diff --git a/autogen/main/firewall.tf.tmpl b/autogen/main/firewall.tf.tmpl
index 6673932e6d..9e238f505f 100644
--- a/autogen/main/firewall.tf.tmpl
+++ b/autogen/main/firewall.tf.tmpl
@@ -46,6 +46,10 @@ resource "google_compute_firewall" "intra_egress" {
   allow { protocol = "sctp" }
   allow { protocol = "esp" }
   allow { protocol = "ah" }
+
+  depends_on = [
+    google_container_cluster.primary,
+  ]
 }
 
 
@@ -72,4 +76,8 @@ resource "google_compute_firewall" "master_ingress" {
     ports    = var.firewall_inbound_ports
   }
 
+  depends_on = [
+    google_container_cluster.primary,
+  ]
+
 }
diff --git a/firewall.tf b/firewall.tf
index 943ed2911a..0b756b5d35 100644
--- a/firewall.tf
+++ b/firewall.tf
@@ -46,6 +46,10 @@ resource "google_compute_firewall" "intra_egress" {
   allow { protocol = "sctp" }
   allow { protocol = "esp" }
   allow { protocol = "ah" }
+
+  depends_on = [
+    google_container_cluster.primary,
+  ]
 }
 
 
@@ -72,4 +76,8 @@ resource "google_compute_firewall" "master_ingress" {
     ports    = var.firewall_inbound_ports
   }
 
+  depends_on = [
+    google_container_cluster.primary,
+  ]
+
 }
diff --git a/modules/beta-private-cluster-update-variant/firewall.tf b/modules/beta-private-cluster-update-variant/firewall.tf
index 943ed2911a..0b756b5d35 100644
--- a/modules/beta-private-cluster-update-variant/firewall.tf
+++ b/modules/beta-private-cluster-update-variant/firewall.tf
@@ -46,6 +46,10 @@ resource "google_compute_firewall" "intra_egress" {
   allow { protocol = "sctp" }
   allow { protocol = "esp" }
   allow { protocol = "ah" }
+
+  depends_on = [
+    google_container_cluster.primary,
+  ]
 }
 
 
@@ -72,4 +76,8 @@ resource "google_compute_firewall" "master_ingress" {
     ports    = var.firewall_inbound_ports
   }
 
+  depends_on = [
+    google_container_cluster.primary,
+  ]
+
 }
diff --git a/modules/beta-private-cluster/firewall.tf b/modules/beta-private-cluster/firewall.tf
index 943ed2911a..0b756b5d35 100644
--- a/modules/beta-private-cluster/firewall.tf
+++ b/modules/beta-private-cluster/firewall.tf
@@ -46,6 +46,10 @@ resource "google_compute_firewall" "intra_egress" {
   allow { protocol = "sctp" }
   allow { protocol = "esp" }
   allow { protocol = "ah" }
+
+  depends_on = [
+    google_container_cluster.primary,
+  ]
 }
 
 
@@ -72,4 +76,8 @@ resource "google_compute_firewall" "master_ingress" {
     ports    = var.firewall_inbound_ports
   }
 
+  depends_on = [
+    google_container_cluster.primary,
+  ]
+
 }
diff --git a/modules/beta-public-cluster/firewall.tf b/modules/beta-public-cluster/firewall.tf
index 943ed2911a..0b756b5d35 100644
--- a/modules/beta-public-cluster/firewall.tf
+++ b/modules/beta-public-cluster/firewall.tf
@@ -46,6 +46,10 @@ resource "google_compute_firewall" "intra_egress" {
   allow { protocol = "sctp" }
   allow { protocol = "esp" }
   allow { protocol = "ah" }
+
+  depends_on = [
+    google_container_cluster.primary,
+  ]
 }
 
 
@@ -72,4 +76,8 @@ resource "google_compute_firewall" "master_ingress" {
     ports    = var.firewall_inbound_ports
   }
 
+  depends_on = [
+    google_container_cluster.primary,
+  ]
+
 }
diff --git a/modules/private-cluster-update-variant/firewall.tf b/modules/private-cluster-update-variant/firewall.tf
index 943ed2911a..0b756b5d35 100644
--- a/modules/private-cluster-update-variant/firewall.tf
+++ b/modules/private-cluster-update-variant/firewall.tf
@@ -46,6 +46,10 @@ resource "google_compute_firewall" "intra_egress" {
   allow { protocol = "sctp" }
   allow { protocol = "esp" }
   allow { protocol = "ah" }
+
+  depends_on = [
+    google_container_cluster.primary,
+  ]
 }
 
 
@@ -72,4 +76,8 @@ resource "google_compute_firewall" "master_ingress" {
     ports    = var.firewall_inbound_ports
   }
 
+  depends_on = [
+    google_container_cluster.primary,
+  ]
+
 }
diff --git a/modules/private-cluster/firewall.tf b/modules/private-cluster/firewall.tf
index 943ed2911a..0b756b5d35 100644
--- a/modules/private-cluster/firewall.tf
+++ b/modules/private-cluster/firewall.tf
@@ -46,6 +46,10 @@ resource "google_compute_firewall" "intra_egress" {
   allow { protocol = "sctp" }
   allow { protocol = "esp" }
   allow { protocol = "ah" }
+
+  depends_on = [
+    google_container_cluster.primary,
+  ]
 }
 
 
@@ -72,4 +76,8 @@ resource "google_compute_firewall" "master_ingress" {
     ports    = var.firewall_inbound_ports
   }
 
+  depends_on = [
+    google_container_cluster.primary,
+  ]
+
 }