v6.2.0/google-beta/services/privateca/resource_privateca_certificate_template.go

// Copyright (c) HashiCorp, Inc.
// SPDX-License-Identifier: MPL-2.0

// ----------------------------------------------------------------------------
//
//     ***     AUTO GENERATED CODE    ***    Type: MMv1     ***
//
// ----------------------------------------------------------------------------
//
//     This file is automatically generated by Magic Modules and manual
//     changes will be clobbered when the file is regenerated.
//
//     Please read more about how to change this file in
//     .github/CONTRIBUTING.md.
//
// ----------------------------------------------------------------------------

package privateca

import (
	"fmt"
	"log"
	"net/http"
	"reflect"
	"strings"
	"time"

	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"

	"github.com/hashicorp/terraform-provider-google-beta/google-beta/tpgresource"
	transport_tpg "github.com/hashicorp/terraform-provider-google-beta/google-beta/transport"
)

func ResourcePrivatecaCertificateTemplate() *schema.Resource {
	return &schema.Resource{
		Create: resourcePrivatecaCertificateTemplateCreate,
		Read:   resourcePrivatecaCertificateTemplateRead,
		Update: resourcePrivatecaCertificateTemplateUpdate,
		Delete: resourcePrivatecaCertificateTemplateDelete,

		Importer: &schema.ResourceImporter{
			State: resourcePrivatecaCertificateTemplateImport,
		},

		Timeouts: &schema.ResourceTimeout{
			Create: schema.DefaultTimeout(20 * time.Minute),
			Update: schema.DefaultTimeout(20 * time.Minute),
			Delete: schema.DefaultTimeout(20 * time.Minute),
		},

		CustomizeDiff: customdiff.All(
			tpgresource.SetLabelsDiff,
			tpgresource.DefaultProviderProject,
		),

		Schema: map[string]*schema.Schema{
			"location": {
				Type:        schema.TypeString,
				Required:    true,
				ForceNew:    true,
				Description: `The location for the resource`,
			},
			"name": {
				Type:        schema.TypeString,
				Required:    true,
				ForceNew:    true,
				Description: `The resource name for this CertificateTemplate in the format 'projects/*/locations/*/certificateTemplates/*'.`,
			},
			"description": {
				Type:        schema.TypeString,
				Optional:    true,
				Description: `Optional. A human-readable description of scenarios this template is intended for.`,
			},
			"identity_constraints": {
				Type:        schema.TypeList,
				Optional:    true,
				Description: `Optional. Describes constraints on identities that may be appear in Certificates issued using this template. If this is omitted, then this template will not add restrictions on a certificate's identity.`,
				MaxItems:    1,
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"allow_subject_alt_names_passthrough": {
							Type:        schema.TypeBool,
							Required:    true,
							Description: `Required. If this is true, the SubjectAltNames extension may be copied from a certificate request into the signed certificate. Otherwise, the requested SubjectAltNames will be discarded.`,
						},
						"allow_subject_passthrough": {
							Type:        schema.TypeBool,
							Required:    true,
							Description: `Required. If this is true, the Subject field may be copied from a certificate request into the signed certificate. Otherwise, the requested Subject will be discarded.`,
						},
						"cel_expression": {
							Type:        schema.TypeList,
							Optional:    true,
							Description: `Optional. A CEL expression that may be used to validate the resolved X.509 Subject and/or Subject Alternative Name before a certificate is signed. To see the full allowed syntax and some examples, see https://cloud.google.com/certificate-authority-service/docs/using-cel`,
							MaxItems:    1,
							Elem: &schema.Resource{
								Schema: map[string]*schema.Schema{
									"description": {
										Type:        schema.TypeString,
										Optional:    true,
										Description: `Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.`,
									},
									"expression": {
										Type:        schema.TypeString,
										Optional:    true,
										Description: `Textual representation of an expression in Common Expression Language syntax.`,
									},
									"location": {
										Type:        schema.TypeString,
										Optional:    true,
										Description: `Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.`,
									},
									"title": {
										Type:        schema.TypeString,
										Optional:    true,
										Description: `Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.`,
									},
								},
							},
						},
					},
				},
			},
			"labels": {
				Type:     schema.TypeMap,
				Optional: true,
				Description: `Optional. Labels with user-defined metadata.

**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
Please refer to the field 'effective_labels' for all of the labels present on the resource.`,
				Elem: &schema.Schema{Type: schema.TypeString},
			},
			"maximum_lifetime": {
				Type:        schema.TypeString,
				Optional:    true,
				Description: `Optional. The maximum lifetime allowed for all issued certificates that use this template. If the issuing CaPool's IssuancePolicy specifies a maximum lifetime the minimum of the two durations will be the maximum lifetime for issued. Note that if the issuing CertificateAuthority expires before a Certificate's requested maximum_lifetime, the effective lifetime will be explicitly truncated to match it.`,
			},
			"passthrough_extensions": {
				Type:        schema.TypeList,
				Optional:    true,
				Description: `Optional. Describes the set of X.509 extensions that may appear in a Certificate issued using this CertificateTemplate. If a certificate request sets extensions that don't appear in the passthrough_extensions, those extensions will be dropped. If the issuing CaPool's IssuancePolicy defines baseline_values that don't appear here, the certificate issuance request will fail. If this is omitted, then this template will not add restrictions on a certificate's X.509 extensions. These constraints do not apply to X.509 extensions set in this CertificateTemplate's predefined_values.`,
				MaxItems:    1,
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"additional_extensions": {
							Type:        schema.TypeList,
							Optional:    true,
							Description: `Optional. A set of ObjectIds identifying custom X.509 extensions. Will be combined with known_extensions to determine the full set of X.509 extensions.`,
							Elem: &schema.Resource{
								Schema: map[string]*schema.Schema{
									"object_id_path": {
										Type:        schema.TypeList,
										Required:    true,
										Description: `Required. The parts of an OID path. The most significant parts of the path come first.`,
										Elem: &schema.Schema{
											Type: schema.TypeInt,
										},
									},
								},
							},
						},
						"known_extensions": {
							Type:        schema.TypeList,
							Optional:    true,
							Description: `Optional. A set of named X.509 extensions. Will be combined with additional_extensions to determine the full set of X.509 extensions.`,
							Elem: &schema.Schema{
								Type: schema.TypeString,
							},
						},
					},
				},
			},
			"predefined_values": {
				Type:        schema.TypeList,
				Optional:    true,
				Description: `Optional. A set of X.509 values that will be applied to all issued certificates that use this template. If the certificate request includes conflicting values for the same properties, they will be overwritten by the values defined here. If the issuing CaPool's IssuancePolicy defines conflicting baseline_values for the same properties, the certificate issuance request will fail.`,
				MaxItems:    1,
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"additional_extensions": {
							Type:        schema.TypeList,
							Optional:    true,
							Description: `Optional. Describes custom X.509 extensions.`,
							Elem: &schema.Resource{
								Schema: map[string]*schema.Schema{
									"object_id": {
										Type:        schema.TypeList,
										Required:    true,
										Description: `Required. The OID for this X.509 extension.`,
										MaxItems:    1,
										Elem: &schema.Resource{
											Schema: map[string]*schema.Schema{
												"object_id_path": {
													Type:        schema.TypeList,
													Required:    true,
													Description: `Required. The parts of an OID path. The most significant parts of the path come first.`,
													Elem: &schema.Schema{
														Type: schema.TypeInt,
													},
												},
											},
										},
									},
									"value": {
										Type:        schema.TypeString,
										Required:    true,
										Description: `Required. The value of this X.509 extension.`,
									},
									"critical": {
										Type:        schema.TypeBool,
										Optional:    true,
										Description: `Optional. Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error).`,
									},
								},
							},
						},
						"aia_ocsp_servers": {
							Type:        schema.TypeList,
							Optional:    true,
							Description: `Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.`,
							Elem: &schema.Schema{
								Type: schema.TypeString,
							},
						},
						"ca_options": {
							Type:        schema.TypeList,
							Optional:    true,
							Description: `Optional. Describes options in this X509Parameters that are relevant in a CA certificate.`,
							MaxItems:    1,
							Elem: &schema.Resource{
								Schema: map[string]*schema.Schema{
									"is_ca": {
										Type:        schema.TypeBool,
										Optional:    true,
										Description: `Optional. Refers to the "CA" X.509 extension, which is a boolean value. When this value is missing, the extension will be omitted from the CA certificate.`,
									},
									"max_issuer_path_length": {
										Type:        schema.TypeInt,
										Optional:    true,
										Description: `Optional. Refers to the path length restriction X.509 extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail. If this value is missing, the max path length will be omitted from the CA certificate.`,
									},
								},
							},
						},
						"key_usage": {
							Type:        schema.TypeList,
							Optional:    true,
							Description: `Optional. Indicates the intended use for keys that correspond to a certificate.`,
							MaxItems:    1,
							Elem: &schema.Resource{
								Schema: map[string]*schema.Schema{
									"base_key_usage": {
										Type:             schema.TypeList,
										Optional:         true,
										DiffSuppressFunc: tpgresource.EmptyOrUnsetBlockDiffSuppress,
										Description:      `Describes high-level ways in which a key may be used.`,
										MaxItems:         1,
										Elem: &schema.Resource{
											Schema: map[string]*schema.Schema{
												"cert_sign": {
													Type:             schema.TypeBool,
													Optional:         true,
													DiffSuppressFunc: tpgresource.EmptyOrFalseSuppressBoolean,
													Description:      `The key may be used to sign certificates.`,
												},
												"content_commitment": {
													Type:             schema.TypeBool,
													Optional:         true,
													DiffSuppressFunc: tpgresource.EmptyOrFalseSuppressBoolean,
													Description:      `The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".`,
												},
												"crl_sign": {
													Type:             schema.TypeBool,
													Optional:         true,
													DiffSuppressFunc: tpgresource.EmptyOrFalseSuppressBoolean,
													Description:      `The key may be used sign certificate revocation lists.`,
												},
												"data_encipherment": {
													Type:             schema.TypeBool,
													Optional:         true,
													DiffSuppressFunc: tpgresource.EmptyOrFalseSuppressBoolean,
													Description:      `The key may be used to encipher data.`,
												},
												"decipher_only": {
													Type:             schema.TypeBool,
													Optional:         true,
													DiffSuppressFunc: tpgresource.EmptyOrFalseSuppressBoolean,
													Description:      `The key may be used to decipher only.`,
												},
												"digital_signature": {
													Type:             schema.TypeBool,
													Optional:         true,
													DiffSuppressFunc: tpgresource.EmptyOrFalseSuppressBoolean,
													Description:      `The key may be used for digital signatures.`,
												},
												"encipher_only": {
													Type:             schema.TypeBool,
													Optional:         true,
													DiffSuppressFunc: tpgresource.EmptyOrFalseSuppressBoolean,
													Description:      `The key may be used to encipher only.`,
												},
												"key_agreement": {
													Type:             schema.TypeBool,
													Optional:         true,
													DiffSuppressFunc: tpgresource.EmptyOrFalseSuppressBoolean,
													Description:      `The key may be used in a key agreement protocol.`,
												},
												"key_encipherment": {
													Type:             schema.TypeBool,
													Optional:         true,
													DiffSuppressFunc: tpgresource.EmptyOrFalseSuppressBoolean,
													Description:      `The key may be used to encipher other keys.`,
												},
											},
										},
									},
									"extended_key_usage": {
										Type:             schema.TypeList,
										Optional:         true,
										DiffSuppressFunc: tpgresource.EmptyOrUnsetBlockDiffSuppress,
										Description:      `Detailed scenarios in which a key may be used.`,
										MaxItems:         1,
										Elem: &schema.Resource{
											Schema: map[string]*schema.Schema{
												"client_auth": {
													Type:             schema.TypeBool,
													Optional:         true,
													DiffSuppressFunc: tpgresource.EmptyOrFalseSuppressBoolean,
													Description:      `Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.`,
												},
												"code_signing": {
													Type:             schema.TypeBool,
													Optional:         true,
													DiffSuppressFunc: tpgresource.EmptyOrFalseSuppressBoolean,
													Description:      `Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".`,
												},
												"email_protection": {
													Type:             schema.TypeBool,
													Optional:         true,
													DiffSuppressFunc: tpgresource.EmptyOrFalseSuppressBoolean,
													Description:      `Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".`,
												},
												"ocsp_signing": {
													Type:             schema.TypeBool,
													Optional:         true,
													DiffSuppressFunc: tpgresource.EmptyOrFalseSuppressBoolean,
													Description:      `Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".`,
												},
												"server_auth": {
													Type:             schema.TypeBool,
													Optional:         true,
													DiffSuppressFunc: tpgresource.EmptyOrFalseSuppressBoolean,
													Description:      `Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.`,
												},
												"time_stamping": {
													Type:             schema.TypeBool,
													Optional:         true,
													DiffSuppressFunc: tpgresource.EmptyOrFalseSuppressBoolean,
													Description:      `Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".`,
												},
											},
										},
									},
									"unknown_extended_key_usages": {
										Type:        schema.TypeList,
										Optional:    true,
										Description: `Used to describe extended key usages that are not listed in the KeyUsage.ExtendedKeyUsageOptions message.`,
										Elem: &schema.Resource{
											Schema: map[string]*schema.Schema{
												"object_id_path": {
													Type:        schema.TypeList,
													Required:    true,
													Description: `Required. The parts of an OID path. The most significant parts of the path come first.`,
													Elem: &schema.Schema{
														Type: schema.TypeInt,
													},
												},
											},
										},
									},
								},
							},
						},
						"policy_ids": {
							Type:        schema.TypeList,
							Optional:    true,
							Description: `Optional. Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.`,
							Elem: &schema.Resource{
								Schema: map[string]*schema.Schema{
									"object_id_path": {
										Type:        schema.TypeList,
										Required:    true,
										Description: `Required. The parts of an OID path. The most significant parts of the path come first.`,
										Elem: &schema.Schema{
											Type: schema.TypeInt,
										},
									},
								},
							},
						},
					},
				},
			},
			"create_time": {
				Type:        schema.TypeString,
				Computed:    true,
				Description: `Output only. The time at which this CertificateTemplate was created.`,
			},
			"effective_labels": {
				Type:        schema.TypeMap,
				Computed:    true,
				Description: `All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Terraform, other clients and services.`,
				Elem:        &schema.Schema{Type: schema.TypeString},
			},
			"terraform_labels": {
				Type:     schema.TypeMap,
				Computed: true,
				Description: `The combination of labels configured directly on the resource
 and default labels configured on the provider.`,
				Elem: &schema.Schema{Type: schema.TypeString},
			},
			"update_time": {
				Type:        schema.TypeString,
				Computed:    true,
				Description: `Output only. The time at which this CertificateTemplate was updated.`,
			},
			"project": {
				Type:     schema.TypeString,
				Optional: true,
				Computed: true,
				ForceNew: true,
			},
		},
		UseJSONNumber: true,
	}
}

func resourcePrivatecaCertificateTemplateCreate(d *schema.ResourceData, meta interface{}) error {
	config := meta.(*transport_tpg.Config)
	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
	if err != nil {
		return err
	}

	obj := make(map[string]interface{})
	predefinedValuesProp, err := expandPrivatecaCertificateTemplatePredefinedValues(d.Get("predefined_values"), d, config)
	if err != nil {
		return err
	} else if v, ok := d.GetOkExists("predefined_values"); !tpgresource.IsEmptyValue(reflect.ValueOf(predefinedValuesProp)) && (ok || !reflect.DeepEqual(v, predefinedValuesProp)) {
		obj["predefinedValues"] = predefinedValuesProp
	}
	identityConstraintsProp, err := expandPrivatecaCertificateTemplateIdentityConstraints(d.Get("identity_constraints"), d, config)
	if err != nil {
		return err
	} else if v, ok := d.GetOkExists("identity_constraints"); !tpgresource.IsEmptyValue(reflect.ValueOf(identityConstraintsProp)) && (ok || !reflect.DeepEqual(v, identityConstraintsProp)) {
		obj["identityConstraints"] = identityConstraintsProp
	}
	passthroughExtensionsProp, err := expandPrivatecaCertificateTemplatePassthroughExtensions(d.Get("passthrough_extensions"), d, config)
	if err != nil {
		return err
	} else if v, ok := d.GetOkExists("passthrough_extensions"); !tpgresource.IsEmptyValue(reflect.ValueOf(passthroughExtensionsProp)) && (ok || !reflect.DeepEqual(v, passthroughExtensionsProp)) {
		obj["passthroughExtensions"] = passthroughExtensionsProp
	}
	maximumLifetimeProp, err := expandPrivatecaCertificateTemplateMaximumLifetime(d.Get("maximum_lifetime"), d, config)
	if err != nil {
		return err
	} else if v, ok := d.GetOkExists("maximum_lifetime"); !tpgresource.IsEmptyValue(reflect.ValueOf(maximumLifetimeProp)) && (ok || !reflect.DeepEqual(v, maximumLifetimeProp)) {
		obj["maximumLifetime"] = maximumLifetimeProp
	}
	descriptionProp, err := expandPrivatecaCertificateTemplateDescription(d.Get("description"), d, config)
	if err != nil {
		return err
	} else if v, ok := d.GetOkExists("description"); !tpgresource.IsEmptyValue(reflect.ValueOf(descriptionProp)) && (ok || !reflect.DeepEqual(v, descriptionProp)) {
		obj["description"] = descriptionProp
	}
	labelsProp, err := expandPrivatecaCertificateTemplateEffectiveLabels(d.Get("effective_labels"), d, config)
	if err != nil {
		return err
	} else if v, ok := d.GetOkExists("effective_labels"); !tpgresource.IsEmptyValue(reflect.ValueOf(labelsProp)) && (ok || !reflect.DeepEqual(v, labelsProp)) {
		obj["labels"] = labelsProp
	}

	url, err := tpgresource.ReplaceVarsForId(d, config, "{{PrivatecaBasePath}}projects/{{project}}/locations/{{location}}/certificateTemplates?certificateTemplateId={{name}}")
	if err != nil {
		return err
	}

	log.Printf("[DEBUG] Creating new CertificateTemplate: %#v", obj)
	billingProject := ""

	project, err := tpgresource.GetProject(d, config)
	if err != nil {
		return fmt.Errorf("Error fetching project for CertificateTemplate: %s", err)
	}
	billingProject = strings.TrimPrefix(project, "projects/")

	// err == nil indicates that the billing_project value was found
	if bp, err := tpgresource.GetBillingProject(d, config); err == nil {
		billingProject = bp
	}

	headers := make(http.Header)
	res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
		Config:    config,
		Method:    "POST",
		Project:   billingProject,
		RawURL:    url,
		UserAgent: userAgent,
		Body:      obj,
		Timeout:   d.Timeout(schema.TimeoutCreate),
		Headers:   headers,
	})
	if err != nil {
		return fmt.Errorf("Error creating CertificateTemplate: %s", err)
	}

	// Store the ID now
	id, err := tpgresource.ReplaceVarsForId(d, config, "projects/{{project}}/locations/{{location}}/certificateTemplates/{{name}}")
	if err != nil {
		return fmt.Errorf("Error constructing id: %s", err)
	}
	d.SetId(id)

	// Use the resource in the operation response to populate
	// identity fields and d.Id() before read
	var opRes map[string]interface{}
	err = PrivatecaOperationWaitTimeWithResponse(
		config, res, &opRes, tpgresource.GetResourceNameFromSelfLink(project), "Creating CertificateTemplate", userAgent,
		d.Timeout(schema.TimeoutCreate))
	if err != nil {
		// The resource didn't actually create
		d.SetId("")

		return fmt.Errorf("Error waiting to create CertificateTemplate: %s", err)
	}

	// This may have caused the ID to update - update it if so.
	id, err = tpgresource.ReplaceVarsForId(d, config, "projects/{{project}}/locations/{{location}}/certificateTemplates/{{name}}")
	if err != nil {
		return fmt.Errorf("Error constructing id: %s", err)
	}
	d.SetId(id)

	log.Printf("[DEBUG] Finished creating CertificateTemplate %q: %#v", d.Id(), res)

	return resourcePrivatecaCertificateTemplateRead(d, meta)
}

func resourcePrivatecaCertificateTemplateRead(d *schema.ResourceData, meta interface{}) error {
	config := meta.(*transport_tpg.Config)
	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
	if err != nil {
		return err
	}

	url, err := tpgresource.ReplaceVarsForId(d, config, "{{PrivatecaBasePath}}projects/{{project}}/locations/{{location}}/certificateTemplates/{{name}}")
	if err != nil {
		return err
	}

	billingProject := ""

	project, err := tpgresource.GetProject(d, config)
	if err != nil {
		return fmt.Errorf("Error fetching project for CertificateTemplate: %s", err)
	}
	billingProject = strings.TrimPrefix(project, "projects/")

	// err == nil indicates that the billing_project value was found
	if bp, err := tpgresource.GetBillingProject(d, config); err == nil {
		billingProject = bp
	}

	headers := make(http.Header)
	res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
		Config:    config,
		Method:    "GET",
		Project:   billingProject,
		RawURL:    url,
		UserAgent: userAgent,
		Headers:   headers,
	})
	if err != nil {
		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("PrivatecaCertificateTemplate %q", d.Id()))
	}

	if err := d.Set("project", project); err != nil {
		return fmt.Errorf("Error reading CertificateTemplate: %s", err)
	}

	if err := d.Set("predefined_values", flattenPrivatecaCertificateTemplatePredefinedValues(res["predefinedValues"], d, config)); err != nil {
		return fmt.Errorf("Error reading CertificateTemplate: %s", err)
	}
	if err := d.Set("identity_constraints", flattenPrivatecaCertificateTemplateIdentityConstraints(res["identityConstraints"], d, config)); err != nil {
		return fmt.Errorf("Error reading CertificateTemplate: %s", err)
	}
	if err := d.Set("passthrough_extensions", flattenPrivatecaCertificateTemplatePassthroughExtensions(res["passthroughExtensions"], d, config)); err != nil {
		return fmt.Errorf("Error reading CertificateTemplate: %s", err)
	}
	if err := d.Set("maximum_lifetime", flattenPrivatecaCertificateTemplateMaximumLifetime(res["maximumLifetime"], d, config)); err != nil {
		return fmt.Errorf("Error reading CertificateTemplate: %s", err)
	}
	if err := d.Set("description", flattenPrivatecaCertificateTemplateDescription(res["description"], d, config)); err != nil {
		return fmt.Errorf("Error reading CertificateTemplate: %s", err)
	}
	if err := d.Set("create_time", flattenPrivatecaCertificateTemplateCreateTime(res["createTime"], d, config)); err != nil {
		return fmt.Errorf("Error reading CertificateTemplate: %s", err)
	}
	if err := d.Set("update_time", flattenPrivatecaCertificateTemplateUpdateTime(res["updateTime"], d, config)); err != nil {
		return fmt.Errorf("Error reading CertificateTemplate: %s", err)
	}
	if err := d.Set("labels", flattenPrivatecaCertificateTemplateLabels(res["labels"], d, config)); err != nil {
		return fmt.Errorf("Error reading CertificateTemplate: %s", err)
	}
	if err := d.Set("terraform_labels", flattenPrivatecaCertificateTemplateTerraformLabels(res["labels"], d, config)); err != nil {
		return fmt.Errorf("Error reading CertificateTemplate: %s", err)
	}
	if err := d.Set("effective_labels", flattenPrivatecaCertificateTemplateEffectiveLabels(res["labels"], d, config)); err != nil {
		return fmt.Errorf("Error reading CertificateTemplate: %s", err)
	}

	return nil
}

func resourcePrivatecaCertificateTemplateUpdate(d *schema.ResourceData, meta interface{}) error {
	config := meta.(*transport_tpg.Config)
	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
	if err != nil {
		return err
	}

	billingProject := ""

	project, err := tpgresource.GetProject(d, config)
	if err != nil {
		return fmt.Errorf("Error fetching project for CertificateTemplate: %s", err)
	}
	billingProject = strings.TrimPrefix(project, "projects/")

	obj := make(map[string]interface{})
	predefinedValuesProp, err := expandPrivatecaCertificateTemplatePredefinedValues(d.Get("predefined_values"), d, config)
	if err != nil {
		return err
	} else if v, ok := d.GetOkExists("predefined_values"); !tpgresource.IsEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, predefinedValuesProp)) {
		obj["predefinedValues"] = predefinedValuesProp
	}
	identityConstraintsProp, err := expandPrivatecaCertificateTemplateIdentityConstraints(d.Get("identity_constraints"), d, config)
	if err != nil {
		return err
	} else if v, ok := d.GetOkExists("identity_constraints"); !tpgresource.IsEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, identityConstraintsProp)) {
		obj["identityConstraints"] = identityConstraintsProp
	}
	passthroughExtensionsProp, err := expandPrivatecaCertificateTemplatePassthroughExtensions(d.Get("passthrough_extensions"), d, config)
	if err != nil {
		return err
	} else if v, ok := d.GetOkExists("passthrough_extensions"); !tpgresource.IsEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, passthroughExtensionsProp)) {
		obj["passthroughExtensions"] = passthroughExtensionsProp
	}
	maximumLifetimeProp, err := expandPrivatecaCertificateTemplateMaximumLifetime(d.Get("maximum_lifetime"), d, config)
	if err != nil {
		return err
	} else if v, ok := d.GetOkExists("maximum_lifetime"); !tpgresource.IsEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, maximumLifetimeProp)) {
		obj["maximumLifetime"] = maximumLifetimeProp
	}
	descriptionProp, err := expandPrivatecaCertificateTemplateDescription(d.Get("description"), d, config)
	if err != nil {
		return err
	} else if v, ok := d.GetOkExists("description"); !tpgresource.IsEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, descriptionProp)) {
		obj["description"] = descriptionProp
	}
	labelsProp, err := expandPrivatecaCertificateTemplateEffectiveLabels(d.Get("effective_labels"), d, config)
	if err != nil {
		return err
	} else if v, ok := d.GetOkExists("effective_labels"); !tpgresource.IsEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, labelsProp)) {
		obj["labels"] = labelsProp
	}

	url, err := tpgresource.ReplaceVarsForId(d, config, "{{PrivatecaBasePath}}projects/{{project}}/locations/{{location}}/certificateTemplates/{{name}}")
	if err != nil {
		return err
	}

	log.Printf("[DEBUG] Updating CertificateTemplate %q: %#v", d.Id(), obj)
	headers := make(http.Header)
	updateMask := []string{}

	if d.HasChange("predefined_values") {
		updateMask = append(updateMask, "predefinedValues")
	}

	if d.HasChange("identity_constraints") {
		updateMask = append(updateMask, "identityConstraints")
	}

	if d.HasChange("passthrough_extensions") {
		updateMask = append(updateMask, "passthroughExtensions")
	}

	if d.HasChange("maximum_lifetime") {
		updateMask = append(updateMask, "maximumLifetime")
	}

	if d.HasChange("description") {
		updateMask = append(updateMask, "description")
	}

	if d.HasChange("effective_labels") {
		updateMask = append(updateMask, "labels")
	}
	// updateMask is a URL parameter but not present in the schema, so ReplaceVars
	// won't set it
	url, err = transport_tpg.AddQueryParams(url, map[string]string{"updateMask": strings.Join(updateMask, ",")})
	if err != nil {
		return err
	}

	// err == nil indicates that the billing_project value was found
	if bp, err := tpgresource.GetBillingProject(d, config); err == nil {
		billingProject = bp
	}

	// if updateMask is empty we are not updating anything so skip the post
	if len(updateMask) > 0 {
		res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
			Config:    config,
			Method:    "PATCH",
			Project:   billingProject,
			RawURL:    url,
			UserAgent: userAgent,
			Body:      obj,
			Timeout:   d.Timeout(schema.TimeoutUpdate),
			Headers:   headers,
		})

		if err != nil {
			return fmt.Errorf("Error updating CertificateTemplate %q: %s", d.Id(), err)
		} else {
			log.Printf("[DEBUG] Finished updating CertificateTemplate %q: %#v", d.Id(), res)
		}

		err = PrivatecaOperationWaitTime(
			config, res, tpgresource.GetResourceNameFromSelfLink(project), "Updating CertificateTemplate", userAgent,
			d.Timeout(schema.TimeoutUpdate))

		if err != nil {
			return err
		}
	}

	return resourcePrivatecaCertificateTemplateRead(d, meta)
}

func resourcePrivatecaCertificateTemplateDelete(d *schema.ResourceData, meta interface{}) error {
	config := meta.(*transport_tpg.Config)
	userAgent, err := tpgresource.GenerateUserAgentString(d, config.UserAgent)
	if err != nil {
		return err
	}

	billingProject := ""

	project, err := tpgresource.GetProject(d, config)
	if err != nil {
		return fmt.Errorf("Error fetching project for CertificateTemplate: %s", err)
	}
	billingProject = strings.TrimPrefix(project, "projects/")

	url, err := tpgresource.ReplaceVarsForId(d, config, "{{PrivatecaBasePath}}projects/{{project}}/locations/{{location}}/certificateTemplates/{{name}}")
	if err != nil {
		return err
	}

	var obj map[string]interface{}

	// err == nil indicates that the billing_project value was found
	if bp, err := tpgresource.GetBillingProject(d, config); err == nil {
		billingProject = bp
	}

	headers := make(http.Header)

	log.Printf("[DEBUG] Deleting CertificateTemplate %q", d.Id())
	res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
		Config:    config,
		Method:    "DELETE",
		Project:   billingProject,
		RawURL:    url,
		UserAgent: userAgent,
		Body:      obj,
		Timeout:   d.Timeout(schema.TimeoutDelete),
		Headers:   headers,
	})
	if err != nil {
		return transport_tpg.HandleNotFoundError(err, d, "CertificateTemplate")
	}

	err = PrivatecaOperationWaitTime(
		config, res, tpgresource.GetResourceNameFromSelfLink(project), "Deleting CertificateTemplate", userAgent,
		d.Timeout(schema.TimeoutDelete))

	if err != nil {
		return err
	}

	log.Printf("[DEBUG] Finished deleting CertificateTemplate %q: %#v", d.Id(), res)
	return nil
}

func resourcePrivatecaCertificateTemplateImport(d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
	config := meta.(*transport_tpg.Config)
	if err := tpgresource.ParseImportId([]string{
		"^projects/(?P<project>[^/]+)/locations/(?P<location>[^/]+)/certificateTemplates/(?P<name>[^/]+)$",
		"^(?P<project>[^/]+)/(?P<location>[^/]+)/(?P<name>[^/]+)$",
		"^(?P<location>[^/]+)/(?P<name>[^/]+)$",
	}, d, config); err != nil {
		return nil, err
	}

	// Replace import id for the resource id
	id, err := tpgresource.ReplaceVarsForId(d, config, "projects/{{project}}/locations/{{location}}/certificateTemplates/{{name}}")
	if err != nil {
		return nil, fmt.Errorf("Error constructing id: %s", err)
	}
	d.SetId(id)

	return []*schema.ResourceData{d}, nil
}

func flattenPrivatecaCertificateTemplatePredefinedValues(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	if v == nil {
		return nil
	}
	original := v.(map[string]interface{})
	if len(original) == 0 {
		return nil
	}
	transformed := make(map[string]interface{})
	transformed["key_usage"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsage(original["keyUsage"], d, config)
	transformed["ca_options"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesCaOptions(original["caOptions"], d, config)
	transformed["policy_ids"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesPolicyIds(original["policyIds"], d, config)
	transformed["aia_ocsp_servers"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesAiaOcspServers(original["aiaOcspServers"], d, config)
	transformed["additional_extensions"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesAdditionalExtensions(original["additionalExtensions"], d, config)
	return []interface{}{transformed}
}
func flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsage(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	if v == nil {
		return nil
	}
	original := v.(map[string]interface{})
	if len(original) == 0 {
		return nil
	}
	transformed := make(map[string]interface{})
	transformed["base_key_usage"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsage(original["baseKeyUsage"], d, config)
	transformed["extended_key_usage"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsage(original["extendedKeyUsage"], d, config)
	transformed["unknown_extended_key_usages"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsages(original["unknownExtendedKeyUsages"], d, config)
	return []interface{}{transformed}
}
func flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsage(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	if v == nil {
		return nil
	}
	original := v.(map[string]interface{})
	if len(original) == 0 {
		return nil
	}
	transformed := make(map[string]interface{})
	transformed["digital_signature"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageDigitalSignature(original["digitalSignature"], d, config)
	transformed["content_commitment"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageContentCommitment(original["contentCommitment"], d, config)
	transformed["key_encipherment"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageKeyEncipherment(original["keyEncipherment"], d, config)
	transformed["data_encipherment"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageDataEncipherment(original["dataEncipherment"], d, config)
	transformed["key_agreement"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageKeyAgreement(original["keyAgreement"], d, config)
	transformed["cert_sign"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageCertSign(original["certSign"], d, config)
	transformed["crl_sign"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageCrlSign(original["crlSign"], d, config)
	transformed["encipher_only"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageEncipherOnly(original["encipherOnly"], d, config)
	transformed["decipher_only"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageDecipherOnly(original["decipherOnly"], d, config)
	return []interface{}{transformed}
}
func flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageDigitalSignature(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageContentCommitment(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageKeyEncipherment(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageDataEncipherment(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageKeyAgreement(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageCertSign(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageCrlSign(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageEncipherOnly(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageDecipherOnly(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsage(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	if v == nil {
		return nil
	}
	original := v.(map[string]interface{})
	if len(original) == 0 {
		return nil
	}
	transformed := make(map[string]interface{})
	transformed["server_auth"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageServerAuth(original["serverAuth"], d, config)
	transformed["client_auth"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageClientAuth(original["clientAuth"], d, config)
	transformed["code_signing"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageCodeSigning(original["codeSigning"], d, config)
	transformed["email_protection"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageEmailProtection(original["emailProtection"], d, config)
	transformed["time_stamping"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageTimeStamping(original["timeStamping"], d, config)
	transformed["ocsp_signing"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageOcspSigning(original["ocspSigning"], d, config)
	return []interface{}{transformed}
}
func flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageServerAuth(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageClientAuth(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageCodeSigning(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageEmailProtection(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageTimeStamping(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageOcspSigning(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsages(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	if v == nil {
		return v
	}
	l := v.([]interface{})
	transformed := make([]interface{}, 0, len(l))
	for _, raw := range l {
		original := raw.(map[string]interface{})
		if len(original) < 1 {
			// Do not include empty json objects coming back from the api
			continue
		}
		transformed = append(transformed, map[string]interface{}{
			"object_id_path": flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsagesObjectIdPath(original["objectIdPath"], d, config),
		})
	}
	return transformed
}
func flattenPrivatecaCertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsagesObjectIdPath(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplatePredefinedValuesCaOptions(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	if v == nil {
		return nil
	}
	original := v.(map[string]interface{})
	if len(original) == 0 {
		return nil
	}
	transformed := make(map[string]interface{})
	transformed["is_ca"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesCaOptionsIsCa(original["isCa"], d, config)
	transformed["max_issuer_path_length"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesCaOptionsMaxIssuerPathLength(original["maxIssuerPathLength"], d, config)
	return []interface{}{transformed}
}
func flattenPrivatecaCertificateTemplatePredefinedValuesCaOptionsIsCa(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplatePredefinedValuesCaOptionsMaxIssuerPathLength(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	// Handles the string fixed64 format
	if strVal, ok := v.(string); ok {
		if intVal, err := tpgresource.StringToFixed64(strVal); err == nil {
			return intVal
		}
	}

	// number values are represented as float64
	if floatVal, ok := v.(float64); ok {
		intVal := int(floatVal)
		return intVal
	}

	return v // let terraform core handle it otherwise
}

func flattenPrivatecaCertificateTemplatePredefinedValuesPolicyIds(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	if v == nil {
		return v
	}
	l := v.([]interface{})
	transformed := make([]interface{}, 0, len(l))
	for _, raw := range l {
		original := raw.(map[string]interface{})
		if len(original) < 1 {
			// Do not include empty json objects coming back from the api
			continue
		}
		transformed = append(transformed, map[string]interface{}{
			"object_id_path": flattenPrivatecaCertificateTemplatePredefinedValuesPolicyIdsObjectIdPath(original["objectIdPath"], d, config),
		})
	}
	return transformed
}
func flattenPrivatecaCertificateTemplatePredefinedValuesPolicyIdsObjectIdPath(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplatePredefinedValuesAiaOcspServers(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplatePredefinedValuesAdditionalExtensions(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	if v == nil {
		return v
	}
	l := v.([]interface{})
	transformed := make([]interface{}, 0, len(l))
	for _, raw := range l {
		original := raw.(map[string]interface{})
		if len(original) < 1 {
			// Do not include empty json objects coming back from the api
			continue
		}
		transformed = append(transformed, map[string]interface{}{
			"object_id": flattenPrivatecaCertificateTemplatePredefinedValuesAdditionalExtensionsObjectId(original["objectId"], d, config),
			"critical":  flattenPrivatecaCertificateTemplatePredefinedValuesAdditionalExtensionsCritical(original["critical"], d, config),
			"value":     flattenPrivatecaCertificateTemplatePredefinedValuesAdditionalExtensionsValue(original["value"], d, config),
		})
	}
	return transformed
}
func flattenPrivatecaCertificateTemplatePredefinedValuesAdditionalExtensionsObjectId(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	if v == nil {
		return nil
	}
	original := v.(map[string]interface{})
	if len(original) == 0 {
		return nil
	}
	transformed := make(map[string]interface{})
	transformed["object_id_path"] =
		flattenPrivatecaCertificateTemplatePredefinedValuesAdditionalExtensionsObjectIdObjectIdPath(original["objectIdPath"], d, config)
	return []interface{}{transformed}
}
func flattenPrivatecaCertificateTemplatePredefinedValuesAdditionalExtensionsObjectIdObjectIdPath(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplatePredefinedValuesAdditionalExtensionsCritical(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplatePredefinedValuesAdditionalExtensionsValue(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplateIdentityConstraints(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	if v == nil {
		return nil
	}
	original := v.(map[string]interface{})
	if len(original) == 0 {
		return nil
	}
	transformed := make(map[string]interface{})
	transformed["cel_expression"] =
		flattenPrivatecaCertificateTemplateIdentityConstraintsCelExpression(original["celExpression"], d, config)
	transformed["allow_subject_passthrough"] =
		flattenPrivatecaCertificateTemplateIdentityConstraintsAllowSubjectPassthrough(original["allowSubjectPassthrough"], d, config)
	transformed["allow_subject_alt_names_passthrough"] =
		flattenPrivatecaCertificateTemplateIdentityConstraintsAllowSubjectAltNamesPassthrough(original["allowSubjectAltNamesPassthrough"], d, config)
	return []interface{}{transformed}
}
func flattenPrivatecaCertificateTemplateIdentityConstraintsCelExpression(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	if v == nil {
		return nil
	}
	original := v.(map[string]interface{})
	if len(original) == 0 {
		return nil
	}
	transformed := make(map[string]interface{})
	transformed["expression"] =
		flattenPrivatecaCertificateTemplateIdentityConstraintsCelExpressionExpression(original["expression"], d, config)
	transformed["title"] =
		flattenPrivatecaCertificateTemplateIdentityConstraintsCelExpressionTitle(original["title"], d, config)
	transformed["description"] =
		flattenPrivatecaCertificateTemplateIdentityConstraintsCelExpressionDescription(original["description"], d, config)
	transformed["location"] =
		flattenPrivatecaCertificateTemplateIdentityConstraintsCelExpressionLocation(original["location"], d, config)
	return []interface{}{transformed}
}
func flattenPrivatecaCertificateTemplateIdentityConstraintsCelExpressionExpression(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplateIdentityConstraintsCelExpressionTitle(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplateIdentityConstraintsCelExpressionDescription(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplateIdentityConstraintsCelExpressionLocation(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplateIdentityConstraintsAllowSubjectPassthrough(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplateIdentityConstraintsAllowSubjectAltNamesPassthrough(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplatePassthroughExtensions(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	if v == nil {
		return nil
	}
	original := v.(map[string]interface{})
	if len(original) == 0 {
		return nil
	}
	transformed := make(map[string]interface{})
	transformed["known_extensions"] =
		flattenPrivatecaCertificateTemplatePassthroughExtensionsKnownExtensions(original["knownExtensions"], d, config)
	transformed["additional_extensions"] =
		flattenPrivatecaCertificateTemplatePassthroughExtensionsAdditionalExtensions(original["additionalExtensions"], d, config)
	return []interface{}{transformed}
}
func flattenPrivatecaCertificateTemplatePassthroughExtensionsKnownExtensions(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplatePassthroughExtensionsAdditionalExtensions(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	if v == nil {
		return v
	}
	l := v.([]interface{})
	transformed := make([]interface{}, 0, len(l))
	for _, raw := range l {
		original := raw.(map[string]interface{})
		if len(original) < 1 {
			// Do not include empty json objects coming back from the api
			continue
		}
		transformed = append(transformed, map[string]interface{}{
			"object_id_path": flattenPrivatecaCertificateTemplatePassthroughExtensionsAdditionalExtensionsObjectIdPath(original["objectIdPath"], d, config),
		})
	}
	return transformed
}
func flattenPrivatecaCertificateTemplatePassthroughExtensionsAdditionalExtensionsObjectIdPath(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplateMaximumLifetime(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplateDescription(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplateCreateTime(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplateUpdateTime(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func flattenPrivatecaCertificateTemplateLabels(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	if v == nil {
		return v
	}

	transformed := make(map[string]interface{})
	if l, ok := d.GetOkExists("labels"); ok {
		for k := range l.(map[string]interface{}) {
			transformed[k] = v.(map[string]interface{})[k]
		}
	}

	return transformed
}

func flattenPrivatecaCertificateTemplateTerraformLabels(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	if v == nil {
		return v
	}

	transformed := make(map[string]interface{})
	if l, ok := d.GetOkExists("terraform_labels"); ok {
		for k := range l.(map[string]interface{}) {
			transformed[k] = v.(map[string]interface{})[k]
		}
	}

	return transformed
}

func flattenPrivatecaCertificateTemplateEffectiveLabels(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
	return v
}

func expandPrivatecaCertificateTemplatePredefinedValues(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	l := v.([]interface{})
	if len(l) == 0 || l[0] == nil {
		return nil, nil
	}
	raw := l[0]
	original := raw.(map[string]interface{})
	transformed := make(map[string]interface{})

	transformedKeyUsage, err := expandPrivatecaCertificateTemplatePredefinedValuesKeyUsage(original["key_usage"], d, config)
	if err != nil {
		return nil, err
	} else if val := reflect.ValueOf(transformedKeyUsage); val.IsValid() && !tpgresource.IsEmptyValue(val) {
		transformed["keyUsage"] = transformedKeyUsage
	}

	transformedCaOptions, err := expandPrivatecaCertificateTemplatePredefinedValuesCaOptions(original["ca_options"], d, config)
	if err != nil {
		return nil, err
	} else if val := reflect.ValueOf(transformedCaOptions); val.IsValid() && !tpgresource.IsEmptyValue(val) {
		transformed["caOptions"] = transformedCaOptions
	}

	transformedPolicyIds, err := expandPrivatecaCertificateTemplatePredefinedValuesPolicyIds(original["policy_ids"], d, config)
	if err != nil {
		return nil, err
	} else if val := reflect.ValueOf(transformedPolicyIds); val.IsValid() && !tpgresource.IsEmptyValue(val) {
		transformed["policyIds"] = transformedPolicyIds
	}

	transformedAiaOcspServers, err := expandPrivatecaCertificateTemplatePredefinedValuesAiaOcspServers(original["aia_ocsp_servers"], d, config)
	if err != nil {
		return nil, err
	} else if val := reflect.ValueOf(transformedAiaOcspServers); val.IsValid() && !tpgresource.IsEmptyValue(val) {
		transformed["aiaOcspServers"] = transformedAiaOcspServers
	}

	transformedAdditionalExtensions, err := expandPrivatecaCertificateTemplatePredefinedValuesAdditionalExtensions(original["additional_extensions"], d, config)
	if err != nil {
		return nil, err
	} else if val := reflect.ValueOf(transformedAdditionalExtensions); val.IsValid() && !tpgresource.IsEmptyValue(val) {
		transformed["additionalExtensions"] = transformedAdditionalExtensions
	}

	return transformed, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesKeyUsage(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	l := v.([]interface{})
	if len(l) == 0 || l[0] == nil {
		return nil, nil
	}
	raw := l[0]
	original := raw.(map[string]interface{})
	transformed := make(map[string]interface{})

	transformedBaseKeyUsage, err := expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsage(original["base_key_usage"], d, config)
	if err != nil {
		return nil, err
	} else if val := reflect.ValueOf(transformedBaseKeyUsage); val.IsValid() && !tpgresource.IsEmptyValue(val) {
		transformed["baseKeyUsage"] = transformedBaseKeyUsage
	}

	transformedExtendedKeyUsage, err := expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsage(original["extended_key_usage"], d, config)
	if err != nil {
		return nil, err
	} else if val := reflect.ValueOf(transformedExtendedKeyUsage); val.IsValid() && !tpgresource.IsEmptyValue(val) {
		transformed["extendedKeyUsage"] = transformedExtendedKeyUsage
	}

	transformedUnknownExtendedKeyUsages, err := expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsages(original["unknown_extended_key_usages"], d, config)
	if err != nil {
		return nil, err
	} else if val := reflect.ValueOf(transformedUnknownExtendedKeyUsages); val.IsValid() && !tpgresource.IsEmptyValue(val) {
		transformed["unknownExtendedKeyUsages"] = transformedUnknownExtendedKeyUsages
	}

	return transformed, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsage(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	l := v.([]interface{})
	if len(l) == 0 || l[0] == nil {
		return nil, nil
	}
	raw := l[0]
	original := raw.(map[string]interface{})
	transformed := make(map[string]interface{})

	transformedDigitalSignature, err := expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageDigitalSignature(original["digital_signature"], d, config)
	if err != nil {
		return nil, err
	} else {
		transformed["digitalSignature"] = transformedDigitalSignature
	}

	transformedContentCommitment, err := expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageContentCommitment(original["content_commitment"], d, config)
	if err != nil {
		return nil, err
	} else {
		transformed["contentCommitment"] = transformedContentCommitment
	}

	transformedKeyEncipherment, err := expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageKeyEncipherment(original["key_encipherment"], d, config)
	if err != nil {
		return nil, err
	} else {
		transformed["keyEncipherment"] = transformedKeyEncipherment
	}

	transformedDataEncipherment, err := expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageDataEncipherment(original["data_encipherment"], d, config)
	if err != nil {
		return nil, err
	} else {
		transformed["dataEncipherment"] = transformedDataEncipherment
	}

	transformedKeyAgreement, err := expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageKeyAgreement(original["key_agreement"], d, config)
	if err != nil {
		return nil, err
	} else {
		transformed["keyAgreement"] = transformedKeyAgreement
	}

	transformedCertSign, err := expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageCertSign(original["cert_sign"], d, config)
	if err != nil {
		return nil, err
	} else {
		transformed["certSign"] = transformedCertSign
	}

	transformedCrlSign, err := expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageCrlSign(original["crl_sign"], d, config)
	if err != nil {
		return nil, err
	} else {
		transformed["crlSign"] = transformedCrlSign
	}

	transformedEncipherOnly, err := expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageEncipherOnly(original["encipher_only"], d, config)
	if err != nil {
		return nil, err
	} else {
		transformed["encipherOnly"] = transformedEncipherOnly
	}

	transformedDecipherOnly, err := expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageDecipherOnly(original["decipher_only"], d, config)
	if err != nil {
		return nil, err
	} else {
		transformed["decipherOnly"] = transformedDecipherOnly
	}

	return transformed, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageDigitalSignature(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageContentCommitment(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageKeyEncipherment(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageDataEncipherment(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageKeyAgreement(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageCertSign(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageCrlSign(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageEncipherOnly(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageBaseKeyUsageDecipherOnly(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsage(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	l := v.([]interface{})
	if len(l) == 0 || l[0] == nil {
		return nil, nil
	}
	raw := l[0]
	original := raw.(map[string]interface{})
	transformed := make(map[string]interface{})

	transformedServerAuth, err := expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageServerAuth(original["server_auth"], d, config)
	if err != nil {
		return nil, err
	} else {
		transformed["serverAuth"] = transformedServerAuth
	}

	transformedClientAuth, err := expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageClientAuth(original["client_auth"], d, config)
	if err != nil {
		return nil, err
	} else {
		transformed["clientAuth"] = transformedClientAuth
	}

	transformedCodeSigning, err := expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageCodeSigning(original["code_signing"], d, config)
	if err != nil {
		return nil, err
	} else {
		transformed["codeSigning"] = transformedCodeSigning
	}

	transformedEmailProtection, err := expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageEmailProtection(original["email_protection"], d, config)
	if err != nil {
		return nil, err
	} else {
		transformed["emailProtection"] = transformedEmailProtection
	}

	transformedTimeStamping, err := expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageTimeStamping(original["time_stamping"], d, config)
	if err != nil {
		return nil, err
	} else {
		transformed["timeStamping"] = transformedTimeStamping
	}

	transformedOcspSigning, err := expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageOcspSigning(original["ocsp_signing"], d, config)
	if err != nil {
		return nil, err
	} else {
		transformed["ocspSigning"] = transformedOcspSigning
	}

	return transformed, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageServerAuth(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageClientAuth(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageCodeSigning(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageEmailProtection(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageTimeStamping(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageExtendedKeyUsageOcspSigning(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsages(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	l := v.([]interface{})
	req := make([]interface{}, 0, len(l))
	for _, raw := range l {
		if raw == nil {
			continue
		}
		original := raw.(map[string]interface{})
		transformed := make(map[string]interface{})

		transformedObjectIdPath, err := expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsagesObjectIdPath(original["object_id_path"], d, config)
		if err != nil {
			return nil, err
		} else if val := reflect.ValueOf(transformedObjectIdPath); val.IsValid() && !tpgresource.IsEmptyValue(val) {
			transformed["objectIdPath"] = transformedObjectIdPath
		}

		req = append(req, transformed)
	}
	return req, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesKeyUsageUnknownExtendedKeyUsagesObjectIdPath(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesCaOptions(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	l := v.([]interface{})
	if len(l) == 0 || l[0] == nil {
		return nil, nil
	}
	raw := l[0]
	original := raw.(map[string]interface{})
	transformed := make(map[string]interface{})

	transformedIsCa, err := expandPrivatecaCertificateTemplatePredefinedValuesCaOptionsIsCa(original["is_ca"], d, config)
	if err != nil {
		return nil, err
	} else {
		transformed["isCa"] = transformedIsCa
	}

	transformedMaxIssuerPathLength, err := expandPrivatecaCertificateTemplatePredefinedValuesCaOptionsMaxIssuerPathLength(original["max_issuer_path_length"], d, config)
	if err != nil {
		return nil, err
	} else if val := reflect.ValueOf(transformedMaxIssuerPathLength); val.IsValid() && !tpgresource.IsEmptyValue(val) {
		transformed["maxIssuerPathLength"] = transformedMaxIssuerPathLength
	}

	return transformed, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesCaOptionsIsCa(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesCaOptionsMaxIssuerPathLength(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesPolicyIds(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	l := v.([]interface{})
	req := make([]interface{}, 0, len(l))
	for _, raw := range l {
		if raw == nil {
			continue
		}
		original := raw.(map[string]interface{})
		transformed := make(map[string]interface{})

		transformedObjectIdPath, err := expandPrivatecaCertificateTemplatePredefinedValuesPolicyIdsObjectIdPath(original["object_id_path"], d, config)
		if err != nil {
			return nil, err
		} else if val := reflect.ValueOf(transformedObjectIdPath); val.IsValid() && !tpgresource.IsEmptyValue(val) {
			transformed["objectIdPath"] = transformedObjectIdPath
		}

		req = append(req, transformed)
	}
	return req, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesPolicyIdsObjectIdPath(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesAiaOcspServers(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesAdditionalExtensions(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	l := v.([]interface{})
	req := make([]interface{}, 0, len(l))
	for _, raw := range l {
		if raw == nil {
			continue
		}
		original := raw.(map[string]interface{})
		transformed := make(map[string]interface{})

		transformedObjectId, err := expandPrivatecaCertificateTemplatePredefinedValuesAdditionalExtensionsObjectId(original["object_id"], d, config)
		if err != nil {
			return nil, err
		} else if val := reflect.ValueOf(transformedObjectId); val.IsValid() && !tpgresource.IsEmptyValue(val) {
			transformed["objectId"] = transformedObjectId
		}

		transformedCritical, err := expandPrivatecaCertificateTemplatePredefinedValuesAdditionalExtensionsCritical(original["critical"], d, config)
		if err != nil {
			return nil, err
		} else {
			transformed["critical"] = transformedCritical
		}

		transformedValue, err := expandPrivatecaCertificateTemplatePredefinedValuesAdditionalExtensionsValue(original["value"], d, config)
		if err != nil {
			return nil, err
		} else if val := reflect.ValueOf(transformedValue); val.IsValid() && !tpgresource.IsEmptyValue(val) {
			transformed["value"] = transformedValue
		}

		req = append(req, transformed)
	}
	return req, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesAdditionalExtensionsObjectId(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	l := v.([]interface{})
	if len(l) == 0 || l[0] == nil {
		return nil, nil
	}
	raw := l[0]
	original := raw.(map[string]interface{})
	transformed := make(map[string]interface{})

	transformedObjectIdPath, err := expandPrivatecaCertificateTemplatePredefinedValuesAdditionalExtensionsObjectIdObjectIdPath(original["object_id_path"], d, config)
	if err != nil {
		return nil, err
	} else if val := reflect.ValueOf(transformedObjectIdPath); val.IsValid() && !tpgresource.IsEmptyValue(val) {
		transformed["objectIdPath"] = transformedObjectIdPath
	}

	return transformed, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesAdditionalExtensionsObjectIdObjectIdPath(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesAdditionalExtensionsCritical(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplatePredefinedValuesAdditionalExtensionsValue(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplateIdentityConstraints(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	l := v.([]interface{})
	if len(l) == 0 || l[0] == nil {
		return nil, nil
	}
	raw := l[0]
	original := raw.(map[string]interface{})
	transformed := make(map[string]interface{})

	transformedCelExpression, err := expandPrivatecaCertificateTemplateIdentityConstraintsCelExpression(original["cel_expression"], d, config)
	if err != nil {
		return nil, err
	} else if val := reflect.ValueOf(transformedCelExpression); val.IsValid() && !tpgresource.IsEmptyValue(val) {
		transformed["celExpression"] = transformedCelExpression
	}

	transformedAllowSubjectPassthrough, err := expandPrivatecaCertificateTemplateIdentityConstraintsAllowSubjectPassthrough(original["allow_subject_passthrough"], d, config)
	if err != nil {
		return nil, err
	} else {
		transformed["allowSubjectPassthrough"] = transformedAllowSubjectPassthrough
	}

	transformedAllowSubjectAltNamesPassthrough, err := expandPrivatecaCertificateTemplateIdentityConstraintsAllowSubjectAltNamesPassthrough(original["allow_subject_alt_names_passthrough"], d, config)
	if err != nil {
		return nil, err
	} else {
		transformed["allowSubjectAltNamesPassthrough"] = transformedAllowSubjectAltNamesPassthrough
	}

	return transformed, nil
}

func expandPrivatecaCertificateTemplateIdentityConstraintsCelExpression(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	l := v.([]interface{})
	if len(l) == 0 || l[0] == nil {
		return nil, nil
	}
	raw := l[0]
	original := raw.(map[string]interface{})
	transformed := make(map[string]interface{})

	transformedExpression, err := expandPrivatecaCertificateTemplateIdentityConstraintsCelExpressionExpression(original["expression"], d, config)
	if err != nil {
		return nil, err
	} else if val := reflect.ValueOf(transformedExpression); val.IsValid() && !tpgresource.IsEmptyValue(val) {
		transformed["expression"] = transformedExpression
	}

	transformedTitle, err := expandPrivatecaCertificateTemplateIdentityConstraintsCelExpressionTitle(original["title"], d, config)
	if err != nil {
		return nil, err
	} else if val := reflect.ValueOf(transformedTitle); val.IsValid() && !tpgresource.IsEmptyValue(val) {
		transformed["title"] = transformedTitle
	}

	transformedDescription, err := expandPrivatecaCertificateTemplateIdentityConstraintsCelExpressionDescription(original["description"], d, config)
	if err != nil {
		return nil, err
	} else if val := reflect.ValueOf(transformedDescription); val.IsValid() && !tpgresource.IsEmptyValue(val) {
		transformed["description"] = transformedDescription
	}

	transformedLocation, err := expandPrivatecaCertificateTemplateIdentityConstraintsCelExpressionLocation(original["location"], d, config)
	if err != nil {
		return nil, err
	} else if val := reflect.ValueOf(transformedLocation); val.IsValid() && !tpgresource.IsEmptyValue(val) {
		transformed["location"] = transformedLocation
	}

	return transformed, nil
}

func expandPrivatecaCertificateTemplateIdentityConstraintsCelExpressionExpression(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplateIdentityConstraintsCelExpressionTitle(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplateIdentityConstraintsCelExpressionDescription(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplateIdentityConstraintsCelExpressionLocation(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplateIdentityConstraintsAllowSubjectPassthrough(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplateIdentityConstraintsAllowSubjectAltNamesPassthrough(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplatePassthroughExtensions(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	l := v.([]interface{})
	if len(l) == 0 || l[0] == nil {
		return nil, nil
	}
	raw := l[0]
	original := raw.(map[string]interface{})
	transformed := make(map[string]interface{})

	transformedKnownExtensions, err := expandPrivatecaCertificateTemplatePassthroughExtensionsKnownExtensions(original["known_extensions"], d, config)
	if err != nil {
		return nil, err
	} else if val := reflect.ValueOf(transformedKnownExtensions); val.IsValid() && !tpgresource.IsEmptyValue(val) {
		transformed["knownExtensions"] = transformedKnownExtensions
	}

	transformedAdditionalExtensions, err := expandPrivatecaCertificateTemplatePassthroughExtensionsAdditionalExtensions(original["additional_extensions"], d, config)
	if err != nil {
		return nil, err
	} else if val := reflect.ValueOf(transformedAdditionalExtensions); val.IsValid() && !tpgresource.IsEmptyValue(val) {
		transformed["additionalExtensions"] = transformedAdditionalExtensions
	}

	return transformed, nil
}

func expandPrivatecaCertificateTemplatePassthroughExtensionsKnownExtensions(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplatePassthroughExtensionsAdditionalExtensions(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	l := v.([]interface{})
	req := make([]interface{}, 0, len(l))
	for _, raw := range l {
		if raw == nil {
			continue
		}
		original := raw.(map[string]interface{})
		transformed := make(map[string]interface{})

		transformedObjectIdPath, err := expandPrivatecaCertificateTemplatePassthroughExtensionsAdditionalExtensionsObjectIdPath(original["object_id_path"], d, config)
		if err != nil {
			return nil, err
		} else if val := reflect.ValueOf(transformedObjectIdPath); val.IsValid() && !tpgresource.IsEmptyValue(val) {
			transformed["objectIdPath"] = transformedObjectIdPath
		}

		req = append(req, transformed)
	}
	return req, nil
}

func expandPrivatecaCertificateTemplatePassthroughExtensionsAdditionalExtensionsObjectIdPath(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplateMaximumLifetime(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplateDescription(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
	return v, nil
}

func expandPrivatecaCertificateTemplateEffectiveLabels(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (map[string]string, error) {
	if v == nil {
		return map[string]string{}, nil
	}
	m := make(map[string]string)
	for k, val := range v.(map[string]interface{}) {
		m[k] = val.(string)
	}
	return m, nil
}