fixed firewall endpoint association example (#11373) (#19185)

[upstream:04619204a8be4d8022df8a847238415a2bdcb64a]

Signed-off-by: Modular Magician <[email protected]>

.changelog/11373.txt

@@ -0,0 +1,3 @@
+```release-note:none
+No release note needed for documentation and testing only change
+```

website/docs/r/network_security_firewall_endpoint_association.html.markdown

@@ -33,24 +33,39 @@ To get more information about FirewallEndpointAssociation, see:
     * [Create and associate firewall endpoints](https://cloud.google.com/firewall/docs/configure-firewall-endpoints)
     * [Firewall endpoint overview](https://cloud.google.com/firewall/docs/about-firewall-endpoints)
 
+~> **Warning:** If you are using User ADCs (Application Default Credentials) with this resource,
+you must specify a `billing_project_id` and set `user_project_override` to true
+in the provider configuration. Otherwise the ACM API will return a 403 error.
+Your account must have the `serviceusage.services.use` permission on the
+`billing_project_id` you defined.
+
 ## Example Usage - Network Security Firewall Endpoint Association Basic
 
 
 ```hcl
+resource "google_compute_network" "foobar" {
+  name                    = "tf-test-my-vpc%{randomSuffix}"
+  auto_create_subnetworks = false
+}
+
 resource "google_network_security_firewall_endpoint" "default" {
-  name        = "my-firewall-endpoint"
-  parent      = "organizations/123456789"
-  location    = "us-central1-a"
+  name               = "my-firewall-endpoint"
+  parent             = "organizations/123456789"
+  location           = "us-central1-a"
+  billing_project_id = "my-project-name"
 
   labels = {
     foo = "bar"
   }
 }
 
 resource "google_network_security_firewall_endpoint_association" "default_association" {
-  name        = "my-firewall-endpoint-association"
-  parent      = "projects/my-project-name"
-  location    = "us-central1-a"
+  name              = "my-firewall-endpoint-association"
+  parent            = "projects/my-project-name"
+  location          = "us-central1-a"
+  network           = google_compute_network.foobar.id
+  firewall_endpoint = google_network_security_firewall_endpoint.default.id
+  disabled          = false
 
   labels = {
     foo = "bar"