diff --git a/.changelog/5568.txt b/.changelog/5568.txt
new file mode 100644
index 00000000000..8ec013c0699
--- /dev/null
+++ b/.changelog/5568.txt
@@ -0,0 +1,3 @@
+```release-note:none
+
+```
diff --git a/google/resource_compute_firewall.go b/google/resource_compute_firewall.go
index 4bacf6f4f28..0fdce068df2 100644
--- a/google/resource_compute_firewall.go
+++ b/google/resource_compute_firewall.go
@@ -278,7 +278,8 @@ sourceTags may be set. If both properties are set, the firewall will
 apply to traffic that has source IP address within sourceRanges OR the
 source IP that belongs to a tag listed in the sourceTags property. The
 connection does not need to match both properties for the firewall to
-apply. Only IPv4 is supported.`,
+apply. Only IPv4 is supported. For INGRESS traffic, one of 'source_ranges',
+'source_tags' or 'source_service_accounts' is required.`,
 				Elem: &schema.Schema{
 					Type: schema.TypeString,
 				},
@@ -298,7 +299,8 @@ apply to traffic that has source IP address within sourceRanges OR the
 source IP belongs to an instance with service account listed in
 sourceServiceAccount. The connection does not need to match both
 properties for the firewall to apply. sourceServiceAccounts cannot be
-used at the same time as sourceTags or targetTags.`,
+used at the same time as sourceTags or targetTags. For INGRESS traffic,
+one of 'source_ranges', 'source_tags' or 'source_service_accounts' is required.`,
 				MaxItems: 10,
 				Elem: &schema.Schema{
 					Type: schema.TypeString,
@@ -317,7 +319,8 @@ address. One or both of sourceRanges and sourceTags may be set. If
 both properties are set, the firewall will apply to traffic that has
 source IP address within sourceRanges OR the source IP that belongs to
 a tag listed in the sourceTags property. The connection does not need
-to match both properties for the firewall to apply.`,
+to match both properties for the firewall to apply. For INGRESS traffic,
+one of 'source_ranges', 'source_tags' or 'source_service_accounts' is required.`,
 				Elem: &schema.Schema{
 					Type: schema.TypeString,
 				},
diff --git a/website/docs/r/compute_firewall.html.markdown b/website/docs/r/compute_firewall.html.markdown
index 98296a8a1c8..8fa10a50251 100644
--- a/website/docs/r/compute_firewall.html.markdown
+++ b/website/docs/r/compute_firewall.html.markdown
@@ -179,7 +179,8 @@ The following arguments are supported:
   apply to traffic that has source IP address within sourceRanges OR the
   source IP that belongs to a tag listed in the sourceTags property. The
   connection does not need to match both properties for the firewall to
-  apply. Only IPv4 is supported.
+  apply. Only IPv4 is supported. For INGRESS traffic, one of `source_ranges`,
+  `source_tags` or `source_service_accounts` is required.
 
 * `source_service_accounts` -
   (Optional)
@@ -193,7 +194,8 @@ The following arguments are supported:
   source IP belongs to an instance with service account listed in
   sourceServiceAccount. The connection does not need to match both
   properties for the firewall to apply. sourceServiceAccounts cannot be
-  used at the same time as sourceTags or targetTags.
+  used at the same time as sourceTags or targetTags. For INGRESS traffic,
+  one of `source_ranges`, `source_tags` or `source_service_accounts` is required.
 
 * `source_tags` -
   (Optional)
@@ -205,7 +207,8 @@ The following arguments are supported:
   both properties are set, the firewall will apply to traffic that has
   source IP address within sourceRanges OR the source IP that belongs to
   a tag listed in the sourceTags property. The connection does not need
-  to match both properties for the firewall to apply.
+  to match both properties for the firewall to apply. For INGRESS traffic,
+  one of `source_ranges`, `source_tags` or `source_service_accounts` is required.
 
 * `target_service_accounts` -
   (Optional)
diff --git a/website/docs/r/os_config_os_policy_assignment.html.markdown b/website/docs/r/os_config_os_policy_assignment.html.markdown
index 7ecb8a64c23..54379f23429 100644
--- a/website/docs/r/os_config_os_policy_assignment.html.markdown
+++ b/website/docs/r/os_config_os_policy_assignment.html.markdown
@@ -703,6 +703,24 @@ The `disruption_budget` block supports:
   (Optional)
   Specifies the relative value defined as a percentage, which will be multiplied by a reference value.
     
+The `source` block supports:
+    
+* `allow_insecure` -
+  (Optional)
+  Defaults to false. When false, files are subject to validations based on the file type: Remote: A checksum must be specified. Cloud Storage: An object generation number must be specified.
+    
+* `gcs` -
+  (Optional)
+  A Cloud Storage object.
+    
+* `local_path` -
+  (Optional)
+  A local path within the VM to use.
+    
+* `remote` -
+  (Optional)
+  A generic remote file.
+    
 - - -
 
 * `description` -
@@ -952,24 +970,6 @@ The `zypper` block supports:
   (Required)
   Required. A one word, unique name for this repository. This is the `repo id` in the zypper config file and also the `display_name` if `display_name` is omitted. This id is also used as the unique identifier when checking for GuestPolicy conflicts.
     
-The `file` block supports:
-    
-* `allow_insecure` -
-  (Optional)
-  Defaults to false. When false, files are subject to validations based on the file type: Remote: A checksum must be specified. Cloud Storage: An object generation number must be specified.
-    
-* `gcs` -
-  (Optional)
-  A Cloud Storage object.
-    
-* `local_path` -
-  (Optional)
-  A local path within the VM to use.
-    
-* `remote` -
-  (Optional)
-  A generic remote file.
-    
 The `gcs` block supports:
     
 * `bucket` -