diff --git a/mmv1/products/compute/BackendService.yaml b/mmv1/products/compute/BackendService.yaml
index d7c05f3d2056..e1a129b7d088 100644
--- a/mmv1/products/compute/BackendService.yaml
+++ b/mmv1/products/compute/BackendService.yaml
@@ -56,6 +56,13 @@ examples:
     vars:
       backend_service_name: 'backend-service'
       http_health_check_name: 'health-check'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'backend_service_external_iap'
+    primary_resource_id: 'default'
+    vars:
+      backend_service_name: 'tf-test-backend-service-external'
+    ignore_read_extra:
+      - 'iap.0.oauth2_client_secret'
   - !ruby/object:Provider::Terraform::Examples
     name: 'backend_service_cache_simple'
     primary_resource_id: 'default'
diff --git a/mmv1/products/compute/RegionBackendService.yaml b/mmv1/products/compute/RegionBackendService.yaml
index e89d609a731b..7647541c16ae 100644
--- a/mmv1/products/compute/RegionBackendService.yaml
+++ b/mmv1/products/compute/RegionBackendService.yaml
@@ -52,6 +52,13 @@ examples:
     vars:
       region_backend_service_name: 'region-service'
       health_check_name: 'rbs-health-check'
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'region_backend_service_external_iap'
+    primary_resource_id: 'default'
+    vars:
+      region_backend_service_name: 'tf-test-region-service-external'
+    ignore_read_extra:
+      - 'iap.0.oauth2_client_secret'
   - !ruby/object:Provider::Terraform::Examples
     name: 'region_backend_service_cache'
     primary_resource_id: 'default'
diff --git a/mmv1/templates/terraform/encoders/backend_service.go.erb b/mmv1/templates/terraform/encoders/backend_service.go.erb
index fa15cb1e70e9..66626bf17fe3 100644
--- a/mmv1/templates/terraform/encoders/backend_service.go.erb
+++ b/mmv1/templates/terraform/encoders/backend_service.go.erb
@@ -23,8 +23,6 @@ iapVal := obj["iap"]
 if iapVal == nil {
 	data := map[string]interface{}{}
 	data["enabled"] = false
-	data["oauth2ClientId"] = ""
-	data["oauth2ClientSecret"] = ""
 	obj["iap"] = data
 } else {
 	iap := iapVal.(map[string]interface{})
diff --git a/mmv1/templates/terraform/encoders/region_backend_service.go.erb b/mmv1/templates/terraform/encoders/region_backend_service.go.erb
index fe1e25657a1f..76d396b5a0c5 100644
--- a/mmv1/templates/terraform/encoders/region_backend_service.go.erb
+++ b/mmv1/templates/terraform/encoders/region_backend_service.go.erb
@@ -23,8 +23,6 @@ iapVal := obj["iap"]
 if iapVal == nil {
 	data := map[string]interface{}{}
 	data["enabled"] = false
-	data["oauth2ClientId"] = ""
-	data["oauth2ClientSecret"] = ""
 	obj["iap"] = data
 } else {
 	iap := iapVal.(map[string]interface{})
diff --git a/mmv1/templates/terraform/examples/backend_service_external_iap.tf.erb b/mmv1/templates/terraform/examples/backend_service_external_iap.tf.erb
new file mode 100644
index 000000000000..1679fa7c39e3
--- /dev/null
+++ b/mmv1/templates/terraform/examples/backend_service_external_iap.tf.erb
@@ -0,0 +1,9 @@
+resource "google_compute_backend_service" "<%= ctx[:primary_resource_id] %>" {
+  name                  = "<%= ctx[:vars]['backend_service_name'] %>"
+  protocol              = "HTTP"
+  load_balancing_scheme = "EXTERNAL"
+  iap {
+    oauth2_client_id     = "abc"
+    oauth2_client_secret = "xyz"
+  }
+}
diff --git a/mmv1/templates/terraform/examples/region_backend_service_external_iap.tf.erb b/mmv1/templates/terraform/examples/region_backend_service_external_iap.tf.erb
new file mode 100644
index 000000000000..ec9ca33f00b0
--- /dev/null
+++ b/mmv1/templates/terraform/examples/region_backend_service_external_iap.tf.erb
@@ -0,0 +1,10 @@
+resource "google_compute_region_backend_service" "<%= ctx[:primary_resource_id] %>" {
+  name                  = "<%= ctx[:vars]['region_backend_service_name'] %>"
+  region                = "us-central1"
+  protocol              = "HTTP"
+  load_balancing_scheme = "EXTERNAL"
+  iap {
+    oauth2_client_id     = "abc"
+    oauth2_client_secret = "xyz"
+  }
+}