diff --git a/.changelog/9689.txt b/.changelog/9689.txt
new file mode 100644
index 00000000000..9f00d9277af
--- /dev/null
+++ b/.changelog/9689.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+composer: added fields `enable_private_environment` and `enable_private_builds_only` to `google_composer_environment`
+```
diff --git a/google/services/composer/resource_composer_environment.go b/google/services/composer/resource_composer_environment.go
index cde5043a054..dcbb120fe73 100644
--- a/google/services/composer/resource_composer_environment.go
+++ b/google/services/composer/resource_composer_environment.go
@@ -2485,3 +2485,8 @@ func versionsEqual(old, new string) (bool, error) {
 	}
 	return o.Equal(n), nil
 }
+
+func isComposer3(d *schema.ResourceData, config *transport_tpg.Config) bool {
+	image_version := d.Get("config.0.software_config.0.image_version").(string)
+	return strings.Contains(image_version, "composer-3")
+}
diff --git a/website/docs/r/composer_environment.html.markdown b/website/docs/r/composer_environment.html.markdown
index 2e2737c5aa6..65cda7387d3 100644
--- a/website/docs/r/composer_environment.html.markdown
+++ b/website/docs/r/composer_environment.html.markdown
@@ -282,6 +282,15 @@ The following arguments are supported:
   (Optional)
   The configuration used for the Private IP Cloud Composer environment. Structure is [documented below](#nested_private_environment_config).
 
+* `enable_private_environment` -
+  (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html), Cloud Composer 3 only)
+  If true, a private Composer environment will be created.
+
+* `enable_private_builds_only` -
+  (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html), Cloud Composer 3 only)
+  If true, builds performed during operations that install Python packages have only private connectivity to Google services.
+  If false, the builds also have access to the internet.
+
 * `web_server_network_access_control` -
   The network-level access control policy for the Airflow web server.
   If unspecified, no network-level access restrictions are applied.