Repository: GoogleCloudPlatform/terraform-validator
Pull request #492 (2022-01-28 18:58:06)

Fix kms crypto key iam asset name
<!-- Put a description of what this PR is for here, along with any references to issues that this resolves or contributes to -->
b/211765752
- Fix kms crypto key iam asset name 
  - .id is not resolved properly, so change the test case to not use any id property. 
- Notice GetOk function was having `{{}}`, which seems not correct, so fix it in the template. 



<!--
Replace each [ ] with [X] to check it. Switch to the preview view to make it easier to click on links.
These steps will speed up the review process, and we appreciate you spending time on them before sending
your code to be reviewed.
-->
If this PR is for Terraform, I acknowledge that I have:

- [X] Searched through the [issue tracker](https://github.com/hashicorp/terraform-provider-google/issues) for an open issue that this either resolves or contributes to, commented on it to claim it, and written "fixes {url}" or "part of {url}" in this PR description. If there were no relevant open issues, I opened one and commented that I would like to work on it (not necessary for very small changes).
- [ ] [Generated Terraform](https://github.com/GoogleCloudPlatform/magic-modules#generating-downstream-tools), and ran `make test` and `make lint` to ensure it passes unit and linter tests.
- [ ] Ensured that all new fields I added that can be set by a user appear in at least one [example](https://github.com/GoogleCloudPlatform/magic-modules/tree/master/templates/terraform/examples) (for generated resources) or [third_party test](https://github.com/GoogleCloudPlatform/magic-modules/tree/master/third_party/terraform/tests) (for handwritten resources or update tests).
- [ ] [Ran](https://github.com/hashicorp/terraform-provider-google/blob/master/.github/CONTRIBUTING.md#tests) relevant acceptance tests (If the acceptance tests do not yet pass or you are unable to run them, please let your reviewer know).
- [X] Read the [Release Notes Guide](https://github.com/GoogleCloudPlatform/magic-modules/blob/master/.ci/RELEASE_NOTES_GUIDE.md) before writing my release note below.

<!-- AUTOCHANGELOG for Downstream PRs.

Please select one of the following "release-note:" headings:
    - release-note:enhancement
    - release-note:bug
    - release-note:note
    - release-note:new-resource
    - release-note:new-datasource
    - release-note:deprecation
    - release-note:breaking-change
    - release-note:none
    
Unless you choose release-note:none, please add a release note.

See .ci/RELEASE_NOTES_GUIDE.md for writing good release notes.

You can add more release note blocks if you want more than one CHANGELOG
entry for this PR.
-->
**Release Note Template for Downstream PRs (will be copied)**

```release-note:none

```

Derived from https://github.com/GoogleCloudPlatform/magic-modules/pull/5654


Patch:
diff --git a/converters/google/resources/apigee_environment_iam.go b/converters/google/resources/apigee_environment_iam.go
index c145983b..9d2ffe35 100644
--- a/converters/google/resources/apigee_environment_iam.go
+++ b/converters/google/resources/apigee_environment_iam.go
@@ -106,10 +106,10 @@ func newApigeeEnvironmentIamAsset(
 
 func FetchApigeeEnvironmentIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{org_id}}"); !ok {
+	if _, ok := d.GetOk("org_id"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
-	if _, ok := d.GetOk("{{env_id}}"); !ok {
+	if _, ok := d.GetOk("env_id"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
diff --git a/converters/google/resources/big_query_table_iam.go b/converters/google/resources/big_query_table_iam.go
index b53d5215..f80235c2 100644
--- a/converters/google/resources/big_query_table_iam.go
+++ b/converters/google/resources/big_query_table_iam.go
@@ -106,10 +106,10 @@ func newBigQueryTableIamAsset(
 
 func FetchBigQueryTableIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{dataset_id}}"); !ok {
+	if _, ok := d.GetOk("dataset_id"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
-	if _, ok := d.GetOk("{{table_id}}"); !ok {
+	if _, ok := d.GetOk("table_id"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
diff --git a/converters/google/resources/cloud_functions_cloud_function_iam.go b/converters/google/resources/cloud_functions_cloud_function_iam.go
index 8ad73b22..945daee8 100644
--- a/converters/google/resources/cloud_functions_cloud_function_iam.go
+++ b/converters/google/resources/cloud_functions_cloud_function_iam.go
@@ -106,10 +106,10 @@ func newCloudFunctionsCloudFunctionIamAsset(
 
 func FetchCloudFunctionsCloudFunctionIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{region}}"); !ok {
+	if _, ok := d.GetOk("region"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
-	if _, ok := d.GetOk("{{cloud_function}}"); !ok {
+	if _, ok := d.GetOk("cloud_function"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
diff --git a/converters/google/resources/cloud_run_service_iam.go b/converters/google/resources/cloud_run_service_iam.go
index 4f6b3c4e..46fa5d79 100644
--- a/converters/google/resources/cloud_run_service_iam.go
+++ b/converters/google/resources/cloud_run_service_iam.go
@@ -106,10 +106,10 @@ func newCloudRunServiceIamAsset(
 
 func FetchCloudRunServiceIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{location}}"); !ok {
+	if _, ok := d.GetOk("location"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
-	if _, ok := d.GetOk("{{service}}"); !ok {
+	if _, ok := d.GetOk("service"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
diff --git a/converters/google/resources/compute_disk_iam.go b/converters/google/resources/compute_disk_iam.go
index 606d778a..13c8b719 100644
--- a/converters/google/resources/compute_disk_iam.go
+++ b/converters/google/resources/compute_disk_iam.go
@@ -106,10 +106,10 @@ func newComputeDiskIamAsset(
 
 func FetchComputeDiskIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{zone}}"); !ok {
+	if _, ok := d.GetOk("zone"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
-	if _, ok := d.GetOk("{{name}}"); !ok {
+	if _, ok := d.GetOk("name"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
diff --git a/converters/google/resources/compute_image_iam.go b/converters/google/resources/compute_image_iam.go
index 774238e8..b131df17 100644
--- a/converters/google/resources/compute_image_iam.go
+++ b/converters/google/resources/compute_image_iam.go
@@ -106,7 +106,7 @@ func newComputeImageIamAsset(
 
 func FetchComputeImageIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{image}}"); !ok {
+	if _, ok := d.GetOk("image"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
diff --git a/converters/google/resources/compute_instance_iam.go b/converters/google/resources/compute_instance_iam.go
index ad5bcb9a..ef621fa2 100644
--- a/converters/google/resources/compute_instance_iam.go
+++ b/converters/google/resources/compute_instance_iam.go
@@ -106,10 +106,10 @@ func newComputeInstanceIamAsset(
 
 func FetchComputeInstanceIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{zone}}"); !ok {
+	if _, ok := d.GetOk("zone"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
-	if _, ok := d.GetOk("{{instance_name}}"); !ok {
+	if _, ok := d.GetOk("instance_name"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
diff --git a/converters/google/resources/compute_region_disk_iam.go b/converters/google/resources/compute_region_disk_iam.go
index 7c22d444..639d6e08 100644
--- a/converters/google/resources/compute_region_disk_iam.go
+++ b/converters/google/resources/compute_region_disk_iam.go
@@ -106,10 +106,10 @@ func newComputeRegionDiskIamAsset(
 
 func FetchComputeRegionDiskIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{region}}"); !ok {
+	if _, ok := d.GetOk("region"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
-	if _, ok := d.GetOk("{{name}}"); !ok {
+	if _, ok := d.GetOk("name"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
diff --git a/converters/google/resources/compute_subnetwork_iam.go b/converters/google/resources/compute_subnetwork_iam.go
index 426523d6..91e46823 100644
--- a/converters/google/resources/compute_subnetwork_iam.go
+++ b/converters/google/resources/compute_subnetwork_iam.go
@@ -106,10 +106,10 @@ func newComputeSubnetworkIamAsset(
 
 func FetchComputeSubnetworkIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{region}}"); !ok {
+	if _, ok := d.GetOk("region"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
-	if _, ok := d.GetOk("{{subnetwork}}"); !ok {
+	if _, ok := d.GetOk("subnetwork"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
diff --git a/converters/google/resources/data_catalog_entry_group_iam.go b/converters/google/resources/data_catalog_entry_group_iam.go
index 74cf5b99..95c7fc46 100644
--- a/converters/google/resources/data_catalog_entry_group_iam.go
+++ b/converters/google/resources/data_catalog_entry_group_iam.go
@@ -106,10 +106,10 @@ func newDataCatalogEntryGroupIamAsset(
 
 func FetchDataCatalogEntryGroupIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{region}}"); !ok {
+	if _, ok := d.GetOk("region"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
-	if _, ok := d.GetOk("{{entry_group}}"); !ok {
+	if _, ok := d.GetOk("entry_group"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
diff --git a/converters/google/resources/data_catalog_tag_template_iam.go b/converters/google/resources/data_catalog_tag_template_iam.go
index 2faab569..7d3ff16f 100644
--- a/converters/google/resources/data_catalog_tag_template_iam.go
+++ b/converters/google/resources/data_catalog_tag_template_iam.go
@@ -106,10 +106,10 @@ func newDataCatalogTagTemplateIamAsset(
 
 func FetchDataCatalogTagTemplateIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{region}}"); !ok {
+	if _, ok := d.GetOk("region"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
-	if _, ok := d.GetOk("{{tag_template}}"); !ok {
+	if _, ok := d.GetOk("tag_template"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
diff --git a/converters/google/resources/healthcare_consent_store_iam.go b/converters/google/resources/healthcare_consent_store_iam.go
index 7d120b00..3ed902d8 100644
--- a/converters/google/resources/healthcare_consent_store_iam.go
+++ b/converters/google/resources/healthcare_consent_store_iam.go
@@ -106,10 +106,10 @@ func newHealthcareConsentStoreIamAsset(
 
 func FetchHealthcareConsentStoreIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{dataset}}"); !ok {
+	if _, ok := d.GetOk("dataset"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
-	if _, ok := d.GetOk("{{consent_store_id}}"); !ok {
+	if _, ok := d.GetOk("consent_store_id"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
diff --git a/converters/google/resources/iap_tunnel_instance_iam.go b/converters/google/resources/iap_tunnel_instance_iam.go
index baa496f1..925b8e22 100644
--- a/converters/google/resources/iap_tunnel_instance_iam.go
+++ b/converters/google/resources/iap_tunnel_instance_iam.go
@@ -106,10 +106,10 @@ func newIapTunnelInstanceIamAsset(
 
 func FetchIapTunnelInstanceIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{zone}}"); !ok {
+	if _, ok := d.GetOk("zone"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
-	if _, ok := d.GetOk("{{instance}}"); !ok {
+	if _, ok := d.GetOk("instance"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
diff --git a/converters/google/resources/kms_crypto_key_iam.go b/converters/google/resources/kms_crypto_key_iam.go
index 6745960c..b7ed8ab4 100644
--- a/converters/google/resources/kms_crypto_key_iam.go
+++ b/converters/google/resources/kms_crypto_key_iam.go
@@ -1,6 +1,9 @@
 package google
 
-import "fmt"
+import (
+	"fmt"
+	"strings"
+)
 
 func resourceConverterKmsCryptoKeyIamPolicy() ResourceConverter {
 	return ResourceConverter{
@@ -73,7 +76,8 @@ func newKmsCryptoKeyIamAsset(
 		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
 	}
 
-	name, err := assetName(d, config, "//cloudkms.googleapis.com/{{crypto_key_id}}")
+	assetNameTemplate := constructAssetNameTemplate(d)
+	name, err := assetName(d, config, assetNameTemplate)
 	if err != nil {
 		return []Asset{}, err
 	}
@@ -93,12 +97,28 @@ func FetchKmsCryptoKeyIamPolicy(d TerraformResourceData, config *Config) (Asset,
 		return Asset{}, ErrEmptyIdentityField
 	}
 
+	assetNameTemplate := constructAssetNameTemplate(d)
+
 	// We use crypto_key_id in the asset name template to be consistent with newKmsCryptoKeyIamAsset.
 	return fetchIamPolicy(
 		NewKmsCryptoKeyIamUpdater,
 		d,
 		config,
-		"//cloudkms.googleapis.com/{{crypto_key_id}}", // asset name
-		"cloudkms.googleapis.com/CryptoKey",           // asset type
+		assetNameTemplate,                   // asset name
+		"cloudkms.googleapis.com/CryptoKey", // asset type
 	)
 }
+
+func constructAssetNameTemplate(d TerraformResourceData) string {
+	assetNameTemplate := "//cloudkms.googleapis.com/{{crypto_key_id}}"
+	if val, ok := d.GetOk("crypto_key_id"); ok {
+		cryptoKeyID := val.(string)
+		splits := strings.Split(cryptoKeyID, "/")
+		if len(splits) == 4 {
+			assetNameTemplate = fmt.Sprintf("//cloudkms.googleapis.com/projects/%s/locations/%s/keyRings/%s/cryptoKeys/%s", splits[0], splits[1], splits[2], splits[3])
+		} else if len(splits) == 3 {
+			assetNameTemplate = fmt.Sprintf("//cloudkms.googleapis.com/projects/{{project}}/locations/%s/keyRings/%s/cryptoKeys/%s", splits[0], splits[1], splits[2])
+		}
+	}
+	return assetNameTemplate
+}
diff --git a/converters/google/resources/notebooks_instance_iam.go b/converters/google/resources/notebooks_instance_iam.go
index d7e8328d..1f3ea9ba 100644
--- a/converters/google/resources/notebooks_instance_iam.go
+++ b/converters/google/resources/notebooks_instance_iam.go
@@ -106,10 +106,10 @@ func newNotebooksInstanceIamAsset(
 
 func FetchNotebooksInstanceIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{location}}"); !ok {
+	if _, ok := d.GetOk("location"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
-	if _, ok := d.GetOk("{{instance_name}}"); !ok {
+	if _, ok := d.GetOk("instance_name"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
diff --git a/converters/google/resources/notebooks_runtime_iam.go b/converters/google/resources/notebooks_runtime_iam.go
index 01b6a2f4..90b4bed6 100644
--- a/converters/google/resources/notebooks_runtime_iam.go
+++ b/converters/google/resources/notebooks_runtime_iam.go
@@ -106,10 +106,10 @@ func newNotebooksRuntimeIamAsset(
 
 func FetchNotebooksRuntimeIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{location}}"); !ok {
+	if _, ok := d.GetOk("location"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
-	if _, ok := d.GetOk("{{runtime_name}}"); !ok {
+	if _, ok := d.GetOk("runtime_name"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
diff --git a/converters/google/resources/privateca_ca_pool_iam.go b/converters/google/resources/privateca_ca_pool_iam.go
index 0857df11..7723a815 100644
--- a/converters/google/resources/privateca_ca_pool_iam.go
+++ b/converters/google/resources/privateca_ca_pool_iam.go
@@ -106,10 +106,10 @@ func newPrivatecaCaPoolIamAsset(
 
 func FetchPrivatecaCaPoolIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{location}}"); !ok {
+	if _, ok := d.GetOk("location"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
-	if _, ok := d.GetOk("{{ca_pool}}"); !ok {
+	if _, ok := d.GetOk("ca_pool"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
diff --git a/converters/google/resources/pubsub_topic_iam.go b/converters/google/resources/pubsub_topic_iam.go
index 367988d9..8353e7de 100644
--- a/converters/google/resources/pubsub_topic_iam.go
+++ b/converters/google/resources/pubsub_topic_iam.go
@@ -106,7 +106,7 @@ func newPubsubTopicIamAsset(
 
 func FetchPubsubTopicIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{topic}}"); !ok {
+	if _, ok := d.GetOk("topic"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
diff --git a/converters/google/resources/secret_manager_secret_iam.go b/converters/google/resources/secret_manager_secret_iam.go
index 865dfb57..08eae78f 100644
--- a/converters/google/resources/secret_manager_secret_iam.go
+++ b/converters/google/resources/secret_manager_secret_iam.go
@@ -106,7 +106,7 @@ func newSecretManagerSecretIamAsset(
 
 func FetchSecretManagerSecretIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{secret_id}}"); !ok {
+	if _, ok := d.GetOk("secret_id"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
diff --git a/converters/google/resources/service_management_service_iam.go b/converters/google/resources/service_management_service_iam.go
index 2632ca9b..47376683 100644
--- a/converters/google/resources/service_management_service_iam.go
+++ b/converters/google/resources/service_management_service_iam.go
@@ -106,7 +106,7 @@ func newServiceManagementServiceIamAsset(
 
 func FetchServiceManagementServiceIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{service_name}}"); !ok {
+	if _, ok := d.GetOk("service_name"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 


Test patch:
diff --git a/converters/google/resources/binary_authorization_attestor_iam.go b/converters/google/resources/binary_authorization_attestor_iam.go
index f01709d3..fb6c8e3b 100644
--- a/converters/google/resources/binary_authorization_attestor_iam.go
+++ b/converters/google/resources/binary_authorization_attestor_iam.go
@@ -106,7 +106,7 @@ func newBinaryAuthorizationAttestorIamAsset(
 
 func FetchBinaryAuthorizationAttestorIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{attestor}}"); !ok {
+	if _, ok := d.GetOk("attestor"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
diff --git a/testdata/templates/example_kms_crypto_key_iam_binding.json b/testdata/templates/example_kms_crypto_key_iam_binding.json
index 7e6c4d9a..cd765e5b 100644
--- a/testdata/templates/example_kms_crypto_key_iam_binding.json
+++ b/testdata/templates/example_kms_crypto_key_iam_binding.json
@@ -1,44 +1,27 @@
 [
-	{
-		"name": "//cloudkms.googleapis.com/placeholder-BpLnfgDs/cryptoKeys/crypto-key-example",
-		"asset_type": "cloudkms.googleapis.com/CryptoKey",
-		"ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
-		"resource": {
-			"version": "v1",
-			"discovery_document_uri": "https://www.googleapis.com/discovery/v1/apis/cloudkms/v1/rest",
-			"discovery_name": "CryptoKey",
-			"parent": "//cloudresourcemanager.googleapis.com/projects/{{.Provider.project}}",
-			"data": {
-				"purpose": "ENCRYPT_DECRYPT"
-			}
-		}
-	},
-	{
-		"name": "//cloudkms.googleapis.com/placeholder-c2WD8F2q",
-		"asset_type": "cloudkms.googleapis.com/CryptoKey",
-		"ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
-		"iam_policy": {
-			"bindings": [
-				{
-					"role": "roles/cloudkms.admin",
-					"members": [
-						"allUsers",
-						"allAuthenticatedUsers"
-					]
-				}
-			]
-		}
-	},
-	{
-		"name": "//cloudkms.googleapis.com/projects/{{.Provider.project}}/locations/global/keyRings/keyring-example",
-		"asset_type": "cloudkms.googleapis.com/KeyRing",
-		"ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
-		"resource": {
-			"version": "v1",
-			"discovery_document_uri": "https://www.googleapis.com/discovery/v1/apis/cloudkms/v1/rest",
-			"discovery_name": "KeyRing",
-			"parent": "//cloudresourcemanager.googleapis.com/projects/{{.Provider.project}}",
-			"data": null
-		}
-	}
-]
\ No newline at end of file
+  {
+    "name": "//cloudkms.googleapis.com/projects/{{.Provider.project}}/locations/global/keyRings/keyring-example/cryptoKeys/crypto-key-example",
+    "asset_type": "cloudkms.googleapis.com/CryptoKey",
+    "ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
+    "resource": {
+      "version": "v1",
+      "discovery_document_uri": "https://www.googleapis.com/discovery/v1/apis/cloudkms/v1/rest",
+      "discovery_name": "CryptoKey",
+      "parent": "//cloudresourcemanager.googleapis.com/projects/{{.Provider.project}}",
+      "data": {
+        "purpose": "ENCRYPT_DECRYPT"
+      }
+    },
+    "iam_policy": {
+      "bindings": [
+        {
+          "role": "roles/cloudkms.admin",
+          "members": [
+            "allUsers",
+            "allAuthenticatedUsers"
+          ]
+        }
+      ]
+    }
+  }
+]
diff --git a/testdata/templates/example_kms_crypto_key_iam_binding.tf b/testdata/templates/example_kms_crypto_key_iam_binding.tf
index a66c3cb9..56ce6fc1 100644
--- a/testdata/templates/example_kms_crypto_key_iam_binding.tf
+++ b/testdata/templates/example_kms_crypto_key_iam_binding.tf
@@ -27,19 +27,13 @@ provider "google" {
   {{if .Provider.credentials }}credentials = "{{.Provider.credentials}}"{{end}}
 }
 
-resource "google_kms_key_ring" "example_keyring" {
-  name     = "keyring-example"
-  location = "global"
-  project  = "{{.Provider.project}}"
-}
-
 resource "google_kms_crypto_key" "example_crypto_key" {
   name     = "crypto-key-example"
-  key_ring = google_kms_key_ring.example_keyring.id
+  key_ring = "projects/{{.Provider.project}}/locations/global/keyRings/keyring-example"
 }
 
 resource "google_kms_crypto_key_iam_binding" "crypto_key" {
-  crypto_key_id = google_kms_crypto_key.example_crypto_key.id
+  crypto_key_id = "{{.Provider.project}}/global/keyring-example/crypto-key-example"
   role          = "roles/cloudkms.admin"
   members = [
     "allUsers", "allAuthenticatedUsers"
diff --git a/testdata/templates/example_kms_crypto_key_iam_binding.tfplan.json b/testdata/templates/example_kms_crypto_key_iam_binding.tfplan.json
index 4670182a..2942be72 100644
--- a/testdata/templates/example_kms_crypto_key_iam_binding.tfplan.json
+++ b/testdata/templates/example_kms_crypto_key_iam_binding.tfplan.json
@@ -1,183 +1,171 @@
 {
-	"format_version": "0.1",
-	"terraform_version": "0.12.31",
-	"planned_values": {
-		"root_module": {
-			"resources": [{
-				"address": "google_kms_crypto_key.example_crypto_key",
-				"mode": "managed",
-				"type": "google_kms_crypto_key",
-				"name": "example_crypto_key",
-				"provider_name": "google",
-				"schema_version": 1,
-				"values": {
-					"labels": null,
-					"name": "crypto-key-example",
-					"purpose": "ENCRYPT_DECRYPT",
-					"rotation_period": null,
-					"skip_initial_version_creation": null,
-					"timeouts": null
-				}
-			}, {
-				"address": "google_kms_crypto_key_iam_binding.crypto_key",
-				"mode": "managed",
-				"type": "google_kms_crypto_key_iam_binding",
-				"name": "crypto_key",
-				"provider_name": "google",
-				"schema_version": 0,
-				"values": {
-					"condition": [],
-					"members": ["allAuthenticatedUsers", "allUsers"],
-					"role": "roles/cloudkms.admin"
-				}
-			}, {
-				"address": "google_kms_key_ring.example_keyring",
-				"mode": "managed",
-				"type": "google_kms_key_ring",
-				"name": "example_keyring",
-				"provider_name": "google",
-				"schema_version": 0,
-				"values": {
-					"location": "global",
-					"name": "keyring-example",
-					"project": "{{.Provider.project}}",
-					"timeouts": null
-				}
-			}]
-		}
-	},
-	"resource_changes": [{
-		"address": "google_kms_crypto_key.example_crypto_key",
-		"mode": "managed",
-		"type": "google_kms_crypto_key",
-		"name": "example_crypto_key",
-		"provider_name": "google",
-		"change": {
-			"actions": ["create"],
-			"before": null,
-			"after": {
-				"labels": null,
-				"name": "crypto-key-example",
-				"purpose": "ENCRYPT_DECRYPT",
-				"rotation_period": null,
-				"skip_initial_version_creation": null,
-				"timeouts": null
-			},
-			"after_unknown": {
-				"destroy_scheduled_duration": true,
-				"id": true,
-				"key_ring": true,
-				"self_link": true,
-				"version_template": true
-			}
-		}
-	}, {
-		"address": "google_kms_crypto_key_iam_binding.crypto_key",
-		"mode": "managed",
-		"type": "google_kms_crypto_key_iam_binding",
-		"name": "crypto_key",
-		"provider_name": "google",
-		"change": {
-			"actions": ["create"],
-			"before": null,
-			"after": {
-				"condition": [],
-				"members": ["allAuthenticatedUsers", "allUsers"],
-				"role": "roles/cloudkms.admin"
-			},
-			"after_unknown": {
-				"condition": [],
-				"crypto_key_id": true,
-				"etag": true,
-				"id": true,
-				"members": [false, false]
-			}
-		}
-	}, {
-		"address": "google_kms_key_ring.example_keyring",
-		"mode": "managed",
-		"type": "google_kms_key_ring",
-		"name": "example_keyring",
-		"provider_name": "google",
-		"change": {
-			"actions": ["create"],
-			"before": null,
-			"after": {
-				"location": "global",
-				"name": "keyring-example",
-				"project": "{{.Provider.project}}",
-				"timeouts": null
-			},
-			"after_unknown": {
-				"id": true,
-				"self_link": true
-			}
-		}
-	}],
-	"configuration": {
-		"provider_config": {
-			"google": {
-				"name": "google",
-				"expressions": {
-					"credentials": {
-						"constant_value": "{{.Provider.project}}"
-					}
-				}
-			}
-		},
-		"root_module": {
-			"resources": [{
-				"address": "google_kms_crypto_key.example_crypto_key",
-				"mode": "managed",
-				"type": "google_kms_crypto_key",
-				"name": "example_crypto_key",
-				"provider_config_key": "google",
-				"expressions": {
-					"key_ring": {
-						"references": ["google_kms_key_ring.example_keyring"]
-					},
-					"name": {
-						"constant_value": "crypto-key-example"
-					}
-				},
-				"schema_version": 1
-			}, {
-				"address": "google_kms_crypto_key_iam_binding.crypto_key",
-				"mode": "managed",
-				"type": "google_kms_crypto_key_iam_binding",
-				"name": "crypto_key",
-				"provider_config_key": "google",
-				"expressions": {
-					"crypto_key_id": {
-						"references": ["google_kms_crypto_key.example_crypto_key"]
-					},
-					"members": {
-						"constant_value": ["allUsers", "allAuthenticatedUsers"]
-					},
-					"role": {
-						"constant_value": "roles/cloudkms.admin"
-					}
-				},
-				"schema_version": 0
-			}, {
-				"address": "google_kms_key_ring.example_keyring",
-				"mode": "managed",
-				"type": "google_kms_key_ring",
-				"name": "example_keyring",
-				"provider_config_key": "google",
-				"expressions": {
-					"location": {
-						"constant_value": "global"
-					},
-					"name": {
-						"constant_value": "keyring-example"
-					},
-					"project": {
-						"constant_value": "{{.Provider.project}}"
-					}
-				},
-				"schema_version": 0
-			}]
-		}
-	}
+  "format_version": "0.2",
+  "terraform_version": "1.0.10",
+  "planned_values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_kms_crypto_key.example_crypto_key",
+          "mode": "managed",
+          "type": "google_kms_crypto_key",
+          "name": "example_crypto_key",
+          "provider_name": "registry.terraform.io/hashicorp/google",
+          "schema_version": 1,
+          "values": {
+            "key_ring": "projects/{{.Provider.project}}/locations/global/keyRings/keyring-example",
+            "labels": null,
+            "name": "crypto-key-example",
+            "purpose": "ENCRYPT_DECRYPT",
+            "rotation_period": null,
+            "skip_initial_version_creation": null,
+            "timeouts": null
+          },
+          "sensitive_values": {
+            "version_template": []
+          }
+        },
+        {
+          "address": "google_kms_crypto_key_iam_binding.crypto_key",
+          "mode": "managed",
+          "type": "google_kms_crypto_key_iam_binding",
+          "name": "crypto_key",
+          "provider_name": "registry.terraform.io/hashicorp/google",
+          "schema_version": 0,
+          "values": {
+            "condition": [],
+            "crypto_key_id": "{{.Provider.project}}/global/keyring-example/crypto-key-example",
+            "members": [
+              "allAuthenticatedUsers",
+              "allUsers"
+            ],
+            "role": "roles/cloudkms.admin"
+          },
+          "sensitive_values": {
+            "condition": [],
+            "members": [
+              false,
+              false
+            ]
+          }
+        }
+      ]
+    }
+  },
+  "resource_changes": [
+    {
+      "address": "google_kms_crypto_key.example_crypto_key",
+      "mode": "managed",
+      "type": "google_kms_crypto_key",
+      "name": "example_crypto_key",
+      "provider_name": "registry.terraform.io/hashicorp/google",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "key_ring": "projects/{{.Provider.project}}/locations/global/keyRings/keyring-example",
+          "labels": null,
+          "name": "crypto-key-example",
+          "purpose": "ENCRYPT_DECRYPT",
+          "rotation_period": null,
+          "skip_initial_version_creation": null,
+          "timeouts": null
+        },
+        "after_unknown": {
+          "destroy_scheduled_duration": true,
+          "id": true,
+          "import_only": true,
+          "version_template": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "version_template": []
+        }
+      }
+    },
+    {
+      "address": "google_kms_crypto_key_iam_binding.crypto_key",
+      "mode": "managed",
+      "type": "google_kms_crypto_key_iam_binding",
+      "name": "crypto_key",
+      "provider_name": "registry.terraform.io/hashicorp/google",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "condition": [],
+          "crypto_key_id": "{{.Provider.project}}/global/keyring-example/crypto-key-example",
+          "members": [
+            "allAuthenticatedUsers",
+            "allUsers"
+          ],
+          "role": "roles/cloudkms.admin"
+        },
+        "after_unknown": {
+          "condition": [],
+          "etag": true,
+          "id": true,
+          "members": [
+            false,
+            false
+          ]
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "condition": [],
+          "members": [
+            false,
+            false
+          ]
+        }
+      }
+    }
+  ],
+  "configuration": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_kms_crypto_key.example_crypto_key",
+          "mode": "managed",
+          "type": "google_kms_crypto_key",
+          "name": "example_crypto_key",
+          "provider_config_key": "google",
+          "expressions": {
+            "key_ring": {
+              "constant_value": "projects/{{.Provider.project}}/locations/global/keyRings/keyring-example"
+            },
+            "name": {
+              "constant_value": "crypto-key-example"
+            }
+          },
+          "schema_version": 1
+        },
+        {
+          "address": "google_kms_crypto_key_iam_binding.crypto_key",
+          "mode": "managed",
+          "type": "google_kms_crypto_key_iam_binding",
+          "name": "crypto_key",
+          "provider_config_key": "google",
+          "expressions": {
+            "crypto_key_id": {
+              "constant_value": "{{.Provider.project}}/global/keyring-example/crypto-key-example"
+            },
+            "members": {
+              "constant_value": [
+                "allUsers",
+                "allAuthenticatedUsers"
+              ]
+            },
+            "role": {
+              "constant_value": "roles/cloudkms.admin"
+            }
+          },
+          "schema_version": 0
+        }
+      ]
+    }
+  }
 }
diff --git a/testdata/templates/example_kms_crypto_key_iam_member.json b/testdata/templates/example_kms_crypto_key_iam_member.json
index aff1e5fe..f743cc71 100644
--- a/testdata/templates/example_kms_crypto_key_iam_member.json
+++ b/testdata/templates/example_kms_crypto_key_iam_member.json
@@ -1,43 +1,26 @@
 [
-    {
-        "name": "//cloudkms.googleapis.com/placeholder-BpLnfgDs/cryptoKeys/crypto-key-example",
-        "asset_type": "cloudkms.googleapis.com/CryptoKey",
-        "ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
-        "resource": {
-            "version": "v1",
-            "discovery_document_uri": "https://www.googleapis.com/discovery/v1/apis/cloudkms/v1/rest",
-            "discovery_name": "CryptoKey",
-            "parent": "//cloudresourcemanager.googleapis.com/projects/{{.Provider.project}}",
-            "data": {
-                "purpose": "ENCRYPT_DECRYPT"
-            }
-        }
-    },
-    {
-        "name": "//cloudkms.googleapis.com/placeholder-c2WD8F2q",
-        "asset_type": "cloudkms.googleapis.com/CryptoKey",
-        "ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
-        "iam_policy": {
-            "bindings": [
-                {
-                    "role": "roles/cloudkms.admin",
-                    "members": [
-                        "allAuthenticatedUsers"
-                    ]
-                }
-            ]
-        }
+  {
+    "name": "//cloudkms.googleapis.com/projects/{{.Provider.project}}/locations/global/keyRings/keyring-example/cryptoKeys/crypto-key-example",
+    "asset_type": "cloudkms.googleapis.com/CryptoKey",
+    "ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
+    "resource": {
+      "version": "v1",
+      "discovery_document_uri": "https://www.googleapis.com/discovery/v1/apis/cloudkms/v1/rest",
+      "discovery_name": "CryptoKey",
+      "parent": "//cloudresourcemanager.googleapis.com/projects/{{.Provider.project}}",
+      "data": {
+        "purpose": "ENCRYPT_DECRYPT"
+      }
     },
-    {
-        "name": "//cloudkms.googleapis.com/projects/{{.Provider.project}}/locations/global/keyRings/keyring-example",
-        "asset_type": "cloudkms.googleapis.com/KeyRing",
-        "ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
-        "resource": {
-            "version": "v1",
-            "discovery_document_uri": "https://www.googleapis.com/discovery/v1/apis/cloudkms/v1/rest",
-            "discovery_name": "KeyRing",
-            "parent": "//cloudresourcemanager.googleapis.com/projects/{{.Provider.project}}",
-            "data": null
+    "iam_policy": {
+      "bindings": [
+        {
+          "role": "roles/cloudkms.admin",
+          "members": [
+            "allAuthenticatedUsers"
+          ]
         }
+      ]
     }
-]
\ No newline at end of file
+  }
+]
diff --git a/testdata/templates/example_kms_crypto_key_iam_member.tf b/testdata/templates/example_kms_crypto_key_iam_member.tf
index 02d07e5a..011241ad 100644
--- a/testdata/templates/example_kms_crypto_key_iam_member.tf
+++ b/testdata/templates/example_kms_crypto_key_iam_member.tf
@@ -27,19 +27,13 @@ provider "google" {
   {{if .Provider.credentials }}credentials = "{{.Provider.credentials}}"{{end}}
 }
 
-resource "google_kms_key_ring" "example_keyring" {
-  name     = "keyring-example"
-  location = "global"
-  project  = "{{.Provider.project}}"
-}
-
 resource "google_kms_crypto_key" "example_crypto_key" {
   name     = "crypto-key-example"
-  key_ring = google_kms_key_ring.example_keyring.id
+  key_ring = "projects/{{.Provider.project}}/locations/global/keyRings/keyring-example"
 }
 
 resource "google_kms_crypto_key_iam_member" "crypto_key" {
-  crypto_key_id = google_kms_crypto_key.example_crypto_key.id
+  crypto_key_id = "global/keyring-example/crypto-key-example"
   role          = "roles/cloudkms.admin"
   member        = "allAuthenticatedUsers"
 }
diff --git a/testdata/templates/example_kms_crypto_key_iam_member.tfplan.json b/testdata/templates/example_kms_crypto_key_iam_member.tfplan.json
index 8018c7d0..c3075bf1 100644
--- a/testdata/templates/example_kms_crypto_key_iam_member.tfplan.json
+++ b/testdata/templates/example_kms_crypto_key_iam_member.tfplan.json
@@ -1,191 +1,150 @@
 {
-	"format_version": "0.1",
-	"terraform_version": "0.12.31",
-	"planned_values": {
-		"root_module": {
-			"resources": [{
-				"address": "google_kms_crypto_key.example_crypto_key",
-				"mode": "managed",
-				"type": "google_kms_crypto_key",
-				"name": "example_crypto_key",
-				"provider_name": "google",
-				"schema_version": 1,
-				"values": {
-					"labels": null,
-					"name": "crypto-key-example",
-					"purpose": "ENCRYPT_DECRYPT",
-					"rotation_period": null,
-					"skip_initial_version_creation": false,
-					"timeouts": null
-				}
-			}, {
-				"address": "google_kms_crypto_key_iam_member.crypto_key",
-				"mode": "managed",
-				"type": "google_kms_crypto_key_iam_member",
-				"name": "crypto_key",
-				"provider_name": "google",
-				"schema_version": 0,
-				"values": {
-					"condition": [],
-					"member": "allAuthenticatedUsers",
-					"role": "roles/cloudkms.admin"
-				}
-			}, {
-				"address": "google_kms_key_ring.example_keyring",
-				"mode": "managed",
-				"type": "google_kms_key_ring",
-				"name": "example_keyring",
-				"provider_name": "google",
-				"schema_version": 0,
-				"values": {
-					"location": "global",
-					"name": "keyring-example",
-					"project": "{{.Provider.project}}",
-					"timeouts": null
-				}
-			}]
-		}
-	},
-	"resource_changes": [{
-		"address": "google_kms_crypto_key.example_crypto_key",
-		"mode": "managed",
-		"type": "google_kms_crypto_key",
-		"name": "example_crypto_key",
-		"provider_name": "google",
-		"change": {
-			"actions": ["create"],
-			"before": null,
-			"after": {
-				"labels": null,
-				"name": "crypto-key-example",
-				"purpose": "ENCRYPT_DECRYPT",
-				"rotation_period": null,
-				"skip_initial_version_creation": false,
-				"timeouts": null
-			},
-			"after_unknown": {
-				"id": true,
-				"key_ring": true,
-				"self_link": true,
-				"version_template": true
-			},
-			"before_sensitive": false,
-			"after_sensitive": {
-				"version_template": []
-			}
-		}
-	}, {
-		"address": "google_kms_crypto_key_iam_member.crypto_key",
-		"mode": "managed",
-		"type": "google_kms_crypto_key_iam_member",
-		"name": "crypto_key",
-		"provider_name": "google",
-		"change": {
-			"actions": ["create"],
-			"before": null,
-			"after": {
-				"condition": [],
-				"member": "allAuthenticatedUsers",
-				"role": "roles/cloudkms.admin"
-			},
-			"after_unknown": {
-				"condition": [],
-				"crypto_key_id": true,
-				"etag": true,
-				"id": true
-			},
-			"before_sensitive": false,
-			"after_sensitive": {
-				"condition": []
-			}
-		}
-	}, {
-		"address": "google_kms_key_ring.example_keyring",
-		"mode": "managed",
-		"type": "google_kms_key_ring",
-		"name": "example_keyring",
-		"provider_name": "google",
-		"change": {
-			"actions": ["create"],
-			"before": null,
-			"after": {
-				"location": "global",
-				"name": "keyring-example",
-				"project": "{{.Provider.project}}",
-				"timeouts": null
-			},
-			"after_unknown": {
-				"id": true,
-				"self_link": true
-			},
-			"before_sensitive": false,
-			"after_sensitive": {}
-		}
-	}],
-	"configuration": {
-		"provider_config": {
-            "google": {
-                "name": "google",
-                "expressions": {
-                    "project": {
-                        "constant_value": "{{.Provider.project}}"
-                    }
-                }
+  "format_version": "0.2",
+  "terraform_version": "1.0.10",
+  "planned_values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_kms_crypto_key.example_crypto_key",
+          "mode": "managed",
+          "type": "google_kms_crypto_key",
+          "name": "example_crypto_key",
+          "provider_name": "registry.terraform.io/hashicorp/google",
+          "schema_version": 1,
+          "values": {
+            "key_ring": "projects/{{.Provider.project}}/locations/global/keyRings/keyring-example",
+            "labels": null,
+            "name": "crypto-key-example",
+            "purpose": "ENCRYPT_DECRYPT",
+            "rotation_period": null,
+            "skip_initial_version_creation": null,
+            "timeouts": null
+          },
+          "sensitive_values": {
+            "version_template": []
+          }
+        },
+        {
+          "address": "google_kms_crypto_key_iam_member.crypto_key",
+          "mode": "managed",
+          "type": "google_kms_crypto_key_iam_member",
+          "name": "crypto_key",
+          "provider_name": "registry.terraform.io/hashicorp/google",
+          "schema_version": 0,
+          "values": {
+            "condition": [],
+            "crypto_key_id": "global/keyring-example/crypto-key-example",
+            "member": "allAuthenticatedUsers",
+            "role": "roles/cloudkms.admin"
+          },
+          "sensitive_values": {
+            "condition": []
+          }
+        }
+      ]
+    }
+  },
+  "resource_changes": [
+    {
+      "address": "google_kms_crypto_key.example_crypto_key",
+      "mode": "managed",
+      "type": "google_kms_crypto_key",
+      "name": "example_crypto_key",
+      "provider_name": "registry.terraform.io/hashicorp/google",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "key_ring": "projects/{{.Provider.project}}/locations/global/keyRings/keyring-example",
+          "labels": null,
+          "name": "crypto-key-example",
+          "purpose": "ENCRYPT_DECRYPT",
+          "rotation_period": null,
+          "skip_initial_version_creation": null,
+          "timeouts": null
+        },
+        "after_unknown": {
+          "destroy_scheduled_duration": true,
+          "id": true,
+          "import_only": true,
+          "version_template": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "version_template": []
+        }
+      }
+    },
+    {
+      "address": "google_kms_crypto_key_iam_member.crypto_key",
+      "mode": "managed",
+      "type": "google_kms_crypto_key_iam_member",
+      "name": "crypto_key",
+      "provider_name": "registry.terraform.io/hashicorp/google",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "condition": [],
+          "crypto_key_id": "global/keyring-example/crypto-key-example",
+          "member": "allAuthenticatedUsers",
+          "role": "roles/cloudkms.admin"
+        },
+        "after_unknown": {
+          "condition": [],
+          "etag": true,
+          "id": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "condition": []
+        }
+      }
+    }
+  ],
+  "configuration": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_kms_crypto_key.example_crypto_key",
+          "mode": "managed",
+          "type": "google_kms_crypto_key",
+          "name": "example_crypto_key",
+          "provider_config_key": "google",
+          "expressions": {
+            "key_ring": {
+              "constant_value": "projects/{{.Provider.project}}/locations/global/keyRings/keyring-example"
+            },
+            "name": {
+              "constant_value": "crypto-key-example"
             }
-		},
-		"root_module": {
-			"resources": [{
-				"address": "google_kms_crypto_key.example_crypto_key",
-				"mode": "managed",
-				"type": "google_kms_crypto_key",
-				"name": "example_crypto_key",
-				"provider_config_key": "google",
-				"expressions": {
-					"key_ring": {
-						"references": ["google_kms_key_ring.example_keyring"]
-					},
-					"name": {
-						"constant_value": "crypto-key-example"
-					}
-				},
-				"schema_version": 1
-			}, {
-				"address": "google_kms_crypto_key_iam_member.crypto_key",
-				"mode": "managed",
-				"type": "google_kms_crypto_key_iam_member",
-				"name": "crypto_key",
-				"provider_config_key": "google",
-				"expressions": {
-					"crypto_key_id": {
-						"references": ["google_kms_crypto_key.example_crypto_key"]
-					},
-					"member": {
-						"constant_value": "allAuthenticatedUsers"
-					},
-					"role": {
-						"constant_value": "roles/cloudkms.admin"
-					}
-				},
-				"schema_version": 0
-			}, {
-				"address": "google_kms_key_ring.example_keyring",
-				"mode": "managed",
-				"type": "google_kms_key_ring",
-				"name": "example_keyring",
-				"provider_config_key": "google",
-				"expressions": {
-					"location": {
-						"constant_value": "global"
-					},
-					"name": {
-						"constant_value": "keyring-example"
-					},
-					"project": {
-						"constant_value": "{{.Provider.project}}"
-					}
-				},
-				"schema_version": 0
-			}]
-		}
-	}
+          },
+          "schema_version": 1
+        },
+        {
+          "address": "google_kms_crypto_key_iam_member.crypto_key",
+          "mode": "managed",
+          "type": "google_kms_crypto_key_iam_member",
+          "name": "crypto_key",
+          "provider_config_key": "google",
+          "expressions": {
+            "crypto_key_id": {
+              "constant_value": "global/keyring-example/crypto-key-example"
+            },
+            "member": {
+              "constant_value": "allAuthenticatedUsers"
+            },
+            "role": {
+              "constant_value": "roles/cloudkms.admin"
+            }
+          },
+          "schema_version": 0
+        }
+      ]
+    }
+  }
 }
diff --git a/testdata/templates/example_kms_crypto_key_iam_policy.json b/testdata/templates/example_kms_crypto_key_iam_policy.json
index ef39bbfd..64c09c1b 100644
--- a/testdata/templates/example_kms_crypto_key_iam_policy.json
+++ b/testdata/templates/example_kms_crypto_key_iam_policy.json
@@ -1,44 +1,27 @@
 [
-	{
-		"name": "//cloudkms.googleapis.com/placeholder-BpLnfgDs/cryptoKeys/crypto-key-example",
-		"asset_type": "cloudkms.googleapis.com/CryptoKey",
-		"ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
-		"resource": {
-			"version": "v1",
-			"discovery_document_uri": "https://www.googleapis.com/discovery/v1/apis/cloudkms/v1/rest",
-			"discovery_name": "CryptoKey",
-			"parent": "//cloudresourcemanager.googleapis.com/projects/{{.Provider.project}}",
-			"data": {
-				"purpose": "ENCRYPT_DECRYPT"
-			}
-		}
-	},
-	{
-		"name": "//cloudkms.googleapis.com/placeholder-c2WD8F2q",
-		"asset_type": "cloudkms.googleapis.com/CryptoKey",
-		"ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
-		"iam_policy": {
-			"bindings": [
-                {
-                    "role": "roles/cloudkms.admin",
-                    "members": [
-                        "allAuthenticatedUsers",
-						"serviceAccount:998476993360@cloudservices.gserviceaccount.com"
-                    ]
-                }
-            ]
-		}
-	},
-	{
-		"name": "//cloudkms.googleapis.com/projects/{{.Provider.project}}/locations/global/keyRings/keyring-example",
-		"asset_type": "cloudkms.googleapis.com/KeyRing",
-		"ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
-		"resource": {
-			"version": "v1",
-			"discovery_document_uri": "https://www.googleapis.com/discovery/v1/apis/cloudkms/v1/rest",
-			"discovery_name": "KeyRing",
-			"parent": "//cloudresourcemanager.googleapis.com/projects/{{.Provider.project}}",
-			"data": null
-		}
-	}
-]
\ No newline at end of file
+  {
+    "name": "//cloudkms.googleapis.com/projects/{{.Provider.project}}/locations/global/keyRings/keyring-example/cryptoKeys/crypto-key-example",
+    "asset_type": "cloudkms.googleapis.com/CryptoKey",
+    "ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
+    "resource": {
+      "version": "v1",
+      "discovery_document_uri": "https://www.googleapis.com/discovery/v1/apis/cloudkms/v1/rest",
+      "discovery_name": "CryptoKey",
+      "parent": "//cloudresourcemanager.googleapis.com/projects/{{.Provider.project}}",
+      "data": {
+        "purpose": "ENCRYPT_DECRYPT"
+      }
+    },
+    "iam_policy": {
+      "bindings": [
+        {
+          "role": "roles/cloudkms.admin",
+          "members": [
+            "allAuthenticatedUsers",
+            "serviceAccount:998476993360@cloudservices.gserviceaccount.com"
+          ]
+        }
+      ]
+    }
+  }
+]
diff --git a/testdata/templates/example_kms_crypto_key_iam_policy.tf b/testdata/templates/example_kms_crypto_key_iam_policy.tf
index 5b43dc48..b10e12f3 100644
--- a/testdata/templates/example_kms_crypto_key_iam_policy.tf
+++ b/testdata/templates/example_kms_crypto_key_iam_policy.tf
@@ -27,19 +27,13 @@ provider "google" {
   {{if .Provider.credentials }}credentials = "{{.Provider.credentials}}"{{end}}
 }
 
-resource "google_kms_key_ring" "example_keyring" {
-  name     = "keyring-example"
-  location = "global"
-  project  = "{{.Provider.project}}"
-}
-
 resource "google_kms_crypto_key" "example_crypto_key" {
   name     = "crypto-key-example"
-  key_ring = google_kms_key_ring.example_keyring.id
+  key_ring = "projects/{{.Provider.project}}/locations/global/keyRings/keyring-example"
 }
 
 resource "google_kms_crypto_key_iam_policy" "crypto_key" {
-  crypto_key_id = google_kms_crypto_key.example_crypto_key.id
+  crypto_key_id = "global/keyring-example/crypto-key-example"
   policy_data = jsonencode(
     {
       bindings = [
diff --git a/testdata/templates/example_kms_crypto_key_iam_policy.tfplan.json b/testdata/templates/example_kms_crypto_key_iam_policy.tfplan.json
index 65d16b92..43f28a43 100644
--- a/testdata/templates/example_kms_crypto_key_iam_policy.tfplan.json
+++ b/testdata/templates/example_kms_crypto_key_iam_policy.tfplan.json
@@ -1,201 +1,136 @@
 {
-    "format_version": "0.1",
-    "terraform_version": "0.12.31",
-    "planned_values": {
-        "root_module": {
-            "resources": [ 
-                {
-                    "address": "google_kms_crypto_key_iam_policy.crypto_key",
-                    "mode": "managed",
-                    "type": "google_kms_crypto_key_iam_policy",
-                    "name": "crypto_key",
-                    "provider_name": "google",
-                    "schema_version": 0,
-                    "values": {
-                        "policy_data": "{\"bindings\":[{\"members\":[\"allAuthenticatedUsers\",\"serviceAccount:998476993360@cloudservices.gserviceaccount.com\"],\"role\":\"roles/cloudkms.admin\"}]}"
-                    }
-                },
-                {
-                    "address": "google_kms_crypto_key.example_crypto_key",
-                    "mode": "managed",
-                    "type": "google_kms_crypto_key",
-                    "name": "example_crypto_key",
-                    "provider_name": "google",
-                    "schema_version": 1,
-                    "values": {
-                        "labels": null,
-                        "name": "crypto-key-example",
-                        "purpose": "ENCRYPT_DECRYPT",
-                        "rotation_period": null,
-                        "skip_initial_version_creation": false,
-                        "timeouts": null
-                    }
-                },
-                {
-                    "address": "google_kms_key_ring.example_keyring",
-                    "mode": "managed",
-                    "type": "google_kms_key_ring",
-                    "name": "example_keyring",
-                    "provider_name": "google",
-                    "schema_version": 0,
-                    "values": {
-                        "location": "global",
-                        "name": "keyring-example",
-                        "project": "{{.Provider.project}}",
-                        "timeouts": null
-                    }
-                }
-            ]
-        }
-    },
-    "resource_changes": [
+  "format_version": "0.2",
+  "terraform_version": "1.0.10",
+  "planned_values": {
+    "root_module": {
+      "resources": [
         {
-            "address": "google_kms_crypto_key_iam_policy.crypto_key",
-            "mode": "managed",
-            "type": "google_kms_crypto_key_iam_policy",
-            "name": "crypto_key",
-            "provider_name": "google",
-            "change": {
-                "actions": [
-                    "create"
-                ],
-                "before": null,
-                "after": {
-                    "policy_data": "{\"bindings\":[{\"members\":[\"allAuthenticatedUsers\",\"serviceAccount:998476993360@cloudservices.gserviceaccount.com\"],\"role\":\"roles/cloudkms.admin\"}]}"
-                },
-                "after_unknown": {
-                    "crypto_key_id": true,
-                    "etag": true,
-                    "id": true
-                },
-                "before_sensitive": false,
-                "after_sensitive": {}
-            }
+          "address": "google_kms_crypto_key.example_crypto_key",
+          "mode": "managed",
+          "type": "google_kms_crypto_key",
+          "name": "example_crypto_key",
+          "provider_name": "registry.terraform.io/hashicorp/google",
+          "schema_version": 1,
+          "values": {
+            "key_ring": "projects/{{.Provider.project}}/locations/global/keyRings/keyring-example",
+            "labels": null,
+            "name": "crypto-key-example",
+            "purpose": "ENCRYPT_DECRYPT",
+            "rotation_period": null,
+            "skip_initial_version_creation": null,
+            "timeouts": null
+          },
+          "sensitive_values": {
+            "version_template": []
+          }
         },
         {
-            "address": "google_kms_crypto_key.example_crypto_key",
-            "mode": "managed",
-            "type": "google_kms_crypto_key",
-            "name": "example_crypto_key",
-            "provider_name": "google",
-            "change": {
-                "actions": [
-                    "create"
-                ],
-                "before": null,
-                "after": {
-                    "labels": null,
-                    "name": "crypto-key-example",
-                    "purpose": "ENCRYPT_DECRYPT",
-                    "rotation_period": null,
-                    "skip_initial_version_creation": false,
-                    "timeouts": null
-                },
-                "after_unknown": {
-                    "id": true,
-                    "key_ring": true,
-                    "self_link": true,
-                    "version_template": true
-                },
-                "before_sensitive": false,
-                "after_sensitive": {
-                    "version_template": []
-                }
-            }
+          "address": "google_kms_crypto_key_iam_policy.crypto_key",
+          "mode": "managed",
+          "type": "google_kms_crypto_key_iam_policy",
+          "name": "crypto_key",
+          "provider_name": "registry.terraform.io/hashicorp/google",
+          "schema_version": 0,
+          "values": {
+            "crypto_key_id": "global/keyring-example/crypto-key-example",
+            "policy_data": "{\"bindings\":[{\"members\":[\"allAuthenticatedUsers\",\"serviceAccount:998476993360@cloudservices.gserviceaccount.com\"],\"role\":\"roles/cloudkms.admin\"}]}"
+          },
+          "sensitive_values": {}
+        }
+      ]
+    }
+  },
+  "resource_changes": [
+    {
+      "address": "google_kms_crypto_key.example_crypto_key",
+      "mode": "managed",
+      "type": "google_kms_crypto_key",
+      "name": "example_crypto_key",
+      "provider_name": "registry.terraform.io/hashicorp/google",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "key_ring": "projects/{{.Provider.project}}/locations/global/keyRings/keyring-example",
+          "labels": null,
+          "name": "crypto-key-example",
+          "purpose": "ENCRYPT_DECRYPT",
+          "rotation_period": null,
+          "skip_initial_version_creation": null,
+          "timeouts": null
         },
-        {
-            "address": "google_kms_key_ring.example_keyring",
-            "mode": "managed",
-            "type": "google_kms_key_ring",
-            "name": "example_keyring",
-            "provider_name": "google",
-            "change": {
-                "actions": [
-                    "create"
-                ],
-                "before": null,
-                "after": {
-                    "location": "global",
-                    "name": "keyring-example",
-                    "project": "{{.Provider.project}}",
-                    "timeouts": null
-                },
-                "after_unknown": {
-                    "id": true,
-                    "self_link": true
-                },
-                "before_sensitive": false,
-                "after_sensitive": {}
-            }
+        "after_unknown": {
+          "destroy_scheduled_duration": true,
+          "id": true,
+          "import_only": true,
+          "version_template": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "version_template": []
         }
-    ],
-    "configuration": {
-        "provider_config": {
-            "google": {
-                "name": "google",
-                "expressions": {
-                    "project": {
-                        "constant_value": "{{.Provider.project}}"
-                    }
-                }
+      }
+    },
+    {
+      "address": "google_kms_crypto_key_iam_policy.crypto_key",
+      "mode": "managed",
+      "type": "google_kms_crypto_key_iam_policy",
+      "name": "crypto_key",
+      "provider_name": "registry.terraform.io/hashicorp/google",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "crypto_key_id": "global/keyring-example/crypto-key-example",
+          "policy_data": "{\"bindings\":[{\"members\":[\"allAuthenticatedUsers\",\"serviceAccount:998476993360@cloudservices.gserviceaccount.com\"],\"role\":\"roles/cloudkms.admin\"}]}"
+        },
+        "after_unknown": {
+          "etag": true,
+          "id": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {}
+      }
+    }
+  ],
+  "configuration": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_kms_crypto_key.example_crypto_key",
+          "mode": "managed",
+          "type": "google_kms_crypto_key",
+          "name": "example_crypto_key",
+          "provider_config_key": "google",
+          "expressions": {
+            "key_ring": {
+              "constant_value": "projects/{{.Provider.project}}/locations/global/keyRings/keyring-example"
+            },
+            "name": {
+              "constant_value": "crypto-key-example"
             }
+          },
+          "schema_version": 1
         },
-        "root_module": {
-            "resources": [
-                {
-                    "address": "google_kms_crypto_key.example_crypto_key",
-                    "mode": "managed",
-                    "type": "google_kms_crypto_key",
-                    "name": "example_crypto_key",
-                    "provider_config_key": "google",
-                    "expressions": {
-                        "key_ring": {
-                            "references": [
-                                "google_kms_key_ring.example_keyring"
-                            ]
-                        },
-                        "name": {
-                            "constant_value": "crypto-key-example"
-                        }
-                    },
-                    "schema_version": 1
-                },
-                {
-                    "address": "google_kms_crypto_key_iam_policy.crypto_key",
-                    "mode": "managed",
-                    "type": "google_kms_crypto_key_iam_policy",
-                    "name": "crypto_key",
-                    "provider_config_key": "google",
-                    "expressions": {
-                        "crypto_key_id": {
-                            "references": [
-                                "google_kms_crypto_key.example_crypto_key"
-                            ]
-                        },
-                        "policy_data": {}
-                    },
-                    "schema_version": 0
-                },
-                {
-                    "address": "google_kms_key_ring.example_keyring",
-                    "mode": "managed",
-                    "type": "google_kms_key_ring",
-                    "name": "example_keyring",
-                    "provider_config_key": "google",
-                    "expressions": {
-                        "location": {
-                            "constant_value": "global"
-                        },
-                        "name": {
-                            "constant_value": "keyring-example"
-                        },
-                        "project": {
-                            "constant_value": "{{.Provider.project}}"
-                        }
-                    },
-                    "schema_version": 0
-                }
-            ]
+        {
+          "address": "google_kms_crypto_key_iam_policy.crypto_key",
+          "mode": "managed",
+          "type": "google_kms_crypto_key_iam_policy",
+          "name": "crypto_key",
+          "provider_config_key": "google",
+          "expressions": {
+            "crypto_key_id": {
+              "constant_value": "global/keyring-example/crypto-key-example"
+            },
+            "policy_data": {}
+          },
+          "schema_version": 0
         }
+      ]
     }
+  }
 }