheck]))
         ```
 
         ## Import

pulumi_gcp/firebase/database_instance.py

@@ -344,7 +344,8 @@ class DatabaseInstance(pulumi.CustomResource):
             project=default_project.project,
             region="us-central1",
             instance_id="rtdb-project-default-rtdb",
-            type="DEFAULT_DATABASE")
+            type="DEFAULT_DATABASE",
+            opts=pulumi.ResourceOptions(depends_on=[firebase_database]))
         ```
 
         ## Import
@@ -450,7 +451,8 @@ class DatabaseInstance(pulumi.CustomResource):
             project=default_project.project,
             region="us-central1",
             instance_id="rtdb-project-default-rtdb",
-            type="DEFAULT_DATABASE")
+            type="DEFAULT_DATABASE",
+            opts=pulumi.ResourceOptions(depends_on=[firebase_database]))
         ```
 
         ## Import

pulumi_gcp/firebaserules/release.py

@@ -200,55 +200,6 @@ class Release(pulumi.CustomResource):
         * [Get started with Firebase Security Rules](https://firebase.google.com/docs/rules/get-started)
         ## Example Usage
 
-        ### Firestore_release
-        Creates a Firebase Rules Release to Cloud Firestore
-        ```python
-        import pulumi
-        import pulumi_gcp as gcp
-
-        firestore = gcp.firebaserules.Ruleset("firestore",
-            source=gcp.firebaserules.RulesetSourceArgs(
-                files=[gcp.firebaserules.RulesetSourceFileArgs(
-                    content="service cloud.firestore {match /databases/{database}/documents { match /{document=**} { allow read, write: if false; } } }",
-                    name="firestore.rules",
-                )],
-            ),
-            project="my-project-name")
-        primary = gcp.firebaserules.Release("primary",
-            name="cloud.firestore/database",
-            ruleset_name=firestore.name.apply(lambda name: f"projects/my-project-name/rulesets/{name}"),
-            project="my-project-name")
-        ```
-        ### Storage_release
-        Creates a Firebase Rules Release for a Storage bucket
-        ```python
-        import pulumi
-        import pulumi_gcp as gcp
-
-        # Provision a non-default Cloud Storage bucket.
-        bucket = gcp.storage.Bucket("bucket",
-            project="my-project-name",
-            name="bucket",
-            location="us-west1")
-        # Create a ruleset of Firebase Security Rules from a local file.
-        storage = gcp.firebaserules.Ruleset("storage",
-            project="my-project-name",
-            source=gcp.firebaserules.RulesetSourceArgs(
-                files=[gcp.firebaserules.RulesetSourceFileArgs(
-                    name="storage.rules",
-                    content="service firebase.storage {match /b/{bucket}/o {match /{allPaths=**} {allow read, write: if request.auth != null;}}}",
-                )],
-            ))
-        primary = gcp.firebaserules.Release("primary",
-            name=bucket.name.apply(lambda name: f"firebase.storage/{name}"),
-            ruleset_name=storage.name.apply(lambda name: f"projects/my-project-name/rulesets/{name}"),
-            project="my-project-name")
-        # Make the Storage bucket accessible for Firebase SDKs, authentication, and Firebase Security Rules.
-        bucket_storage_bucket = gcp.firebase.StorageBucket("bucket",
-            project="my-project-name",
-            bucket_id=bucket.name)
-        ```
-
         ## Import
 
         Release can be imported using any of these accepted formats:
@@ -281,55 +232,6 @@ class Release(pulumi.CustomResource):
         * [Get started with Firebase Security Rules](https://firebase.google.com/docs/rules/get-started)
         ## Example Usage
 
-        ### Firestore_release
-        Creates a Firebase Rules Release to Cloud Firestore
-        ```python
-        import pulumi
-        import pulumi_gcp as gcp
-
-        firestore = gcp.firebaserules.Ruleset("firestore",
-            source=gcp.firebaserules.RulesetSourceArgs(
-                files=[gcp.firebaserules.RulesetSourceFileArgs(
-                    content="service cloud.firestore {match /databases/{database}/documents { match /{document=**} { allow read, write: if false; } } }",
-                    name="firestore.rules",
-                )],
-            ),
-            project="my-project-name")
-        primary = gcp.firebaserules.Release("primary",
-            name="cloud.firestore/database",
-            ruleset_name=firestore.name.apply(lambda name: f"projects/my-project-name/rulesets/{name}"),
-            project="my-project-name")
-        ```
-        ### Storage_release
-        Creates a Firebase Rules Release for a Storage bucket
-        ```python
-        import pulumi
-        import pulumi_gcp as gcp
-
-        # Provision a non-default Cloud Storage bucket.
-        bucket = gcp.storage.Bucket("bucket",
-            project="my-project-name",
-            name="bucket",
-            location="us-west1")
-        # Create a ruleset of Firebase Security Rules from a local file.
-        storage = gcp.firebaserules.Ruleset("storage",
-            project="my-project-name",
-            source=gcp.firebaserules.RulesetSourceArgs(
-                files=[gcp.firebaserules.RulesetSourceFileArgs(
-                    name="storage.rules",
-                    content="service firebase.storage {match /b/{bucket}/o {match /{allPaths=**} {allow read, write: if request.auth != null;}}}",
-                )],
-            ))
-        primary = gcp.firebaserules.Release("primary",
-            name=bucket.name.apply(lambda name: f"firebase.storage/{name}"),
-            ruleset_name=storage.name.apply(lambda name: f"projects/my-project-name/rulesets/{name}"),
-            project="my-project-name")
-        # Make the Storage bucket accessible for Firebase SDKs, authentication, and Firebase Security Rules.
-        bucket_storage_bucket = gcp.firebase.StorageBucket("bucket",
-            project="my-project-name",
-            bucket_id=bucket.name)
-        ```
-
         ## Import
 
         Release can be imported using any of these accepted formats:

pulumi_gcp/firestore/database.py

@@ -635,6 +635,10 @@ class Database(pulumi.CustomResource):
             name="kms-key",
             key_ring=key_ring.id,
             purpose="ENCRYPT_DECRYPT")
+        firestore_cmek_keyuser = gcp.kms.CryptoKeyIAMBinding("firestore_cmek_keyuser",
+            crypto_key_id=crypto_key.id,
+            role="roles/cloudkms.cryptoKeyEncrypterDecrypter",
+            members=[f"serviceAccount:service-{project.number}@gcp-sa-firestore.iam.gserviceaccount.com"])
         database = gcp.firestore.Database("database",
             project="my-project-name",
             name="cmek-database-id",
@@ -647,11 +651,8 @@ class Database(pulumi.CustomResource):
             deletion_policy="DELETE",
             cmek_config=gcp.firestore.DatabaseCmekConfigArgs(
                 kms_key_name=crypto_key.id,
-            ))
-        firestore_cmek_keyuser = gcp.kms.CryptoKeyIAMBinding("firestore_cmek_keyuser",
-            crypto_key_id=crypto_key.id,
-            role="roles/cloudkms.cryptoKeyEncrypterDecrypter",
-            members=[f"serviceAccount:service-{project.number}@gcp-sa-firestore.iam.gserviceaccount.com"])
+            ),
+            opts=pulumi.ResourceOptions(depends_on=[firestore_cmek_keyuser]))
         ```
         ### Firestore Default Database In Datastore Mode
 
@@ -696,6 +697,10 @@ class Database(pulumi.CustomResource):
             name="kms-key",
             key_ring=key_ring.id,
             purpose="ENCRYPT_DECRYPT")
+        firestore_cmek_keyuser = gcp.kms.CryptoKeyIAMBinding("firestore_cmek_keyuser",
+            crypto_key_id=crypto_key.id,
+            role="roles/cloudkms.cryptoKeyEncrypterDecrypter",
+            members=[f"serviceAccount:service-{project.number}@gcp-sa-firestore.iam.gserviceaccount.com"])
         database = gcp.firestore.Database("database",
             project="my-project-name",
             name="cmek-database-id",
@@ -708,11 +713,8 @@ class Database(pulumi.CustomResource):
             deletion_policy="DELETE",
             cmek_config=gcp.firestore.DatabaseCmekConfigArgs(
                 kms_key_name=crypto_key.id,
-            ))
-        firestore_cmek_keyuser = gcp.kms.CryptoKeyIAMBinding("firestore_cmek_keyuser",
-            crypto_key_id=crypto_key.id,
-            role="roles/cloudkms.cryptoKeyEncrypterDecrypter",
-            members=[f"serviceAccount:service-{project.number}@gcp-sa-firestore.iam.gserviceaccount.com"])
+            ),
+            opts=pulumi.ResourceOptions(depends_on=[firestore_cmek_keyuser]))
         ```
 
         ## Import
@@ -840,6 +842,10 @@ class Database(pulumi.CustomResource):
             name="kms-key",
             key_ring=key_ring.id,
             purpose="ENCRYPT_DECRYPT")
+        firestore_cmek_keyuser = gcp.kms.CryptoKeyIAMBinding("firestore_cmek_keyuser",
+            crypto_key_id=crypto_key.id,
+            role="roles/cloudkms.cryptoKeyEncrypterDecrypter",
+            members=[f"serviceAccount:service-{project.number}@gcp-sa-firestore.iam.gserviceaccount.com"])
         database = gcp.firestore.Database("database",
             project="my-project-name",
             name="cmek-database-id",
@@ -852,11 +858,8 @@ class Database(pulumi.CustomResource):
             deletion_policy="DELETE",
             cmek_config=gcp.firestore.DatabaseCmekConfigArgs(
                 kms_key_name=crypto_key.id,
-            ))
-        firestore_cmek_keyuser = gcp.kms.CryptoKeyIAMBinding("firestore_cmek_keyuser",
-            crypto_key_id=crypto_key.id,
-            role="roles/cloudkms.cryptoKeyEncrypterDecrypter",
-            members=[f"serviceAccount:service-{project.number}@gcp-sa-firestore.iam.gserviceaccount.com"])
+            ),
+            opts=pulumi.ResourceOptions(depends_on=[firestore_cmek_keyuser]))
         ```
         ### Firestore Default Database In Datastore Mode
 
@@ -901,6 +904,10 @@ class Database(pulumi.CustomResource):
             name="kms-key",
             key_ring=key_ring.id,
             purpose="ENCRYPT_DECRYPT")
+        firestore_cmek_keyuser = gcp.kms.CryptoKeyIAMBinding("firestore_cmek_keyuser",
+            crypto_key_id=crypto_key.id,
+            role="roles/cloudkms.cryptoKeyEncrypterDecrypter",
+            members=[f"serviceAccount:service-{project.number}@gcp-sa-firestore.iam.gserviceaccount.com"])
         database = gcp.firestore.Database("database",
             project="my-project-name",
             name="cmek-database-id",
@@ -913,11 +920,8 @@ class Database(pulumi.CustomResource):
             deletion_policy="DELETE",
             cmek_config=gcp.firestore.DatabaseCmekConfigArgs(
                 kms_key_name=crypto_key.id,
-            ))
-        firestore_cmek_keyuser = gcp.kms.CryptoKeyIAMBinding("firestore_cmek_keyuser",
-            crypto_key_id=crypto_key.id,
-            role="roles/cloudkms.cryptoKeyEncrypterDecrypter",
-            members=[f"serviceAccount:service-{project.number}@gcp-sa-firestore.iam.gserviceaccount.com"])
+            ),
+            opts=pulumi.ResourceOptions(depends_on=[firestore_cmek_keyuser]))
         ```
 
         ## Import