diff --git a/third_party/terraform/resources/resource_app_engine_application.go b/third_party/terraform/resources/resource_app_engine_application.go
index 5163480bb1a0..4cfeb39307d2 100644
--- a/third_party/terraform/resources/resource_app_engine_application.go
+++ b/third_party/terraform/resources/resource_app_engine_application.go
@@ -38,15 +38,18 @@ func resourceAppEngineApplication() *schema.Resource {
 				Computed:     true,
 				ForceNew:     true,
 				ValidateFunc: validateProjectID(),
+				Description:  `The project ID to create the application under.`,
 			},
 			"auth_domain": {
-				Type:     schema.TypeString,
-				Optional: true,
-				Computed: true,
+				Type:        schema.TypeString,
+				Optional:    true,
+				Computed:    true,
+				Description: `The domain to authenticate users with when using App Engine's User API.`,
 			},
 			"location_id": {
-				Type:     schema.TypeString,
-				Required: true,
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: `The location to serve the app from.`,
 			},
 			"serving_status": {
 				Type:     schema.TypeString,
@@ -57,69 +60,82 @@ func resourceAppEngineApplication() *schema.Resource {
 					"USER_DISABLED",
 					"SYSTEM_DISABLED",
 				}, false),
-				Computed: true,
+				Computed:    true,
+				Description: `The serving status of the app.`,
 			},
 			"feature_settings": {
-				Type:     schema.TypeList,
-				Optional: true,
-				Computed: true,
-				MaxItems: 1,
-				Elem:     appEngineApplicationFeatureSettingsResource(),
+				Type:        schema.TypeList,
+				Optional:    true,
+				Computed:    true,
+				MaxItems:    1,
+				Description: `A block of optional settings to configure specific App Engine features:`,
+				Elem:        appEngineApplicationFeatureSettingsResource(),
 			},
 			"name": {
-				Type:     schema.TypeString,
-				Computed: true,
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: `Unique name of the app.`,
 			},
 			"app_id": {
-				Type:     schema.TypeString,
-				Computed: true,
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: `Identifier of the app.`,
 			},
 			"url_dispatch_rule": {
-				Type:     schema.TypeList,
-				Computed: true,
-				Elem:     appEngineApplicationURLDispatchRuleResource(),
+				Type:        schema.TypeList,
+				Computed:    true,
+				Description: `A list of dispatch rule blocks. Each block has a domain, path, and service field.`,
+				Elem:        appEngineApplicationURLDispatchRuleResource(),
 			},
 			"code_bucket": {
-				Type:     schema.TypeString,
-				Computed: true,
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: `The GCS bucket code is being stored in for this app.`,
 			},
 			"default_hostname": {
-				Type:     schema.TypeString,
-				Computed: true,
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: `The default hostname for this app.`,
 			},
 			"default_bucket": {
-				Type:     schema.TypeString,
-				Computed: true,
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: `The GCS bucket content is being stored in for this app.`,
 			},
 			"gcr_domain": {
-				Type:     schema.TypeString,
-				Computed: true,
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: `The GCR domain used for storing managed Docker images for this app.`,
 			},
 			"iap": {
 				Type:        schema.TypeList,
 				Optional:    true,
-				Description: `Settings for enabling Cloud Identity Aware Proxy`,
 				MaxItems:    1,
+				Description: `Settings for enabling Cloud Identity Aware Proxy`,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"enabled": {
-							Type:     schema.TypeBool,
-							Optional: true,
-							Default:  false,
+							Type:        schema.TypeBool,
+							Optional:    true,
+							Default:     false,
+							Description: `Adapted for use with the app`,
 						},
 						"oauth2_client_id": {
-							Type:     schema.TypeString,
-							Required: true,
+							Type:        schema.TypeString,
+							Required:    true,
+							Description: `OAuth2 client ID to use for the authentication flow.`,
 						},
 						"oauth2_client_secret": {
-							Type:      schema.TypeString,
-							Required:  true,
-							Sensitive: true,
+							Type:        schema.TypeString,
+							Required:    true,
+							Sensitive:   true,
+							Description: `OAuth2 client secret to use for the authentication flow. The SHA-256 hash of the value is returned in the oauth2ClientSecretSha256 field.`,
 						},
 						"oauth2_client_secret_sha256": {
-							Type:      schema.TypeString,
-							Computed:  true,
-							Sensitive: true,
+							Type:        schema.TypeString,
+							Computed:    true,
+							Sensitive:   true,
+							Description: `Hex-encoded SHA-256 hash of the client secret.`,
 						},
 					},
 				},