list(object({
    raw_key                 = optional(string), # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
    sha256                  = optional(string), # The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
    kms_key_self_link       = optional(string), # The self link of the encryption key used to encrypt the disk. Also called KmsKeyName in the cloud console
    kms_key_service_account = optional(string), # The service account used for the encryption request for the given KMS key.
  }))

list(object({
    image = string, # source image

    # Optional image encryption
    raw_key                 = optional(string), # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
    sha256                  = optional(string), # The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
    kms_key_self_link       = optional(string), # The self link of the encryption key used to encrypt the disk. Also called KmsKeyName in the cloud console
    kms_key_service_account = optional(string), # The service account used for the encryption request for the given KMS key.
  }))

list(object({
    snapshot = string, # source snapshot

    # Optional image encryption
    raw_key                 = optional(string), # Specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648 base64 to either encrypt or decrypt this resource.
    sha256                  = optional(string), # The RFC 4648 base64 encoded SHA-256 hash of the customer-supplied encryption key that protects this resource.
    kms_key_self_link       = optional(string), # The self link of the encryption key used to encrypt the disk. Also called KmsKeyName in the cloud console
    kms_key_service_account = optional(string), # The service account used for the encryption request for the given KMS key.
  }))

{
  "SUNDAY": "00:00",
  "WEDNESDAY": "00:00"
}

object({
    max_retention_days    = number           # Maximum age of the snapshot that is allowed to be kept.
    on_source_disk_delete = optional(string) # Specifies the behavior to apply to scheduled snapshots when the source disk is deleted. Default value is KEEP_AUTO_SNAPSHOTS. Possible values are KEEP_AUTO_SNAPSHOTS and APPLY_RETENTION_POLICY.
  })

{
  "max_retention_days": 14,
  "on_source_disk_delete": "KEEP_AUTO_SNAPSHOTS"
}