From 9ce171193854cdd5cc9695cad463debe0b427e20 Mon Sep 17 00:00:00 2001
From: The Magician <magic-modules@google.com>
Date: Mon, 25 Sep 2023 18:10:50 -0400
Subject: [PATCH] Labels compute instance template (#9051) (#15993)

* Apply labels model to compute instance template

* Check if terraform_labels and effective_labels are in schema

* Test out of band labels

Signed-off-by: Modular Magician <magic-modules@google.com>
---
 .changelog/9051.txt                           |  3 +
 .../resource_active_directory_domain.go       | 11 ++-
 .../alloydb/resource_alloydb_backup.go        | 11 ++-
 .../alloydb/resource_alloydb_cluster.go       | 11 ++-
 .../alloydb/resource_alloydb_instance.go      | 11 ++-
 .../resource_artifact_registry_repository.go  |  6 +-
 .../resource_beyondcorp_app_connection.go     | 12 ++-
 .../resource_beyondcorp_app_connector.go      | 12 ++-
 .../resource_beyondcorp_app_gateway.go        | 14 ++--
 .../bigquery/resource_bigquery_dataset.go     |  3 +-
 .../resource_bigquery_dataset_test.go         | 81 +++++++++++++++++++
 .../bigquery/resource_bigquery_job.go         | 14 ++--
 ...esource_certificate_manager_certificate.go | 11 ++-
 ...ate_manager_certificate_issuance_config.go |  6 +-
 ...rce_certificate_manager_certificate_map.go | 12 ++-
 ...rtificate_manager_certificate_map_entry.go |  6 +-
 ...e_certificate_manager_dns_authorization.go | 11 ++-
 ...source_certificate_manager_trust_config.go | 13 +--
 .../resource_cloudfunctions2_function.go      | 12 ++-
 .../resource_cloud_run_domain_mapping.go      |  5 +-
 .../cloudrun/resource_cloud_run_service.go    |  5 +-
 .../cloudrunv2/resource_cloud_run_v2_job.go   |  5 +-
 .../resource_cloud_run_v2_service.go          |  5 +-
 ...source_google_compute_instance_template.go | 10 ++-
 ...e_google_compute_instance_template_test.go |  3 +
 ...google_compute_region_instance_template.go |  5 +-
 .../services/compute/resource_compute_disk.go | 12 ++-
 .../resource_compute_external_vpn_gateway.go  | 11 ++-
 .../resource_compute_forwarding_rule.go       | 12 ++-
 ...resource_compute_global_forwarding_rule.go | 12 ++-
 .../compute/resource_compute_image.go         | 11 ++-
 .../resource_compute_instance_template.go     | 18 ++++-
 ...resource_compute_instance_template_test.go | 10 +--
 .../compute/resource_compute_region_disk.go   | 12 ++-
 ...source_compute_region_instance_template.go | 39 +++++++--
 ...e_compute_region_instance_template_test.go | 28 ++++---
 .../compute/resource_compute_snapshot.go      | 11 ++-
 ...se_migration_service_connection_profile.go | 12 ++-
 .../resource_data_fusion_instance.go          |  6 +-
 .../dataplex/resource_dataplex_datascan.go    | 12 ++-
 .../dataplex/resource_dataplex_task.go        | 12 ++-
 .../resource_dataproc_metastore_service.go    | 11 ++-
 .../resource_datastream_connection_profile.go | 11 ++-
 .../resource_datastream_private_connection.go | 13 +--
 .../datastream/resource_datastream_stream.go  | 11 ++-
 .../resource_dialogflow_cx_intent.go          |  6 +-
 .../services/dns/resource_dns_managed_zone.go | 12 ++-
 .../filestore/resource_filestore_backup.go    | 12 ++-
 .../filestore/resource_filestore_instance.go  | 12 ++-
 .../filestore/resource_filestore_snapshot.go  | 12 ++-
 .../resource_gke_backup_backup_plan.go        |  6 +-
 .../gkehub/resource_gke_hub_membership.go     | 12 ++-
 .../gkehub2/resource_gke_hub_feature.go       | 11 ++-
 .../resource_gke_hub_membership_binding.go    | 12 ++-
 .../gkehub2/resource_gke_hub_namespace.go     | 12 ++-
 .../gkehub2/resource_gke_hub_scope.go         | 12 ++-
 ...esource_gke_hub_scope_rbac_role_binding.go | 12 ++-
 .../resource_healthcare_consent_store.go      |  6 +-
 .../resource_healthcare_dicom_store.go        |  6 +-
 .../resource_healthcare_fhir_store.go         |  6 +-
 .../resource_healthcare_hl7_v2_store.go       |  6 +-
 .../services/kms/resource_kms_crypto_key.go   | 12 ++-
 .../memcache/resource_memcache_instance.go    | 12 ++-
 .../mlengine/resource_ml_engine_model.go      | 13 +--
 ..._connectivity_service_connection_policy.go | 12 ++-
 ...k_management_connectivity_test_resource.go | 12 ++-
 ...resource_network_security_address_group.go |  6 +-
 ...urce_network_services_edge_cache_keyset.go | 11 ++-
 ...urce_network_services_edge_cache_origin.go | 11 ++-
 ...rce_network_services_edge_cache_service.go | 11 ++-
 .../resource_network_services_gateway.go      | 11 ++-
 .../notebooks/resource_notebooks_instance.go  |  6 +-
 .../privateca/resource_privateca_ca_pool.go   |  6 +-
 .../resource_privateca_certificate.go         | 12 ++-
 ...esource_privateca_certificate_authority.go |  6 +-
 .../pubsub/resource_pubsub_subscription.go    | 12 ++-
 .../services/pubsub/resource_pubsub_topic.go  | 12 ++-
 .../services/redis/resource_redis_instance.go | 11 ++-
 .../resource_secret_manager_secret.go         |  6 +-
 .../spanner/resource_spanner_instance.go      |  6 +-
 google/services/tpu/resource_tpu_node.go      | 13 +--
 .../vertexai/resource_vertex_ai_dataset.go    | 12 ++-
 .../vertexai/resource_vertex_ai_endpoint.go   | 11 ++-
 .../resource_vertex_ai_featurestore.go        | 12 ++-
 ...ource_vertex_ai_featurestore_entitytype.go | 12 ++-
 ...rtex_ai_featurestore_entitytype_feature.go | 12 ++-
 .../vertexai/resource_vertex_ai_index.go      | 11 ++-
 .../resource_vertex_ai_index_endpoint.go      | 11 ++-
 .../resource_vertex_ai_tensorboard.go         | 12 ++-
 .../workflows/resource_workflows_workflow.go  | 12 ++-
 google/tpgresource/annotations.go             |  8 ++
 google/tpgresource/labels.go                  | 28 +++++--
 .../r/active_directory_domain.html.markdown   |  2 +
 .../r/active_directory_peering.html.markdown  |  2 +
 website/docs/r/alloydb_backup.html.markdown   |  2 +
 website/docs/r/alloydb_cluster.html.markdown  |  2 +
 website/docs/r/alloydb_instance.html.markdown |  2 +
 website/docs/r/api_gateway_api.html.markdown  |  3 +
 .../r/api_gateway_api_config.html.markdown    |  3 +
 .../docs/r/api_gateway_gateway.html.markdown  |  3 +
 ...artifact_registry_repository.html.markdown |  3 +
 .../r/beyondcorp_app_connection.html.markdown |  3 +
 .../r/beyondcorp_app_connector.html.markdown  |  3 +
 .../r/beyondcorp_app_gateway.html.markdown    |  3 +
 website/docs/r/bigquery_dataset.html.markdown |  3 +-
 website/docs/r/bigquery_job.html.markdown     |  3 +
 website/docs/r/bigquery_table.html.markdown   |  3 +
 .../docs/r/bigtable_instance.html.markdown    |  3 +
 ...tificate_manager_certificate.html.markdown |  2 +
 ..._certificate_issuance_config.html.markdown |  3 +
 ...cate_manager_certificate_map.html.markdown |  3 +
 ...anager_certificate_map_entry.html.markdown |  3 +
 ...te_manager_dns_authorization.html.markdown |  2 +
 ...ificate_manager_trust_config.html.markdown |  2 +
 .../r/cloud_run_domain_mapping.html.markdown  |  2 +
 .../docs/r/cloud_run_service.html.markdown    |  2 +
 website/docs/r/cloud_run_v2_job.html.markdown |  2 +
 .../docs/r/cloud_run_v2_service.html.markdown |  2 +
 .../r/cloudfunctions2_function.html.markdown  |  3 +
 website/docs/r/compute_address.html.markdown  |  1 +
 website/docs/r/compute_disk.html.markdown     |  3 +
 ...compute_external_vpn_gateway.html.markdown |  2 +
 .../r/compute_forwarding_rule.html.markdown   |  3 +
 .../r/compute_global_address.html.markdown    |  3 +
 ...mpute_global_forwarding_rule.html.markdown |  3 +
 website/docs/r/compute_image.html.markdown    |  2 +
 .../r/compute_instance_template.html.markdown |  7 +-
 .../docs/r/compute_region_disk.html.markdown  |  3 +
 ...ute_region_instance_template.html.markdown |  9 +++
 website/docs/r/compute_snapshot.html.markdown |  2 +
 .../docs/r/compute_vpn_tunnel.html.markdown   |  2 +
 .../docs/r/data_fusion_instance.html.markdown |  3 +
 ...n_service_connection_profile.html.markdown |  3 +
 .../docs/r/dataplex_datascan.html.markdown    |  3 +
 website/docs/r/dataplex_task.html.markdown    |  3 +
 ...ataproc_metastore_federation.html.markdown |  2 +
 .../dataproc_metastore_service.html.markdown  |  2 +
 ...atastream_connection_profile.html.markdown |  2 +
 ...atastream_private_connection.html.markdown |  2 +
 .../docs/r/datastream_stream.html.markdown    |  2 +
 .../docs/r/dialogflow_cx_intent.html.markdown |  3 +
 website/docs/r/dns_managed_zone.html.markdown |  3 +
 website/docs/r/filestore_backup.html.markdown |  3 +
 .../docs/r/filestore_instance.html.markdown   |  3 +
 .../docs/r/filestore_snapshot.html.markdown   |  3 +
 .../r/firebase_hosting_channel.html.markdown  |  2 +
 .../r/gke_backup_backup_plan.html.markdown    |  3 +
 website/docs/r/gke_hub_feature.html.markdown  |  2 +
 .../docs/r/gke_hub_membership.html.markdown   |  3 +
 .../gke_hub_membership_binding.html.markdown  |  3 +
 .../docs/r/gke_hub_namespace.html.markdown    |  3 +
 website/docs/r/gke_hub_scope.html.markdown    |  3 +
 ..._hub_scope_rbac_role_binding.html.markdown |  3 +
 .../r/healthcare_consent_store.html.markdown  |  3 +
 .../r/healthcare_dicom_store.html.markdown    |  3 +
 .../r/healthcare_fhir_store.html.markdown     |  3 +
 .../r/healthcare_hl7_v2_store.html.markdown   |  3 +
 website/docs/r/kms_crypto_key.html.markdown   |  3 +
 .../docs/r/memcache_instance.html.markdown    |  3 +
 website/docs/r/ml_engine_model.html.markdown  |  2 +
 ...ty_service_connection_policy.html.markdown |  3 +
 ...t_connectivity_test_resource.html.markdown |  3 +
 ...twork_security_address_group.html.markdown |  3 +
 ...ecurity_authorization_policy.html.markdown |  2 +
 ...k_security_client_tls_policy.html.markdown |  2 +
 ...k_security_server_tls_policy.html.markdown |  2 +
 ...k_services_edge_cache_keyset.html.markdown |  2 +
 ...k_services_edge_cache_origin.html.markdown |  2 +
 ..._services_edge_cache_service.html.markdown |  2 +
 ...ork_services_endpoint_policy.html.markdown |  2 +
 .../r/network_services_gateway.html.markdown  |  2 +
 .../network_services_grpc_route.html.markdown |  2 +
 .../network_services_http_route.html.markdown |  2 +
 .../r/network_services_mesh.html.markdown     |  2 +
 ...ork_services_service_binding.html.markdown |  2 +
 .../network_services_tcp_route.html.markdown  |  2 +
 .../docs/r/notebooks_instance.html.markdown   |  3 +
 .../docs/r/privateca_ca_pool.html.markdown    |  3 +
 .../r/privateca_certificate.html.markdown     |  3 +
 ...vateca_certificate_authority.html.markdown |  3 +
 .../docs/r/pubsub_subscription.html.markdown  |  3 +
 website/docs/r/pubsub_topic.html.markdown     |  3 +
 website/docs/r/redis_instance.html.markdown   |  2 +
 .../r/secret_manager_secret.html.markdown     |  3 +
 .../service_directory_namespace.html.markdown |  3 +
 website/docs/r/spanner_instance.html.markdown |  3 +
 website/docs/r/tpu_node.html.markdown         |  2 +
 .../docs/r/vertex_ai_dataset.html.markdown    |  3 +
 .../docs/r/vertex_ai_endpoint.html.markdown   |  2 +
 .../r/vertex_ai_featurestore.html.markdown    |  3 +
 ...x_ai_featurestore_entitytype.html.markdown |  3 +
 ...turestore_entitytype_feature.html.markdown |  3 +
 website/docs/r/vertex_ai_index.html.markdown  |  2 +
 .../r/vertex_ai_index_endpoint.html.markdown  |  2 +
 .../r/vertex_ai_tensorboard.html.markdown     |  3 +
 .../docs/r/workflows_workflow.html.markdown   |  3 +
 .../r/workstations_workstation.html.markdown  |  2 +
 ...stations_workstation_cluster.html.markdown |  2 +
 ...kstations_workstation_config.html.markdown |  2 +
 199 files changed, 1039 insertions(+), 304 deletions(-)
 create mode 100644 .changelog/9051.txt

diff --git a/.changelog/9051.txt b/.changelog/9051.txt
new file mode 100644
index 00000000000..8ec013c0699
--- /dev/null
+++ b/.changelog/9051.txt
@@ -0,0 +1,3 @@
+```release-note:none
+
+```
diff --git a/google/services/activedirectory/resource_active_directory_domain.go b/google/services/activedirectory/resource_active_directory_domain.go
index 417affb1f21..a482ceefb68 100644
--- a/google/services/activedirectory/resource_active_directory_domain.go
+++ b/google/services/activedirectory/resource_active_directory_domain.go
@@ -98,10 +98,13 @@ If CIDR subnets overlap between networks, domain creation will fail.`,
 				Set: schema.HashString,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Resource labels that can contain user-provided metadata`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Resource labels that can contain user-provided metadata
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"effective_labels": {
 				Type:        schema.TypeMap,
diff --git a/google/services/alloydb/resource_alloydb_backup.go b/google/services/alloydb/resource_alloydb_backup.go
index 26b227f0b27..a1b907c7639 100644
--- a/google/services/alloydb/resource_alloydb_backup.go
+++ b/google/services/alloydb/resource_alloydb_backup.go
@@ -96,10 +96,13 @@ func ResourceAlloydbBackup() *schema.Resource {
 				},
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `User-defined labels for the alloydb backup.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `User-defined labels for the alloydb backup.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"create_time": {
 				Type:        schema.TypeString,
diff --git a/google/services/alloydb/resource_alloydb_cluster.go b/google/services/alloydb/resource_alloydb_cluster.go
index 4bdf9ae9861..ddcc0d3dd33 100644
--- a/google/services/alloydb/resource_alloydb_cluster.go
+++ b/google/services/alloydb/resource_alloydb_cluster.go
@@ -289,10 +289,13 @@ If not set, defaults to 14 days.`,
 				},
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `User-defined labels for the alloydb cluster.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `User-defined labels for the alloydb cluster.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"network": {
 				Type:             schema.TypeString,
diff --git a/google/services/alloydb/resource_alloydb_instance.go b/google/services/alloydb/resource_alloydb_instance.go
index 211e776ccf9..30f8d613228 100644
--- a/google/services/alloydb/resource_alloydb_instance.go
+++ b/google/services/alloydb/resource_alloydb_instance.go
@@ -111,10 +111,13 @@ can have regional availability (nodes are present in 2 or more zones in a region
 				Description: `The Compute Engine zone that the instance should serve from, per https://cloud.google.com/compute/docs/regions-zones This can ONLY be specified for ZONAL instances. If present for a REGIONAL instance, an error will be thrown. If this is absent for a ZONAL instance, instance is created in a random zone with available capacity.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `User-defined labels for the alloydb instance.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `User-defined labels for the alloydb instance.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"machine_config": {
 				Type:        schema.TypeList,
diff --git a/google/services/artifactregistry/resource_artifact_registry_repository.go b/google/services/artifactregistry/resource_artifact_registry_repository.go
index 0722d9eaea8..dbda5ed4c8e 100644
--- a/google/services/artifactregistry/resource_artifact_registry_repository.go
+++ b/google/services/artifactregistry/resource_artifact_registry_repository.go
@@ -108,7 +108,11 @@ This value may not be changed after the Repository has been created.`,
 This field may contain up to 64 entries. Label keys and values may be no
 longer than 63 characters. Label keys must begin with a lowercase letter
 and may only contain lowercase letters, numeric characters, underscores,
-and dashes.`,
+and dashes.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
 				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"location": {
diff --git a/google/services/beyondcorp/resource_beyondcorp_app_connection.go b/google/services/beyondcorp/resource_beyondcorp_app_connection.go
index b6b24076dde..b263bd3e09b 100644
--- a/google/services/beyondcorp/resource_beyondcorp_app_connection.go
+++ b/google/services/beyondcorp/resource_beyondcorp_app_connection.go
@@ -127,10 +127,14 @@ for a list of possible values.`,
 				},
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Resource labels to represent user provided metadata.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Resource labels to represent user provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"region": {
 				Type:        schema.TypeString,
diff --git a/google/services/beyondcorp/resource_beyondcorp_app_connector.go b/google/services/beyondcorp/resource_beyondcorp_app_connector.go
index a2817936580..039d00b4626 100644
--- a/google/services/beyondcorp/resource_beyondcorp_app_connector.go
+++ b/google/services/beyondcorp/resource_beyondcorp_app_connector.go
@@ -91,10 +91,14 @@ func ResourceBeyondcorpAppConnector() *schema.Resource {
 				Description: `An arbitrary user-provided name for the AppConnector.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Resource labels to represent user provided metadata.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Resource labels to represent user provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"region": {
 				Type:        schema.TypeString,
diff --git a/google/services/beyondcorp/resource_beyondcorp_app_gateway.go b/google/services/beyondcorp/resource_beyondcorp_app_gateway.go
index b8d244cecfd..b544483c3b9 100644
--- a/google/services/beyondcorp/resource_beyondcorp_app_gateway.go
+++ b/google/services/beyondcorp/resource_beyondcorp_app_gateway.go
@@ -73,11 +73,15 @@ func ResourceBeyondcorpAppGateway() *schema.Resource {
 				Default:      "HOST_TYPE_UNSPECIFIED",
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				ForceNew:    true,
-				Description: `Resource labels to represent user provided metadata.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				ForceNew: true,
+				Description: `Resource labels to represent user provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"region": {
 				Type:        schema.TypeString,
diff --git a/google/services/bigquery/resource_bigquery_dataset.go b/google/services/bigquery/resource_bigquery_dataset.go
index a83cd333786..2032ec3f929 100644
--- a/google/services/bigquery/resource_bigquery_dataset.go
+++ b/google/services/bigquery/resource_bigquery_dataset.go
@@ -193,7 +193,8 @@ case-sensitive. This field does not affect routine references.`,
 				Type:     schema.TypeMap,
 				Optional: true,
 				Description: `The labels associated with this dataset. You can use these to
-organize and group your datasets
+organize and group your datasets.
+
 
 **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
 Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
diff --git a/google/services/bigquery/resource_bigquery_dataset_test.go b/google/services/bigquery/resource_bigquery_dataset_test.go
index 50ec2b6f3d3..6819b69074f 100644
--- a/google/services/bigquery/resource_bigquery_dataset_test.go
+++ b/google/services/bigquery/resource_bigquery_dataset_test.go
@@ -139,6 +139,49 @@ func TestAccBigQueryDataset_withProvider5(t *testing.T) {
 	})
 }
 
+func TestAccBigQueryDataset_withOutOfBandLabels(t *testing.T) {
+	acctest.SkipIfVcr(t)
+	t.Parallel()
+
+	datasetID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckBigQueryDatasetDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBigQueryDataset(datasetID),
+				Check:  addOutOfBandLabels(t, datasetID),
+			},
+			{
+				ResourceName:            "google_bigquery_dataset.test",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"delete_contents_on_destroy", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccBigQueryDatasetUpdated(datasetID),
+			},
+			{
+				ResourceName:            "google_bigquery_dataset.test",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"delete_contents_on_destroy", "labels", "terraform_labels"},
+			},
+			{
+				Config: testAccBigQueryDatasetUpdated_withOutOfBandLabels(datasetID),
+			},
+			{
+				ResourceName:            "google_bigquery_dataset.test",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"delete_contents_on_destroy", "labels", "terraform_labels"},
+			},
+		},
+	})
+}
+
 func TestAccBigQueryDataset_datasetWithContents(t *testing.T) {
 	t.Parallel()
 
@@ -304,6 +347,25 @@ func testAccAddTable(t *testing.T, datasetID string, tableID string) resource.Te
 	}
 }
 
+func addOutOfBandLabels(t *testing.T, datasetID string) resource.TestCheckFunc {
+	// Not actually a check, but adds labels independently of terraform
+	return func(s *terraform.State) error {
+		config := acctest.GoogleProviderConfig(t)
+
+		dataset, err := config.NewBigQueryClient(config.UserAgent).Datasets.Get(config.Project, datasetID).Do()
+		if err != nil {
+			return fmt.Errorf("Could not get dataset with ID %s", datasetID)
+		}
+
+		dataset.Labels["outband_key"] = "test"
+		_, err = config.NewBigQueryClient(config.UserAgent).Datasets.Patch(config.Project, datasetID, dataset).Do()
+		if err != nil {
+			return fmt.Errorf("Could not update labele for the dataset")
+		}
+		return nil
+	}
+}
+
 func testAccBigQueryDataset_withoutLabels(datasetID string) string {
 	return fmt.Sprintf(`
 resource "google_bigquery_dataset" "test" {
@@ -353,6 +415,25 @@ resource "google_bigquery_dataset" "test" {
 `, datasetID)
 }
 
+func testAccBigQueryDatasetUpdated_withOutOfBandLabels(datasetID string) string {
+	return fmt.Sprintf(`
+resource "google_bigquery_dataset" "test" {
+  dataset_id                      = "%s"
+  friendly_name                   = "bar"
+  description                     = "This is a bar description"
+  location                        = "EU"
+  default_partition_expiration_ms = 7200000
+  default_table_expiration_ms     = 7200000
+
+  labels = {
+    env                         = "bar"
+    default_table_expiration_ms = 7200000
+	outband_key                 = "test-update"
+  }
+}
+`, datasetID)
+}
+
 func testAccBigQueryDatasetUpdated2(datasetID string) string {
 	return fmt.Sprintf(`
 resource "google_bigquery_dataset" "test" {
diff --git a/google/services/bigquery/resource_bigquery_job.go b/google/services/bigquery/resource_bigquery_job.go
index aad07d02295..f32cc989ef3 100644
--- a/google/services/bigquery/resource_bigquery_job.go
+++ b/google/services/bigquery/resource_bigquery_job.go
@@ -315,11 +315,15 @@ or of the form 'projects/{{project}}/datasets/{{dataset_id}}/tables/{{table_id}}
 				Description: `Job timeout in milliseconds. If this time limit is exceeded, BigQuery may attempt to terminate the job.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				ForceNew:    true,
-				Description: `The labels associated with this job. You can use these to organize and group your jobs.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				ForceNew: true,
+				Description: `The labels associated with this job. You can use these to organize and group your jobs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"load": {
 				Type:        schema.TypeList,
diff --git a/google/services/certificatemanager/resource_certificate_manager_certificate.go b/google/services/certificatemanager/resource_certificate_manager_certificate.go
index 2658815b84a..5d0b8c85cb8 100644
--- a/google/services/certificatemanager/resource_certificate_manager_certificate.go
+++ b/google/services/certificatemanager/resource_certificate_manager_certificate.go
@@ -85,10 +85,13 @@ and all following characters must be a dash, underscore, letter or digit.`,
 				Description: `A human-readable description of the resource.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Set of label tags associated with the Certificate resource.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Set of label tags associated with the Certificate resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"location": {
 				Type:        schema.TypeString,
diff --git a/google/services/certificatemanager/resource_certificate_manager_certificate_issuance_config.go b/google/services/certificatemanager/resource_certificate_manager_certificate_issuance_config.go
index b1b9be7ba9d..de5c666729c 100644
--- a/google/services/certificatemanager/resource_certificate_manager_certificate_issuance_config.go
+++ b/google/services/certificatemanager/resource_certificate_manager_certificate_issuance_config.go
@@ -124,7 +124,11 @@ the certificate has been issued and at least 7 days before it expires.`,
 				Optional: true,
 				ForceNew: true,
 				Description: `'Set of label tags associated with the CertificateIssuanceConfig resource.
- An object containing a list of "key": value pairs. Example: { "name": "wrench", "count": "3" }.`,
+ An object containing a list of "key": value pairs. Example: { "name": "wrench", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
 				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"location": {
diff --git a/google/services/certificatemanager/resource_certificate_manager_certificate_map.go b/google/services/certificatemanager/resource_certificate_manager_certificate_map.go
index 410a792031a..b7831ef061d 100644
--- a/google/services/certificatemanager/resource_certificate_manager_certificate_map.go
+++ b/google/services/certificatemanager/resource_certificate_manager_certificate_map.go
@@ -67,10 +67,14 @@ globally and match the pattern 'projects/*/locations/*/certificateMaps/*'.`,
 				Description: `A human-readable description of the resource.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Set of labels associated with a Certificate Map resource.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Set of labels associated with a Certificate Map resource.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"create_time": {
 				Type:     schema.TypeString,
diff --git a/google/services/certificatemanager/resource_certificate_manager_certificate_map_entry.go b/google/services/certificatemanager/resource_certificate_manager_certificate_map_entry.go
index ef8c5dfd503..bbe756087a7 100644
--- a/google/services/certificatemanager/resource_certificate_manager_certificate_map_entry.go
+++ b/google/services/certificatemanager/resource_certificate_manager_certificate_map_entry.go
@@ -99,7 +99,11 @@ selecting a proper certificate.`,
 				Optional: true,
 				Description: `Set of labels associated with a Certificate Map Entry.
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.`,
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
 				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"matcher": {
diff --git a/google/services/certificatemanager/resource_certificate_manager_dns_authorization.go b/google/services/certificatemanager/resource_certificate_manager_dns_authorization.go
index 421a606a92b..b41d2c182a0 100644
--- a/google/services/certificatemanager/resource_certificate_manager_dns_authorization.go
+++ b/google/services/certificatemanager/resource_certificate_manager_dns_authorization.go
@@ -76,10 +76,13 @@ and all following characters must be a dash, underscore, letter or digit.`,
 				Description: `A human-readable description of the resource.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Set of label tags associated with the DNS Authorization resource.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Set of label tags associated with the DNS Authorization resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"dns_resource_record": {
 				Type:     schema.TypeList,
diff --git a/google/services/certificatemanager/resource_certificate_manager_trust_config.go b/google/services/certificatemanager/resource_certificate_manager_trust_config.go
index 0312d5e6ad9..91ef2deaa0f 100644
--- a/google/services/certificatemanager/resource_certificate_manager_trust_config.go
+++ b/google/services/certificatemanager/resource_certificate_manager_trust_config.go
@@ -71,11 +71,14 @@ func ResourceCertificateManagerTrustConfig() *schema.Resource {
 				Description: `One or more paragraphs of text description of a trust config.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				ForceNew:    true,
-				Description: `Set of label tags associated with the trust config.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				ForceNew: true,
+				Description: `Set of label tags associated with the trust config.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"trust_stores": {
 				Type:     schema.TypeList,
diff --git a/google/services/cloudfunctions2/resource_cloudfunctions2_function.go b/google/services/cloudfunctions2/resource_cloudfunctions2_function.go
index f40041e4e74..567fcbc6607 100644
--- a/google/services/cloudfunctions2/resource_cloudfunctions2_function.go
+++ b/google/services/cloudfunctions2/resource_cloudfunctions2_function.go
@@ -275,10 +275,14 @@ region. If not provided, defaults to the same region as the function.`,
 It must match the pattern projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `A set of key/value label pairs associated with this Cloud Function.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `A set of key/value label pairs associated with this Cloud Function.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"service_config": {
 				Type:        schema.TypeList,
diff --git a/google/services/cloudrun/resource_cloud_run_domain_mapping.go b/google/services/cloudrun/resource_cloud_run_domain_mapping.go
index 26930502067..dca141d207a 100644
--- a/google/services/cloudrun/resource_cloud_run_domain_mapping.go
+++ b/google/services/cloudrun/resource_cloud_run_domain_mapping.go
@@ -159,7 +159,10 @@ or apply the lifecycle.ignore_changes rule to the metadata.0.annotations field.`
 							Description: `Map of string keys and values that can be used to organize and categorize
 (scope and select) objects. May match selectors of replication controllers
 and routes.
-More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels`,
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
 							Elem: &schema.Schema{Type: schema.TypeString},
 						},
 						"effective_annotations": {
diff --git a/google/services/cloudrun/resource_cloud_run_service.go b/google/services/cloudrun/resource_cloud_run_service.go
index e1ecb29e06e..930b8f6ed2e 100644
--- a/google/services/cloudrun/resource_cloud_run_service.go
+++ b/google/services/cloudrun/resource_cloud_run_service.go
@@ -927,7 +927,10 @@ keys to configure features on a Service:
 							Optional: true,
 							Description: `Map of string keys and values that can be used to organize and categorize
 (scope and select) objects. May match selectors of replication controllers
-and routes.`,
+and routes.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
 							Elem: &schema.Schema{Type: schema.TypeString},
 						},
 						"namespace": {
diff --git a/google/services/cloudrunv2/resource_cloud_run_v2_job.go b/google/services/cloudrunv2/resource_cloud_run_v2_job.go
index 31db25658ba..acf6037ffe4 100644
--- a/google/services/cloudrunv2/resource_cloud_run_v2_job.go
+++ b/google/services/cloudrunv2/resource_cloud_run_v2_job.go
@@ -475,7 +475,10 @@ This field follows Kubernetes annotations' namespacing, limits, and rules.`,
 environment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.
 
 Cloud Run API v2 does not support labels with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected.
-All system labels in v1 now have a corresponding field in v2 Job.`,
+All system labels in v1 now have a corresponding field in v2 Job.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
 				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"launch_stage": {
diff --git a/google/services/cloudrunv2/resource_cloud_run_v2_service.go b/google/services/cloudrunv2/resource_cloud_run_v2_service.go
index 3eceb79b7b9..b6e0a31de5d 100644
--- a/google/services/cloudrunv2/resource_cloud_run_v2_service.go
+++ b/google/services/cloudrunv2/resource_cloud_run_v2_service.go
@@ -727,7 +727,10 @@ This field follows Kubernetes annotations' namespacing, limits, and rules.`,
 environment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.
 
 Cloud Run API v2 does not support labels with  'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected.
-All system labels in v1 now have a corresponding field in v2 Service.`,
+All system labels in v1 now have a corresponding field in v2 Service.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
 				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"launch_stage": {
diff --git a/google/services/compute/data_source_google_compute_instance_template.go b/google/services/compute/data_source_google_compute_instance_template.go
index 5370c964842..762ecd6a68d 100644
--- a/google/services/compute/data_source_google_compute_instance_template.go
+++ b/google/services/compute/data_source_google_compute_instance_template.go
@@ -89,7 +89,10 @@ func datasourceComputeInstanceTemplateRead(d *schema.ResourceData, meta interfac
 func retrieveInstance(d *schema.ResourceData, meta interface{}, project, name string) error {
 	d.SetId("projects/" + project + "/global/instanceTemplates/" + name)
 
-	return resourceComputeInstanceTemplateRead(d, meta)
+	if err := resourceComputeInstanceTemplateRead(d, meta); err != nil {
+		return err
+	}
+	return tpgresource.SetDataSourceLabels(d)
 }
 
 func retrieveInstanceFromUniqueId(d *schema.ResourceData, meta interface{}, project, self_link_unique string) error {
@@ -97,7 +100,10 @@ func retrieveInstanceFromUniqueId(d *schema.ResourceData, meta interface{}, proj
 	d.SetId(normalId)
 	d.Set("self_link_unique", self_link_unique)
 
-	return resourceComputeInstanceTemplateRead(d, meta)
+	if err := resourceComputeInstanceTemplateRead(d, meta); err != nil {
+		return err
+	}
+	return tpgresource.SetDataSourceLabels(d)
 }
 
 // ByCreationTimestamp implements sort.Interface for []*InstanceTemplate based on
diff --git a/google/services/compute/data_source_google_compute_instance_template_test.go b/google/services/compute/data_source_google_compute_instance_template_test.go
index 7d91dc5176d..0f16f8079cb 100644
--- a/google/services/compute/data_source_google_compute_instance_template_test.go
+++ b/google/services/compute/data_source_google_compute_instance_template_test.go
@@ -117,6 +117,9 @@ resource "google_compute_instance_template" "default" {
   network_interface {
     network = "default"
   }
+  labels = {
+    my-label = "my-label-value"
+  }
 }
 
 data "google_compute_instance_template" "default" {
diff --git a/google/services/compute/data_source_google_compute_region_instance_template.go b/google/services/compute/data_source_google_compute_region_instance_template.go
index cce92006754..149532db8e5 100644
--- a/google/services/compute/data_source_google_compute_region_instance_template.go
+++ b/google/services/compute/data_source_google_compute_region_instance_template.go
@@ -121,5 +121,8 @@ func datasourceComputeRegionInstanceTemplateRead(d *schema.ResourceData, meta in
 func retrieveInstances(d *schema.ResourceData, meta interface{}, project, region, name string) error {
 	d.SetId("projects/" + project + "/regions/" + region + "/instanceTemplates/" + name)
 
-	return resourceComputeRegionInstanceTemplateRead(d, meta)
+	if err := resourceComputeRegionInstanceTemplateRead(d, meta); err != nil {
+		return err
+	}
+	return tpgresource.SetDataSourceLabels(d)
 }
diff --git a/google/services/compute/resource_compute_disk.go b/google/services/compute/resource_compute_disk.go
index 09b852c848c..a41d33fd2e6 100644
--- a/google/services/compute/resource_compute_disk.go
+++ b/google/services/compute/resource_compute_disk.go
@@ -443,10 +443,14 @@ For instance, the image 'centos-6-v20180104' includes its family name 'centos-6'
 These images can be referred by family name here.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Labels to apply to this disk.  A list of key->value pairs.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Labels to apply to this disk.  A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"licenses": {
 				Type:        schema.TypeList,
diff --git a/google/services/compute/resource_compute_external_vpn_gateway.go b/google/services/compute/resource_compute_external_vpn_gateway.go
index 8aa7ea752c0..dfce30fbff1 100644
--- a/google/services/compute/resource_compute_external_vpn_gateway.go
+++ b/google/services/compute/resource_compute_external_vpn_gateway.go
@@ -102,10 +102,13 @@ it cannot be an IP address from Google Compute Engine.`,
 				},
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Labels for the external VPN gateway resource.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Labels for the external VPN gateway resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"redundancy_type": {
 				Type:         schema.TypeString,
diff --git a/google/services/compute/resource_compute_forwarding_rule.go b/google/services/compute/resource_compute_forwarding_rule.go
index 6323332a903..b8e13530b81 100644
--- a/google/services/compute/resource_compute_forwarding_rule.go
+++ b/google/services/compute/resource_compute_forwarding_rule.go
@@ -221,10 +221,14 @@ This can only be set to true for load balancers that have their
 'loadBalancingScheme' set to 'INTERNAL'.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Labels to apply to this forwarding rule.  A list of key->value pairs.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Labels to apply to this forwarding rule.  A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"load_balancing_scheme": {
 				Type:         schema.TypeString,
diff --git a/google/services/compute/resource_compute_global_forwarding_rule.go b/google/services/compute/resource_compute_global_forwarding_rule.go
index adb44ef0a12..10c3188d70c 100644
--- a/google/services/compute/resource_compute_global_forwarding_rule.go
+++ b/google/services/compute/resource_compute_global_forwarding_rule.go
@@ -171,10 +171,14 @@ you create the resource.`,
 				Description:  `The IP Version that will be used by this global forwarding rule. Possible values: ["IPV4", "IPV6"]`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Labels to apply to this forwarding rule.  A list of key->value pairs.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Labels to apply to this forwarding rule.  A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"load_balancing_scheme": {
 				Type:         schema.TypeString,
diff --git a/google/services/compute/resource_compute_image.go b/google/services/compute/resource_compute_image.go
index cfe657e61e3..c96cd3b9140 100644
--- a/google/services/compute/resource_compute_image.go
+++ b/google/services/compute/resource_compute_image.go
@@ -133,10 +133,13 @@ account is used.`,
 				},
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Labels to apply to this Image.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Labels to apply to this Image.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"licenses": {
 				Type:        schema.TypeList,
diff --git a/google/services/compute/resource_compute_instance_template.go b/google/services/compute/resource_compute_instance_template.go
index caa220e2c44..7dabb0d0210 100644
--- a/google/services/compute/resource_compute_instance_template.go
+++ b/google/services/compute/resource_compute_instance_template.go
@@ -58,6 +58,7 @@ func ResourceComputeInstanceTemplate() *schema.Resource {
 			resourceComputeInstanceTemplateSourceImageCustomizeDiff,
 			resourceComputeInstanceTemplateScratchDiskCustomizeDiff,
 			resourceComputeInstanceTemplateBootDiskCustomizeDiff,
+			tpgresource.SetLabelsDiff,
 		),
 		MigrateState: resourceComputeInstanceTemplateMigrateState,
 
@@ -865,9 +866,19 @@ be from 0 to 999,999,999 inclusive.`,
 				Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
 			},
 
+			"terraform_labels": {
+				Type:        schema.TypeMap,
+				Computed:    true,
+				Set:         schema.HashString,
+				Description: `The combination of labels configured directly on the resource and default labels configured on the provider.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+			},
+
 			"effective_labels": {
 				Type:        schema.TypeMap,
 				Computed:    true,
+				ForceNew:    true,
+				Set:         schema.HashString,
 				Description: `All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.`,
 				Elem:        &schema.Schema{Type: schema.TypeString},
 			},
@@ -1254,8 +1265,8 @@ func resourceComputeInstanceTemplateCreate(d *schema.ResourceData, meta interfac
 		ReservationAffinity:        reservationAffinity,
 	}
 
-	if _, ok := d.GetOk("labels"); ok {
-		instanceProperties.Labels = tpgresource.ExpandLabels(d)
+	if _, ok := d.GetOk("effective_labels"); ok {
+		instanceProperties.Labels = tpgresource.ExpandEffectiveLabels(d)
 	}
 
 	var itName string
@@ -1582,6 +1593,9 @@ func resourceComputeInstanceTemplateRead(d *schema.ResourceData, meta interface{
 			return fmt.Errorf("Error setting labels: %s", err)
 		}
 	}
+	if err := tpgresource.SetLabels(instanceTemplate.Properties.Labels, d, "terraform_labels"); err != nil {
+		return fmt.Errorf("Error setting terraform_labels: %s", err)
+	}
 	if err := d.Set("effective_labels", instanceTemplate.Properties.Labels); err != nil {
 		return fmt.Errorf("Error setting effective_labels: %s", err)
 	}
diff --git a/google/services/compute/resource_compute_instance_template_test.go b/google/services/compute/resource_compute_instance_template_test.go
index 745bec959da..9f5e0bb982a 100644
--- a/google/services/compute/resource_compute_instance_template_test.go
+++ b/google/services/compute/resource_compute_instance_template_test.go
@@ -47,7 +47,7 @@ func TestAccComputeInstanceTemplate_basic(t *testing.T) {
 				ResourceName:            "google_compute_instance_template.foobar",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"labels"},
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -74,7 +74,7 @@ func TestAccComputeInstanceTemplate_imageShorthand(t *testing.T) {
 				ResourceName:            "google_compute_instance_template.foobar",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"labels"},
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -570,7 +570,7 @@ func TestAccComputeInstanceTemplate_EncryptKMS(t *testing.T) {
 				ResourceName:            "google_compute_instance_template.foobar",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"labels"},
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -880,7 +880,7 @@ func TestAccComputeInstanceTemplate_diskResourcePolicies(t *testing.T) {
 				ResourceName:            "google_compute_instance_template.foobar",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"labels"},
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -958,7 +958,7 @@ func TestAccComputeInstanceTemplate_managedEnvoy(t *testing.T) {
 				ResourceName:            "google_compute_instance_template.foobar",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"labels"},
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/google/services/compute/resource_compute_region_disk.go b/google/services/compute/resource_compute_region_disk.go
index 8c4ad1fdfbd..0415186a800 100644
--- a/google/services/compute/resource_compute_region_disk.go
+++ b/google/services/compute/resource_compute_region_disk.go
@@ -160,10 +160,14 @@ Applicable only for bootable disks.`,
 				// Default schema.HashSchema is used.
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Labels to apply to this disk.  A list of key->value pairs.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Labels to apply to this disk.  A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"licenses": {
 				Type:        schema.TypeList,
diff --git a/google/services/compute/resource_compute_region_instance_template.go b/google/services/compute/resource_compute_region_instance_template.go
index 407c5159750..64e06c5814a 100644
--- a/google/services/compute/resource_compute_region_instance_template.go
+++ b/google/services/compute/resource_compute_region_instance_template.go
@@ -35,6 +35,7 @@ func ResourceComputeRegionInstanceTemplate() *schema.Resource {
 			resourceComputeInstanceTemplateSourceImageCustomizeDiff,
 			resourceComputeInstanceTemplateScratchDiskCustomizeDiff,
 			resourceComputeInstanceTemplateBootDiskCustomizeDiff,
+			tpgresource.SetLabelsDiff,
 		),
 
 		Timeouts: &schema.ResourceTimeout{
@@ -825,12 +826,32 @@ be from 0 to 999,999,999 inclusive.`,
 			},
 
 			"labels": {
+				Type:     schema.TypeMap,
+				Optional: true,
+				ForceNew: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Set:      schema.HashString,
+				Description: `A set of key/value label pairs to assign to instances created from this template,
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+			},
+
+			"terraform_labels": {
 				Type:        schema.TypeMap,
-				Optional:    true,
-				ForceNew:    true,
+				Computed:    true,
+				Set:         schema.HashString,
+				Description: `The combination of labels configured directly on the resource and default labels configured on the provider.`,
 				Elem:        &schema.Schema{Type: schema.TypeString},
+			},
+
+			"effective_labels": {
+				Type:        schema.TypeMap,
+				Computed:    true,
+				ForceNew:    true,
 				Set:         schema.HashString,
-				Description: `A set of key/value label pairs to assign to instances created from this template,`,
+				Description: `All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.`,
+				Elem:        &schema.Schema{Type: schema.TypeString},
 			},
 
 			"resource_policies": {
@@ -960,8 +981,8 @@ func resourceComputeRegionInstanceTemplateCreate(d *schema.ResourceData, meta in
 		ReservationAffinity:        reservationAffinity,
 	}
 
-	if _, ok := d.GetOk("labels"); ok {
-		instanceProperties.Labels = tpgresource.ExpandLabels(d)
+	if _, ok := d.GetOk("effective_labels"); ok {
+		instanceProperties.Labels = tpgresource.ExpandEffectiveLabels(d)
 	}
 
 	var itName string
@@ -1087,10 +1108,16 @@ func resourceComputeRegionInstanceTemplateRead(d *schema.ResourceData, meta inte
 		}
 	}
 	if instanceProperties.Labels != nil {
-		if err := d.Set("labels", instanceProperties.Labels); err != nil {
+		if err := tpgresource.SetLabels(instanceProperties.Labels, d, "labels"); err != nil {
 			return fmt.Errorf("Error setting labels: %s", err)
 		}
 	}
+	if err := tpgresource.SetLabels(instanceProperties.Labels, d, "terraform_labels"); err != nil {
+		return fmt.Errorf("Error setting terraform_labels: %s", err)
+	}
+	if err := d.Set("effective_labels", instanceProperties.Labels); err != nil {
+		return fmt.Errorf("Error setting effective_labels: %s", err)
+	}
 	if err = d.Set("self_link", instanceTemplate["selfLink"]); err != nil {
 		return fmt.Errorf("Error setting self_link: %s", err)
 	}
diff --git a/google/services/compute/resource_compute_region_instance_template_test.go b/google/services/compute/resource_compute_region_instance_template_test.go
index 9400c78ba98..d28f5071502 100644
--- a/google/services/compute/resource_compute_region_instance_template_test.go
+++ b/google/services/compute/resource_compute_region_instance_template_test.go
@@ -43,9 +43,10 @@ func TestAccComputeRegionInstanceTemplate_basic(t *testing.T) {
 				),
 			},
 			{
-				ResourceName:      "google_compute_region_instance_template.foobar",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_compute_region_instance_template.foobar",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -69,9 +70,10 @@ func TestAccComputeRegionInstanceTemplate_imageShorthand(t *testing.T) {
 				),
 			},
 			{
-				ResourceName:      "google_compute_region_instance_template.foobar",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_compute_region_instance_template.foobar",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -827,9 +829,10 @@ func TestAccComputeRegionInstanceTemplate_diskResourcePolicies(t *testing.T) {
 				),
 			},
 			{
-				ResourceName:      "google_compute_region_instance_template.foobar",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_compute_region_instance_template.foobar",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
@@ -904,9 +907,10 @@ func TestAccComputeRegionInstanceTemplate_managedEnvoy(t *testing.T) {
 				),
 			},
 			{
-				ResourceName:      "google_compute_region_instance_template.foobar",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "google_compute_region_instance_template.foobar",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
 			},
 		},
 	})
diff --git a/google/services/compute/resource_compute_snapshot.go b/google/services/compute/resource_compute_snapshot.go
index 008f4318722..3e1cf47b2c0 100644
--- a/google/services/compute/resource_compute_snapshot.go
+++ b/google/services/compute/resource_compute_snapshot.go
@@ -92,10 +92,13 @@ resource, this field is visible only if it has a non-empty value.`,
 				Description: `An optional description of this resource.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Labels to apply to this Snapshot.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Labels to apply to this Snapshot.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"snapshot_encryption_key": {
 				Type:     schema.TypeList,
diff --git a/google/services/databasemigrationservice/resource_database_migration_service_connection_profile.go b/google/services/databasemigrationservice/resource_database_migration_service_connection_profile.go
index 5aa22f7793c..95966de222c 100644
--- a/google/services/databasemigrationservice/resource_database_migration_service_connection_profile.go
+++ b/google/services/databasemigrationservice/resource_database_migration_service_connection_profile.go
@@ -365,10 +365,14 @@ For more information, see https://cloud.google.com/sql/docs/mysql/instance-setti
 				Description: `The connection profile display name.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `The resource labels for connection profile to use to annotate any related underlying resources such as Compute Engine VMs.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `The resource labels for connection profile to use to annotate any related underlying resources such as Compute Engine VMs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"location": {
 				Type:        schema.TypeString,
diff --git a/google/services/datafusion/resource_data_fusion_instance.go b/google/services/datafusion/resource_data_fusion_instance.go
index 6e73b85576c..9b2e79da081 100644
--- a/google/services/datafusion/resource_data_fusion_instance.go
+++ b/google/services/datafusion/resource_data_fusion_instance.go
@@ -199,7 +199,11 @@ Users will need to either manually update their state file to include these diff
 				Type:     schema.TypeMap,
 				Optional: true,
 				Description: `The resource labels for instance to use to annotate any related underlying resources,
-such as Compute Engine VMs.`,
+such as Compute Engine VMs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
 				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"network_config": {
diff --git a/google/services/dataplex/resource_dataplex_datascan.go b/google/services/dataplex/resource_dataplex_datascan.go
index b438f392430..fd8aef68cdf 100644
--- a/google/services/dataplex/resource_dataplex_datascan.go
+++ b/google/services/dataplex/resource_dataplex_datascan.go
@@ -498,10 +498,14 @@ Sampling is not applied if 'sampling_percent' is not specified, 0 or 100.`,
 				Description: `User friendly display name.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `User-defined labels for the scan. A list of key->value pairs.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `User-defined labels for the scan. A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"create_time": {
 				Type:        schema.TypeString,
diff --git a/google/services/dataplex/resource_dataplex_task.go b/google/services/dataplex/resource_dataplex_task.go
index f1b54cc7e02..5e7e2a09571 100644
--- a/google/services/dataplex/resource_dataplex_task.go
+++ b/google/services/dataplex/resource_dataplex_task.go
@@ -139,10 +139,14 @@ func ResourceDataplexTask() *schema.Resource {
 				Description: `User friendly display name.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `User-defined labels for the task.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `User-defined labels for the task.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"lake": {
 				Type:        schema.TypeString,
diff --git a/google/services/dataprocmetastore/resource_dataproc_metastore_service.go b/google/services/dataprocmetastore/resource_dataproc_metastore_service.go
index 5e5f35fa210..79b0ef5ee6f 100644
--- a/google/services/dataprocmetastore/resource_dataproc_metastore_service.go
+++ b/google/services/dataprocmetastore/resource_dataproc_metastore_service.go
@@ -152,10 +152,13 @@ The mappings override system defaults (some keys cannot be overridden)`,
 				},
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `User-defined labels for the metastore service.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `User-defined labels for the metastore service.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"location": {
 				Type:     schema.TypeString,
diff --git a/google/services/datastream/resource_datastream_connection_profile.go b/google/services/datastream/resource_datastream_connection_profile.go
index 320a36beae9..3c6dfd09ff8 100644
--- a/google/services/datastream/resource_datastream_connection_profile.go
+++ b/google/services/datastream/resource_datastream_connection_profile.go
@@ -146,10 +146,13 @@ func ResourceDatastreamConnectionProfile() *schema.Resource {
 				ExactlyOneOf: []string{"oracle_profile", "gcs_profile", "mysql_profile", "bigquery_profile", "postgresql_profile"},
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Labels.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Labels.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"mysql_profile": {
 				Type:        schema.TypeList,
diff --git a/google/services/datastream/resource_datastream_private_connection.go b/google/services/datastream/resource_datastream_private_connection.go
index b013b409460..f4d4c26e291 100644
--- a/google/services/datastream/resource_datastream_private_connection.go
+++ b/google/services/datastream/resource_datastream_private_connection.go
@@ -129,11 +129,14 @@ Format: projects/{project}/global/{networks}/{name}`,
 				},
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				ForceNew:    true,
-				Description: `Labels.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				ForceNew: true,
+				Description: `Labels.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"effective_labels": {
 				Type:        schema.TypeMap,
diff --git a/google/services/datastream/resource_datastream_stream.go b/google/services/datastream/resource_datastream_stream.go
index 90ef3cd857a..f18fcfdef92 100644
--- a/google/services/datastream/resource_datastream_stream.go
+++ b/google/services/datastream/resource_datastream_stream.go
@@ -1268,10 +1268,13 @@ https://www.postgresql.org/docs/current/datatype.html`,
 will be encrypted using an internal Stream-specific encryption key provisioned through KMS.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Labels.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Labels.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"effective_labels": {
 				Type:        schema.TypeMap,
diff --git a/google/services/dialogflowcx/resource_dialogflow_cx_intent.go b/google/services/dialogflowcx/resource_dialogflow_cx_intent.go
index 162c9d8d544..a48a97d3c3d 100644
--- a/google/services/dialogflowcx/resource_dialogflow_cx_intent.go
+++ b/google/services/dialogflowcx/resource_dialogflow_cx_intent.go
@@ -78,7 +78,11 @@ Adding training phrases to fallback intent is useful in the case of requests tha
 				Optional: true,
 				Description: `The key/value metadata to label an intent. Labels can contain lowercase letters, digits and the symbols '-' and '_'. International characters are allowed, including letters from unicase alphabets. Keys must start with a letter. Keys and values can be no longer than 63 characters and no more than 128 bytes.
 Prefix "sys-" is reserved for Dialogflow defined labels. Currently allowed Dialogflow defined labels include: * sys-head * sys-contextual The above labels do not require value. "sys-head" means the intent is a head intent. "sys.contextual" means the intent is a contextual intent.
-An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.`,
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
 				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"language_code": {
diff --git a/google/services/dns/resource_dns_managed_zone.go b/google/services/dns/resource_dns_managed_zone.go
index b71f33d63fb..14fdc72c2a7 100644
--- a/google/services/dns/resource_dns_managed_zone.go
+++ b/google/services/dns/resource_dns_managed_zone.go
@@ -199,10 +199,14 @@ one target is given.`,
 				},
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `A set of key/value label pairs to assign to this ManagedZone.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `A set of key/value label pairs to assign to this ManagedZone.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"peering_config": {
 				Type:     schema.TypeList,
diff --git a/google/services/filestore/resource_filestore_backup.go b/google/services/filestore/resource_filestore_backup.go
index d370b30fa5f..ad84ca506ad 100644
--- a/google/services/filestore/resource_filestore_backup.go
+++ b/google/services/filestore/resource_filestore_backup.go
@@ -90,10 +90,14 @@ character, which cannot be a dash.`,
 				Description: `A description of the backup with 2048 characters or less. Requests with longer descriptions will be rejected.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Resource labels to represent user-provided metadata.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"capacity_gb": {
 				Type:        schema.TypeString,
diff --git a/google/services/filestore/resource_filestore_instance.go b/google/services/filestore/resource_filestore_instance.go
index 2b8cd5432b8..0e964d4c933 100644
--- a/google/services/filestore/resource_filestore_instance.go
+++ b/google/services/filestore/resource_filestore_instance.go
@@ -227,10 +227,14 @@ Possible values include: STANDARD, PREMIUM, BASIC_HDD, BASIC_SSD, HIGH_SCALE_SSD
 				Description: `KMS key name used for data encryption.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Resource labels to represent user-provided metadata.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"location": {
 				Type:         schema.TypeString,
diff --git a/google/services/filestore/resource_filestore_snapshot.go b/google/services/filestore/resource_filestore_snapshot.go
index 402f012c671..357ca3ab6d6 100644
--- a/google/services/filestore/resource_filestore_snapshot.go
+++ b/google/services/filestore/resource_filestore_snapshot.go
@@ -85,10 +85,14 @@ character, which cannot be a dash.`,
 				Description: `A description of the snapshot with 2048 characters or less. Requests with longer descriptions will be rejected.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Resource labels to represent user-provided metadata.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"create_time": {
 				Type:        schema.TypeString,
diff --git a/google/services/gkebackup/resource_gke_backup_backup_plan.go b/google/services/gkebackup/resource_gke_backup_backup_plan.go
index da4131cc2fb..aed046c4573 100644
--- a/google/services/gkebackup/resource_gke_backup_backup_plan.go
+++ b/google/services/gkebackup/resource_gke_backup_backup_plan.go
@@ -209,7 +209,11 @@ from being created via this BackupPlan (including scheduled Backups).`,
 				Optional: true,
 				Description: `Description: A set of custom labels supplied by the user.
 A list of key->value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.`,
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
 				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"retention_policy": {
diff --git a/google/services/gkehub/resource_gke_hub_membership.go b/google/services/gkehub/resource_gke_hub_membership.go
index adf6fdb1439..9ebb4682dae 100644
--- a/google/services/gkehub/resource_gke_hub_membership.go
+++ b/google/services/gkehub/resource_gke_hub_membership.go
@@ -123,10 +123,14 @@ this can be '"//container.googleapis.com/${google_container_cluster.my-cluster.i
 				},
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Labels to apply to this membership.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Labels to apply to this membership.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"effective_labels": {
 				Type:        schema.TypeMap,
diff --git a/google/services/gkehub2/resource_gke_hub_feature.go b/google/services/gkehub2/resource_gke_hub_feature.go
index fac23fefafa..c74810545f1 100644
--- a/google/services/gkehub2/resource_gke_hub_feature.go
+++ b/google/services/gkehub2/resource_gke_hub_feature.go
@@ -62,10 +62,13 @@ func ResourceGKEHub2Feature() *schema.Resource {
 				Description: `The location for the resource`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `GCP labels for this Feature.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `GCP labels for this Feature.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"name": {
 				Type:             schema.TypeString,
diff --git a/google/services/gkehub2/resource_gke_hub_membership_binding.go b/google/services/gkehub2/resource_gke_hub_membership_binding.go
index c25f422dfa5..a5a44189878 100644
--- a/google/services/gkehub2/resource_gke_hub_membership_binding.go
+++ b/google/services/gkehub2/resource_gke_hub_membership_binding.go
@@ -80,10 +80,14 @@ func ResourceGKEHub2MembershipBinding() *schema.Resource {
 'projects/*/locations/*/scopes/*'.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Labels for this Membership binding.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Labels for this Membership binding.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"create_time": {
 				Type:        schema.TypeString,
diff --git a/google/services/gkehub2/resource_gke_hub_namespace.go b/google/services/gkehub2/resource_gke_hub_namespace.go
index e87ec2bec45..052d87b22a3 100644
--- a/google/services/gkehub2/resource_gke_hub_namespace.go
+++ b/google/services/gkehub2/resource_gke_hub_namespace.go
@@ -74,10 +74,14 @@ func ResourceGKEHub2Namespace() *schema.Resource {
 				Description: `Id of the scope`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Labels for this Namespace.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Labels for this Namespace.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"namespace_labels": {
 				Type:     schema.TypeMap,
diff --git a/google/services/gkehub2/resource_gke_hub_scope.go b/google/services/gkehub2/resource_gke_hub_scope.go
index f174433fa0f..936d26c2e18 100644
--- a/google/services/gkehub2/resource_gke_hub_scope.go
+++ b/google/services/gkehub2/resource_gke_hub_scope.go
@@ -61,10 +61,14 @@ func ResourceGKEHub2Scope() *schema.Resource {
 				Description: `The client-provided identifier of the scope.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Labels for this Scope.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Labels for this Scope.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"create_time": {
 				Type:        schema.TypeString,
diff --git a/google/services/gkehub2/resource_gke_hub_scope_rbac_role_binding.go b/google/services/gkehub2/resource_gke_hub_scope_rbac_role_binding.go
index 34af9183f62..31479c44875 100644
--- a/google/services/gkehub2/resource_gke_hub_scope_rbac_role_binding.go
+++ b/google/services/gkehub2/resource_gke_hub_scope_rbac_role_binding.go
@@ -92,10 +92,14 @@ group is the group, as seen by the kubernetes cluster.`,
 				ExactlyOneOf: []string{"user", "group"},
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Labels for this ScopeRBACRoleBinding.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Labels for this ScopeRBACRoleBinding.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"user": {
 				Type:     schema.TypeString,
diff --git a/google/services/healthcare/resource_healthcare_consent_store.go b/google/services/healthcare/resource_healthcare_consent_store.go
index f4e2c26b2ac..14f4b5de70e 100644
--- a/google/services/healthcare/resource_healthcare_consent_store.go
+++ b/google/services/healthcare/resource_healthcare_consent_store.go
@@ -94,7 +94,11 @@ bytes, and must conform to the following PCRE regular expression: '[\p{Ll}\p{Lo}
 No more than 64 labels can be associated with a given store.
 
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.`,
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
 				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"effective_labels": {
diff --git a/google/services/healthcare/resource_healthcare_dicom_store.go b/google/services/healthcare/resource_healthcare_dicom_store.go
index 8712ee80802..56b117ab63a 100644
--- a/google/services/healthcare/resource_healthcare_dicom_store.go
+++ b/google/services/healthcare/resource_healthcare_dicom_store.go
@@ -83,7 +83,11 @@ bytes, and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\
 No more than 64 labels can be associated with a given store.
 
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.`,
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
 				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"notification_config": {
diff --git a/google/services/healthcare/resource_healthcare_fhir_store.go b/google/services/healthcare/resource_healthcare_fhir_store.go
index 16e69ad3f63..d6f2637e9c2 100644
--- a/google/services/healthcare/resource_healthcare_fhir_store.go
+++ b/google/services/healthcare/resource_healthcare_fhir_store.go
@@ -152,7 +152,11 @@ bytes, and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\
 No more than 64 labels can be associated with a given store.
 
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.`,
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
 				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"notification_config": {
diff --git a/google/services/healthcare/resource_healthcare_hl7_v2_store.go b/google/services/healthcare/resource_healthcare_hl7_v2_store.go
index 838c2974c91..00a1fb9b7eb 100644
--- a/google/services/healthcare/resource_healthcare_hl7_v2_store.go
+++ b/google/services/healthcare/resource_healthcare_hl7_v2_store.go
@@ -87,7 +87,11 @@ bytes, and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\
 No more than 64 labels can be associated with a given store.
 
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.`,
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
 				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"notification_config": {
diff --git a/google/services/kms/resource_kms_crypto_key.go b/google/services/kms/resource_kms_crypto_key.go
index 042b4cb9bc1..49bff832bb4 100644
--- a/google/services/kms/resource_kms_crypto_key.go
+++ b/google/services/kms/resource_kms_crypto_key.go
@@ -95,10 +95,14 @@ If not specified at creation time, the default duration is 24 hours.`,
 				Description: `Whether this key may contain imported versions only.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Labels with user-defined metadata to apply to this resource.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Labels with user-defined metadata to apply to this resource.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"purpose": {
 				Type:     schema.TypeString,
diff --git a/google/services/memcache/resource_memcache_instance.go b/google/services/memcache/resource_memcache_instance.go
index 1763b6e8c74..ad8017826cb 100644
--- a/google/services/memcache/resource_memcache_instance.go
+++ b/google/services/memcache/resource_memcache_instance.go
@@ -103,10 +103,14 @@ func ResourceMemcacheInstance() *schema.Resource {
 				Description: `A user-visible name for the instance.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Resource labels to represent user-provided metadata.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"maintenance_policy": {
 				Type:        schema.TypeList,
diff --git a/google/services/mlengine/resource_ml_engine_model.go b/google/services/mlengine/resource_ml_engine_model.go
index 30e3de14092..e2596fd98ba 100644
--- a/google/services/mlengine/resource_ml_engine_model.go
+++ b/google/services/mlengine/resource_ml_engine_model.go
@@ -82,11 +82,14 @@ prediction requests that do not specify a version.`,
 				Description: `The description specified for the model when it was created.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				ForceNew:    true,
-				Description: `One or more labels that you can add, to organize your models.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				ForceNew: true,
+				Description: `One or more labels that you can add, to organize your models.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"online_prediction_console_logging": {
 				Type:        schema.TypeBool,
diff --git a/google/services/networkconnectivity/resource_network_connectivity_service_connection_policy.go b/google/services/networkconnectivity/resource_network_connectivity_service_connection_policy.go
index 0afde6f4e39..88bc81589fa 100644
--- a/google/services/networkconnectivity/resource_network_connectivity_service_connection_policy.go
+++ b/google/services/networkconnectivity/resource_network_connectivity_service_connection_policy.go
@@ -86,10 +86,14 @@ It is provided by the Service Producer. Google services have a prefix of gcp. Fo
 				Description: `Free-text description of the resource.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `User-defined labels.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `User-defined labels.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"psc_config": {
 				Type:        schema.TypeList,
diff --git a/google/services/networkmanagement/resource_network_management_connectivity_test_resource.go b/google/services/networkmanagement/resource_network_management_connectivity_test_resource.go
index 3a201954a08..66272fd9cea 100644
--- a/google/services/networkmanagement/resource_network_management_connectivity_test_resource.go
+++ b/google/services/networkmanagement/resource_network_management_connectivity_test_resource.go
@@ -205,10 +205,14 @@ The following are two cases where you must provide the project ID:
 Maximum of 512 characters.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Resource labels to represent user-provided metadata.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"protocol": {
 				Type:        schema.TypeString,
diff --git a/google/services/networksecurity/resource_network_security_address_group.go b/google/services/networksecurity/resource_network_security_address_group.go
index 18ac195a0f5..c6746bca261 100644
--- a/google/services/networksecurity/resource_network_security_address_group.go
+++ b/google/services/networksecurity/resource_network_security_address_group.go
@@ -93,7 +93,11 @@ The default value is 'global'.`,
 				Type:     schema.TypeMap,
 				Optional: true,
 				Description: `Set of label tags associated with the AddressGroup resource.
-An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.`,
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
 				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"parent": {
diff --git a/google/services/networkservices/resource_network_services_edge_cache_keyset.go b/google/services/networkservices/resource_network_services_edge_cache_keyset.go
index 918bfdd7df4..aa1e47b8e51 100644
--- a/google/services/networkservices/resource_network_services_edge_cache_keyset.go
+++ b/google/services/networkservices/resource_network_services_edge_cache_keyset.go
@@ -68,10 +68,13 @@ and all following characters must be a dash, underscore, letter or digit.`,
 				Description: `A human-readable description of the resource.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Set of label tags associated with the EdgeCache resource.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Set of label tags associated with the EdgeCache resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"public_key": {
 				Type:     schema.TypeList,
diff --git a/google/services/networkservices/resource_network_services_edge_cache_origin.go b/google/services/networkservices/resource_network_services_edge_cache_origin.go
index d291f8322b3..b45185924cc 100644
--- a/google/services/networkservices/resource_network_services_edge_cache_origin.go
+++ b/google/services/networkservices/resource_network_services_edge_cache_origin.go
@@ -117,10 +117,13 @@ The value of timeout.maxAttemptsTimeout dictates the timeout across all origins.
 A reference to a Topic resource.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Set of label tags associated with the EdgeCache resource.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Set of label tags associated with the EdgeCache resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"max_attempts": {
 				Type:         schema.TypeInt,
diff --git a/google/services/networkservices/resource_network_services_edge_cache_service.go b/google/services/networkservices/resource_network_services_edge_cache_service.go
index 4e868499002..290de3becc4 100644
--- a/google/services/networkservices/resource_network_services_edge_cache_service.go
+++ b/google/services/networkservices/resource_network_services_edge_cache_service.go
@@ -936,10 +936,13 @@ Note that only "global" certificates with a "scope" of "EDGE_CACHE" can be attac
 				},
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Set of label tags associated with the EdgeCache resource.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Set of label tags associated with the EdgeCache resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"log_config": {
 				Type:        schema.TypeList,
diff --git a/google/services/networkservices/resource_network_services_gateway.go b/google/services/networkservices/resource_network_services_gateway.go
index 03c2f239665..ee3adf7a047 100644
--- a/google/services/networkservices/resource_network_services_gateway.go
+++ b/google/services/networkservices/resource_network_services_gateway.go
@@ -228,10 +228,13 @@ For example: 'projects/*/locations/*/gatewaySecurityPolicies/swg-policy'.
 This policy is specific to gateways of type 'SECURE_WEB_GATEWAY'.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Set of label tags associated with the Gateway resource.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Set of label tags associated with the Gateway resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"location": {
 				Type:     schema.TypeString,
diff --git a/google/services/notebooks/resource_notebooks_instance.go b/google/services/notebooks/resource_notebooks_instance.go
index 99bbce4a290..7aa89e6fc47 100644
--- a/google/services/notebooks/resource_notebooks_instance.go
+++ b/google/services/notebooks/resource_notebooks_instance.go
@@ -214,7 +214,11 @@ Format: projects/{project_id}/locations/{location}/keyRings/{key_ring_id}/crypto
 				Type:     schema.TypeMap,
 				Optional: true,
 				Description: `Labels to apply to this instance. These can be later modified by the setLabels method.
-An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.`,
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
 				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"metadata": {
diff --git a/google/services/privateca/resource_privateca_ca_pool.go b/google/services/privateca/resource_privateca_ca_pool.go
index 996db4de3a9..82c1e0d49ba 100644
--- a/google/services/privateca/resource_privateca_ca_pool.go
+++ b/google/services/privateca/resource_privateca_ca_pool.go
@@ -556,7 +556,11 @@ expires before a Certificate's requested maximumLifetime, the effective lifetime
 				Description: `Labels with user-defined metadata.
 
 An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":
-"1.3kg", "count": "3" }.`,
+"1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
 				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"publishing_options": {
diff --git a/google/services/privateca/resource_privateca_certificate.go b/google/services/privateca/resource_privateca_certificate.go
index 411f7a03784..7e3876ffbe1 100644
--- a/google/services/privateca/resource_privateca_certificate.go
+++ b/google/services/privateca/resource_privateca_certificate.go
@@ -629,10 +629,14 @@ leading period (like '.example.com')`,
 				ExactlyOneOf: []string{"pem_csr", "config"},
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Labels with user-defined metadata to apply to this resource.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Labels with user-defined metadata to apply to this resource.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"lifetime": {
 				Type:     schema.TypeString,
diff --git a/google/services/privateca/resource_privateca_certificate_authority.go b/google/services/privateca/resource_privateca_certificate_authority.go
index 5768c1169cc..c37dd0a0ac8 100644
--- a/google/services/privateca/resource_privateca_certificate_authority.go
+++ b/google/services/privateca/resource_privateca_certificate_authority.go
@@ -659,7 +659,11 @@ Use with care. Defaults to 'false'.`,
 				Description: `Labels with user-defined metadata.
 
 An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":
-"1.3kg", "count": "3" }.`,
+"1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
 				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"lifetime": {
diff --git a/google/services/pubsub/resource_pubsub_subscription.go b/google/services/pubsub/resource_pubsub_subscription.go
index 81d330eff7d..513d523f97e 100644
--- a/google/services/pubsub/resource_pubsub_subscription.go
+++ b/google/services/pubsub/resource_pubsub_subscription.go
@@ -306,10 +306,14 @@ by their attributes. The maximum length of a filter is 256 bytes. After creating
 you can't modify the filter.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `A set of key/value label pairs to assign to this Subscription.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `A set of key/value label pairs to assign to this Subscription.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"message_retention_duration": {
 				Type:     schema.TypeString,
diff --git a/google/services/pubsub/resource_pubsub_topic.go b/google/services/pubsub/resource_pubsub_topic.go
index 920f7c9a911..8b6dd482975 100644
--- a/google/services/pubsub/resource_pubsub_topic.go
+++ b/google/services/pubsub/resource_pubsub_topic.go
@@ -72,10 +72,14 @@ to messages published on this topic. Your project's PubSub service account
 The expected format is 'projects/*/locations/*/keyRings/*/cryptoKeys/*'`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `A set of key/value label pairs to assign to this Topic.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `A set of key/value label pairs to assign to this Topic.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"message_retention_duration": {
 				Type:     schema.TypeString,
diff --git a/google/services/redis/resource_redis_instance.go b/google/services/redis/resource_redis_instance.go
index 536c49e34e0..2221d431f6a 100644
--- a/google/services/redis/resource_redis_instance.go
+++ b/google/services/redis/resource_redis_instance.go
@@ -159,10 +159,13 @@ instance. If this is provided, CMEK is enabled.`,
 				Description: `An arbitrary and optional user-provided name for the instance.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `Resource labels to represent user provided metadata.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `Resource labels to represent user provided metadata.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"location_id": {
 				Type:     schema.TypeString,
diff --git a/google/services/secretmanager/resource_secret_manager_secret.go b/google/services/secretmanager/resource_secret_manager_secret.go
index 5367bb6018a..1d6e2f4e1c1 100644
--- a/google/services/secretmanager/resource_secret_manager_secret.go
+++ b/google/services/secretmanager/resource_secret_manager_secret.go
@@ -214,7 +214,11 @@ and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\p{N}_-]
 No more than 64 labels can be assigned to a given resource.
 
 An object containing a list of "key": value pairs. Example:
-{ "name": "wrench", "mass": "1.3kg", "count": "3" }.`,
+{ "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
 				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"rotation": {
diff --git a/google/services/spanner/resource_spanner_instance.go b/google/services/spanner/resource_spanner_instance.go
index 7feeb5d27b1..594c7c88be2 100644
--- a/google/services/spanner/resource_spanner_instance.go
+++ b/google/services/spanner/resource_spanner_instance.go
@@ -149,7 +149,11 @@ If not provided, a random string starting with 'tf-' will be selected.`,
 				Type:     schema.TypeMap,
 				Optional: true,
 				Description: `An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.`,
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
 				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"num_nodes": {
diff --git a/google/services/tpu/resource_tpu_node.go b/google/services/tpu/resource_tpu_node.go
index 05768087e36..32ab4c2697c 100644
--- a/google/services/tpu/resource_tpu_node.go
+++ b/google/services/tpu/resource_tpu_node.go
@@ -147,11 +147,14 @@ is peered with another network that is using that CIDR block.`,
 				Description: `The user-supplied description of the TPU. Maximum of 512 characters.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				ForceNew:    true,
-				Description: `Resource labels to represent user provided metadata.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				ForceNew: true,
+				Description: `Resource labels to represent user provided metadata.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"network": {
 				Type:             schema.TypeString,
diff --git a/google/services/vertexai/resource_vertex_ai_dataset.go b/google/services/vertexai/resource_vertex_ai_dataset.go
index 906d3e804d3..c85cffa2cfe 100644
--- a/google/services/vertexai/resource_vertex_ai_dataset.go
+++ b/google/services/vertexai/resource_vertex_ai_dataset.go
@@ -80,10 +80,14 @@ Has the form: projects/my-project/locations/my-region/keyRings/my-kr/cryptoKeys/
 				},
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `A set of key/value label pairs to assign to this Workflow.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `A set of key/value label pairs to assign to this Workflow.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"region": {
 				Type:        schema.TypeString,
diff --git a/google/services/vertexai/resource_vertex_ai_endpoint.go b/google/services/vertexai/resource_vertex_ai_endpoint.go
index 904ff0218a3..7fec62f3b09 100644
--- a/google/services/vertexai/resource_vertex_ai_endpoint.go
+++ b/google/services/vertexai/resource_vertex_ai_endpoint.go
@@ -94,10 +94,13 @@ func ResourceVertexAIEndpoint() *schema.Resource {
 				},
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `The labels with user-defined metadata to organize your Endpoints. Label keys and values can be no longer than 64 characters (Unicode codepoints), can only contain lowercase letters, numeric characters, underscores and dashes. International characters are allowed. See https://goo.gl/xmQnxf for more information and examples of labels.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `The labels with user-defined metadata to organize your Endpoints. Label keys and values can be no longer than 64 characters (Unicode codepoints), can only contain lowercase letters, numeric characters, underscores and dashes. International characters are allowed. See https://goo.gl/xmQnxf for more information and examples of labels.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"network": {
 				Type:        schema.TypeString,
diff --git a/google/services/vertexai/resource_vertex_ai_featurestore.go b/google/services/vertexai/resource_vertex_ai_featurestore.go
index 68a7a6a34e1..589d86f2b3b 100644
--- a/google/services/vertexai/resource_vertex_ai_featurestore.go
+++ b/google/services/vertexai/resource_vertex_ai_featurestore.go
@@ -70,10 +70,14 @@ func ResourceVertexAIFeaturestore() *schema.Resource {
 				},
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `A set of key/value label pairs to assign to this Featurestore.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `A set of key/value label pairs to assign to this Featurestore.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"name": {
 				Type:        schema.TypeString,
diff --git a/google/services/vertexai/resource_vertex_ai_featurestore_entitytype.go b/google/services/vertexai/resource_vertex_ai_featurestore_entitytype.go
index c7535ede533..6be4e439062 100644
--- a/google/services/vertexai/resource_vertex_ai_featurestore_entitytype.go
+++ b/google/services/vertexai/resource_vertex_ai_featurestore_entitytype.go
@@ -66,10 +66,14 @@ func ResourceVertexAIFeaturestoreEntitytype() *schema.Resource {
 				Description: `Optional. Description of the EntityType.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `A set of key/value label pairs to assign to this EntityType.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `A set of key/value label pairs to assign to this EntityType.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"monitoring_config": {
 				Type:     schema.TypeList,
diff --git a/google/services/vertexai/resource_vertex_ai_featurestore_entitytype_feature.go b/google/services/vertexai/resource_vertex_ai_featurestore_entitytype_feature.go
index 0f8d22336ca..af8ace194fb 100644
--- a/google/services/vertexai/resource_vertex_ai_featurestore_entitytype_feature.go
+++ b/google/services/vertexai/resource_vertex_ai_featurestore_entitytype_feature.go
@@ -72,10 +72,14 @@ func ResourceVertexAIFeaturestoreEntitytypeFeature() *schema.Resource {
 				Description: `Description of the feature.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `A set of key/value label pairs to assign to the feature.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `A set of key/value label pairs to assign to the feature.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"name": {
 				Type:        schema.TypeString,
diff --git a/google/services/vertexai/resource_vertex_ai_index.go b/google/services/vertexai/resource_vertex_ai_index.go
index 38c7c4ab4ce..b66ec5686f7 100644
--- a/google/services/vertexai/resource_vertex_ai_index.go
+++ b/google/services/vertexai/resource_vertex_ai_index.go
@@ -74,10 +74,13 @@ func ResourceVertexAIIndex() *schema.Resource {
 				Default: "BATCH_UPDATE",
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `The labels with user-defined metadata to organize your Indexes.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `The labels with user-defined metadata to organize your Indexes.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"metadata": {
 				Type:        schema.TypeList,
diff --git a/google/services/vertexai/resource_vertex_ai_index_endpoint.go b/google/services/vertexai/resource_vertex_ai_index_endpoint.go
index 75fa9d1d525..5781966669c 100644
--- a/google/services/vertexai/resource_vertex_ai_index_endpoint.go
+++ b/google/services/vertexai/resource_vertex_ai_index_endpoint.go
@@ -65,10 +65,13 @@ func ResourceVertexAIIndexEndpoint() *schema.Resource {
 				Description: `The description of the Index.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `The labels with user-defined metadata to organize your Indexes.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `The labels with user-defined metadata to organize your Indexes.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"network": {
 				Type:     schema.TypeString,
diff --git a/google/services/vertexai/resource_vertex_ai_tensorboard.go b/google/services/vertexai/resource_vertex_ai_tensorboard.go
index 253c710f3fc..fb58ff237d5 100644
--- a/google/services/vertexai/resource_vertex_ai_tensorboard.go
+++ b/google/services/vertexai/resource_vertex_ai_tensorboard.go
@@ -83,10 +83,14 @@ Has the form: projects/my-project/locations/my-region/keyRings/my-kr/cryptoKeys/
 				},
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `The labels with user-defined metadata to organize your Tensorboards.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `The labels with user-defined metadata to organize your Tensorboards.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"region": {
 				Type:        schema.TypeString,
diff --git a/google/services/workflows/resource_workflows_workflow.go b/google/services/workflows/resource_workflows_workflow.go
index 39fec6d7412..6e826655744 100644
--- a/google/services/workflows/resource_workflows_workflow.go
+++ b/google/services/workflows/resource_workflows_workflow.go
@@ -75,10 +75,14 @@ Format: projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{c
 				Description: `Description of the workflow provided by the user. Must be at most 1000 unicode characters long.`,
 			},
 			"labels": {
-				Type:        schema.TypeMap,
-				Optional:    true,
-				Description: `A set of key/value label pairs to assign to this Workflow.`,
-				Elem:        &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeMap,
+				Optional: true,
+				Description: `A set of key/value label pairs to assign to this Workflow.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
+				Elem: &schema.Schema{Type: schema.TypeString},
 			},
 			"name": {
 				Type:        schema.TypeString,
diff --git a/google/tpgresource/annotations.go b/google/tpgresource/annotations.go
index 23fe7efe58a..ec286a7470c 100644
--- a/google/tpgresource/annotations.go
+++ b/google/tpgresource/annotations.go
@@ -15,6 +15,10 @@ func SetAnnotationsDiff(_ context.Context, d *schema.ResourceDiff, meta interfac
 		return nil
 	}
 
+	if d.Get("effective_annotations") == nil {
+		return fmt.Errorf("`effective_annotations` field is not present in the resource schema.")
+	}
+
 	o, n := d.GetChange("annotations")
 	effectiveAnnotations := d.Get("effective_annotations").(map[string]interface{})
 
@@ -46,6 +50,10 @@ func SetMetadataAnnotationsDiff(_ context.Context, d *schema.ResourceDiff, meta
 		return nil
 	}
 
+	if d.Get("metadata.0.effective_annotations") == nil {
+		return fmt.Errorf("`metadata.0.effective_annotations` field is not present in the resource schema.")
+	}
+
 	o, n := d.GetChange("metadata.0.annotations")
 	effectiveAnnotations := d.Get("metadata.0.effective_annotations").(map[string]interface{})
 
diff --git a/google/tpgresource/labels.go b/google/tpgresource/labels.go
index b7b585c4cd0..f4de95baa12 100644
--- a/google/tpgresource/labels.go
+++ b/google/tpgresource/labels.go
@@ -22,7 +22,7 @@ func SetLabels(labels map[string]string, d *schema.ResourceData, lineage string)
 
 	if v, ok := d.GetOk(lineage); ok {
 		if labels != nil {
-			for k, _ := range v.(map[string]interface{}) {
+			for k := range v.(map[string]interface{}) {
 				transformed[k] = labels[k]
 			}
 		}
@@ -58,6 +58,19 @@ func SetDataSourceLabels(d *schema.ResourceData) error {
 }
 
 func SetLabelsDiff(_ context.Context, d *schema.ResourceDiff, meta interface{}) error {
+	raw := d.Get("labels")
+	if raw == nil {
+		return nil
+	}
+
+	if d.Get("terraform_labels") == nil {
+		return fmt.Errorf("`terraform_labels` field is not present in the resource schema.")
+	}
+
+	if d.Get("effective_labels") == nil {
+		return fmt.Errorf("`effective_labels` field is not present in the resource schema.")
+	}
+
 	config := meta.(*transport_tpg.Config)
 
 	// Merge provider default labels with the user defined labels in the resource to get terraform managed labels
@@ -66,11 +79,6 @@ func SetLabelsDiff(_ context.Context, d *schema.ResourceDiff, meta interface{})
 		terraformLabels[k] = v
 	}
 
-	raw := d.Get("labels")
-	if raw == nil {
-		return nil
-	}
-
 	labels := raw.(map[string]interface{})
 	for k, v := range labels {
 		terraformLabels[k] = v.(string)
@@ -111,6 +119,14 @@ func SetMetadataLabelsDiff(_ context.Context, d *schema.ResourceDiff, meta inter
 		return nil
 	}
 
+	if d.Get("metadata.0.terraform_labels") == nil {
+		return fmt.Errorf("`metadata.0.terraform_labels` field is not present in the resource schema.")
+	}
+
+	if d.Get("metadata.0.effective_labels") == nil {
+		return fmt.Errorf("`metadata.0.effective_labels` field is not present in the resource schema.")
+	}
+
 	config := meta.(*transport_tpg.Config)
 
 	// Merge provider default labels with the user defined labels in the resource to get terraform managed labels
diff --git a/website/docs/r/active_directory_domain.html.markdown b/website/docs/r/active_directory_domain.html.markdown
index 7b7cf3c3413..9207fe3eeab 100644
--- a/website/docs/r/active_directory_domain.html.markdown
+++ b/website/docs/r/active_directory_domain.html.markdown
@@ -66,6 +66,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Resource labels that can contain user-provided metadata
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `authorized_networks` -
   (Optional)
diff --git a/website/docs/r/active_directory_peering.html.markdown b/website/docs/r/active_directory_peering.html.markdown
index c293a81393f..9b87b6f05de 100644
--- a/website/docs/r/active_directory_peering.html.markdown
+++ b/website/docs/r/active_directory_peering.html.markdown
@@ -101,6 +101,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Resource labels that can contain user-provided metadata
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `status` -
   (Optional)
diff --git a/website/docs/r/alloydb_backup.html.markdown b/website/docs/r/alloydb_backup.html.markdown
index 9aeec78984f..fcc7a6f3f87 100644
--- a/website/docs/r/alloydb_backup.html.markdown
+++ b/website/docs/r/alloydb_backup.html.markdown
@@ -155,6 +155,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   User-defined labels for the alloydb backup.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `description` -
   (Optional)
diff --git a/website/docs/r/alloydb_cluster.html.markdown b/website/docs/r/alloydb_cluster.html.markdown
index 2a87d0a7b26..8f141815eb8 100644
--- a/website/docs/r/alloydb_cluster.html.markdown
+++ b/website/docs/r/alloydb_cluster.html.markdown
@@ -208,6 +208,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   User-defined labels for the alloydb cluster.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `encryption_config` -
   (Optional)
diff --git a/website/docs/r/alloydb_instance.html.markdown b/website/docs/r/alloydb_instance.html.markdown
index 5aeb0d7e002..ac7e20c0a0c 100644
--- a/website/docs/r/alloydb_instance.html.markdown
+++ b/website/docs/r/alloydb_instance.html.markdown
@@ -106,6 +106,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   User-defined labels for the alloydb instance.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `annotations` -
   (Optional)
diff --git a/website/docs/r/api_gateway_api.html.markdown b/website/docs/r/api_gateway_api.html.markdown
index 9b3e6db8ee9..058e6249833 100644
--- a/website/docs/r/api_gateway_api.html.markdown
+++ b/website/docs/r/api_gateway_api.html.markdown
@@ -71,6 +71,9 @@ The following arguments are supported:
   (Optional)
   Resource labels to represent user-provided metadata.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.
 
diff --git a/website/docs/r/api_gateway_api_config.html.markdown b/website/docs/r/api_gateway_api_config.html.markdown
index b0cc2459900..41e86a20cbe 100644
--- a/website/docs/r/api_gateway_api_config.html.markdown
+++ b/website/docs/r/api_gateway_api_config.html.markdown
@@ -134,6 +134,9 @@ The following arguments are supported:
   (Optional)
   Resource labels to represent user-provided metadata.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `gateway_config` -
   (Optional)
   Immutable. Gateway specific configuration.
diff --git a/website/docs/r/api_gateway_gateway.html.markdown b/website/docs/r/api_gateway_gateway.html.markdown
index 8ef18b3c502..f2c79febbb2 100644
--- a/website/docs/r/api_gateway_gateway.html.markdown
+++ b/website/docs/r/api_gateway_gateway.html.markdown
@@ -93,6 +93,9 @@ The following arguments are supported:
   (Optional)
   Resource labels to represent user-provided metadata.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `region` -
   (Optional)
   The region of the gateway for the API.
diff --git a/website/docs/r/artifact_registry_repository.html.markdown b/website/docs/r/artifact_registry_repository.html.markdown
index 135d5b08adc..442b5ac0393 100644
--- a/website/docs/r/artifact_registry_repository.html.markdown
+++ b/website/docs/r/artifact_registry_repository.html.markdown
@@ -229,6 +229,9 @@ The following arguments are supported:
   and may only contain lowercase letters, numeric characters, underscores,
   and dashes.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `kms_key_name` -
   (Optional)
   The Cloud KMS resource name of the customer managed encryption key that’s
diff --git a/website/docs/r/beyondcorp_app_connection.html.markdown b/website/docs/r/beyondcorp_app_connection.html.markdown
index 56b6c38da1c..b2d00336d97 100644
--- a/website/docs/r/beyondcorp_app_connection.html.markdown
+++ b/website/docs/r/beyondcorp_app_connection.html.markdown
@@ -151,6 +151,9 @@ The following arguments are supported:
   (Optional)
   Resource labels to represent user provided metadata.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `type` -
   (Optional)
   The type of network connectivity used by the AppConnection. Refer to
diff --git a/website/docs/r/beyondcorp_app_connector.html.markdown b/website/docs/r/beyondcorp_app_connector.html.markdown
index b0c9539db76..5fbf0193c8b 100644
--- a/website/docs/r/beyondcorp_app_connector.html.markdown
+++ b/website/docs/r/beyondcorp_app_connector.html.markdown
@@ -129,6 +129,9 @@ The following arguments are supported:
   (Optional)
   Resource labels to represent user provided metadata.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.
 
diff --git a/website/docs/r/beyondcorp_app_gateway.html.markdown b/website/docs/r/beyondcorp_app_gateway.html.markdown
index e8763290502..b5adc40e1f3 100644
--- a/website/docs/r/beyondcorp_app_gateway.html.markdown
+++ b/website/docs/r/beyondcorp_app_gateway.html.markdown
@@ -105,6 +105,9 @@ The following arguments are supported:
   (Optional)
   Resource labels to represent user provided metadata.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.
 
diff --git a/website/docs/r/bigquery_dataset.html.markdown b/website/docs/r/bigquery_dataset.html.markdown
index a27ba1029d6..32a1aaa985b 100644
--- a/website/docs/r/bigquery_dataset.html.markdown
+++ b/website/docs/r/bigquery_dataset.html.markdown
@@ -271,7 +271,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   The labels associated with this dataset. You can use these to
-  organize and group your datasets
+  organize and group your datasets.
+
   **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
   Please refer to the field `effective_labels` for all of the labels present on the resource.
 
diff --git a/website/docs/r/bigquery_job.html.markdown b/website/docs/r/bigquery_job.html.markdown
index 9a2b0fefce0..768b8a66029 100644
--- a/website/docs/r/bigquery_job.html.markdown
+++ b/website/docs/r/bigquery_job.html.markdown
@@ -1040,6 +1040,9 @@ The following arguments are supported:
   (Optional)
   The labels associated with this job. You can use these to organize and group your jobs.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `query` -
   (Optional)
   Configures a query job.
diff --git a/website/docs/r/bigquery_table.html.markdown b/website/docs/r/bigquery_table.html.markdown
index 78d4668a668..929a8e8f2c7 100644
--- a/website/docs/r/bigquery_table.html.markdown
+++ b/website/docs/r/bigquery_table.html.markdown
@@ -114,6 +114,9 @@ The following arguments are supported:
 
 * `labels` - (Optional) A mapping of labels to assign to the resource.
 
+    **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+    Please refer to the field 'effective_labels' for all of the labels present on the resource.
+
 * `terraform_labels` -
   The combination of labels configured directly on the resource and default labels configured on the provider.
 
diff --git a/website/docs/r/bigtable_instance.html.markdown b/website/docs/r/bigtable_instance.html.markdown
index 0a9b8887761..9f64f4873d6 100644
--- a/website/docs/r/bigtable_instance.html.markdown
+++ b/website/docs/r/bigtable_instance.html.markdown
@@ -102,6 +102,9 @@ in Terraform state, a `terraform destroy` or `terraform apply` that would delete
 
 * `labels` - (Optional) A set of key/value label pairs to assign to the resource. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field 'effective_labels' for all of the labels present on the resource.
+
 * `terraform_labels` -
   The combination of labels configured directly on the resource and default labels configured on the provider.
 
diff --git a/website/docs/r/certificate_manager_certificate.html.markdown b/website/docs/r/certificate_manager_certificate.html.markdown
index 6091f8d161e..a33d1401d3c 100644
--- a/website/docs/r/certificate_manager_certificate.html.markdown
+++ b/website/docs/r/certificate_manager_certificate.html.markdown
@@ -212,6 +212,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Set of label tags associated with the Certificate resource.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `scope` -
   (Optional)
diff --git a/website/docs/r/certificate_manager_certificate_issuance_config.html.markdown b/website/docs/r/certificate_manager_certificate_issuance_config.html.markdown
index 1d258297f8a..d342563ac3e 100644
--- a/website/docs/r/certificate_manager_certificate_issuance_config.html.markdown
+++ b/website/docs/r/certificate_manager_certificate_issuance_config.html.markdown
@@ -160,6 +160,9 @@ The following arguments are supported:
   'Set of label tags associated with the CertificateIssuanceConfig resource.
    An object containing a list of "key": value pairs. Example: { "name": "wrench", "count": "3" }.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `location` -
   (Optional)
   The Certificate Manager location. If not specified, "global" is used.
diff --git a/website/docs/r/certificate_manager_certificate_map.html.markdown b/website/docs/r/certificate_manager_certificate_map.html.markdown
index 82d3f24efb6..1fc87894f1d 100644
--- a/website/docs/r/certificate_manager_certificate_map.html.markdown
+++ b/website/docs/r/certificate_manager_certificate_map.html.markdown
@@ -66,6 +66,9 @@ The following arguments are supported:
   (Optional)
   Set of labels associated with a Certificate Map resource.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.
 
diff --git a/website/docs/r/certificate_manager_certificate_map_entry.html.markdown b/website/docs/r/certificate_manager_certificate_map_entry.html.markdown
index a94f10e178d..636191035f3 100644
--- a/website/docs/r/certificate_manager_certificate_map_entry.html.markdown
+++ b/website/docs/r/certificate_manager_certificate_map_entry.html.markdown
@@ -120,6 +120,9 @@ The following arguments are supported:
   An object containing a list of "key": value pairs.
   Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `hostname` -
   (Optional)
   A Hostname (FQDN, e.g. example.com) or a wildcard hostname expression (*.example.com)
diff --git a/website/docs/r/certificate_manager_dns_authorization.html.markdown b/website/docs/r/certificate_manager_dns_authorization.html.markdown
index bde2d3fcdde..10a971c0b50 100644
--- a/website/docs/r/certificate_manager_dns_authorization.html.markdown
+++ b/website/docs/r/certificate_manager_dns_authorization.html.markdown
@@ -79,6 +79,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Set of label tags associated with the DNS Authorization resource.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.
diff --git a/website/docs/r/certificate_manager_trust_config.html.markdown b/website/docs/r/certificate_manager_trust_config.html.markdown
index fb8ce20ea60..d684061912c 100644
--- a/website/docs/r/certificate_manager_trust_config.html.markdown
+++ b/website/docs/r/certificate_manager_trust_config.html.markdown
@@ -81,6 +81,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Set of label tags associated with the trust config.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `description` -
   (Optional)
diff --git a/website/docs/r/cloud_run_domain_mapping.html.markdown b/website/docs/r/cloud_run_domain_mapping.html.markdown
index 51f5e7c7f1d..d8be9d2c373 100644
--- a/website/docs/r/cloud_run_domain_mapping.html.markdown
+++ b/website/docs/r/cloud_run_domain_mapping.html.markdown
@@ -123,6 +123,8 @@ The following arguments are supported:
   (scope and select) objects. May match selectors of replication controllers
   and routes.
   More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `generation` -
   (Output)
diff --git a/website/docs/r/cloud_run_service.html.markdown b/website/docs/r/cloud_run_service.html.markdown
index 6c7efc4c9c0..cc16e788568 100644
--- a/website/docs/r/cloud_run_service.html.markdown
+++ b/website/docs/r/cloud_run_service.html.markdown
@@ -920,6 +920,8 @@ this field is set to false, the revision name will still autogenerate.)
   Map of string keys and values that can be used to organize and categorize
   (scope and select) objects. May match selectors of replication controllers
   and routes.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `generation` -
   (Output)
diff --git a/website/docs/r/cloud_run_v2_job.html.markdown b/website/docs/r/cloud_run_v2_job.html.markdown
index b30d3ef5ebf..53b4535b5a5 100644
--- a/website/docs/r/cloud_run_v2_job.html.markdown
+++ b/website/docs/r/cloud_run_v2_job.html.markdown
@@ -647,6 +647,8 @@ The following arguments are supported:
   environment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.
   Cloud Run API v2 does not support labels with `run.googleapis.com`, `cloud.googleapis.com`, `serving.knative.dev`, or `autoscaling.knative.dev` namespaces, and they will be rejected.
   All system labels in v1 now have a corresponding field in v2 Job.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `annotations` -
   (Optional)
diff --git a/website/docs/r/cloud_run_v2_service.html.markdown b/website/docs/r/cloud_run_v2_service.html.markdown
index a4dc64a2260..8ab1c3029e5 100644
--- a/website/docs/r/cloud_run_v2_service.html.markdown
+++ b/website/docs/r/cloud_run_v2_service.html.markdown
@@ -839,6 +839,8 @@ The following arguments are supported:
   environment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.
   Cloud Run API v2 does not support labels with  `run.googleapis.com`, `cloud.googleapis.com`, `serving.knative.dev`, or `autoscaling.knative.dev` namespaces, and they will be rejected.
   All system labels in v1 now have a corresponding field in v2 Service.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `annotations` -
   (Optional)
diff --git a/website/docs/r/cloudfunctions2_function.html.markdown b/website/docs/r/cloudfunctions2_function.html.markdown
index 47b4d4d9607..601d67083a5 100644
--- a/website/docs/r/cloudfunctions2_function.html.markdown
+++ b/website/docs/r/cloudfunctions2_function.html.markdown
@@ -802,6 +802,9 @@ The following arguments are supported:
   (Optional)
   A set of key/value label pairs associated with this Cloud Function.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `kms_key_name` -
   (Optional)
   Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources.
diff --git a/website/docs/r/compute_address.html.markdown b/website/docs/r/compute_address.html.markdown
index 452222ea3c1..2bbca9a6a0b 100644
--- a/website/docs/r/compute_address.html.markdown
+++ b/website/docs/r/compute_address.html.markdown
@@ -227,6 +227,7 @@ The following arguments are supported:
 * `labels` -
   (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html))
   Labels to apply to this address.  A list of key->value pairs.
+
   **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
   Please refer to the field `effective_labels` for all of the labels present on the resource.
 
diff --git a/website/docs/r/compute_disk.html.markdown b/website/docs/r/compute_disk.html.markdown
index 30f078a4309..ec241b9d5bd 100644
--- a/website/docs/r/compute_disk.html.markdown
+++ b/website/docs/r/compute_disk.html.markdown
@@ -159,6 +159,9 @@ The following arguments are supported:
   (Optional)
   Labels to apply to this disk.  A list of key->value pairs.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `size` -
   (Optional)
   Size of the persistent disk, specified in GB. You can specify this
diff --git a/website/docs/r/compute_external_vpn_gateway.html.markdown b/website/docs/r/compute_external_vpn_gateway.html.markdown
index f1d1a017e1c..1ecc294ba3e 100644
--- a/website/docs/r/compute_external_vpn_gateway.html.markdown
+++ b/website/docs/r/compute_external_vpn_gateway.html.markdown
@@ -164,6 +164,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Labels for the external VPN gateway resource.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `redundancy_type` -
   (Optional)
diff --git a/website/docs/r/compute_forwarding_rule.html.markdown b/website/docs/r/compute_forwarding_rule.html.markdown
index 683b9cbf4ae..cfc1992bc0a 100644
--- a/website/docs/r/compute_forwarding_rule.html.markdown
+++ b/website/docs/r/compute_forwarding_rule.html.markdown
@@ -1493,6 +1493,9 @@ The following arguments are supported:
   (Optional)
   Labels to apply to this forwarding rule.  A list of key->value pairs.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `all_ports` -
   (Optional)
   This field can only be used:
diff --git a/website/docs/r/compute_global_address.html.markdown b/website/docs/r/compute_global_address.html.markdown
index fd2532f4df5..26b1b08152f 100644
--- a/website/docs/r/compute_global_address.html.markdown
+++ b/website/docs/r/compute_global_address.html.markdown
@@ -100,6 +100,9 @@ The following arguments are supported:
   (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html))
   Labels to apply to this address.  A list of key->value pairs.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `ip_version` -
   (Optional)
   The IP Version that will be used by this address. The default value is `IPV4`.
diff --git a/website/docs/r/compute_global_forwarding_rule.html.markdown b/website/docs/r/compute_global_forwarding_rule.html.markdown
index ab8c2adc510..0246fa17c18 100644
--- a/website/docs/r/compute_global_forwarding_rule.html.markdown
+++ b/website/docs/r/compute_global_forwarding_rule.html.markdown
@@ -1279,6 +1279,9 @@ The following arguments are supported:
   (Optional)
   Labels to apply to this forwarding rule.  A list of key->value pairs.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `load_balancing_scheme` -
   (Optional)
   Specifies the forwarding rule type.
diff --git a/website/docs/r/compute_image.html.markdown b/website/docs/r/compute_image.html.markdown
index f83aec4de15..f63334aabf4 100644
--- a/website/docs/r/compute_image.html.markdown
+++ b/website/docs/r/compute_image.html.markdown
@@ -163,6 +163,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Labels to apply to this Image.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `licenses` -
   (Optional)
diff --git a/website/docs/r/compute_instance_template.html.markdown b/website/docs/r/compute_instance_template.html.markdown
index b6c5fe8b88d..a1c450d39cc 100644
--- a/website/docs/r/compute_instance_template.html.markdown
+++ b/website/docs/r/compute_instance_template.html.markdown
@@ -308,8 +308,11 @@ The following arguments are supported:
 * `labels` - (Optional) A set of key/value label pairs to assign to instances
     created from this template.
 
-  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
-	Please refer to the field 'effective_labels' for all of the labels present on the resource.
+    **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+    Please refer to the field 'effective_labels' for all of the labels present on the resource.
+
+* `terraform_labels` -
+  The combination of labels configured directly on the resource and default labels configured on the provider.
 
 * `effective_labels` -
   All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
diff --git a/website/docs/r/compute_region_disk.html.markdown b/website/docs/r/compute_region_disk.html.markdown
index 9875a923073..e24043dd78c 100644
--- a/website/docs/r/compute_region_disk.html.markdown
+++ b/website/docs/r/compute_region_disk.html.markdown
@@ -176,6 +176,9 @@ The following arguments are supported:
   (Optional)
   Labels to apply to this disk.  A list of key->value pairs.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `size` -
   (Optional)
   Size of the persistent disk, specified in GB. You can specify this
diff --git a/website/docs/r/compute_region_instance_template.html.markdown b/website/docs/r/compute_region_instance_template.html.markdown
index 4e1c3a29838..5364b319711 100644
--- a/website/docs/r/compute_region_instance_template.html.markdown
+++ b/website/docs/r/compute_region_instance_template.html.markdown
@@ -320,6 +320,15 @@ The following arguments are supported:
 * `labels` - (Optional) A set of key/value label pairs to assign to instances
     created from this template.
 
+    **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+    Please refer to the field 'effective_labels' for all of the labels present on the resource.
+
+* `terraform_labels` -
+  The combination of labels configured directly on the resource and default labels configured on the provider.
+
+* `effective_labels` -
+  All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.
+
 * `metadata` - (Optional) Metadata key/value pairs to make available from
     within instances created from this template.
 
diff --git a/website/docs/r/compute_snapshot.html.markdown b/website/docs/r/compute_snapshot.html.markdown
index b8040aa3ac7..ea940a347c4 100644
--- a/website/docs/r/compute_snapshot.html.markdown
+++ b/website/docs/r/compute_snapshot.html.markdown
@@ -152,6 +152,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Labels to apply to this Snapshot.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `zone` -
   (Optional)
diff --git a/website/docs/r/compute_vpn_tunnel.html.markdown b/website/docs/r/compute_vpn_tunnel.html.markdown
index ef4562b1c99..398b7a01da6 100644
--- a/website/docs/r/compute_vpn_tunnel.html.markdown
+++ b/website/docs/r/compute_vpn_tunnel.html.markdown
@@ -278,6 +278,8 @@ The following arguments are supported:
 * `labels` -
   (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html))
   Labels to apply to this VpnTunnel.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `region` -
   (Optional)
diff --git a/website/docs/r/data_fusion_instance.html.markdown b/website/docs/r/data_fusion_instance.html.markdown
index 03f2f9be9d4..aa621807fbd 100644
--- a/website/docs/r/data_fusion_instance.html.markdown
+++ b/website/docs/r/data_fusion_instance.html.markdown
@@ -243,6 +243,9 @@ The following arguments are supported:
   The resource labels for instance to use to annotate any related underlying resources,
   such as Compute Engine VMs.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `options` -
   (Optional)
   Map of additional options used to configure the behavior of Data Fusion instance.
diff --git a/website/docs/r/database_migration_service_connection_profile.html.markdown b/website/docs/r/database_migration_service_connection_profile.html.markdown
index 6a36b49c913..5346d60b5b5 100644
--- a/website/docs/r/database_migration_service_connection_profile.html.markdown
+++ b/website/docs/r/database_migration_service_connection_profile.html.markdown
@@ -266,6 +266,9 @@ The following arguments are supported:
   (Optional)
   The resource labels for connection profile to use to annotate any related underlying resources such as Compute Engine VMs.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `mysql` -
   (Optional)
   Specifies connection parameters required specifically for MySQL databases.
diff --git a/website/docs/r/dataplex_datascan.html.markdown b/website/docs/r/dataplex_datascan.html.markdown
index b4d9742d32e..fdbfb47e5a3 100644
--- a/website/docs/r/dataplex_datascan.html.markdown
+++ b/website/docs/r/dataplex_datascan.html.markdown
@@ -326,6 +326,9 @@ The following arguments are supported:
   (Optional)
   User-defined labels for the scan. A list of key->value pairs.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `data_quality_spec` -
   (Optional)
   DataQualityScan related setting.
diff --git a/website/docs/r/dataplex_task.html.markdown b/website/docs/r/dataplex_task.html.markdown
index f2697c328b5..13b3e434238 100644
--- a/website/docs/r/dataplex_task.html.markdown
+++ b/website/docs/r/dataplex_task.html.markdown
@@ -287,6 +287,9 @@ The following arguments are supported:
   (Optional)
   User-defined labels for the task.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `spark` -
   (Optional)
   A service with manual scaling runs continuously, allowing you to perform complex initialization and rely on the state of its memory over time.
diff --git a/website/docs/r/dataproc_metastore_federation.html.markdown b/website/docs/r/dataproc_metastore_federation.html.markdown
index 0bad09c8722..f300ab1b5c7 100644
--- a/website/docs/r/dataproc_metastore_federation.html.markdown
+++ b/website/docs/r/dataproc_metastore_federation.html.markdown
@@ -136,6 +136,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   User-defined labels for the metastore federation.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `location` -
   (Optional)
diff --git a/website/docs/r/dataproc_metastore_service.html.markdown b/website/docs/r/dataproc_metastore_service.html.markdown
index dbdd49d0291..64174d0d761 100644
--- a/website/docs/r/dataproc_metastore_service.html.markdown
+++ b/website/docs/r/dataproc_metastore_service.html.markdown
@@ -191,6 +191,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   User-defined labels for the metastore service.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `network` -
   (Optional)
diff --git a/website/docs/r/datastream_connection_profile.html.markdown b/website/docs/r/datastream_connection_profile.html.markdown
index 24598e6df86..45bffbfad4e 100644
--- a/website/docs/r/datastream_connection_profile.html.markdown
+++ b/website/docs/r/datastream_connection_profile.html.markdown
@@ -215,6 +215,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Labels.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `oracle_profile` -
   (Optional)
diff --git a/website/docs/r/datastream_private_connection.html.markdown b/website/docs/r/datastream_private_connection.html.markdown
index 4d1b9daf0e5..3791939146a 100644
--- a/website/docs/r/datastream_private_connection.html.markdown
+++ b/website/docs/r/datastream_private_connection.html.markdown
@@ -98,6 +98,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Labels.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.
diff --git a/website/docs/r/datastream_stream.html.markdown b/website/docs/r/datastream_stream.html.markdown
index e5456a1078b..2df8eff5bd0 100644
--- a/website/docs/r/datastream_stream.html.markdown
+++ b/website/docs/r/datastream_stream.html.markdown
@@ -1302,6 +1302,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Labels.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `backfill_all` -
   (Optional)
diff --git a/website/docs/r/dialogflow_cx_intent.html.markdown b/website/docs/r/dialogflow_cx_intent.html.markdown
index f664b6b7304..c8efd70c6f6 100644
--- a/website/docs/r/dialogflow_cx_intent.html.markdown
+++ b/website/docs/r/dialogflow_cx_intent.html.markdown
@@ -126,6 +126,9 @@ The following arguments are supported:
   Prefix "sys-" is reserved for Dialogflow defined labels. Currently allowed Dialogflow defined labels include: * sys-head * sys-contextual The above labels do not require value. "sys-head" means the intent is a head intent. "sys.contextual" means the intent is a contextual intent.
   An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `description` -
   (Optional)
   Human readable description for better understanding an intent like its scope, content, result etc. Maximum character limit: 140 characters.
diff --git a/website/docs/r/dns_managed_zone.html.markdown b/website/docs/r/dns_managed_zone.html.markdown
index 00459c861ea..bddd2143d3e 100644
--- a/website/docs/r/dns_managed_zone.html.markdown
+++ b/website/docs/r/dns_managed_zone.html.markdown
@@ -344,6 +344,9 @@ The following arguments are supported:
   (Optional)
   A set of key/value label pairs to assign to this ManagedZone.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `visibility` -
   (Optional)
   The zone's visibility: public zones are exposed to the Internet,
diff --git a/website/docs/r/filestore_backup.html.markdown b/website/docs/r/filestore_backup.html.markdown
index 4fba257008f..c86014f8ec3 100644
--- a/website/docs/r/filestore_backup.html.markdown
+++ b/website/docs/r/filestore_backup.html.markdown
@@ -108,6 +108,9 @@ The following arguments are supported:
   (Optional)
   Resource labels to represent user-provided metadata.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.
 
diff --git a/website/docs/r/filestore_instance.html.markdown b/website/docs/r/filestore_instance.html.markdown
index 5b049f3250a..fa80d943ea5 100644
--- a/website/docs/r/filestore_instance.html.markdown
+++ b/website/docs/r/filestore_instance.html.markdown
@@ -253,6 +253,9 @@ The following arguments are supported:
   (Optional)
   Resource labels to represent user-provided metadata.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `kms_key_name` -
   (Optional)
   KMS key name used for data encryption.
diff --git a/website/docs/r/filestore_snapshot.html.markdown b/website/docs/r/filestore_snapshot.html.markdown
index f6f48aa5a6d..4deed811a90 100644
--- a/website/docs/r/filestore_snapshot.html.markdown
+++ b/website/docs/r/filestore_snapshot.html.markdown
@@ -133,6 +133,9 @@ The following arguments are supported:
   (Optional)
   Resource labels to represent user-provided metadata.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.
 
diff --git a/website/docs/r/firebase_hosting_channel.html.markdown b/website/docs/r/firebase_hosting_channel.html.markdown
index b28f8afac2c..2feab8e047b 100644
--- a/website/docs/r/firebase_hosting_channel.html.markdown
+++ b/website/docs/r/firebase_hosting_channel.html.markdown
@@ -95,6 +95,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Text labels used for extra metadata and/or filtering
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `expire_time` -
   (Optional)
diff --git a/website/docs/r/gke_backup_backup_plan.html.markdown b/website/docs/r/gke_backup_backup_plan.html.markdown
index 01e6c8ab3cd..b3658ed13f1 100644
--- a/website/docs/r/gke_backup_backup_plan.html.markdown
+++ b/website/docs/r/gke_backup_backup_plan.html.markdown
@@ -219,6 +219,9 @@ The following arguments are supported:
   A list of key->value pairs.
   Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `backup_schedule` -
   (Optional)
   Defines a schedule for automatic Backup creation via this BackupPlan.
diff --git a/website/docs/r/gke_hub_feature.html.markdown b/website/docs/r/gke_hub_feature.html.markdown
index 08432e84a5c..1b06f0e3e8b 100644
--- a/website/docs/r/gke_hub_feature.html.markdown
+++ b/website/docs/r/gke_hub_feature.html.markdown
@@ -157,6 +157,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   GCP labels for this Feature.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `spec` -
   (Optional)
diff --git a/website/docs/r/gke_hub_membership.html.markdown b/website/docs/r/gke_hub_membership.html.markdown
index cb52da93fcc..1c53d401f77 100644
--- a/website/docs/r/gke_hub_membership.html.markdown
+++ b/website/docs/r/gke_hub_membership.html.markdown
@@ -105,6 +105,9 @@ The following arguments are supported:
   (Optional)
   Labels to apply to this membership.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `endpoint` -
   (Optional)
   If this Membership is a Kubernetes API server hosted on GKE, this is a self link to its GCP resource.
diff --git a/website/docs/r/gke_hub_membership_binding.html.markdown b/website/docs/r/gke_hub_membership_binding.html.markdown
index bcdb83088e2..4dbe0fd7f6d 100644
--- a/website/docs/r/gke_hub_membership_binding.html.markdown
+++ b/website/docs/r/gke_hub_membership_binding.html.markdown
@@ -100,6 +100,9 @@ The following arguments are supported:
   (Optional)
   Labels for this Membership binding.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.
 
diff --git a/website/docs/r/gke_hub_namespace.html.markdown b/website/docs/r/gke_hub_namespace.html.markdown
index be0570b52ba..9760fbbd635 100644
--- a/website/docs/r/gke_hub_namespace.html.markdown
+++ b/website/docs/r/gke_hub_namespace.html.markdown
@@ -88,6 +88,9 @@ The following arguments are supported:
   (Optional)
   Labels for this Namespace.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.
 
diff --git a/website/docs/r/gke_hub_scope.html.markdown b/website/docs/r/gke_hub_scope.html.markdown
index 84f970dd0b8..c59086d7fd0 100644
--- a/website/docs/r/gke_hub_scope.html.markdown
+++ b/website/docs/r/gke_hub_scope.html.markdown
@@ -59,6 +59,9 @@ The following arguments are supported:
   (Optional)
   Labels for this Scope.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.
 
diff --git a/website/docs/r/gke_hub_scope_rbac_role_binding.html.markdown b/website/docs/r/gke_hub_scope_rbac_role_binding.html.markdown
index c182f01fa50..3b543199f07 100644
--- a/website/docs/r/gke_hub_scope_rbac_role_binding.html.markdown
+++ b/website/docs/r/gke_hub_scope_rbac_role_binding.html.markdown
@@ -96,6 +96,9 @@ The following arguments are supported:
   (Optional)
   Labels for this ScopeRBACRoleBinding.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.
 
diff --git a/website/docs/r/healthcare_consent_store.html.markdown b/website/docs/r/healthcare_consent_store.html.markdown
index 88970d1308b..81e3879df28 100644
--- a/website/docs/r/healthcare_consent_store.html.markdown
+++ b/website/docs/r/healthcare_consent_store.html.markdown
@@ -145,6 +145,9 @@ The following arguments are supported:
   An object containing a list of "key": value pairs.
   Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 
 ## Attributes Reference
 
diff --git a/website/docs/r/healthcare_dicom_store.html.markdown b/website/docs/r/healthcare_dicom_store.html.markdown
index 6da45f7a1bf..e59a94cb868 100644
--- a/website/docs/r/healthcare_dicom_store.html.markdown
+++ b/website/docs/r/healthcare_dicom_store.html.markdown
@@ -153,6 +153,9 @@ The following arguments are supported:
   An object containing a list of "key": value pairs.
   Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `notification_config` -
   (Optional)
   A nested object resource
diff --git a/website/docs/r/healthcare_fhir_store.html.markdown b/website/docs/r/healthcare_fhir_store.html.markdown
index c30cb90e125..b1c58715ad7 100644
--- a/website/docs/r/healthcare_fhir_store.html.markdown
+++ b/website/docs/r/healthcare_fhir_store.html.markdown
@@ -280,6 +280,9 @@ The following arguments are supported:
   An object containing a list of "key": value pairs.
   Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `notification_config` -
   (Optional)
   A nested object resource
diff --git a/website/docs/r/healthcare_hl7_v2_store.html.markdown b/website/docs/r/healthcare_hl7_v2_store.html.markdown
index b14bfaab4a1..a58f84f8c2c 100644
--- a/website/docs/r/healthcare_hl7_v2_store.html.markdown
+++ b/website/docs/r/healthcare_hl7_v2_store.html.markdown
@@ -229,6 +229,9 @@ The following arguments are supported:
   An object containing a list of "key": value pairs.
   Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `notification_configs` -
   (Optional)
   A list of notification configs. Each configuration uses a filter to determine whether to publish a
diff --git a/website/docs/r/kms_crypto_key.html.markdown b/website/docs/r/kms_crypto_key.html.markdown
index b4b1e755e54..56c008ab01b 100644
--- a/website/docs/r/kms_crypto_key.html.markdown
+++ b/website/docs/r/kms_crypto_key.html.markdown
@@ -102,6 +102,9 @@ The following arguments are supported:
   (Optional)
   Labels with user-defined metadata to apply to this resource.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `purpose` -
   (Optional)
   The immutable purpose of this CryptoKey. See the
diff --git a/website/docs/r/memcache_instance.html.markdown b/website/docs/r/memcache_instance.html.markdown
index fab325ec5cb..56f94a9041a 100644
--- a/website/docs/r/memcache_instance.html.markdown
+++ b/website/docs/r/memcache_instance.html.markdown
@@ -133,6 +133,9 @@ The following arguments are supported:
   (Optional)
   Resource labels to represent user-provided metadata.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `zones` -
   (Optional)
   Zones where memcache nodes should be provisioned.  If not
diff --git a/website/docs/r/ml_engine_model.html.markdown b/website/docs/r/ml_engine_model.html.markdown
index ca57895e5bd..526990922e0 100644
--- a/website/docs/r/ml_engine_model.html.markdown
+++ b/website/docs/r/ml_engine_model.html.markdown
@@ -106,6 +106,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   One or more labels that you can add, to organize your models.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.
diff --git a/website/docs/r/network_connectivity_service_connection_policy.html.markdown b/website/docs/r/network_connectivity_service_connection_policy.html.markdown
index 03fa7e68b3e..ed2b06d9b8d 100644
--- a/website/docs/r/network_connectivity_service_connection_policy.html.markdown
+++ b/website/docs/r/network_connectivity_service_connection_policy.html.markdown
@@ -101,6 +101,9 @@ The following arguments are supported:
   (Optional)
   User-defined labels.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.
 
diff --git a/website/docs/r/network_management_connectivity_test_resource.html.markdown b/website/docs/r/network_management_connectivity_test_resource.html.markdown
index 890ac896987..d9e978bc5a8 100644
--- a/website/docs/r/network_management_connectivity_test_resource.html.markdown
+++ b/website/docs/r/network_management_connectivity_test_resource.html.markdown
@@ -297,6 +297,9 @@ The following arguments are supported:
   (Optional)
   Resource labels to represent user-provided metadata.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.
 
diff --git a/website/docs/r/network_security_address_group.html.markdown b/website/docs/r/network_security_address_group.html.markdown
index 88ff4e3e051..5186afeb04e 100644
--- a/website/docs/r/network_security_address_group.html.markdown
+++ b/website/docs/r/network_security_address_group.html.markdown
@@ -105,6 +105,9 @@ The following arguments are supported:
   Set of label tags associated with the AddressGroup resource.
   An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `items` -
   (Optional)
   List of items.
diff --git a/website/docs/r/network_security_authorization_policy.html.markdown b/website/docs/r/network_security_authorization_policy.html.markdown
index e0b019e8bae..743a43cd31f 100644
--- a/website/docs/r/network_security_authorization_policy.html.markdown
+++ b/website/docs/r/network_security_authorization_policy.html.markdown
@@ -109,6 +109,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Set of label tags associated with the AuthorizationPolicy resource.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `description` -
   (Optional)
diff --git a/website/docs/r/network_security_client_tls_policy.html.markdown b/website/docs/r/network_security_client_tls_policy.html.markdown
index f54ad92fa75..b7b3465e9f8 100644
--- a/website/docs/r/network_security_client_tls_policy.html.markdown
+++ b/website/docs/r/network_security_client_tls_policy.html.markdown
@@ -99,6 +99,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Set of label tags associated with the ClientTlsPolicy resource.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `description` -
   (Optional)
diff --git a/website/docs/r/network_security_server_tls_policy.html.markdown b/website/docs/r/network_security_server_tls_policy.html.markdown
index c7bab7e5a11..0dd74737716 100644
--- a/website/docs/r/network_security_server_tls_policy.html.markdown
+++ b/website/docs/r/network_security_server_tls_policy.html.markdown
@@ -134,6 +134,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Set of label tags associated with the ServerTlsPolicy resource.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `description` -
   (Optional)
diff --git a/website/docs/r/network_services_edge_cache_keyset.html.markdown b/website/docs/r/network_services_edge_cache_keyset.html.markdown
index 0433ecaed9c..5ab5ce873af 100644
--- a/website/docs/r/network_services_edge_cache_keyset.html.markdown
+++ b/website/docs/r/network_services_edge_cache_keyset.html.markdown
@@ -113,6 +113,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Set of label tags associated with the EdgeCache resource.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `public_key` -
   (Optional)
diff --git a/website/docs/r/network_services_edge_cache_origin.html.markdown b/website/docs/r/network_services_edge_cache_origin.html.markdown
index 80d539961a3..52ec16ae2c9 100644
--- a/website/docs/r/network_services_edge_cache_origin.html.markdown
+++ b/website/docs/r/network_services_edge_cache_origin.html.markdown
@@ -172,6 +172,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Set of label tags associated with the EdgeCache resource.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `protocol` -
   (Optional)
diff --git a/website/docs/r/network_services_edge_cache_service.html.markdown b/website/docs/r/network_services_edge_cache_service.html.markdown
index 8ef7371863e..150cf67b245 100644
--- a/website/docs/r/network_services_edge_cache_service.html.markdown
+++ b/website/docs/r/network_services_edge_cache_service.html.markdown
@@ -989,6 +989,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Set of label tags associated with the EdgeCache resource.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `disable_quic` -
   (Optional)
diff --git a/website/docs/r/network_services_endpoint_policy.html.markdown b/website/docs/r/network_services_endpoint_policy.html.markdown
index e11976a810a..10a088a00c1 100644
--- a/website/docs/r/network_services_endpoint_policy.html.markdown
+++ b/website/docs/r/network_services_endpoint_policy.html.markdown
@@ -146,6 +146,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Set of label tags associated with the TcpRoute resource.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `description` -
   (Optional)
diff --git a/website/docs/r/network_services_gateway.html.markdown b/website/docs/r/network_services_gateway.html.markdown
index 00b696af36c..ec567f04b9b 100644
--- a/website/docs/r/network_services_gateway.html.markdown
+++ b/website/docs/r/network_services_gateway.html.markdown
@@ -252,6 +252,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Set of label tags associated with the Gateway resource.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `description` -
   (Optional)
diff --git a/website/docs/r/network_services_grpc_route.html.markdown b/website/docs/r/network_services_grpc_route.html.markdown
index 22e6ca2d773..b1fb27a9e1a 100644
--- a/website/docs/r/network_services_grpc_route.html.markdown
+++ b/website/docs/r/network_services_grpc_route.html.markdown
@@ -310,6 +310,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Set of label tags associated with the GrpcRoute resource.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `description` -
   (Optional)
diff --git a/website/docs/r/network_services_http_route.html.markdown b/website/docs/r/network_services_http_route.html.markdown
index 57805f72fa4..ed6c0d08708 100644
--- a/website/docs/r/network_services_http_route.html.markdown
+++ b/website/docs/r/network_services_http_route.html.markdown
@@ -628,6 +628,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Set of label tags associated with the HttpRoute resource.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `description` -
   (Optional)
diff --git a/website/docs/r/network_services_mesh.html.markdown b/website/docs/r/network_services_mesh.html.markdown
index d5e80b6118d..e7ee443fd13 100644
--- a/website/docs/r/network_services_mesh.html.markdown
+++ b/website/docs/r/network_services_mesh.html.markdown
@@ -85,6 +85,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Set of label tags associated with the Mesh resource.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `description` -
   (Optional)
diff --git a/website/docs/r/network_services_service_binding.html.markdown b/website/docs/r/network_services_service_binding.html.markdown
index 6dd6e04833e..416ef962c53 100644
--- a/website/docs/r/network_services_service_binding.html.markdown
+++ b/website/docs/r/network_services_service_binding.html.markdown
@@ -88,6 +88,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Set of label tags associated with the ServiceBinding resource.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `description` -
   (Optional)
diff --git a/website/docs/r/network_services_tcp_route.html.markdown b/website/docs/r/network_services_tcp_route.html.markdown
index 484c7ae7939..5846cfaca63 100644
--- a/website/docs/r/network_services_tcp_route.html.markdown
+++ b/website/docs/r/network_services_tcp_route.html.markdown
@@ -308,6 +308,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Set of label tags associated with the TcpRoute resource.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `description` -
   (Optional)
diff --git a/website/docs/r/notebooks_instance.html.markdown b/website/docs/r/notebooks_instance.html.markdown
index 041c5408405..900aad3600a 100644
--- a/website/docs/r/notebooks_instance.html.markdown
+++ b/website/docs/r/notebooks_instance.html.markdown
@@ -290,6 +290,9 @@ The following arguments are supported:
   Labels to apply to this instance. These can be later modified by the setLabels method.
   An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `tags` -
   (Optional)
   The Compute Engine tags to add to instance.
diff --git a/website/docs/r/privateca_ca_pool.html.markdown b/website/docs/r/privateca_ca_pool.html.markdown
index f698b3f6292..483a24e4ade 100644
--- a/website/docs/r/privateca_ca_pool.html.markdown
+++ b/website/docs/r/privateca_ca_pool.html.markdown
@@ -186,6 +186,9 @@ The following arguments are supported:
   An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":
   "1.3kg", "count": "3" }.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.
 
diff --git a/website/docs/r/privateca_certificate.html.markdown b/website/docs/r/privateca_certificate.html.markdown
index 018ceb83e79..4965a415078 100644
--- a/website/docs/r/privateca_certificate.html.markdown
+++ b/website/docs/r/privateca_certificate.html.markdown
@@ -467,6 +467,9 @@ The following arguments are supported:
   (Optional)
   Labels with user-defined metadata to apply to this resource.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `pem_csr` -
   (Optional)
   Immutable. A pem-encoded X.509 certificate signing request (CSR).
diff --git a/website/docs/r/privateca_certificate_authority.html.markdown b/website/docs/r/privateca_certificate_authority.html.markdown
index aac07a2f046..90cb27a657e 100644
--- a/website/docs/r/privateca_certificate_authority.html.markdown
+++ b/website/docs/r/privateca_certificate_authority.html.markdown
@@ -685,6 +685,9 @@ The following arguments are supported:
   An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":
   "1.3kg", "count": "3" }.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.
 
diff --git a/website/docs/r/pubsub_subscription.html.markdown b/website/docs/r/pubsub_subscription.html.markdown
index fff6375e919..8ee437f6d10 100644
--- a/website/docs/r/pubsub_subscription.html.markdown
+++ b/website/docs/r/pubsub_subscription.html.markdown
@@ -324,6 +324,9 @@ The following arguments are supported:
   (Optional)
   A set of key/value label pairs to assign to this Subscription.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `bigquery_config` -
   (Optional)
   If delivery to BigQuery is used with this subscription, this field is used to configure it.
diff --git a/website/docs/r/pubsub_topic.html.markdown b/website/docs/r/pubsub_topic.html.markdown
index 198ea723d97..bbd8627f01f 100644
--- a/website/docs/r/pubsub_topic.html.markdown
+++ b/website/docs/r/pubsub_topic.html.markdown
@@ -134,6 +134,9 @@ The following arguments are supported:
   (Optional)
   A set of key/value label pairs to assign to this Topic.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `message_storage_policy` -
   (Optional)
   Policy constraining the set of Google Cloud Platform regions where
diff --git a/website/docs/r/redis_instance.html.markdown b/website/docs/r/redis_instance.html.markdown
index ec244ddcc06..86d8f98e99a 100644
--- a/website/docs/r/redis_instance.html.markdown
+++ b/website/docs/r/redis_instance.html.markdown
@@ -310,6 +310,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Resource labels to represent user provided metadata.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `redis_configs` -
   (Optional)
diff --git a/website/docs/r/secret_manager_secret.html.markdown b/website/docs/r/secret_manager_secret.html.markdown
index 244d8388e5f..727bf2c2d62 100644
--- a/website/docs/r/secret_manager_secret.html.markdown
+++ b/website/docs/r/secret_manager_secret.html.markdown
@@ -200,6 +200,9 @@ The following arguments are supported:
   An object containing a list of "key": value pairs. Example:
   { "name": "wrench", "mass": "1.3kg", "count": "3" }.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `annotations` -
   (Optional)
   Custom metadata about the secret.
diff --git a/website/docs/r/service_directory_namespace.html.markdown b/website/docs/r/service_directory_namespace.html.markdown
index dcd6b13be43..16630471fb3 100644
--- a/website/docs/r/service_directory_namespace.html.markdown
+++ b/website/docs/r/service_directory_namespace.html.markdown
@@ -78,6 +78,9 @@ The following arguments are supported:
   labels can be associated with a given resource. Label keys and values can
   be no longer than 63 characters.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.
 
diff --git a/website/docs/r/spanner_instance.html.markdown b/website/docs/r/spanner_instance.html.markdown
index 7ac47b975fd..a43600ba10b 100644
--- a/website/docs/r/spanner_instance.html.markdown
+++ b/website/docs/r/spanner_instance.html.markdown
@@ -131,6 +131,9 @@ The following arguments are supported:
   An object containing a list of "key": value pairs.
   Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.
 
diff --git a/website/docs/r/tpu_node.html.markdown b/website/docs/r/tpu_node.html.markdown
index 803c324bedc..329f47455ea 100644
--- a/website/docs/r/tpu_node.html.markdown
+++ b/website/docs/r/tpu_node.html.markdown
@@ -161,6 +161,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Resource labels to represent user provided metadata.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `zone` -
   (Optional)
diff --git a/website/docs/r/vertex_ai_dataset.html.markdown b/website/docs/r/vertex_ai_dataset.html.markdown
index acc179997f8..ed3c84a70cb 100644
--- a/website/docs/r/vertex_ai_dataset.html.markdown
+++ b/website/docs/r/vertex_ai_dataset.html.markdown
@@ -69,6 +69,9 @@ The following arguments are supported:
   (Optional)
   A set of key/value label pairs to assign to this Workflow.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `encryption_spec` -
   (Optional)
   Customer-managed encryption key spec for a Dataset. If set, this Dataset and all sub-resources of this Dataset will be secured by this key.
diff --git a/website/docs/r/vertex_ai_endpoint.html.markdown b/website/docs/r/vertex_ai_endpoint.html.markdown
index 568caf19294..e4abec8401a 100644
--- a/website/docs/r/vertex_ai_endpoint.html.markdown
+++ b/website/docs/r/vertex_ai_endpoint.html.markdown
@@ -105,6 +105,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   The labels with user-defined metadata to organize your Endpoints. Label keys and values can be no longer than 64 characters (Unicode codepoints), can only contain lowercase letters, numeric characters, underscores and dashes. International characters are allowed. See https://goo.gl/xmQnxf for more information and examples of labels.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `encryption_spec` -
   (Optional)
diff --git a/website/docs/r/vertex_ai_featurestore.html.markdown b/website/docs/r/vertex_ai_featurestore.html.markdown
index 75420330622..d547167d6fd 100644
--- a/website/docs/r/vertex_ai_featurestore.html.markdown
+++ b/website/docs/r/vertex_ai_featurestore.html.markdown
@@ -108,6 +108,9 @@ The following arguments are supported:
   (Optional)
   A set of key/value label pairs to assign to this Featurestore.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `online_serving_config` -
   (Optional)
   Config for online serving resources.
diff --git a/website/docs/r/vertex_ai_featurestore_entitytype.html.markdown b/website/docs/r/vertex_ai_featurestore_entitytype.html.markdown
index 04d42539188..e2cd78b629d 100644
--- a/website/docs/r/vertex_ai_featurestore_entitytype.html.markdown
+++ b/website/docs/r/vertex_ai_featurestore_entitytype.html.markdown
@@ -141,6 +141,9 @@ The following arguments are supported:
   (Optional)
   A set of key/value label pairs to assign to this EntityType.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `monitoring_config` -
   (Optional)
   The default monitoring configuration for all Features under this EntityType.
diff --git a/website/docs/r/vertex_ai_featurestore_entitytype_feature.html.markdown b/website/docs/r/vertex_ai_featurestore_entitytype_feature.html.markdown
index c0bbe40f2de..1c75bd1726c 100644
--- a/website/docs/r/vertex_ai_featurestore_entitytype_feature.html.markdown
+++ b/website/docs/r/vertex_ai_featurestore_entitytype_feature.html.markdown
@@ -147,6 +147,9 @@ The following arguments are supported:
   (Optional)
   A set of key/value label pairs to assign to the feature.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `description` -
   (Optional)
   Description of the feature.
diff --git a/website/docs/r/vertex_ai_index.html.markdown b/website/docs/r/vertex_ai_index.html.markdown
index fc9182a5f88..3f646408877 100644
--- a/website/docs/r/vertex_ai_index.html.markdown
+++ b/website/docs/r/vertex_ai_index.html.markdown
@@ -141,6 +141,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   The labels with user-defined metadata to organize your Indexes.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `index_update_method` -
   (Optional)
diff --git a/website/docs/r/vertex_ai_index_endpoint.html.markdown b/website/docs/r/vertex_ai_index_endpoint.html.markdown
index e7b82b05bcc..dcaded22c16 100644
--- a/website/docs/r/vertex_ai_index_endpoint.html.markdown
+++ b/website/docs/r/vertex_ai_index_endpoint.html.markdown
@@ -109,6 +109,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   The labels with user-defined metadata to organize your Indexes.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `network` -
   (Optional)
diff --git a/website/docs/r/vertex_ai_tensorboard.html.markdown b/website/docs/r/vertex_ai_tensorboard.html.markdown
index ac6b321d9b0..24247b11344 100644
--- a/website/docs/r/vertex_ai_tensorboard.html.markdown
+++ b/website/docs/r/vertex_ai_tensorboard.html.markdown
@@ -105,6 +105,9 @@ The following arguments are supported:
   (Optional)
   The labels with user-defined metadata to organize your Tensorboards.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `region` -
   (Optional)
   The region of the tensorboard. eg us-central1
diff --git a/website/docs/r/workflows_workflow.html.markdown b/website/docs/r/workflows_workflow.html.markdown
index a1d8c483b8c..18a7eabaa4b 100644
--- a/website/docs/r/workflows_workflow.html.markdown
+++ b/website/docs/r/workflows_workflow.html.markdown
@@ -102,6 +102,9 @@ The following arguments are supported:
   (Optional)
   A set of key/value label pairs to assign to this Workflow.
 
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
+
 * `service_account` -
   (Optional)
   Name of the service account associated with the latest workflow version. This service
diff --git a/website/docs/r/workstations_workstation.html.markdown b/website/docs/r/workstations_workstation.html.markdown
index cef301b8835..c654549a63c 100644
--- a/website/docs/r/workstations_workstation.html.markdown
+++ b/website/docs/r/workstations_workstation.html.markdown
@@ -137,6 +137,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Client-specified labels that are applied to the resource and that are also propagated to the underlying Compute Engine resources.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `annotations` -
   (Optional)
diff --git a/website/docs/r/workstations_workstation_cluster.html.markdown b/website/docs/r/workstations_workstation_cluster.html.markdown
index cd9fe6295a2..4ea79bdec6e 100644
--- a/website/docs/r/workstations_workstation_cluster.html.markdown
+++ b/website/docs/r/workstations_workstation_cluster.html.markdown
@@ -147,6 +147,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Client-specified labels that are applied to the resource and that are also propagated to the underlying Compute Engine resources.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `display_name` -
   (Optional)
diff --git a/website/docs/r/workstations_workstation_config.html.markdown b/website/docs/r/workstations_workstation_config.html.markdown
index 4f5a2ebd43c..d4dfed7e263 100644
--- a/website/docs/r/workstations_workstation_config.html.markdown
+++ b/website/docs/r/workstations_workstation_config.html.markdown
@@ -521,6 +521,8 @@ The following arguments are supported:
 * `labels` -
   (Optional)
   Client-specified labels that are applied to the resource and that are also propagated to the underlying Compute Engine resources.
+  **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+  Please refer to the field `effective_labels` for all of the labels present on the resource.
 
 * `annotations` -
   (Optional)