diff --git a/edgecenter/resource_edgecenter_securitygroup.go b/edgecenter/resource_edgecenter_securitygroup.go
index a416fd8..d2ab0d7 100644
--- a/edgecenter/resource_edgecenter_securitygroup.go
+++ b/edgecenter/resource_edgecenter_securitygroup.go
@@ -86,7 +86,6 @@ func resourceSecurityGroup() *schema.Resource {
 			"metadata_map": {
 				Type:        schema.TypeMap,
 				Optional:    true,
-				Computed:    true,
 				Description: "A map containing metadata, for example tags.",
 				Elem: &schema.Schema{
 					Type: schema.TypeString,
diff --git a/edgecenter/resource_edgecenter_snapshot.go b/edgecenter/resource_edgecenter_snapshot.go
index 3e8b36a..95358a3 100644
--- a/edgecenter/resource_edgecenter_snapshot.go
+++ b/edgecenter/resource_edgecenter_snapshot.go
@@ -98,11 +98,31 @@ func resourceSnapshot() *schema.Resource {
 			"metadata": {
 				Type:     schema.TypeMap,
 				Optional: true,
-				Computed: true,
 				Elem: &schema.Schema{
 					Type: schema.TypeString,
 				},
 			},
+			"metadata_read_only": {
+				Type:        schema.TypeList,
+				Computed:    true,
+				Description: `A list of read-only metadata items, e.g. tags.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"key": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"value": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"read_only": {
+							Type:     schema.TypeBool,
+							Computed: true,
+						},
+					},
+				},
+			},
 			"last_updated": {
 				Type:        schema.TypeString,
 				Optional:    true,
@@ -164,7 +184,13 @@ func resourceSnapshotRead(ctx context.Context, d *schema.ResourceData, m interfa
 	d.Set("volume_id", snapshot.VolumeID)
 	d.Set("region_id", snapshot.RegionID)
 	d.Set("project_id", snapshot.ProjectID)
-	if err := d.Set("metadata", snapshot.Metadata); err != nil {
+
+	metadata, metadataReadOnly := separateMetadata(snapshot.Metadata)
+
+	if err := d.Set("metadata", metadata); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := d.Set("metadata_read_only", metadataReadOnly); err != nil {
 		return diag.FromErr(err)
 	}
 
diff --git a/edgecenter/utils_snapshot.go b/edgecenter/utils_snapshot.go
new file mode 100644
index 0000000..a2780b8
--- /dev/null
+++ b/edgecenter/utils_snapshot.go
@@ -0,0 +1,41 @@
+package edgecenter
+
+type SnapshotMetadata = map[string]interface{}
+
+type SnapshotReadOnlyMetadata = []map[string]interface{}
+
+var snapshotReadOnlyTags = map[string]struct{}{
+	"bootable":    {},
+	"task_id":     {},
+	"volume_name": {},
+	"volume_type": {},
+}
+
+// separateMetadata takes a map of string key-value pairs (md) and separates it into two distinct collections
+// Parameters:
+// - md: A map of string key-value pairs representing metadata to be separated.
+//
+// Returns:
+// - SnapshotMetadata: A map containing metadata that is mutable.
+// - SnapshotReadOnlyMetadata: A slice containing metadata that is read-only.
+func separateMetadata(md map[string]string) (SnapshotMetadata, SnapshotReadOnlyMetadata) {
+	metadata := make(SnapshotMetadata)
+	metadataReadOnly := make(SnapshotReadOnlyMetadata, 0, len(md))
+
+	for k, v := range md {
+		if _, ok := snapshotReadOnlyTags[k]; ok {
+			metadataReadOnly = append(
+				metadataReadOnly,
+				SnapshotMetadata{
+					"key":       k,
+					"value":     v,
+					"read_only": true,
+				})
+			continue
+		}
+
+		metadata[k] = v
+	}
+
+	return metadata, metadataReadOnly
+}