diff --git a/mmv1/third_party/terraform/website/docs/r/spanner_instance_iam.html.markdown b/mmv1/third_party/terraform/website/docs/r/spanner_instance_iam.html.markdown
index f093e8d0878b..f5745dfc9e7e 100644
--- a/mmv1/third_party/terraform/website/docs/r/spanner_instance_iam.html.markdown
+++ b/mmv1/third_party/terraform/website/docs/r/spanner_instance_iam.html.markdown
@@ -73,6 +73,8 @@ The following arguments are supported:
   * **allAuthenticatedUsers**: A special identifier that represents anyone who is authenticated with a Google account or a service account.
   * **user:{emailid}**: An email address that represents a specific Google account. For example, alice@gmail.com or joe@example.com.
   * **serviceAccount:{emailid}**: An email address that represents a service account. For example, my-other-app@appspot.gserviceaccount.com.
+  * **principal:{principal}**: Federated single identity. For example, principal://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/PROJECT_ID.svc.id.goog/subject/ns/NAMESPACE/sa/SERVICEACCOUNT
+  * **principalSet:{principalSet}**: Federated identity group. For example, principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/PROJECT_ID.svc.id.goog/namespace/NAMESPACE
   * **group:{emailid}**: An email address that represents a Google group. For example, admins@example.com.
   * **domain:{domain}**: A G Suite domain (primary, instead of alias) name that represents all the users of that domain. For example, google.com or example.com.